Corey Harrell has a review of Digital Forensics with Open Source Tools up on his Journey Into Incident Response blog. He recommends the book, just as I and quite a few others have done as well. If you don't normally read Corey's blog, you should start doing so. He's always got great content there.
Claus has a very interesting and helpful post up on the Grand Stream Dreams blog titled Anti-Malware Tools of Note. This is an excellent write-up about the tools and some of the methods he uses in combating malware infections. This is another excellent blog that is well worth taking the time to read regularly.
Over on the Windows Incident Response blog, Harlan Carvey has a new post titled Meetup, Tools and Other Stuff. In addition to several other topics, he talks about his research into Windows 7 Jump Lists, as well as information on the Master Boot Record. Jump Lists have become a topic of interest lately and deservedly so. Harlan has done a great job researching them and provides a nice write-up of what he's discovered thus far. Kudos to him for sharing this information and to everyone who does research and shares what they find.
Also, the talk about the MBR is quite interesting. Harlan mentions some tools and other resources for further study. I plan to try out the tools he links to and see for myself if they'll do the job I need done.
This topic is quite timely, given this post at the Microsoft Malware Protection Center blog on Technet about the 'bootkit' they call Trojan:Win32/Popureb.E. According the MS, the solution when your system is infected by this particular malware is to "simply" do an MBR repair followed by an operating system reinstall. I plan to do considerably more reading about this in the very near future, as the number of pc's being brought to me for malware cleanup has been increasing greatly as of late. If I learn anything useful, I'll post it here.
I still hope to learn how to reverse engineer malware and bought "Introduction to 80x86 Assembly Language and Computer Architecture" to help me learn that part of the reverse engineering process. I just started reading it, so I'm far from knowing much about the subject now, but hope to be able to put what I learn from it to good use soon.
I'm still catching up on all my favorite blogs, so I'm sure I've left out more than a few posts by others. I'm hoping to get caught up on all my reading in the next day or two and I'll post if I see something of interest.
Wednesday, June 29, 2011
Wednesday, June 22, 2011
Quick Post
Wanted to do a quick post here to say my review of Digital Forensics with Open Source Tools is now up on the SANS Computer Forensics Blog. As a frequent user of open source forensic tools, I found this book an excellent addition to my library. I think most forensic examiners will benefit from it in some way, while I think it could be essential reading for newcomers to the field.
On another subject, it's not often I give props to Microsoft, but today will be one of those rare moments. I think it's great that they've released their Microsoft Safety Scanner for both 32 bit and 64 bit versions of Windows. This tool will create either a bootable cd, usb flash drive or an .iso image for later burning. Just this morning I used it on an infected system brought to me and was impressed with the ease of use. Basically, it's a stand alone version of their Microsoft Security Essentials antivirus and it seems to work very well. It's nice to get new tools from vendors to help clean up the messes created by the various malware people find accidentally every day. You can download the tool from Microsoft Safety Scanner webpage.
Speaking of malware, I've been seeing a lot of infections by yet another fake security application. Most recently I've been receiving quite a few machines for clean up that are infected with variants called XP Recovery, Windows Vista Repair and so on. This one sets the hidden attribute on most every file and folder on the system and then does a fake scan claiming all sorts of terrible problems exist on your system and encourages you topay the ransom register the program so it can fix your problems and get your files back. It doesn't seem to do any serious damage at first, but the one I'm repairing now did get the extra gift of a rootkit patch to the C:\Windows\System32\drivers\volsnap.sys file. It would be really nice if those responsible for creating this fake security programs would find new jobs as speed bumps for trains.
An excellent resource for information on fake security app and other malware is the S!RI.URZ blog. The information there has been helpful to me on quite a few occasions.
That's all for now.
On another subject, it's not often I give props to Microsoft, but today will be one of those rare moments. I think it's great that they've released their Microsoft Safety Scanner for both 32 bit and 64 bit versions of Windows. This tool will create either a bootable cd, usb flash drive or an .iso image for later burning. Just this morning I used it on an infected system brought to me and was impressed with the ease of use. Basically, it's a stand alone version of their Microsoft Security Essentials antivirus and it seems to work very well. It's nice to get new tools from vendors to help clean up the messes created by the various malware people find accidentally every day. You can download the tool from Microsoft Safety Scanner webpage.
