Researchers describe tool that manipulates RAM, misleads cybercrime investigators

mattdocs12345 · Jan 27, 2014

Williams said:

ADD allows an attacker to preposition fake files, network connections, and processes in memory. If the computer is confiscated, and a memory dump obtained by a forensic analyst: the fake artifacts could send the analyst on a wild goose chase searching for files that do not exist. A much scarier proposition is that an attacker might insert fake artifacts that attribute the attack to another cybercrime group or nation state. The mere existence of anti-forensics tools like ADD is an alert that analysts need to validate their findings. Some researchers commented about the possibility of forging artifacts in memory at BlackHat in 2007. But as far as I know, nobody has built a publicly available tool capable of doing so until now.
Click to expand...

I love that cat and mouse game. Interesting read. Here is the original source.

noone_particular · Jan 27, 2014

Interesting indeed. Their existence on a system opens up a few more possibilities, especially if the tools are "found" in a hidden partition or an ADS, like a claim of planted evidence.

Log in or Sign up

Researchers describe tool that manipulates RAM, misleads cybercrime investigators

mattdocs12345 Registered Member

noone_particular Registered Member

Log in or Sign up

Researchers describe tool that manipulates RAM, misleads cybercrime investigators

mattdocs12345 Registered Member

noone_particular Registered Member

Useful Searches