ANALYSIS OF THE EFFECT OF VSM ON THE MEMORY ACQUISITION PROCESS USING THE DYNAMIC ANALYSIS METHOD

Recently, acquiring the Random Access Memory (RAM) full memory and access data is gaining significant interest in digital forensics. However, a security feature on the Windows operating system - Virtual Secure Mode (VSM) - presents challenges to the acquisition process by causing a system crash known as a Blue Screen of Death (BSoD). The crash is likely to occur when memory acquisition tools are being used. Subsequently, it disrupts the goal of memory acquisition since the system must be restarted, and the RAM content is no longer available. This study analyzes the implications of VSM on memory acquisition tools as well as examines to what extent its impact on the acquisition process. Two memory acquisition tools, namely FTK Imager and Belkasoft RAM Capturer, were used to conduct the acquisition process. Static and dynamic code analyses were performed by using reverse engineering techniques that are disassembler and debugger. The results were compared based on the percentage of unreadable memory between active and inactive VSM. Static analysis showed that there is no difference between all applications’ functions for both active and inactive VSM. Further Bugcheck analysis of the MEMORY.DMP is pointed to the ad_driver.sys module in FTK Imager that causes the system to crash. The percentage of unreadable memory while running on active VSM and inactive VSM for Belkasoft is about 0.6% and 0.0021%, respectively. These results are significant as a reference to digital investigators as consistent with the importance of RAM dump in live forensics.

Today, webmail is being used in a number of organizations for all kinds of important communications as they move to cloud-based services. Several cyber threats involving phishing, malicious insider, unauthorized access to data and ransomware attacks are primarily carried out through webmail. This poses challenges and limitations for forensic investigators in the incident investigations involving emails, because actual email evidence is store at cloud service provider. The majority of work on email forensics and detection works on email information stored by email clients on desktop physical disk space. In order to gather artifacts from webmail used in browsers, volatile memory forensics is gaining popularity. However, few recent work utilizing memory forensics are focused on detecting email spoofing attempts from outside work by taking memory dumps of emails received by user from outside. This leaves the opportunity for malicious insiders to covertly send confidential data through webmail and remain undetected. In this work a novel framework is proposed, which models the malicious insider scenario and create the activity logs using volatile memory forensics. To implement and test the framework, a small tool was created using python. The framework is equally applicable for both public and private browsing. Our proposed method counters the limitation in previous schemes in terms of analyzing new email messages more efficiently using browser parent process ID. Our proposed method provides forensics investigators with a novel webmail tool that can be used to detect malicious email activity generated from with in the organisation.KeywordsEmail forensicsMalicious emailMemory forensicWebmail

The reliability of cyber forensic evidence acquisition is strongly influenced by the underlying operating systems, Windows, macOS, and Linux - due to inherent variations in file system structures, encryption protocols, and forensic tool compatibility. Disk forensics, one of the most widely used techniques in digital investigations, faces distinct obstacles on each platform. Windows, with its predominantly NTFS and FAT file systems, typically supports reliable disk imaging and analysis through established tools such as FTK Imager and Autopsy/Sleuth Kit. However, encryption features frequently pose challenges to evidence acquisition. Conversely, Linux environments, which rely on file systems like ext4 and XFS, generally offer greater transparency, yet the transient nature of log retention often complicates forensic analysis. In instances where anti-forensic strategies—such as encryption and compression— render traditional disk forensics insufficient, memory forensics becomes crucial. While memory forensic methodologies demonstrate robustness across Windows and Linux platforms forms through frameworks like Volatility, platform-specific difficulties persist. Memory analysis on Linux systems benefits from tools like LiME, snapshot utilities, and dd for memory acquisition; nevertheless, live memory acquisition on Linux can still present challenges. This research systematically assesses both disk and memory forensic acquisition techniques across samples representing Windows and Linux systems. By identifying effective combinations of forensic tools and configurations tailored to each operating system, the study aims to improve the accuracy and reliability of evidence collection. It further evaluates current forensic tools and highlights a persistent gap: consistently assuring forensic input reliability and footprint integrity. By integrating static analysis with temporal performance evaluations, this study emphasizes the importance of developing standardized forensic procedures to ensure the integrity and admissibility of evidence across diverse platforms. Establishing such standardized methodologies is imperative to maintaining the credibility and reliability of cyber forensic investigations in heterogeneous operating system environments.

