Artifact Analysis

• What Is an “Artifact”?

An artifact is one or more files that accomplish a single task or have a well-defined purpose.
Tools used by intruders to gather information about networks or hosts
Tools used by intruders to exploit vulnerabilities
Tools installed by intruders on compromised  hosts
A malicious program (e.g., virus, worm, Trojan horse, bot, etc.)
Soft evidence (e.g., algorithms, descriptions, partial artifacts, network traces, etc.)

What is Artifact Analysis?
The study of Internet attack technology, otherwise known as malicious code, or “malware”
Viruses
Worms
Trojan horses
Rootkits
Bots
Denial-of-service tools
Vulnerability exploits
Spyware
Etc..
https://www.first.org/conference/2005/papers/kevin-houle-slides-1.pdf

• payload

In computer security, the payload is the part of malware such as worms or viruses which performs the malicious action; deleting data, sending spam or encrypting data.In addition to the payload, such malware also typically has overhead code aimed at simply spreading itself, or avoiding detection.

https://en.wikipedia.org/wiki/Payload_(computing)

• WHAT IS A PAYLOAD-BASED SIGNATURE?

Payload-based signatures detect patterns in the content of the file rather than attributes, such as a hash, allowing them to identify and block altered malware

Security tools often utilize signatures based on easily changed variables like hash, file name or URLs to identify and prevent known malware from infecting systems. With this type of signature, identifying threats requires essentially a one-to-one match against the specific variables the signature is looking for.

Malware authors can now easily create thousands of variants of existing malware, containing only slight changes, in order to get around signature matching
As legacy signatures require a static one-to-one match for each unique file, these slight changes allow malware to go undetected.

If a piece of known malware has been altered in any way, resulting in an entirely new hash or other small change, payload-based signatures would still be able to identify and block what would otherwise have been treated as a new unknown threat.

https://www.paloaltonetworks.com/cyberpedia/what-is-a-payload-based-signature

• In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites.A sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted.

In the sense of providing a highly controlled environment, sandboxes may be seen as a specific example of virtualization. Sandboxing is frequently used to test unverified programs that may contain a virus or other malicious code, without allowing the software to harm the host device.
https://en.wikipedia.org/wiki/Sandbox_%28computer_security%29

• A sandbox is a testing environment that isolates untested code changes and outright experimentation from the production environment or repository, in the context of software development including Web development and revision control. Sandboxing protects "live" servers and their data, vetted source code distributions, and other collections of code, data and/or content, proprietary or public, from changes that could be damaging (regardless of the intent of the author of those changes) to a mission-critical system or which could simply be difficult to revert

The concept of the sandbox (sometimes also called a working directory, a test server or development server) is typically built into revision control software such as CVS and Subversion (SVN), in which developers "check out" a copy of the source code tree, or a branch thereof, to examine and work on. Only after the developer has (hopefully) fully tested the code changes in their own sandbox should the changes be checked back into and merged with the repository and thereby made available to other developers or end users of the software
https://en.wikipedia.org/wiki/Sandbox_%28software_development%29

•  Malware Sandbox and Breach Detection Evasion Techniques

   a malware uses 4 basic evasion techniques that include:
    Configuration-specific — sleep calls, time triggers, fast flux, and process hiding
    Human interaction — mouse clicks and dialog boxes
    Environment-specific — version, embedded iframes, and DLL loaders
    VMware-specific — system-service lists, unique files, and the VMX port
http://www.drchaos.com/malware-sandbox-and-breach-detection-evasion-techniques

• Traditionally, your anti-virus and anti-spyware software work with your email software to identify malicious software as soon as it is received, or at least, as soon as it begins to execute in your computer. That works well for well-known viruses and spyware but leaves you vulnerable to zero-day exploits, that is, vulnerable to malicious software that is not yet properly identified by the security software.

For example, suppose you get an email message with the virus that presents itself as an attachment called Click_Me_For_Best_Joke_Ever.exe. Suppose you don't know this is a virus, and further suppose that your anti-virus has not yet been updated to identify this particular virus. You click the attachment, and it delivers the best joke ever, but it also secretly installs malicious software.

If you run your email program sandboxed, then Click_Me_For_Best_Joke_Ever.exe also runs sandboxed, and any changes it makes to the computer, or software it installs, will be confined to the sandbox. These changes will be discarded in their entirety as soon as you delete the sandbox.

https://www.sandboxie.com/?EmailProtection

• Joe Sandbox Mail is an easy to use Microsoft Outlook add-in which enables you to:

    analyze potentially malicious e-Mail attachments (any file type) in one click
    detect malicious e-Mails
    delete malicious e-Mails
    access behavior analysis reports of analyzed e-Mail attachments
    mark and categorizes malicious e-Mails

Joe Sandbox Mail integrates into Microsoft Outlook as a new Ribbon, and just with a simple click of the “analyze” button, the e-Mail attachments are being sent to Joe Sandbox Cloud, Joe Sandbox Desktop, Joe Sandbox Complete or Joe Sandbox Ultimate to be analyzed.
https://www.joesecurity.org/joe-sandbox-mail

• Test downloads in a safe environment on your PC before installing them on your hard drive. We show how to install and run software in a sandbox with the free BufferZone app

http://www.pcadvisor.co.uk/how-to/security/test-downloads-files-with-sandbox-3407128/

• Use the Email > Settings > File Sandboxing page to send suspicious files received in email messages to a cloud-hosted sandbox for analysis. The sandbox activates the file, observes the behavior, and compiles a report. If the file is malicious, the message is either quarantined, or an email alert is sent to the administrators that you specify, containing summary information and a link to the report.

https://www.websense.com/content/support/library/email/hosted/admin_guide/email_threat_analysis.aspx

• You could do all sorts of cool things with a sandboxed Python:

A "Sandboxed Python" would let you permit or forbid modules, limit execution slices, permit or deny network traffic, constrain filesystem access to a particular directory (floated as "/"), and so on. It is also referred to as restricted execution, a topic brought up by Mitch Kapor at PyCon and noted on his blog.
https://wiki.python.org/moin/SandboxedPython

• As its name suggests, this library is a NodeJS sandbox for executing untrusted Python code in Docker containers.

https://github.com/christophetd/docker-python-sandbox

• pysandbox is a Python sandbox. By default, untrusted code executed in the sandbox cannot modify the environment (write a file, use print or import a module). But you can configure the sandbox to choose exactly which features are allowed or not, eg. import sys module and read /etc/issue file.

https://pypi.org/project/pysandbox/

• As a security analyst, you can look for threats that evaded detection by analyzing reconstructed artifacts, such as files and images. To understand the connections between collaborators and artifacts, you can also investigate the links to and from these files and images.

Several systems are infected despite all of the security measures that are in place. After he identifies and quarantines these systems, John needs to find out how these systems became infected and whether other assets are similarly compromised.
https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/c_qif_ug_artifact_an_ov.html


Malware analysis is a process that uses various tools and techniques to determine how malicious code
is working. Unfortunately, there is no single algorithm to indicate how to analyze such code. Various
approaches are usually needed including static analysis, behavioral analysis, executable debugging
or analysis of disassembled code. Moreover, each analyst usually tends to have his or her own favorite techniques and preferred tools.