Speaking of malware, I've been seeing a lot of infections by yet another fake security application. Most recently I've been receiving quite a few machines for clean up that are infected with variants called XP Recovery, Windows Vista Repair and so on. This one sets the hidden attribute on most every file and folder on the system and then does a fake scan claiming all sorts of terrible problems exist on your system and encourages you to
An excellent resource for information on fake security app and other malware is the S!RI.URZ blog. The information there has been helpful to me on quite a few occasions.
That's all for now.
Thursday, June 16, 2011
And..... it's over
Over, as in my two weeks of conferences are now complete. Last time, I talked about my plans to attend both the SANS 2011 Digital Forensics and Incident Response Summit in Austin, Tx followed the next week by the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference in McLean, Va. Those two events are now history and I'm happy to say I enjoyed both very much. As seems to always happen, I looked so forward to them and then once it was time for them they just flew by. Ah well, perhaps I'll have the good fortune to attend one or both of them again next year.
One of the truly great things these conferences were good for, aside from the excellent presentations, were the tremendous opportunities to network with others in the field. I have been so happy to find that the "superstars" of this field are just like the rest of us, except way smarter ;-) Seriously, they're really good people and I was glad to meet and greet with them. Both conferences provided multiple opportunities to interact with the other attendees and speakers. Both were very well run and well attended as well, which is understandable given the quality of the speakers and the topics they were presenting.
Without a doubt, the best part of the two conferences for me was finally getting the chance to meet some of the people I've "known" online for several years but never met in person. Finally putting a face with the name for people I'd never even seen before was really cool. I talked with several of them over the two conferences about how we all have considered each other as friends, despite the lack of actually ever actually meeting in person. In most cases, we've managed to connect via Twitter and some of us have forged very close friendships with other "tweeps" who share our job interests and duties. There are many social media websites and services, but I would find it hard to believe any have a greater ability to unite people in the digital forensics and security fields than Twitter.
Each conference was great overall, with each only having one presentation I was a little disappointed in, though for different reasons. In fact, I wouldn't even say I was disappointed in the second one I'll talk about, but it was the one I got the least out of for reasons I'll explain.
I really enjoyed every speaker at SANS but one, even though some talked about subjects pretty far over my head. Unfortunately, one speaker seemed far more interested in promoting his product and showing his arrogance than conveying information. That seemed to be the general consensus of most everyone in the room from what I was able to tell and that's a shame, as the talk could have been very good. As he went on, it got better and more informative, but by that time he'd already lost most of the crowd. I read more than a few tweets by other attendees and heard many whispered comments complaining about this speaker while he was still talking.
At the open source conference, all speakers were likable and informative. Unfortunately, one spoke only very broken English, making it hard to really follow what he was talking about. He was aware of that and started off his talk by apologizing for his poor English. Just the same, he did his best and completed his talk. The information he provided was interesting and the slides he used were helpful, so I really hesitate to say I was "disappointed" exactly. The subject of his talk was something I was really interested in, but it was hard to come away with anything useful.
Overall, these two conferences where chock full of great information, both in the talks and in the informal meet-ups. I truly hope I can attend one or both next year, as they were both great learning experiences. Thanks to Rob Lee and Brian Carrier for all their hard work in getting these conferences up and running each year.
One of the truly great things these conferences were good for, aside from the excellent presentations, were the tremendous opportunities to network with others in the field. I have been so happy to find that the "superstars" of this field are just like the rest of us, except way smarter ;-) Seriously, they're really good people and I was glad to meet and greet with them. Both conferences provided multiple opportunities to interact with the other attendees and speakers. Both were very well run and well attended as well, which is understandable given the quality of the speakers and the topics they were presenting.
Without a doubt, the best part of the two conferences for me was finally getting the chance to meet some of the people I've "known" online for several years but never met in person. Finally putting a face with the name for people I'd never even seen before was really cool. I talked with several of them over the two conferences about how we all have considered each other as friends, despite the lack of actually ever actually meeting in person. In most cases, we've managed to connect via Twitter and some of us have forged very close friendships with other "tweeps" who share our job interests and duties. There are many social media websites and services, but I would find it hard to believe any have a greater ability to unite people in the digital forensics and security fields than Twitter.
