[00:00.000 --> 00:00.500]  Hey, y'all.
[00:04.580 --> 00:06.180]  How has your guys' weekend been?
[00:06.280 --> 00:07.540]  Everybody having a good weekend at HOPE?
[00:09.420 --> 00:09.780]  Awesome.
[00:09.780 --> 00:10.520]  Learning a lot?
[00:10.700 --> 00:11.420]  Catching all the Pokemon?
[00:12.860 --> 00:13.220]  Cool.
[00:13.820 --> 00:15.480]  Well, thank you for coming to the talk.
[00:15.600 --> 00:16.800]  This is Anti-Forensics AF.
[00:17.340 --> 00:25.960]  I named it this because the memes that are like, you know, that's silly AF or that stupid AF, when I would read it, I would always think, that's silly anti-forensics.
[00:26.060 --> 00:28.140]  And it's like, that's not what it means, so I don't know.
[00:28.640 --> 00:30.660]  My name's Int 80, I'm the rapper in Dual Core.
[00:31.500 --> 00:34.340]  Have you guys heard the song, Drink All the Booze, Hack All the Things?
[00:35.300 --> 00:36.560]  Cool, that's me.
[00:37.620 --> 00:40.880]  This is my fourth talk that I've made about anti-forensics stuff.
[00:41.360 --> 00:44.420]  The other three are, they're all different than this, and you can find them on YouTube.
[00:46.260 --> 00:50.180]  I just, I like computers, and I'm not like a, I'm not super lead or anything like that.
[00:50.280 --> 00:51.380]  I just like to mess around, so.
[00:52.160 --> 00:53.760]  Here's what we're going to talk about today.
[00:54.140 --> 01:01.100]  We're going to talk about some memory forensic stuff, and evading memory forensics with using self-modifying code.
[01:01.440 --> 01:09.860]  We'll look at this from like the context of being an attacker on a system, and you're basically trying to preserve your malware and your tool chain that's got persistence on that system.
[01:10.060 --> 01:11.360]  We'll look at some Android stuff.
[01:11.740 --> 01:16.800]  The TLDR of Android is that forensics sucks on Android, and then it's kind of easy to win.
[01:16.800 --> 01:24.720]  And then I'll show you some neat SD card stuff that I got put onto by my friend Craig Smith from Open Garages, who gave the car hacking talk on Friday.
[01:25.180 --> 01:27.700]  And so that's pretty much the overview.
[01:31.770 --> 01:33.250]  So a few disclaimers to start.
[01:33.410 --> 01:34.290]  I'm not a professional.
[01:34.890 --> 01:36.410]  Maybe you guessed by that last slide.
[01:37.230 --> 01:41.070]  I love to troll people, and specifically three-letter agencies.
[01:41.070 --> 01:43.590]  So I've had some really fun run-ins with the FBI and the NSA.
[01:44.110 --> 01:47.450]  Happy to talk about them with a drink in my hand or something.
[01:48.170 --> 01:49.410]  I don't do forensics for a living.
[01:50.310 --> 01:51.470]  Like, I hack stuff.
[01:51.650 --> 01:53.550]  So I'm not an expert by any means.
[01:53.750 --> 01:54.670]  Your mileage may vary.
[01:55.190 --> 01:59.730]  And then everything cool that I know how to do with computers, I've learned by doing illegal things.
[01:59.890 --> 02:01.270]  So do illegal things.
[02:06.960 --> 02:07.280]  Great.
[02:07.420 --> 02:08.440]  Okay, so memory forensics.
[02:09.700 --> 02:13.500]  So everybody knows, like, memory forensics has been the new hotness for the last, like, decade or so, right?
[02:13.500 --> 02:15.060]  Like, all the cool stuff happens in memory.
[02:15.420 --> 02:19.160]  And from our perspective, like, I've shelled a system.
[02:19.440 --> 02:21.560]  I've dropped my malware to establish persistence.
[02:21.580 --> 02:23.180]  I've got to shell back out or whatever.
[02:23.320 --> 02:24.800]  I don't want my malware caught, right?
[02:24.900 --> 02:26.100]  Like, I had to build this tool chain.
[02:26.320 --> 02:29.840]  I don't want to, like, tear down my infrastructure, et cetera.
[02:30.120 --> 02:32.280]  Like, I want my malware to keep on living.
[02:32.440 --> 02:34.580]  So basically I'm trying to evade detection.
[02:34.580 --> 02:41.780]  And then if the system is seen as being accessed or whatever, I don't want my malware acquired and then analyzed.
[02:41.780 --> 02:43.040]  So that's our goal here.
[02:44.240 --> 02:46.820]  Like I said, you know, memory forensics is where it's at.
[02:47.760 --> 02:53.720]  And so we're going to actually leverage the difference between running in memory and having to load from disk.
[02:54.140 --> 03:00.580]  So the thing that's cool with binaries, anybody that's done reverse engineering or looked at executables, you'll see, like, they have a bunch of different sections.
[03:00.900 --> 03:10.740]  Any data that is needed, any bytes that are needed in those sections to load from disk into memory, once they're no longer needed in memory, you can remove them or change them or whatever.
[03:11.380 --> 03:19.560]  So basically, like, this totally messes up analysis tools if you start munching with, like, particular sections or values or fields.
[03:19.800 --> 03:22.220]  So there's a lot of cool stuff to be had, and we'll do a couple demos.
[03:26.100 --> 03:32.280]  All right, so my first demo is a program that I wrote called the keys are, like, right next to each other.
[03:33.220 --> 03:36.920]  And I wrote it... or I named it that because of this bash.org quote.
[03:42.840 --> 03:43.800]  It's a common typo.
[03:43.880 --> 03:45.280]  The keys are, like, right next to each other.
[03:45.980 --> 03:46.260]  All right.
[03:46.520 --> 03:47.560]  Let's give this a go.
[03:47.660 --> 03:48.140]  See what happens.
[03:52.430 --> 03:52.990]  Oh, no.
[03:56.870 --> 03:57.530]  There it is.
[03:58.210 --> 03:58.850]  Look at that.
[04:00.090 --> 04:00.450]  Smack.
[04:00.530 --> 04:01.070]  It just works.
[04:01.470 --> 04:01.710]  All right.
[04:03.710 --> 04:07.130]  Okay, so I have this program.
[04:07.370 --> 04:08.690]  The keys are, like, right next to each other.
[04:08.890 --> 04:14.550]  And what we're gonna do is we're gonna... in this case, like, this is a POC program, but say that this is my malware, right?
[04:15.130 --> 04:17.230]  And so malware is running.
[04:18.390 --> 04:18.790]  Great.
[04:19.030 --> 04:19.330]  Cool.
[04:19.570 --> 04:25.010]  Now let's acquire RAM and see if we can get the malware out of memory.
[04:33.660 --> 04:37.500]  So... I have a really bad memory, so I have to, like, write all my notes down.
[04:38.860 --> 04:39.300]  All right.
[04:39.380 --> 04:45.380]  So what we're doing is we're using WinPMem, which is part of the recall toolkit that's published by Google.
[04:45.580 --> 04:46.040]  It's open-source.
[04:47.580 --> 04:49.900]  So... this is gonna acquire RAM.
[04:51.000 --> 04:51.720]  I hope.
[04:53.040 --> 04:53.940]  Driver unloaded.
[04:54.000 --> 04:54.600]  That doesn't look right.
[04:55.900 --> 04:56.380]  Huh?
[04:56.380 --> 04:57.300]  Let's see what happens.
[05:13.030 --> 05:13.510]  Hello.
[05:18.490 --> 05:19.230]  Are you kidding me?
[05:19.590 --> 05:20.690]  Did I typo something?
[05:23.550 --> 05:24.030]  Oh.
[05:24.250 --> 05:24.630]  There we go.
[05:25.890 --> 05:26.370]  Cool.
[05:26.530 --> 05:27.290]  So recall's really nice.
[05:27.530 --> 05:29.050]  It's, like, basically, IPython.
[05:29.050 --> 05:30.910]  If any of you guys use IPython, it's really nice.
[05:31.990 --> 05:33.830]  Oh, and I totally did not run it right.
[05:35.370 --> 05:36.190]  My bad, y'all.
[05:41.140 --> 05:41.840]  Oh, shoot.
[05:42.980 --> 05:45.000]  That was not intended.
[05:52.450 --> 05:54.740]  Is it lol.aff4 in there?
[05:54.860 --> 05:55.040]  Yep.
[05:55.220 --> 05:55.330]  Okay.
[05:55.830 --> 05:56.240]  Cool.
[05:57.580 --> 05:58.160]  All right.
[06:09.420 --> 06:10.060]  All right.
[06:13.920 --> 06:14.380]  Cool.
[06:14.640 --> 06:17.220]  So this is, like, this is recall.
[06:18.080 --> 06:22.520]  The PS list gives you a list of processes that you had running in memory.
