First real snow this season, here in the southern part of New England means that i’m sitting home, ready to write about some new tools in security :) So, armed with a cup of coffee, a keyboard, and hoping that the power wont go out… again… we have the making of a new article 
Before we start talking about memory tools, let me first, for those of you who are wondering what in the world would we need to do in memory, explain the point of the tools and a bit of history. We tend to believe that RAM is instant, that we can instantly write to it, that we can instantly erase it by turning off the power, and that somehow its a safe place to store things, because nobody can exploit it, right? Well it certainly looked that way to about the beginning of 2008, when a couple of guys, well, much more then a couple, more like a bunch, namely J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten of princeton university published a research paper that undermined most people’s understanding of RAM. They showed that memory did not momentarily loose it’s contents, but rather it degraded over a period of time, long enough to, if you were able to remove the memory from one machine, put it in another, reapply power and read the contents, infact the research shows that some types of memory retained information up to a couple of minutes. Well, so what do i get out of it you ask? They also showed that there are programs on most current-day operating systems that stored password hashes in ram, so with this, you opened a new way to get passwords, and not just any local passwords, on windows machines for example, you could get the hashes for AD authentication, rsa and aes hashes which can allow one to decrypt normally securely encrypted information and that, if you know what i mean, can be a BIG deal
Back to apples or oranges, whatever you prefer, oh wait, geeks, riight, back to coffee , there has been later research into this, and new attack vectors have sprung from this initial research, boot kits are prime examples of things that reside in memory and would be untraceable on systems by computer forensics experts of this day. If you aren’t familiar with boot kits, please refer to this excellent article. Normally to analyze how the security of a particular system was breached, the computer forensics experts will unplug the computer, take out the hard drive pit it in a little write-protection enclosure, take it back to their office and go and dissect the data, piece by piece, reviewing activities, logs, files, etc, etc. The problem with a boot kit is that if correctly implemented, it will leave no traces on the hard drive, it will be completely running in ram, and a couple of minutes after the system gets unplugged all of that data is gone, and on the herd drive side of it, it will look completely as though there was no intrusion to begin with. There are other exploits that get to memory directly, what if the exploit was transported via a firewire device that wrote the executable code right into memory, then the device was taken out and data was then slowly sent out to a third party server somewhere in another country where it was safely picked up later. Thus the process of identifying an intrusion and how to trace the data is all in ram, and moments after shutting off the machine, it is gone…
For those types of attacks, there are some new interesting Linux tools that became recently available. Unfortunately this is a new venue, and there hasn’t been enough time to develop analisys tools as of yet at least none are publically available yet, that i know of, but students at Princeton University have put out a couple of tools that are already a step in the right direction. They have released a memory imager, its a tool that runs on a tiny linux distro that is bootable either via USB or PXE, though the proces is slightly different (look at their documentation of the tools, its in the sources section at the end of the article), basically you would reset the machine, by either hitting the reset button, or unplugging and plugging the machine back in. Plugging in the USB stick, if you choose to use it, or if not, going into boot device options, and making the computer boot off of the method you chose to use to get the image of the system’s ram, boot the device. If you are using USB, the stick will automatically pull the contents of ram, pxe will not, you have to run a command on the server (in pxedump dir, there is a file called pxedump, you would run ./pxedump target_ip > mem.img). once the process is done (either method) the machine will be shut down or rebooted, depending if APM works correctly. If you used the USB stick you will still need to extract the memory dump. A tool that is provided with the usb bootable image, you can run it on the machine you will use to analyze the memory dump, to run it you need to be root, similarly you can use sudo: sudo ./usbdump {usb device such as /dev/sdc} > mem.img
From here you can use creative techniques to get data out of ram, for example you can use strings util to scan the image for words. Or you could use the aes and rsa extract utilities to extract keys out of the image. All those techniques are beyond this particular discussion, but they are described in the white paper that is available in the sources list. Also Not all memory can be dumped this way. Some machines that run ECC RAM will zero the RAM before booting, in those cases significantly lowering the temperature of ram, and moving it to a machine that does not wipe zero the RAM first would be the only way to retrieve the contents of such memory in this fashion… BTW the research showed that you didnt have to chill memory to liquid nitrogen temperatures, but cooling it with the contents of a CO2 can (flip it upside down), greatly prolonged the retaining of information in this, once-thought as, instant, memory…
Sources:
research: http://citp.princeton.edu/memory/
white paper: http://citp.princeton.edu/pub/coldboot.pdf
tools: http://citp.princeton.edu/memory/code
Also a recently published article in the Linux Journal, titled “Cold Boot Attack Tools for Linux” by Kyle Rankin
–
- Niksoft -