Basic static analysis
The  goal  of  this  analysis  is  to gather information about potential malware functionality and any characteristic  file  features
that could  later  be  used  to  create malware signature

Behavioral analysis
In  this  analysis, malicious  code  is  intentionally  executed  in a controlled  environment  to  observe  what  changes  it  makes to  the operating  system
https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/documents/artifact-analysis-fundamentals-handbook

• Difference Between Static Malware Analysis and Dynamic Malware Analysis

Malware analysis is a process or technique of determining the origin and potential impact of a specified malware sample.
Malware could be anything that looks malicious or acts like one like a virus, worm, bug, Trojan, spyware, adware, etc. Any suspicious software that may cause harm to your system can be considered as a malware.

What is Static Malware Analysis?
Static analysis is a process of analyzing a malware binary without actually running the code. Static analysis is generally performed by determining the signature of the binary file which is a unique identification for the binary file and can be done by calculating the cryptographic hash of the file and understanding each component.
The malware binary file can be reverse-engineered by loading the executable into a disassembler such as IDA. The machine-executable code can be converted assembly language code so that it can be easily read and understood by humans.

What is Dynamic Malware Analysis?
Dynamic analysis involves running the malware sample and observing its behavior on the system in order to remove the infection or stop it from spreading into other systems. The system is setup in a closed, isolated virtual environment so that the malware sample can be studied thoroughly without the risk of damage to your system.

http://www.differencebetween.net/technology/difference-between-static-malware-analysis-and-dynamic-malware-analysis/

• Classification

Static analysis tools

PEiDExeinfo PE
PEview
CFF Explorer
Resource Hacker
BinText
Upx

Dynamic analysis tools
Process Explorer
Process Monitor
Regshot
GMER

Network analysis tools
Tcpdump
Wireshark
Mitmproxy
INetSim

Automatic analysis tools
Cuckoo Sandbox

https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/documents/artifact-analysis-fundamentals-handbook

• Cuckoo Sandbox is a malware analysis system.

In other words, you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment.
Malware is the swiss-army knife of cybercriminals and any other adversary to your corporation or organization.
https://cuckoosandbox.org/

• CuckooMX: Automating Email Attachments Scanning with Cuckoo

Today,  classic anti-virus protections are not enough reliable to protect against modern malware. To have a better understanding and, if possible, block them, it’s best to execute the code in a safe environment and to analyze its behavior. Does it create new processes or files, are outbound connections performed via suspicious domains or IP addresses? Does it implement hooks? This method of performing malware analysis in a sandbox is more and more common.
https://blog.rootshell.be/2012/06/20/cuckoomx-automating-email-attachments-scanning-with-cuckoo/

• CuckooMX is a project to automate the analysis of files transmitted over SMTP (using the Cuckoo sandbox)

https://github.com/xme/cuckoomx

• One    Flew    Over    the    Cuckoo’s    Nest   

http://conference.hitb.org/hitbsecconf2012ams/materials/D1T1%20-%20Claudio%20Guarnieri%20-%20One%20Flew%20Over%20the%20Cuckoos%20Nest.pdf

• Delete VMDK Files Securely

To help prevent sensitive data in VMDK files from being read off the physical disk after it is deleted, write zeros to the entire contents of a VMDK file ("zero out") before you delete it, overwriting the sensitive data. When you zero out a file, it is more difficult for someone to reconstruct the contents.
https://pubs.vmware.com/vsphere-51/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-A9EA80D8-9D7A-48CB-9109-992782C88EA7.html

•  The partition is deleted and space returned for the pool to be used by another virtual machine. This means the next time someone buys a virtual machine with the same host, some of the blocks that made up your filesystem could end up making up their filesystem. The metadata will be wiped clean when the filesystem is formatted of course, so they won’t just see your files listed, but the blocks can still contain your data. It depends on how they’re managing their disks. go buy a virtual machine somewhere and pipe the contents of your new disk through the strings command and look out for anything that isn’t yours (ssh root@newmachine "dd if=/dev/sda1 bs=1M | strings").

 you’re probably careful and securely wipe your sensitive data before you leave. But disk space is virtualized too. The blocks that make up your disk might not all be in order or even all be on the same disk. snapshots, your data may exist in duplicate too that you can’t even access what about if you bought extra disk space, then removed it?

 All virtual machine disks are wiped at the block level when the machine is deleted or when a new machine is created.
 if a disk image is extended into space that had previously been used as a snapshot or as a disk that was shrunk.

 https://www.brightbox.com/blog/2007/12/04/secure-virtual-disk-deletion-is-your-data-safe/

• In software development, obfuscation is the deliberate act of creating obfuscated code, i.e. source or machine code that is difficult for humans to understand.

Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic, in order to prevent tampering, deter reverse engineering, or as a puzzle or recreational challenge for someone reading the source code.
http://en.wikipedia.org/wiki/Obfuscation_%28software%29

• Reverse Engineering Virtual Machine Protected Binaries

it’s crucial to know how this code obfuscation technique really works behind the scenes. The virtual machine first starts by setting its “address space” in the executing process’s virtual address space. In other words, it allocates the needed space for its memory, stack and registers then start executing the code. Code execution is done within what is called a virtual machine loop. Inside this loop, the virtual machine plays the processor part by parsing each of its predefined opcodes and their operands then using the mother architecture to execute the instructions. Iterating through the VM loop will continue until reaching a special exit opcode.
http://resources.infosecinstitute.com/reverse-engineering-virtual-machine-protected-binaries/#gref

• Code Virtualizer is a powerful code-obfuscation system for Windows, Linux, and Mac OS X applications that helps developers to protect their sensitive code areas against Reverse Engineering with very strong obfuscation code, based on code virtualization.

https://oreans.com/codevirtualizer.php

• Tigress is a diversifying virtualizer/obfuscator for the C language that supports many novel defenses against both static and dynamic reverse engineering and de-virtualization attacks.

http://tigress.cs.arizona.edu/

• According to a Friday morning tweet from the contest's organizers, members of Qihoo 360's security team carried out the hack by exploiting a heap overflow bug in Edge, a type confusion flaw in the Windows kernel and an uninitialized buffer vulnerability in VMware, contest organizers reported Friday morning on Twitter. The result was a "complete virtual machine escape."

"We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine," Qihoo 360 Executive Director Zheng Zheng wrote in an e-mail. "Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website."
https://arstechnica.com/security/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/

• Anti-VM and Anti-Sandbox Explained

    Understand how malware authors detect when malware is running in a virtual environment
    Harden your security systems to reduce the odds of evasion
    Identify anti-VM behavior in order to improve detection.

    Malware analysts and investigators often use isolated environments, such as virtual machines (VMs) or sandboxes, to analyze unknown code for malware. In the same manner security products often use VM’s and sandboxes to execute potentially malicious code before it is approved to enter the organizational network.

    In an attempt to evade analysis and bypass security systems malware authors often design their code to detect isolated environments. Once such an environment is detected the evasion mechanism may prevent the malicious code from running, or it may alter the malware’s behavior to avoid exposing malicious activity while running in a VM

    multiple tactics used by malware authors for detecting sandboxes in general, and virtual environments in specific.
     Malware authors implement this in various ways such as Windows API, WMI queries or specific CPU instructions.

     Some of the methods described herein can be monitored by automatic analysis systems and added as behavioral signatures indicating potential malicious activity, in order to improve detection.

https://www.cyberbit.net/endpoint-security/anti-vm-and-anti-sandbox-explained/

• What Happens When APTs Advance to Lateral Movement?

