On Challenges in Verifying Trusted Executable Files in Memory Forensics

Uroz, D. (Universidad de Zaragoza) ; Rodriguez, R.J. (Universidad de Zaragoza)

Resumen: Memory forensics is a fundamental step in any security incident response process, especially in computer systems where malware may be present. Thememory of the system is acquired and then analyzed, looking for facts about the security incident. To remain stealthy and undetected in computer systems, malware are abusing the code signing technology, which helps to establish trust in computer software. Intuitively, a memory forensic analyst can think of code signing as a preliminary step to prioritize the list of processes to analyze. However, amemory dump does not contain an exact copy of an executable file (the file as stored in disk) and thus code signing may be useless in this context. In this paper, we investigate the limitations that memory forensics imposes to the digital signature verification process of Windows PE signed files obtained from a memory dump. These limitations are data incompleteness, data changes caused by relocation, catalog-signed files, and executable file and process inconsistencies. We also discuss solutions to these limitations. Moreover, we have developed a Volatility plugin named sigcheck that recovers executable files from a memory dump and computes its digital signature (if feasible). We tested it on Windows 7 x86 and x64 memory dumps. Our experiments showed that the success rate is low, especially when the memory is acquired from a system that has been running for a long time.

Idioma: Inglés

DOI: 10.1016/j.fsidi.2020.300917

Año: 2020

Publicado en: Forensic science international. Digital investigation 32, S (2020), 300917 [10 pp]
ISSN: 2666-2825

Factor impacto JCR: 0.0 (2020)

Categ. JCR: COMPUTER SCIENCE, INTERDISCIPLINARY APPLICATIONS
Categ. JCR: COMPUTER SCIENCE, INFORMATION SYSTEMS

Financiación: info:eu-repo/grantAgreement/ES/DGA/T21-17R-DISCO
Financiación: info:eu-repo/grantAgreement/ES/MICIU/Medrese-RTI2018-098543-B-I00

Tipo y forma: Artículo (Versión definitiva)

Área (Departamento): Área Lenguajes y Sistemas Inf. (Dpto. Informát.Ingenie.Sistms.)