[06:23.720 --> 06:24.960]  What is that number?
[06:25.960 --> 06:26.400]  5868?
[06:26.680 --> 06:27.120]  5068?
[06:27.900 --> 06:28.340]  5068.
[06:28.640 --> 06:29.080]  5068.
[06:29.220 --> 06:29.300]  Cool.
[06:29.440 --> 06:29.520]  Thanks.
[06:30.100 --> 06:30.340]  All right.
[06:30.600 --> 06:32.220]  So let's dump that.
[06:32.360 --> 06:33.120]  That's our malware, right?
[06:36.660 --> 06:39.720]  This is the most challenging demo I've ever done in my life.
[06:40.160 --> 06:41.740]  It only goes downhill from here.
[07:04.870 --> 07:05.450]  All right.
[07:05.630 --> 07:05.850]  Dumping.
[07:06.350 --> 07:07.150]  Did we get it?
[07:07.490 --> 07:08.170]  Does it look right?
[07:08.170 --> 07:08.210]  All right.
[07:08.530 --> 07:11.150]  Let's open it up with hxd.
[07:14.970 --> 07:15.940]  Oh, shoot.
[07:20.520 --> 07:21.860]  Hot dang it.
[07:23.140 --> 07:24.340]  I'm so sorry.
[07:24.440 --> 07:26.180]  I can't see a darn thing.
[07:37.140 --> 07:37.960]  users.
[07:41.140 --> 07:43.580]  Is that the right directory?
[07:44.980 --> 07:45.460]  All right.
[07:45.920 --> 07:46.180]  Desktop?
[07:48.240 --> 07:48.880]  Oh, my God.
[07:49.000 --> 07:49.560]  This is the worst.
[07:50.120 --> 07:50.660]  Hold on.
[07:52.080 --> 07:53.300]  I'm just going to mirror the screen.
[07:53.850 --> 07:54.660]  Sorry, everybody.
[07:57.040 --> 07:59.000]  My demo is bad, and I should feel bad.
[08:07.110 --> 08:08.150]  Where is the mouse?
[08:09.750 --> 08:10.510]  This is the worst.
[08:10.650 --> 08:10.770]  All right.
[08:10.810 --> 08:11.130]  Here it goes.
[08:11.650 --> 08:12.050]  Jesus.
[08:14.850 --> 08:19.070]  I wish I could blame, like, being hungover or something, but really I'm just bad at being on stage.
[08:20.410 --> 08:20.950]  All right.
[08:24.850 --> 08:25.550]  There we go.
[08:25.770 --> 08:26.710]  Everybody can see that, right?
[08:27.030 --> 08:27.850]  I can see it, too.
[08:28.430 --> 08:28.790]  Hooray.
[08:30.610 --> 08:31.170]  All right.
[08:31.830 --> 08:34.230]  So, let's see.
[08:35.290 --> 08:36.090]  Executable 5068.
[08:36.630 --> 08:37.230]  Oh, shoot.
[08:37.290 --> 08:37.850]  It's all zeros.
[08:38.250 --> 08:39.650]  Does anybody know what should be here?
[08:41.150 --> 08:42.270]  PE header, right?
[08:42.630 --> 08:44.730]  Should be, like, 45A.
[08:45.010 --> 08:47.950]  There should be, like, a 50 somewhere in there.
[08:48.230 --> 08:52.430]  And so, basically, if you feed this into, like, Ida, Ida's going to be, like, I don't know what this is, bro.
[08:52.630 --> 08:53.410]  It's a bunch of bytes.
[08:53.650 --> 09:00.030]  So, it's cool, like, and then the whole point is, look, our malware is still running, right?
[09:00.150 --> 09:03.910]  So, you can't analyze it, even though you've maybe managed to acquire it, but you can't analyze it.
[09:04.010 --> 09:05.150]  So, malware is still running.
[09:05.370 --> 09:06.370]  We evaded analysis.
[09:06.770 --> 09:07.110]  Good job.
[09:07.110 --> 09:10.650]  Don't have to necessarily tear down our infrastructure and build a new toolchain.
[09:14.060 --> 09:14.500]  Dynafire.
[09:15.780 --> 09:16.360]  All right.
[09:18.840 --> 09:20.200]  Any questions about that?
[09:22.220 --> 09:22.660]  No?
[09:22.840 --> 09:24.860]  I guess we'll just take questions at the end, anyways.
[09:29.570 --> 09:30.250]  All right.
[09:41.930 --> 09:42.370]  Cool.
[09:43.350 --> 09:43.770]  Great.
[09:43.910 --> 09:45.250]  So, the keys are, like, right next to each other.
[09:46.210 --> 09:56.230]  So, what we did is, the malware, once it loads into memory, it zeroes out the header, finds itself, and then just calls RTL zero memory.
[09:57.630 --> 09:59.130]  The process runs fine, right?
[09:59.230 --> 10:00.290]  Like, all the code is still executing.
[10:00.630 --> 10:01.510]  We're still winning.
[10:02.010 --> 10:03.850]  But you can't analyze it at that point.
[10:03.970 --> 10:07.490]  And this is something I built back in, like, Windows XP, like, a number of years ago.
[10:07.490 --> 10:10.310]  And this is kind of where I left off in my last anti-forensics talk.
[10:10.550 --> 10:13.090]  And my question was, like, does it still work in Windows 10?
[10:13.250 --> 10:14.210]  And the answer is yes.
[10:15.050 --> 10:16.510]  We can take a look at the code real quick.
[10:17.010 --> 10:17.750]  It's kind of neat.
[10:21.880 --> 10:22.320]  All right.
[10:22.400 --> 10:22.580]  Yeah.
[10:23.860 --> 10:24.960]  So, here's the code.
[10:25.860 --> 10:30.360]  And this is all just standard data structures for Windows executables.
[10:31.380 --> 10:33.580]  There's that MZ header.
[10:33.820 --> 10:34.820]  There's that PE header.
[10:35.920 --> 10:38.760]  Basically, we're just checking, like, hey, did we find the header okay?
[10:39.260 --> 10:42.760]  Let's change the permissions on the page in memory so that we can write to it.
[10:43.280 --> 10:45.000]  And then, here's our workhorse.
[10:45.180 --> 10:46.320]  Just RTL zero memory.
[10:46.500 --> 10:47.760]  Just write zeroes into that page.
[10:48.340 --> 10:53.020]  And then we reset the protections again with virtual protect, or the permissions.
[10:53.420 --> 10:54.000]  And we're done.
[10:54.120 --> 10:56.800]  And this is just POC for just looping to continue running.
[10:56.800 --> 10:58.080]  So, really not a lot to it.
[10:58.140 --> 10:58.900]  It's pretty easy to do.
[10:59.040 --> 11:01.160]  But it thwarts analysis, and you win.
[11:01.360 --> 11:02.040]  So, it's kind of neat.
[11:05.000 --> 11:05.720]  All right.
[11:09.860 --> 11:10.220]  Cool.
[11:10.560 --> 11:11.220]  So, yeah.
[11:14.040 --> 11:14.760]  All right.
[11:14.880 --> 11:18.340]  So, this is what we did on the demo, despite all of my typos and failings.
[11:18.840 --> 11:20.780]  We ran WinPmem to acquire memory.
[11:20.920 --> 11:23.200]  I'll put it in this lol.aff4 file.
[11:23.480 --> 11:25.000]  That's like your memory dump, essentially.
[11:25.580 --> 11:27.020]  Run recall against it for analysis.
[11:27.020 --> 11:34.440]  And then, ProcDump is the module that we use to get the malware out of memory.
[11:42.050 --> 11:44.010]  So, we can do the same thing in Linux, too.
[11:44.610 --> 11:47.010]  Except the tools are to use Lime and volatility.
[11:47.450 --> 11:48.530]  So, let's do that.
[11:53.990 --> 11:54.390]  Shit.
[11:54.590 --> 11:55.190]  Actually, here.
[11:55.250 --> 11:56.330]  I'm just gonna mirror the displays again.
[11:56.850 --> 11:58.390]  I think I learned my lesson the first time.
[12:05.390 --> 12:05.870]  And...
[12:05.870 --> 12:06.570]  A mustard.
[12:09.130 --> 12:09.910]  Super secret.
[12:10.250 --> 12:10.430]  All right.
[12:11.010 --> 12:13.890]  So, the keys are, like, right next to each other.
[12:14.030 --> 12:16.070]  This is just some debugging output.
[12:17.830 --> 12:19.090]  So, malware's running.
[12:19.270 --> 12:19.510]  Right?
[12:19.570 --> 12:20.330]  We're doing a good job.
[12:21.090 --> 12:22.270]  We're doing evil stuff.
[12:23.910 --> 12:24.230]  And...
[12:26.590 --> 12:27.090]  Oh, no.
[12:27.350 --> 12:28.610]  I forget how to...
