4 ms·
Probably just a USB stick with Second Look or a similar tool on it. Very first thing you do is dump the running memory on the system. Then you pull the drives,
by dsl 12y ago
Probably just a USB stick with Second Look or a similar tool on it. Very first thing you do is dump the running memory on the system. Then you pull the drives, plug them into a write blocker, then image the drives.
Modifying anything before you have a complete forensic dump is a big no-no because you need to preserve evidence.
- xorcist 12y agoCan you explain more? How do go about dumping memory?
- dsl 12y agoThis is a good intro to the subject http://www.forensicswiki.org/wiki/Memory_Imaging http://www.forensicswiki.org/wiki/Memory_Imaging Law enforcement also has additional undisclosed methods to avoid detection by systems.
- psykovsky 12y agoUndisclosed even to courts? How do courts know such forensic methods are done according to the law if they're undisclosed?
- adrianpike 12y agoThe specific tool they were mentioning is: https://secondlookforensics.com/ https://secondlookforensics.com/ Interestingly enough, look who makes it.
- grrowl 12y agoSpoiler/save-the-click: "© 2014 Raytheon Cyber Products. All rights reserved. Second Look® is a registered trademark of Raytheon." > The Raytheon Company is a major American defense contractor and industrial corporation with core manufacturing concentrations in weapons and military and commercial electronics.
- xorcist 12y agoI understand that as I googled it before asking the question. It's advertised as a tool to analyze memory dump, not to take them, but I have no doubts they sell tools for that as well. If you know how they work, please tell.
- Havoc 12y agoSeeing how this is a targeted attack on an exit node specifically they're not going to be interested in dumping whats on the system for evidence. Even an idiot will know that someone running a TOR exit node isn't going to be a big fan of logging traffic in detail. Has to be an attempt to keep the node running but in a compromised state...
- jumanji 12y agoWhen you are going to take control over a machine you have physical access to while it is running, you should always dump memory because it might, among other things, contain disc encryption keys.
- cesarb 12y agoI'm trying to understand that too. A Linux server (I'm guessing for no particular reason it's a Linux server) would have no reason to automount a USB stick, and its console would be at a login screen (so a HID device would gain nothing). So my guess for the intrusion scenario would be a "cold boot" attack: plug a specially prepared USB stick, open the server case, short the reset pins in the motherboard (AFAIK, modern motherboards still have the pins for the reset button, even though modern cases don't have a reset button anymore), and tell the BIOS to boot from the USB stick. The USB stick then dumps the memory, which still has data from the previously running system (since it was an unclean shutdown), with some luck including cryptographic keys. That scenario would also explain why he briefly saw the server back on the KVM: they might have been using the KVM to interact with the BIOS. The defense against such a scenario would be to aggressively shut down all processes and kexec to a memory-wiping kernel as soon as any unexpected device (not only USB, but also PCI and others) is seen, or if the case is opened. Also make it send an alert message through the network with the details whenever it's triggered, to be able to diagnose why the server shut down without warning. But there's another possible scenario: the "bureaucratic confusion" scenario. It's possible that the systems at his hosting location got confused, and thought he was no longer a client. The apparent intrusion would be a techie repurposing the servers for another client.