See you later, allocator!’: Updating Volatility’s analysis of modern Linux memory allocators

No ratings

Presented at BSides Las Vegas 2022 by

Daniel Donze

Memory forensics, which is the recreation of system state through the analysis of physical memory (RAM), is a key technique for responding to modern security incidents. Given the frequent use of memory-only frameworks and payloads by attackers, memory analysis is often the only technique that incident response handlers can rely on to perform complete investigations. In this talk, research will be presented that introduces newly developed techniques for deep examination of Linux memory samples. This includes new research performed against the kernel memory allocator, known as SLUB, as well as the development of new Volatility capabilities that leverage the research to uncover new artifacts. With these new capabilities, investigators can uncover a wide variety of system information that will greatly increase insight into examined systems. This includes direct recovery of processes and network activity hidden by malware, file system interactions by attackers, and historical information not available to live forensics tools. Attendees of this presentation will be shown examples of how to use Volatility to recover these artifacts, and the code developed during this research process will be contributed to the open source Volatility project. This will allow attendees to immediately use the presented capabilities during their daily investigations.