SANS WhatWorks Summit in Forensics and Incident Response

Jamie Butler — Mon, 01 Jun 2009 21:28:42 +0000

The SANS WhatWorks Summit is quickly approaching, and I am excited to attend for the first time this year. Peter Silberman and I will be presenting on memory forensics. There has been some recent public debate about the usefulness of memory forensics. You can read some of my thoughts on particular issues at DailyDave. While we will not have time in 40 minutes to dive into the finer points of this argument, I believe we have some pretty compelling use cases. You can be the judge. Of course, if you want to stick around after the talk, Peter and I will be happy to engage in the discourse.

I look forward to seeing everyone at the conference. Rob Lee has put together what I believe everyone will find is an informative show. Do not forget to catch Kris Harms’ talk and see if you can find evil or not.

Speakers: Jamie Butler and Peter Silberman
Date: Tuesday, July 7, 3:10pm – 3:50pm
Title: Memory Forensics and Analysis

The memory in today’s business desktops is now larger than the hard drives that were in systems just a few years ago. Traditionally, forensic analysis has meant taking an image of the hard drive and sifting through files. This is only half of the story and can no longer be considered sufficient. Attackers are writing less to disk and hiding more in the ample memory users now enjoy. Memory analysis – once a niche function performed by only the most advanced forensic investigators – is now mainstream and common in professional investigations. Tools have been written to make memory analysis as easy for the investigator if not easier than hard drive analysis and in a fraction of the time. In this talk, we will show you how to quickly identify suspicious things in memory without having to be a reverse engineer. This talk will feature research, use cases, and real world examples.

Speaker: Kris Harms
Date: Tuesday, July 7, 9:30am – 10:30am
Title: Evil or Not? Rapid Confirmation of Compromised Hosts Via Live Incident Response

During this presentation, attendees will learn practical, tried, and true methods to review live incident response information. You will obtain the skillful eye required to quickly confirm or dispel if a system is compromised. Recent case data from PCI credit card breaches as well as the Advanced Persistent Threat (APT) will be used as samples. Armed with this knowledge, you will excel as an initial responder to any incident.

Snort My Memory – Blackhat DC 09

Peter Silberman — Fri, 09 Jan 2009 16:17:21 +0000

For those of you who have not checked the speaker lineup for Blackhat DC, I will be there giving a presentation entitled “Snort My Memory.” This talk will address some research that has been going on internally here at MANDIANT for the past couple of months. The research is focused on how to identify common malware samples in memory using Memoryze and the Audit Viewer. The specific idea behind this presentation is to take existing Snort signatures and apply them to strings in memory. The theory being that Snort uses strings to identify malware going over the network. These malware samples create network traffic using “strings” these “strings” must be in memory prior to going out over the wire. So why not just use Snort on the network? Well, when searching an entire enterprise for malware, you need to know every host that is infected and not just the ones that are communicating. Also, the attacker’s communications may be encrypted using SSL or other techniques, which makes network detection harder. With a little luck, the protocol strings such as commands for the botnet are hanging around statically unencrypted in memory, and we can detect them.

This research led me to write two new components. The first component is MindSniffer. This tool takes a Snort rule file and generates either Xpath filters for Memoryze to use or plugins for the Audit Viewer.

python mindsniffer.py
Written by Peter Silberman (peter.silberman@mandiant.com)
USAGE: mindsnort.py

<-r|–rules RULE FILE> snort rule file to parse

<-x|–xpath> generate xpath signatures

<-p|–py> generate py files for use in AuditViewer

[-o|--output] specify output directory

The second component written is a plugin framework/manager for the Audit Viewer. This new component allows users to apply Snort “signatures” to Audit Viewer results (strings must be turned on during the process audit).

The presentation will cover the above research, what was learned, and how Memoryze accesses/parses physical memory and associates strings to processes. As always there will be live demonstrations of Snort signatures working in memory. You can see the official abstract https://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Silberman

I hope to see you guys there in February. Feel free to e-mail me if you have questions or want to see the demo from Hack In The Box Malaysia ’08 (http://conference.hitb.org/hitbsecconf2008kl/).

As final note and shameless plug, stay tuned for some major updates to the Audit Viewer in the coming month or so.

M-unition » memory

SANS WhatWorks Summit in Forensics and Incident Response

Snort My Memory – Blackhat DC 09