From the All's Well That Ends Well department

Hello all, it's me with another drive by blog post.Yes, it really has been 7 months since my last post here. I won't be surprised if no one ever reads this. Time for writing or, for that matter, almost anything else, has been in short supply. Between my regular job and teaching at Lincoln Trail College I really haven't had the time to devote to testing and writing.

I took on a data recovery job recently that allowed me to practice my forensics skills a bit. The end result was rather humorous to me. I was asked to recover two missing Excel spreadsheets from a Windows 7 laptop computer. The owner told me the two spreadsheets had been saved to both the user's desktop, as well as a usb jump drive. These spreadsheets had important data and it would take a very long time to recreate them, so of course the owner was very interested in recovering them. He gave me the laptop, but didn't have the usb drive with him, so he said he would bring it to me the next day. I assumed this was going to be an easy job and it was.....sort of.

I took the laptop to my home office and hooked its hard drive up to my analysis system via a Wiebetech Ultradock v4. I started X-Ways Forensics, created a new case and brought the drive in to the case, followed by creating a forensic image and replacing the drive in the case with the newly created image. I selected Refine Volume Snapshot in X-Ways and set it up to do a particularly thorough file system data structure search and a file header signature search in hopes of carving out the missing files from unallocated space. Upon completion, I found no sign of the missing files.

Upon receipt of the 124 mb Lexar brand usb drive, I imaged it and added it to my X-Ways case. Following the same procedures as above, I expected I would find the missing files. No dice. Nada. Nothing.

The owner of the files had been quite certain the files had been in the two locations previously described. I decided I would look at the volume shadow copies from around the time the files went missing and see if I could locate anything. I used the VHD method of accessing the VSC's as presented by Harlan Carvey in Windows Forensic Analysis 3E and also as he presented in the DFIR Online session back in December. This method worked like a charm, but once again the data failed to be where I expected it.

About to give up, I realized I had failed to do something fairly obvious. I checked the Recent folder in Users\user\appdata\microsoft\windows\ to see if I could determine where the spreadsheets had been accessed from in the first place. I found lnk files for both spreadsheets in the Recent folder and they both had been opened from the "G:" drive, which I at first assumed to be the Lexar usb drive. I looked further into the lnk files and found the volume name of the G: drive had been Cruzer, which I knew to be the name for various SanDisk drives, not Lexar drives. I checked the volume name on the Lexar drive and it was not Cruzer.

I called the owner and asked if there was any chance at all the files had been saved to a different usb drive, possibly a SanDisk Cruzer. He didn't think so at first, but had such a drive in his pocket. He inserted it into a computer at his office and guess what....there were the two files!

This certainly wasn't your traditional data recovery, but in the end it worked out. I never did find any evidence the files had been saved on the laptop hard drive, but at least they got their files "back". Even though the files were never really gone, they were gone as far as the owner knew and a lot of work would have been done to recreate them if not for the use of digital forensic analysis. So, as mentioned in the title of this post, all's well that end's well.

Finally, I wanted to mention two awesome books I got recently. As previously mentioned, Windows Forensic Analsys 3E came out and I have been reading it. This version is a companion to WFA 2E and has lots of great info on volume shadow copies, file analysis, malware detection and much more. Harlan has never written a bad book as far as I'm concerned. Each one has excellent and well researched info of use to the forensics/IR crowd.

Also, another great book I got recently is Practical Malware Analysis. I've only had time to read the first couple chapters, but I love this book. It is so well written and easy to follow. Given the potential difficulty of learning this material, Michael Sikorski and Andrew Honig did a fantastic job writing it in a way that noobs and veterans alike can learn from it.

I'm hoping it won't be another 7 months before I post again. I'm going to try to make time to write now and then, but we'll see.

Interesting Malware Trick

Sometimes it's hard to keep from admiring the tricks the various malware purveyors come up with. A couple days ago, my friend Luby (Luby Warning Luby Warning Luby Warning) sent me a malware sample he'd received as an email attachment. The filename was "Changelog_08_08_201atdoc" and its icon gave it the appearance of being a Microsoft Word document:

It would be easy to see that icon and not notice the "doc" part of the filename had no dot between it and the rest of the name to make a proper filename extension.   Fortunately, Luby knows better than to open such an attachment and he started looking into it further, hashing it with FTK Imager. He noticed that when viewing the spreadsheet produced by FTK Imager, that the filename appeared as "Changelog_08_08_201at[U+202E]cod.exe" while copying and pasting the file using Windows Explorer, the filename looked like "Changelog_08_08_201atexe.doc".

He did some research and found that the characters within the brackets represent a Unicode Right to Left Override, where anything after the inserted Unicode control character is reversed in the way it is displayed. Thus, the "cod.exe" is displayed as "exe.doc" but the system still knows what it is and executes it when you double click it. You can read about similar uses of Unicode in this Microsoft Malware Protection Center blog post that came out the same day I received the file from Luby.

I'm sure this is nothing new to many people, but I must admit I'd never heard of such a thing. Like I said above, it's almost hard to keep from admiring cool tricks, but then I remember the reason for the trick and it's not so cool.

