1 1 00:00:00,810 --> 00:00:03,480 Virtualization Forensics. 2 2 00:00:03,480 --> 00:00:06,510 Now, in previous lessons we've talked about forensics, 3 3 00:00:06,510 --> 00:00:09,420 and from your Security+ studies and your A+ studies 4 4 00:00:09,420 --> 00:00:11,730 you should know all about virtualization. 5 5 00:00:11,730 --> 00:00:14,220 But in this lesson, we're going to put the two together, 6 6 00:00:14,220 --> 00:00:16,020 because when we deal with applications, 7 7 00:00:16,020 --> 00:00:18,750 oftentimes they're being run inside some sort of 8 8 00:00:18,750 --> 00:00:21,870 a containerization or virtualization environment. 9 9 00:00:21,870 --> 00:00:23,460 Now, virtualization provides 10 10 00:00:23,460 --> 00:00:25,050 numerous security challenges 11 11 00:00:25,050 --> 00:00:26,580 that we have to mitigate against 12 12 00:00:26,580 --> 00:00:30,540 as a cybersecurity analyst or a cybersecurity engineer. 13 13 00:00:30,540 --> 00:00:31,890 Some of these challenges include 14 14 00:00:31,890 --> 00:00:33,720 process and memory analysis, 15 15 00:00:33,720 --> 00:00:35,610 persistent data acquisition, 16 16 00:00:35,610 --> 00:00:39,810 file-carving-deleted VM disk images, and lost system logs. 17 17 00:00:39,810 --> 00:00:42,240 Let's talk about each of these in this lesson. 18 18 00:00:42,240 --> 00:00:44,940 First, process and memory analysis. 19 19 00:00:44,940 --> 00:00:48,120 This can be performed by a VM introspection 20 20 00:00:48,120 --> 00:00:51,180 or analyzing save state files. 21 21 00:00:51,180 --> 00:00:52,770 Now, what does this mean? 22 22 00:00:52,770 --> 00:00:56,610 Well, when you start looking at VM introspection, or VMI, 23 23 00:00:56,610 --> 00:00:58,200 this is going to use tools installed 24 24 00:00:58,200 --> 00:01:00,990 inside the hypervisor to retrieve pages 25 25 00:01:00,990 --> 00:01:03,360 of memory for later analysis. 26 26 00:01:03,360 --> 00:01:05,190 There are programs inside the VM 27 27 00:01:05,190 --> 00:01:08,310 that can provide information about other processes in it. 28 28 00:01:08,310 --> 00:01:11,010 This information may be sent through a network interface 29 29 00:01:11,010 --> 00:01:13,770 or some other virtual device like a serial port. 30 30 00:01:13,770 --> 00:01:15,360 There are lots of different examples 31 31 00:01:15,360 --> 00:01:16,710 of these type of programs. 32 32 00:01:16,710 --> 00:01:20,280 For instance, WinDbg and GDB will both serve 33 33 00:01:20,280 --> 00:01:22,140 to interact with the remote debuggers 34 34 00:01:22,140 --> 00:01:24,180 and send that information over. 35 35 00:01:24,180 --> 00:01:26,490 Now, there are other VMI tools out there, 36 36 00:01:26,490 --> 00:01:28,260 and a lot of these tools can be implemented 37 37 00:01:28,260 --> 00:01:30,480 within the virtual machine monitor itself 38 38 00:01:30,480 --> 00:01:32,130 or that hypervisor. 39 39 00:01:32,130 --> 00:01:34,980 This can contain information and capture it for you, 40 40 00:01:34,980 --> 00:01:36,750 such as the contents of the memory 41 41 00:01:36,750 --> 00:01:38,610 from that virtual machine. 42 42 00:01:38,610 --> 00:01:40,770 Then, this data can be interpreted 43 43 00:01:40,770 --> 00:01:43,710 to understand the processes inside the system. 44 44 00:01:43,710 --> 00:01:46,620 One of the most popular tools for such an interpretation 45 45 00:01:46,620 --> 00:01:49,530 is the volatility framework that we've mentioned before 46 46 00:01:49,530 --> 00:01:51,660 when we talked about memory capture. 47 47 00:01:51,660 --> 00:01:53,550 This framework is going to contain profiles 48 48 00:01:53,550 --> 00:01:55,620 for many popular operating systems, 49 49 00:01:55,620 --> 00:01:57,510 and you can extract different information, 50 50 00:01:57,510 --> 00:02:00,210 like process trees or lists of kernel objects 51 51 00:02:00,210 --> 00:02:02,160 from within those virtual machines 52 52 00:02:02,160 --> 00:02:05,760 by using virtual introspection or VMI. 53 53 00:02:05,760 --> 00:02:07,380 Now, the other way we can do this 54 54 00:02:07,380 --> 00:02:09,210 is by going and capturing information 55 55 00:02:09,210 --> 00:02:11,490 from saved state files. 