Instructor: Virtualization Forensics. 2 2
Now, in previous lessons we've talked about forensics, 3 3
and from your Security+ studies and your A+ studies 4 4
you should know all about virtualization. 5 5
But in this lesson, we're going to put the two together, 6 6
because when we deal with applications, 7 7
oftentimes they're being run inside some sort of 8 8
a containerization or virtualization environment. 9 9
Now, virtualization provides 10 10
numerous security challenges 11 11
that we have to mitigate against 12 12
as a cybersecurity analyst or a cybersecurity engineer. 13 13
Some of these challenges include 14 14
process and memory analysis, 15 15
persistent data acquisition, 16 16
file-carving-deleted VM disk images, and lost system logs. 17 17
Let's talk about each of these in this lesson. 18 18
First, process and memory analysis. 19 19
This can be performed by a VM introspection 20 20
or analyzing save state files. 21 21
Now, what does this mean? 22 22
Well, when you start looking at VM introspection, or VMI, 23 23
this is going to use tools installed 24 24
inside the hypervisor to retrieve pages 25 25
of memory for later analysis. 26 26
There are programs inside the VM 27 27
that can provide information about other processes in it. 28 28
This information may be sent through a network interface 29 29
or some other virtual device like a serial port. 30 30
There are lots of different examples 31 31
of these type of programs. 32 32
For instance, WinDbg and GDB will both serve 33 33
to interact with the remote debuggers 34 34
and send that information over. 35 35
Now, there are other VMI tools out there, 36 36
and a lot of these tools can be implemented 37 37
within the virtual machine monitor itself 38 38
or that hypervisor. 39 39
This can contain information and capture it for you, 40 40
such as the contents of the memory 41 41
from that virtual machine. 42 42
Then, this data can be interpreted 43 43
to understand the processes inside the system. 44 44
One of the most popular tools for such an interpretation 45 45
is the volatility framework that we've mentioned before 46 46
when we talked about memory capture. 47 47
This framework is going to contain profiles 48 48
for many popular operating systems, 49 49
and you can extract different information, 50 50
like process trees or lists of kernel objects 51 51
from within those virtual machines 52 52
by using virtual introspection or VMI. 53 53
Now, the other way we can do this 54 54
is by going and capturing information 55 55
from saved state files. 56 56
These are files that are written 57 57
when you suspend a virtual machine, 58 58
and if you take these suspended virtual machine memory files 59 59
and load them into a memory analysis tool 60 60
like the volatility framework, 61 61
you can then go through that memory 62 62
and be able to use it just as if you 63 63
had done a live memory capture. 64 64
This is one of the nice things about a virtual machine. 65 65
When you pause that virtual machine and you suspend it 66 66
anything running a memory is instantly saved 67 67
into one of these saved state files. 68 68
Now, the next thing we have to think about 69 69
is how are we going to capture persistent data? 70 70
And this persistent data acquisition 71 71
is something we have to consider. 72 72
This is the "acquiring of data from persistent devices 73 73
"such as virtual hard drives 74 74
"or other virtualized mass storage devices 75 75
"to an image-based format." 76 76
Now, when I dealt with a standard laptop or desktop, 77 77
I could take the hard drive out 78 78
and plug it into an imaging machine to make an image format 79 79
and be able to use that for my analysis. 80 80
But if I'm dealing with a virtual machine, 81 81
there is no physical hard drive, 82 82
just an image file that is being created 83 83
on this virtual machine. 84 84
And so we have to have a way 85 85
to persistently capture that data. 86 86
Now, it is still necessary 87 87
for us to follow forensic procedures to preserve that data 88 88
as original evidence, 89 89
but we do want to get an image of it 90 90
so that we can do our analysis of it. 91 91
Now, one of the ways we can do this 92 92
is we can capture a bit by bit copy 93 93
of the virtual machine's virtual hard drive, 94 94
because that virtual hard drive is already a file 95 95
sitting on the host computer. 96 96
So if I do a bit by bit copy of the host computer 97 97
I can then have, as part of that, 98 98
that virtual machine image as well. 99 99
Or, I can just copy that virtual machine image 100 100
and do it in a forensically sound method. 101 101
And that way I don't have to 102 102
even shut down the full computer, 103 103
because I just need to shut down that virtual machine 104 104
and capture that image file. 105 105
The next area that we have to consider 106 106
is file carving of deleted virtual machine disc images. 107 107
Now, file carving of these virtual machine's 108 108
virtualized hard drives, can help us to identify files 109 109
in the unallocated and slack space of those disc images. 110 110
Now, the challenge with file carving deleted VM disc images 111 111
is that these virtual machine hosts 112 112
utilize proprietary file formats or file systems. 113 113
For example, if you're using VMware it uses the VMFS, 114 114
instead of something like NTFS that Windows uses by default. 115 115
This can make disc analysis much more difficult for us, 116 116
and so we often have to rely on file carving. 117 117
Now, file carving can be used to reconstruct files 118 118
that have been fragmented across the host file system, 119 119
and that can actually be made up 120 120
of parts of different virtual machine images, too. 121 121
So it does make our challenge a lot harder here 122 122
when we're trying to do file carving across these systems. 123 123
Now the final area that we have to consider 124 124
is lost system logs. 125 125
Now this happens because virtual machines are optimized 126 126
to spin up when they're needed 127 127
and then destroyed when they're no longer needed. 128 128
This is known as elasticity, 129 129
as you learned all the way back in A+. 130 130
Now, this is great for operations, 131 131
but this is horrible for security, 132 132
because as security analysts those logs that we rely on 133 133
are now being destroyed, too, 134 134
because if a new Windows machine was spun up 135 135
and its event logs are then destroyed 136 136
when that machine is destroyed, we lose access to that. 137 137
So we need to make sure that we're 138 138
configuring virtual machines to log those events 139 139
to a remote logging server 140 140
to prevent the system logs from being lost 141 141
during the deprovisioning and that scaled down event 142 142
that happens during the shrinking of elasticity. 143 143
This is really important for us to consider 144 144
and a big thing for us to remember inside virtualization, 145 145
because if we don't configure this upfront in our systems 146 146
as part of our architecture, 147 147
we are not going to have the security data we need 148 148
when a bad thing happens, 149 149
and we have to go back and put together a timeline 150 150
of all the events.