1

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The catch is that our solution has to be stealthy and undetected by the kernel, so no DMA, drivers or anything that invokes traditional system calls/routines. Anything that leverages the kernel can be detected by the kernel.

Assume the system in question is infected by a rootkit. Assume the rootkit is employing everything specified here and more unknown anti-debug routines: https://github.com/LordNoteworthy/al-khaser So all the traditional windows routines, (like ObRegisterCallbacks) are hooked.

Is there a digital forensic device for this use case? In so far as I can tell the conventional means of volatile memory collection for forensic purposes can be detected (scraping/dumping).

Note1: There is a "magic" number associated with the bytes surrounding the key, so we don't have to worry about being overwhelmed by heaps of data, we can filter for those magic bytes.

Note2: We can in theory configure this to use non volatile memory for RAM... then shutoff the computer while the key is in there. However, the key is only good as long as the process remains open. It is random gen, key cannot be cracked. This is also somewhat of a side-channel attack question I suppose. Reading cache I would assume be out of the question since its usually embedded on the cpu or motherboard.

Note3: Running this in a hypervisor might be the call. But there still exists the extra hurdles of avoiding detection of sandboxing. Would rather use a solution that avoids virtualization.

Note4: I originally asked this in EE section about using some type of logic analyzer to read the key as it was coming over the PCI-e bus, but that would disrupt some of the data coming over (resistance and properties of impedance would be disrupted).

  • I might not fully understand your question, but to Note 2, can you do a standard memory dump when the key is in RAM or try a Meltdown or Spectre attack on the host? – J9Fackque Dec 2 '19 at 3:14
  • The conventional memory dumper usually involves using a program like dumpIt... which is basically a combination of standard windows (microsoft) tools to dump RAM. win32dd and win64dd. These RAM scrapers would run while the system is online and unfortunately be detected. – Benjamin Martin Dec 2 '19 at 3:28
  • I could avoid that completely, and go with a standard cold boot attack, but the keys would no longer be good once the machine is turned off en.wikipedia.org/wiki/Cold_boot_attack Spectre/Meltdown style attack would be great, its the kind of side channel attack we're looking for. That said, it would require work with unpatched versions of windows which is not what I am working on :/ – Benjamin Martin Dec 2 '19 at 3:33
  • I was not aware that there was a real patch for Spectre already. That definitely changes things... I'm sorry. I wish I could be of more help, but that's where my useful knowledge ends. – J9Fackque Dec 2 '19 at 3:40
  • No worries. This type of discussion is encouraged and appreciate the help. I can't say for sure if there is a "real" patch. I just go by microsoft's word (no pun intended) – Benjamin Martin Dec 2 '19 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.