Abstract image of a woman sitting on books and studying on a laptop

SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)

Security Bootcamp, profile picture
Security Bootcamp

The document discusses memory forensics and rootkit detection. It covers why memory forensics is important for malware analysis and incident response. Key topics include memory acquisition tools, the Volatility memory forensics framework, rootkit techniques like DLL injection, hooking, and process/driver hiding used by malware. Detection methods for these rootkit behaviors using Volatility plugins are also presented. The document appears to be from a security training presentation on memory forensics and rootkit analysis.

Technology
1 of 93
Downloaded 214 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 1 2 Malware Memory Forensic Nguyễn Chấn Việt | vietwow@gmail.com
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 2 Who am I Senior Security Researcher +4 years in Information Security. Focusing on 2 Malware Analysis and Exploit Development Twitter : https://twitter.com/vietwow
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 3 Agenda Why Memory Forensics? What is Memory Forensics? 2 Our approach : Rootkit Detection Windows Platform Linux Platform Real-world Malwares
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Why4 Memory Forensics ? In past, Forensic Analysis = File System Forensic 2 Why memory forensics ? Malware Analysis Incident Respone (IR) HOT Topic for researchers
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Why5 Memory Forensics ? Everything in the OS traverses RAM •Processes and threads •Malware (including rootkit technologies) 2 •Network sockets, URLs, IP addresses •Open files •User generated content Passwords, caches, clipboards •Encryption keys •Hardware and software configuration •Windows registry keys and event logs
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 6 What processes were running on the suspect system at the time memory image was taken? What (hidden or closed) 2processes existed? Are there any (hidden or closed) network connections? Are there any (hidden or closed) sockets? What is the purpose and intent of the suspected file? Are there any suspicious DLL modules? Are there any suspicious URLs or IP addresses associated with a process?
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 7 Are there any suspicious open files associated with a process? Are there any closed or hidden files associated with any 2 process? Are there any suspicious strings associated with a particular process? Are there any suspicious files present? Can you extract them? Can you extract malicious processes from the memory and analyze it?
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 8 Can you identify the attackers and their IP addresses? Did the attacker create a user account on the system? Did the malware modify 2 add any registry entry? or Does the malware use any type of hooks to hide itself? Did the malware inject itself to any running processes? What is the relationship between different processes? What is the intent and purpose of this malware?
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! What 9is Memory Forensics? Là kỹ thuật/quá trình phân tích dấu vết dựa trên memory (RAM) của 1 hệ thống 2 Bao gồm physical memory (RAM) và Page File/Swap
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Acquisition 10 Winen (Guidance Software) FastDump Pro (HB Gary) - Limited Free version available 2 FTK Imager - Free DD Free but limited - May not work on later versions of Windows WinHex - Has some limitations Nigilant32 - Free but for 32-bit systems only Memoryze (Mandiant) - Free
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Virtual Machine Memory Acquisition 11 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensic Tools Volatility 12 https://www.volatilesystems.com/default/volatility Free & Open Source 2 Mandiant Redline http://www.mandiant.com/resources/download/redline/ Free HBGary Responder http://www.hbgary.com/responder-pro-2 $$$ - Pro Community Edition available
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 13 Volatility An advanced memory forensics framework OpenSource 2 Written by Python Primarily Windows-focused Linux (Android) & Mac support now available Modular, portable Main reason why I’m here :D
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 14 Volatility Volatility supports the following extraction capabilities for memory images: Image date and time Running processes 2 Open network sockets Open network connections DLLs loaded for each process Open files for each process Open registry keys for each process Memory maps for each process Extract executable samples Scanning examples: processes, threads, sockets, connections, modules
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 15 2 General checking
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 16 2 Windows Platform
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 17 Volatility pslist List the processes of a system. This walks the doubly- linked list pointed to by 2 PsActiveProcessHead. It does not detect hidden or unlinked processes.
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 18 Volatility connections To view the active connections 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 19 Volatility dlllist Print all loaded DLLs 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 20 Volatility svcscan List Windows services 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 21 2 Linux Platform
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 22 Volatility linux_lsmod Print all loaded modules 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 23 2 Rootkit Dection
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 24 2 [1] Windows Platform
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 25 2 [1.1] DLL Injection
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Normal DLL Interaction 26 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Injected DLL Interactopn 27 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 28 DLL Injection DLL Injection là kỹ thuật rất phổ biến được sử dụng bởi malware 2 VirtualAllocEx( ) và CreateRemoteThread( ) SetWindowsHookEx( )
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! DLL Injection Detection 29 ldrmodules  Là module để detect DLL Injection 2  Trong mỗi process, các DLL sẽ được track trong 3 linked-list  Stealthy malware sẽ unlink dll của chúng trong các linked-list này  Plugin này sẽ query các linked-list này và hiển thị thông tin để ta có thể so sánh
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 30 2 [1.2] Usermode & Kernelmode Hooking
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Levels31 Access in Windows of  Ring 3 – User Land  User  Administrator 2  System  Ring 0 – Kernel Land  Drivers
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 32 OS Internals • Readfile() called on File1.txt • Transition to Ring 0 • NtReadFile() processed 2 • I/O Subsystem called • IRP generated • Data at File1.txt requested from ntfs.sys • Data on D: requested from dmio.sys • Data on disk 2 requested from disk.sys
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 33 OS Internals • Binary replacement eg modified Exe or Dll 2 • Binary modification in memory eg He4Hook • User land hooking eg Hacker Defender • IAT hooking
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 34 OS Internals • Kernel Hooking • E.g. NtRootkit 2 • Driver replacement • E.g. replace ntfs.sys with ntfss.sys • Direct Kernel Object Manipulation – DKOM • E.g. Fu, FuTo
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 35 OS Internals • IO Request Packet (IRP) Hooking • IRP Dispatch Table 2 • E.g. He4Hook (some versions)
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 36 OS Internals • Filter Drivers • The official Microsoft method • Types 2 • File system filter • Volume filter • Disk Filter • Bus Filter • • E.g. Clandestine File System Driver (CFSD)
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Current Rootkit Capabilities 37 Hide processes Hide files Hide registry entries 2 Hide services Completely bypass personal firewalls Undetectable by anti virus Remotely undetectable Covert channels - undetectable on the network Defeat cryptographic hash checking Install silently All capabilities ever used by viruses or worms
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 38 2 [1.2.1] Usermode Hooking
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Windows39GUI Subsystem Hooking Malware có thể dùng SetWindowsHookEx để intercept các window message 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Windows GUI Hooking Detection 40 messagehooks  Là module để detect Windows GUI Hooking 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 41 IAT Hooking Hook vào IAT Table của process 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 42 IAT Hooking IAT Hook 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 43 IAT Hooking void hookFunction( PVOID * thunk, HookedFunction & hookedFunction ) { MEMORY_BASIC_INFORMATION mbi; //The IAT is marked as read-only memory so we mark it as read-write for the update. 2 ZeroMemory( &mbi, sizeof( MEMORY_BASIC_INFORMATION ) ); SIZE_T s = VirtualQuery( thunk, &mbi, sizeof( MEMORY_BASIC_INFORMATION ) ); BOOL b = VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_READWRITE, &mbi.Protect ); if ( hookedFunction.RealFunction == 0 ) { hookedFunction.RealFunction = *thunk; } *thunk = hookedFunction.HookFunction; DWORD oldProtect; VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.Protect, &oldProtect); }
