In the world of cryptocurrency-related malware, mining Monero (XMR) is a growing threat for organizations. In this paper we will explain why Monero is appealing for malicious actors, and how to leverage publicly available sources for hunting of Monero-related activities. We will heavily rely on automation and other open-source projects to achieve our objectives.
As one of the widest spread database systems in the world, SQLite is used on an immense number of computer systems. This is especially true for mobile devices, such as smartphones. As a consequence, data stored by SQLite gains significant relevance in many forensic investigations. Different tools are available for the (forensic) analysis of the underlying database files. However, appropriate collections of databases, that can be leveraged by the forensic community for purposes like testing, validating, comparing and improving such tools, are still missing. A first collection specific to SQLite has been made available with the SQLite Forensic Corpus in 2018. In this work, we enhance this corpus by anti-forensic aspects and present a collection of specifically crafted databases that do not necessarily conform to the SQLite file format specification. We use these databases to evaluate a selection of tools available for the analysis of SQLite - and thereby challenge their (forensic) extraction and recovery routines. Finally, we present the results of our analyses and derive some claims regarding the functionality of forensic tools in general.
The investigation of log files is an essential part of any form of IT incident management and IT forensics. In situations where logs can be manipulated, logging approaches that offer security guarantees are advisable. Within a formal system model, we describe several well-known existing approaches to secure logging and compare them with each other. Furthermore, we formalize the security requirements of secure logging approaches and systematically investigate which combinations of guarantees are achieved by the published approached under increasingly stronger attacker models.
This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with approxis, an approximate disassembler. Recent literature claims that approximate matching techniques are slow and hardly applicable to the field of memory forensics. Especially legitimate changes to executables in memory caused by the loader itself prevent the application of current bytewise approximate matching techniques. Our approach lowers the impact of modified code in memory and shows a good computational performance. During our experiments, we show how an investigator can leverage meaningful insights by combining data gained from a hard disk image and raw memory dumps with a practicability runtime performance. Lastly, our current implementation will be integrable into the Volatility memory forensics framework and we introduce new possibilities for providing data driven cross validation functions. Our current proof of concept implementation supports Linux based raw memory dumps.
This paper discusses the complexities of cases that involve Social Engineering to a full, or significantly large extend, and proposes alternative routes to investigators for collecting evidence. The largest problem in social engineering cases seems to be the admissibility of evidence and the large degree of plausible interpretations of the case argued in court. Due to this complexity, investigation for additional, admissible evidence to help bring the case to resolution is optimal. Behavioral reverse engineering is being recommended as an investigative option for the discovery of evidence from sloppy mistakes during the phase of planning a crime and the discovery of digital traces that will support the investigation. An example of this process is being provided: tracing back the phase of targeting victims and profiling. It is hoped, that investigators can use this knowledge to trace back the offender's channels of information, find potential sources of evidence, discover patterns, and more.
The IT-Security of cyber-physical systems is becoming a topic of increasing interest. With the development of new attack techniques against such cyber-physical systems there is an increased need of security, incident management and forensic methods to investigate and counter these threats. In general, incident management and forensic readiness in such non-traditional scenarios is hampered by a poor understanding (along with limited means of access) of all the potential data sources / traces and incident response mechanisms available. This work aims at increasing the understanding, and therefore the capability to perform incident response and forensic investigations, in non-traditional cyber-physical systems. The approach presented in this work is demonstrated in an automotive environment as one possible example of cyber-physical systems. It takes into account the broad array of data, which modern automotive systems collect. However, this data is well hidden from the consumer and independent incident manager/forensic investigator. By achieving transparency regarding this data, forensic capabilities are increased. Hence, this work introduces a concept to locate, acquire and identify (privacy-related) data stored inside modern cars. To (partially) implement the concept, a physical testbed for explorative research on data in modern vehicles is introduced. Based on this testbed, various data streams inside the vehicle were located and successfully identified allowing to investigate their implications in privacy related incidents and the forensic process.
To manage cybersecurity risks in practice, a simple yet effective method to assess suchs risks for individual systems is needed. With time-to-compromise (TTC), McQueen et al. (2005) introduced such a metric that measures the expected time that a system remains uncompromised given a specific threat landscape. Unlike other approaches that require complex system modeling to proceed, TTC combines simplicity with expressiveness and therefore has evolved into one of the most successful cybersecurity metrics in practice. We revisit TTC and identify several mathematical and methodological shortcomings which we address by embedding all aspects of the metric into the continuous domain and the possibility to incorporate information about vulnerability characteristics and other cyber threat intelligence into the model. We propose β-TTC, a formal extension of TTC which includes information from CVSS vectors as well as a continuous attacker skill based on a β-distribution. We show that our new metric (1) remains simple enough for practical use and (2) gives more realistic predictions than the original TTC by using data from a modern and productively used vulnerability database of a national CERT.