I found the executable file was packed with the UPX packer. I uploaded it to Virustotal and found 32 of the virus checkers there recognized the file as malicious:

 

Notice most everything listed under the File name (Submission date, Current Status, etc) is backwards. The Unicode in the file name even affected the VirusTotal display.

Not satisfied with what I'd found so far, I executed the malware file in a Windows XP virtual machine and obtained an image of RAM using the new free tool from Moonsols called DumpIt. I'd been wanting a good opportunity to try out DumpIt and this seemed like as good as any.

I saved the RAM image and moved to my analysis machine where I proceeded to examine it with the awesome Volatility Framework. I decided to obtain a copy of the unpacked executable from RAM and Volatility is perfect for that, using the procexedump plugin. After obtaining the unpacked executable, I uploaded it to VirusTotal and found this:

   

Only 10 out of 43 antivirus products on VirusTotal recognized the unpacked malware. I thought that was kind of interesting. My AV of choice was one of those that didn't recognize it in either the packed or unpacked versions, so I submitted both samples to them so signatures could be created (signatures for both now exist for Vipre Antivirus).

I searched online for some of the names given for this malware by the various AV vendors and only found a little information. I submitted the packed version of the malware to ThreatExpert.com and got a good report. Instead of me retyping it, you can have a look here: ThreatExpert Report.

By the way, I checked the headers from the original email sent to Luby and found it came from Austria. I'm planning to spend a little more time looking at this file soon, but have a couple other projects to take care of first. If I find anything new and interesting, I'll be sure to post about it.

Addendum: I wanted to give the MD5 of the packed exe for those who create their own signatures: FE84E712F52AF7B0F0F3FC58296FEE00.

Cheat Sheets

Mark Morgan has a couple of intrusion discovery cheat sheets over on his blog. He has one for Windows XP Pro, Server 2003 and Vista, along with a separate one for investigating Linux machines. I really appreciate him taking the time to do these and make them available. I always enjoy seeing how people approach their investigations and adapting their methods to my work when possible. Lenny Zeltser also has some great Information Security cheat sheets over on his site.

My good buddy Joe Garcia has a review of Windows Registry Forensics over on the CyberCrime 101 blog. Nice job Joe!

I've been beta testing a new tool called Registry Decoder for Windows Registry parsing and searching. Registry Decoder is being developed by Andrew Case and Vico Marziale over at Digital Forensics Solutions. It's plugin based and has a nice search function as well. It's still in early beta stage and not ready for prime time, but I can definitely see it will be a fine addition to my forensic toolbox.

I've been spending a lot of my off time studying for the Network+ exam and hope to take it in the near future. I've also taken the time lately to set up a couple of Untangle firewall/router machines, one at home and another for my employer. I'll be talking more about all of that later.


That's it for now. Everyone stay safe!

Upcoming Class

I've seen posts by several people as of late talking about digital forensic classes they'll be teaching in which they plan to use Digital Forensics with Open Source Tools for the text book.  I mentioned in my review that I thought it would be a good book for introductory digital forensics courses and it seems others felt the same way. I'm happy to say that I'll be teaching a brand new DF course starting in the Spring, 2012 semester at Lincoln Trail College and I'm planning to use DFwOST as my text book as well. When I was first asked to teach this course, I started trying to decide on a good book that beginners and those with some experience would benefit from that I felt would cover all the topics I wanted covered. DFwOST is definitely that book.

On a related note, I'll be teaching Computer Ethics at LTC beginning in the Fall, 2011 semester. This course is required if the student is pursuing the Computer Forensics certificate. I'll be using Ethics for the Information Age by Michael J. Quinn as the text book. I've only had a short time to look at the book, but it looks like it's going to cover the topic very well.

I'm very excited to be teaching for the very first time and hope I will do a good job at it. I've never taught before and was pretty surprised when I was contacted by the college.

A few links

Corey Harrell has a review of Digital Forensics with Open Source Tools up on his Journey Into Incident Response blog. He recommends the book, just as I and quite a few others have done as well. If you don't normally read Corey's blog, you should start doing so. He's always got great content there.


Claus has a very interesting and helpful post up on the Grand Stream Dreams blog titled Anti-Malware Tools of Note. This is an excellent write-up about the tools and some of the methods he uses in combating malware infections. This is another excellent blog that is well worth taking the time to read regularly.

Over on the Windows Incident Response blog, Harlan Carvey has a new post titled Meetup, Tools and Other Stuff. In addition to several other topics, he talks about his research into Windows 7 Jump Lists, as well as information on the Master Boot Record. Jump Lists have become a topic of interest lately and deservedly so. Harlan has done a great job researching them and provides a nice write-up of what he's discovered thus far. Kudos to him for sharing this information and to everyone who does research and shares what they find.

Also, the talk about the MBR is quite interesting. Harlan mentions some tools and other resources for further study. I plan to try out the tools he links to and see for myself if they'll do the job I need done.