Each conference was great overall, with each only having one presentation I was a little disappointed in, though for different reasons. In fact, I wouldn't even say I was disappointed in the second one I'll talk about, but it was the one I got the least out of for reasons I'll explain.
I really enjoyed every speaker at SANS but one, even though some talked about subjects pretty far over my head. Unfortunately, one speaker seemed far more interested in promoting his product and showing his arrogance than conveying information. That seemed to be the general consensus of most everyone in the room from what I was able to tell and that's a shame, as the talk could have been very good. As he went on, it got better and more informative, but by that time he'd already lost most of the crowd. I read more than a few tweets by other attendees and heard many whispered comments complaining about this speaker while he was still talking.
At the open source conference, all speakers were likable and informative. Unfortunately, one spoke only very broken English, making it hard to really follow what he was talking about. He was aware of that and started off his talk by apologizing for his poor English. Just the same, he did his best and completed his talk. The information he provided was interesting and the slides he used were helpful, so I really hesitate to say I was "disappointed" exactly. The subject of his talk was something I was really interested in, but it was hard to come away with anything useful.
Overall, these two conferences where chock full of great information, both in the talks and in the informal meet-ups. I truly hope I can attend one or both next year, as they were both great learning experiences. Thanks to Rob Lee and Brian Carrier for all their hard work in getting these conferences up and running each year.
Tuesday, May 17, 2011
Huge Month of June is Almost Here!
This may be the most I've ever looked forward to the month of June. The first couple weeks of the month are going to be absolutely filled with forensic geeky goodness.
First comes the 2011 Digital Forensics and Incident Response Summit in Austin, TX, which I'll be attending this year. I was presented with "an offer I couldn't refuse" and am very excited to say I'll be there. A look at the agenda shows what is bound to be a fantastic learning experience. The lineup of speakers and topics is top notch and I can't wait to get there. Besides, I'm gonna get to hang out with my good buddy Joe Garcia, host of the Cybercrime 101 podcast. Joe and talk several times a week and I know he's as excited as I am to head to Austin.
I'm also excited because one of my posts on the SANS Computer Forensics Blog, entitled "I'm Here, Now What?" has been nominated for a Forensic 4Cast Award. The awards will be presented at the Summit. I have to admit, my post wasn't as good as the posts by Rob Lee, entitled "Digital Forensic SIFTing: SUPER Timeline Analysis and Creation" and Matt Churchill, entitled "Free Digital Forensics Triage Tool" and I think either one of them could easily be the right one to vote for. Still, I'm more than a little honored to be nominated and will enjoy myself, regardless of the outcome.
The following week, I'll be driving eastward to McLean, VA with good friend Brad Garnett for the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference. This is going to be an excellent conference with presentations by some of my forensics heroes, such as Cory Altheide, Harlan Carvey, Simson Garfinkle and Brian Carrier. We'll be attending one of the pre-conference workshops as well.
There are several people I "know" online that I hope to meet at both conferences. Some of them I already have established friendships with in the online world and there's no doubt I'll enjoy meeting them in person. I'll be writing recaps of my travels here once they're over with. I may post some from the conferences if time and circumstances allow.
First comes the 2011 Digital Forensics and Incident Response Summit in Austin, TX, which I'll be attending this year. I was presented with "an offer I couldn't refuse" and am very excited to say I'll be there. A look at the agenda shows what is bound to be a fantastic learning experience. The lineup of speakers and topics is top notch and I can't wait to get there. Besides, I'm gonna get to hang out with my good buddy Joe Garcia, host of the Cybercrime 101 podcast. Joe and talk several times a week and I know he's as excited as I am to head to Austin.
I'm also excited because one of my posts on the SANS Computer Forensics Blog, entitled "I'm Here, Now What?" has been nominated for a Forensic 4Cast Award. The awards will be presented at the Summit. I have to admit, my post wasn't as good as the posts by Rob Lee, entitled "Digital Forensic SIFTing: SUPER Timeline Analysis and Creation" and Matt Churchill, entitled "Free Digital Forensics Triage Tool" and I think either one of them could easily be the right one to vote for. Still, I'm more than a little honored to be nominated and will enjoy myself, regardless of the outcome.