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Inline Hooking 44 Thay đổi các byte (thường là 5) đầu tiên của chương trình 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Usermode Hooking Detection 45 apihooks  Là module để detect IAT Hook và Inline Hook 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 46 2 [1.2.2] Kernelmode Hooking
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 47 Hook vào SSDT Table 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 48 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 49 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking • Hook the call when the device is created 50 NTSTATUS Create(PDEVICE_OBJECT DeviceObject,PIRP Irp) { NTSTATUS status = STATUS_SUCCESS; if ( !CanWriteToSSDT() ) 2 { //Change the read-only SSDT memory block to read/write EnableWritingToSSDT(); OldZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)InterlockedExchange( (PLONG)&g_MappedSystemCallTable[0xAD], (LONG) NewQuerySytemInformation); } Irp->IoStatus.Status = status; IoCompleteRequest(Irp,IO_NO_INCREMENT); return status; }
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Kernelmode Hooking Detection 51 ssdt_ex  Là module để detect SSDT và Inline Hook 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 52 Others IDT(Interrupt Descriptor Table) Hooking Sử dụng module “idt” để detect SYSENTER / SDT Hooking 2 Hooking SST (KiServiceTable) Hooking KiSystemService IRP Hooking Sử dụng module “driverirp” để detect => not enough time to cover all 
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 53 2 [1.3] Process Hiding
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 54 DKOM Thay đổi cấu trúc EPROCESS để unlink process cần hide Ngoài việc hide process, 2 DKOM còn có thể sử dụng để : Add Privileges to Tokens Add Groups to Tokens Manipulate the Token to Fool the Windows Event Viewer Hide Ports Hide drivers => FU là rootkit sử dụng kỹ thuật này
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! EPROCESS Linked List 55 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! EPROCESS Linked List 56 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Rootkit Detection 57 psxview (FU Rootkit) 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 58 2 [1.4] Driver Hiding
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 59 Driver Hiding Rootkit sẽ sử dụng kỹ thuật DKOM unlink nó ra khỏi list of loaded module của kernel 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module Detection 60 modscan  Là module để detect hiding kernel module 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 61 2 [2] Linux Platform
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 62 2 [2.1] Hiding the Kernel Module
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module 63 Rootkit thường tìm cách “giấu” bản thân bằng cách unlink nó ra khỏi linked-list loaded kernel modules 2 List này được export thông qua /proc/modules (lsmod chính là đọc từ list này và show ra)
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module Detection 64 linux_check_modules  Là module để detect hiding kernel module 2  Hoạt động dựa trên sysfs để tìm các module đã bị remove ra khỏi module list nhưng vẫn đang active  sysfs là 1 kernel to userland interface, giống như /proc, export các info & statistics của kernel
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 65 2 [2.2] Hooking System Call Table
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hooking System Call Table 66 System call là cơ chế để userland code có thể trigger event handling ở kernel 2 Giống API trên Windows Được quản lý bởi System call table System call table là 1 array các function pointer. Mỗi 1 function pointer sẽ tương ứng với 1 syscall handler (vd : sys_read sẽ handle read system call) Rootkit thường sẽ focus vào việc overwrite table này
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hooking System Call Table Detection 67 linux_check_syscall  Là module để detect System Call Table Hooking 2  Hoạt động dựa trên cơ chế là enumerate và verify từng entry trong System Call Table
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 68 2 [2.3] Hiding Network Connections
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Network Connections 69 Hook vào cấu trúc “tcp4_seq_afinfo”, thay đổi member “show” 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Network Connections Detection 70 linux_check_afinfo  Là module để detect hiding network connection 2  Hoạt động dựa trên cơ chế là duyệt cấu trúc “file_operations” và “sequence_operations” của tất cả cấu trúc UDP and TCP protocol
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 71 2 [2.4] Hiding Processes
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 72 Phương pháp 1 : Linux kernel chứa 1 array các cấu trúc task_struct 2 Cấu trúc task_struct giống như EPROCESS trên Windows task_struct bao gồm 2 pointer là prev_run và next_run trỏ tới process trước và sau nó tương ứng Để hide process, ta chỉ cần unlink process ra khỏi list prev_task và next_task này
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 73 task_array PID PID PID PID Process 0 2 1901 State State State State *next_task *next_task *next_task *next_task *prev_task *prev_task *prev_task *prev_task *next_run *next_run *next_run *next_run *prev_run *prev_run *prev_run *prev_run *p_pptr (null) *p_pptr *p_pptr *p_pptr *p_cptr *p_cptr *p_cptr *p_cptr *p_ysptr *p_ysptr *p_ysptr *p_ysptr *p_osptr *p_osptr *p_osptr *p_osptr ... ... ... ... ... ... ... ...
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 74 task_array PID PID PID 1901 Process 0 2 State State State *next_task *next_task *next_task *prev_task *prev_task *prev_task *next_run *next_run *next_run *prev_run *prev_run *prev_run *p_pptr *p_pptr *p_pptr *p_cptr *p_cptr *p_cptr *p_ysptr *p_ysptr *p_ysptr *p_osptr *p_osptr *p_osptr ... ... ... ... ... ...
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 75 Phương pháp 2 : Hooking /proc : Mỗi process sẽ có 1 directory tương ứng trong /proc 2 Để hide process, rookit sẽ hjack hàm “readdir” và filter out tên process cần
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 76 static inline int fuckit_proc_filldir(void *__buf, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type){ //our hidden PID :) 2 if(!strcmp(name,HIDDEN_PID) || !strcmp(name,KEY)){ return 0; } return original_filldir(__buf,name,namelen,offset,ino,d_type); } static inline int fuckit_proc_readdir(struct file *filp, void *dirent, filldir_t filldir){ //save this, we will need to return it later original_filldir = filldir; return original_proc_readdir(filp,dirent,fuckit_proc_filldir); }
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes Detection 77 linux_check_fop  Là module để detect hiding process 2  Hoạt động dựa trên cơ chế là enumerate /proc filesystem và rất các opened file, verify từng member của từng file ops structure là hợp lệ
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 78 2 Anything else ?
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Scan for Registry Artifacts 79  volatility hivescan -f dumped.vmem  volatility hivelist -f dumped.vmem -o 0x212cb60 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Data80 Carving Using Foremost  Foremost foremost -c foremost.conf -t exe –i <PID>.dmp -o 2 output3
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! [3] Real-world Malwares 81 Mixed many concepts : VirTool:WinNT/Exforel.A 2 TDSS Rookit Zeus Stunex / Duqu Flame
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! VirTool:WinNT/Exforel.A 82 Là malware implement lại toàn bộ TCP/IP Stack 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 83 TDSS Rootkit Gồm 4 biến thể : TDL-1 TDL-2 2 TDL-3 TDL-4
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 84 Zeus Là 1 dạng trojan chuyên ăn cắp thông tin trong các công ty/tập đoàn tài chính 2 Có 1 số tính năng như 1 rootkit
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 85 Stunex / Duqu Là 1 dạng worm, gồm 2 phiên bản : Stunex : focus vào việc phá hủy hạ tầng lò phản ứng hạt nhân (PLC) của Iran 2 Duqu : forcus vào việc ăn cắp thông tin
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 86 Flame Còn có tên là sKyWiper Là malware nổi tiếng nhất gần đây, phức tạp hơn nhiều 2 so với Duqu. Vừa là 1 backdoor, vừa là trojan, và cũng có những tính năng như 1 worm
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 87 Comparison 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 88 2 Other cases
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Password Keeper 89 Password Keeper is a small utility useful for storing our frequently used passwords. Password information can be stored, edited and printed with this easy to use 2 program. No mention of protection against memory analysis
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Password Keeper 90 With volatilty we dump the PasswordKeeper processes 2 And strings our password on it
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 91 Conclusion Volatility is a great tool for memory forensic Want to learn more ? 2 SANS FOR526: Windows Memory Forensics In-Depth Windows Memory Forensics Training for Analysts by Volatility Developers
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Any Questions ? 92 2
SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 93 Thank you very much ! 2

