ADSandbox: Sandboxing JavaScript to fight Malicious Websites - Dewald, Andreas; Holz, Thorsten; Freiling, Felix (Proceedings of the 2010 ACM Symposium on Applied Computing, 2010)
We present ADSandbox, an analysis system for malicious websites that focusses on detecting attacks through JavaScript. Since, in contrast to Java, JavaScript does not have any built-in sandbox concept, the idea is to execute any embedded JavaScript within an isolated environment and log every critical action. Using heuristics on these logs, ADSandbox decides whether the site is malicious or not. In contrast to previous work, this approach combines generality with usability, since the system is executed directly on the client running the web browser before the web page is displayed. We show that we can achieve false positive rates close to 0% and false negative rates below 15% with a performance overhead of only a few seconds, what is a bit high for real time application, but supposes a great potential for future versions of our tool. © 2010 ACM.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.lehrst.adsand
Keywords: drive-by downloads; dynamic analysis; malicious software

AESSE: A Cold-boot Resistant Implementation of AES - Müller, Tilo; Dewald, Andreas; Freiling, Felix (Proceedings of the Third European Workshop on System Security, 2010)
Cold boot attacks exploit the fact that memory contents fade with time and that most of them can be retrieved after a short power-down (reboot). These attacks aim at retrieving encryption keys from memory to thwart disk drive encryption. We present a method to implement disk drive encryption that is resistant to cold boot attacks. More specifically, we implemented AES and integrated it into the Linux kernel in such a way that neither the secret key nor any parts of it leave the processor. To achieve this, we used the SSE (streaming SIMD extensions) available in modern Intel processors in a non-standard way. We show that the performance penalty is acceptable and present a brief security analysis of the system. Copyright 2010 ACM.
UnivIS-Import:2015-04-16:Pub.2010.tech.IMMD.lehrst.aessea
Keywords: Advanced encryption standard; Cold boot attacks; Linux kernel; Streaming SIMD extensions

Analyse und Vergleich von BckR2D2-I und II - Dewald, Andreas; Freiling, Felix; Schreck, Thomas; Spreitzenbarth, Michael; Stüttgen, Johannes; Vömel, Stefan; Willems, Carsten (Sicherheit 2012: Sicherheit, Schutz und Zuverlässigkeit, Beiträge der 6. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft für Informatik e.V. (GI), 2012)
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.lehrst.analys

Analyse und Vergleich von BckR2D2-I und II - Dewald, Andreas; Freiling, Felix; Schreck, Thomas; Spreitzenbarth, Michael; Stüttgen, Johannes; Vömel, Stefan; Willems, Carsten (2011)
UnivIS-Import:2016-06-30:Pub.2011.tech.IMMD.lehrst.analys
Keywords: Backdoor; Trojan; Analysis; Malware; Trojaner; R2D2; Schadsoftware; Analyse

Design and Implementation of a Documentation Tool for interactive Commandline Sessions - Dewald, Andreas; Freiling, Felix; Weber, Tim (Sixth International Conference on IT Security Incident Management and IT Forensics, 2011)
In digital investigations it is important to document the examination of a computer system with as much detail as possible. Allthough never designed for digital investigations, many experts use the software script to record their whole terminal session while analyzing a target system. We analyze script's deficiencies and present the design and implementation of for script (forensic script), a software providing additional capabilities and mechanisms for digital investigations, following the paradigm of literate programming. © 2011 IEEE.
UnivIS-Import:2015-04-20:Pub.2011.tech.IMMD.lehrst.design

Drei Jahre Master Online Digitale Forensik: Ergebnisse und Erfahrungen - Brodowski, Dominik; Dewald, Andreas; Freiling, Felix; Kovacs, Steve; Rieger, Martin (Sicherheit 2014 – Sicherheit, Schutz und Zuverlässigkeit, 2014)
UnivIS-Import:2015-04-17:Pub.2014.tech.IMMD.lehrst.dreija

