Palutke R, Block F, Reichenberger P, Stripeika D (2020)
Publication Type: Journal article
Publication year: 2020
Book Volume: 33
DOI: 10.1016/j.fsidi.2020.301012
Nowadays, security practitioners typically use memory acquisition or live forensics to detect and analyze sophisticated malware samples. Subsequently, malware authors began to incorporate anti-forensic techniques that subvert the analysis process by hiding malicious memory areas. Those techniques typically modify characteristics, such as access permissions, or place malicious data near legitimate one, in order to prevent the memory from being identified by analysis tools while still remaining accessible. With this paper, we present three novel methods that prevent malicious user space memory from appearing in analysis tools and additionally making the memory inaccessible from a security analysts perspective. Two of these techniques manipulate kernel structures, namely Page Table Entries and the structures responsible for managing user space memory regions, while the third one utilizes shared memory and hence does not require elevated privileges. As a proof of concept, we implemented all techniques for the Windows and Linux operating systems, and subsequently evaluated these with both, memory forensics and live analysis techniques. Furthermore, we discuss and evaluate several approaches to detect our subversion techniques and introduce two Rekall plugins that automate the detection of hidden memory for the shared memory scenario. (C) 2020 The Author(s). Published by Elsevier Ltd on behalf of DFRWS. All rights reserved.
APA:
Palutke, R., Block, F., Reichenberger, P., & Stripeika, D. (2020). Hiding Process Memory Via Anti-Forensic Techniques. Forensic Science International: Digital Investigation, 33. https://doi.org/10.1016/j.fsidi.2020.301012
MLA:
Palutke, Ralph, et al. "Hiding Process Memory Via Anti-Forensic Techniques." Forensic Science International: Digital Investigation 33 (2020).
BibTeX: Download