better faith the Lord oh hey we want the
earth thank you good morning we're going
to start this workshop I hope you enjoy
it I know it's very early so I'm going
to try to wake you up with something
that's interesting I don't know if you
know about the cloud world there's cyber
response for we've got some forensics
here you can do all sorts of things
you're gonna like this because it's
called incidence in the cloud or fast
which is a term that was coined many
years ago forensic service and we're
gonna look at the whole process and and
look at it from a technical viewpoint I
hope you enjoy it I should like to thank
in theory for inviting me here this is
what I do this is a little bit about me
I work in process a war and I'm in
charge of the digital forensics service
there is my education the certification
that I've got and what I do outside my
job I'm a lecturer I'm a cyber volunteer
for the NCBI enema speak speaker and on
the bottom you can see how I'm
it was when I was younger let's start
with the table of contents we're gonna
mix things we're going to talk about the
general concepts today but they're going
to be all mixed up fast which is a
service offered to different companies
who offers services to other customers
in the cloud we're talking about
forensic issues and you have to have the
appropriate team for everything that you
need to do in the cloud and I'll explain
that a little bit later I also need to
make a disclaimer because every time
we're going to do concept trials or some
kind of an ethical hack we have to tell
people here we're going to talk about
three a provider so the most of the
important Google as you from Microsoft
and Amazon web server please are there
three main ones and we're going to be
concentrating on them in my talk I'm
gonna be having them it'll be a basic
average medium level talk for anybody
that's in this room I think you'll find
it useful so an introduction let's look
at the whole of the model from the left
to the right on premises is they've
water forensic offers typically you've
got all the machines that you manage and
in this kind of model you can have SAS
and pass an es so you free up control of
hardware so you can have a forensic but
there are other conditioning the factors
they can see the different controls that
you have to have what you manage and
what your main supplier manages and this
is very important
I like this slide because it shows how
systems used to operate before 2005 in
IOT networks everything was centralized
how it looks today where things can be
controlled from the cloud and there you
offer different services and what we
expect to happen from 2025 and beyond
this is very interesting because
everything is going to be decentralized
it's going to be distributed there'll be
a communication between all the
different devices and the cloud and it
all be automated and it supposedly is
going to be distributed via blockchain I
think as very ambitious and also very
interesting and that's why it's
necessary to have this kind of services
like out of us because you need to have
some kind of control if an incident
happens you need to have sufficient
skills to know what has happened let's
get to the point
I remember at a talk once at a Microsoft
at all somebody said oh there was no
doubt about the level of safety in the
cloud I thought well hang on a minute
maybe that's not true because at the end
of the day the cloud is managed by
people we all make mistakes and at an
infrastructure therefore there are
mistakes every day that errors are free
day I a couple of years ago started
looking into the cloud issue with
different suppliers and I looked into
security and of course it's not a
hundred percent safe so let's see what
we can do and what sort of forensic
services we can offer there are many
incidents that can ruin a small company
or about large company we've seen news
about Playstations
I think it was a few months ago how that
was harmed and that could happen in our
company so let's imagine you've got an
instance you're most your computers
aren't well maintained they've not been
updated they've got a bad setup and
you're exposed to internet this is a
typical example of what happened and you
you of course that can be very
vulnerable you might have bad
developments and bad implementation and
there may be an error we're all human
so people may upload something like a
kowler into the cloud and our service
provider then cuts that service to us
and that's just because of bad
implementation this is gonna have an
effect of course on the company
there's also malpractice of users if
your users aren't properly trained they
may accidentally let
we're in and then passwords may be very
very exposed it's far more than people
think because you've got a developers
that are using the cloud they could hack
into passwords or access code so you
need to be very careful with this
because there are people specifically
who try to do that so we need to be very
careful and then a combined attack and
that that is using the cloud to attack a
third party we've seen that as well that
can happen we saw it in PlayStation and
in more cases but people try to cover
that up but it actually does happen ok
what sort of challenges when we do we
face when we offer this kind of service
firstly we need to have a good
relationship with our supplier our
customer and ongoing communication
that's going to make everything a lot
easier we need to be very agile when
asking for control over all the elements
that are in the cloud and to be able to
work we of course need permits then you
gotta have the permits when the incident
happens you need them before what about
and the characteristics as well because
everybody has different concepts you can
see you can make a simile for example
between Amazon and Google and they
develop characteristics that may be