Forensic Application-Fingerprinting based on file system Metadata - Kälber, Sven; Dewald, Andreas; Freiling, Felix (Proceedings of the 7th International Conference on IT Security Incident Management & IT Forensics, 2013)
While much work has been invested in tools for aquisition and extraction of digital evidence, there are only few tools that allow for automatic event reconstruction. In this paper, we present a generic approach for forensic event reconstruction based on digital evidence from file systems. Our approach applies the idea of fingerprinting to changes made by applications in file system metadata. We present a system with which it is possible to automatically compute file system fingerprints of individual actions. Using NTFS timestamps as an example, we show that with our approach it is possible to automatically reconstruct actions performed by different applications even if the set of files accessed by those actions overlap. © 2013 IEEE.
UnivIS-Import:2015-04-16:Pub.2013.tech.IMMD.lehrst.forens
Keywords: Application Fingerprinting; Digital Forensics; Digital Investigation; Event Reconstruction

Forensische Informatik - Dewald, Andreas; Freiling, Felix (Books on Demand, 2011)
UnivIS-Import:2015-04-02:Pub.2011.tech.IMMD.lehrst.forens_0

From Computer Forensics to Forensic Computing: Investigators Investigate, Scientists Associate - Dewald, Andreas; Freiling, Felix (2014)
UnivIS-Import:2016-06-30:Pub.2014.tech.IMMD.lehrst.fromco

Information Leakage behind the Curtain: Abusing Anti-EMI Features for Covert Communication - Bauer, Johannes; Schinzel, Sebastian; Freiling, Felix; Dewald, Andreas (Proceedings of HOST 2016, 2016)
We present a new class of covert channels which can be created by utilizing common hardware but that cannot be detected by such. Our idea is to abuse anti-EMI features of a processor to create a covert channel on the physical layer. Thus, the sender uses the invariants in how digital signals are encoded over analog channels to covertly transport information. This leaked data is present on the wire bound connections of the compromised device, but is also by definition present in the vicinity of the device and can be picked up by radio equipment. As the covert channel is present only on the physical layer, the data on all layers above, as well as the timing behavior on those layers is indistinguishable from uncompromised devices.
UnivIS-Import:2017-03-24:Pub.2016.tech.IMMD.lehrst.inform
Keywords: Covert channel; Elektromagnetische Verträglichkeit; Verdeckter Kanal

Is Computer Forensics a Forensic Science? - Dewald, Andreas; Freiling, Felix (Proceedings of Current Issues in IT Security 2012, 2012)
UnivIS-Import:2015-04-16:Pub.2012.tech.IMMD.lehrst.iscomp

Kriterien für die Priorisierung bei der Sicherung und Analyse digitaler Spuren - Bäcker, Matthias; Dewald, Andreas; Freiling, Felix; Schmitt, Sven (Datenschutz und Datensicherheit, 2012)
Durch die zunehmende Verbreitung digitaler Geräte in allen Lebensbereichen werden diese immer häufiger als Beweismittel für die Aufklärung von Straftaten aller Art relevant. Zugleich steigt mit der Speicherkapazität dieser Geräte auch das Datenaufkommen — und übersteigt bereits heute häufig die Kapazitäten ermittelnder Stellen. Daher ist es notwendig, die Sicherung und Analyse dieser Daten zu priorisieren. Der Beitrag zeigt, wie eine Priorisierung in gängige Vorgehensmodelle der digitalen Forensik eingebettet werden kann, und schlägt Kriterien für diese Priorisierung vo
UnivIS-Import:2015-03-09:Pub.2012.tech.IMMD.lehrst.kriter

Linux Memory Forensics: Expanding Rekall Userland Investigation - Stadlinger, Johannes; Block, Frank; Dewald, Andreas (2018 11th International Conference on IT Security Incident Management & IT Forensics (IMF), 2018)
The field of memory forensics is getting more important in forensic investigations for obtaining valuable data of a running system. Besides kernel artifacts, there might be also plenty of interesting data in the heap of a user space process, but unfortunately, that area has not yet received the attention it deserves in the forensic field. This paper shows that the heap of user applications may also be a rich source of information including data like credentials that can be helpful in a forensic investigation. With the help of the HeapAnalysis plugins, previously published by Block, we examined the heap of selected Linux userland software and managed to identify data of interest and also certain application-internal structures, which link those data snippets together. The result of our analysis is a set of plugins for the Rekall framework, enabling an investigator to automatically extract process-related information such as login credentials, command history and file information for those application

