| |
Analysis of binaries found on compromised
systems
Francisco Jesus Monserrat Coll,
REDIRIS.
Tips to find malware binaries on
different Unix systems and how to perform a light analysis of the
assembler code to find configuration files and other binaries without
using a full forensic analysis. - Format:
Hands-on exercise.
- Bring your own laptop and wired
ethernet card.
- Capacity: 6-8
MD5 and SHA-1 in Evidence Files and tool
demonstration
Brian Wolfinger and Thomas Akin,
ISS
A discussion of the collision issues in MD5,
SHA-0 and SHA-1, their implications on the day to day work of forensic
examiners & IT security professionals, and suggestions for
avoiding pitfalls. Also includes a exercise with and demonstration of a
open source hashing tool written by Mr. Akin.
- Format: Presentation, exercise and demonstration
- Handouts: Students will receive a copy of the
CDROM
- Capacity: 8-10 students
Malware analysis
Steve Romig,
Ohio State University
How to investigate malicious
software with general tools like VMware, various web resources, a
variety of common tools (like tcpdump, ethereal, flow-tools and so on)
and possibly dissassemblers and debuggers. This is illustrated with a
walk through an incident that occurred early in 2002 where some
"unknown" malicious software was found on OSU
systems. - Format: Hands-on. Students can
use their own Linux laptop (Redhat 8 or 9 with BIND, Apache, FTP and
VMware) or can use one of a few laptops that Steve Romig arranges
for.
- Handouts: CDs with Vmware images and config
files.
- Capacity: about 8 students
Introduction to Windows Online Forensics
(WOLF)
Rob Hensing, Microsoft
This is a follow-up on Robert Hensing's TC presentation about
rootkit detection on live systems and on-line incident response using a
live
response toolkit. -
Format: Demonstration, possibly some hands-on opportunity.
- Capacity: any number of students
|
