“The Need for Speed”: Extracting Session Keys From the Main Memory Using Brute-force and Machine Learning
Stewart Sentanoe, Christofer Fellicious, Hans P. Reiser, Michael Granitzer · 2022
Digital forensics has become an important topic during this digital devices era. One major problem is extracting critical information from a digital device, and one of such data sources from a digital device is the main memory. The main memory holds many data that can be as simple as a text and a number or as complex as a data structure that holds cryptography keys. In line with the growth of the digital devices era, the need for privacy is also becoming an emerging topic. Encryption is one of the ways to achieve privacy during data transmission. As mentioned, the main memory might hold the session keys to encrypt or decrypt such secure data transmissions. This paper proposes a pure brute-force and a machine learning augmented brute force method to extract session keys from the main memory. In addition, we reduce the training data footprint using a novel entropy-based preprocessing method. We choose the most commonly used secure communication protocols: Secure Shell (SSH) and Transport Layer Security (TLS). With the help of machine learning, our method becomes efficient compared to the brute-force method. Our performance evaluation shows that our methods can extract the keys with high precision and considerably fast run-time.