리눅스시스템의메모리포렌식 - github pages리눅스시스템의메모리포렌식...
TRANSCRIPT
리눅스시스템의메모리포렌식
09/20/2018
Linux Memory Forensic Analysis
2018 제3분기 사이버 침해사고 정보공유세미나
• 메모리 포렌식 개요
• 리눅스메모리포렌식연구동향
•메모리 덤프 추출 및 프로파일 생성
• 발전방향 및 결론
목차
Backgroud: Introduction to Memory Forensics
Goals:
메모리포렌식전반에대한배경지식전달
Traditional Storage Forensics
대검찰청 “디지털증거의수집 ·분석및관리규정”
1. 컴퓨터용디스크,그밖에이와비슷한정보저장매체
2. 디지털증거를수집,분석,보관,관리
3. 정보저장매체등에저장된전자정보를동일하게비트열복제
4. 법률적으로유효한증거로사용될수있도록복사한파일
경찰청 “디지털증거수집및처리등에관한규칙”
1. 컴퓨터용디스크,그밖에이와비슷한정보저장매체
2. 하드카피및이미징복제,삭제된형태로존재하는정보원형복원
디스크내부의자료를복원하는것이초점
대검찰청예규 제876호, [시행 2017.3.1]
경찰청훈령 제766호, [시행 2015.6.1.]
Order of Volatility
휘발성우선순위(RFC 3227)
1. RAM 내부의메모리
2. 네트워크정보
3. 실행중인프로세스정보
4. 하드디스크
5. 플로피 / 기타저장장치
휘발성(Volatile) 아티팩트분석
디스크포렌식만으로는추출할수없는단서
휘발성정보의수집이가능한상황이라면? 매우유용할것.
단, 빠르고신속하며안정적인추출방안필요!
RFC 3227 –증거수집과보관에관한지침(Guidelines for evidence collection and archiving)
Memory Forensics ?
메모리포렌식
1. 하드디스크를사용하지않는 Fileless Malware 등
2. 메모리(RAM)에는중요아티팩트들이존재
3. 컴퓨터의물리메모리덤프를추출
4. 덤프를분석하는도구필요
디스크포렌식과의차별성
Storage forensics tools are focused primarily on “dead” anlysis.
Researchers have created many powerful memory forenscis techniques.Andrew Case, ”Memory forensics : The path forward”(2017)
Physical Memory Structure
폰노이만식컴퓨터구조
일반적인 CPU, 메모리,프로그램구조를갖는범용구조
이중주기억장치(RAM)에존재하는데이터는휘발성(Volatile)을가짐
관련연구
Mariusz Burdach, “Physical Memory Forenscis” Black Hat US 2006
포렌식관점에서의메모리분석
메모리내부의증거를통해유죄입증가능성제시
안티포렌식기법에대응할수있는방안
Amari Kristine, “Techniques and tools for data from volatile memory”
SANS Forensics 연구소에서출간한White Paper(2009)
메모리로부터암호화키등을복원할수있음을입증
Haruyama, “One-byte modification for breaking memory forensics” 2012
최근에는메모리분석을불가능하게하기위한안티포렌식연구도진행중
메모리 포렌식 절차
메모리추출 &분석
2004년경최초기반기술개발됨
Image from Haruyama, Takahiro, and Hiroshi Suzuki. "One-byte modification for breaking memory forensic analysis." Black Hat Europe (2012).
Target Machine
Investigator’s Machine
Memory Image File
1. Acquire RAM dataas an image file
2. Parse and analyze the image offline
메모리 추출 도구
Raw Image 추출
HBGary FastDump Pro
Guidance WinEn
MoonSols Windd
Crash Dump Image Acquisition
MoonSols Windd
Memory Image Conversion
MoonSols Windows Memory Toolkit
RawCrash Dump
Hibernation
CPU Register Included
Not Included
Memory Image File
Image from Haruyama, Takahiro, and Hiroshi Suzuki. "One-byte modification for breaking memory forensic analysis." Black Hat Europe (2012).
(오픈소스) 메모리 분석 SW
strings and grep (stressful)
메모리전용도구가개발되기전에는단순한패턴매칭위주고전적분석
Volatility
DFRWS 2005 컨퍼런스이후본격적으로도구발전
Volatility가 De facto standard 로가장널리이용되고있음.
Rekall
구글이개발한오픈소스메모리포렌식프레임워크.
편리한 GUI 및운영체제프로파일을자동으로감지하는기능유용.
Ligh, Michael Hale, et al. ”The art of memory forensics”. John Wiley & Sons, 2014.
Google, Rekall Memory Forensic Framework, 2016. https://github.com/google/rekall
How about Linux system? Is it possible?
Goals:
리눅스시스템특유의환경적제약조건
Linux Memory Acquisition
Historical Methods /dev/mem
/dev/kmem
ptrace
Modern Acquisition fmem
/proc/kcore
Linux Memory Extractor (LiME)
Virtualization Machine KVM, Oracle VirtualBox, VMware Workstation -> debug mode -> *.vmem
Ligh, Michael Hale, et al. ”The art of memory forensics”. John Wiley & Sons, 2014.
