00:00:00.083-->00:00:06.208
>>So a little bit about me um
I’ve been a hacker for awhile in
case you didn’t know. Um one of

00:00:06.208-->00:00:12.958
the tools I’ve written recently
uh it actually started way back
in Def Con 22 as the process

00:00:12.958-->00:00:17.958
detection mechanism for
detecting processes in physical
memory by page table detection

00:00:20.875-->00:00:26.833
and there’s a lot of reserve
bits that you needed and because
of you know, characteristics

00:00:26.833-->00:00:32.625
about how the page table is
organized in particular the self
pointer um I could detect all

00:00:32.625-->00:00:37.500
these process and uh you know,
they were pointing up at the
screen and you were like oh

00:00:37.500-->00:00:43.083
cause there’s a VM running and
it could even detect the
processes in the VM, you know

00:00:43.083-->00:00:48.083
i-i-in the nested-wise. And uh,
that gave me the idea to kind of
keep developing th- the tool and

00:00:50.250-->00:00:55.000
or the you know tool set and
here we are a few years later
with uh something I think is

00:00:55.000-->00:01:00.000
pretty cool uh you’ll see it at
the end hopefully but um it’s
all on Github right now. Uh, it

00:01:02.917-->00:01:07.917
does a full integrity checking
of code pages in memory and you
just golden image your VM and

00:01:10.375-->00:01:14.583
you can just check it any time
you want. So that’s going to be
like uh hopefully we get to see

00:01:14.583-->00:01:19.583
a little demo. Um, over all the
outline of what we’re going to
talk about today is um how to

00:01:23.875-->00:01:28.875
forensic, how to f**k forensics,
um how to un-f**k it. Um I don’t
know how much uh any of you guys

00:01:32.042-->00:01:38.125
have done forensics but it can
be a very frustrating uh
proposition. There’s a lot of uh

00:01:38.125-->00:01:43.125
tactics used by adversaries to
um misdirect you to uh cause you
to do extra work and cost the

00:01:46.750-->00:01:51.500
people a lot of money and time.
So overall there’s been a lot of
techniques over the years. I’ve

00:01:51.500-->00:01:58.167
got a couple slides on uh like
a-uh uh break out of different
things that I borrowed from uh

00:01:58.167-->00:02:03.167
another presentation. Um but uh
last year uh in eighty did this
AF presentation uh as f**k but

00:02:06.792-->00:02:11.792
it means anti-forensics and
um-uh he did this uh interesting
um mechanism to break certain

00:02:14.333-->00:02:19.333
tools and then uh the RoP stuff
is gonna be how forensics kind
of meets reverse engineering and

00:02:21.750-->00:02:28.125
kind of meets uh like low level
analysis and how you know these
different uh domains are kind of

00:02:28.125-->00:02:32.917
overlapping a bit and you got to
really have an understanding at
least of these things and maybe

00:02:32.917-->00:02:37.750
look out for them. Um and I got
some references of some cool
tools one of the guys from Cisco

00:02:37.750-->00:02:42.750
Talos did recently um pretty
awesome um and then um-uh
CloudLeech is uh-um a rip I did

00:02:45.208-->00:02:50.208
on um-uh Ul Frisks’ DMA uh PCI
Leech stuff um and uh was going
to have a demo of like uh

00:02:53.792-->00:02:59.667
unlocking a cloud container um
but trust me it all works great,
it all works great [laugh] just

00:02:59.667-->00:03:06.458
imagine it. Wave my hands
around. So um the forensic
process in general kind of uh

00:03:06.458-->00:03:11.667
starts out um in the most basic
form of trying to find out the
timeline of events that happen

00:03:11.667-->00:03:16.208
and trying to reconstruct and
understandings of comprehension
of like what happened. What’s

00:03:16.208-->00:03:21.750
the capability of this guy? What
can he do? How much do I have to
backpedal or you know, how hard

00:03:21.750-->00:03:26.750
do I have to come? Do I have to
redeploy my, you know, domain
controllers or can I just format

00:03:29.333-->00:03:34.333
some backups? You know, or-r-r-r
un-ya know, unroll some tapes
and uh we’re good. So um these

00:03:41.833-->00:03:46.833
artifacts often come from disks
or ya know log event sources and
ya know, the better you are at

00:03:49.500-->00:03:56.083
providing high quality sources
um ya know at the front end. And
like have your infrastructure