Despite the increasing number of cases of data theft (such as Equifax), the classic password is still in many places the sole security feature for user authentication. However, numerous possibilities for extending this now anachronistic form of access control already exist. One such option is the use of one-time passwords (OTP). These passwords are increasingly used for additional authentication (in addition to user name and password) of the respective user to service providers on the Internet and the applications that generate these are therefore referred to as so-called two-factor authentication apps (2FA apps). This paper investigates 16 such 2FA apps for the Android operating system and focuses on the extent to which these applications can offer a similar level of protection when compared to classical hardware tokens (e.g., YubiKey, SecurID-Authenticator).
P2P botnets represent a major threat and are responsible for a wide range of criminal activities. Fortunately, statistical algorithms that operate on NetFlow data have become a reliable means for their detection and can identify infected machines in large networks with high precision. However, many of these algorithms presume visibility on large parts of the communication within the botnet. In addition, so far only structured P2P botnets have been addressed, while especially more recent botnets shifted to unstructured P2P approaches. In this paper, we propose a detection algorithm based on the statistical concept of random walks and test it on real-world graph data of unstructured P2P botnets. Our evaluation results indicate that our algorithm yields high-precision results of about 90% at significantly reduced visibility on bots and their communication. Transferred to an Internet-wide scope, this is achieved when NetFlow data includes at least 5% of the bots and 10% of their communication links.
The field of memory forensics is getting more important in forensic investigations for obtaining valuable data of a running system. Besides kernel artifacts, there might be also plenty of interesting data in the heap of a user space process, but unfortunately, that area has not yet received the attention it deserves in the forensic field. This paper shows that the heap of user applications may also be a rich source of information including data like credentials that can be helpful in a forensic investigation. With the help of the HeapAnalysis plugins, previously published by Block, we examined the heap of selected Linux userland software and managed to identify data of interest and also certain application-internal structures, which link those data snippets together. The result of our analysis is a set of plugins for the Rekall framework, enabling an investigator to automatically extract process-related information such as login credentials, command history and file information for those applications.
Over the past years malicious software has evolved to a persistent threat on all major computer platforms. Due to the high number of new threats which are released every day security researchers have developed automatic systems to analyze and classify unknown pieces of software. While these techniques are technically mature on the Windows platform they still have to be improved on many other platforms such as Linux and Mac OS X. As the process of malware analysis is very similar on all platforms we have developed a platform independent framework to easily implement malware analysis on a new platform. This paper will cover our experience with malware analysis and we will show our generic approach, which can be applied on any platform.
The growth of Android in the mobile sector and the interest to investigate these devices from a forensic point of view has rapidly increased. Many companies have security problems with mobile devices in their own IT infrastructure. To respond to these incidents, it is important to have professional trained staff. Furthermore, it is necessary to further train their existing employees in the practical applications of mobile forensics owing to the fact that a lot of companies are trusted with very sensitive data. Inspired by these facts, this paper addresses training approaches and practical exercises to investigate Android mobile devices.
As hard disk encryption, RAM disks, persistent data avoidance technology and memory resident malware become more widespread, memory analysis becomes more important. In order to provide more virtual memory than is actually physical present on a system, an operating system may transfer frames of memory to a pagefile on persistent storage. Current memory analysis software does not incorporate such pagefiles and thus misses important information. We therefore present a detailed analysis of Windows NT paging. We use dynamic gray-box analysis, in which we place known data into virtual memory and examine where it is mapped to, in either the physical memory or the pagefile, and cross-reference these findings with the Windows NT Research Kernel source code. We demonstrate how to decode the non-present page table entries, and accurately reconstruct the complete virtual memory space, including non-present memory pages on Windows NT systems using 32-bit, PAE or IA32e paging. Our analysis approach can be used to analyze other operating systems as well.
SQLite databases have tremendous forensic potential. In addition to active data, expired data remain in the database file, if the option secure delete is not applied. Tests of available forensic tools show, that the indexes were not considered, although they may complete the recovery of the table structures. Algorithms for their recovery and combination with each other or with table data are worked out. A new tool, SQLite Index Recovery, was developed for this study. The use with test data and data of Apple Mail shows, that the recovery of indexes is possible and enriches the recovery of ordinary table data.
The detection of persistently stored encrypted data plays an increasingly important role in digital forensics. This is especially true during live analysis of IT systems, when the encrypted data structures are temporarily decrypted in main memory and thus can be accessed as plaintext. One method commonly used to detect the presence of encrypted data on a storage device is the calculation of entropy. However, this method has a significant drawback: both random and compressed data have a very similar entropy compared to encrypted data, which yields a high false positive rate. That is why entropy is not very suitable to differentiate between these types of data.In this work we suggest both a workflow for detection of encrypted data structures on a storage device and an improved classification algorithm. The classification part of the workflow is based on statistical tests. For convenience of the investigator an important goal is to minimize the number of falsely classified unencrypted data structures (e.g. compressed data is classified as encrypted data). Our approach to achieve this goal is to combine different statistical tests. As a practical proof of concept we provide and evaluate a tool for automated analysis of storage devices that implements a multitude of statistical tests for improved detection of encrypted data, compared to both the application of only one such test and the calculation of entropy. More precisely our tool is able to reliably distinguish high-entropy file formats (i.e. DOCX, JPG, PDF, ZIP) from encrypted files (i.e. a truecrypt container).
