BlackHat资料us-14-Castle-GRR-Find-All-The-Badness-Collect-All-The-Things.pdfVIP

GRR: Find all the badness, collect all the things Greg Castle, Blackhat 2014 Who am I GRR Developer, Google IR team OS X Security Former lives: pentesting, IR, security audits etc. Why live forensics? “We saw a HTTP request for evil domain/IP/content from Joe’s machine” “We saw a HTTP request for evil domain/IP/content from Joe’s machine” Joe is on vacation with 3G internet “New malware report BAZOOKA BEAR EAGLE SHARK LASER is out: check all the things” “New malware report BAZOOKA BEAR EAGLE SHARK LASER is out: check all the things” 50+ IOCs for Win/Mac and “all the things” is the machines of a highly mobile global organisation with 50k+ employees GRR: GRR Rapid Response Open source live forensics for Win/Mac/Linux Scalable Access to raw memory, raw disk Stable, low-impact client: Mem/CPU/Net limits 2-party authorization workflow Hunting, binary collection much more…. “We saw a HTTP request for evil domain/IP/content from Joe’s machine” Joe is on vacation with 3G internet SANS: “a combination of description, location, and interpretation” I prefer “that stuff I want” Chrom(e|ium), Firefox, IE, Safari: 3 OSes %%users.localappdata%%\Google\Chrome\User Data\*\Archived History %%users.localappdata%%\Microsoft\Windows\Temporary Internet Files\Content. IE5\index.dat %%users.localappdata%%\Google\Chrome\User Data\*\History %%users.localappdata%%\Microsoft\Windows\Temporary Internet %%users.localappdata%%\Chromium\User Data\*\Archived History Files\Low\Content.IE5\index.dat %%users.localappdata%%\Chr