Upload File

deep dive into digital forensics and incident response - (isc)2 latam congress 2016

  • Home
  • Technology
  • Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016
52

Upload: mateo-martinez

Post on 15-Apr-2017

54 views

Category:

Technology


1 download

Report

TRANSCRIPT

Page 1: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016
Page 2: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Deep Dive into Digital Forensics and Incident Response

Mateo MartínezCEO KOD LATAM SECURITY

www.kod.uy

2

Page 3: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Mateo Martínez∗Papá (x2)∗CISSP∗C|EH∗ISO 27001 Lead Implementer∗ex PCI QSA∗ITIL∗Gerente General de KOD LATAM SECURITY (www.kod.uy)∗Docente Hacking Ético en Universidad ORT∗Líder del capítulo OWASP Uruguay∗OWASP Web Application Security Person of the Year 2015 ∗Contacto: @mateomartinez1

www.kod.uy
Page 4: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Teoría

• Malware

• Respuesta ante Incidentes

• Forense Digital

• Herramientas

Práctica

• Adquisición de memoria

• Análisis de memoria

• Análisis de malware

Page 5: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Malware

Page 6: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016
Page 7: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

El mayor vector de infección…

PEBKAC

Page 8: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

El RFC 2828

“Un evento de seguridad en el que la política de seguridad ha sido desobedecida o vulnerada”

http://www.ietf.org/rfc/rfc2828.txt(212 páginas)

http://www.ietf.org/rfc/rfc2828.txt
Page 9: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Principio de intercambio de Locard

“Every contact leaves a trace”

Dr. Edmond Locard(13 diciembre 1877 – 4 mayo 1966)

Page 10: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Respuesta ante Incidentes actual

- Adquirir de lo más volatil a lo menos volatil

- El malware residente en memoria no puedeanalizarse a partir de una imágen de disco

- La memoria puede contenter claves de información que haya sido cifrada en el disco

Page 11: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

El RFC 3227 define el orden básico - Memoria del Sistema

- Archivos temporales (swapfile / paging file)

- Procesos y conexiones de red

- Información de routeo & ARP Cache

- Adquisición de Discos (Forense)

- Logs Remotos & Datos de Monitoreo

- Configuración física & Topología de Red

- Backupshttp://www.ietf.org/rfc/rfc3227.txt

(10 páginas)

http://www.ietf.org/rfc/rfc3227.txt
Page 12: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Información a revisar• Archivos de Logs• Procesos de Sistema• Archivos ocultos inusuales• Backdoors• Tareas Programadas• Nivel de Parches• Relaciones de confianza

• Archivos temporales• SWAP Files• Reconstruir papelera de reciclaje• Reconstruir el pool de impresión• Extraer correos y archivos

adjuntos• Historia de navegación web• Aplicaciones instaladas

Page 13: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Windows Prefetch

Es un registro de los programasejecutados en un sistema.

C:\Windows\Prefetch>

strings filename

Page 14: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Windows Prefetch

Es un registro de los programasejecutados en un sistema.

C:\Windows\Prefetch>

strings filename

Page 15: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

¿Qué contiene la memoriaen Windows?

Page 16: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Pagefile.sys

» No se puede copiar directamenteya que el SO lo está “utilizando”

» Una opción es la herramientaFGET de HBGary

» FTK Imager es otra opción (peroes una GUI)

Page 17: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Dumping System Memory w/Software

En Windows, se accede a la memoria física a través de\\.\PhysicalMemory and \\.\DebugMemory devices

Herramientas• Moonsols/win32dd

• FTK Imager

• FD.exe (HBGary)

• KnTDD

• Encase Enterprise

• F-response

Page 18: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Dumping System Memory w/Software

FTK Imager: File Capture Memory

Page 19: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Dumping System Memory w/Software

Moonsol’s DumpIT

Page 20: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Dumping System Memory w/Hardware

» Con Firewire, el OHCI controller puedeleer y escribir los primeros 4 GiB de memoria

» Ver : http://www.storm.net.nz/projects/16

Page 21: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Analizando Dumps de Memoria

Volatility• Advanced memory forensics framework• Es un script en Python• Es posible escribir plugins propios• Varios plugins de detección de malware• Gratis!

Yara• Malware plugins para Volatility

Page 22: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

• malfind• svcscan • ldrmodules • impscan • apihooks • idt

Analizando Dumps de Memoria

• gdt• orphanthreads• callbacks • driverirp• psxview

Page 23: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Analizando Dumps de Memoria

https://code.google.com/p/volatility/

Page 24: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Identificar imágen

Plugin: imageinfo

Identificar Procesos Sospechosos

Plugin: pslist & psscan

Identificar conexiones activas

Plugin: connections, connscan2, socks, sockscan2

Identificar archivos y dll`s sospechosas

Plugin: dlllist, files, fileobjscan

Analizando Dumps de Memoria

Page 25: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

# volatility pslist –f memorydump.name

Analizando Dumps de Memoria

Page 26: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

LAB TIME!