00:03:56.083-->00:04:01.500
monitored properly, um in
different ways, you’ll have
better luck in the back end

00:04:01.500-->00:04:07.292
because um ya know it’s easy to
tamper with one machine but it’s
hard, ya know to go after and

00:04:07.292-->00:04:12.083
compromise the logging that’s
going on in multiple systems and
to try uh you know, if the

00:04:12.083-->00:04:17.083
attackers have to now subvert
remoting events and things like
that, it makes his job a lot

00:04:21.167-->00:04:26.750
harder. Uh,so this one is um
talking about some different uh
tools you can use and different

00:04:26.750-->00:04:32.000
ways you can go about it. Um
Mark Russinovich uh did this
SysMon stuff which really

00:04:32.000-->00:04:37.167
enhances the windows events
tools but I don’t know how many
of you guys have um or people

00:04:37.167-->00:04:43.500
have used uh Wevtutil uh you
know i used to, I grew up in
windows and back in the day it

00:04:43.500-->00:04:49.625
used to be like event log and it
was like system app programs
like there are like four of them

00:04:49.625-->00:04:54.083
um there’s like almost twelve
hundred of them that you can
configure. And this will log

00:04:54.083-->00:04:59.708
everything from like binders
being executed to really the
manucha of you VP connections

00:04:59.708-->00:05:06.542
and what packets got dropped and
firewalls all kinds of stuff and
this is uh an amazing um set of

00:05:06.542-->00:05:13.292
laws that can really boost uh
your understanding or your
comprehension of events and you

00:05:13.292-->00:05:18.500
can tie it together easier and
it’s a lot more difficult to
mask your activity um when you

00:05:18.500-->00:05:24.500
gotta kind of compromise
different logs. Um swift on
security security um has a

00:05:24.500-->00:05:30.958
github repro that um has a bunch
of uh SysMon configs which will
help make um running SysMon a

00:05:30.958-->00:05:35.958
lot easier uh and- and more
concise as it were. And also if
you're in the Linux space, I

00:05:38.292-->00:05:43.208
don't want to be totally Windows
focused here but in the Linux
space, um uh go ahead and take a

00:05:43.208-->00:05:48.208
look at um OS query from github.
So handling memory, uh you know,
has gotten uh pretty uh-uh

00:05:50.333-->00:05:57.333
intense over the years and uh
there’s a lot of different tools
here as well. Um essentially you

00:05:57.333-->00:06:02.000
want to reconstruct like what is
actually running and developing
and understanding of what was

00:06:02.000-->00:06:07.500
running from the artifacts in
memory and um, ya know, this is
where we start getting into

00:06:07.500-->00:06:12.000
reverse engineering component of
it. Uh Stephen Ridley has this
really cool tool for sandbox

00:06:12.000-->00:06:17.000
memory hacking um, should
totally check that out and
always the game hacking space.

00:06:17.000-->00:06:21.750
And if you really want to go
farther and understand the
limits of what people are doing

00:06:21.750-->00:06:26.750
um it’s a good way to go. Um so
hiding really well, misdirecting
and uh or like exploiting people

00:06:29.333-->00:06:35.208
um Alex Stamos actually uh way
back in Def Con 15 did this talk
with a couple other guys uh on

00:06:35.208-->00:06:42.083
breaking forensic software and
they had like NTFS hacks um they
had like N case exploits and

00:06:42.083-->00:06:46.750
stuff like this. So this stuff
still goes on. Um and that’s
kind of in the vein of what um

00:06:46.750-->00:06:53.458
dual core like N80 guy did um uh
last year. Um in trying to
attack the tool. This is the

00:06:53.458-->00:06:58.458
overall kind of uh anti
forensics testimony and it kind
of breaks out all these

00:07:00.500-->00:07:05.292
different techniques that all
these guys came up with and they
try to expand on this is some

00:07:05.292-->00:07:09.167
academic guys that you can check
the reference out and uh they
are trying to get more in this

00:07:09.167-->00:07:14.167
space and uh publish papers in
that area. Um uh sorry I didn’t
make the slides for this cd or

00:07:16.000-->00:07:20.167
anything. I’m going to upload
them to get hub in the, in my
repro if you guys want to check

00:07:20.167-->00:07:23.708
and I’m also going to pass them
to the needy people after.
Foreshadow is like, if you can