[12:28.610 --> 12:29.310]  Oh, that is not it.
[12:32.650 --> 12:32.970]  F*ck.
[12:34.150 --> 12:34.590]  Hold on.
[12:34.650 --> 12:35.610]  Let me kill the malware real quick.
[12:36.090 --> 12:36.470]  All right.
[12:36.530 --> 12:37.770]  I'm just gonna run it in here.
[12:37.930 --> 12:38.510]  It's running, right?
[12:38.550 --> 12:38.890]  We're fine.
[12:39.230 --> 12:40.910]  We'll do the analysis stuff over here.
[12:40.910 --> 12:42.070]  All right.
[12:43.430 --> 12:43.970]  So...
[12:55.420 --> 12:56.420]  This is just...
[12:56.420 --> 12:57.020]  What we're gonna do is...
[12:57.020 --> 13:00.260]  We're gonna use Lime to load a kernel module.
[13:00.700 --> 13:01.880]  And then...
[13:03.820 --> 13:05.820]  Dump out to...
[13:05.820 --> 13:07.500]  lol.lyme intent.
[13:07.660 --> 13:07.980]  How about that?
[13:08.040 --> 13:08.700]  That should be writable.
[13:10.720 --> 13:11.260]  And...
[13:15.980 --> 13:17.600]  So, we're acquiring memory.
[13:18.580 --> 13:19.340]  I hope.
[13:21.880 --> 13:23.360]  Let's go into volatility.
[13:26.840 --> 13:27.320]  And...
[13:27.940 --> 13:31.760]  One thing I'm gonna skip in the demo is about how to build...
[13:32.740 --> 13:35.380]  Build the modules for Ubuntu, but we'll cover it in the slides.
[13:35.800 --> 13:39.860]  So, let's run volatility and...
[13:40.700 --> 13:41.660]  Check out...
[13:41.660 --> 13:42.240]  Oh, God.
[13:57.010 --> 13:58.410]  Check out and make sure that we have...
[13:58.410 --> 13:58.990]  Of...
[14:00.010 --> 14:00.430]  Of...
[14:00.430 --> 14:00.650]  Of...
[14:00.650 --> 14:01.710]  A profile for Linux.
[14:01.870 --> 14:02.090]  So, we do.
[14:02.250 --> 14:02.470]  Which...
[14:02.470 --> 14:03.770]  Doesn't come standard in volatility.
[14:03.970 --> 14:05.290]  And I'll cover that in the slides in just a second.
[14:06.430 --> 14:06.850]  So...
[14:08.250 --> 14:08.670]  Let's...
[14:09.260 --> 14:09.850]  Let's get cracking.
[14:11.550 --> 14:12.550]  So, what we're gonna do is...
[14:12.550 --> 14:13.210]  We're gonna...
[14:13.210 --> 14:14.370]  Analyze our...
[14:14.370 --> 14:15.670]  Lol.lyme dump.
[14:16.670 --> 14:17.090]  And...
[14:17.090 --> 14:18.370]  We'll use this...
[14:18.370 --> 14:18.970]  Profile.
[14:22.570 --> 14:22.970]  And...
[14:22.970 --> 14:25.230]  Let's do...
[14:28.750 --> 14:29.950]  See if we can find the...
[14:29.950 --> 14:31.030]  The PID in memory.
[14:32.070 --> 14:32.530]  All right.
[14:32.550 --> 14:32.850]  There it is.
[14:33.030 --> 14:33.430]  2340.
[14:34.090 --> 14:34.810]  That was easy.
[14:34.970 --> 14:37.010]  Usually I can't find it, because I suck.
[14:38.670 --> 14:39.210]  All right.
[14:39.370 --> 14:40.290]  So, let's dump it.
[14:41.270 --> 14:42.870]  We'll dump it into the temp directory.
[14:44.490 --> 14:44.850]  And...
[14:44.850 --> 14:45.690]  We'll give it the PID.
[14:46.530 --> 14:46.890]  2340.
[14:50.560 --> 14:50.920]  Cool.
[14:51.240 --> 14:51.600]  Looks...
[14:51.600 --> 14:51.960]  You know...
[14:51.960 --> 14:52.820]  Looks like it dumped.
[14:52.920 --> 14:53.060]  I don't...
[14:53.060 --> 14:54.520]  I don't see any errors outside of the...
[14:54.520 --> 14:55.400]  The Python stuff.
[14:55.600 --> 14:56.380]  The Diestorm.
[14:57.080 --> 14:57.440]  So...
[14:57.440 --> 14:59.680]  If we go into temp, we should have...
[14:59.680 --> 15:00.520]  A dump.
[15:00.700 --> 15:00.900]  Oh, yeah.
[15:00.920 --> 15:01.200]  Here we go.
[15:01.380 --> 15:02.440]  The keys are...
[15:02.440 --> 15:02.680]  All right.
[15:02.700 --> 15:03.060]  There it is.
[15:03.600 --> 15:04.680]  So, let's see what we got.
[15:05.780 --> 15:06.500]  It's empty.
[15:07.140 --> 15:07.860]  Well, that's odd.
[15:12.260 --> 15:12.620]  Yep.
[15:12.620 --> 15:13.680]  No bytes.
[15:14.740 --> 15:15.140]  But...
[15:15.140 --> 15:16.440]  Now we're still running.
[15:16.580 --> 15:17.600]  It's still doing evil stuff.
[15:18.260 --> 15:18.700]  We won.
[15:19.000 --> 15:19.340]  Good job.
[15:19.500 --> 15:20.200]  Good job, red team.
[15:21.360 --> 15:22.240]  Hack the planet.
[15:28.450 --> 15:32.730]  Code for this is pretty similar to the Windows one.
[15:33.310 --> 15:36.570]  Basically, resolve the elf header.
[15:37.370 --> 15:38.430]  So, the PE header.
[15:38.690 --> 15:41.350]  This is kind of like janky breeding out of proc self maps.
[15:41.510 --> 15:41.970]  You can do it.
[15:42.070 --> 15:43.170]  I did it because I'm lazy.
[15:43.430 --> 15:44.530]  And I suck.
[15:45.170 --> 15:45.650]  But...
[15:46.230 --> 15:48.670]  Find your start address for your header page.
[15:48.810 --> 15:49.570]  Find your end address.
[15:49.930 --> 15:51.030]  And then...
[15:51.030 --> 15:52.330]  Just basically like...
[15:52.330 --> 15:53.550]  This is debug stuff.
[15:53.810 --> 15:54.290]  But...
[15:54.290 --> 15:56.030]  Set the permissions with mprotect.
[15:56.110 --> 15:57.230]  Just like we called virtual protect.
[15:57.410 --> 15:58.230]  It's the analog in Windows.
[15:58.790 --> 16:01.530]  Then memset instead of RTL zero memory.
[16:01.890 --> 16:04.010]  And then reset the page permissions back.
[16:04.250 --> 16:05.530]  And then do evil stuff.
[16:05.810 --> 16:06.290]  So...
[16:06.290 --> 16:08.630]  All we've done is overwrite the header with zeros again.
[16:09.050 --> 16:09.530]  And...
[16:09.530 --> 16:10.810]  We thwarted the analysis.
[16:11.070 --> 16:11.270]  So...
[16:11.270 --> 16:11.830]  Good job, us.
[16:13.090 --> 16:13.690]  All right.
[16:13.690 --> 16:14.510]  Pretty easy, right?
[16:14.630 --> 16:15.090]  It's kind of...
[16:15.510 --> 16:16.390]  It's kind of not difficult.
[16:22.120 --> 16:22.640]  All right.
[16:23.240 --> 16:23.560]  Cool.
[16:23.800 --> 16:24.600]  So, that was...
[16:24.600 --> 16:25.240]  That was that demo.
[16:30.740 --> 16:31.220]  So, yeah.
[16:31.400 --> 16:36.400]  The whole point, like, why these things work is we don't need to reference into the header once...
[16:36.400 --> 16:37.400]  Once we're loaded in memory, right?
[16:37.460 --> 16:38.240]  Like, the code's all there.
[16:38.360 --> 16:38.820]  It's executing.
[16:39.000 --> 16:39.580]  We're good to go.
[16:39.660 --> 16:40.500]  We don't need the header anymore.
[16:40.500 --> 16:42.800]  But the analysis tools do need the header.
[16:43.060 --> 16:44.920]  And so, we can tamper values.
[16:45.060 --> 16:45.840]  We can write zeros.
[16:46.040 --> 16:46.440]  We can do whatever.
[16:46.760 --> 16:48.240]  And we're still executing fine.
[16:48.240 --> 16:49.420]  But the analysis tools will fail.
[16:49.940 --> 16:52.740]  For completeness, this is basically the whole walkthrough.
[16:54.200 --> 16:55.880]  504 Enzix is the crew that made Lime.
[16:56.460 --> 16:59.940]  This is running the module.
[16:59.940 --> 17:00.940]  And then...