Page 27: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

1.Abrir Kali Linux

2.Abrir una terminal

3.Ejecutar: # vol –h

Page 28: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

4. imageinfo –f vmem1

5. pslist --profile=WinXPSP3x86 -f vmem1 > output_path

6. psscan --profile=WinXPSP3x86 -f vmem1 > output_path

Page 29: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility imageinfo –f dump.vmem

Page 30: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility pslist –f dump.vmem

Page 31: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility pslist –f dump.vmem

Page 32: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility sockets –f dump.vmem

Page 33: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

7. threads --profile=WinXPSP3x86 –vmem1-p 680

8. threads --profile=WinXPSP3x86 –vmem1 -p 1928

Page 34: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

9. vol --profile=WinXPSP3x86 procexedump -p 868,680,1928 -D processes/ -f vmem1

10. dlllist --profile=WinXPSP3x86 –f vmem1 -p 1928,868,680

Page 35: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility procdump –p 680 –f dump.vmem --dump-dir=.

Page 36: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#strings executable.1928.exe

Page 37: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

9. vol --profile=WinXPSP3x86 procexedump -p 868,680,1928 -D processes/ -f vmem1

10. dlllist --profile=WinXPSP3x86 –f vmem1 -p 1928,868,680

Page 38: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility dlllist –p 680 –f dump.vmem

Page 39: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

11. vol.py dlllist --profile=WinXPSP3x86 -f vmem1 -p 680 | grep 0x | wc –l

Repetir para cada proceso

(Revisar “Command Line”)

Page 40: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

12. mkdir malfind

13. malfind --profile=WinXPSP3x86 -f vmem1 -D malfind/

14. --profile=WinXPSP3x86 ldrmodules -p 868 -f vmem1

Page 41: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

#volatility malfind –f dump.vmem

Page 42: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

• Muchos procesos iguales (lsass.exe)

• Prioridad de Procesos

• Pocas DLLs

• Malfind Plugin

• DLLs Ocultas

• Mutex

• Nuevos Archivos

• Conexiones

• Kernel Drivers

LAB TIME!

Page 43: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

?

Page 44: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

ST

UX

NE

T

Siemens’ SCADA softwareSiemens SIMATIC WinCC/STEP 7CVE-2010-2772+4 Vulnerabilidades en MS Win14 Plantas de Enriquecimiento

ST

UX

NE

T

Page 45: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016
Page 46: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

» RPC server

» Tareas programadas

» UPX packing

» Certificados digitales falsificados…

En el Lab ni miramos…

Page 47: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

http://ics-cert.us-cert.gov/alerts

Alerts FeedICS-ALERT-14-099-01C : Situational Awareness Alert for OpenSSL Vulnerability ICS-ALERT-14-015-01 : Ecava IntegraXor Buffer Overflow VulnerabilityICS-ALERT-13-304-01 : Nordex NC2 – Cross-Site Scripting VulnerabilityICS-ALERT-13-259-01 : Mitsubishi MC-WorX Suite Unsecure ActiveX ControlICS-ALERT-13-256-01 : WellinTech KingView ActiveX VulnerabilitiesICS-ALERT-13-164-01 : Medical Devices Hard-Coded PasswordsICS-ALERT-13-091-01 : Mitsubishi Electric Automation MX Buffer Overflow ICS-ALERT-13-091-02 : Clorius Controls ICS SCADA Information DisclosureICS-ALERT-13-016-01A : Schneider Electric Product Vulnerabilities (Update A)ICS-ALERT-13-016-02 : Offline Brute-Force Password Tool Targeting Siemens S7ICS-ALERT-13-009-01 : Advantech WebAccess Cross-Site Scripting

Page 48: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

http://ics-cert.us-cert.gov/alerts

ABB

(Multiple, Buffer Overflow)

Arbiter

(Denial of Service)C3-ILEX (Multiple)

EMERSON (Buffer Overflow)

GE

(Multiple)

HONEYWELL

(Buffer Overflow)

ICONICS

(Multiple)

INVENSYS

(DLL Hijack, ActiveX, Buffer Overflow)

OSISOFT

(Buffer Overflow)

ROCKWELL

(Multiple PLC Vulnerabilities)

SCHNEIDER

(Remote Auth bypass, multiple)

SIEMENS

(XSS, Buffer Overflow)