More Related Content

PPTX
Patch Management Best Practices
Ivanti
 
PPTX
Traditional Firewall vs. Next Generation Firewall
美兰 曾
 
PDF
Cloud Security - Security Aspects of Cloud Computing
Jim Geovedi
 
PDF
Vulnerability and Patch Management
n|u - The Open Security Community
 
PPTX
Security Information Event Management - nullhyd
n|u - The Open Security Community
 
PDF
SIEM Architecture
Nishanth Kumar Pathi
 
PPTX
McAfee SIEM solution
hashnees
 
PPTX
Crowdstrike .pptx
uthayakumar174828
 
Patch Management Best Practices
Ivanti
 
Traditional Firewall vs. Next Generation Firewall
美兰 曾
 
Cloud Security - Security Aspects of Cloud Computing
Jim Geovedi
 
Vulnerability and Patch Management
n|u - The Open Security Community
 
Security Information Event Management - nullhyd
n|u - The Open Security Community
 
SIEM Architecture
Nishanth Kumar Pathi
 
McAfee SIEM solution
hashnees
 
Crowdstrike .pptx
uthayakumar174828
 

What's hot (20)

PPTX
Hardware firewall
Subrata Kumer Paul
 
PDF
Threat Hunting Report
Morane Decriem
 
PDF
DevSecOps - Colocando segurança na esteira
Diego Gabriel Cardoso
 
PDF
DataPower API Gateway Performance Benchmarks
IBM DataPower Gateway
 
PDF
Introduction to QRadar
PencilData
 
PDF
Incident response before:after breach
Sumedt Jitpukdebodin
 
PDF
The Current ICS Threat Landscape
Dragos, Inc.
 
PPTX
Security Information and Event Management (SIEM)
k33a
 
PDF
QRadar Architecture.pdf
PencilData
 
PDF
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
PDF
Finding attacks with these 6 events
Michael Gough
 
PPTX
[발표자료] 오픈소스 기반 고가용성 Pacemaker 소개 및 적용 사례_20230703_v1.1F.pptx
ssuserf8b8bd1
 
PDF
Security Testing Mobile Applications
Denim Group
 
PPTX
Linux and firewall
Mhmud Khraibene
 
PDF
ChuyenDeANM ung dung he thong IDS securityonion vao giam sat moi truong mang ...
nataliej4
 
PDF
MR201406 A Re-introduction to SELinux
FFRI, Inc.
 