[17:01.820 --> 17:04.260]  This is how you build your Linux profile.
[17:04.860 --> 17:07.340]  You'll have to do it for every particular distro that you're working on.
[17:07.420 --> 17:09.880]  Because you need the current kernel headers.
[17:10.060 --> 17:14.880]  But you'll get this module.dwarf as an output file once you've built the profile.
[17:15.100 --> 17:17.480]  And then you can check on it with the...
[17:17.480 --> 17:18.620]  Just by running head.
[17:18.720 --> 17:20.640]  And you should see, like, .debug info to start the file.
[17:25.680 --> 17:26.520]  So then...
[17:26.520 --> 17:27.340]  Excuse me.
[17:28.100 --> 17:34.900]  Then we just move the module.dwarf file along with the current system map for the current kernel into the volatility directory.
[17:35.720 --> 17:36.240]  And then...
[17:36.240 --> 17:40.260]  Just run info and find it with grep.
[17:40.460 --> 17:41.680]  Just to make sure it's there.
[17:43.020 --> 17:46.520]  And then here's our PSList modules and our ProcDump modules.
[17:47.400 --> 17:47.920]  So...
[17:47.920 --> 17:49.900]  Fortunately, volatility documentation is pretty good.
[17:50.080 --> 17:50.440]  So...
[17:50.440 --> 17:52.340]  All of this is readily accessible online.
[17:57.690 --> 17:58.330]  All right.
[17:58.490 --> 17:59.870]  Let's talk about Android stuff.
[18:00.810 --> 18:03.510]  I guess I'll prefix all of the Android stuff by saying, like...
[18:03.510 --> 18:08.050]  I made these slides before all the Qualcomm Trust Zone stuff happened where you can, like, dump the hardware key out.
[18:08.150 --> 18:13.050]  But the premise of all my Android anti-forensic stuff is you have a device with... that's full-disk encrypted.
[18:14.750 --> 18:20.810]  And the situation is you're out doing an operation, right?
[18:20.890 --> 18:22.990]  And you don't take your personal phone with you when you go do that.
[18:23.070 --> 18:23.650]  You leave it at home.
[18:24.070 --> 18:27.290]  And maybe your personal phone has, like, some evidence on it.
[18:27.290 --> 18:33.350]  And if you got raided while you were out, you wouldn't want that evidence to be acquired by whatever law enforcement agency was raiding you.
[18:33.690 --> 18:36.290]  So, the premise is, your device is encrypted.
[18:36.550 --> 18:37.750]  You like having that data.
[18:38.130 --> 18:41.770]  And if anything happens, the device should just turn off, right?
[18:41.930 --> 18:47.190]  Phone's encrypted, and now FBI or whoever can't get access to the evidence on the phone.
[18:47.190 --> 18:49.770]  So, it's a pretty simple approach.
[18:50.350 --> 18:52.570]  But it's all based on using encryption.
[18:53.050 --> 18:55.130]  So, also use Tor.
[18:55.390 --> 18:57.310]  Use Signal if you follow the gruck.
[19:17.570 --> 19:22.930]  The quote in there is, I want to eat a pint of Jerry Garcia ice cream.
[19:22.930 --> 19:24.510]  Should I use a bowl or not?
[19:25.190 --> 19:26.270]  Use Tor, use Signal.
[19:27.870 --> 19:31.010]  And then this one is, Selling social security numbers for Bitcoin.
[19:31.250 --> 19:33.710]  Please contact me on my XMPP and we will discuss further.
[19:34.810 --> 19:35.830]  Use Tor, use Signal.
[19:37.370 --> 19:38.170]  It's just...
[19:47.870 --> 19:50.210]  Goats are literally the greatest of all time.
[19:51.050 --> 19:51.590]  Get it?
[19:52.430 --> 19:52.830]  Cool.
[19:52.970 --> 19:56.710]  So, again, all of this revolves around using encryption, protecting your device.
[19:56.850 --> 20:01.070]  And I'm just going to kind of, like, try to breeze through the Android forensic stuff, because it's kind of boring.
[20:01.070 --> 20:04.310]  Also, the demo really sucks, but the SD card stuff is really fun.
[20:08.640 --> 20:09.140]  All right.
[20:09.360 --> 20:11.880]  So, Android forensics is not the easiest thing to do in the world.
[20:13.780 --> 20:18.680]  Getting an actual, like, acquisition of the NAND storage on a device is a huge pain in the butt.
[20:19.520 --> 20:21.880]  You basically need, like, a rooted device.
[20:22.800 --> 20:30.840]  If you wanted, like, actual memory, you need a loadable kernel modules, like, enabled for the kernel config, which I've never seen on any device.
[20:31.580 --> 20:37.900]  So, I don't know what people do, like, IRL that are actually professionals, if they want a memory dump of a running device.
[20:38.720 --> 20:43.800]  Then, use Netcat to get a disk acquisition off of the NAND.
[20:44.080 --> 20:49.380]  So, you have to cross-compile it for ARM, and then you have to dump it up onto the device.
[20:49.600 --> 20:53.560]  And then different interfaces are exposed via various builds of Android.
[20:54.640 --> 21:04.780]  So, in order to get a successful acquisition off of an Android device, you need the device to be powered on, has to be decrypted, has to be unlocked, has to be rooted, and USB debugging has to be enabled.
[21:04.780 --> 21:07.860]  Of course, if you've got the first four, like, the fifth one's kind of trivial, right?
[21:07.960 --> 21:14.800]  Although they kind of hide it from you now, and I think since, like, Android 5 or something, you have to, like, click in system settings a bunch of times.
[21:15.460 --> 21:21.600]  And then if you want memory acquisition, you have to have all that stuff, plus loadable kernel modules enabled, which, again, I've never seen on a device.
[21:35.540 --> 21:38.920]  This is really an exercise on how many screaming goats will you guys tolerate.
[21:41.240 --> 21:41.780]  All right.
[21:41.940 --> 21:44.800]  So, we've got a netcat cross-compiled.
[21:45.380 --> 21:46.560]  We've got ADB enabled.
[21:46.720 --> 21:47.460]  The device is powered on.
[21:47.640 --> 21:49.080]  It's decrypted, unlocked, et cetera.
[21:49.080 --> 22:01.440]  So, you attach your device, find it with ADB devices, assuming you have the toolkit, the Android SDK, or just enough toolchain to run ADB successfully.
[22:01.740 --> 22:08.140]  Push netcat up, and then what you do is you actually set up a forwarder, like a port forward, with TCP IP.
[22:08.140 --> 22:17.760]  And so, you literally will DD and pipe the bytes that you're reading off of the NAND storage through your, like, netcat listener.
[22:18.040 --> 22:20.020]  And it's so janky, but it works.
[22:21.160 --> 22:27.220]  And then you'll have an acquisition of the NAND, and you can check some of it and do all your normal forensics things that you would do.
[22:27.360 --> 22:29.560]  But all of this stuff, like, oh, shoot.
[22:30.120 --> 22:31.840]  Like, all this stuff has to be working, right?
[22:31.840 --> 22:38.620]  If any of these things happens, the device is encrypted, it powers off, it's locked, like, your acquisition fails.
[22:38.940 --> 22:40.280]  Sorry that you're going to have to watch this again.
[22:43.520 --> 22:44.300]  All right, I made it.
[22:44.400 --> 22:44.500]  Sorry.
[22:45.480 --> 22:49.360]  So, it's just like it's such a long kill chain in order to get a successful acquisition.
[22:49.620 --> 22:53.780]  And the cool thing is, to thwart that, all we have to do is have a device that's encrypted and just turns off.
[22:54.020 --> 22:54.360]  All right?
[22:54.460 --> 22:55.940]  Like, somebody picked up the device.
[22:56.100 --> 22:56.760]  Turn it off.
[22:57.200 --> 22:59.080]  Like, the device just left a geofence.
[22:59.240 --> 22:59.800]  Turn it off.
[22:59.800 --> 23:01.320]  You know, it was on the cell network.
[23:01.520 --> 23:05.740]  Now it's been acquired and put in a Faraday cage bag, and it doesn't have connection to the cell network.
[23:05.940 --> 23:06.400]  Turn it off.
[23:06.640 --> 23:07.260]  Now it's encrypted.
[23:07.640 --> 23:08.280]  Kill chain's done.
[23:08.400 --> 23:09.600]  You can't get acquisition of it.
[23:21.110 --> 23:27.750]  It's probably bad to confess this, but the whole reason that I made this talk was because I had the idea to do slide transitions of screaming goats.
[23:30.350 --> 23:30.850]  All right.
[23:31.050 --> 23:36.310]  So, I was talking about how, like, another janky thing with Android forensics is how the NAND can be exposed through different interfaces.
[23:36.490 --> 23:39.670]  These are all interfaces that I've seen in various Android devices, right?