56 56 00:02:11,490 --> 00:02:12,840 These are files that are written 57 57 00:02:12,840 --> 00:02:14,730 when you suspend a virtual machine, 58 58 00:02:14,730 --> 00:02:17,940 and if you take these suspended virtual machine memory files 59 59 00:02:17,940 --> 00:02:20,220 and load them into a memory analysis tool 60 60 00:02:20,220 --> 00:02:21,900 like the volatility framework, 61 61 00:02:21,900 --> 00:02:24,000 you can then go through that memory 62 62 00:02:24,000 --> 00:02:25,590 and be able to use it just as if you 63 63 00:02:25,590 --> 00:02:27,690 had done a live memory capture. 64 64 00:02:27,690 --> 00:02:30,210 This is one of the nice things about a virtual machine. 65 65 00:02:30,210 --> 00:02:33,000 When you pause that virtual machine and you suspend it 66 66 00:02:33,000 --> 00:02:35,430 anything running a memory is instantly saved 67 67 00:02:35,430 --> 00:02:38,010 into one of these saved state files. 68 68 00:02:38,010 --> 00:02:39,750 Now, the next thing we have to think about 69 69 00:02:39,750 --> 00:02:42,450 is how are we going to capture persistent data? 70 70 00:02:42,450 --> 00:02:44,190 And this persistent data acquisition 71 71 00:02:44,190 --> 00:02:46,050 is something we have to consider. 72 72 00:02:46,050 --> 00:02:48,787 This is the "acquiring of data from persistent devices 73 73 00:02:48,787 --> 00:02:50,437 "such as virtual hard drives 74 74 00:02:50,437 --> 00:02:52,807 "or other virtualized mass storage devices 75 75 00:02:52,807 --> 00:02:54,840 "to an image-based format." 76 76 00:02:54,840 --> 00:02:57,660 Now, when I dealt with a standard laptop or desktop, 77 77 00:02:57,660 --> 00:02:59,520 I could take the hard drive out 78 78 00:02:59,520 --> 00:03:02,940 and plug it into an imaging machine to make an image format 79 79 00:03:02,940 --> 00:03:04,860 and be able to use that for my analysis. 80 80 00:03:04,860 --> 00:03:06,750 But if I'm dealing with a virtual machine, 81 81 00:03:06,750 --> 00:03:08,820 there is no physical hard drive, 82 82 00:03:08,820 --> 00:03:11,310 just an image file that is being created 83 83 00:03:11,310 --> 00:03:12,810 on this virtual machine. 84 84 00:03:12,810 --> 00:03:13,980 And so we have to have a way 85 85 00:03:13,980 --> 00:03:16,170 to persistently capture that data. 86 86 00:03:16,170 --> 00:03:17,430 Now, it is still necessary 87 87 00:03:17,430 --> 00:03:20,610 for us to follow forensic procedures to preserve that data 88 88 00:03:20,610 --> 00:03:22,170 as original evidence, 89 89 00:03:22,170 --> 00:03:24,270 but we do want to get an image of it 90 90 00:03:24,270 --> 00:03:26,580 so that we can do our analysis of it. 91 91 00:03:26,580 --> 00:03:28,350 Now, one of the ways we can do this 92 92 00:03:28,350 --> 00:03:30,900 is we can capture a bit by bit copy 93 93 00:03:30,900 --> 00:03:33,720 of the virtual machine's virtual hard drive, 94 94 00:03:33,720 --> 00:03:36,450 because that virtual hard drive is already a file 95 95 00:03:36,450 --> 00:03:38,280 sitting on the host computer. 96 96 00:03:38,280 --> 00:03:41,580 So if I do a bit by bit copy of the host computer 97 97 00:03:41,580 --> 00:03:43,650 I can then have, as part of that, 98 98 00:03:43,650 --> 00:03:46,020 that virtual machine image as well. 99 99 00:03:46,020 --> 00:03:48,900 Or, I can just copy that virtual machine image 100 100 00:03:48,900 --> 00:03:50,940 and do it in a forensically sound method. 