Lateral movement tactics used by attackers are mainly divided into three parts: the reconnaissance period where they gather inside information to move freely in a network, the stealing of legitimate credentials, and the actual intrusion to computers using these credentials.
http://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/what-happens-when-apts-advance-to-lateral-movement-

• An advanced persistent threat is a set of stealthy and continuous computer hacking processes, often orchestrated by a person or persons targeting a specific entity. An APT usually targets either private organizations, states or both for business or political motives. APT processes require a high degree of covertness over a long period of time. The "advanced" process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. The "persistent" process suggests that an external command and control system is continuously monitoring and extracting data from a specific target. The "threat" process indicates human involvement in orchestrating the attack

Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include computer intrusion technologies and techniques but also extend to conventional intelligence-gathering techniques such as telephone-interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or another gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives.

Mitigation strategies
While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level
Agents can be used to collect logs (TCP and UDP) directly from assets into a syslog server.
Then a Security Information and Event Management (SIEM) tool can correlate and analyze logs.
While it is challenging to separate noises from legitimate traffic, a good log correlation tool can be used to filter out the legitimate traffic so security staff can focus on the noises.
Good asset management with documented components of the original Operation System plus software will help IT security analysts detect new files on the system.

Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code

https://en.wikipedia.org/wiki/Advanced_persistent_threat

• Lateral movement: the key to any attack or escape

 real life example of this malicious lateral movement in your network is the Destover Wiper malware which uses the SMB protocol via Netbios API, port 139—a protocol not monitored by most sandboxing tools—to move laterally across a network to gain access to confidential data and transport the desired data across the network where it can later be pulled out of the network.
 http://community.hpe.com/t5/Protect-Your-Assets/Lateral-movement-the-key-to-any-attack-or-escape/ba-p/6759654#.V2J9zqLSzuh

• Lateral Movement – A Critical Opportunity to Detect an In-progress Cyber Attack

 the attacker begins to move laterally around the network, taking inventory of the resources, and looking for opportunities to collect additional credentials or upgrade the privileges they already have to gain access
 http://www.countertack.com/blog/bid/124216/Lateral-Movement-A-Critical-Opportunity-to-Detect-an-In-progress-Cyber-Attack

• Criminals have strong motives to prevent their malware from being analyzed, which is a  mandatory step in performing incident response. The classical model of an executable protection is that of a wrapper around a single executable. At the time of creation, the protector will compress and/or encrypt the contents of the executable’s sections. It will then append a new code section that is responsible for decompressing and/or decrypting the sections when executed, as well as for thwarting attempts at reverse engineering. The executable’s entry point is redirected into this new code (termed the ”unpacking stub”), and upon completion, execution is transferred back to the original entry point. The program will subsequently function identically to the original, unprotected executable.

Each assumes that the hidden code from the protected program will be completely unprotected in memory at some point during execution, and each uses various measures to guide execution until this point. Some tools additionally have the goal, beyond merely identifying hidden code and the original entry point, of producing working, unprotected executables.
http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf

• At YaraRules Project we want to offer to the Community a new online service: “YaraRules Analyzer”. It allows you to analyze your files on the cloud using the full YaraRules ruleset, so you do not need to install Yara in your local computer and you also make sure to analyze your files against the latest YaraRules ruleset.

http://yararules.com/

• Yara Rules

Yara is an open source malware attribution tool used to classify malware samples based on textual or binary patterns once they have been analyzed in Cuckoo. Using Yara, researchers write descriptions of malware families based on patterns. These descriptions are called rules, hence the name Yara (which stands for “Yet Another Recursive Acronym”) Rules. It allows researchers to recognize and categorize seemingly similar variants of malware and can be integrated to use within Cuckoo.
https://www.cyberbit.net/endpoint-security/open-source-malware-analysis-tools

• Reverse Engineering involves the analysis of malicious files in depth which involves time and cost. It is considered a good practice to observe malware behavior, group them in a signature, and then identify the related infected files. To cut the costs of R.E and identifying malware families based on signatures,q we can use an open source tool known as YARA.

YARA is a popular tool that provides a robust language, which is compatible with Perl-based Regular Expressions and is used to examine the suspected files/directories and match strings as is defined in the YARA rules with the file.
https://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-malware/#gref

• This project covers the need of a group of IT Security Researchers to have a single repository where different Yara signatures are compiled, classified and kept as up to date as possible, and began as an open source community for collecting Yara rules.

https://github.com/Yara-Rules/rules

The pattern matching swiss knife for malware researchers
YARA is multi-platform, running on Windows, Linux, and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.
https://virustotal.github.io/yara/

• That’s why playing “retro hunting” is also important. I like this name: it comes from a VirusTotal feature that allows the creation of YARA rules and to search backward for samples that match them. Here is an example based on MISP and Splunk. The first step is to export interesting IOC’s like IP addresses, hostnames or hashes from the last day. Export them in CSV format into your Splunk via a simple crontab

https://isc.sans.edu/diary/Retro+Hunting%21/22189

• Retrohunt: Yara back in time

Create a Yara rule and apply it back in time to the existing dataset in order to discover early versions of new attacks that you might have recently discovered.
https://www.virustotal.com/#/hunting-overview

• A Linux Toolkit for Reverse-Engineering and Analyzing Malware.REMnux® is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software. It strives to make it easier for forensic investigators and incident responders to start using the variety of freely-available tools that can examine malware, yet might be difficult to locate or set up.

https://remnux.org/

• Radare is a portable reversing framework that can

    Disassemble (and assemble for) many different architectures
    Debug with local native and remote debuggers (gdb, rap, webui, r2pipe, winedbg, windbg)
    Run on Linux, *BSD, Windows, OSX, Android, iOS, Solaris and Haiku
    Perform forensics on filesystems and data carving
    Be scripted in Python, Javascript, Go and more
    Support collaborative analysis using the embedded webserver
    Visualize data structures of several file types
    Patch programs to uncover new features or fix vulnerabilities
    Use powerful analysis capabilities to speed up reversing
    Aid in software exploitation
https://rada.re/r/


• Medusa is a disassembler designed to be both modular and interactive. It runs on Windows and Linux, it should be the same on OSX. This project is organized as a library. To disassemble a file you have to use medusa_text or Medusa.

https://github.com/wisk/medusa

• Hopper Disassembler, the reverse engineering tool that lets you disassemble, decompile and debug your applications

https://www.hopperapp.com/

• Hiew

    view and edit files of any length in text, hex, and decode modes    x86-64 disassembler & assembler (AVX instructions include)
    physical & logical drive view & edit
    support for NE, LE, LX, PE/PE32+, ELF/ELF64(little-endian), Mach-O(little-endian), TE/TE64 executable formats
    support for Netware Loadable Modules like NLM, DSK, LAN,...
    following direct call/jmp instructions in any executable file with one touch
    pattern search in disassembler
    built-in simple 64bit decrypt/crypt system
    built-in powerful 64bit calculator
    block operations: read, write, fill, copy, move, insert, delete, crypt
    multifile search and replace
    keyboard macros
    unicode/utf8 support
    Hiew Extrenal Module (HEM) support
    ArmV6 disassembler
http://www.hiew.ru/

• IDA Pro is a disassembler

As a disassembler, IDA Pro explores binary programs, for which source code isn't always available,
to create maps of their execution. The real interest of a disassembler is that it shows the instructions that are
actually executed by the processor in a symbolic representation called
assembly language. If the friendly screen saver you have just installed is spying on your e-banking session or logging your e-mails, a
disassembler can reveal it. However, assembly language is hard to make sense of. That's why advanced
techniques have been implemented into IDA Pro to make that code more readable, in some cases, quite close
to the original source code that produced the binary program. The map of the program's code then be
post-processed for further investigations

IDA Pro is a debugger
Hostile code usually does not cooperate with the analyst. Viruses, worms, and trojans are often armored and obfuscated
The debugger in IDA Pro complements the static analysis capabilities of the disassembler: by allowing to
single step through the code being investigated, the debugger often bypasses the obfuscation and helps obtain
data that the more powerful static disassembler will be able to process in depth. IDA Pro can be used as a
local and as a remote debugger on various platforms, including the ubiquitous 80x86 (typically
Windows/Linux) and the ARM platform (typically Windows CE PDAs) and other platforms. Remote
debuggers are very useful when one wants to safely dissect potentially harmful programs.

