EDITOR'S PICK
  • CYBER BULLYING AND CHILD SAFETY
  • A GUIDE TO DARK WEB
  • GUIDE TO NETWORK SECURITY
  • CONTACT US
CONTACT US
Security Land
  • HOME
  • NEWS
    News

    Combatting Cyber Crime: FBI Columbia Leads Multi-Agency Training Course to Enhance Investigation Techniques

    Security Land Security Land January 26, 2023
    News

    Gen Z’s Lack of Cybersecurity Knowledge Puts Small Businesses at Risk

    Security Land January 25, 2023
    News

    Experts Predict Consequential Year for Cybersecurity in 2023

    Security Land January 19, 2023
  • DATA BREACHES
    Data Breaches

    India’s Education Ministry Data Breach Exposes Millions of Student and Teacher Records on Unsecured Server

    A security lapse in India's Education Ministry's Digital Infrastructure for Knowledge Sharing…

    Security Land Security Land January 26, 2023
    Data Breaches
    Riot Games Suffers Social Engineering Attack
    DevOps
    Data Breaches
    CircleCI Reveals Malware Attack as the Cause of Recent Security Breach, Advises Developers to Rotate Secrets and API Tokens
    Data Breach - Security Land
    Data BreachesEditors Pick
    What You Should Know About Data Breaches
    indian bank data breach
    Data Breaches
    Indian Bank Exposed Millions of Records Online
  • EDUCATION
    Education

    Protecting Your Business: The Importance of Web Application Security

    Sponsored by IntelSenseIntelSense
    Editors PickEducation

    Incident Response Guide for Small Businesses

    Sponsored by IntelSenseIntelSense
    Education

    Protecting Patient Data: The Importance of Cybersecurity in Healthcare

    Sponsored by IntelSenseIntelSense
  • MORE
    • Customize Interests
    • Contact Us
  • BOOKMARKS
Reading: Exploiting Advanced Volatile Memory Analysis Challenges for Fun and Profit
Share
Security Land
Aa
  • HOME
  • NEWS
  • DATA BREACHES
  • EDUCATION
  • MORE
  • BOOKMARKS
Search
  • HOME
  • NEWS
  • DATA BREACHES
  • EDUCATION
  • MORE
    • Customize Interests
    • Contact Us
  • BOOKMARKS
Have an existing account? Sign In
Follow US
© Copyright 2023 | Security Land from IntelSense.
Security Land > Video Area > Exploiting Advanced Volatile Memory Analysis Challenges for Fun and Profit
Video Area

Exploiting Advanced Volatile Memory Analysis Challenges for Fun and Profit

Security Land
Last updated: 2023/01/17 at 12:23 AM
Security Land
Share
3 Min Read
SHARE

Malware continues to advance in sophistication and prevalence. Well-engineered malware can obfuscate itself from the user, network, and even the operating system running host-based security applications.

But one place malware cannot easily hide itself is within volatile computer memory (RAM). Many problems and inefficiencies exist with our current approach of conducting memory analysis: it takes too much time, is very labor intensive, and artifact extraction comes with a deluge of raw data that is not practical to analyze on real-world computer systems compromised with malware.

These inefficiencies ultimately result in greater time and resource expenditure to conduct the analysis while impairing accuracy of results since it is too easy to miss a key artifact from the overload of data during the analysis. I have seen many people struggle with capture the flag memory challenges as well due to these same issues.

I have solved this problem by engineering a new construct for memory analysis along with a new tool release to provide an automated process for advanced memory analysis, correlation, and user-interaction that increases investigation accuracy, reduces analysis workload, and better detects obfuscated malware.

This talk is especially perfect if you have conducted memory analysis before and understand the pain and difficulty with completing this type of investigation. During this session, I will provide many new features that optimize memory analysis to include a new, revolutionary interactive construct that provides a visual representation of artifacts and indicators extracted from memory.

We will also cover a new data cross-reference (data xref) ability I built into the open-source tool (Xavier Memory Analysis Framework) that creates a new index and memory context feature to view how your keyword data is coupled with processes, modules, and events captured in memory.

This data xref feature also allows you immediately pivot to create specific process-memory dumps and file extraction directly from each keyword entered by the user. Finally, a new concept called a System Manifest is delivered by this research.

The System Manifest is a single file detailing significant artifacts (and their relationships) distilled from a memory image. This manifest allows Xavier to immediately reload the full memory image context in seconds versus hours to without this tool. The most beneficial feature about the manifest file creation is the new ability to create and analyze memory snapshots.

This uniquely provides a new light-weight yet very powerful and precise memory analysis capability to automatically detect system changes captured in memory from malware execution especially useful for exploit dev and malware analysis and software reverse engineering!

This talk is full of live-demos as we will take a real-world capture the flag memory analysis engagement, and demonstrate how the Xavier Construct optimizes memory analysis.

You Might Also Like

Cloud Scanning For Vulnerability Discovery

An In-Depth Guide to Network Security

OverRide: Reverse-Engineering and Binary Exploitation Tool

Introduction to Docker and Security

Bypassing NGAV by Shai Meir and Ishai Rosenberg

TAGGED: exploit, memory analysis
SOURCES: Solomon Sonya / SANS
Share this Article
Facebook Twitter Whatsapp Whatsapp LinkedIn Reddit Email Print
By Security Land
Follow:
Hello. I am Bot created by SL Team.
Leave a comment Leave a comment

Leave a Reply Cancel reply

You must be logged in to post a comment.

Watch Now

- Advertisement -
Ad imageAd image

Trending Stories

News

Gen Z’s Lack of Cybersecurity Knowledge Puts Small Businesses at Risk

January 25, 2023

New Multi-Factor Authentication Bypass

August 15, 2018
Mobile

NoRoot – Free Android Firewall

April 25, 2019

After DDoS Attacks Intel Techniques Removed OSINT Tools

June 10, 2019

Czech security experts warns Huawei products pose security threat

March 30, 2019

Microsoft Zero-Day RCE Bug

June 2, 2018

Always Stay Up to Date

Subscribe to our newsletter to get our newest articles instantly!

I have read and agree to the terms & conditions

Follow US on Social Media

Linkedin Twitter Facebook Instagram Youtube

© Copyright 2023 | Security Land from IntelSense.

Security Land

More from Security Land

  • About Us
  • Privacy Policy
  • Advertise
  • Contact Us
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Do not sell my personal information.
Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
SAVE & ACCEPT
physical security
Join Us!

Subscribe to our newsletter and never miss our latest news, podcasts etc.

I have read and agree to the terms & conditions
Zero spam, Unsubscribe at any time.

Removed from reading list

Undo
Welcome Back!

Sign in to your account

Lost your password?