#memory forensics

Volatility Workbench - A #GUI For Volatility #Memory #Forensics

[ad_1]

Volatility Workbench is a graphical user interface (GUI) for the Volatility tool. Volatility is a command line memory analysis and forensics tool for extracting artifacts from memory dumps. Volatility Workbench is free, open source and runs in Windows.

  It provides a number of advantages over the command line version including:

No need of remembering command line parameters.

Storage of…

Sunday Round up for the week ending the 23rd of April 2017, Enjoy!

Articles:

Memory Forensics Power: An Introduction: http://resources.infosecinstitute.com/memory-forensics-power-introduction/

Surveillance and our Insecure Infrastructure: https://www.schneier.com/blog/archives/2017/04/surveillance_an_2.html

Hidemyass – a tool that carefully cleans access logs: http://seclist.us/hidemyass-a-post-exploits-tool-that-carefully-clean-access-log.html

Free Ebook - Computer Science & Information Technology: http://www.freetechbooks.com/computer-science-information-technology-t1306.html

An open source memory analysis tool built on top of Volatility: http://seclist.us/damm-differential-analysis-of-malware-in-memory.html

Analyzing the DOUBLEPULSAR Kernel DLL Injection Technique: https://countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/

Malicious Documents: The Matryoshka Edition: https://blog.didierstevens.com/2017/04/20/malicious-documents-the-matryoshka-edition/

The 8 Best Free Anti-Virus Programs for Linux: http://www.tecmint.com/best-antivirus-programs-for-linux/

Windows, Now with built in anti forensics!: http://www.hecfblog.com/2017/04/windows-now-built-in-anti-forensics.html

amzn_assoc_placement = "adunit0"; amzn_assoc_search_bar = "true"; amzn_assoc_tracking_id = "kraljevicn1-20"; amzn_assoc_ad_mode = "manual"; amzn_assoc_ad_type = "smart"; amzn_assoc_marketplace = "amazon"; amzn_assoc_region = "US"; amzn_assoc_title = "My Amazon Picks"; amzn_assoc_linkid = "b9c24aaa0843107b7149bf632d7cc961"; amzn_assoc_asins = "1491949406,B00KNPZ2BE,1494295504,B010MHABUY,B01G5L1G2S,B00TWKCC6Y,B00W3DVHMC,159327758X,1593271441,B003PDMKIY,1593272901,0071792066,B00JHN1MPI,0470613033,0071823077,1118825098,B014HFNB36,B01GRVNRVO,B071D6N383,B007R9UPHA";

Twitter:

"NSA-leaking Shadow Brokers just dumped its most damaging release yet" #informationsecurity #feedly https://t.co/81FqvjITA9

— The Security Sleuth (@Security_Sleuth) April 16, 2017

"Google Making Life Difficult for Ransomware to Thrive on Android" #informationsecurity #feedly https://t.co/reUxx01XYO

— The Security Sleuth (@Security_Sleuth) April 16, 2017

"Wave of Java-Based RATs Target Tax Filers" #informationsecurity #feedly https://t.co/3iPvzBIA2k

— The Security Sleuth (@Security_Sleuth) April 17, 2017

"This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera" #infosec #feedly https://t.co/xJqWUOPiQ7

— The Security Sleuth (@Security_Sleuth) April 17, 2017

"Meet PINLogger, the drive-by exploit that steals smartphone PINs" #informationsecurity #feedly https://t.co/tkmwNIQMrz

— The Security Sleuth (@Security_Sleuth) April 18, 2017

"Vigilante botnet infects IoT devices before blackhats can hijack them" #informationsecurity #feedly https://t.co/Que5QRgint

— The Security Sleuth (@Security_Sleuth) April 19, 2017

"Patched Flaw in Bosch Diagnostic Dongle Allowed Researchers to Shut Off Engine" #informationsecurity #feedly https://t.co/Y2MpAPkujg

— The Security Sleuth (@Security_Sleuth) April 19, 2017

"The History of Fileless Malware – Looking Beyond the Buzzword" #forensics #feedly https://t.co/5C7Jes0Lp0

— The Security Sleuth (@Security_Sleuth) April 20, 2017

Read last weeks round up here

Here's the round up for this week:

Articles:

PlugX: The Memory Forensics Lifecycle: https://prezi.com/6ruvzpnpp-8y/plugx-the-memory-forensics-lifecycle/

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability: http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Surviving in an IoT-enabled world: https://securelist.com/analysis/publications/72595/surviving-in-an-iot-enabled-world/

A quick look at a signed spam campaign: http://bartblaze.blogspot.com.au/2015/11/a-quick-look-at-signed-spam-campaign.html

Macro documents with XOR Encoded Payloads: http://phishme.com/macro-documents-with-xor-encoded-payloads/

WAP - Web Application Protection: http://www.kitploit.com/2015/11/wap-web-application-protection.html