Hostile Code analysis
When eEye isolated a new worm whose payload targeted the White House's website, IDA Pro was used to
analyze and understand it: it helped the talented eEye analysts deliver a prompt and accurate warning of the impending attack. 

Vulnerability research
IDA Pro is the ideal tool to investigate why software breaks.

COTS validation
A lot of software is now developed outside the country where it is used
IDA provides a convenient means to check if a program really does what it claims to do

Privacy protection

https://www.hex-rays.com/products/ida/ida-executive.pdf

• Viruses

A computer virus is a type of malware that propagates by inserting a copy of itself into and becoming part of another program. It spreads from one computer to another, leaving infections as it travels
Worms
Computer worms are similar to viruses in that they replicate functional copies of themselves and can cause the same type of damage. In contrast to viruses, which require the spreading of an infected host file, worms are standalone software and do not require a host program or human help to propagate

https://www.cisco.com/c/en/us/about/security-center/virus-differences.html

• OllyDbg is a 32-bit assembler level analyzing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where the source is unavailable. OllyDbg is a shareware, but you can download and use it for free

http://www.ollydbg.de/

• OllyDbg

OllyDbg is an x86 debugger that emphasizes binary code analysis, which is useful when source code is not available. It traces registers, recognizes procedures, API calls, switches, tables, constants, and strings, as well as locates routines from object files and libraries. It has a friendly interface, and its functionality can be extended by third-party plugins.

OllyDbg is often used for reverse engineering of programs. It is often used by crackers to crack software made by other developers. For cracking and reverse engineering, it is often the primary tool because of its ease of use and availability; any 32 bit executable can be used by the debugger can be edited in bitcode/assembly in real-time. It is also useful for programmers to ensure that their program is running as intended. Furthermore, it can be used for malware analysis purposes as well
http://en.wikipedia.org/wiki/OllyDbg

• WinDbg

WinDbg is a multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft. It can be used to debug user mode applications, drivers, and the operating system itself in kernel mode.

WinDbg can be used for debugging kernel-mode memory dumps, created after what is commonly called the Blue Screen of Death which occurs when a bug check is issued. It can also be used to debug user-mode crash dumps. This is known as post-mortem debugging.

Recent versions of WinDbg have been and are being distributed as part of the free Debugging Tools for Windows suite, which shares a common debugging back-end between WinDbg and command line debugger front-ends like KD, CDB, and NTSD.
http://en.wikipedia.org/wiki/WinDbg

• Freeware Hex Editor Neo allows you to view, modify, analyze your hexadecimal data and binary files, edit, exchange data with other applications through the clipboard, insert new data and delete existing data, as well as perform other editing actions.

http://www.hhdsoftware.com/free-hex-editor

• Spyware

Spyware is a software that aids in gathering information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge


"Spyware" is mostly classified into four types: system monitors, trojans, adware, and tracking cookies.
Spyware is mostly used for the purposes such as; tracking and storing internet users' movements on the web; serving up pop-up ads to internet users.

Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users.

While the term spyware suggests software that monitors a user's computing, the functions of spyware can extend beyond simple monitoring. Spyware can collect almost any type of data, including personal information like Internet surfing habits, user logins, and bank or credit account information. Spyware can also interfere with user control of a computer by installing additional software or redirecting Web browsers. Some spyware can change computer settings, which can result in slow Internet connection speeds, un-authorized changes in browser settings, or changes to software settings.

http://en.wikipedia.org/wiki/Spyware

• How to: Use NETSTAT.EXE to detect spyware/malware

This video just explains how to use netstat command to detect executables on established connections
"netstat -b" should be used.
http://www.mappingwireless.com/internet-security/how-to-use-netstatexe-to-detect-spywaremalware

• Elicitation Techniques

Elicitation is a technique used to discreetly gather information. It is a conversation with a specific purpose: collect information that is not readily available and do so without raising suspicion that specific facts are being sought.

A person may never realize she was the target of elicitation or that she provided meaningful information
Many competitive business intelligence collectors and foreign intelligence officers are trained in elicitation tactics. Their job is to obtain non-public information

A business competitor may want information in order to out-compete your company, or a foreign intelligence officer may want insider information or details on US defense technologies.

Elicitors may use a cover story to account for the conversation topic and why they ask certain questions.
Elicitors may collect information about you or your colleagues that could facilitate future targeting attempts.

Elicitation can occur anywhere— at social gatherings, at conferences, over the phone, on the street, on the Internet, or in someone’s home.

For example, have you ever planned a surprise party for someone and needed to know their schedule, wish list, food likes and dislikes or other information without that person finding out you were collecting the information or for what purpose?


Why Elicitation Works
Natural tendencies an elicitor may try to exploit include:

    A desire to be polite and helpful, even to strangers or new acquaintances
    A desire to appear well informed, especially about our profession
    A desire to feel appreciated and believe we are contributing to something important
    A tendency to expand on a topic when given praise or encouragement; to show off
    A tendency to gossip
    A tendency to correct others
    A tendency to underestimate the value of the information being sought or given, especially if we are unfamiliar with how else that information could be used
    A tendency to believe others are honest; a disinclination to be suspicious of others
    A tendency to answer truthfully when asked an “honest” question
    A desire to convert someone to our opinion


For example, you meet someone at a public function and the natural getting-to-know-you questions eventually turn to your work. You never mention the name of your organization. The new person asks questions about job satisfaction at your company, perhaps while complaining about his job. You may think, “He has no idea where I work or what I really do. He’s just making idle chat. There’s no harm in answering.” However, he may know exactly what you do but he relies on his anonymity, your desire to be honest and appear knowledgeable, and your disinclination to be suspicious to get the information he wants. He may be hunting for a disgruntled employee who he can entice to give him insider informat


Techniques

Assumed Knowledge: 
Pretend to have knowledge or associations in common with a person. “According to the computer network guys I used to work with…

Bracketing: 
Provide a high and low estimate in order to entice a more specific number. “I assume rates will have to go up soon. I’d guess between five and 15 dollars.” Response: “Probably around seven dollars.

Can you top this? 
Tell an extreme story in hopes the person will want to top it. “I heard Company M is developing an amazing new product that is capable of …”

Confidential Bait: 
Pretend to divulge confidential information in hopes of receiving confidential information in return. “Just between you and me…” “Off the record…”

Deliberate False Statements / Denial of the Obvious:
Say something wrong in the hopes that the person will correct your statement with true information

Feigned Ignorance:
Pretend to be ignorant of a topic in order to exploit the person’s tendency to educate.

Flattery:
Use praise to coax a person into providing information

Good Listener:
Exploit the instinct to complain or brag, by listening patiently and validating the person’s feelings (whether positive or negative)

The Leading Question:
Ask a question to which the answer is “yes” or “no,” but which contains at least one presumption

Macro to Micro:
Start a conversation on the macro level, and then gradually guide the person toward the topic of actual interest.
A good elicitor will then reverse the process taking the conversation back to macro topics.

Mutual Interest:
Suggest you are similar to a person based on shared interests, hobbies, or experiences, as a way to obtain information or build a rapport before soliciting information.