Dynamic program analysis is extremely successful both in code debugging and in malicious code attacks. Fuzzing, concolic, and monkey testing are instances of the more general problem of analysing programs by dynamically executing their code with selected inputs. While static program analysis has a beautiful and well established theoretical foundation in abstract interpretation, dynamic analysis still lacks such a foundation. In this paper, we introduce a formal model for understanding the notion of precision in dynamic program analysis. It is known that in sound-by-construction static program analysis the precision amounts to completeness. In dynamic analysis, which is inherently unsound, precision boils down to a notion of coverage of execution traces with respect to what the observer (attacker or debugger) can effectively observe about the computation. We introduce a topological characterisation of the notion of coverage relatively to a given (fixed) observation for dynamic program analysis and we show how this coverage can be changed by semantic preserving code transformations. Once again, as well as in the case of static program analysis and abstract interpretation, also for dynamic analysis we can morph the precision of the analysis by transforming the code. In this context, we validate our model on well established code obfuscation and watermarking techniques. We confirm the efficiency of existing methods for preventing control-flow-graph extraction and data exploit by dynamic analysis, including a validation of the potency of fully homomorphic data encodings in code obfuscation.

Memory forensics plays a pivotal role in digital investigations, providing crucial insights into the activities and artifacts of an operating system. This paper explores the application of deep learning techniques in the domain of memory forensics within the Linux environment. Linux-based systems are widely used in various contexts, including servers, embedded devices, and desktops, making memory analysis in this ecosystem of paramount importance. Traditional memory forensics techniques have relied on manual analysis, which is often time-consuming and error prone. Deep learning, a subfield of machine learning, has demonstrated remarkable capabilities in pattern recognition and feature extraction tasks. In response, this paper presents a novel framework that automates and improves memory analysis through deep learning. Key components of this framework include data collection, preprocessing, feature extraction, and model selection. We introduce a unique dataset specifically curated for Linux memory forensics, facilitating the development and evaluation of deep learning models. Our experimental results demonstrate the efficacy of using a ResNet-50 model for detecting and classifying malware from memory dumps, achieving a detection rate of 98.75% and an accuracy rate of 89% in classifying malware types. Additionally, we acknowledged the challenges and limitations of applying deep learning in memory forensics, such as model interpretability and data privacy concerns. Future research directions are discussed, including real-time memory analysis integration and techniques for handling encrypted and compressed memory data.

Optimizing the controller IC for micro HDD process based on Taguchi methods

Concurrency programs are hard to test or debug due to their non-deterministic nature. Existing dynamic program analysis approaches tried to address this by carefully examine a recorded execution trace. However, developing such analysis tools is complicated, requiring to take care of many tedious implementation details, and comparing and evaluating different analysis approaches are also subject to various biases, due to lack of a common base platform. This motivates us to design DPAC, an infrastructure that support in building dynamic program analysis tools for concurrency Java programs. DPAC takes events and their various processing mechanisms as its underlying model to facilitate monitoring and manipulation of program executions as required by dynamic program analysis. Various analysis tools can be implemented by customizing their required event types and processing mechanisms. We show two concrete case studies how our DPAC helps building existing dynamic program analysis approaches, as well as tuning subtle implementation details for supporting customized function implementation and code transformation.

Buffer overflow (BOF) vulnerabilities when present in code can be exploited to violate security objectives such as availability, confidentiality and integrity. They make up substantial portion of input manipulation attacks due to their common presence and ease of exploitation. In this study, the authors propose a hybrid approach combining static and dynamic program analysis with machine learning to audit BOFs. Simple rules to generate test data is proposed to confirm some of the vulnerabilities through dynamic analysis. Confirmed cases can be fixed by developers without further verification. Statements whose vulnerability is not confirmed by dynamic analysis are predicted by mining static code attributes. In the authors’ evaluation using standard benchmarks, their best classifier achieved a recall over 93% and accuracy >94%. Dynamic analysis itself confirmed 34% of known vulnerabilities along with reporting six new bugs, thereby reducing by third, otherwise needed manual auditing effort.