Digital Forensics – NTFS Metadata Timeline Creation: http://countuponsecurity.com/2015/11/10/digital-forensics-ntfs-metadata-timeline-creation/

Metadata Investigation : Inside Hacking Team: http://labs.rs/en/metadata/

Pentesting SAP Applications : An Introduction: http://resources.infosecinstitute.com/pen-stesting-sap-applications-part-1/

Distributed Vulnerability Search – Told via Access Logs: https://blog.sucuri.net/2015/11/distributed-vulnerability-search-told-via-access-logs.html

Reverse engineering challenge similar to project Euler: http://challenges.re/

Twitter:

Teen hackers strike again, allegedly gain access to US arrest records database https://t.co/1QuBTLPbIG

— The Security Sleuth (@Security_Sleuth) November 8, 2015

The Pentesters Framework (Ptf) - The Easy Way To Roll Your Own Distro https://t.co/xvAmXFmGcf

— The Security Sleuth (@Security_Sleuth) November 8, 2015

Hackers and Sith Lords Roam Ukraine's Cyber Badlands https://t.co/gYFM0DHY5H

— The Security Sleuth (@Security_Sleuth) November 9, 2015

ARM is bringing some much needed security to the Internet of Things https://t.co/kmJoTmISsP

— The Security Sleuth (@Security_Sleuth) November 11, 2015

FBI accused of paying US university for dark net attack https://t.co/mOm97EFiyk

— The Security Sleuth (@Security_Sleuth) November 12, 2015

Read last weeks round up here

As another month ends here is the week in review.

Articles:

Windows Memory Forensics: http://cerbero-blog.com/?p=1586

Shim Shady: Live Investigations of the Application Compatibility Cache: https://www.fireeye.com/blog/threat-research/2015/10/shim_shady_live_inv.html

Car Hacking for Plebs – The Untold Story: http://foxglovesecurity.com/2015/10/26/car-hacking-for-plebs-the-untold-story/ 

Twitter:

PSA: Don’t Trust Caller ID — It Can Be Faked https://t.co/OPrzcx3IxM

— The Security Sleuth (@Security_Sleuth) October 25, 2015

Security researcher has last laugh over Oracle https://t.co/E3JIhNpidy

— The Security Sleuth (@Security_Sleuth) October 25, 2015

Information Security News: Russian cyberspies targeted the MH17 crash investigation https://t.co/7uMMOgWzwD

— The Security Sleuth (@Security_Sleuth) October 26, 2015

DARPA Gave a Company $500K to Keep Tabs on White Hat Hackers https://t.co/KbXmWMgPBN

— The Security Sleuth (@Security_Sleuth) October 28, 2015

11-Year-Old Sets Up Cryptographically Secure Password Business https://t.co/oMeuQZ8piv

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Hacked Opinions: The legalities of hacking – Richard Ford https://t.co/NHjBe2wijv

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Leaving Laptops in Hotel Rooms: A Bad Idea https://t.co/3DrDPDOekJ

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Low-cost IMSI catcher for 4G/LTE networks tracks phone’s precise locations https://t.co/OZR4NMc2Z9

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Read last weeks round up here

As another month ends here is the week in review.

Articles:

Windows Memory Forensics: http://cerbero-blog.com/?p=1586

Shim Shady: Live Investigations of the Application Compatibility Cache: https://www.fireeye.com/blog/threat-research/2015/10/shim_shady_live_inv.html

Car Hacking for Plebs – The Untold Story: http://foxglovesecurity.com/2015/10/26/car-hacking-for-plebs-the-untold-story/ 

Twitter:

PSA: Don’t Trust Caller ID — It Can Be Faked https://t.co/OPrzcx3IxM

— The Security Sleuth (@Security_Sleuth) October 25, 2015

Security researcher has last laugh over Oracle https://t.co/E3JIhNpidy

— The Security Sleuth (@Security_Sleuth) October 25, 2015

Information Security News: Russian cyberspies targeted the MH17 crash investigation https://t.co/7uMMOgWzwD

— The Security Sleuth (@Security_Sleuth) October 26, 2015

DARPA Gave a Company $500K to Keep Tabs on White Hat Hackers https://t.co/KbXmWMgPBN

— The Security Sleuth (@Security_Sleuth) October 28, 2015

11-Year-Old Sets Up Cryptographically Secure Password Business https://t.co/oMeuQZ8piv

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Hacked Opinions: The legalities of hacking – Richard Ford https://t.co/NHjBe2wijv

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Leaving Laptops in Hotel Rooms: A Bad Idea https://t.co/3DrDPDOekJ

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Low-cost IMSI catcher for 4G/LTE networks tracks phone’s precise locations https://t.co/OZR4NMc2Z9

— The Security Sleuth (@Security_Sleuth) October 29, 2015

Read last weeks round up here