Search

Memory dumps that are acquired while the system is running often contain inconsistencies like page smearing which hamper the analysis. One possibility to avoid inconsistencies is to pause the system during the acquisition and take an instantaneous memory dump. While this is possible for virtual machines, most systems cannot be frozen and thus the ideal dump can only be quasi-instantaneous, i.e., consistent despite the system running. In this article, we introduce a method allowing us to measure quasi-instantaneous consistency and show both, theoretically, and practically, that our method is valid but that in reality, dumps can be but usually are not quasi-instantaneously consistent. For the assessment, we run a pivot program enabling the evaluation of quasi-instantaneous consistency for its heap and allowing us to pinpoint where exactly inconsistencies occurred., Comment: In: Proceedings of the Digital Forensics Research Conference USA (DFRWS USA). 2023

The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for “forensically sound” acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.

Having spent two successive years running online to prevent the spread of the Corona virus, the traditional annual meeting of the German Research Training Groups (RTGs) funded by the Deutsche Forschungsgemeinschaft (DFG) in the field of computer science returns to Schloss Dagstuhl --– Leibniz Center for Informatics, one of the world's premier venues for computer science-related seminars. Returning to Dagstuhl and hosting this meeting as an in-person-only event was a deliberate decision to revive interaction modes that many of the funded researchers had yet to experience: fostering personal interchange of ideas and experiences in order to strengthen the connection within the German computer science community. This volume documents the abstracts of the research topics of funded researchers in the participating RTGs. The event was jointly organized by RTG 2475 (Cybercrime and Forensic Computing) and RTG 2428 (ConVeY --- Continuous Verification of Cyber-Physical Systems). It took place between Sunday, June 12 and Wednesday, June 15, 2022, as in-person only Dagstuhl Event 22243. The meeting featured the usual sequence of research presentations by funded researchers, networking meetings for PIs and RTG coordinators, as well as two invited talks, one by Professor Martina Seidl (JKU Linz, Austria) on ``Competitions as Scientific Method'' and another by Professor Jennifer Byrne (School of Medical Sciences, The University of Sydney, Australia) titled ``An introduction to research paper mills''. Because last year's event marked the 25th anniversary of the workshop series, it featured a live interview with Professor Otto Spaniol who had initiated the workshop series in 1996. We document the interview in this volume.

Invasive computing is a paradigm for designing and programming future parallel computing systems. For systems with 1,000 or more cores on a chip, resource-aware programming is of utmost importance to obtain high utilisation as well as computational, energy and power efficiency. Invasive computing provides a programmer explicit handles to specify and argue about resource requirements desired or required in different phases of execution: In an invade phase, an application asks the operating system to allocate a set of processor, memory and communication resources to be claimed. In a subsequent infect phase, the parallel workload is spread and executed on the obtained claim of resources. Finally, if the degree of parallelism should be lower again, a retreat operation frees the claim again, and the application resumes a sequential execution. To support this idea of self-adaptive and resource-aware programming, not only new programming concepts, languages, compilers, and operating systems were needed to be developed, but also revolutionary architectural changes in the design of MPSoCs (multiprocessor systems-on-a-chip) to efficiently support invasion, infection, and retreat operations. This book gives a comprehensive overview of all aspects of invasive computing., Invasives Rechnen ist ein Paradigma für den Entwurf und die Programmierung zukünftiger paralleler Rechensysteme. Für Systeme mit 1.000 oder mehr Kernen auf einem Chip ist eine ressourcengewahre Programmierung von größter Bedeutung, um eine hohe Auslastung sowie Rechen-, Energie- und Leistungseffizienz zu erreichen. Invasives Rechnen bietet dem Programmierer bzw. der Programmiererin explizite Möglichkeiten, die in verschiedenen Phasen der Ausführung gewünschten oder erforderlichen Ressourcenanforderungen zu spezifizieren: In einer Invasionsphase fordert eine Anwendung vom Betriebssystem eine Reihe gewünschter Prozessor-, Speicher- und Kommunikationsressourcen an. In einer anschließenden Infektionsphase wird die parallele Arbeitslast auf die bereitgestellten Ressourcen verteilt und ausgeführt. Nimmt der Grad der Parallelität während der Programmausführung ab, können die allozierten Ressourcen durch eine Rückzugsoperation wieder freigegeben werden, und die Anwendung wird wieder sequenziell ausgeführt. Um diese Idee der selbstadaptiven und ressourcengewahren Programmierung zu realisieren, mussten nicht nur neue Programmierkonzepte, Sprachen, Compiler und Betriebssysteme entwickelt werden, sondern auch revolutionäre architektonische Änderungen im Entwurf von MPSoCs (Multiprozessorsystemen auf einem Chip), um Invasions-, Infektions- und Rückzugsoperationen effizient zu unterstützen. Dieses Buch gibt einen umfassenden Überblick über alle Aspekte des invasiven Rechnens.