Oblique Reference:
Discuss one topic that may provide insight into a different topic. A question about the catering of a work party may actually be an attempt to understand the type of access outside vendors have to the

facility.

Opposition/Feigned Incredulity:
Indicate disbelief or opposition in order to prompt a person to offer information in defense of their position

Provocative Statement:
Entice the person to direct a question toward you, in order to set up the rest of the conversation.

Questionnaires and Surveys:
State a benign purpose for the survey.

Quote Reported Facts:
Reference real or false information so the person believes that bit of information is in the public domain


Ruse Interviews:
Someone pretending to be a headhunter calls and asks about your experience, qualifications, and recent projects

Volunteering Information / Quid Pro Quo:
Give information in hopes that the person will reciprocate

Word Repetition:
Repeat core words or concepts to encourage a person to expand on what he/she already said


Deflecting Elicitation Attempts

You can politely discourage conversation topics and deflect possible elicitations by:

    Referring them to public sources (websites, press releases)
    Ignoring any question or statement you think is improper and changing the topic
    Deflecting a question with one of your own
    Responding with “Why do you ask?”
    Giving a nondescript answer
    Stating that you do not know
    Stating that you would have to clear such discussions with your security office
    Stating that you cannot discuss the matter

If you believe someone has tried to elicit information from you, especially about your work, report it to your security officer.



http://www.fbi.gov/about-us/investigate/counterintelligence/elicitation-techniques

• The Insider Threat

An introduction to detecting and deterring an insider spy




Personal Factors

Greed or Financial Need: A belief that money can fix anything. Excessive debt or overwhelming expenses.

Anger/Revenge: Disgruntlement to the point of wanting to retaliate against the organization.

Problems at work: A lack of recognition, disagreements with co-workers or managers, dissatisfaction with the job, a pending layoff.

Ideology/Identification: A desire to help the “underdog” or a particular cause.

Divided Loyalty: Allegiance to another person or company, or to a country besides the United States.

Adventure/Thrill: Want to add excitement to their life, intrigued by the clandestine activity, “James Bond Wannabe.”

Vulnerability to blackmail: Extra-marital affairs, gambling, fraud.

Ego/Self-image: An “above the rules” attitude, or desire to repair wounds to their self-esteem. Vulnerability to flattery or the promise of a better job. Often coupled with Anger/Revenge or Adventure/Thrill.

Ingratiation: A desire to please or win the approval of someone who could benefit from insider information with the expectation of returned favors.

Compulsive and destructive behavior: Drug or alcohol abuse, or other addictive behaviors.

Family problems: Marital conflicts or separation from loved one



Organizational Factors

The availability and ease of acquiring proprietary, classified, or other protected materials. Providing access privileges to those who do not need it.


Behavioral Indicators

Some behaviors may be a clue that an employee is spying and/or methodically stealing from the organization:


http://www.fbi.gov/about-us/investigate/counterintelligence/the-insider-threat

• Internet Social Networking Risks

http://www.fbi.gov/about-us/investigate/counterintelligence/internet-social-networking-risks

• How to Detect Spyware on a Cell Phone

There are a few subtle signs that spyware has been installed on your cell phone.

Notice if your phone lights up when you’re not using it to make or receive a call or access any of the phone’s apps. Spyware has to “call” your phone to get information.
Note any strange background noises or clicks when you’re on a call.
Notice an increase in GPRS activity. This indicates spyware is tracking your location.
Check your phone bill closely. Notice whether it lists more text messages than you remember sending or calls you did not make.
Ask anyone who may have borrowed your phone whether they installed any software, wallpapers or ringtones.

Tips & Warnings
Use an anti-virus software on your phone to detect and remove viruses or spyware
Take your phone to your service provider, who can erase the phone’s memory and restore the factory default settings.
You’ll lose all your data, but the spyware will be eliminated.
Make a hard copy of any information in your phone that you wish to retain.
Do not give your cell phone number to strangers or post it on the Internet.
Spyware can be installed on your phone from a remote location simply by calling it.
If you let a stranger borrow your phone to make an “emergency” call before you noticed any of these signs, the number they called most likely installed spyware on your phone.
This is commonly used to set up a program to send large numbers of text messages to your phone for which you are charged.

http://www.ehow.com/how_4826956_detect-spyware-cell-phone.html#ixzz2MfR4Vj46

• How to detect and remove Ramnit

Ramnit is malware that’s infecting PCs running Microsoft Windows. When a PC has been infected, the malware will disable a series of Windows security features (Windows Defender, Windows Firewall, User Account Control), Windows Update, and remove the ability to install other antivirus software
http://windows.microsoft.com/en-us/windows/detect-remove-ramnit-virus

• spyeye

SpyEye was written in C++ and the size of the compiled binary is of 60 KB, the operating systems supported are from Windows 2000 to the recent Windows 7, it works in ring3 mode (same as Zeus Trojan). It is sold as undetected from most Antivirus Software and it is invisible from the task managers and other user-mode applications, it hides the files from the regular explorer searches and it hides also its registry keys.
http://thehackernews.com/2011/08/spyeye-1345-download-loader-source-code.html

• Zeus

Zeus, ZeuS, or Zbot is a Trojan horse malware package that runs on versions of Microsoft Windows. While it can be used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware.
https://en.wikipedia.org/wiki/Zeus_(malware)

• advanced threat analytics(ATA)

Using deep packet inspection technology, Microsoft Advanced Threat Analytics analyzes all Active Directory traffic. It can also collect relevant events from SIEM and other sources.
https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics#CP_CaseStudy_2

• Crypters are computer applications which are solely used to bypass the antivirus detection of malwares. Hackers use crypters to hide viruses, Trojans, RATS, keyloggers and other hack tools into a new executable, whose sole purpose is to bypass the detection of the same from antivirus.

https://www.hackingloops.com/crypters-tutorial-for-hackers-by-hackingloops/

• A crypter is a program which is used to assist malware with evading antivirus signature-based detection. How it does this is it applies an obfuscation method onto the malware so that the antivirus cannot successfully match it with any signature. It then outputs a seemingly "harmless" file called the stub. Once the stub is opened by the victim, it will decrypt the malware and execute it.

https://null-byte.wonderhowto.com/how-to/security-oriented-c-tutorial-0xfb-simple-crypter-0168089/

• Poison Ivy: Assessing Damage and Extracting Intelligence

Here is how a typical Poison Ivy attack works:

    The attacker sets up a custom PIVY server, tailoring details such as how Poison Ivy will install itself on the target computer, what features are enabled, the encryption password, and so on.
    The attacker sends the PIVY server installation file to the targeted computer. Typically, the attacker takes advantage of a zero-day flaw. The target executes the file by opening an infected email attachment, for example, or visiting a compromised website.
    The server installation file begins executing on the target machine. To avoid detection by anti-virus software, it downloads additional code as needed through an encrypted communication channel.
    Once the PIVY server is up and running on the target machine, the attacker uses a Windows GUI client to control the target computer.
https://www.fireeye.com/blog/threat-research/2013/08/pivy-assessing-damage-and-extracting-intel.html

• Gh0st RAT is a Trojan horse for the Windows platform that the operators of GhostNet used to hack into some of the most sensitive computer networks on Earth

https://en.wikipedia.org/wiki/Gh0st_RAT

• Gh0st RAT: Complete Malware Analysis – Part 1

Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.
http://resources.infosecinstitute.com/gh0st-rat-complete-malware-analysis-part-1/

• Superfish 

The preloaded Superfish adware does more than hijack website ads in a browser. It also exposes Lenovo owners to a simple but dangerous hack that could spell disaster.
http://www.cnet.com/news/superfish-torments-lenovo-owners-with-more-than-adware/

• The company has been preloading Superfish, a "visual search" tool that includes adware that fakes the encryption certificates for every HTTPS-protected site you visit, on its PCs since at least the middle of 2014. Essentially, the software conducts a man-in-the-middle attack to fill the websites you visit with ads, and leaves you vulnerable to hackers in its wake.

http://www.pcworld.com/article/2886278/how-to-remove-the-dangerous-superfish-adware-presintalled-on-lenovo-pcs.html

• Exploit Kit

Exploit kits are toolkits used to exploit security holes primarily to spread malware. These toolkits come packaged with exploit codes. These exploit kits target software such as Adobe Flash, Java, Microsoft Silverlight, Internet Explorer - software that are commonly installed and used in most PCs. Computers using outdated software/applications are at high risk.
https://www.trendmicro.com/vinfo/us/security/definition/Exploit-Kit

• to lure users into clicking a URL that points to sites hosting Blackhole Exploit Kit.

