Cyber4Us

Hey Gang!

Here are some academic oriented malware analysis papers that I am referencing for my PhD. Included, for a very limited time, is a paper called Jesse.pdf. This paper is a PDF that is infected with an old adobe exploit. It will attempt to connect to a local IP, so shouldn't get loose.

Well, the DoD Cyber Crime Conference is over. Malware seemed to be the topic of the year and I was in that boat presenting two “mini” classes on Interactive Malware Analysis. In common speak that is “static analysis,” but using a debugger is anything but static. The classes where “Introduction to Malware Analysis with Immunity” and “Introduction to Manual Unpacking with Olly/Immunity.” Both where condensed excerpts from my one week course.

I would like to thank everyone that attended the malware class last week. Mike and I really enjoyed giving the course as we are passionate about the subject. As I said in the class, the VM is available at ftp.cyber4.us with the user name and password provided in the class. The VM is as it was prior to any work (infections) occurring. I am also hopeful that we will be able to post the solutions to many of the examples we used in the class. If we can make some videos of the solutions they will be posted here, else there will be a note to check the ftp site.

Thanks,

Jason Upchurch

In the previous installments, I have talked about the general concept of RAID and how it is not really standardized. We broke RAID down into 4 main groups, left symmetrical, left asymmetrical, right symmetrical, and right asymmetrical. Of course if that was all to it, it wouldn't be such a hassle to reconstruct failed RAID arrays. To that end, I spoke about parity levels and that the number of disks don't necessarily have to be equal. This can complicate matters a bit in the reconstruction process.

*** NOTE: URL's cited (but not linked to) in this article may contain malware that could harm your computer or encourage you to give money away for nothing in return. Please be cautious when browsing to any address not explicitly linked to!

I would like to take a few minutes to review an in-depth article by The Register (Anatomy of a Hack). Specifically I want to focus on the areas that were well executed and areas that create vulnerabilities to the hacker's objectives.

The Plea
Over the last 6 years that I've been involved with computer forensics/computer security I regularly reflect on the lack of open standards for handling digital evidence. Can we please, as a community, make a grassroots decision to standardize our imaging on a common format?

The Problem

When approaching computer forensics I try to put myself in the shoes of the subject of the case. In intrusions I try to think like the attacker... This is the inaugural post of a tag series I'll call mindset. During this series I'll try to uncover the thought process behind different types of hackers and show how understanding their individual nuances can increase your proficiency in examining intrusions.

In this post I reveal the base principle I use in examining an intrusion:

General Theory of Laziness