[23:39.770 --> 23:43.810]  So, it's not like, yeah, I'm just gonna DD dev SDA, and it's always dev SDA.
[23:43.810 --> 23:48.090]  It's like, dev block MMC block, or dev MTD block.
[23:48.410 --> 23:49.030]  It's whatever.
[23:49.970 --> 23:52.250]  Also, I was just trying to be clever with that last one.
[23:52.810 --> 23:54.410]  Code no is comment.
[23:55.750 --> 23:56.190]  Great.
[24:04.300 --> 24:06.560]  Also, there's, like, all these logical acquisitions you can do.
[24:06.680 --> 24:07.180]  It's a lot easier.
[24:07.180 --> 24:10.280]  But, you know, if you're doing forensics, you want all the bytes, right?
[24:10.520 --> 24:14.000]  So, you can do these other things, like ADB pull, and dump sys, and stuff like that.
[24:14.100 --> 24:19.380]  And you'll get really interesting logs, which might be enough for your investigation, depending.
[24:20.190 --> 24:21.460]  But, yeah, it's a huge pain.
[24:27.570 --> 24:28.190]  Goat simulator.
[24:28.490 --> 24:28.730]  Love it.
[24:29.090 --> 24:29.330]  All right.
[24:30.270 --> 24:33.150]  So, more stuff you can do with the logical acquisition.
[24:33.330 --> 24:38.270]  There's also, like, a tool that's made, this open-source, called AFLogical, and it's pretty easy to use.
[24:38.270 --> 24:40.350]  They have a law enforcement edition, as well.
[24:40.550 --> 24:45.610]  So, if you want to, you know, pretend to be a cop and try to get a copy, that's fine, I guess.
[24:45.710 --> 24:46.050]  I don't care.
[24:47.550 --> 24:47.910]  So...
[24:47.910 --> 24:48.230]  All right.
[24:48.310 --> 24:48.670]  So, cool.
[24:48.790 --> 24:53.350]  Like, hopefully I've proven it's awful, right, to do analysis on Android devices.
[24:58.100 --> 24:58.540]  All right.
[24:58.620 --> 24:58.780]  Cool.
[24:59.000 --> 25:04.260]  So, there's a couple scenarios where, like, this is worthwhile.
[25:04.500 --> 25:09.160]  Like, the main one that I thought of is, you know, I leave my personal phone at home, and I'm out doing an operation.
[25:09.980 --> 25:11.840]  I've also built hardware implants.
[25:12.480 --> 25:24.740]  So, like, when you attack, like, a network that's using, like, wireless, right, and they use, like, Radius for authentication, one thing that you might be able to do, and I can neither confirm nor deny that I have, is use an Android device, put it in the bathroom,
[25:24.780 --> 25:29.560]  maybe, of the office that you're targeting, and have it broadcast the same SSID that you're going after.
[25:29.560 --> 25:35.480]  People will go into the bathroom, they'll sit down there, pull out their phone, they'll be like, oh, cool, the, like, work access point is available.
[25:35.680 --> 25:39.680]  Oh, I just need to log in again, I guess, like, I don't know, and they'll type in their creds, and boom, you have creds, great.
[25:39.920 --> 25:50.880]  But, if that hardware implant gets found, you don't want your malware or whatever's on there, like the, you know, the creds that you've captured, to be acquired by somebody else, especially if it's somebody outside of the scope of your engagement.
[25:50.880 --> 25:56.200]  So, this is great, like, the phone moves, turns off, it's encrypted, all the data's, you know, protected.
[25:56.700 --> 25:57.900]  How many of you guys know Coz?
[25:57.960 --> 25:58.660]  Anybody know Coz?
[25:58.740 --> 26:01.000]  Coz did a bunch of Android research and stuff like that.
[26:01.100 --> 26:09.620]  He also likes to smash phones, so initially I wrote this as like a shrug, as the third bullet point, like shrug emoji, but I guess it's actually more like Coz throwing his phone on the ground.
[26:09.840 --> 26:14.280]  So, you know, if you're using encryption and you turn the phone off, it'll protect the data at least from Coz.
[26:15.440 --> 26:16.060]  Okay, cool.
[26:16.200 --> 26:21.940]  So, power down the device, everything's encrypted, and then, of course, after you've deleted Facebook and hit the gym, then you lawyer up.
[26:24.100 --> 26:26.880]  Alright, so, you have all these sensors in your device, right?
[26:27.380 --> 26:28.140]  Bluetooth, right?
[26:28.200 --> 26:35.760]  You could pair your phone to a Bluetooth device in your house and say, hey, if it ever becomes unpaired, like, turn the device off, encrypt the data again.
[26:36.340 --> 26:40.260]  Cellular, if it stops communicating to the cell network or loses signal, just turn the device off.
[26:40.860 --> 26:42.280]  GPS for the geofence stuff.
[26:42.800 --> 26:43.500]  Motion, right?
[26:43.560 --> 26:44.900]  It's got accelerometers in the device.
[26:45.020 --> 26:46.720]  If the device moves, turn it off.
[26:47.100 --> 26:48.120]  Also, power source, right?
[26:48.120 --> 26:53.300]  If you just have it running on battery and your device gets captured by law enforcement, they're going to plug it in to maintain power, right?
[26:53.360 --> 26:54.440]  That's the first part of the kill chain.
[26:54.980 --> 26:57.160]  So, power state changes, turn it off.
[26:57.380 --> 26:58.000]  Same thing.
[27:03.440 --> 27:04.600]  So, I made this app.
[27:04.720 --> 27:06.560]  It's called Duck the Police.
[27:07.460 --> 27:15.300]  And the assertions are that the app is running on a device that's encrypted and using Tor and Signal, I guess, has access to, like, all the sensors.
[27:15.580 --> 27:17.420]  So, this is the worst demo.
[27:17.560 --> 27:21.280]  This is worse than my opening one, so I apologize ahead of time.
[27:23.400 --> 27:29.240]  But what I've got is a phone that's running it and maybe the people in the front row will be able to see and everybody else will just have to believe me.
[27:29.460 --> 27:31.160]  So, here's my phone.
[27:31.400 --> 27:32.080]  It's running.
[27:32.640 --> 27:33.040]  Android.
[27:33.480 --> 27:33.820]  Load.
[27:33.960 --> 27:34.700]  Duck the police.
[27:35.180 --> 27:35.820]  It's on.
[27:36.380 --> 27:37.380]  Select movement.
[27:37.800 --> 27:38.700]  Duck the police.
[27:38.700 --> 27:40.020]  Hey, I'm law enforcement.
[27:40.180 --> 27:40.700]  Give me your phone.
[27:42.080 --> 27:42.480]  There.
[27:42.720 --> 27:43.180]  Now it's off.
[27:44.300 --> 27:45.000]  And encrypted.
[27:45.760 --> 27:50.420]  So, literally you have to power it back on again and decrypt it and the whole forensic kill chain is gone.
[27:50.620 --> 27:53.240]  So, we were able to duck the police.
[28:04.120 --> 28:08.040]  I could only find the one picture with the duck that said duck the police.
[28:17.790 --> 28:20.150]  The rabbit hole goes so deep on this one.
[28:30.530 --> 28:31.490]  I love that one.
[28:31.490 --> 28:31.970]  All right.
[28:32.190 --> 28:38.790]  So, our Android anti-forensic stuff, we encrypt the drive, right?
[28:38.910 --> 28:41.910]  So, here I've booted it back up and it's asking for decryption.
[28:42.110 --> 28:43.790]  So, we won, right?
[28:43.890 --> 28:46.130]  No forensics evidence acquired.
[28:46.410 --> 28:46.710]  Good job.
[28:49.720 --> 28:50.320]  All right.
[28:51.840 --> 28:52.580]  SD cards.
[28:52.820 --> 28:53.400]  CTF time.
[28:53.520 --> 28:53.640]  Okay.
[28:53.780 --> 28:58.620]  So, I want to play CTF with you guys and please line up at the microphone, I guess.
[28:59.600 --> 29:03.080]  What we're going to do is play the CTF and you'll see the rules.
[29:03.220 --> 29:06.580]  But I'm going to take suggestions from you guys on how we're going to win this CTF together.
[29:17.420 --> 29:18.380]  Also, I apologize.
[29:18.640 --> 29:18.900]  Oh, sorry.
[29:18.980 --> 29:19.220]  Hey, Paul.
[29:19.280 --> 29:19.920]  Can I get this mic too?
[29:20.100 --> 29:20.360]  Thanks.
[29:20.700 --> 29:21.140]  I apologize.
[29:21.440 --> 29:25.560]  I like never get this display thing right the first time with my Linux laptop.
[29:35.980 --> 29:36.600]  Did it mirror?
[29:36.740 --> 29:37.260]  It did not mirror.
[29:37.700 --> 29:37.840]  Shoot.
[30:00.530 --> 30:00.850]  Okay.
[30:03.670 --> 30:04.610]  I can't see.