Programming tools have expanded both in scope of the problems they solve, and in the kinds of techniques they use. Traditionally, programming tools have focused on detecting errors in programs. Recently, this scope has broadened to help with other programming tasks, including inferring specifications, helping diagnose root cause of errors during debugging, and managing knowledge in large projects. Also, traditionally programming tools have been based on either static or dynamic program analysis. Modern programming tools combine static and dynamic program analysis together with techniques from other disciplines such as statistical and probabilistic inference, and information retrieval. This paper reports on some such tools built by the Rigorous Software Engineering group at Microsoft Research India.

Physical memory acquisition is a prerequisite when performing memory forensics, referring to a set of techniques for acquiring and analyzing traces associated with user activity information, malware analysis, cyber incident response, and similar areas when the traces remain in the physical RAM. However, certain types of malware have applied anti-memory forensics techniques to evade memory analysis strategies or to make the acquisition process impossible. To disturb the acquisition process of physical memory, an attacker hooks the kernel API, which returns a map of the physical memory spaces, and modifies the return value of the API, specifically that typically used by memory acquisition tools. Moreover, an attacker modifies the kernel object referenced by the kernel API. This causes the system to crash during the memory acquisition process or causes the memory acquisition tools to incorrectly proceed with the acquisition. Even with a modification of one byte, called a one-byte modification attack, some tools fail to acquire memory. Therefore, specialized countermeasure techniques are needed for these anti-memory forensics techniques. In this paper, we propose a memory layout acquisition method which is robust to kernel API hooking and the one-byte modification attack on NumberOfRuns, the kernel object used to construct the memory layout in Windows. The proposed acquisition method directly accesses the memory, extracts the byte array, and parses it in the form of a memory layout. When we access the memory, we extract the _PHYSICAL_MEMORY_DESCRIPTOR structure, which is the basis of the memory layout without using the existing memory layout acquisition API. Furthermore, we propose a verification method that selects a reliable memory layout. We realize the verification method by comparing NumberOfRuns and the memory layout acquired via the kernel API, the registry, and the proposed method. The proposed verification method guarantees the reliability of the memory layout and helps secure memory image acquisition through a comparative verification with existing memory layout acquisition methods. We also conduct experiments to prove that the proposed method is resistant to anti-memory forensics techniques, confirming that there are no significant differences in time compared to the existing tools.

In 2014, laptops shipping with solid-state drives (SSDs) were just over 20% of the total market. There are projections that this could increase considerably over the next few years, possibly reaching over 50% of the market by 2017 [1]. This trend is driven by the decreasing costs for SSD storage capacity and the longer battery life that is possible with SSD laptops. Presently, SSDs with 256-GB capacity sell for about US$90. SSDs are still at least four-times more expensive in US$/GB than hard-disk drives (HDDs) (a 1-TB notebook HDD sells for about US$50 while a 1-TB SSD sells for about US$400) [2]. A 256-GB storage capacity is enough to hold many applications and two operating systems, with some room for data storage.

Dynamic program analysis encompasses the development of techniques and tools for analyzing computer software by exploiting information gathered from a program at runtime. The impressive amounts of data collected by dynamic analysis tools require efficient indexing and compression schemes, as well as on-line algorithmic techniques for mining relevant information on-the-fly in order to identify frequent events, hidden software patterns, or undesirable behaviors corresponding to bugs, malware, or intrusions. The paper explores how recent results in algorithmic theory for data-intensive scenarios can be applied to the design and implementation of dynamic program analysis tools, focusing on two important techniques: sampling and streaming.

Whitebox fuzzing is a novel form of security testing based on dynamic symbolic execution and constraint solving. Over the last couple of years, whitebox fuzzers have found many new security vulnerabilities (buffer overflows) in Windows and Linux applications, including codecs, image viewers and media players. Those types of applications tend to use floating-point instructions available on modern processors, yet existing whitebox fuzzers and SMT constraint solvers do not handle floating-point arithmetic. Are there new security vulnerabilities lurking in floating-point code?A naive solution would be to extend symbolic execution to floating-point (FP) instructions (months of work), extend SMT solvers to reason about FP constraints (months of work or more), and then face more complex constraints and an even worse path explosion problem. Instead, we propose an alternative approach, based on the rough intuition that FP code should only perform memory safe data-processing of the payload of an image or video file, while the non-FP part of the application should deal with buffer allocations and memory address computations, with only the latter being prone to buffer overflows and other security critical bugs. Our approach combines (1) a lightweight local path-insensitive may static analysis of FP instructions with (2) a high-precision whole-program path-sensitive must dynamic analysis of non-FP instructions. The aim of this combination is to prove memory safety of the FP part of each execution and a form of non-interference between the FP part and the non-FP part with respect to memory address computations.We have implemented our approach using two existing tools for, respectively, static and dynamic x86 binary analysis. We present preliminary results of experiments with standard JPEG, GIF and ANI Windows parsers. For a given test suite of diverse input files, our mixed static/dynamic analysis is able to prove memory safety of FP code in those parsers for a small upfront static analysis cost and a marginal runtime expense compared to regular dynamic symbolic execution.