Möglichkeiten und Grenzen KI-gestützter Analyse digitaler Spuren - Dewald, Andreas; Freiling, Felix; Groß, Tobias; Kniel, Dennis; Michael, Robert; Rieck, Konrad (2023)
Im Rahmen von forensischen Untersuchungen werden regelmäßig eine Vielzahl von digitalen Speichermedien ausgewertet. Die Analyse der dabei anfallenden großen Datenmengen und komplexen Dateiformate ist nur mit Hilfe automatisierter Methoden leistbar. Die Autoren dieses Artikels haben in den vergangenen Jahren die Anwendung KI-gestützter Methoden zur Analyse digitaler Spuren erforscht. Dieser Artikel berichtet über die dabei gesammelten Erfahrunge

Presence, Intervention, Insertion: Unifying Attack and Failure Models in Wireless Sensor Networks - Benenson, Zinaida; Dewald, Andreas; Freiling, Felix (2009)
UnivIS-Import:2016-06-30:Pub.2009.tech.IMMD.lehrst.presen

Selective Imaging Revisited - Stüttgen, Johannes; Dewald, Andreas; Freiling, Felix (Proceedings of the 7th International Conference on IT Security Incident Management & IT Forensics, 2013)
The standard procedure for the acquisition of digital evidence in forensic investigations is to produce a bit-wise 1:1 copy of the original data on a digital storage device. This is often called imaging and becoming a bottleneck in modern digital investigations. The notion of selective imaging was introduced by Turner in 2005 and associated with the decision not to acquire all possible information during the evidence capture process. In this paper, we precisely define the term selective imaging, thereby generalizing the concept to allow acquisition of data objects in any combination and from any level of abstraction. We have implemented this approach as a plug in for the open source Digital Forensics Framework (DFF) using a container format based on the Advanced Forensic Framework 4 (AFF4). We present some design and implementation details as well as a performance evaluation. © 2013 IEEE.
UnivIS-Import:2015-04-16:Pub.2013.tech.IMMD.lehrst.select
Keywords: Digital Forensics; Evidence Acquisition; Selective Imaging

Systematische Probleme und Grenzen der forensischen Informatik - Dewald, Andreas; Freiling, Felix; Schmitt, Sven; Spreitzenbarth, Michael; Vömel, Stefan (Jenseits von 1984: Datenschutz und Überwachung in der fortgeschrittenen Informationsgesellschaft. Eine Versachlichung, 2013)
UnivIS-Import:2015-04-20:Pub.2013.tech.IMMD.lehrst.system

TRESOR Runs Encryption Securely Outside RAM - Müller, Tilo; Freiling, Felix; Dewald, Andreas (Proceedings of the 20th USENIX Security Symposium, 2011)
UnivIS-Import:2015-04-16:Pub.2011.tech.IMMD.lehrst.tresor

Windows Memory Forensics: Detecting (Un)Intentionally Hidden Injected Code by Examining Page Table Entries - Block, Frank; Dewald, Andreas (Digital Investigation, 2019)
Malware utilizes code injection techniques to either manipulate other processes (e.g. done by banking trojans) or hide its existence. With some exceptions, such as ROP gadgets, the injected code needs to be executable by the CPU (at least at some point in time). In this work, we cover and evaluate hiding techniques that prevent executable pages (containing injected code) from being reported by current detection tools. These techniques can either be implemented by malware in order to hide its injected code (as already observed) or can, in one case, unintentionally be taken care of by the operating system through its paging mechanism. In a second step, we present an approach to reveal such pages despite the mentioned hiding techniques by examining Page Table Entries. We implement our approach in a plugin for the memory forensic framework Rekall, which automatically reports any memory region containing executable pages, and evaluate it against own implementations of different hiding techniques, as well as against real-world malware samples. (C) 2019 The Author(s). Published by Elsevier Ltd on behalf of DFRWS.
CRIS-Team WoS Importer:2019-07-26