PDF
Data Center Security
devalnaik
 
PPTX
Centralised logging with ELK stack
Simon Hanmer
 
PPTX
Database security
Birju Tank
 
PPT
Fortinet
Petre-doru Dragus
 
Hardware firewall
Subrata Kumer Paul
 
Threat Hunting Report
Morane Decriem
 
DevSecOps - Colocando segurança na esteira
Diego Gabriel Cardoso
 
DataPower API Gateway Performance Benchmarks
IBM DataPower Gateway
 
Introduction to QRadar
PencilData
 
Incident response before:after breach
Sumedt Jitpukdebodin
 
The Current ICS Threat Landscape
Dragos, Inc.
 
Security Information and Event Management (SIEM)
k33a
 
QRadar Architecture.pdf
PencilData
 
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
Finding attacks with these 6 events
Michael Gough
 
[발표자료] 오픈소스 기반 고가용성 Pacemaker 소개 및 적용 사례_20230703_v1.1F.pptx
ssuserf8b8bd1
 
Security Testing Mobile Applications
Denim Group
 
Linux and firewall
Mhmud Khraibene
 
ChuyenDeANM ung dung he thong IDS securityonion vao giam sat moi truong mang ...
nataliej4
 
MR201406 A Re-introduction to SELinux
FFRI, Inc.
 
Data Center Security
devalnaik
 
Centralised logging with ELK stack
Simon Hanmer
 
Database security
Birju Tank
 
Fortinet
Petre-doru Dragus
 
Ad

Viewers also liked (20)

PDF
Next Generation Memory Forensics
Andrew Case
 
PPT
2006 03 15_pe & api hook
용환 노
 
PDF
THOR Apt Scanner
Florian Roth
 
PDF
openioc_scan - IOC scanner for memory forensics
Takahiro Haruyama
 
PDF
Hunting malware with volatility v2.0
Frank Boldewin
 
PDF
One-Byte Modification for Breaking Memory Forensic Analysis
Takahiro Haruyama
 
PPTX
Windows forensic
MD SAQUIB KHAN
 
PPT
Memory Forensics
Prince Boonlia
 
PPTX
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
securityxploded
 
PDF
Windows Memory Forensic Analysis using EnCase
Takahiro Haruyama
 
PPTX
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
PDF
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS
 
PDF
HITCON CTF 2016導覽
HITCON GIRLS
 
PDF
HITCON GIRLS Malware Analysis
Hacks in Taiwan (HITCON)
 
PDF
CTF 經驗分享
Hacks in Taiwan (HITCON)
 
PDF
HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS
 
PDF
HITCON GIRLS 成大講座 基礎知識（蜘子珣）
HITCON GIRLS
 
Next Generation Memory Forensics
Andrew Case
 
2006 03 15_pe & api hook
용환 노
 
THOR Apt Scanner
Florian Roth
 
openioc_scan - IOC scanner for memory forensics
Takahiro Haruyama
 
Hunting malware with volatility v2.0
Frank Boldewin
 
One-Byte Modification for Breaking Memory Forensic Analysis
Takahiro Haruyama
 
Windows forensic
MD SAQUIB KHAN
 
Memory Forensics
Prince Boonlia
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
securityxploded
 
Windows Memory Forensic Analysis using EnCase
Takahiro Haruyama
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
securityxploded
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
securityxploded
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
HITCON GIRLS: Android 滲透測試介紹 (Elven Liu)
HITCON GIRLS
 
HITCON CTF 2016導覽
HITCON GIRLS
 
HITCON GIRLS Malware Analysis
Hacks in Taiwan (HITCON)
 
CTF 經驗分享
Hacks in Taiwan (HITCON)
 
HITCON GIRLS 成大講座 惡意程式分析（Turkey）
HITCON GIRLS
 
HITCON GIRLS 成大講座 基礎知識（蜘子珣）
HITCON GIRLS
 
Ad

Similar to SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt) (20)

PDF
Finfisher- Nguyễn Chấn Việt
Security Bootcamp
 
PDF
IoT: Contrasting Yocto/Buildroot to binary OSes
Mender.io
 
PDF
Piratng Avs to bypass exploit mitigation
Priyanka Aash
 
PDF
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
enSilo
 
PPTX
Securing your Cloud Environment v2
ShapeBlue
 
PDF
EMBA Firmware analysis - TROOPERS22
EMBA Firmware Analyzer
 
PDF
DEF CON 27 - HUBER AND ROSKOSCH - im on your phone listening attacking voip c...
Felipe Prado
 
PPT
Rootkit Hunting & Compromise Detection
amiable_indian
 
PDF
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Maksim Shudrak
 
PDF
IoT Development from Prototype to Production
Mender.io
 
PDF
Hybis: Advanced Introspection for Effective Windows Guest Protection
Federico Franzoni
 
PDF
Journey from Monolith to a Modularized Application - Approach and Key Learnin...
mfrancis
 
PDF
Iot development from prototype to production
Mender.io
 
PDF
Fighting Malware Without Antivirus
EnergySec
 
PDF
Compiling Malware Features
Muhammad Najmi Ahmad Zabidi
 
PDF
PostScript: Danger Ahead?!
Positive Hack Days
 
PDF
Green Dam Analysis Valkyrie-X by Alnthony Lai
Charles Mok
 
PDF
Ceh v8 labs module 05 system hacking
Asep Sopyan
 
PDF
TDC2016SP - Trilha Linux Embarcado
tdc-globalcode
 
PDF
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
sparkfabrik
 
Finfisher- Nguyễn Chấn Việt
Security Bootcamp
 
IoT: Contrasting Yocto/Buildroot to binary OSes
Mender.io
 
Piratng Avs to bypass exploit mitigation
Priyanka Aash
 
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
enSilo
 
Securing your Cloud Environment v2
ShapeBlue
 
EMBA Firmware analysis - TROOPERS22
EMBA Firmware Analyzer
 
DEF CON 27 - HUBER AND ROSKOSCH - im on your phone listening attacking voip c...
Felipe Prado
 
Rootkit Hunting & Compromise Detection
amiable_indian
 
Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bu...
Maksim Shudrak
 
IoT Development from Prototype to Production
Mender.io
 
Hybis: Advanced Introspection for Effective Windows Guest Protection
Federico Franzoni
 