00:07:23.708-->00:07:29.000
normalize your tactics as an
attacker into like what to
expect of the network then um ya

00:07:29.000-->00:07:35.042
know it’s a lot harder to be
seen if you’re like assumed to
be like a regular guy. Like I’m

00:07:35.042-->00:07:40.542
a VPN user what, ya know? And um
so you know if the attacker gets
in a reconfigures your system

00:07:40.542-->00:07:47.167
and just uses what’s there ya
know. Um so the counter to N80s
anti-forensics the

00:07:47.167-->00:07:52.958
counter,counter to this is more
or less there’s always
additional sources to this, just

00:07:52.958-->00:07:56.500
like logs in memory. There’s
always going to be additional
sources to take advantage of. In

00:07:56.500-->00:08:02.542
particular for his um my tool
inventoro works out of the box.
It, because I base all of the

00:08:02.542-->00:08:09.000
dumping on page tables and
that’s something defined by the
ABI and hardware and you can’t

00:08:09.000-->00:08:15.542
really mess that up so to speak
in the same way. Um I believe
voluntary lady in recall have an

00:08:15.542-->00:08:20.917
option for uh using dad’s to
discriminate the pages for your
executables and make them easier

00:08:20.917-->00:08:25.375
to dump them as well so um with
a little digging you can always
find a way to kind of get around

00:08:25.375-->00:08:29.917
this stuff. So the RoP, sorry I
know I gotta make this quick, I
burnt up so much time um with

00:08:29.917-->00:08:39.583
the monitor. Um anyhow, the
monitors, I mean the RoPs um uh
ya know becoming there an

00:08:39.583-->00:08:44.917
attack, exploitation um
technique but now it’s being
seen that they are actually

00:08:44.917-->00:08:49.542
becoming a persistence method.
So gargoyle was like the public
example of like how to, how to

00:08:49.542-->00:08:54.917
interactive with the Ropp and
how to make it persistent threat
out of it as opposed to just

00:08:54.917-->00:08:59.708
like and exploit. And it sort of
waits on a timer and then
evaluates the stack a little bit

00:08:59.708-->00:09:05.583
and sets up a window to jump in
and out of kind of like it’s a
uh-uh you know little splash

00:09:05.583-->00:09:11.792
jump and he’ll jump into one
page on a timer, on and off.
Anyhow, the way this RoP works

00:09:11.792-->00:09:19.083
um it actually gets a little bit
easy to detect because it’s not
exactly perfect either um uh so

00:09:19.083-->00:09:23.000
I’m just going to jump right to
the tools because I know I’m
running so short. RoP MEU is

00:09:23.000-->00:09:29.792
this really cool tool that um
actually will evaluate a rock
chain and if you want to do some

00:09:29.792-->00:09:34.208
analysis of like what is this
ropp doing cause it’s really
hard to, if you got a ropp in

00:09:34.208-->00:09:38.833
the stack like understanding
what all the little micro
gadgets are what you would turn

00:09:38.833-->00:09:47.167
into that does a little
operation so that you can uh ya
know construct shell code or

00:09:47.167-->00:09:53.208
execute something and you have
to change these together. So
anyhow, RoP MEU will take these

00:09:53.208-->00:09:58.750
opps and actually emit an elf
binary that you can just throw
into IDA, which is pretty dope,

00:09:58.750-->00:10:04.583
and uh also um so inventero my
tool as well has a ropp
detection built into it for

00:10:04.583-->00:10:12.542
forensics. So in the tool know
if gargoyle or something like
gargoyle is running. Lots of

00:10:12.542-->00:10:16.583
different injection techniques
over the years, a lot of these
are kind of variations of a

00:10:16.583-->00:10:23.708
theme. Um ya know, more or less
loading a binary up and like
using part of the address space

00:10:23.708-->00:10:29.167
to inject your own code so that
your hiding again. Always those
attackers are going to want to

00:10:29.167-->00:10:34.083
hide in something that’s in, ya
know hiding in something that is
in the ya know trees or the

00:10:34.083-->00:10:41.250
grass or whatever else. Um so
another one [laugh] sorry to
keep going like this, this is um

00:10:41.250-->00:10:47.375
so in a sense the PCI leech in s
kind of like a code cave attack
because it’s the inline patch

