UnFucking Forensics: Active Passive memory hacking debugging
Defensive and offensive memory hacking techniques for forensic analysis and covert attacker debugging.
Summary
Forensic Challenges
The presentation covers how to perform forensics, counter-forensics, and defensive forensic improvement. Understanding return-oriented programming (ROP) and static detection from memory is critical.
Defensive Techniques
WTF is ROP and why it matters. Detecting RoP statically from memory and counteracting Gargoyle attacks provides defense insights. These techniques help incident responders and forensic analysts.
Memory Debugging
In-memory passive debugging techniques allow covert debugging of attackers. The term "active passive" indicates methods not using easily detectable events or techniques that attackers would notice.
Offensive Techniques
CloudLeech represents a cloud-based twist on Ulf Frisk Direct Memory Attack. Offensive and defensive capabilities provide comprehensive view of memory-based attack and defense mechanisms.
Related talks
37th Annual FIRST Conference·29 min
Analysts investigate attack surfaces and defenses concerning Anti-Forensics - You are Doing it Wrong (Believe Me, I'm an IR Consultant).
Black Hat·25 min
Engineers explore architecture and security mechanisms for Fixing a Memory Forensics Blind Spot: Linux Kernel Tracing.
Black Hat·31 min
Matt Bergin
Security researchers examine technical aspects of Anti-Forensics: Reverse Engineering a Leading Phone Forensic Tool.