반궤도식 임내작업차의 주행안정성 분석을 위하여 동역학분석 프로그램인 RecurDyn을 이용하여 횡전도 분석, 등판능력 분석, 장애물 통과 시뮬레이션을 수행하였다. 동역학분석 프로그램을 해석하는데 필요한 반궤도식 임내 작업차의 형상은 3D CAD모델러인 AutoCAD 3D를 이용하여 모델링하였다. 반궤도식 임내작업차의 공차 및 적재 시에서 횡단기울기 $20^{\circ}$ 이하의 지형에서 주행하는 것이 안전하다는 것을 알 수 있었으며, 종단기울기 시뮬레이션에서는 공차 및 적재 시에 종단경사 $28^{\circ}$ 미만의 지역에서 주행하는 것이 안정적인 것으로 판단되었다. 장애물 통과 시의 주행안정성은 공차 및 적재의 경우, 전륜타이어가 주행속도 각각 5 km/hr 및 4 km/hr 이상일 때 지면과 분리되는 것으로 예측되었으며, 후륜궤도는 지면과의 분리현상이 나타나지 않았으므로 장애물 통과 시에는 최대 5 km/hr 이하가 안전하다는 것을 알 수 있었다. 【This study was conducted to analyze the running stability of a semi-crawler type mini-forwarder. The running stability analysis was performed by using a dynamic analysis program, RecurDyn. Physical properties of the semi-crawler type mini-forwarder was performed by using 3D CAD modeler, AutoCAD 3D. As a result from the computer simulation of stationary sideways overturning, it was found that the semi-crawler type mini-forwarder runs safely on a road with a slope not bigger than $20^{\circ}$ regardless whether it is empty or loaded, but in case of a road with a slope bigger than $20^{\circ}$ , it is assumed that it is difficult for the car to run safely due to some dangers. In addition, it was found that the critical slope of its sideways overturning gets much smaller when empty since the location of its gravity center is elevated and much higher when it is loaded. As a result from the computer simulation of its hill-climbing ability, since the running speed is unstable in case of a road with a vertical slope not smaller than $28^{\circ}$ , it is assumed that it is safe to drive it on a road with a slope not bigger than $28^{\circ}$ . Taking a look at the result from an analysis of the running safety when it passes an obstacle, it was observed that a front tire comes off the ground when the running speed of the car is 5 and 4 km per hour respectively when it is empty and loaded while the gravity center of the front tire is watched. When taking a look at the changes in the location of the gravity center of the rear wheel crawler shaft, it was not found that the shaft comes off the ground at the test speeds both when it is empty and loaded.】

Embedded systems are an integral part of almost every electronic product today. From consumer electronics to industrial components in SCADA systems, their possible fields of application are manifold. While especially in industrial and critical infrastructures the security requirements are high, recent publications have shown that embedded systems do not cope well with this demand. One of the reasons is that embedded systems are being less scrutinized as embedded security analysis is considered to be more time consuming and challenging in comparison to PC systems. One of the key challenges on proprietary, resource constrained embedded devices is dynamic code analysis. The devices typically do not have the capabilities for a full-scale dynamic security evaluation. Likewise, the analyst cannot execute the software implementation inside a virtual machine due to the missing peripheral hardware that is required by the software to run. In this paper, we present PROSPECT, a system that can overcome these shortcomings and enables dynamic code analysis of embedded binary code inside arbitrary analysis environments. By transparently forwarding peripheral hardware accesses from the original host system into a virtual machine, PROSPECT allows security analysts to run the embedded software implementation without the need to know which and how embedded peripheral hardware components are accessed. We evaluated PROSPECT with respect to the performance impact and conducted a case study by doing a full-scale security audit of a widely used commercial fire alarm system in the building automation domain. Our results show that PROSPECT is both practical and usable for real-world application.