The following week, I'll be driving eastward to McLean, VA with good friend Brad Garnett for the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference. This is going to be an excellent conference with presentations by some of my forensics heroes, such as Cory Altheide, Harlan Carvey, Simson Garfinkle and Brian Carrier. We'll be attending one of the pre-conference workshops as well.
There are several people I "know" online that I hope to meet at both conferences. Some of them I already have established friendships with in the online world and there's no doubt I'll enjoy meeting them in person. I'll be writing recaps of my travels here once they're over with. I may post some from the conferences if time and circumstances allow.
Monday, May 9, 2011
It has ARRIVED!
Open source tools hold a special place in my heart. Like so many of us, I got my first real start in forensics using the Sleuth Kit, Autopsy, RegRipper and so on. Without these free, open source tools I would probably not be doing forensics today. Fortunately, they were there for me and, honestly, I enjoy using them. Even though I now have a few closed source, "payware" tools, I still use open source tools like those I mentioned, all the time.
I look forward to starting the book tonight when I get home from work. I'll be writing a review of it soon after I finish it and post it here.
Sleuth Kit and Open Source Digital Forensics Conference
Speaking of open source tools, I am happy to report I will attending this years Sleuth Kit and Open Source Digital Forensics Conference in McLean, VA. I will be submitting my registration tonight. Barring some catastrophe keeping me from getting there, I hope to attend and meet old friends and those I only know through their work. It's sure to be a great learning experience, as well as a great chance to network and do a lot of geek speak.
Sunday, May 1, 2011
bin Laden related malware links
Okay, we all know Osama bin Hidin is now DRT (dead right there). The next obvious thing to come will of course be billions of spam and other type messages leading to malware related sites. Remember, don't click on any of that crap. Remind your friends and family that they aren't likely to see autopsy photos or anything of the sort if they click a link on Facebook or in an email. Help stop the spread of malware!
Also, more importantly, thank you to our troops and all who serve for doing an awesome job, all the time!
Also, more importantly, thank you to our troops and all who serve for doing an awesome job, all the time!
Thursday, April 28, 2011
A Quick Note
Just wanted to mention that, according to Amazon, Digital Forensics with Open Source Tools has been released. This is a book I've really been looking forward to. The two authors, Cory Altheide and Harlan Carvey are well known in the field and bring a lot experience and knowledge to this book, so I know it's going to be great. I'll be posting a review after I receive and read my copy.
Related to the use of Open Source, I also wanted to mention some interesting posts being made over on the SANS Forensic Blog by Dave Hull. He's made two related recent posts on the use of the Linux command line to aid in data reduction during an investigation. The posts are called "Least Frequently Occurring Strings?" and "Data Reduction redux and map-reduce." I love reading things like this, because these are methods anyone can use without buying high dollar forensic software. The Linux operating system comes as an almost ready made forensics investigation platform, with just a few things still needed to do the job. I still work in both Linux and Windows and make use of paid software in both, but my heart is with the open source tools available to all.
I hope to be putting out a new blog post in the near future that contains info on some research I've been doing lately, but I haven't had time to finish things up yet. I'll be back with a new post "soon".
Related to the use of Open Source, I also wanted to mention some interesting posts being made over on the SANS Forensic Blog by Dave Hull. He's made two related recent posts on the use of the Linux command line to aid in data reduction during an investigation. The posts are called "Least Frequently Occurring Strings?" and "Data Reduction redux and map-reduce." I love reading things like this, because these are methods anyone can use without buying high dollar forensic software. The Linux operating system comes as an almost ready made forensics investigation platform, with just a few things still needed to do the job. I still work in both Linux and Windows and make use of paid software in both, but my heart is with the open source tools available to all.
I hope to be putting out a new blog post in the near future that contains info on some research I've been doing lately, but I haven't had time to finish things up yet. I'll be back with a new post "soon".
Subscribe to:
Posts (Atom)