Journey from Monolith to a Modularized Application - Approach and Key Learnin...
mfrancis
 
Iot development from prototype to production
Mender.io
 
Fighting Malware Without Antivirus
EnergySec
 
Compiling Malware Features
Muhammad Najmi Ahmad Zabidi
 
PostScript: Danger Ahead?!
Positive Hack Days
 
Green Dam Analysis Valkyrie-X by Alnthony Lai
Charles Mok
 
Ceh v8 labs module 05 system hacking
Asep Sopyan
 
TDC2016SP - Trilha Linux Embarcado
tdc-globalcode
 
Drupal Dev Days Vienna 2023 - What is the secure software supply chain and th...
sparkfabrik
 

More from Security Bootcamp (20)

PDF
Ẩn mình kết nối C&C - Xu hướng tấn công và cách phòng thủ
Security Bootcamp
 
PPTX
AI-ttacks - Nghiên cứu về một số tấn công vào các mô hình học máy và AI
Security Bootcamp
 
PPTX
Human and AI - Balancing Innovation and Data Privacy in the Age of Cyber Threats
Security Bootcamp
 
PPTX
Robustness of Deep learning mode ls.pptx
Security Bootcamp
 
PPTX
DLL Sideloading cho mọi nhà - Security Bootcamp 2024
Security Bootcamp
 
PDF
Let the Hunt Begin - Security Bootcamp 2024
Security Bootcamp
 
PDF
Detection as Code - Effective Approach to manage & optimize SOC Development
Security Bootcamp
 
PDF
Quản trị rủi ro nguồn mở tại các doanh nghiệp phần mềm Việt Nam
Security Bootcamp
 
PDF
Phân tích một chiến dịch ransomware: Từ lan truyền đến tống tiền
Security Bootcamp
 
PDF
CyberJutsu - The Joern-ey of Static Code Analysis.pdf
Security Bootcamp
 
PPTX
Security in the AI and Web3 era - Veramine
Security Bootcamp
 
PDF
ĐỂ AI ĐƯỢC AN TOÀN, MINH BẠCH, CÓ TRÁCH NHIỆM VÀ ‘NHÂN TÍNH’ HƠN
Security Bootcamp
 
PDF
Modern Security Operations - Building and leading modern SOC
Security Bootcamp
 
PDF
Humanity and AI: Balancing Innovation and Data Privacy in the Age of Cyber Th...
Security Bootcamp
 
PPTX
SBC2024_AI TRONG CYBER SECURITY_final.pptx
Security Bootcamp
 
PPTX
Cyber GenAI – Another Chatbot? - Trellix
Security Bootcamp
 
PDF
Akamai_ API Security Best Practices - Real-world attacks and breaches
Security Bootcamp
 
PPTX
How to steal a drone Drone Hijacking - VNPT Cyber Immunity
Security Bootcamp
 
PDF
Empowering Malware Analysis with IDA AppCall
Security Bootcamp
 
PDF
Detection of Spreading Process on many assets over the network
Security Bootcamp
 
Ẩn mình kết nối C&C - Xu hướng tấn công và cách phòng thủ
Security Bootcamp
 
AI-ttacks - Nghiên cứu về một số tấn công vào các mô hình học máy và AI
Security Bootcamp
 
Human and AI - Balancing Innovation and Data Privacy in the Age of Cyber Threats
Security Bootcamp
 
Robustness of Deep learning mode ls.pptx
Security Bootcamp
 
DLL Sideloading cho mọi nhà - Security Bootcamp 2024
Security Bootcamp
 
Let the Hunt Begin - Security Bootcamp 2024
Security Bootcamp
 
Detection as Code - Effective Approach to manage & optimize SOC Development
Security Bootcamp
 
Quản trị rủi ro nguồn mở tại các doanh nghiệp phần mềm Việt Nam
Security Bootcamp
 
Phân tích một chiến dịch ransomware: Từ lan truyền đến tống tiền
Security Bootcamp
 
CyberJutsu - The Joern-ey of Static Code Analysis.pdf
Security Bootcamp
 
Security in the AI and Web3 era - Veramine
Security Bootcamp
 
ĐỂ AI ĐƯỢC AN TOÀN, MINH BẠCH, CÓ TRÁCH NHIỆM VÀ ‘NHÂN TÍNH’ HƠN
Security Bootcamp
 
Modern Security Operations - Building and leading modern SOC
Security Bootcamp
 
Humanity and AI: Balancing Innovation and Data Privacy in the Age of Cyber Th...
Security Bootcamp
 
SBC2024_AI TRONG CYBER SECURITY_final.pptx
Security Bootcamp
 
Cyber GenAI – Another Chatbot? - Trellix
Security Bootcamp
 
Akamai_ API Security Best Practices - Real-world attacks and breaches
Security Bootcamp
 
How to steal a drone Drone Hijacking - VNPT Cyber Immunity
Security Bootcamp
 
Empowering Malware Analysis with IDA AppCall
Security Bootcamp
 
Detection of Spreading Process on many assets over the network
Security Bootcamp
 

Recently uploaded (20)

PPTX
Benefits of Physical activity for teenagers.pptx
Nokwanda Thabethe
 
PDF
TrustArc Webinar - Click, Consent, Trust: Winning the Privacy Game
TrustArc
 
PPTX
The various Industrial Revolutions .pptx
bandileshozi3
 
PPT
Geologic Time for studying geology for geologist
ssuser738f5a
 
DOCX
search engine optimization ppt fir known well about this
StandardCodeLearning
 
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
PDF
WOOl fibre morphology and structure.pdf for textiles
Rajendrakumar868651
 
PDF
CloudStack 4.21: First Look Webinar slides
ShapeBlue
 
PDF
1 - Historical Antecedents, Social Consideration.pdf
tuazon2030627
 
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PDF
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
PDF
Architecture types and enterprise applications.pdf
ChristopherTHyatt
 
PDF
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
PDF
Hybrid model detection and classification of lung cancer
IAESIJAI
 