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/128/blackhole-exploit-kit-spam-runs-a-threat-vortex

• An exploit kit, sometimes called an exploit pack, is a toolkit that automates the exploitation of client-side vulnerabilities, targeting browsers and programs that a website can invoke through the browser. Common exploit targets have been vulnerabilities in Adobe Reader, Java Runtime Environment and Adobe Flash Player.

https://zeltser.com/what-are-exploit-kits

• Trojan:JS/Kilim is a family of malicious browser extensions that post unauthorized content to the user's Facebook Wall.

Kilim is distributed in executable files that use names such as "flashplayer", "video installer", "premium installer" or similar, in order to lure an unsuspecting user into installing the program.
https://www.f-secure.com/v-descs/trojan_js_kilim.shtml

• SMB Worm Tool: This worm uses a brute force authentication attack to propagate via Windows SMB shares. It connects home every five minutes to send log data back to command and control (C2) infrastructure if it has successfully spread to other Windows hosts via SMB port 445. The tool also accepts new scan tasking when it connects to C2. There are two main threads: the first thread calls home and sends back logs (a list of successful SMB exploitations), and the second thread attempts to guess passwords for SMB connections. If the password is correctly guessed, a file share is established and file is copied and run on the newly-infected host.

http://www.securityweek.com/hackers-used-sophisticated-smb-worm-tool-attack-sony

• In computer networking, Server Message Block (SMB), one version of which was also known as Common Internet File System (CIFS, /'s?fs/),[1][2] operates as an application-layer network protocol[3] mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network.

https://en.wikipedia.org/wiki/Server_Message_Block

• Hack windows xp with metasploit

Metasploit does this by exploiting a vulnerability in windows samba service called ms08-67. This exploit works on windows xp upto version xp sp3.

http://www.binarytides.com/hack-windows-xp-metasploit

• Remote Access Trojans (RATs) provide cybercriminals with unlimited access to infected endpoints.

https://www.trusteer.com/glossary/remote-access-trojan-rat

• A remote access Trojan (RAT) is a malware program that includes a back door for administrative control over the target computer. RATs are usually downloaded invisibly with a user-requested program -- such as a game -- or sent as an email attachment

http://searchsecurity.techtarget.com/definition/RAT-remote-access-Trojan

• Watering Hole is a computer attack strategy identified in 2012 by RSA Security, in which the victim is a particular group (organization, industry, or region). In this attack, the attacker guesses or observes which websites the group often uses and infects one or more of them with malware.

https://en.wikipedia.org/wiki/Watering_Hole

• In a watering hole attack scenario, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection.

http://www.trendmicro.com.au/vinfo/au/threat-encyclopedia/web-attack/137/watering-hole-101

• Detecting malware through static and dynamic techniques

Malware analysis involves two key techniques: static analysis and dynamic analysis.
Static analysis examines malware without actually running it. Dynamic analysis (also known as behavior analysis) executes malware in a controlled and monitored environment to observe its behavior

Basic Static Analysis
Basic static analysis examines malware without viewing the actual code or instructions. It employs different tools and techniques to quickly determine whether a file is malicious or not, provide information about its functionality and collect technical indicators to produce simple signatures. Technical indicators gathered with basic static analysis can include file name, MD5 checksums or hashes, file type, file size and recognition by antivirus detection tools.

Basic Dynamic Analysis
Basic dynamic analysis actually runs malware to observe its behavior, understand its functionality and identify technical indicators which can be used in detection signatures. Technical indicators revealed with basic dynamic analysis can include domain names, IP addresses, file path locations, registry keys, additional files located on the system or network.
Additionally, it will identify communication with an attacker-controlled external server for command and control purposes or in an attempt to download additional malware files.
Basic analysis can be thought of as what most automated sandboxes or dynamic malware analysis engines do today



https://technical.nttsecurity.com/post/102efk4/detecting-malware-through-static-and-dynamic-techniques

CCcam cardsharing

• Question: What is CCcam cardsharing?

Answer: Card sharing a is method of sharing a paid subscription card over the internet. Person 1 has a paid subscription to a tv package EG sky uk. Person 1 also receives Sky Italia from abroad but cannot watch them as it is not possible to subscribe to that particular package due to territorial boundries. Person 2 has a subscription to sky italia, he also receives sky uk on his satellite but cannot watch it as it is encrypted and he cannot subscribe due to territorial boundries. This is where card sharing come into effect. person 1 & 2 both own linux cardsharing boxes (ie dreambox VU Duo etc), so therefore they can create a newtwork for each other to join. Being connected to each other through the internet means that person 1 can use person 2`s card as if it was his own and can now decrypt the sky italia stations he could not before. Person 2 can now also watch sky uk in italy with person 1`s card.

Your dreambox needs a fixed ip. The setup of this is different for each router so it is recommended you consult you router documentation. Basically every time your box is switched on it MUST be assigned the same IP otherwise your peers will not find you (where the router assigns the ip this is known as DHCP)

Another way to do this is to assign a static ip from the box itself. Go to setup - system setting - network and turn DHCP off. Enter the ip you wish to use and this way the box will tell the router what ip it is taking rather than the router assigning an ip.

When you have this set up you will need to forward a port to the static address you have assigned to the dreambox
go to http://www.canyouseeme.org and enter the port number you selected into the box

Next you will want to get some shares and get started with your F & C Lines. To share you with a friend you need to create 2 lines. An Fline for your own box and a Cline to give to your client for his box. Your lines will look something like this
F: USER PASS 2 0 0 { 0:0:2 } 
C: 80.97.243.65 12000 USER PASS 

80.97.243.65 This is your ip address. To use Ip addresses for shares you need to have a static ip address (most broadband providors do not give static ip addresses and change your ip regularly). Check with them and see if you can get a static. If they dont do this or want to charge you extra you can set an DNS account instead and download dns updater. The dns updater will track your ip and will update as necessary. If you set up a dns you cline will change to comething like this: 
C: anyone.dyndns.org 12000 USER PASS 
You can join dyndns here http://www.dyndns.com
And download the dns updater here http://www.dyndns.com/support/clients/windows.html

When you have created your lines give your client the cline and put the fline in your cccam.cfg. this can be found on DCC by browsing to: FTP- VAR- ETC- cccam.cfg

http://xcccamx.blogspot.com.tr/2013/09/beginers-guide-to-cccam-cardsharing.html

•  Satellite TV systems also require a landline phone connection for downloading periodic updates associated with the interactive on-screen program guide as well as pay-per-view service information

 A modem inside the satellite receiver makes a short duration toll-free call to the service provider computer system; 
 Satellite TV decoders de-scramble encrypted satellite TV signals and deliver them usable to satellite TV subscribers. For this purpose, satellite TV decoders incorporate a conditional access module (CAM) with a built-in card reader.
 satellite TV receivers with HD support, built-in hard-drive, and a full range of digital video recording (DVR) features to record movies and TV shows.

encryption tools

• AxCrypt is a free, open source, GNU GPL-licensed encryption tool for Windows that prides itself on being simple, efficient, and easy to use.

