Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Cloud Forensics - Bsides Colombia 2015
Search
ShieldNow
September 05, 2015
Technology
0
520
Cloud Forensics - Bsides Colombia 2015
ShieldNow
September 05, 2015
Tweet
Share
More Decks by ShieldNow
See All by ShieldNow
GPG
shieldnow
0
570
Guía TCPDump
shieldnow
0
560
Netcat
shieldnow
0
510
Other Decks in Technology
See All in Technology
TypescriptでのContextualな構造化ロギングと社内全体への導入
leveragestech
3
580
シンプルなHITL機械学習と様々なタスクにおけるHITL機械学習
naohachi89
0
310
Laboratories in Science and Technology: Deep Neural Networks
keio_smilab
PRO
3
100
.NET GraphQL Client のリアル
sansantech
PRO
1
220
YJIT Makes Rails 1.7x faster / RubyKaigi 2024
k0kubun
3
440
エムスリーQAチーム紹介資料 / Introduction of M3 QA Team
m3_engineering
1
320
エムスリーマルチデバイスチーム紹介資料 / Introduction of M3 Multi Device Team
m3_engineering
1
150
生成AIと産業向けソフトウェアの自動生成 〜 ハノーバーメッセ2024より〜
kioto
2
420
AI JIMY - 登壇(インストール編)
hanacchi
0
150
【リラン】AIの光と闇?失敗しないために知っておきたいAIリスクとその対応 ①政府の動き編
tkhresk
0
140
QAエンジニアが伝えたい品質保証の羅針盤 / Compass for Quality Assurance
mii3king
1
330
Password cracking: past, present, future
openwall
0
250
Featured
See All Featured
Stop Working from a Prison Cell
hatefulcrawdad
266
19k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
41
4.5k
Building Applications with DynamoDB
mza
88
5.7k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
26
2.3k
Done Done
chrislema
178
15k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
34
8.9k
What the flash - Photography Introduction
edds
64
11k
jQuery: Nuts, Bolts and Bling
dougneiner
60
7.2k
Optimising Largest Contentful Paint
csswizardry
13
2.4k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
20
1.8k
Making the Leap to Tech Lead
cromwellryan
125
8.6k
A Tale of Four Properties
chriscoyier
153
22k
Transcript
Open Source Cloud Forensics B-Sides | Septiembre 2015
Methodology Collection Examination Analysis Reporting
Problem 1 • Physical Access • Host Contamination • Response
Time • Technical Expertise
Problem 2 • Size of Resources • Chain of custody
• Tools • Technical Expertise
Problem 3 Rackspace • Where is the data stored? •
Acquisition - Size of Resources • Chain of custody? • Live Forensics? • Legal Considerations?
Traditional Way Snapshot of VM Snapshot of storage volumes http://blogs.msdn.com/b/azuresecurity/archive/2015/08/14/azure-forensics-for-the-security-responder-how-i-learned-to-stop-worrying-and-love-the-cloud.aspx
Puppet The Master
The Master /etc/puppet/manifests/site.pp
The Master allowscp chrootpath = /home/ user=strigoi:033:000110: /etc/rssh.conf
Strigois (Puppet-Nodes) /etc/puppet/puppet.conf
Strigois (Puppet-Nodes) /etc/puppet/puppet.conf
The Master artefacto-worm1-105233.tar.xz artefacto-worm2-11.tar.xz artefacto-worm3-2846.tar.xz artefacto-worm4-106736.tar.xz artefacto-worm5-5413.tar.xz /home/strigoi/
The Master 2cf0de7966fcc238b12f42df621a6beee55dba17b39be620cd147295afebc0c9a6bd58a0270cfb160edd16fbf46e253 793e5eed943d57a2db1881d72e0c9d5c4 /tmp/artefacto/auth.log d13254e9a6d6d12af1765b099d14e3c8742b731c98993ded94783883946a84a3b7c46f2e587a58ab6965c313125d 77e039ec05e80c51e803a11d5d456005ed8c /tmp/artefacto/dataw 582939b8399b80852ea83500dd1ac244b2a3332212085777207e8166e0673f19b00623c903edb91f729626491f52 7e575b9f7b6157e07d2473da07a46952bff5
/tmp/artefacto/swap.swap 3f73d4a9591f5ba47c65a739ec8c0bf0c3a8f41bef778479374b4588af7e7009ba12a4405d9937925b7825e6f51974 ac28f628f6bfcfea58bf1994aa04f5d785 /tmp/artefacto/memorydump.lime 06f9deb3034b5cf649c7aa3e07430417a868e64e80930564a29f52d64d1d3e6a9edf651698f97f204c1777bc748e9b 653d39c7fd1c9521592332019c04a67cad /tmp/artefacto/messages 37ec32ee176380e81a2ce7e25eb30f662b5097d7a2fcd54af0960d29a14e01a03aac63202c906db0192a8c8cd4f6d f2a033d11c0c3879b8b4d3a8b85512babdc /tmp/artefacto/netdump.pcap /home/strigoi/artefacto-strigoiname-uptimeinsec.tar.xz
The Master auth.log: Auth OS log dataw: arp, netstat (udp/tcp),
ps, host info swap.swap: Swap Memory Dump memorydump.lime: Physical Memory Dump messages: Message OS Log netdump.pcap: 1000 network packets hash-f: Integrity hash (SHA512) /home/strigoi/artefacto-strigoiname-uptimeinsec.tar.xz
Incident Response Team ShieldNow Cloud VM VM VM Public Cloud
Host Info Network Packets Network Info OS/APP Logs Memory Dump Integrity Hash Forensic Analysis Solution
Solution VM VM VM Public / Private / Hybrid Cloud
Linux VM • Open Source Puppet • Volatility • Yara • Snort • The Sleuth Kit® (TSK) • log2timeline • Wireshark • Cryptcat • dc3dd • Foremost • netcat
Future Work Public / Private / Hybrid Cloud • Windows
Forensics Puppet + Sysinternals + PowerShell • Timestamping (thanks to Fernando Quintero @nonroot) • Automated Analysis • Web Front-End • Digital Chain of Custody • Automated Report
Learn Forensics Public / Private / Hybrid Cloud
Learn Forensics Public / Private / Hybrid Cloud • Windows
Forensics Puppet + Sysinternals + PowerShell • Automated Analysis • Web Front-End • Digital Chain of Custody • Automated Report
Learn Puppet Public / Private / Hybrid Cloud • Windows
Forensics Puppet + Sysinternals + PowerShell • Automated Analysis • Web Front-End • Digital Chain of Custody • Automated Report
Obey the Master!!! Thanks for your attention