Cold Boot Encryption Attack goes Open Source

If you've been reading along you'll be familiar with the cold boot/RAM harvesting encryption key attack that came to light a few weeks ago. Originally, researchers from Princeton posted a video highlighting their work in harvesting encryption key information from RAM. If you haven't been following along, take the time to watch the video and then read here and here for our write-up.

As predicted, a tool has been released into the wild to harvest RAM data from Microsoft Windows computers. The McGrew Security RAM Dumper is not a tool that is script-kiddie friendly, however with a little work and utilizing the instructions provided you too can grab the contents of RAM and run.

In the end, tools like this will become more readily available and used more often to expose what we would prefer to keep confidential. As the adage goes, "If the bad guys get their hands on your computer, it's not your computer any longer."

Forensic tools: WiebeTech HotPlug

Engadget has a short writeup of WiebeTech's HotPlug forensic system - in short, a tool for moving powered on systems, either by powering their power strip, or for injecting power into their power cord or outlet.

If you're doing police forensics, this looks like a tool to investigate!

SSL testing: Foundstone's SSLDigger

If you're required to be PCI-DSS compliant, or you just want to check the SSL settings for your site, Foundstone provides a great free tool: SSLDigger. It checks certificate details, encryption and cipher settings, and is generally a good way to double check your SSL setup. Note that it does require the .NET package to be installed first.

Security tools: BartPE - Bootable Windows on a CD

I'm attending offsite training this week, and the class is full of a lot of people who do security work for their organizations. A frequent topic is how their organization do things, and what they use to do their jobs.

I was startled to learn that some of my classmates had never heard of BartPE, which is a tool that any security staffer who works with Windows systems or needs a bootable Windows toolkit should have.

What is BartPE? Is it a "Preinstalled Environment" - which doesn't tell you much up front. In short, it is a Windows environment (XP or 2003) packaged to run from a CD, much like a Knoppix live CD. It has a wide variety of plugins that are ready to go, or which can be easily added if you have appropriate licenses or downloaded free software, and you can add tools of your own quite easily. The advantages of this including the ability to run Windows native programs without touching the host system's filesystem, native NTFS support, and familiar Windows tools will be obvious to anybody who needs to work with Windows systems, either for recovery, repair, or on-host forensic or incident response work. This is also a useful way to boot Windows on non-Windows systems if you are traveling and need a Windows system on the go, but don't have to have a fully installed system, or have only non-Windows x86 systems handy.

This is one of the tools that is usable in its basic form (which does require a local build and setup), but which can be a much more powerful tool with some work. Put this one in the list of tools that are worth your time and effort to learn and build before an incident.

An Inexpensive Forensic toolkit

What should you have in a basic homebuilt forensic toolkit? What can you do without specialized tools? We'll cover what you should have in a portable IR forensic toolkit if you're on a tight budget, with an emphasis on freebies and using inexpensive commodity tools and software. In our next article, we'll talk about what a well equipped forensic toolkit might contain if you aren't budget constrained.

A full kit composed only of commodity items many systems administrators have at hand:

• Screwdrivers (Phillips at the very least)
• USB 2.0/Firewire drive enclosure or a USB 2.0 -> IDE bridge device and 12v molex power adapter. Remember to check that your enclosure works with your Linux LiveCD.
  
• SATA->IDE Adapter OR USB 2.0/Firewire -> SATA enclosure - having the adapter is lighter than carrying two enclosures.
  
• 2.5" -> 3.5" laptop hard drive adapter
• Spare hard drive jumpers
• Known good ATA and SATA cables - in my experience, problem ATA cables are one of the most annoying issues when imaging drives.
  
• A capacious thumbdrive - a 1 GB drive is a good start, and one with write block switch is a good idea.
• A portable external USB/Firewire hard drive - larger is better - try to have at least the maximum size drive that your environment has deployed for a single desktop or server. You can cheat a bit and carry just one enclosure and a drive to put in it if you are attempting to travel light and don't anticipate needing to copy from a drive in the enclosure while you're using the big drive.
  
• IR and forensic LiveCDs.
• A notebook and pens - do not use pencil!
• A laptop with supported chipsets for your forensic CD of choice for USB/Firewire, NIC, and other critical hardware.
• A crossover network cable, in case you need to connect your laptop to the system you're imaging. If you don't have a crossover cable handy, a pocket hub or switch and some standard ethernet cables will work nicely.
  
• Anti-static bags for transporting drives. I like to carry the plastic clamshells that drives ship in to put drives in when I have to take them with me.
  
• Stick on labels to label drives and devices - something that will stay on, but peels off easily.
• A black fine tip permanent market for labeling devices
• Blank CDs and DVDs
• An extension cord and/or power strip with a long cord
  
• Business cards to leave so that you can be contacted
  

Total toolkit cost should be <$300 excluding the laptop, even if you have to buy all of this new. This toolkit provides the hardware you need to get a system open and to pull most commodity drives, and to walk away with a good image. If you're just doing forensics as part of an incident response investigation, and don't have to maintain evidenciary standards, this will get you where you need to go in most cases. This is also the sort of toolkit that many administrators could scrape together on short notice out of their standard administrator's toolkit, meaning that the tools you need are likely already at hand. In addition:

• If you frequently work with SCSI, you should have SCSI adapters - a SCA -> 68 pin adapter, a HD50 -> 68 pin adapter, and spare terminators. You'll also need a SCSI card or SCSI adapter. Sadly, I haven't run into a quality USB 2.0 -> SCSI bridge device yet.
  

What you don't have in this kit:

• Commercial analysis software like FTK or Encase
• A commercial disk duplicator with MD5 sum capabilities.
  
• Write blockers (although these can be had for less than $200 now)
  
• Large scale long term mass storage

We'll discuss a pro level forensic kit next time! Don't forget to check out our earlier posts on digital forensics tips.