similar but actually technically have a
small differences and you need to know
all the different characteristics what
some of the security levels they have so
we need to be very much up to date of
all changes and everything that's
progressing because that can help us
also Lee legally the jurisdiction it's
very important to know what you can do
and what you can't to do you may have
your data center in one place you're
suffering in another place
so you really need to carry out yourself
because I'm kind of auditor for what you
can Jim what you can't and you need to
be honest if you end up going to court
you need to be very careful with your
integrity and how you look after the the
chain a forensics service you need to
have things that are traceable as well
but here normally you're just
firefighting so you need to always for
example record on video all the
different processes so that if something
goes wrong and we have to go to court we
need to be able to provide evidence of
what we've been doing preparation how do
you get ready for this I think there are
two service models new one which is of
being a firefighter if something's
happened nobody knows what's going on
you're cold and you have to go and put
the fire out that's what a firefighter
does that's the situation that I really
don't like I prefer to have everything
prepared I prefer to be monitoring
everything but sometimes you have to go
and put out a fire and that's is costly
and requires time especially if you go
to place where you have no idea of the
architecture you need to very rapid
response you need a rapid response team
and you really need to know what you're
doing keep your keep of cool heads know
what to do where to stop they're
critical decisions that you're taking
are critical tip moments in time and so
it's very important to know about
architecture I've already spoken about
legal side of things and that's also
important so if you're being a
firefighter of course you need to be
able to contact with a delegate to say
okay we've got services and so
for all countries that we're gonna offer
bitching which includes of course
monitoring service than which you've
you've got everything agreed upon with a
current a series of service level
agreements so you got to go to the
critical points what are we forensics
really like we like logins we like
system administrator so do we need to
try to create everything that we want as
if it was like a a funnel going into a
machine so that you can get everything
possible and create everything that you
need and also the relationship with
other endpoints this is of course
important if we've got a cyber security
incident and the patient as it were is
ill we need to isolate that's a case and
and see what it effects so we're going
to need a profile an auditors profile
and the necessary permits to work as a
forensics and in the end we need a
series of resources which we can have in
the customers premises or in app on our
premises because you can be offering a
forensic service to their cloud directly
or you could actually go to their cloud
and bring them down everything that they
have that takes a little longer and here
you can see how the service is set up
it's a very simple diagram
if there's an incident you have to sit
down with the customer write down the
basic data it's very important to have a
contact person you need to know if
something happens who you got to ring
who's got the password so who knows
about this because this is a continuous
ongoing service that you need to be able
to offer 24 hours a day you need to know
about the infrastructure you need to sit
down sometimes with the a client for a
week and to see what they've got and
compare what with what the client says
with what you can see so and that always
needs to be kept connected and kept up
to date so there's data collection there
and then we wait until something happens
it may well be that the customer calls
us or we realize that something's
happened but these are the three things
that you do you need to detect isolate
and contain this is really really
important when an incident happens
that's what we offer our customers first
of all you know something has happened
you isolate that incident and you
contain it so that the service can get
back to normality
then we annales analyze anything and if
there's any discordance between the date
the original data that we collected we
see oh you know you didn't say that this
was this had been updated so the end of
the day you what you're offering is a
continuous improvement service now let's
look at a demo
concepts are very important before we
start looking at a demo and depending
upon the customer and then for structure
the customer has you can do some things
and others not we we can have some logs
and others not depending upon the
supplier so decisions need to be taken
and they're always a UPS upsides and
downsides to everything that we do so
let's make a machine for somebody it's
just started out in this world and we
can have a in this case a sift virtual
machine or a sans it's easy to set up
we'll do it in its recent most recent
version which was updated yesterday and
then we'll put it live and then we'll
see how if at a given moment in time a
person a client has an incident they
call us and we set up a lab in the cloud
and then what we'll do is get the
evidence and then connect the two you
can the good thing about the cloud as
you can do things remotely and then
we'll see and another couple of demos
which will be at our for forensic site
we'll get all the data we'll get
evidence capturing with all the
guarantees and then we'll work on that
okay those are the demos that we're
going to see this is the first one we're
creating the instance here I don't know
if you can see we're creating it from
zero in this demo by the way we've done
this all free of charge