Sandboxes are an indispensable tool in dynamic malware analysis today. However, modern malware often employs sandbox-detection methods to exhibit non-malicious behavior within sandboxes and therefore evade automatic analysis. One category of sandbox-detection techniques are reverse Turing tests (RTTs) to determine the presence of a human operator. In order to pass these RTTs, we propose a novel approach which builds upon virtual machine introspection (VMI) to automatically reconstruct the graphical user interface, determine clickable buttons and inject human interface device events via direct control of virtualized human interface devices in a stealthy way. We extend the VMI-based open-source sandbox DRAKVUF with our approach and show that it successfully passes RTTs commonly employed by malware in the wild to detect sandboxes

Due to their ease of use and their reliability, managed storage services "in the cloud" have become a standard way to store personal files for many users. In fact, many apps on mobile devices use local storage on the client merely as a cache for data that is fully stored on a remote server. Consequently, data from cloud storage services is an increasingly valuable source of digital evidence in forensic investigations. This document presents the results of a student project that was performed at Friedrich-Alexander-Universität Erlangen-Nürnberg in the winter term 2021/22. Six groups of students analyzed the most relevant network storage technologies (Samba, Nextcloud, Dropbox, Google Drive, OneDrive, iCloud) regarding two questions: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition in any way? The two questions refer to critical aspects of forensic evidence collection, namely in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. In the concluding discussion we compare the different technologies and develop a taxonomy of storage services that can be used to assess other cloud storage services with regarding the evidental value of data acquired from them., Technical reports / Department Informatik; CS-2022-01

Log files provide essential information regarding the actions of processes in critical computer systems. If an attacker modifies log entries, critical digital evidence is lost. Therefore, many algorithms for secure logging have been devised, each achieving different security goals under different assumptions. We analyze these algorithms and identify their essential security features. Within a common system and attacker model, we integrate these algorithms into a single (parameterizable) “meta” algorithm called LAVA that possesses the union of the security features and can be parameterized to yield the set of former algorithms (and many more). Apart from giving insight into general structures of secure logging protocols, we present an abstract efficiency analysis and practical performance measurements of LAVA showing its usefulness., Technical reports / Department Informatik, CS-2019-01

The analysis of various log files is an integral part of digital forensic investigations. Despite their different file formats and due to their common purpose, log files generally contain similar structures. Based on the analysis of three common log file types (syslog, windows event log and SQLite browser histories), we present a simple yet precise unified representation of log files that allows to analyze such files independently of their format. We exemplify the usefulness of our representation using two case studies: Firstly, we show how our representation allows to express consistency criteria used for the identification of (ab)normal events in first-order logic. Secondly, we show how—based on this unified representation—visualization of log files can be used to find evidence or to test hypotheses. For showing the latter, we have implemented a simple log file visualization tool (SLogViz) and apply it to identify evidence of a system time manipulation., Technical reports / Department Informatik, CS-2019-02

We present DiOS, a practical system to perform automated dynamic privacy analysis of iOS apps. DiOS provides a highly scalable and fully automated solution to schedule apps from the official Apple App Store for privacy analysis to iOS devices. While apps are automatically executed, user interaction is simulated using random and smart execution strategies, and sensitive API calls as well as network connections are tracked. We evaluated the system on 1,136 of the most popular free apps from the iOS App Store and found out that almost 20% of all investigated apps are tracking users' locations on every app start, one third of all accesses to users' address books are attributed to apps from the social network category and almost half of all apps are tracking users' app usage behavior by incorporating tracking and advertising libraries.

This paper draws a comparison of fundamental theories in traditional forensic science and the state of the art in current computer forensics, thereby identifying a certain disproportion between the perception of central aspects in common theory and the digital forensics reality. We propose a separation of what is currently demanded of practitioners in digital forensics into a rigorous scientific part on the one hand, and a more general methodology of searching and seizing digital evidence and conducting digital investigations on the other. We thereby mark out the route for computer forensics to turn into a true forensic science. To illustrate the feasibility of the proposed path, we supply a couple of practical examples, as well as a list of exemplary questions that should be answered by digital forensic scientists.

Passwords have to be secure and usable at the same time, a trade-off that is long known. There are many approaches to avoid this trade-off, e.g., to advice users on generating strong passwords and to reject user passwords that are weak. The same usability/security trade-off arises in scenarios where passwords are generated by machines but exchanged by humans, as is the case in pre-shared key (PSK) authentication. We investigate this trade-off by analyzing the PSK authentication method used by Apple iOS to set up a secure WPA2 connection when using an iPhone as a Wi-Fi mobile hotspot. We show that Apple iOS generates weak default passwords which makes the mobile hotspot feature of Apple iOS susceptible to brute force attacks on the WPA2 handshake. More precisely, we observed that the generation of default passwords is based on a word list, of which only 1.842 entries are taken into consideration. In addition, the process of selecting words from that word list is not random at all, resulting in a skewed frequency distribution and the possibility to compromise a hotspot connection in less than 50 seconds. Spot tests show that other mobile platforms are also affected by similar problems. We conclude that more care should be taken to create secure passwords even in PSK scenarios.