It supports 128-bit AES encryption only, offers protection against brute force cracking attempts, and is exceptionally lightweight (less than 1MB.)

• 7-Zip is actually a lightweight file archiver. It's completely free, even for commercial use, supports 256-bit AES encryption, and while the official download is Windows only, there are unofficial builds for Linux and OS X systems as well

• VeraCrypt is a fork of and a successor to TrueCrypt, which ceased development last year.VeraCrypt supports AES (the most commonly used), TwoFish, and Serpent encryption ciphers, supports the creation of hidden, encrypted volumes within other volumes

http://lifehacker.com/five-best-file-encryption-tools-5677725

• AES Crypt

Platforms: Windows, OSX, Linux (Crypt4All Lite for Android is compatible).This very easy to use Java based file encryption program integrates with the OS, providing simple file encryption using the right-click menu button (Windows and Linux, or drag and drop for OSX).

• DiskCryptor

Encryption: AES_256, Twofish and Serpent.DiskCryptor is a full disk encryption program for Windows that allows you to encrypt hard drives (including CD’s USB sticks etc.), or individual partitions, including the ability to encrypt the partition and disk on which Windows is installed.

• EncFS

EncFS creates an encrypted volume, which is typically stored in a cloud storage folder (e.g. Dropbox) for easy cloud synching. This folder can be mounted locally as virtual drive, from where files can be accessed unencrypted, just as if they were files in a regular folder.

• dm-Crypt/LUKS

LUKS (Linux Unified Key Setup) is the standard for Linux hard disk encryption. It is built-in to most Linux distros, and can be used with the dm-crypt subsystem to provide transparent full disk encryption.

• Secrecy

This promising new Android app lets you create password protected vaults in which you can store any kind of file (including local Google Docs). 
https://www.bestvpn.com/blog/10995/6-best-open-source-alternatives-to-truecrypt/

Forensic art

• Age progression portraits

http://loisgibson.com/sketches.asp

• Forensic art is any art used in law enforcement or legal proceedings. Within this field are such skills as composite drawing, crime scene sketching, image modification and image identification, courtroom drawings, demonstrative evidence, and postmortem and facial approximation aids

https://en.wikipedia.org/wiki/Forensic_arts

Data Recovery

• TestDisk

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy. 
http://www.cgsecurity.org/wiki/TestDisk

• ddrescue is frequently recommended for hard drive cloning, as it is a powerful, free data recovery utility and included by default in many Linux distributions

it doesn’t truncate files or write zeroes to its output file, it can be run successively to fill in bad sectors that were missed in earlier passes.
it is an effective option for restoring low-priority data from a failing hard disk.
ddrescue should not be used on hard drives that make excessive sounds or that show any other signs of permanent damage
Before starting this process, you will need a copy of ddrescue (preferably on a CD or DVD), a fully functional hard drive, and the damaged drive. 

To image from disk to disk:
root# ddrescue -f -n /dev/[baddrive] /dev/[gooddrive] /root/recovery.log


To image from disk to image file:
root# ddrescue -f -n /dev/[baddrive] /root/[imagefilename].img /root/recovery.log

https://datarecovery.com/rd/how-to-clone-hard-disks-with-ddrescue/

• a system rescue disk for Linux that can be used as a bootable USB stick or CD.

http://www.system-rescue-cd.org/

• Data recovery techniques are used to recover information that has been deleted or compromised

Data recovery techniques are often a major part of computer forensics.
When data is removed from a system it is either deleted or overwritten.
Just because a file is deleted that does not mean the data is gone. 
The Operating System simply removes the pointer from the file, but the data is still there

Data is recorded onto magnetic media by using ones and zeroes.
When the data is overwritten, the disk will only detect the new data leaving only remnants of the old data
The time to read the remnants would be very time consuming and all the old data would not be read correctly.
This would cause a very problematic and impossible puzzle to solve


Techniques
Perform a forensic analysis of the computer
Search for one file or a single file type
Attack encryption methods
Restore disk using an existing image
Examine data in RAM
Examine disk at the cluster or sector level
Analyze data using hex editor
Create hash of entire disk,Export for use in another tool

Types of Damage
Physical Damage
Logical Damage

Logical damage is primarily caused by power outages that does not allow the file to be completely written to the storage device.
Some Results are:
File is left in an inconsistent state
DATA totally lost
Cause the system to crash
Strange behavior
Partial storage

Methods exist than can make data recovery very difficult or impossible.
These methods should be used to secure financial information, medical records, or classified data

Techniques to Prevent Recovery
Write over deleted space with random data
1s and 0s
Make space appear random
Use a unique or uncommon algorithm
Some recovery tools can reverse the algorithm and recover the data

Use a tool to “wipe” data securely
Automates process of covering up deleted data
Tools are available to End User
Sometimes included with security software suites

Data Recovery Techniques
Florida State University
CIS 4360 – Computer Security
Fall 2006
https://www.google.com.tr/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwiar9OagYnXAhWjQZoKHeGKBmUQFggnMAA&url=http%3A%2F%2Fwww.cs.fsu.edu%2F~burmeste%2FCIS4360%2FFall2006%2FprojectPresentations%2FDataRecoveryTeq.ppt&usg=AOvVaw1TEZ2Rd2b52q0IQmvzgNxN

windows tools

• Portqry.exe is a command-line utility that you can use to help troubleshoot TCP/IP connectivity issues. Portqry.exe runs on Windows 2000-based computers, on Windows XP-based computers, and on Windows Server 2003-based computers. The utility reports the port status of TCP and UDP ports on a computer that you select.

https://support.microsoft.com/en-us/help/310099/description-of-the-portqry.exe-command-line-utility

• NBLookup is a command line diagnostic tool that uses the User Datagram Protocol (UDP) to send NetBIOS name queries to Microsoft Windows Internet Naming Service (WINS) servers. NBLookup requires TCP/IP version 4 to run. WINS servers accept name resolution requests on UDP port 137.

https://support.microsoft.com/en-us/help/830578/nblookup.exe-command-line-tool

Enabling and Managing the Active Directory Recycle Bin Using Active Directory Administrative Center

• Capabilities

    The Windows Server 2012 Active Directory Administrative Center enables you to configure and manage the Active Directory Recycle Bin for any domain partition in a forest. There is no longer a requirement to use Windows PowerShell or Ldp.exe to enable the Active Directory Recycle Bin or restore objects in domain partitions.
    The Active Directory Administrative Center has advanced filtering criteria, making targeted restoration easier in large environments with many intentionally deleted objects. 
Limitations
    Because the Active Directory Administrative Center can only manage domain partitions, it cannot restore deleted objects from the Configuration, Domain DNS, or Forest DNS partitions (you cannot delete objects from the Schema partition). To restore objects from non-domain partitions, use Restore-ADObject.
    The Active Directory Administrative Center cannot restore sub-trees of objects in a single action. For example, if you delete an OU with nested OUs, users, groups, and computers, restoring the base OU does not restore the child objects. 
    https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/adac/advanced-ad-ds-management-using-active-directory-administrative-center--level-200-

Flexible Single Master Operator (FSMOwi)

• FSMO

Acronym for Flexible Single Master Operator. These are roles that are assigned only to designated domain controllers, either one in each domain, or one in the forest. The five FSMO roles are:

    Schema Master (one for the forest)
    Domain Naming Master (one for the forest)
    PDC Emulator (one for each domain)
    RID Master (one for each domain)
    Infrastructure Master (one for each domain)

Schema Master
The Schema Master role holder is the domain controller that can make changes to the Schema. One domain controller in the forest must hold this role. One of the five Flexible Single Master Operator roles (FSMO).

