Search

Publisher Summary This chapter emphasizes the forensic aspects of memory collection and analysis practices. Recent developments in these areas have led to improved methods and tools and increased speculation into how these can be abused by an attacker. Evidence handling is a fundamental phase in the field of computer forensics and continues to be the driving force behind the development of volatile memory acquisition and analysis. The days of unplugging a system before gathering digital evidence for forensic analysis are nearly gone. Live forensics is now a necessity for first responders as it appears to have finally emerged from the legacy era throughout the security community. There are a number of full-disk encryption products on the market, and each has their benefits as well as drawbacks. Most are still susceptible to the cold-boot RAM-acquisition techniques, although some, like BitArmor, SSS have taken measures to prevent most of these attack strategies. To date, the best preventative approach to minimizing the threat of RAM acquisition is to turn the computer off when not in use. This simple habit can go a long way in protecting your encryption keys and valuable data in residing in RAM remnants. From an investigator's perspective, the data taken by a first responder from a crime scene has never been more crucial. Forensic memory analysis could soon provide acquittals for those wrongfully convicted in the past, much like DNA does today.

This chapter defines USB specifications, drivers, buffers, and types of overflows. It explores the historical aspects of the threats, peers into the future, and explains how one can detect and protect against these threats. Exploits that target buffer overflows are commonly used against operating systems, applications, or their dependencies. These can be considered the most common types of vulnerabilities still employed against legacy and current operating environments. Their exploitation usually relies on the modification of input variables similar to techniques used in SQL injection strikes. Individuals familiar with the exploitation of buffer overflows are usually well versed in x86 assembly and C languages, as well as have a general understanding of the respective operating system architecture. A crucial factor in keeping buffer pirates at bay is frequent updates to all system software. By default, Windows update and Microsoft update services will be set to automatic and should be left in this state. Most third-party applications and system utilities provide automatic updates for their components, and these should be enabled where applicable. Beware that some applications, plug-ins, and drivers are not automatically updated, and these will need to be managed using alternative methods.

We are currently facing a problem of pandemic proportions with viruses and other forms of malicious code being propagated through unexpected avenues. Advanced tactics are making it increasingly difficult to identify the actual source of this mischief. A majority of these threats now appear to be originating from Asia with fluctuating functionality. A While the risk of being exposed to malicious code is nothing new, how you can be exposed to it is swiftly transforming.

Publisher Summary This chapter investigates the “pod slurping” fiasco. It attempts to uncover the techniques involved in creating a slurping device, exploring recent advancements, and probing into the preventative aspects one should consider. The iPod is just one example of a convenient contraption that can be cleverly crafted into a portable snatcher. Any portable storage device can be used to slurp data from an unsuspecting host. iPhones, Blackberries, PDAs, cameras, flash drives, and mobile phones are just a few devices that can be altered to elicit desired information. The theater of this technological war is already saturated with quality tools for crackers, hackers, phrackers, and phreakers. These devices simply provide another stealthy deployment mechanism for an existing arsenal of weapons with portable properties. From a corporate standpoint, expulsion of these devices entirely could contradict the outcome it is intended to provide. Mobile phones and other memory-based gadgets are entrenched as an essential part of the enterprise and our daily lives. A sudden policy change enforcing their banishment could decrease morale, spike interest, or even lead to disgruntled behaviors. The lines between what can be beneficial or detrimental are twisting together more than ever. It is becoming increasingly difficult to determine which of the latest improvised illusions actually pose a true hazard. Adaptations of these attacks are evolving with increasing velocity, and the best thing we can do is constantly strive for enhanced awareness.

Publisher Summary This chapter focuses on Universal Serial Bus (USB) Hacksaw. It outlines the risks induced, and the available mitigation techniques for the systems. The original Hacksaw version was designed to use any configurable flash drive that can be customized with a compact disc, read-only memory (CD-ROM) partition. By leveraging the unique features of the U3 flash drives, it has the capability to install silently upon insertion. The drive will then act in a Trojan-like fashion as it copies the payload to an inconspicuous location, typically by way of an autorun mechanism enabled by the U3 CD-ROM emulation. The payload will then reside on the host by executing an initialization script each time the system is restarted. Once this is accomplished, the program monitors the system for external drives, and when detected, it will compress, split, and replicate all data to a mail account of the attacker stealthily. The Hacksaw puts a new spin on data security by preying on unsuspecting victims who do not comprehend the degree of negligence they might be exuding. New versions of this utility are already in the wild ready to pounce on systems deemed to have adequate protection. It seems the only protection against this is the education of the users who interact with the systems that can fall victim to these and related attacks.

This chapter explores the body of knowledge commonly known as social engineering twisted into a penetration-testing perspective. It gazes into the evolving fields, provides practical examples, builds a portable penetration platform, and discusses how to combat these clever confrontations. While social engineering and penetration philosophies have been around for several millennia, each are continually evolving and adapting to the information technology scene. Social engineering can generally be considered a subject under the broader spectrum of social sciences. While the social sciences definition typically refers to large-scale applications, the concept of influencing attitudes, popular beliefs, behaviors, and resources port quite nicely into the technological sector. With their portability and ease of use, it is no wonder that flash drives have become the most popular storage medium to date. The proliferation of these drives can be largely attributed to vendor freebies given away at classes, seminars, or any event providing product trial versions, marketing, or documentation. These devices can now be found in a wide range of decorative or concealing covers, which includes ink pens, wrist watches, and novelty items of all sorts. This might seem like a fun way to store the information, but it also enhances the ability to deploy covert operations. Absolute security can never actually be achieved; it is an ongoing process that demands constant attention and regulation. To sustain an effective security posture, all elements relating to an environment must be progressively fostered as fresh threats arrive and enterprises evolve. To continue to use software as the only protection mechanism is a foolish proposition.

Publisher Summary This chapter examines the USB Switchblade to uncover the clever yet mischievous usages this device can be engaged in. The Switchblade has more potential to wreak a higher degree of havoc on a system and its environment than its cousin, the Hacksaw. Administrator-level privileges are required to run most of the tools included in the Switchblade packages. The premise behind Switchblade is to provide a means for gathering vital information about a Windows system or the network in which it resides. Its modular design allows for developers to include additional toolsets and features with minimal effort. This tool would significantly benefit any administrator in need of a standard utility devised for isolated system troubleshooting and analysis. Data often thought to be inaccessible from a physical standpoint is now nearly effortlessly attainable. Most of the tools used by the USB Switchblade have been around for years. Information technology administrators and engineers are likely very familiar with some of these tools, just not the deployment methods. As with the USB Hacksaw, the method of use is what is important. As with most security strategies, a layered approach applied against USB types of attacks can be the most effective. Considering the convenient usages for auditing and general system administration, this deployment method could significantly increase in popularity. There are a large number of possible mutations a device of the Switchblade sort can take.