with the instructions that you're given
you're given a series of credits to do
it free of charge and why do we do that
because we want people to see how
important it is
of course your machine normally won't be
sufficient you want more processing
power and the machine that we have here
is quite basic so what we're going to do
of all of the option that here this one
well choose the free option it's got a
Giga of RAM memory
there's a whole suite of things that you
can choose from up to 16 RAM so of
course it depends on the needs so let's
move on now of all the different options
that are there which isn't this one here
we can customize this a little bit
here's everything that you've got to
choose by the way every each one of
these elements has a cost attached to it
we choose this one depending upon the
geographical area where we happen to be
located we'll leave this just on default
mode
this is the network you can also
customize a series of details but for
the moment let's just leave it as it is
there's the machines capacity we've got
up to 30 so we're just right here 28 the
type of drive that you we can let's have
at the SSD it's not encrypted and off we
go
here you can see a series of tags this
is just to get organized we've got
several machines we need to identify
them let's go to create and here we can
set up a security group there are all
different security groups that you can
choose from we've already set one up but
I wanted you to see it here you can see
we've set one up and so let's choose
this one it's a very basic one
it says H RDP there you go we've
customized it this is the one and we
launch it there's not much now to do to
finish the process and there you've got
everything that we've selected you can
see it all
here we choose equipment what we want to
do is to create a virtual machine so
what we're gonna do is give it
forensic functionality there we are it's
been created the machine now takes a
while I would just say that we shortened
the whole process just so that you can
see it there's our public IP let's
connect let's connect and now customize
this takes a while this process it's so
there you can see the machines tag
unlike others this account I've actually
created specifically for this where in
the description part you can see
everything that you have you can see
what the CPU have the CPU is and
everything else that you can see as well
how it's updated sometimes it takes a
while to update then we can see the
region which is always very important as
well and there's the code you can see it
or I'm gonna stop it there
what we're going to do is to set up the
environment now with a series of
commands the best thing is Tabak
visually we can see real-time reports
timelines so that's the mode we're going
to ask for it so that it's we ask for it
to be an RDP
with a basic normal desktop and you open
it and secondly what we're going to do
is now is install it there's a series of
commands we're gonna go step by step it
takes a while but it's an easy process
here you can see on the last line but
one we've got version 41.1 of 2017 there
are more update ones that but this one
is fine for the moment because the
others have been a problematic so it's a
basic machine that's just a basic
computer it's got a core that's carry on
with all this information and I'll put
it in my github
there you can see it user and password
then we've created the instance and what
we're going to do for the forensic work
now we've got the Machine what we want
to do is to mmm put all the evidence is
there so we're going to create a disk
and we'll match it so we can see what
we've got now this is the incident and
you can see their machine I've got my
profile here it's not the best profile
but us it's only a demo let's move on
this is what we saw earlier the same as
we saw via SSH and now let's look at
volumes there's a snapshot of the
machine what it's looking like you can
have people working on these different
snapshots so we've got our hard drive
we've asked it to investigate what's
going on there we can see what's going
on we've got the authority and then
we wait it takes a while and we'll have
it in our machine we carry on it's it's
located in our machine so we then move
on and work with it so it's easy really
our machine our forensic machine in the
car out with our evidences and we can
work it with it as if we were just a
normal forensic that's as far as we're
going with that demo okay let's now do
another kind of a demo we've got a
machine in the cloud an Amazon machine
in the cloud let's now do a demo of a
case that we did with a machine in this
case it's an azure that we're using and
we've got an it's a machine for a
business environment so we were called
and they said we've got some very
suspicious logins and it looks like
there's been some kind of intrusion so
we have to somehow access it and see the
characteristics of the machine and then
how we can extract from the RAM memory
and look at a series of artifacts which
are key files that will give us an idea
of what's happening in the end
what we're going to do is have as hard
it is to it with a series of tools this
is the instance that we have this is our
virtual machine this is what the you
know what the diagram the setup looks
like it's very very basic seriously
basic we've got a subnet and an
interface public IP at the bottom you
can see the security group and the
virtual machine it's easy
that's our environment we can see it's
at the bottom it's there's a server it's
got the firewalls on it's fairly updated
it would seem that everything by default
is okay here I'm going to see if I can
stop this so what we do is okay once
again we've got this machine with its
hard drive and another series of hard
drives what we do is we put ours there
with our tools we'll talk about the
tools a little bit more in detail and
what we're going to do is work on the