[30:05.870 --> 30:06.350]  All right.
[30:06.550 --> 30:06.630]  Wait.
[30:06.990 --> 30:07.110]  No.
[30:07.910 --> 30:08.570]  Oh, shoot.
[30:08.670 --> 30:09.590]  That is not what I wanted.
[30:11.230 --> 30:11.590]  F*ck.
[30:16.630 --> 30:17.770]  Third time's a charm, maybe?
[30:26.020 --> 30:26.480]  All right.
[30:26.520 --> 30:27.120]  We'll do it live.
[30:27.880 --> 30:30.220]  I'm going to fly blind here, but this is the one that worked.
[30:30.400 --> 30:33.580]  So, I'm sorry for another terrible demo.
[30:39.070 --> 30:39.570]  All right.
[30:39.750 --> 30:40.770]  Can you guys...
[30:40.770 --> 30:41.090]  All right.
[30:41.110 --> 30:41.410]  There it is.
[30:41.570 --> 30:41.750]  Cool.
[30:42.370 --> 30:42.730]  Okay.
[30:43.210 --> 30:43.570]  Okay.
[30:44.730 --> 30:45.350]  All right.
[30:45.510 --> 30:49.090]  So, I have an SD card here.
[30:49.870 --> 30:55.150]  And the lock setting is set to unlock, so we can write to the device.
[31:01.660 --> 31:03.400]  And insert it into the laptop.
[31:07.720 --> 31:08.240]  Cool.
[31:08.520 --> 31:08.980]  All right.
[31:09.340 --> 31:10.160]  So, there it is.
[31:10.220 --> 31:10.840]  There's our device.
[31:11.260 --> 31:12.240]  Let's mount it.
[31:19.980 --> 31:20.500]  P1.
[31:23.340 --> 31:23.860]  Cool.
[31:24.520 --> 31:27.220]  So, we're at mount SD card.
[31:28.720 --> 31:29.280]  All right.
[31:29.460 --> 31:30.420]  Challenge dot text.
[31:36.340 --> 31:38.260]  The rules of this CTF challenge are easy.
[31:38.500 --> 31:40.260]  You must add your name to the end of this file.
[31:40.460 --> 31:45.920]  Once you've done that, ensure that the file is saved and synced and will survive being ejected and remounted.
[31:46.300 --> 31:49.360]  Note that your success must be validated before you may pass this on to another player.
[31:49.580 --> 31:50.220]  Enter your name below.
[31:50.720 --> 31:50.900]  All right.
[31:51.660 --> 31:52.380]  Seems easy.
[31:55.200 --> 31:56.020]  Do, do, do.
[31:56.380 --> 31:57.200]  My name's int 80.
[31:57.520 --> 31:58.540]  I'm the rapper in dual core.
[31:59.300 --> 32:01.160]  That's too long to type, so I just type int 80.
[32:02.080 --> 32:02.680]  Saved it, right?
[32:02.880 --> 32:03.360]  No complaints.
[32:03.600 --> 32:04.000]  Everything good.
[32:04.580 --> 32:05.520]  Let's look at it.
[32:05.720 --> 32:05.840]  Cool.
[32:05.960 --> 32:06.440]  There's my name.
[32:06.620 --> 32:06.980]  Int 80.
[32:07.140 --> 32:07.360]  We good.
[32:08.180 --> 32:08.440]  All right.
[32:08.740 --> 32:09.700]  So, let's...
[32:09.700 --> 32:10.720]  Normal process, right?
[32:10.900 --> 32:11.300]  You mount.
[32:13.620 --> 32:13.980]  Cool.
[32:14.240 --> 32:15.080]  No complaints there.
[32:16.120 --> 32:17.260]  Take the device out.
[32:20.590 --> 32:21.750]  Put it back in.
[32:25.280 --> 32:26.240]  There it is.
[32:29.190 --> 32:30.230]  It's mounted again.
[32:32.710 --> 32:33.670]  What do you guys think?
[32:33.850 --> 32:34.390]  Did we win?
[32:34.550 --> 32:36.050]  Did we keep our name there?
[32:38.970 --> 32:39.650]  Oh, no.
[32:39.970 --> 32:40.770]  My name's not there.
[32:41.270 --> 32:42.510]  But we didn't get any errors.
[32:43.170 --> 32:44.150]  What, what can we do?
[32:44.350 --> 32:44.830]  Ideas?
[32:45.010 --> 32:45.490]  Suggestions?
[32:45.490 --> 32:46.330]  Run sync.
[32:48.870 --> 32:50.870]  Your mount binary is pristine.
[32:51.190 --> 32:51.330]  Nice.
[32:51.530 --> 32:51.850]  I like that.
[32:52.590 --> 32:53.770]  Use the card!
[32:54.190 --> 32:54.790]  Use signal!
[33:00.370 --> 33:01.090]  I'm sorry?
[33:01.330 --> 33:02.970]  Reverse engineer your SD card.
[33:03.050 --> 33:03.250]  Yeah.
[33:03.810 --> 33:04.390]  We could do that.
[33:05.930 --> 33:08.690]  Get the SD card and put the correct file on it.
[33:09.070 --> 33:09.630]  Okay.
[33:10.030 --> 33:12.610]  So, write a new file onto the SD card?
[33:12.610 --> 33:14.450]  I was saying get a new SD card.
[33:14.550 --> 33:15.410]  Oh, get a new SD card.
[33:15.730 --> 33:16.910]  This is with this SD card.
[33:18.270 --> 33:18.630]  Okay.
[33:18.830 --> 33:20.910]  So, I heard sync in the crowd.
[33:21.070 --> 33:25.190]  And you mount will automatically run sync before it cleanly unmounts.
[33:25.290 --> 33:28.430]  So, sync has already been done behind the scenes.
[33:28.750 --> 33:29.270]  What else?
[33:29.570 --> 33:29.930]  Chatter.
[33:30.270 --> 33:30.630]  Chatter.
[33:30.750 --> 33:30.970]  Great.
[33:31.150 --> 33:31.290]  Yeah.
[33:31.350 --> 33:32.010]  Let's set the attributes.
[33:32.310 --> 33:32.470]  Okay.
[33:32.570 --> 33:32.670]  Cool.
[33:33.090 --> 33:33.810]  So, what do you guys want to do?
[33:33.910 --> 33:35.030]  Like, plus I, plus A?
[33:36.270 --> 33:36.810]  Plus I?
[33:36.930 --> 33:37.830]  It's immutable, right?
[33:38.290 --> 33:38.630]  All right.
[33:39.030 --> 33:39.510]  Let's...
[33:42.240 --> 33:42.940]  All right.
[33:43.240 --> 33:44.740]  So, add our name.
[33:46.340 --> 33:46.820]  Now.
[33:51.570 --> 33:52.050]  Cool.
[33:52.290 --> 33:53.070]  No complaints there.
[33:53.210 --> 33:53.470]  All right.
[33:53.670 --> 33:54.350]  No errors.
[33:56.370 --> 33:56.850]  Let's...
[33:56.850 --> 33:57.350]  What is it?
[33:57.390 --> 33:57.850]  LSatter?
[33:58.110 --> 33:58.750]  Is that right?
[34:02.770 --> 34:03.250]  Yep.
[34:03.490 --> 34:04.730]  There's the immutable bit, right?
[34:04.950 --> 34:06.130]  So, file's immutable.
[34:07.370 --> 34:08.890]  Let's make sure it's there.
[34:09.110 --> 34:10.050]  Just real quick.
[34:10.190 --> 34:10.450]  Okay, cool.
[34:10.690 --> 34:10.990]  Int 80.
[34:11.170 --> 34:11.770]  Still good.
[34:14.910 --> 34:15.390]  Okay.
[34:15.550 --> 34:16.270]  You mounted, right?
[34:16.270 --> 34:16.690]  So...
[34:16.690 --> 34:17.550]  Which does the sync.
[34:17.790 --> 34:18.670]  No complaints.
[34:18.770 --> 34:19.130]  No errors.
[34:20.830 --> 34:21.670]  Take it out.
[34:24.940 --> 34:26.100]  Put it back in.
[34:28.520 --> 34:29.120]  Hip...
[34:29.120 --> 34:30.460]  Hip-hop hooray.
[34:30.780 --> 34:31.240]  Ho.
[34:31.660 --> 34:32.260]  Hey.
[34:32.600 --> 34:33.200]  Ho.
[34:34.240 --> 34:35.460]  I like rap music.
[34:38.560 --> 34:39.420]  What'd I do?
[34:39.580 --> 34:39.900]  All right.
[34:40.280 --> 34:40.740]  Let's...
[34:40.740 --> 34:41.340]  Let's see if it's there.
[34:43.620 --> 34:44.200]  Oh, no.
[34:44.680 --> 34:45.720]  But we set the immutable bit.
[34:45.900 --> 34:46.840]  The file should be immutable.