PDF
Taming the Chaos: How to Turn Unstructured Data into Decisions
Safe Software
 
PDF
Univ-Connecticut-ChatGPT-Presentaion.pdf
ry7r52mzb4
 
PDF
Getting started with AI Agents and Multi-Agent Systems
Maxim Salnikov
 
PPT
Module 1.ppt Iot fundamentals and Architecture
nanditha7766
 
PDF
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
IAESIJAI
 
Benefits of Physical activity for teenagers.pptx
Nokwanda Thabethe
 
TrustArc Webinar - Click, Consent, Trust: Winning the Privacy Game
TrustArc
 
The various Industrial Revolutions .pptx
bandileshozi3
 
Geologic Time for studying geology for geologist
ssuser738f5a
 
search engine optimization ppt fir known well about this
StandardCodeLearning
 
Group 1 Presentation -Planning and Decision Making .pptx
MatthewLewis227954
 
WOOl fibre morphology and structure.pdf for textiles
Rajendrakumar868651
 
CloudStack 4.21: First Look Webinar slides
ShapeBlue
 
1 - Historical Antecedents, Social Consideration.pdf
tuazon2030627
 
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
Architecture types and enterprise applications.pdf
ChristopherTHyatt
 
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
Hybrid model detection and classification of lung cancer
IAESIJAI
 
Taming the Chaos: How to Turn Unstructured Data into Decisions
Safe Software
 
Univ-Connecticut-ChatGPT-Presentaion.pdf
ry7r52mzb4
 
Getting started with AI Agents and Multi-Agent Systems
Maxim Salnikov
 
Module 1.ppt Iot fundamentals and Architecture
nanditha7766
 
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
IAESIJAI
 

SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)