There is a growing demand for experts with a dedicated knowledge of forensics, especially in the domain of digital and digitised forensics, besides a general shortage of teaching of digital forensics. Further, there is prominent lack of standardisation in designing a curriculum [18]. We address this by offering the profile ForensikDesign@Informatik [23] to the bachelor's degree at university level. By teaching digital and digitised forensics, we propose a model-based approach combining the practitioners and the computer scientist's view [19], also to address the standardisation issue. We identify three main application areas: teaching conventional digital forensic examinations using existing tools and methods following the model-based approach, the design of new forensic tools and methods and the system design to achieve a desired degree of forensic readiness in the conflict field of a degree of anonymity. The last two application areas, we believe, also justify teaching at university level. We set an international focus, and highlight the science part of forensic sciences. Selected law aspects are addressed both for motivational and comparative purposes. We implement different teaching strategies and provide dedicated resources (technical, organisational and personnel). Finally, we outline the two options for the profile ForensikDesign@Informatik, depending on the effort of commitment by the students.
Latent print age estimation is an important topic in the emerging field of digitized crime scene forensics. While several capturing devices have recently been studied towards this goal, hyperspectral imaging in the UV/VIS (ultraviolet and visible light) range of the electromagnetic spectrum has not been investigated so far. Addressing this research gap, a first qualitative evaluation on the aging behavior of 30 latent print time series from 6 different donors is conducted, utilizing an optical reflection spectrometer. Results show more unpredictable aging tendencies in the ultraviolet spectral range, whereas a general logarithmic trend from prior work (using non-spectral capturing devices) is confirmed for the visible light band. Furthermore, a different behavior of eccrine and sebaceous print components is found, especially in the ultraviolet band, where sebaceous components seem to become reflective to the emitted radiation and might furthermore be utilized for studying longer aging periods in contrast to eccrine prints. Overall, the combined degradation information of the ultraviolet and the visible light band seem to provide the most reliable results for measuring a reproducible aging trend, serving as a potential opportunity to address the strong influence of different sweat compositions on the aging behavior of latent prints.
As payment cards and mobile devices are equipped with Near Field Communication (NFC) technology, electronic payment transactions at physical Point of Sale (POS) environments are changing. Payment transactions do not require the customer to insert their card into a slot of the payment terminal. The customer is able to simply swipe the payment card or mobile phone in front of a dedicated zone of the terminal to initiate a payment transaction. Secure Elements (SEs) in mobile phones and payment cards with NFC should keep sensitive application data in a save place to protect it from abuse by attackers. Although hardware and the operating system of such a chip has to go through an intensive process of security testing, the current integration of such a chip in mobile phones easily allows attackers to access the information stored. In the following paper we present the implementation of two different proof-of-concept attacks. Out of the analysis of the attack scenarios, we propose various starting points for the forensic analysis in order to detect such fraudulent transactions. The presented concept should lead to fewer fraudulent transactions as well as protected evidence in case of fraud.
The home of the future should be a smart one, to support us in our daily life. Up to now only a few security incidents in that area are known. Depending on different security analyses, this fact is rather a result of the low spread of Smart Home products than the success of such systems security. Given that Smart Homes become more and more popular, we will consider current incidents and analyses to estimate potential security threats in the future. The definitions of a Smart Home drift widely apart. Thus we first need to define Smart Home for ourselves and additionally provide a way to categorize the big mass of products into smaller groups.
The increasing amount of network-based attacks evolved to one of the top concerns responsible for network infrastructure and service outages. In order to counteract these threats, computer networks are monitored to detect malicious traffic and initiate suitable reactions. However, initiating a suitable reaction is a process of selecting an appropriate response related to the identified network-based attack. The process of selecting a response requires to take into account the economics of an reaction e.g., risks and benefits. The literature describes several response selection models, but they are not widely adopted. In addition, these models and their evaluation are often not reproducible due to closed testing data. In this paper, we introduce a new response selection model, called REASSESS, that allows to mitigate network-based attacks by incorporating an intuitive response selection process that evaluates negative and positive impacts associated with each countermeasure. We compare REASSESS with the response selection models of IE-IRS, ADEPTS, CS-IRS, and TVA and show that REASSESS is able to select the most appropriate response to an attack in consideration of the positive and negative impacts and thus reduces the effects caused by an network-based attack. Further, we show that REASSESS is aligned to the NIST incident life cycle. We expect REASSESS to help organizations to select the most appropriate response measure against a detected network-based attack, and hence contribute to mitigate them.