[34:49.520 --> 34:49.920]  Any...
[34:49.920 --> 34:50.280]  Yeah.
[34:50.340 --> 34:51.060]  Let's see if it's still set.
[34:51.520 --> 34:51.760]  It's good.
[34:53.660 --> 34:54.060]  Nope.
[34:54.420 --> 34:54.560]  Hmm.
[34:55.200 --> 34:55.500]  Bummer.
[34:56.100 --> 35:00.220]  I didn't do any, like, magic where I, like, mysteriously unset it behind the scenes.
[35:01.780 --> 35:02.180]  Okay.
[35:02.380 --> 35:02.800]  What else?
[35:02.880 --> 35:03.380]  What else can we do?
[35:03.380 --> 35:06.060]  Is there a lock lock?
[35:06.620 --> 35:07.020]  Yes.
[35:07.520 --> 35:08.140]  Is it set?
[35:08.380 --> 35:08.780]  Yeah.
[35:08.920 --> 35:12.320]  The lock, the lock physical thing is, is actually, like, not set.
[35:12.420 --> 35:13.420]  Like, we can write to it.
[35:13.700 --> 35:16.520]  Is it, there's a software one in the firmware, though?
[35:16.720 --> 35:17.120]  Yes.
[35:17.600 --> 35:18.260]  Yes, there is.
[35:18.580 --> 35:20.560]  So, we have a, we have a winner.
[35:20.700 --> 35:21.540]  Winner, winner, chicken dinner.
[35:22.040 --> 35:27.740]  So, there's a, there's a tool called SDTool, which will allow locking and unlocking the SD card.
[35:27.740 --> 35:33.080]  So, what we can do is go to that directory.
[35:37.540 --> 35:38.380]  Don't look at that.
[35:40.200 --> 35:40.740]  All right.
[35:41.120 --> 35:42.480]  So, here's SDTool.
[35:43.000 --> 35:45.760]  And we can run SDTool, I think.
[35:46.180 --> 35:47.740]  Let me...
[35:49.420 --> 35:49.960]  Great.
[35:50.020 --> 35:50.880]  I didn't put that one in the notes.
[35:51.160 --> 35:52.400]  Let's, let's run help, see what happens.
[35:53.720 --> 35:55.120]  I think it's just over the MMC.
[35:55.240 --> 35:55.320]  Yeah.
[35:55.440 --> 35:55.740]  Okay, cool.
[35:56.560 --> 35:59.400]  So, we can get the status of the card.
[36:01.300 --> 36:01.700]  Oops.
[36:01.700 --> 36:02.560]  I did that backwards.
[36:08.550 --> 36:09.680]  And, let's see.
[36:09.960 --> 36:10.820]  Write protection temporary.
[36:12.050 --> 36:12.570]  Okay.
[36:12.860 --> 36:13.540]  So, let's unlock it.
[36:16.870 --> 36:17.390]  Cool.
[36:17.530 --> 36:18.370]  Write protection off.
[36:18.690 --> 36:20.130]  Do you think we can add our name now?
[36:20.450 --> 36:21.130]  Keep it?
[36:30.510 --> 36:31.030]  Cool.
[36:32.430 --> 36:32.830]  Yep.
[36:32.930 --> 36:33.370]  It's there.
[36:33.590 --> 36:33.870]  All right.
[36:35.030 --> 36:36.070]  Let's, you mount it.
[36:38.790 --> 36:39.970]  And take it out.
[36:48.470 --> 36:49.290]  It's back.
[36:57.710 --> 36:58.110]  Hey.
[36:59.190 --> 36:59.890]  We did it.
[37:03.780 --> 37:06.430]  So, again, shouts out to Craig Smith from Open Garages.
[37:06.660 --> 37:08.360]  He gave the car hacking talk on Friday.
[37:08.500 --> 37:11.450]  He was going to put me onto this and kind of got me down this path.
[37:11.450 --> 37:12.580]  And I thought it was really cool.
[37:14.080 --> 37:19.600]  And we'll talk about some applications of that once I switch back over to my other laptop with the goats.
[37:19.600 --> 37:19.840]  So, it's...
[37:20.500 --> 37:20.720]  Sure.
[37:23.070 --> 37:25.850]  Because, to the operating system, everything is fine.
[37:26.070 --> 37:26.150]  Right?
[37:26.270 --> 37:27.370]  Like, this code...
[37:27.370 --> 37:29.530]  This change is happening at the firmware of the SD card.
[37:29.770 --> 37:32.310]  So, as far as the OS knows, it's fine.
[37:32.510 --> 37:32.870]  Everything's...
[37:32.870 --> 37:33.550]  Everything's legit.
[37:37.080 --> 37:37.680]  All right.
[37:45.560 --> 37:46.020]  Oh, yeah.
[37:46.260 --> 37:48.300]  I put that as, like, don't go too far in the talk.
[37:50.580 --> 37:51.240]  It's that boy.
[37:51.600 --> 37:52.080]  Oh, shit.
[37:52.200 --> 37:52.420]  What up?
[37:53.240 --> 37:53.520]  Whoa!
[37:59.130 --> 37:59.490]  All right.
[37:59.610 --> 38:01.870]  So, we were able to use SD card to lock and unlock the device.
[38:01.870 --> 38:04.730]  And, again, the physical lock was disengaged, right?
[38:04.950 --> 38:06.390]  It's set to the right position.
[38:07.030 --> 38:09.430]  All this stuff, like, is happening in memory.
[38:09.430 --> 38:11.510]  So, it's more kind of memory anti-forensics.
[38:11.650 --> 38:13.510]  But everything looks legit, right?
[38:13.610 --> 38:16.970]  And the whole point is that you're basically failing to...
[38:17.410 --> 38:19.290]  Or preventing, like, evidence from being acquired.
[38:19.290 --> 38:21.930]  So, you're winning at the anti-forensics game.
[38:24.370 --> 38:26.150]  So, there are a couple caveats here.
[38:26.950 --> 38:31.950]  I have a separate laptop because you have to have a direct MMC device to interface with.
[38:32.150 --> 38:39.890]  If you plug up, like, a USB hub that's, like, one of those multi-readers that's got, like, compact flash and all that stuff, it actually shows up as, like, USB mass storage.
[38:40.030 --> 38:42.830]  And you can't interface the same way through the device.
[38:42.950 --> 38:46.410]  So, that's why I've got a second laptop because it has an actual SD card reader in it.
[38:47.070 --> 38:48.930]  And the code is for Linux.
[38:49.110 --> 38:50.170]  I haven't ported it to OS X.
[38:50.310 --> 38:53.030]  I didn't write it, but I also am not good at coding.
[38:54.390 --> 38:54.950]  So, yeah.
[38:55.930 --> 38:56.330]  Sometimes...
[38:57.550 --> 38:59.370]  Sometimes you just need extra hardware, I guess.
[39:03.920 --> 39:05.410]  I guess that's a troll on me.
[39:08.220 --> 39:08.620]  What?
[39:08.950 --> 39:09.580]  What's happening?
[39:09.820 --> 39:10.260]  Alright, cool.
[39:11.430 --> 39:11.800]  Alright.
[39:11.980 --> 39:14.800]  So, here are my ideas for scenarios of why this is neat.
[39:15.720 --> 39:16.520]  Applications, right?
[39:16.740 --> 39:19.240]  Hardware implant, just like I was talking about with the Android phones.
[39:19.450 --> 39:21.480]  Maybe you leave, like, a Pwn plug behind or something like that.
[39:21.760 --> 39:28.410]  Your Pwn plug has your malware on it, like, running in memory or something like that, but you place it there after you've shelled out and established your connection.
[39:28.410 --> 39:30.560]  So, everything's good.
[39:30.840 --> 39:35.140]  The malware can be, like, on disk, just like our challenge.txt file was edited on disk.
[39:35.240 --> 39:43.800]  But then, when, if you get caught by Blue Team or whatever, or law enforcement or whoever, they go to do forensic analysis of the device.
[39:44.000 --> 39:47.320]  They pull it out of the Pwn plug and pop it into their reader.
[39:47.960 --> 39:49.480]  All of the changes are gone, right?
[39:49.640 --> 39:52.620]  Just the core of your initial setup is there.
[39:52.960 --> 39:53.910]  So, it's kind of neat.
[39:54.060 --> 39:57.060]  Like, you're basically able to protect your malware from being acquired.
[39:58.280 --> 39:59.290]  Also, Portal of Pi.
[39:59.450 --> 40:01.270]  Have you guys ever, anybody used that at all?
[40:01.370 --> 40:02.930]  It's from the Grok and it's pretty cool.
[40:03.040 --> 40:04.200]  Basically, it's just a hardware device.
[40:04.830 --> 40:09.600]  You can also make regular portals out of, like, TP-Link routers, but everybody has a Raspberry Pi.
