Dementia bluffs live memory analysis

Powered by SC Magazine
 

Forensics fooled.

View larger image View larger image View larger image

See all pictures here »

A security researcher has released a tool that hides a computer's memory to defeat live digital forensics efforts.

Dementia is a proof of concept tool for hiding various OS artifacts from the memory or crash dumps acquired by the memory acquisition software.

Creator Luka Milković told SC ahead of the Chaos Communication Congress last month the method used was an extension of existing research into disk anti-forensics. 

 

"It's intention is to raise awareness for (or to remind) the forensic professionals that memory forensics, any other live forensic process and forensic applications have potential pitfalls and problems." 
It could hide operating system objects like processes and threads from a host of forensic analysis applications including Volatility and Memoryze.

The Infigo security consultant said two fundamental problems with acquisition tools are that they are usually run on machines not controlled by the handler, meaning attackers can have a kernel-level visibility and control over the system. A further complication was that tools must dump their data either on a local or external disk, or on a networked machine.

"Although these issues are well known, many incident handlers and forensic experts are still using those methods because the alternatives are rare, difficult to use in practice or expensive," Milković said.

By combining these two issues and controlling the process of dump writing, attackers can defeat most live memory acquisition methods used by forensics experts and incident handlers.

Previous recent research into memory anti-forensic techniques and methods made it difficult to impossible to hide operating system objects like network connections and processes.

The research included methods that completely blocked the acquisition process and were therefore easy to detect, thwarted the acquisition and analysis processes by tricking the memory manager and modifying the kernel structures.

Copyright © SC Magazine, Australia


 
 
 
Top Stories
Tech SWAT teams kicking down the digital door
From dam engineers in Ecuador to Sydney light-rail gurus, Cardno's global CIO Karen Wagner is linking up her widespread organisation.
 
Brandis hits telcos with new security reforms
Civil penalties for those who don't comply.
 
When does an insurance company turn into a software vendor?
The lines are blurring for ASX-listed Cover-More Group.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  86%
 
Somewhat
  12%
TOTAL VOTES: 520

Vote