This topic is quite timely, given this post at the Microsoft Malware Protection Center blog on Technet about the 'bootkit' they call Trojan:Win32/Popureb.E. According the MS, the solution when your system is infected by this particular malware is to "simply" do an MBR repair followed by an operating system reinstall. I plan to do considerably more reading about this in the very near future, as the number of pc's being brought to me for malware cleanup has been increasing greatly as of late. If I learn anything useful, I'll post it here.


I still hope to learn how to reverse engineer malware and bought "Introduction to 80x86 Assembly Language and Computer Architecture" to help me learn that part of the reverse engineering process. I just started reading it, so I'm far from knowing much about the subject now, but hope to be able to put what I learn from it to good use soon.



I'm still catching up on all my favorite blogs, so I'm sure I've left out more than a few posts by others. I'm hoping to get caught up on all my reading in the next day or two and I'll post if I see something of interest.

Quick Post

Wanted to do a quick post here to say my review of Digital Forensics with Open Source Tools is now up on the SANS Computer Forensics Blog. As a frequent user of open source forensic tools, I found this book an excellent addition to my library. I think most forensic examiners will benefit from it in some way, while I think it could be essential reading for newcomers to the field.

On another subject, it's not often I give props to Microsoft, but today will be one of those rare moments. I think it's great that they've released their Microsoft Safety Scanner for both 32 bit and 64 bit versions of Windows. This tool will create either a bootable cd, usb flash drive or an .iso image for later burning. Just this morning I used it on an infected system brought to me and was impressed with the ease of use. Basically, it's a stand alone version of their Microsoft Security Essentials antivirus and it seems to work very well. It's nice to get new tools from vendors to help clean up the messes created by the various malware people find accidentally every day. You can download the tool from Microsoft Safety Scanner webpage.

Speaking of malware, I've been seeing a lot of infections by yet another fake security application. Most recently I've been receiving quite a few machines for clean up that are infected with variants called XP Recovery, Windows Vista Repair and so on. This one sets the hidden attribute on most every file and folder on the system and then does a fake scan claiming all sorts of terrible problems exist on your system and encourages you to pay the ransom register the program so it can fix your problems and get your files back. It doesn't seem to do any serious damage at first, but the one I'm repairing now did get the extra gift of a rootkit patch to the C:\Windows\System32\drivers\volsnap.sys file. It would be really nice if those responsible for creating this fake security programs would find new jobs as speed bumps for trains.

An excellent resource for information on fake security app and other malware is the S!RI.URZ blog. The information there has been helpful to me on quite a few occasions.

That's all for now.

And..... it's over

Over, as in my two weeks of conferences are now complete. Last time, I talked about my plans to attend both the  SANS 2011 Digital Forensics and Incident Response Summit in Austin, Tx followed the next week by the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference in McLean, Va. Those two events are now history and I'm happy to say I enjoyed both very much. As seems to always happen, I looked so forward to them and then once it was time for them they just flew by. Ah well, perhaps I'll have the good fortune to attend one or both of them again next year.

One of the truly great things these conferences were good for, aside from the excellent presentations, were the tremendous opportunities to network with others in the field. I have been so happy to find that the "superstars" of this field are just like the rest of us, except way smarter ;-)  Seriously, they're really good people and I was glad to meet and greet with them. Both conferences provided multiple opportunities to interact with the other attendees and speakers. Both were very well run and well attended as well, which is understandable given the quality of the speakers and the topics they were presenting.

Without a doubt, the best part of the two conferences for me was finally getting the chance to meet some of the people I've "known" online for several years but never met in person. Finally putting a face with the name for people I'd never even seen before was really cool. I talked with several of them over the two conferences about how we all have considered each other as friends, despite the lack of actually ever actually meeting in person. In most cases, we've managed to connect via Twitter and some of us have forged very close friendships with other "tweeps" who share our job interests and duties. There are many social media websites and services, but I would find it hard to believe any have a greater ability to unite people in the digital forensics and security fields than Twitter.

Each conference was great overall,  with each only having one presentation I was a little disappointed in, though for different reasons. In fact, I wouldn't even say I was disappointed in the second one I'll talk about, but it was the one I got the least out of for reasons I'll explain.

I really enjoyed every speaker at SANS but one, even though some talked about subjects pretty far over my head. Unfortunately, one speaker seemed far more interested in promoting his product and showing his arrogance than conveying information. That seemed to be the general consensus of most everyone in the room from what I was able to tell and that's a shame, as the talk could have been very good. As he went on, it got better and more informative, but by that time he'd already lost most of the crowd. I read more than a few tweets by other attendees and heard many whispered comments complaining about this speaker while he was still talking.

At the open source conference, all speakers were likable and informative. Unfortunately, one spoke only very broken English, making it hard to really follow what he was talking about. He was aware of that and started off his talk by apologizing for his poor English. Just the same, he did his best and completed his talk. The information he provided was interesting and the slides he used were helpful, so I really hesitate to say I was "disappointed" exactly. The subject of his talk was something I was really interested in, but it was hard to come away with anything useful.

Overall, these two conferences where chock full of great information, both in the talks and in the informal meet-ups. I truly hope I can attend one or both next year, as they were both great learning experiences. Thanks to Rob Lee and Brian Carrier for all their hard work in getting these conferences up and running each year.