[40:09.600 --> 40:13.160]  So, he released this script for doing portable Pi stuff.
[40:15.000 --> 40:17.290]  Raspberry Pi is powered by an SD card, right?
[40:17.450 --> 40:18.060]  So, same thing.
[40:18.220 --> 40:20.520]  You lock the device for writes.
[40:20.720 --> 40:21.850]  Everything operates normally.
[40:21.850 --> 40:24.200]  It looks like, you know, all writes are happening fine.
[40:24.450 --> 40:25.500]  No errors, no complaints.
[40:25.620 --> 40:27.520]  The OS behaves perfectly as expected.
[40:27.720 --> 40:30.660]  Except when you go to, like, look at changes and they're all gone.
[40:30.960 --> 40:39.870]  And then, if you have, like, an operator device that you're using for hacking stuff, maybe you, like, run your OS and your attack VMs off of an SD card.
[40:40.600 --> 40:43.390]  Again, like, no writes happen to the SD card for permanence.
[40:43.740 --> 40:45.520]  Like, you lock it after you've done your initial setup.
[40:45.810 --> 40:49.220]  And so, anything that you're doing, any activity, doesn't get written to the card.
[40:49.430 --> 40:50.930]  And no logs, no crime.
[40:51.220 --> 40:51.740]  You've won.
[40:52.540 --> 40:53.870]  I still don't know what this...
[40:53.870 --> 40:54.540]  What is that?
[40:55.640 --> 40:56.390]  He's there!
[40:56.560 --> 40:57.000]  He's hiding!
[40:57.100 --> 40:58.310]  What kind of animal is this?
[41:03.510 --> 41:04.290]  Get up there!
[41:07.970 --> 41:08.710]  Oh, you.
[41:10.010 --> 41:10.410]  Laddergoat.
[41:10.590 --> 41:11.570]  You're so random.
[41:13.970 --> 41:14.770]  Oh, Laddergoat.
[41:15.650 --> 41:16.070]  All right.
[41:16.970 --> 41:19.250]  So, SDTool, it's open-source, online.
[41:20.030 --> 41:21.150]  That's the download.
[41:21.790 --> 41:22.590]  I modified...
[41:22.590 --> 41:26.110]  I couldn't get it to build using GCC, which is, like, the main compiler in the...
[41:26.110 --> 41:28.030]  or the default compiler in the make file.
[41:28.230 --> 41:31.250]  So, I just swapped it to Clang, and Clang built it, no problem.
[41:31.910 --> 41:32.850]  And then, this is the usage.
[41:32.990 --> 41:36.830]  You can do status to check whether it's locked or unlocked, and you can lock and unlock it.
[41:36.950 --> 41:37.470]  Pretty easy.
[41:37.470 --> 41:42.090]  So, hello from the other side.
[41:43.790 --> 41:47.070]  I must have called a thousand times.
[42:02.610 --> 42:04.570]  So, I guess we have some time for questions.
[42:05.030 --> 42:10.110]  I won't be answering any questions about goats, but anything else I'm happy to answer questions about.
[42:16.490 --> 42:17.330]  No questions?
[42:17.550 --> 42:17.810]  Awesome.
[42:18.090 --> 42:18.570]  Thank...
[42:18.570 --> 42:19.030]  Oh, yeah.
[42:19.130 --> 42:19.270]  Question.
[42:19.270 --> 42:19.510]  Yeah.
[42:21.370 --> 42:21.930]  Mike?
[42:22.270 --> 42:22.550]  Yes.
[42:22.750 --> 42:23.770]  Please step up to the mic.
[42:23.850 --> 42:23.990]  Sorry.
[42:24.410 --> 42:33.710]  So, that SDTool trick, I imagine those modifications are living in the kernel's buffer cache, the file system block cache.
[42:33.710 --> 42:50.030]  So, if you were to cause that to go out, because it's already synced it to disk, flushed it, and then if you read in a large file or replace some sys control things, I imagine then while it's still running, those changes would disappear then as the cache is reread from the disk,
[42:50.170 --> 42:51.610]  or the SD card probably.
[42:51.610 --> 42:52.950]  Yeah, I think you're right.
[42:53.110 --> 42:55.790]  I haven't tested that, but that sounds like it's probably accurate.
[42:56.830 --> 42:57.190]  Thanks.
[43:00.770 --> 43:10.690]  With the attack of erasing all the headers in memory, what's stopping someone who's a little better at volatility from just putting some placeholder headers back in?
[43:11.650 --> 43:14.870]  Yes, you could manually reconstruct the binary, right?
[43:14.950 --> 43:20.630]  If you had the time and the know-how to go through and say, like, this looks like the data section, this looks like the text section, right?
[43:20.630 --> 43:23.750]  You could, like, potentially reconstruct the header and rebuild it.
[43:24.310 --> 43:32.230]  My assertion is that most forensic analysts don't have either the resources to do that or the know-how, and so that's why I figure I'd probably win.
[43:32.450 --> 43:38.270]  You know, I'd love to see the WTF look on somebody's face if they were like, yeah, I dumped out this binary, wait, it's empty?
[43:38.390 --> 43:39.090]  Like, what's going on?
[43:39.210 --> 43:48.390]  So, yeah, you probably could manually go back through the image and, like, rebuild the header, but I just don't see it being, like, a reasonable vector for analysts.
[43:49.730 --> 43:53.530]  Because even without the header, you could probably disassemble the rest of it, right?
[43:53.730 --> 43:54.290]  Right, right.
[43:54.410 --> 43:55.970]  You could throw that file, like...
[43:55.970 --> 43:58.050]  So, not with the volatility one from Lime, but...
[43:58.050 --> 43:58.770]  Because it was empty, right?
[43:59.110 --> 43:59.270]  Yeah.
[43:59.650 --> 44:10.090]  But with the one from Recall, you could throw that into IDA, scroll down to be like, yeah, this looks like a stack frame, you know, epilogue or prologue, and then just start hitting C in IDA to, like, say, disassemble this as code.
[44:10.350 --> 44:12.030]  And then, right from there, you would start winning.
[44:12.150 --> 44:18.170]  But also, I'm working on the assertion that I don't know any forensic investigators that have IDA Pro or know how to use it.
[44:19.610 --> 44:20.510]  Oh, okay.
[44:20.790 --> 44:21.030]  Yeah.
[44:21.270 --> 44:21.550]  Thanks.
[44:22.870 --> 44:23.270]  Hi.
[44:23.370 --> 44:31.050]  With memory forensics being so used nowadays, do you see this technique as far as getting rid of the PE headers being used a lot in malware?
[44:31.050 --> 44:35.370]  I've actually never seen it in malware, except for my malware.
[44:35.950 --> 44:38.890]  But I haven't seen it in any other stuff in the wild.
[44:39.330 --> 44:40.850]  Why would you think it wouldn't be?
[44:41.050 --> 44:43.810]  I mean, is this just something you developed and no one else thought of it?
[44:44.210 --> 44:46.650]  I think it's just, like, operators don't care, right?
[44:46.810 --> 44:51.930]  Like, how many, like, of us hack stuff and have been arrested for it?
[44:52.030 --> 44:53.590]  Like, not me.
[44:53.850 --> 44:55.810]  So, it's just, like, cool.
[44:55.910 --> 45:01.850]  Like, if you get caught, your operational security is probably good enough that you don't actually get caught in person.
[45:02.730 --> 45:10.470]  And, I mean, I've seen tons of malware that just plainly beacons back to other C2s and those people, like, don't care.
[45:11.010 --> 45:12.770]  They're not doing anything to, like, obfuscate this.
[45:13.050 --> 45:15.530]  Like, you throw out an IDA and you're just like, yup, here's all the IOCs.
[45:15.610 --> 45:17.370]  Like, these are the IP addresses it talks to you.
[45:17.370 --> 45:18.210]  These are the domain names.
[45:18.270 --> 45:19.090]  These are the files it writes.
[45:19.350 --> 45:23.410]  I think operators are just bold and, you know, who cares if your malware gets caught?
[45:23.510 --> 45:27.250]  In my case, I care because I have to dev a whole new tool chain and I don't have time to do that.
[45:27.250 --> 45:31.470]  So, I try to keep my malware family alive as long as possible.
[45:31.830 --> 45:32.310]  Thank you.
[45:32.570 --> 45:32.950]  Yeah, thank you.
[45:35.170 --> 45:35.490]  Cool.
[45:35.690 --> 45:36.170]  Thanks, everybody.
[45:36.390 --> 45:37.130]  Drink all the booze.
[45:37.170 --> 45:37.690]  Hack all the things.
[45:37.830 --> 45:38.990]  Go pirate our music on the Internet.
[45:39.170 --> 45:40.250]  You can get it for free there, I heard.
[45:40.390 --> 45:40.970]  So, thanks.
[45:40.970 --> 45:41.030]  Thanks.
[45:41.510 --> 45:41.990]  Thanks, guys.