00:10:47.375-->00:10:52.875
and inline patches are really
really hard to detect because
they are not modifying something

00:10:52.875-->00:10:58.000
that normal hookers do which is
like an import table or an entry
point or prolog or something

00:10:58.000-->00:11:02.875
like this. It’s actually just
like in the bitstream of the
binary so unless you're actually

00:11:02.875-->00:11:08.208
reverse engineering or dumping
like the whole address space of
the OS to the an-an-and manually

00:11:08.208-->00:11:13.292
going through and uh auditing it
or something like that. You’re
going to have a really hard time

00:11:13.292-->00:11:18.042
understanding if you’ve been
comprehensive and if you
understand everything you’re

00:11:18.042-->00:11:24.375
looking at in terms of a memory
dump. So um uh that’s where kind
of integrity validation comes in

00:11:24.375-->00:11:30.625
and this is the feature that I
uh released um just a couple
weeks ago and um it does

00:11:30.625-->00:11:37.417
essentially sixty four bite
piecewise hashing over binary.
So you’re all the tech segments

00:11:37.417-->00:11:43.000
of all the binaries that you
whitelist or golden image that
converted into this database

00:11:43.000-->00:11:49.333
then you can go and test your
machines and go hey, is this
thing what I think it is? And a

00:11:49.333-->00:11:55.625
lot of people did pages for uh
hashing, but I don’t even want
to disassemble four kilobytes

00:11:55.625-->00:12:01.750
like a page is 4K, that’s a lot
of assemble instructions. So I
support like a configurable size

00:12:01.750-->00:12:06.583
that you specify, you’re like ya
know, I don’t want to spend any
time at all disassembling so you

00:12:06.583-->00:12:12.042
could just say sixty four bytes
and then if it detects like a
patch in these bytes um it goes

00:12:12.042-->00:12:16.208
right to the byte that is
patched or like right near it
it’s going to only be three or

00:12:16.208-->00:12:22.625
four instructions there. Um to
tie it all together, uh always
use complementary sources and uh

00:12:22.625-->00:12:28.250
build an understanding of like
ya know the latest techniques
and understand these things are

00:12:28.250-->00:12:34.125
coming and they do happen and
the lack of visibility into uh
an understanding of these um

00:12:34.125-->00:12:40.708
methodologies can leave you with
some gaps in the understanding
of what you’re looking at. Um,

00:12:40.708-->00:12:45.667
and my hope was to show you this
tool and it’s got a really
awesome output where um ya know,

00:12:45.667-->00:12:51.125
it’ll uh I’ll just give it a
shot while I’m up here. Um, how
do I get this thing out of here?

00:12:51.125-->00:13:06.958
Oh here we go, um if I do get a
chance to run it. If I get one
second here. Hold on. Oh it’s

00:13:06.958-->00:13:23.667
the wrong cable. Oh well, they
don’t have it. Nuts, wha wha. Um
sorry. Oh wait, is that it? No,

00:13:23.667-->00:13:31.125
ok sorry well any questions? Um
[applause] Go check the tool
out, ya know [applause] Full

00:13:31.125-->00:13:40.375
integrity checking, golden image
of your VM. I also have live
editing. If anyone has ever used

00:13:40.375-->00:13:44.708
Pydebug? I’ve got a similar
concept where I reflect all the
native kernel, all the symbols

00:13:44.708-->00:13:51.625
reflect into ironpython which is
dot net so you can basically go
like e process dot image path

00:13:51.625-->00:13:57.750
name equals foo and it can write
back to the memory imagine that
you’re looking at so you can

00:13:57.750-->00:14:03.208
suspend the m-ware, edit it with
this tool and then resume it.
And then whatever will happen

00:14:03.208-->00:14:08.958
the kernel will happen and the,
the thing that um will protect
you is normally you got a set of

00:14:08.958-->00:14:15.625
BCD entries for debugging but if
you’re dealing with an advanced
adversary uh that’ll actually

00:14:15.625-->00:14:20.083
tip them off, that they are in
ya know monitored environment so
when, ya know you configure the

00:14:20.083-->00:14:25.625
BCD debug it changed the kernel
and what not so um that was the
concept behind the passive

00:14:25.625-->00:14:31.917
active memory hacking. Um ya
know, give it a shot on github
and uh. Thanks again everybody.

00:14:31.917-->00:00:00.000
Thanks. [applause]