  • 1. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 1 2 Malware Memory Forensic Nguyễn Chấn Việt | vietwow@gmail.com
  • 2. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 2 Who am I Senior Security Researcher +4 years in Information Security. Focusing on 2 Malware Analysis and Exploit Development Twitter : https://twitter.com/vietwow
  • 3. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 3 Agenda Why Memory Forensics? What is Memory Forensics? 2 Our approach : Rootkit Detection Windows Platform Linux Platform Real-world Malwares
  • 4. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Why4 Memory Forensics ? In past, Forensic Analysis = File System Forensic 2 Why memory forensics ? Malware Analysis Incident Respone (IR) HOT Topic for researchers
  • 5. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Why5 Memory Forensics ? Everything in the OS traverses RAM •Processes and threads •Malware (including rootkit technologies) 2 •Network sockets, URLs, IP addresses •Open files •User generated content Passwords, caches, clipboards •Encryption keys •Hardware and software configuration •Windows registry keys and event logs
  • 6. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 6 What processes were running on the suspect system at the time memory image was taken? What (hidden or closed) 2processes existed? Are there any (hidden or closed) network connections? Are there any (hidden or closed) sockets? What is the purpose and intent of the suspected file? Are there any suspicious DLL modules? Are there any suspicious URLs or IP addresses associated with a process?
  • 7. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 7 Are there any suspicious open files associated with a process? Are there any closed or hidden files associated with any 2 process? Are there any suspicious strings associated with a particular process? Are there any suspicious files present? Can you extract them? Can you extract malicious processes from the memory and analyze it?
  • 8. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensics Questions… 8 Can you identify the attackers and their IP addresses? Did the attacker create a user account on the system? Did the malware modify 2 add any registry entry? or Does the malware use any type of hooks to hide itself? Did the malware inject itself to any running processes? What is the relationship between different processes? What is the intent and purpose of this malware?
  • 9. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! What 9is Memory Forensics? Là kỹ thuật/quá trình phân tích dấu vết dựa trên memory (RAM) của 1 hệ thống 2 Bao gồm physical memory (RAM) và Page File/Swap
  • 10. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Acquisition 10 Winen (Guidance Software) FastDump Pro (HB Gary) - Limited Free version available 2 FTK Imager - Free DD Free but limited - May not work on later versions of Windows WinHex - Has some limitations Nigilant32 - Free but for 32-bit systems only Memoryze (Mandiant) - Free
  • 11. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Virtual Machine Memory Acquisition 11 2
  • 12. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Memory Forensic Tools Volatility 12 https://www.volatilesystems.com/default/volatility Free & Open Source 2 Mandiant Redline http://www.mandiant.com/resources/download/redline/ Free HBGary Responder http://www.hbgary.com/responder-pro-2 $$$ - Pro Community Edition available
  • 13. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 13 Volatility An advanced memory forensics framework OpenSource 2 Written by Python Primarily Windows-focused Linux (Android) & Mac support now available Modular, portable Main reason why I’m here :D
  • 14. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 14 Volatility Volatility supports the following extraction capabilities for memory images: Image date and time Running processes 2 Open network sockets Open network connections DLLs loaded for each process Open files for each process Open registry keys for each process Memory maps for each process Extract executable samples Scanning examples: processes, threads, sockets, connections, modules
  • 15. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 15 2 General checking
  • 16. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 16 2 Windows Platform
  • 17. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 17 Volatility pslist List the processes of a system. This walks the doubly- linked list pointed to by 2 PsActiveProcessHead. It does not detect hidden or unlinked processes.
  • 18. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 18 Volatility connections To view the active connections 2
  • 19. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 19 Volatility dlllist Print all loaded DLLs 2
  • 20. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 20 Volatility svcscan List Windows services 2
  • 21. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 21 2 Linux Platform
  • 22. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 22 Volatility linux_lsmod Print all loaded modules 2
  • 23. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 23 2 Rootkit Dection
  • 24. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 24 2 [1] Windows Platform
  • 25. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 25 2 [1.1] DLL Injection
  • 26. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Normal DLL Interaction 26 2
  • 27. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Injected DLL Interactopn 27 2
  • 28. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 28 DLL Injection DLL Injection là kỹ thuật rất phổ biến được sử dụng bởi malware 2 VirtualAllocEx( ) và CreateRemoteThread( ) SetWindowsHookEx( )
  • 29. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! DLL Injection Detection 29 ldrmodules  Là module để detect DLL Injection 2  Trong mỗi process, các DLL sẽ được track trong 3 linked-list  Stealthy malware sẽ unlink dll của chúng trong các linked-list này  Plugin này sẽ query các linked-list này và hiển thị thông tin để ta có thể so sánh
  • 30. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 30 2 [1.2] Usermode & Kernelmode Hooking
  • 31. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Levels31 Access in Windows of  Ring 3 – User Land  User  Administrator 2  System  Ring 0 – Kernel Land  Drivers
  • 32. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 32 OS Internals • Readfile() called on File1.txt • Transition to Ring 0 • NtReadFile() processed 2 • I/O Subsystem called • IRP generated • Data at File1.txt requested from ntfs.sys • Data on D: requested from dmio.sys • Data on disk 2 requested from disk.sys
  • 33. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 33 OS Internals • Binary replacement eg modified Exe or Dll 2 • Binary modification in memory eg He4Hook • User land hooking eg Hacker Defender • IAT hooking
  • 34. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 34 OS Internals • Kernel Hooking • E.g. NtRootkit 2 • Driver replacement • E.g. replace ntfs.sys with ntfss.sys • Direct Kernel Object Manipulation – DKOM • E.g. Fu, FuTo
  • 35. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 35 OS Internals • IO Request Packet (IRP) Hooking • IRP Dispatch Table 2 • E.g. He4Hook (some versions)
  • 36. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 36 OS Internals • Filter Drivers • The official Microsoft method • Types 2 • File system filter • Volume filter • Disk Filter • Bus Filter • • E.g. Clandestine File System Driver (CFSD)
  • 37. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Current Rootkit Capabilities 37 Hide processes Hide files Hide registry entries 2 Hide services Completely bypass personal firewalls Undetectable by anti virus Remotely undetectable Covert channels - undetectable on the network Defeat cryptographic hash checking Install silently All capabilities ever used by viruses or worms
  • 38. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 38 2 [1.2.1] Usermode Hooking
  • 39. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Windows39GUI Subsystem Hooking Malware có thể dùng SetWindowsHookEx để intercept các window message 2
  • 40. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Windows GUI Hooking Detection 40 messagehooks  Là module để detect Windows GUI Hooking 2
  • 41. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 41 IAT Hooking Hook vào IAT Table của process 2
  • 42. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 42 IAT Hooking IAT Hook 2
  • 43. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 43 IAT Hooking void hookFunction( PVOID * thunk, HookedFunction & hookedFunction ) { MEMORY_BASIC_INFORMATION mbi; //The IAT is marked as read-only memory so we mark it as read-write for the update. 2 ZeroMemory( &mbi, sizeof( MEMORY_BASIC_INFORMATION ) ); SIZE_T s = VirtualQuery( thunk, &mbi, sizeof( MEMORY_BASIC_INFORMATION ) ); BOOL b = VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_READWRITE, &mbi.Protect ); if ( hookedFunction.RealFunction == 0 ) { hookedFunction.RealFunction = *thunk; } *thunk = hookedFunction.HookFunction; DWORD oldProtect; VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.Protect, &oldProtect); }
  • 44. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Inline Hooking 44 Thay đổi các byte (thường là 5) đầu tiên của chương trình 2
  • 45. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Usermode Hooking Detection 45 apihooks  Là module để detect IAT Hook và Inline Hook 2