 
Infrastructure Master
The Infrastructure Master role holder is the domain controller that maintains references, called phantoms, to objects in other domains. One domain controller in each domain must hold this role. One of the five Flexible Single Master Operator (FSMO) roles.

RID Master
The RID Master role holder is the domain controller responsible for assigning pools of RID's to all domain controllers in the domain. A RID is required whenever a security principal is created in Active Directory. One domain controller in each domain must hold this role. One of the five Flexible Single Master Operator roles (FSMO).
Security Principal
An object in Active Directory to which security can be applied. A security principal must have the objectSID attribute, so it can be the trustee in an Access Control Entry (ACE).
RID
Acronym for Relative IDentifier. All security principals (users, computers, and groups) in Active Directory have a Security ID (SID). SID values include several components, including the RID. The SID without the RID is the same for all objects in a domain. The RID value uniquely identifies the object in the domain

PDC Emulator
The PDC Emulator role holder acts as the Windows NT Primary Domain Controller (PDC) for backward compatibility. It also is used to forward password changes immediately to other domain controllers and serves as the primary time source for the domain. The PDC Emulator is also targeted by most Group Policy tools. One domain controller in each domain must hold this role. One of the five Flexible Single Master Operator roles (FSMO).

Domain Naming Master
The Domain Naming Master role holder is the domain controller that controls changes to the forest-wide namespace. One of the five Flexible Single Master Operator (FSMO) roles. The domain controller with this role can add, remove, rename, or move domains in the forest. It is also required to create application partitions. One domain controller in the forest must hold this role.
http://social.technet.microsoft.com/wiki/contents/articles/16757.active-directory-glossary.aspx#FSMO

• How to find out who has your FSMO Roles?

1-The easy way:
NetDOM /query FSMO

2-The Common way:
How to Determine the RID, PDC, and Infrastructure FSMO Holders of a Selected Domain
1. Click Start, click Run, type dsa.msc, and then click OK.
2. Right-click the selected Domain Object in the top left pane, and then click Operations Masters.
3. Click the PDC tab to view the server holding the PDC master role.
4. Click the Infrastructure tab to view the server holding the Infrastructure master role.
5. Click the RID Pool tab to view the server holding the RID master role.

How to Determine the Schema FSMO Holder in a Forest
1. Click Start, click Run, type mmc, and then click OK.
2. On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Schema, click Close, and then click OK.
3. Right-click Active Directory Schema in the top left pane, and then click Operations Masters to view the server holding the schema master role.
NOTE: For the Active Directory Schema snap-in to be available, you may have to register the Schmmgmt.dll file. To do this, click Start, click Run, type regsvr32 schmmgmt.dll in the Open box, and then click OK. A message is displayed that states the registration was successful.

How to Determine the Domain Naming FSMO Holder in a Forest
1. Click Start, click Run, type mmc, and then click OK.
2. On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Domains and Trusts, click Close, and then click OK.
3. In the left pane, click Active Directory Domains and Trusts.
4. Right-click Active Directory Domains and Trust, and then click Operations Master to view the server holding the domain naming master role in the Forest.


https://blogs.technet.microsoft.com/mempson/2007/11/08/how-to-find-out-who-has-your-fsmo-roles

• How To Find Servers That Hold Flexible Single Master Operations Roles

    How to Determine the RID, PDC, and Infrastructure FSMO Holders of a Selected Domain
    How to Determine the Schema FSMO Holder in a Forest
    How to Determine the Domain Naming FSMO Holder in a Forest
    Using the Windows 2000 Server Resource Kit
    Using the NTDSUTIL Tool
    Using DCDIAG
https://support.microsoft.com/en-us/kb/234790

• the domain controller that actually performs a single master operation is the

domain controller that currently holds the operation’s token, or the “role holder.”
An operation token, and thus the role, can be transferred easily to another domain
controller without a reboot.

AD DS contains five operations master roles. Two roles are performed for the
entire forest, and two roles are performed by three roles for each domain.
Forest Roles (two roles):

    Domain naming
    Schema

Domain Roles (three roles):

    Relative identifier (RID)
    Infrastructure
    PDC Emulator


RID Master Role
Because any domain controller can create
accounts, and therefore, SIDs, a mechanism is necessary to ensure that the SIDs
generated by a DC are unique. Active Directory domain controllers generate SIDs
by assigning a unique RID to the domain SID. The RID master for the domain
allocates pools of unique RIDs to each domain controller in the domain. Thus,
each domain controller can be confident that the SIDs it generates are unique.
Note:

The RID master role is like DHCP for SIDs. If you are familiar with the concept that
you allocate a scope of IP addresses for the Dynamic Host Configuration Protocol (DHCP) server to assign to clients, you can draw a parallel to the RID master, which allocates pools of RIDs to domain controllers for the creation of SIDs

Infrastructure Master Role
In a multidomain environment, it’s common for an object to reference objects in other domains. For example, a group can include members from another domain
You can think of the infrastructure master as a tracking device for group members from other domains. When those members are renamed or moved in the other domain, the infrastructure master identifies the change and makes appropriate changes to group memberships so that the memberships are kept up to date.

This role only pertains in a multi-domain forest. The infrastructure master if running on the same DC as a GC, will conflict and cause the infrastructure master role to fail its intended purpose


PDC Emulator Role
 Emulates a Primary Domain Controller (PDC) for backward compatibility

 Participates in special password update handling for the domain
  If a user attempts to log on immediately after
changing passwords, the domain controller responding to the user’s logon
request might not know about the new password. Before it rejects the logon
attempt, that domain controller forwards the authentication request to a PDC
emulator, which verifies that the new password is correct and instructs the
domain controller to accept the logon request

 Manages Group Policy updates within a domain
  When you open a GPO in
the Group Policy Management Editor (GPME), the GPME binds to the domain
controller performing the PDC emulator role. Therefore, all changes to GPOs
are made on the PDC emulator by default.

Provides a master time source for the domain
Active Directory, Kerberos, File Replication Service (FRS), and DFS-R each rely
on timestamps, so synchronizing the time across all systems in a domain is
crucial. The PDC emulator in the forest root domain is the time master for the
entire forest, by default. The PDC emulator in each domain synchronizes its
time with the forest root PDC emulator. Other domain controllers in the
domain synchronize their clocks against that domain’s PDC emulator. All
other domain members synchronize their time with their preferred domain
controller. This hierarchical structure of time synchronization, all implemented
through the Win32Time service, ensures consistency of time. Universal
Coordinated Time (UTC) is synchronized, and the time displayed to users is
adjusted based on the time zone setting of the computer.
 
http://blogs.msmvps.com/acefekay/2011/01/16/active-directory-fsmo-roles-explained

• Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools:

Active Directory Schema snap-in
Active Directory Domains and Trusts snap-in
Active Directory Users and Computers snap-in
https://support.microsoft.com/en-us/kb/324801