101 101 00:03:50,940 --> 00:03:52,170 And that way I don't have to 102 102 00:03:52,170 --> 00:03:53,940 even shut down the full computer, 103 103 00:03:53,940 --> 00:03:56,040 because I just need to shut down that virtual machine 104 104 00:03:56,040 --> 00:03:57,660 and capture that image file. 105 105 00:03:57,660 --> 00:03:59,400 The next area that we have to consider 106 106 00:03:59,400 --> 00:04:03,240 is file carving of deleted virtual machine disc images. 107 107 00:04:03,240 --> 00:04:05,490 Now, file carving of these virtual machine's 108 108 00:04:05,490 --> 00:04:08,760 virtualized hard drives, can help us to identify files 109 109 00:04:08,760 --> 00:04:13,110 in the unallocated and slack space of those disc images. 110 110 00:04:13,110 --> 00:04:16,860 Now, the challenge with file carving deleted VM disc images 111 111 00:04:16,860 --> 00:04:18,630 is that these virtual machine hosts 112 112 00:04:18,630 --> 00:04:22,350 utilize proprietary file formats or file systems. 113 113 00:04:22,350 --> 00:04:25,590 For example, if you're using VMware it uses the VMFS, 114 114 00:04:25,590 --> 00:04:29,580 instead of something like NTFS that Windows uses by default. 115 115 00:04:29,580 --> 00:04:32,820 This can make disc analysis much more difficult for us, 116 116 00:04:32,820 --> 00:04:35,670 and so we often have to rely on file carving. 117 117 00:04:35,670 --> 00:04:38,460 Now, file carving can be used to reconstruct files 118 118 00:04:38,460 --> 00:04:41,970 that have been fragmented across the host file system, 119 119 00:04:41,970 --> 00:04:43,470 and that can actually be made up 120 120 00:04:43,470 --> 00:04:46,470 of parts of different virtual machine images, too. 121 121 00:04:46,470 --> 00:04:49,290 So it does make our challenge a lot harder here 122 122 00:04:49,290 --> 00:04:52,560 when we're trying to do file carving across these systems. 123 123 00:04:52,560 --> 00:04:54,480 Now the final area that we have to consider 124 124 00:04:54,480 --> 00:04:56,640 is lost system logs. 125 125 00:04:56,640 --> 00:04:59,280 Now this happens because virtual machines are optimized 126 126 00:04:59,280 --> 00:05:00,690 to spin up when they're needed 127 127 00:05:00,690 --> 00:05:02,640 and then destroyed when they're no longer needed. 128 128 00:05:02,640 --> 00:05:04,470 This is known as elasticity, 129 129 00:05:04,470 --> 00:05:06,930 as you learned all the way back in A+. 130 130 00:05:06,930 --> 00:05:08,490 Now, this is great for operations, 131 131 00:05:08,490 --> 00:05:10,800 but this is horrible for security, 132 132 00:05:10,800 --> 00:05:14,100 because as security analysts those logs that we rely on 133 133 00:05:14,100 --> 00:05:15,720 are now being destroyed, too, 134 134 00:05:15,720 --> 00:05:17,940 because if a new Windows machine was spun up 135 135 00:05:17,940 --> 00:05:19,560 and its event logs are then destroyed 136 136 00:05:19,560 --> 00:05:22,590 when that machine is destroyed, we lose access to that. 137 137 00:05:22,590 --> 00:05:24,300 So we need to make sure that we're 138 138 00:05:24,300 --> 00:05:27,120 configuring virtual machines to log those events 139 139 00:05:27,120 --> 00:05:28,950 to a remote logging server 140 140 00:05:28,950 --> 00:05:30,960 to prevent the system logs from being lost 141 141 00:05:30,960 --> 00:05:34,170 during the deprovisioning and that scaled down event 142 142 00:05:34,170 --> 00:05:37,110 that happens during the shrinking of elasticity. 143 143 00:05:37,110 --> 00:05:39,360 This is really important for us to consider 144 144 00:05:39,360 --> 00:05:42,570 and a big thing for us to remember inside virtualization, 145 145 00:05:42,570 --> 00:05:45,300 because if we don't configure this upfront in our systems 146 146 00:05:45,300 --> 00:05:46,830 as part of our architecture, 147 147 00:05:46,830 --> 00:05:49,020 we are not going to have the security data we need 148 148 00:05:49,020 --> 00:05:50,310 when a bad thing happens, 149 149 00:05:50,310 --> 00:05:52,590 and we have to go back and put together a timeline 150 150 00:05:52,590 --> 00:05:53,643 of all the events.