Memory map
Kernel Space / User Space
Stack, Heap, Segments ..
https://manybutfinite.com/post/anatomy-of-a-program-in-memory/
Memory Profiles
A profile is the template that allows us to know where each field member begins and ends in memory.
The compiler will normally plan how to lay each struct member in memory and generate code that access this struct:
Socała, Arkadiusz, and Michael Cohen. "Automatic profile generation for live Linux Memory analysis." Digital Investigation 16 (2016): S11-S24
Memory Profiles
메모리구조는
시스템아키텍처
운영체제종류
Kernerl버전
등에따라
적재방식이모두다름.
따라서,
각각에알맞은해법필요
유사한연구 :
OS Fingerprinting
Gu, Yufei. "Derandomizing kernel address space layout for memory introspection and forensics.”, ACM CODASPY 2016
[Volatility가 Windows OS 탐지에 사용하는 KDBG Signature]
Windows Profiles
Volatility
Windows Profiles
Rekall (from Google)
Microsoft Windows XP Service Pack 2 and 3
Microsoft Windows 7 Service Pack 0 and 1
Microsoft Windows 8 and 8.1
Microsoft Windows 10
macOS 10.7 – 10.12.x
Auto detecting – specific version of GUID
(Major) Linux Profiles
Linux Profile Github
CentOS, Debian, Fedora, OpenSUSE, RedHat, Ubuntu
https://github.com/volatilityfoundation/profiles
How about Custom Linux ?
특별한목적에맞게제작된커스텀리눅스다수존재
Kali Linux for Penetration Testing
Gentoo Linux
FreeBSD or ETC
Linux Distribution Timeline (version 16.12)
From Wikipedia : https://en.wikipedia.org/wiki/Linux_distribution
Rapid Kernel Updates
Linux Kernel Version Check
Ubuntu 18.04 with kernel 4.15.0-29-generic
https://git.kernel.org
커널소숫점 1자리만달라져도불가
난제 : 임의의리눅스프로파일생성
Detect kernel version from ELF binary
Leveraging Relocations in ELF-binaries for Linux Kernel Version Identification
Bhatt, Manish, and Irfan Ahmed. "Leveraging relocations in ELF-binaries for Linux kernel version identification." Digital Investigation 26 (2018): S12-S20.
Let’s Create Linux Kernel Profiles.
Goals:
- (알려지지않은)커스텀리눅스환경에서직접프로파일제작
Amazon EC2 Cloud
인프라구축을위해클라우드자원활용
실험에사용한환경 :
Virtualization Tech
Open-source (Linux/Unix) Virtual machines (VDIs)
Both VirtualBox & Vmware
Over 100 images with pre- installed
Import to Amazon EC2 Instance
KVM, Oracle VirtualBox경우메모리페이징오류발생(timeout error)
VMware Workstation 채택
www.osboxes.org
VM Import/Export Guide for Amazon EC2, https://aws.amazon.com/ec2/vm-import/
lmg (Hal Pomeranz)
Hal Pomeranz, Automating Linux Memory Capture
https://github.com/halpomeranz/lmg
SANS DFIR Summit 2014
Memory Acquisition(LiME)
Profile Creation(dwarfdump)
(Need to modify some errors)
5년이상업데이트중단된것으로보임
설치시약간의오류발생으로직접수정필요
lmc (cpuu)
lmc - Linux Memory Capturer
https://github.com/cpuu/lmc
(어제벼락치기로…)
Hal Pomeranz스크립트수정
관련패키지최신버전으로자동설치
Generate Volatility Profile
Kali Linux 2018.3 Release
Linux Kernel 4.9
2018년 8월 21일출시
프로파일생성사례없음
아마존 AWS 이용
프로파일생성
Linux header
Kernel module
분석성공
(+) Google Rekal
$ pip install rekall-layout-expert
Socała, Arkadiusz, and Michael Cohen. "Automatic profile generation for live Linux Memory analysis." Digital Investigation 16 (2016): S11-S24
Compile test module with debug information generated - stored in zip file.
(+) Google Rekal
$ pip install rekall-layout-expert
Socała, Arkadiusz, and Michael Cohen. "Automatic profile generation for live Linux Memory analysis." Digital Investigation 16 (2016): S11-S24
De-randomizing Kernel Address Space layoutfor Memory forensics
Goals:
- Linux 4.8 Kernel 부터적용된 KASLR 에대한이해
-메모리포렌식을위해 KASLR 을우회하는플러그인개발
ASLR
ASLR : Address Space Layout Randomization
메모리상의공격을막기위해힙, 라이브러리등의주소를프로세스주소공간에무작위적으로배치하여실행시마다주소가바뀌도록하는보호기법.