  • 46. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 46 2 [1.2.2] Kernelmode Hooking
  • 47. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 47 Hook vào SSDT Table 2
  • 48. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 48 2
  • 49. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking 49 2
  • 50. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! SSDT Hooking • Hook the call when the device is created 50 NTSTATUS Create(PDEVICE_OBJECT DeviceObject,PIRP Irp) { NTSTATUS status = STATUS_SUCCESS; if ( !CanWriteToSSDT() ) 2 { //Change the read-only SSDT memory block to read/write EnableWritingToSSDT(); OldZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)InterlockedExchange( (PLONG)&g_MappedSystemCallTable[0xAD], (LONG) NewQuerySytemInformation); } Irp->IoStatus.Status = status; IoCompleteRequest(Irp,IO_NO_INCREMENT); return status; }
  • 51. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Kernelmode Hooking Detection 51 ssdt_ex  Là module để detect SSDT và Inline Hook 2
  • 52. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 52 Others IDT(Interrupt Descriptor Table) Hooking Sử dụng module “idt” để detect SYSENTER / SDT Hooking 2 Hooking SST (KiServiceTable) Hooking KiSystemService IRP Hooking Sử dụng module “driverirp” để detect => not enough time to cover all 
  • 53. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 53 2 [1.3] Process Hiding
  • 54. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 54 DKOM Thay đổi cấu trúc EPROCESS để unlink process cần hide Ngoài việc hide process, 2 DKOM còn có thể sử dụng để : Add Privileges to Tokens Add Groups to Tokens Manipulate the Token to Fool the Windows Event Viewer Hide Ports Hide drivers => FU là rootkit sử dụng kỹ thuật này
  • 55. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! EPROCESS Linked List 55 2
  • 56. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! EPROCESS Linked List 56 2
  • 57. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Rootkit Detection 57 psxview (FU Rootkit) 2
  • 58. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 58 2 [1.4] Driver Hiding
  • 59. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 59 Driver Hiding Rootkit sẽ sử dụng kỹ thuật DKOM unlink nó ra khỏi list of loaded module của kernel 2
  • 60. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module Detection 60 modscan  Là module để detect hiding kernel module 2
  • 61. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 61 2 [2] Linux Platform
  • 62. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 62 2 [2.1] Hiding the Kernel Module
  • 63. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module 63 Rootkit thường tìm cách “giấu” bản thân bằng cách unlink nó ra khỏi linked-list loaded kernel modules 2 List này được export thông qua /proc/modules (lsmod chính là đọc từ list này và show ra)
  • 64. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding the Kernel Module Detection 64 linux_check_modules  Là module để detect hiding kernel module 2  Hoạt động dựa trên sysfs để tìm các module đã bị remove ra khỏi module list nhưng vẫn đang active  sysfs là 1 kernel to userland interface, giống như /proc, export các info & statistics của kernel
  • 65. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 65 2 [2.2] Hooking System Call Table
  • 66. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hooking System Call Table 66 System call là cơ chế để userland code có thể trigger event handling ở kernel 2 Giống API trên Windows Được quản lý bởi System call table System call table là 1 array các function pointer. Mỗi 1 function pointer sẽ tương ứng với 1 syscall handler (vd : sys_read sẽ handle read system call) Rootkit thường sẽ focus vào việc overwrite table này
  • 67. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hooking System Call Table Detection 67 linux_check_syscall  Là module để detect System Call Table Hooking 2  Hoạt động dựa trên cơ chế là enumerate và verify từng entry trong System Call Table
  • 68. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 68 2 [2.3] Hiding Network Connections
  • 69. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Network Connections 69 Hook vào cấu trúc “tcp4_seq_afinfo”, thay đổi member “show” 2
  • 70. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Network Connections Detection 70 linux_check_afinfo  Là module để detect hiding network connection 2  Hoạt động dựa trên cơ chế là duyệt cấu trúc “file_operations” và “sequence_operations” của tất cả cấu trúc UDP and TCP protocol
  • 71. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 71 2 [2.4] Hiding Processes
  • 72. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 72 Phương pháp 1 : Linux kernel chứa 1 array các cấu trúc task_struct 2 Cấu trúc task_struct giống như EPROCESS trên Windows task_struct bao gồm 2 pointer là prev_run và next_run trỏ tới process trước và sau nó tương ứng Để hide process, ta chỉ cần unlink process ra khỏi list prev_task và next_task này
  • 73. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 73 task_array PID PID PID PID Process 0 2 1901 State State State State *next_task *next_task *next_task *next_task *prev_task *prev_task *prev_task *prev_task *next_run *next_run *next_run *next_run *prev_run *prev_run *prev_run *prev_run *p_pptr (null) *p_pptr *p_pptr *p_pptr *p_cptr *p_cptr *p_cptr *p_cptr *p_ysptr *p_ysptr *p_ysptr *p_ysptr *p_osptr *p_osptr *p_osptr *p_osptr ... ... ... ... ... ... ... ...
  • 74. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 74 task_array PID PID PID 1901 Process 0 2 State State State *next_task *next_task *next_task *prev_task *prev_task *prev_task *next_run *next_run *next_run *prev_run *prev_run *prev_run *p_pptr *p_pptr *p_pptr *p_cptr *p_cptr *p_cptr *p_ysptr *p_ysptr *p_ysptr *p_osptr *p_osptr *p_osptr ... ... ... ... ... ...
  • 75. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 75 Phương pháp 2 : Hooking /proc : Mỗi process sẽ có 1 directory tương ứng trong /proc 2 Để hide process, rookit sẽ hjack hàm “readdir” và filter out tên process cần
  • 76. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes 76 static inline int fuckit_proc_filldir(void *__buf, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type){ //our hidden PID :) 2 if(!strcmp(name,HIDDEN_PID) || !strcmp(name,KEY)){ return 0; } return original_filldir(__buf,name,namelen,offset,ino,d_type); } static inline int fuckit_proc_readdir(struct file *filp, void *dirent, filldir_t filldir){ //save this, we will need to return it later original_filldir = filldir; return original_proc_readdir(filp,dirent,fuckit_proc_filldir); }
  • 77. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Hiding Processes Detection 77 linux_check_fop  Là module để detect hiding process 2  Hoạt động dựa trên cơ chế là enumerate /proc filesystem và rất các opened file, verify từng member của từng file ops structure là hợp lệ
  • 78. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 78 2 Anything else ?
  • 79. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Scan for Registry Artifacts 79  volatility hivescan -f dumped.vmem  volatility hivelist -f dumped.vmem -o 0x212cb60 2
  • 80. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Data80 Carving Using Foremost  Foremost foremost -c foremost.conf -t exe –i <PID>.dmp -o 2 output3
  • 81. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! [3] Real-world Malwares 81 Mixed many concepts : VirTool:WinNT/Exforel.A 2 TDSS Rookit Zeus Stunex / Duqu Flame
  • 82. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! VirTool:WinNT/Exforel.A 82 Là malware implement lại toàn bộ TCP/IP Stack 2
  • 83. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 83 TDSS Rootkit Gồm 4 biến thể : TDL-1 TDL-2 2 TDL-3 TDL-4
  • 84. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 84 Zeus Là 1 dạng trojan chuyên ăn cắp thông tin trong các công ty/tập đoàn tài chính 2 Có 1 số tính năng như 1 rootkit
  • 85. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 85 Stunex / Duqu Là 1 dạng worm, gồm 2 phiên bản : Stunex : focus vào việc phá hủy hạ tầng lò phản ứng hạt nhân (PLC) của Iran 2 Duqu : forcus vào việc ăn cắp thông tin
  • 86. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 86 Flame Còn có tên là sKyWiper Là malware nổi tiếng nhất gần đây, phức tạp hơn nhiều 2 so với Duqu. Vừa là 1 backdoor, vừa là trojan, và cũng có những tính năng như 1 worm
  • 87. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 87 Comparison 2
  • 88. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 88 2 Other cases
  • 89. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Password Keeper 89 Password Keeper is a small utility useful for storing our frequently used passwords. Password information can be stored, edited and printed with this easy to use 2 program. No mention of protection against memory analysis
  • 90. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Password Keeper 90 With volatilty we dump the PasswordKeeper processes 2 And strings our password on it
  • 91. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 91 Conclusion Volatility is a great tool for memory forensic Want to learn more ? 2 SANS FOR526: Windows Memory Forensics In-Depth Windows Memory Forensics Training for Analysts by Volatility Developers
  • 92. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! Any Questions ? 92 2
  • 93. SECURITY BOOTCAMP 2012 | Make yourself to be an expert! 93 Thank you very much ! 2