jetlib.sec » Tags » physical-memory

Feeds

133445 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

5 items tagged "physical memory"

Related tags: tor [+], privacy event [+], physical [+], memory analysis [+], filesystem [+], examination [+], black hat [+], andrew case [+], analysis [+], wlan [+], usa [+], sudo [+], memory [+], mac addresses [+], mac [+], ivs [+], forensics [+], evidence [+], digital evidence [+], digital [+], command [+], Wireless [+]

• January 16, 2012
• 21:33

  [Slides] Finding Digital Evidence in Physical Memory

   » ‎ SecDocs
  Authors: Mariusz Burdach
  Tags: forensic
  Event: Black Hat Federal 2006
  

  Tags:  digital evidence physical physical-memory digital-evidence black-hat  

• January 01, 2012
• 21:35

  [Slides] Physical Memory Forensics

   » ‎ SecDocs
  Authors: Mariusz Burdach
  Tags: forensic memory
  Event: Black Hat USA 2006
  

  Tags:  forensics memory physical usa physical-memory black-hat  

• April 12, 2011
• 11:36

  [Paper] De-Anonymizing Live CDs through Physical Memory Analysis

   » ‎ SecDocs
  Authors: Andrew Case
  Tags: Tor privacy
  Event: Black Hat DC 2011
  Abstract: Traditional digital forensics encompasses the examination of data from an offline or “dead” source such as a disk image. Since the filesystem is intact on these images, a number of forensics techniques are available for analysis such as file and metadata examination, timelining, deleted file recovery, indexing, and searching. Live CDs present a large problem for this forensics model though as they run solely in RAM and do not interact with the local disk. This removes the ability to perform an orderly examination since the filesystem is no longer readily available and putting random pages of data into context can be very difficult for in-depth investigations. In order to solve this problem, we present a number of techniques that allow for complete recovery of a live CD’s in-memory filesystem and partial recovery of its previously deleted contents. We also present memory analysis of the popular Tor application as it is used by a number of live CDs in an attempt to keep network communications encrypted and anonymous.

  Tags:  filesystem analysis examination andrew-case tor privacy-event memory-analysis physical-memory  

• 11:36

  [Slides] De-Anonymizing Live CDs through Physical Memory Analysis

   » ‎ SecDocs
  Authors: Andrew Case
  Tags: Tor privacy
  Event: Black Hat DC 2011
  Abstract: Traditional digital forensics encompasses the examination of data from an offline or “dead” source such as a disk image. Since the filesystem is intact on these images, a number of forensics techniques are available for analysis such as file and metadata examination, timelining, deleted file recovery, indexing, and searching. Live CDs present a large problem for this forensics model though as they run solely in RAM and do not interact with the local disk. This removes the ability to perform an orderly examination since the filesystem is no longer readily available and putting random pages of data into context can be very difficult for in-depth investigations. In order to solve this problem, we present a number of techniques that allow for complete recovery of a live CD’s in-memory filesystem and partial recovery of its previously deleted contents. We also present memory analysis of the popular Tor application as it is used by a number of live CDs in an attempt to keep network communications encrypted and anonymous.

  Tags:  filesystem analysis examination andrew-case tor privacy-event memory-analysis physical-memory  

• February 12, 2010
• 7:04

  WEP 128 Bit Crack problem!!

   » ‎ remote-exploit & backtrack
  hi all
  i tried to crack a friends WEP encrypted AP with airocrack-ng (command line , if any GUI exist plz let me know)
  i use this command :
  
  sudo airmon-ng start wlan0 5
  sudo airodump-ng --ivs -w Erix -c 5 wlan0
  sudo aireplay-ng -5 -b 00:00:00:00:00:00 -h 00:00:00:00:00:00 wlan0
  sudo aireplay-ng -1 0 -e Torkanet -a 00:00:00:00:00:00 -h00:00:00:00:00:00 wlan0
  
  (MAC addresses is diffrent but Ap is Torkanet :D & it is on channel 5)
  this is when no clients present!
  and this commands when we use a clients :
  
  sudo airmon-ng start wlan0 5
  sudo airodump-ng --ivs -w Erix -c 5 wlan0
  sudo aireplay-ng -0 10 -a 00:00:00:00:00:00 -c 00:00:00:00:00:00 wlan0
  sudo aireplay-ng -3 -b 00:00:00:00:00:00 -h 00:00:00:00:00:00 wlan0
  
  the problem is when aircrack-ng gots packegs it said ".....still nothing tring another package" it done this over and over and over till i ran low on physical memory :D!! what should i do?
  is our network secured enough?
  
  and other silly question is :D on this command :
  sudo aireplay-ng -5 -b 00:00:00:00:00:00 -h 00:00:00:00:00:00 wlan0
  
  which MAC address is mine and which is for Ap? (the same question goes for -3 option!!)
  by the way sry for my weak english!!:D

  Tags:  sudo command wlan mac physical-memory ivs mac-addresses Wireless