Quantifying Windows File Slack Size and Stability

Mulazzani, Martin; Neuner, Sebastian; Kieseberg, Peter; Huber, Markus; Schrittwieser, Sebastian; Weippl, Edgar

doi:10.1007/978-3-642-41148-9_13

Cited by 6 publications

(3 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, an 8 bit value allocated in a 16 bit boundary system, would result in 8 bits of unused memory. This is a concept similar to the use of file slack space for hiding data, and is used in tools such as bmap ( Mulazzani et al, 2013 ).…”

Section: Attack 3: a Novel Storage Based Covert Channelmentioning

confidence: 99%

PCaaD: Towards automated determination and exploitation of industrial systems

Green

Derbyshire

Krotofil

et al. 2021

Computers & Security

View full text Add to dashboard Cite

Over the last decade, Programmable Logic Controllers (PLCs) have been increasingly targeted by attackers to obtain control over industrial processes that support critical services. Such targeted attacks typically require detailed knowledge of system-specific attributes, including hardware configurations, adopted protocols, and PLC control-logic, i.e., process comprehension. The consensus from both academics and practitioners suggests stealthy process comprehension obtained from a PLC alone, to execute targeted attacks, is impractical. In contrast, we assert that current PLC programming practices open the door to a new vulnerability class, affording attackers an increased level of process comprehension. To support this, we propose the concept of Process Comprehension at a Distance (PCaaD), as a novel methodological and automatable approach towards the system-agnostic identification of PLC library functions. This leads to the targeted exfiltration of operational data, manipulation of control-logic behavior, and establishment of covert command and control channels through unused memory. We validate PCaaD on widely used PLCs through its practical application.

show abstract

Section: Attack 3: a Novel Storage Based Covert Channelmentioning

confidence: 99%

PCaaD: Towards automated determination and exploitation of industrial systems

Green

Derbyshire

Krotofil

et al. 2021

Computers & Security

View full text Add to dashboard Cite

show abstract

“…For example, an 8 bit value allocated in a 16 bit boundary system, would result 8 bits of unused space. This is a concept similar to the use of file slack space for hiding data, and is used in tools such as bmap [39].…”

Section: Attack 3: a Novel Storage Based Covert Channelmentioning

confidence: 99%

PCaaD: Towards Automated Determination and Exploitation of Industrial Processes

Green,

Knowles,

Krotofil

et al. 2021

Preprint

View full text Add to dashboard Cite

Over the last decade, Programmable Logic Controllers (PLCs) have been increasingly targeted by attackers to obtain control over industrial processes that support critical services. Such targeted attacks typically require detailed knowledge of system-specific attributes, including hardware configurations, adopted protocols, and PLC control-logic, i.e. process comprehension. The consensus from both academics and practitioners suggests stealthy process comprehension obtained from a PLC alone, to conduct targeted attacks, is impractical. In contrast, we assert that current PLC programming practices open the door to a new vulnerability class based on control-logic constructs. To support this, we propose the concept of Process Comprehension at a Distance (PCaaD), as a novel methodological and automatable approach for systemagnostic exploitation of PLC library functions, leading to the targeted exfiltration of operational data, manipulation of control-logic behavior, and establishment of covert command and control channels through unused memory. We validate PCaaD on widely used PLCs, by identification of practical attacks.

show abstract

“…The size of slack space can be non-trivial: A review of 18 different versions of Windows for slack space found slack (unused) space of the order of tens of megabytes (Mulazzani , 2013).…”

Section: How Data Is Stored On a Hddmentioning

confidence: 99%

The Treatment of Advanced Persistent Threats on Windows Based Systems

Bentley¹

View full text Add to dashboard Cite

Advanced Persistent Threat (APT) is the name given to individuals or groups who write malicious software (malware) and who have the intent to perform actions detrimental to the victim or the victims' organisation. This thesis investigates ways in which it is possible to treat APTs before, during and after the malware has been laid down on the victim's computer. The scope of the thesis is restricted to desktop and laptop computers with hard disk drives. APTs have different motivations for their work and this thesis is agnostic towards their origin and intent. Anti-malware companies freely present the work of APTs in many ways but summarise mainly in the form of white papers. Individually, pieces of these works give an incomplete picture of an APT but in aggregate it is possible to construct a view of APT families and pan-APT commonalities by comparing and contrasting the work of many anti-malware companies; it as if there are alot of the pieces of a jigsaw puzzle but there is no box lid available with the complete picture. In addition, academic papers provide proof of concept attacks and observations, some of which may become used by malware writers. Gaps in, and extensions to, the public knowledge may be filled through inference, implication, interpolation and extrapolation and form the basis for this thesis. The thesis presents a view of where APTs lie on windows-based systems. It uses this view to create and build generic views of where APTs lie on Hard Disc Drives on Windows based systems using the Lockheed Martin Cyber Kill Chain. This is then used to treat APTs on Windows based IT systems using purpose-built software in such a way that the malware is negated by. The thesis does not claim to find all malware on but it demonstrates how to increase the cost of doing business for APTs, for example by overwriting unused disc space so APTs cannot place malware there. The software developed was able to find Indicators of Compromise on all eight Hard Disc Drives provided for analysis. Separately, from a corpus of 228 files known to be associated with malware it identified approximately two thirds as Indicators of Compromise.

show abstract

Quantifying Windows File Slack Size and Stability

Cited by 6 publications

References 8 publications

PCaaD: Towards automated determination and exploitation of industrial systems

PCaaD: Towards automated determination and exploitation of industrial systems

PCaaD: Towards Automated Determination and Exploitation of Industrial Processes

The Treatment of Advanced Persistent Threats on Windows Based Systems

Contact Info

Product

Resources

About