Respect for reps Computerised memory dump Bonfire night bonus

I2P is an anonymous P2P distributed communication layer used to send messages to each other anonymously and safely. It is built on top of the internet and can be considered as an internet within the internet. Even though I2P is developed with an intention to create censorship resistant environment for the free flow of information, it is misused for illegal activities now a days. The possible misuses are less known among law enforcement agencies and existing industry approved software programs have no detection functionality for I2P. Because of the increased use of I2P in criminal purposes, there is a need for methods and tools to acquire and analyze digital evidence related to I2P. We conducted a detailed live memory dump analysis in order to find out the I2P related artifacts from a host machine. Furthermore, we propose a tool that will analyze the memory dump and system local files to find out the I2P related artifacts and provide a detailed report to the investigator.

Download Full-text

AutoProfile: Towards Automated Profile Generation for Memory Analysis

ACM Transactions on Privacy and Security ◽

10.1145/3485471 ◽

2022 ◽

Vol 25 (1) ◽

pp. 1-26

Author(s):

Fabio Pagani ◽

Davide Balzarotti

Keyword(s):

Computer Security ◽

Digital Forensics ◽

Public Information ◽

Forensic Analysis ◽

Binary Analysis ◽

Analysis Techniques ◽

Memory Forensics ◽

Novel Approach ◽

Viable Solution ◽

Memory Dump

Despite a considerable number of approaches that have been proposed to protect computer systems, cyber-criminal activities are on the rise and forensic analysis of compromised machines and seized devices is becoming essential in computer security. This article focuses on memory forensics, a branch of digital forensics that extract artifacts from the volatile memory. In particular, this article looks at a key ingredient required by memory forensics frameworks: a precise model of the OS kernel under analysis, also known as profile . By using the information stored in the profile, memory forensics tools are able to bridge the semantic gap and interpret raw bytes to extract evidences from a memory dump. A big problem with profile-based solutions is that custom profiles must be created for each and every system under analysis. This is especially problematic for Linux systems, because profiles are not generic : they are strictly tied to a specific kernel version and to the configuration used to build the kernel. Failing to create a valid profile means that an analyst cannot unleash the true power of memory forensics and is limited to primitive carving strategies. For this reason, in this article we present a novel approach that combines source code and binary analysis techniques to automatically generate a profile from a memory dump, without relying on any non-public information. Our experiments show that this is a viable solution and that profiles reconstructed by our framework can be used to run many plugins, which are essential for a successful forensics investigation.

Download Full-text

Extracting Cryptographic Keys from .NET Applications

Semiconductor Science and Information Devices ◽

10.30564/ssid.v3i2.3347 ◽

2021 ◽

Vol 3 (2) ◽

Author(s):

Shaun Mc Brearty ◽

William Farrelly ◽

Kevin Curran

Keyword(s):

Prior Knowledge ◽

Main Memory ◽

Basic Knowledge ◽

Proof Of Concept ◽

Software Applications ◽

Cryptographic Keys ◽

Cryptographic Key ◽

Memory Dump ◽

Concept Application ◽

Net Framework

In the absence of specialized encryption hardware,cryptographic operations must be performed in main memory.As such,it is common place for cyber criminals to examine the content of main memory with a view to retrieving high-value data in plaintext form and/or the associated decryption key.In this paper,the author presents a number of simple methods for identifying and extracting cryptographic keys from memory dumps of software applications that utilize the Microsoft .NET Framework,as well as sourcecode level countermeasures to protect against same.Given the EXE file of an application and a basic knowledge of the cryptographic libraries utilized in the .NET Framework,the author shows how to create a memory dump of a running application and how to extract cryptographic keys from same using WinDBG - without any prior knowledge of the cryptographic key utilized.Whilst the proof-of-concept application utilized as part of this paper uses an implementation of the DES cipher,it should be noted that the steps shown can be utilized against all three generations of symmetric and asymmetric ciphers supported within the .NET Framework.

Download Full-text