All your System Memory are belong to us: From Low-Level Memory Acquisition to High-Level Forensic Event Reconstruction
Tobias Latzo · 2021
This thesis comprises two parts. In the first part, we unveil the limitations of forensic event reconstruction with log files. To enhance forensic event reconstruction, we use system call traces treated as log files. System call traces are gained via virtual machine introspection, which analyzes the target system’s memory. System memory analysis, in general, has evolved into an essential part of today’s forensic investigations. For this, memory needs to be acquired first, becoming more difficult with upcoming system security features. Hence, the second part of this thesis is dedicated to memory acquisition techniques. First, we survey the landscape of forensic memory acquisition techniques. Then we introduce new low-layer memory acquisition techniques and tools. In the first part of this thesis, we calculate characteristic fingerprints for various typical Linux administration-related events. We use different standard log files, and additionally, we make use of system call traces. While these turn out to be beneficial for event detection, they have a significant impact on performance. Hence, we research which system calls are discriminative and improve performance by only tracing relevant ones. The second part of this thesis is dedicated to low-level memory acquisition techniques starting with a universal taxonomy and survey. On the one side, the survey reveals, the lower the memory acquisition technique’s layer, the better. On the other side, only a few tools do run “below” the operating system. In the further course of the thesis, four techniques are introduced that do operate on low layers. All techniques come with pros and cons and have their particular use cases. Our first two techniques are integrated into the computer’s firmware. UEberForensIcs acquires memory from the UEFI Shell. To acquire memory, one needs to restart the system and open the UEFI Shell. System memory is exfiltrated over the network. Another approach is to hook UEFI’s Runtime Services that are called by the target’s operating system. The third technique we introduce makes use of Direct Memory Access (DMA). We leverage the high capabilities of Baseboard Management Controllers (BMCs), which are standard in remote administration servers. With BMCLeech we introduce stealthy memory acquisition from the BMC via Direct Memory Access (DMA) that is compatible with the memory forensic tool PCILeech. Eventually, we use the little-known Intel Direct Connect Interface (DCI) to acquire system memory via JTAG debugging. This approach is beneficial in terms of atomicity and integrity of the resulting memory image. DCILeech is also compatible with PCILeech and so benefits from all its features. Additionally, we show how to read the secured memory of Intel SGX enclaves.