Thursday, March 21, 2019

Daily Blog #649: How to pick something to test

Hello Reader,
         One of the questions I get asked on a semi regular basis is, how do I pick what to test/research? The answer is more simple than you would expect:

Selection pool:

  •  I look at an interaction I just experienced while using the operating system
  • I think about an artifact I don't feel I full understand
  • I am working on a case and have to find a way to recreate a behavior I found

After that, as you can see the in test kitchen videos, I spend hours testing/recreating/examining/understanding the behavior that I'm seeing. While it is possible that two different actions can result in the same behavior, typically those different actions create their own marks on the system allowing you determine which route the user went through.

I have my travel streaming system with me now and I'm currently in an airport in Dubai awaiting my flight to Jeddah. My hope is that the hotel in Jeddah will have enough bandwidth to let me stream some testing this week, wish me luck!

Tuesday, March 19, 2019

Daily Blog #648: How to stream your own test kitchen

Hello Reader,
       As I prepare to get the test kitchen back in service I thought I'd share what I use for others who are looking to do the same. I got this idea after this tweet from Gerald Davis


So here is my setup:
Hardware: I have a Windows 10 desktop with a Nvidia GTX 980 an i7 processor and 32gb of RAM. It's nothing special and you don't need much in order to do this. The OS is running off of a SSD and the virtual machines are running off a 2TB 7200 RPM Western Digital.

Broadcasting software: I'm using XSplit broadcaster. You could use something else like OBS or Wireframe but XSplit when I was looking was the easiest to setup and use with all of its built in plugins and stream support.

Hypervisor: I'm using VMWare Workstation

Mic: I'm using a HyperX Cloud 2 headset, nothing special just a headset with a mic.

I have a 4K Samsung monitor so I have the VM running in the upper corner of the monitor and have drawn the broadcast window over it. This allows me to keep most of the screen off camera as it were so I can monitor the stream, check chat and google things while also making the streamed desktop be a readable size to the viewer.

I got the Windows OS ISO's from MSDN but you could also get eval images from Microsoft directly.

Have other questions? Let me know in the comments and I can explain more about what I do and how it works. 

Monday, March 18, 2019

Daily Blog #647: Windows Forensics in San Diego

Hello Reader,

               Looks like I'll be heading to sunny San Diego California to teach SANS FOR500: Windows Forensics this May 9 2019. The event is called Security West and its one of the bigger SANS events of the years. If you wanted to learn Windows Forensics, see San Diego and see some great bonus sessions for some amazing SANS instructors its a great event.

Want to learn more? Click below
https://www.sans.org/event/security-west-2019/course/windows-forensic-analysis

Sunday, March 17, 2019

Daily Blog #646: Sunday Funday 3/17/19

Hello Reader,
              I always appreciate it when people spend their time researching rather than doing other fun things, like playing video games or reading a non-technical book. When we share what we know, even if we don't know everything about something, it helps someone else leap frog forward and learn more. This week let's keep our head in the clouds for another challenge.


The Prize:
$100 Amazon Giftcard

The Rules:

  1. You must post your answer before Friday 3/22/19 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post


The Challenge:
Name and describe all of the available forensic data sources provided by Azure Compute

Daily Blog #645: Solution Saturday 3/16/19

Hello Reader,
         Spring break is ending which means kids are going back to school soon and I'll be back on track with blogging. Here is this weeks winner!

The Challenge:
Name and describe all of the available forensic data sources provided by Amazon AWS for EC2

The Winning Answer:
Jonathan Yan

CloudTrail Logs
Cloudtrail is an audit log that is enabled by default and stores all actions on resources for an account for 90 days. For EC2 specifically, it can provide information on the user and the action they performed on a specific resource such as EC2 KeyPairs, NetworkAcl, SecurityGroup, Snapshot to see if any suspicious changes were made.
cloudtrail-start-stop-instance.png
EBS (Elastic Block Store) Snapshots
Elastic Block Store are the hard drives that EC2 instances use to store data on. Snapshots can be taken of the EBS of a compromised and mounted onto a trusted EC2 instance for forensic investigation. These snapshots can be taken regularly as part of backups or whilst responding to an incident. Note that the ownership of snapshots can be assigned to another AWS account to ensure they cannot be modified by anyone with permissions over a compromised account.
EBS.png

VPC Flow Logs
VPC Flow logs are a record of ip traffic to and from network interfaces within a Virtual Private Cloud (VPC), which is the segregated network that EC2 instances reside in. It can provide a trail of all network traffic to and from each EC2 instance. However, this has to be enabled per VPC and then sent to AWS CloudWatch or stored in an AWS S3 bucket, where it can then be analysed.
vpc-flow-logs.png
AWS Systems Manager
AWS Systems Manager is a utility that can be enabled as an AWS agent on an EC2 instance to record all the installed software, network configurations, CPU data, windows patch versions, specific windows registry keys and files. It could be useful for a first glance while in the console, but this has to be enabled and configured correctly before an incident occurs to provide value. Additionally, information shown here can be found during forensic investigation of EBS volume.
aws-system-manager-auditing.png
AWS Inspector
AWS Inspector is a vulnerability scanning platform that can identify vulnerabilities in applications running on EC2 instances. If enabled and configured, it could be useful during forensic investigations to narrow down which vulnerabilities may have been exploited on a host.
Cheers,

Tuesday, March 12, 2019

Daily Blog #644: Creating decrypted images of APFS file systems encrypted with T2 Chips with Macquistion

Hello Reader,
          Dealing with T2 Chips on recent model Macbooks has been a real pain point for us in the lab so I was very, very happy to read that Blackbag (thanks Joe and Vico!) have figured out how to transparently decrypt the physical blocks of a drive being managed by a T2 chip at imaging time. Now the important to understand is that this decryption is being done at Image time, meaning Macquisition is not extracting the keys for later use. Instead Blackbag has found a way to get the T2 chip to return decrypted blocks rather than just files.

This is a big step forward as all of the other solutions I'm aware of (including the previous version of Macquistion) where stuck just doing file system images (logical images) of APFS drives with T2 chips. Now with this feature you can get all the data including APFS snapshots and possibly deleted data as well.

You can read more here:
https://www.blackbagtech.com/blog/2019/03/11/macquisition-will-decrypt-physical-images-macs-t2-chip/

Monday, March 11, 2019

Daily Blog #643: Sunday Funday 3/10/19

Hello Reader,
        On this blog we focus on a lot of host related issues, but the world is no longer confined to single on premises hosts anymore. This week let's set our challenge sights to the skies and start seeing what you can research about ... the cloud.



The Prize:
$100 Amazon Giftcard

The Rules:

  1. You must post your answer before Friday 3/15/19 7PM CST (GMT -5)
  2. The most complete answer wins
  3. You are allowed to edit your answer after posting
  4. If two answers are too similar for one to win, the one with the earlier posting time wins
  5. Be specific and be thoughtful
  6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
  7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post


The Challenge:
Name and describe all of the available forensic data sources provided by Amazon AWS for EC2