In the world of cryptocurrency-related malware, mining Monero (XMR) is a growing threat for organizations. In this paper we will explain why Monero is appealing for malicious actors, and how to leverage publicly available sources for hunting of Monero-related activities. We will heavily rely on automation and other open-source projects to achieve our objectives.
As one of the widest spread database systems in the world, SQLite is used on an immense number of computer systems. This is especially true for mobile devices, such as smartphones. As a consequence, data stored by SQLite gains significant relevance in many forensic investigations. Different tools are available for the (forensic) analysis of the underlying database files. However, appropriate collections of databases, that can be leveraged by the forensic community for purposes like testing, validating, comparing and improving such tools, are still missing. A first collection specific to SQLite has been made available with the SQLite Forensic Corpus in 2018. In this work, we enhance this corpus by anti-forensic aspects and present a collection of specifically crafted databases that do not necessarily conform to the SQLite file format specification. We use these databases to evaluate a selection of tools available for the analysis of SQLite - and thereby challenge their (forensic) extraction and recovery routines. Finally, we present the results of our analyses and derive some claims regarding the functionality of forensic tools in general.
The investigation of log files is an essential part of any form of IT incident management and IT forensics. In situations where logs can be manipulated, logging approaches that offer security guarantees are advisable. Within a formal system model, we describe several well-known existing approaches to secure logging and compare them with each other. Furthermore, we formalize the security requirements of secure logging approaches and systematically investigate which combinations of guarantees are achieved by the published approached under increasingly stronger attacker models.
This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with approxis, an approximate disassembler. Recent literature claims that approximate matching techniques are slow and hardly applicable to the field of memory forensics. Especially legitimate changes to executables in memory caused by the loader itself prevent the application of current bytewise approximate matching techniques. Our approach lowers the impact of modified code in memory and shows a good computational performance. During our experiments, we show how an investigator can leverage meaningful insights by combining data gained from a hard disk image and raw memory dumps with a practicability runtime performance. Lastly, our current implementation will be integrable into the Volatility memory forensics framework and we introduce new possibilities for providing data driven cross validation functions. Our current proof of concept implementation supports Linux based raw memory dumps.
This paper discusses the complexities of cases that involve Social Engineering to a full, or significantly large extend, and proposes alternative routes to investigators for collecting evidence. The largest problem in social engineering cases seems to be the admissibility of evidence and the large degree of plausible interpretations of the case argued in court. Due to this complexity, investigation for additional, admissible evidence to help bring the case to resolution is optimal. Behavioral reverse engineering is being recommended as an investigative option for the discovery of evidence from sloppy mistakes during the phase of planning a crime and the discovery of digital traces that will support the investigation. An example of this process is being provided: tracing back the phase of targeting victims and profiling. It is hoped, that investigators can use this knowledge to trace back the offender's channels of information, find potential sources of evidence, discover patterns, and more.