Page 49: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

Nombre Fecha de alerta Fecha de Parche Meses

abb_1 10 oct 2011 22 feb 2012 +4

indusoft_* 27 apr 2011 16 nov 2011 +7

ifix_1 06 feb 2011 07 nov 2011 +9

rtip_1 17 oct 2011 22 aug 2012 +10

ifix_2 17 oct 2011 03 aug 2012 +10

Page 50: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

La infraestructura crítica no puede parar

(99% de los casos)

La prioridad es la disponibilidad y timing

Existen vulnerabilidades desconocidas porlos Vendors y otras (muy) conocidas

Hay que perfeccionar la respuesta ante Incidentes

Page 51: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

» http://mnin.blogspot.co.uk/2011/06/examining-stuxnets-footprint-in-memory.html

» http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx

Referencias:

http://mnin.blogspot.co.uk/2011/06/examining-stuxnets-footprint-in-memory.html
http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx
Page 52: Deep dive into digital forensics and incident response - (ISC)2 latam congress 2016

¡Muchas gracias!Mateo Martínez

CEO KOD LATAM SECURITYwww.kod.uy

@mateomartinez1

http://www.kod.uy/

Latam: creciente diferenciación (Situación Latam 1T14) - BBVA Research

Lista latam

Comp ter Forensics It’s NotComputer Forensics: It’s … ter Forensics It’s NotComputer Forensics: ... Computer Forensics Can be Useful with ... Solid state drives & deleted file

Network Forensics PPrinciples of Network Forensics

COMPUTER FORENSICS - Boise Chapter€¦ · 3 Mobile device forensics 4 Other 5 References Computer forensics Main article: computer forensics ... 1.19 Computer Forensics Solution

Reshaping LATAM: Founder Institute's 2016 Growth in LATAM

Forensics · Disk Forensics Mobile Forensics E-mail investigations Questioned document Cryptography, examination Steganography Live Forensics and Network Forensics Audio/video authentication

The ISC Global - ISC - ISC

Inversor LATAM

Ready latam

LATAM Conference

Memory Forensics - publish.illinois.edupublish.illinois.edu/.../files/2014/03/acc-forensics.pdfWhat is Computer Forensics? Mobile Device Forensics Network Forensics Memory & Data Forensics

Digital Forensics for Cyber Defense - (ISC)² Middle ...isc2chapter-middlega.org/wp-content/uploads/2019/... · Digital Forensics for Cyber Defense - Disclaimer The contents of this

(ISC)2 Cincinnati Tri-State Chapter: Phishing Forensics - Is it just suspicious or is it malicious?

The TTN volioti - ISC)2 · 2018-02-21 · 2013 Information Security Management 2014 Computer Security Introduction to Cryptography 2015 Network Security 2016 Digital Forensics Cybercrime

COE589: Digital Forensics - ccse.kfupm.edu.saahmadsm/coe589-122/00_Overview_Logisti… · Digital Forensics computer forensics mobile forensics network forensics ... COE589 - Ahmad

Corp.fin LATAM

Digital Evidence and Computer Forensics Oct 7-8 2013/Tab 02 Oct 7-8... · Digital Evidence and Computer Forensics COMPUTER FORENSICS FORENSICS FORENSICS

RETROFIT LATAM

Informe estado internet y comercio electrónico en latam matomy latam

The security officer role in virtual environments - (ISC)2 LATAM CONGRESS 2016

Forensics & Anti- Forensics

[WEBINARIO] Ciclo AMDIA OM Latam. "Tendencias digitales en Latam"

LatAm Outlook

Oportunidade LATAM Corporate · LATAM Airlines Colômbia, LATAM Airlines Peru, LATAM Airlines Brasil, LATAM Airlines Group, LATAM Airlines Argentinas. Os Pontos LATAM Pass serão

LATAM Mantenimiento

iPhone Forensics Methodology and Tools · Forensics methodologies, iPhone forensics, forensics tools, digital forensics evidence handling, INTRODUCTION iPhone mobile phone is becoming

grupo latam airlines - LATAM Cargo Colombiaabsacargo.com.br/latam/docs/fusao/brochure_pt.pdf · grupo latam airlines. grupo latam airlines. grupo latam airlines. Created Date: 6/25/2012

PMConsultant Latam

_LB224 LatAm

Security-SIG February, 2007 ISC/Information Security Basics of capturing and mounting forensic images Forensics 101:

Larousse Latam

Morvarid Co. - shirazartu.ac.irshirazartu.ac.ir/.../aeennameh_bargozari-hamayesh.pdf · Jots (ISC) l, (ISC) .a:s ISC . as (ISC) Title: Morvarid Co. Author: Morvarid Co. Subject: Morvarid

[email protected] [email protected] [email protected] [email protected] Assemblée Générale du 24 septembre

FundForum Latam