Hooktracer: Automatic Detection and Analysis of Keystroke Loggers Using Memory Forensics
Hooktracer: Automatic Detection and Analysis of Keystroke Loggers Using Memory Forensics
复制标题
DOI：
10.1016/j.cose.2020.101872
复制
发表时间：
2020-09-01
影响因子：
5.6
通讯作者：
Richard, Golden G., III
中科院分区：
文献类型：
--
作者：
Case, Andrew;Maggio, Ryan D.;Richard, Golden G., III
恶意软件开发的进步导致广泛使用攻击者工具包，这些工具包不会在本地文件系统中留下任何跟踪。这对依赖文件系统分析重建攻击者活动的传统调查程序产生负面影响。作为解决方案，内存取证替换了这些情况下的文件系统分析。不幸的是，现有的内存法医工具给最有经验的调查员以外的所有能力都无法访问，这些功能都擅长于操作系统内部和反向工程。本文所描述的研究的目的是调查组织面临的最大威胁之一，Userland Keyloggers，较少错误的错误，并且较少依赖手动反向工程。为了实现这一目标，我们为Hooktracer添加了重要的新功能，该引擎能够模拟在物理内存捕获中发现的代码并记录模拟代码采取的所有操作。基于这项工作，我们提出了新的内存取证能力，该功能体现在新的波动式插件，hooktracer_messagehooks中，该插件使用钩状钩自动确定内存中的挂钩是否与恶意键盘和良性软件相关联。我们还包括一个详细的案例研究，该研究说明了我们技术成功分析非常复杂的钥匙记录员（例如Turla）的能力。 （c）2020 Elsevier Ltd.保留所有权利。
Advances in malware development have led to the widespread use of attacker toolkits that do not leave any trace in the local filesystem. This negatively impacts traditional investigative procedures that rely on filesystem analysis to reconstruct attacker activities. As a solution, memory forensics has replaced filesystem analysis in these scenarios. Unfortunately, existing memory forensics tools leave many capabilities inaccessible to all but the most experienced investigators, who are well versed in operating systems internals and reverse engineering. The goal of the research described in this paper is to make investigation of one of the greatest threats that organizations face, userland keyloggers, less error-prone and less dependent on manual reverse engineering. To accomplish this, we have added significant new capabilities to HookTracer, which is an engine capable of emulating code discovered in a physical memory captures and recording all actions taken by the emulated code. Based on this work, we present new memory forensics capabilities, embodied in a new Volatility plugin, hooktracer_messagehooks, that uses Hooktracer to automatically decide whether a hook in memory is associated with a malicious keylogger or benign software. We also include a detailed case study that illustrates our technique's ability to successfully analyze very sophisticated keyloggers, such as Turla. (C) 2020 Elsevier Ltd. All rights reserved.