How I met your browser: going incognito doesn’t hide your browsing from Ragamuffin.

No ratings

Presented at bsideszurich 2017 by

Alessandro Vito

Nowadays, the browser represents the gate between a human and its virtual world; all this makes it one of the most challenging attack vectors and a source of invaluable relevance during a forensic analysis. In this talk I will introduce theoretical and practical methodologies to perform an analysis of the Google Chrome web browser address space, dissecting – in a forensically-sound manner – the data structures implemented by the Blink rendering engine and its JavaScript V8 engine. In addition, some case studies will be presented with the help of Chrome Ragamuffin, a new Volatility plugin that makes the analyst able to gain a new set of artifacts otherwise unattainable by existing forensic tools. This way, it also overcomes in fact the limits introduced the modern anti-forensic techniques such as the incognito mode.