Image from : https://bpsecblog.wordpress.com/2016/05/16/memory_protect_linux_1/
echo 1 > /proc/sys/kernel/randomize_va_space
Kernel ASLR
K-ASLR : Kernel mode ASLR
부팅시마다메모리주소레이아웃을난독화함
공격자는공격할 code/data 의위치를정확히예측하기어려워짐
Image from : Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX, Black Hat USA 2015
KASLR changes kernel symbol addresses every boot
Popular OSes Adopted KASLR
Cook, K. “KASLR, 2013” Linux Security Summit
First released : Linux 3.14 Kernel (optional)
Image from : Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX, Black Hat USA 2015
Example : Ubuntu Linux
Ubuntu Linux 의경우연도별로새로운 Release
16.10 version에포함된 4.8 kernel 부터 default : enable KASLR
Fedora 25 등에도 KASLR 기본적용
Version Kernel KASLR
12.04 LTS 3.11 Unsupported
14.04 LTS 3.13 Unsupported
15.04 3.19 Optional
16.04 LTS 4.4 Optional
16.10 4.8 Default
17.04 4.10 Default
Ubuntu Version/Kernel에따른 KASLR 적용여부
https://kernelnewbies.org/Linux_4.8
Side Effect (?)
Volatility Error on Linux 4.8+ => KASLR error
KASLR 적용여부를감지하고우회할수있는방안필요.
ERROR : No suitable address space mapping found
KASLR Shift Plugin 개발 (1)
calculate() Initialization
dtb < dtb_candidates
pte_to_search_for = pte_to_search_for.replace(pte_to_search_for[-4:-1], '...')pte_regex = re.compile(pte_to_search_for)
pte=_match = find_key(tree,pte_regex)
Searches for a leaf in a nested dictionary and returns the path taken
dtbs_and_offsets[dtb] = index_offsets
yield [dtb, candidate, dtb_candidates[dtb] - candidate]
dtb++
KASLR Shift Plugin 개발 (2)
unified_output()
def unified_output(self, data):return TreeGrid([("DTB", Address), ("VirtualShift", Address), ("Physical Shift", Address)],
self.generator(data))def generator(self, data):
for dtb, virtualshift, physicalshift in data:yield(0, [Address(dtb), Address(virtualshift), Address(physicalshift)])
Volatility Core Patch
volatility/plugins/overlays/linux/linux.py
https://github.com/volatilityfoundation/volatility/pull/385/files
Simple test
It works!
--dtb=0x11406000 --virtual=0x39200000 --physical=-700448768
Conclusion & Discussion
• Linux Memory Forensic : Current state of the art
• Live 시스템에서 직접 프로파일 생성 및 덤프
• 프로파일 공유를 위한 오픈 커뮤니티 필요
• Auto OS Fingerprinting 연구 접목 필요
• 리눅스 프로세스 메모리 구조 분석 및 바이너리 복원
Conclusion & Discussion
[1] Burdach, Mariusz. "Physical memory forensics." Black Hat USA (2006).[2] Amari, Kristine. "Techniques and tools for recovering and analyzing data from volatile memory." SANS Institute (2009).[3] 주한익. “리눅스물리메모리덤프파일을이용한심볼정보재구성포렌식도구구현.” 서강대학교정보통신대학원학위논문(석사), 2016.[4] LiME : Linux Memory Extractor, 2012. https://github.com/504ensicsLabs/LiME[5] Sylve, Joe, et al. "Acquisition and analysis of volatile memory from android devices." Digital Investigation 8.3 (2012)[6] The Volatility Framework: Volatile Memory Artifact extraction Utility Framework, 2016. https://github.com/volatilityfoundation/volatility[7] Ligh, Michael Hale, et al. “The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory.” John Wiley & Sons, 2014.[8] Google, Rekall Memory Forensic Framework, 2016. https://github.com/google/rekall[9] Brezinski, D., and Tom Killalea. “Guidelines for evidence collection and archiving. No. RFC 3227.”, 2002.[10] Farmer, Dan, and Wietse Venema. Forensic discovery. Vol. 6. Upper Saddle River: Addison-Wesley, 2005.[11] 대법원 2007. 12. 13. 선고 2007도7257[12] Volatility profiles for Linux and Mac OS X, 2014, https://github.com/volatilityfoundation/profiles[13] Cook, K. "Kernel address space layout randomization, 2013." Linux Security Summit.[14] Hal Pomeranz. "Automating Linux Memory Capture." SANS DFIR Summit, 2014.[15] Anderson, D. "Libdwarf and dwarfdump." (2011).[16] Gu, Yufei, and Zhiqiang Lin. "Derandomizing kernel address space layout for memory introspection and forensics." Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy. ACM, 2016.[17] Volafox memory analysis framework, 2015, https://github.com/n0fate/volafox.[18] 이경식. "Mac OS X의물리메모리분석연구." 고려대학교정보경영공학전문대학원학위논문(석사), 2010.[19] Andrew Case, et al. "Memory forensics: The path forward," Digital Investigation, Volume 20, 2017.
Reference