information in that a hard drive what we
do isolate the information then we take
it to our machine and this is what we're
going to use here for those of you that
work on Incident Response and forensics
this is what we're doing is a live
response collection what it is it's a
link I don't like it for Mac and Linux
but it's good for Windows because it's
got a Suzy of tools different versions
they're free
and what it can do is it can edit you
can edit them
it's got scripts that you can edit as
you want them and that's what I'm
interested in because each case might
may be different so you have to extract
them as you want them with this tool you
can do it with the artifacts with RAM
memory and with disks so we got the RAM
artifacts and off we go
male voice Jameson Ptolemaic so we get
into the Machine the unit unit has been
configured we have allocated a letter
and it's there we identify it as new
volume unit e here in this file we have
the skips with all the skips there we
have configured the tools and
directories there's two files like the
same you can get system data and this
nomenclature when will execute again the
back it will require another file and
then we will dump it there the whole of
the content will execute executive
action and it starts with RAM memory
which is quite long ish yeah we get into
the file and we see how it is generated
first we have the memory my memory is
there and the image disks we can't do
anything against that and here the
process 5% 28 it takes time according
depending on your memory the processing
power let's see all the tools
32 and 64 versions for each one a series
of tools and here we are using this one
run capture it's very basic for
forensics and this file we have all the
information now it's being generated
this is not a good practice while you do
the extraction it's generating the the
files up but this is a demo so in it's
okay
the processes continue the back it each
one of the files is being fed these are
the logs and the records that we're
going to see in our lab we have last
activity view we will show the last
processes that were made in this machine
it's Excel format almost its HTML format
but you can convert it into Excel format
so here we will analyze this data in
detail but this is a preview let's
continue with the process
it continues to generate files giving a
lot of content notes to it
the message is okay be patient it says
it's quite long a long process
especially with big machines let's
continue with other finds with all the
information that's being generated here
there were errors when you have to
analyze why what are the records that
haven't been generated there let's do
the extraction maybe later and we don't
need to go back we need to analyze each
error we'll have a log with all the
processing processing processing options
and we will see what has happened here
the the other files that are important
in the records will have a lot of
information and we'll have to analyze it
in detail there are many tools that
everything that include all the detailed
information we have to see if it's
complete or not hosts information more
information in the network the Seaport
the client sends a series of logs and
this machine is published in the
internet so at the level of connection
it's very important to see all the
events that happened let's browse the
finds the auto run the auto runs are
important too when there's an attack and
you want to have persistence it's very
common to go to that auto run section
this is the end and let's see the whole
process there's a detail of all the
processes that has been followed file
creation for good integrity we see what
we've done so we have the forensics hat
we've supervised what's happened the the
hashes of all that is obtained is saved
with Sears we'll have a series of
important hashes and then we'll have to
go to trial we need to explain this this
is the content it's traceable the
versions the programs that have been
used the licenses of the tool and
everything is locked
Hey yes is in tonight ASIS and we are
near the end wait until it's completed
so this is the impression of the file
and we stop here once we're doing this
option we can use other it's not they're
not investigative applications that just
environments for for investigation if
we're a team we can do it together in
parallel here we have windows power
windows power cell we connect to the
clip CLA CLA and we can do certain
things at the same time if we know that
as an incident at the same time we do
the acquisition of the incidents we can
create an investigative environment and
we see locks appearing and we'll see
what we do with that we need to have the
clients authorization it's important to
ask for authorization we have this
option we can do a lot with this it's
very powerful and we have others that is
this is offered by Azur it has to be
configured upstream you can't just do it
there at any time has to be working
before as your analytics will do it on
the left you can see it a series of
consultations that we can that are
pre-configured and this is adapted to
fly into this instance here it's in
Spanish you pick the consultation you
edit it ideally it's being
pre-configured for your client you have
already your instances and then you only
need to execute and it gives you all the
information and the extraction is done
at the same time we can do several
things we'll have a team and we'll even
have a team much better let's continue
we've done the extraction we've got the
compressed file and we brought it to the
investigative forensics environment its
provider it has its own features in
Azure we have a Windows server has its
own file and so in our report we need to
clarify that it has its own
characteristics and specificities so let
in the analysis that we've done we'll
have the seaport this is just about
investigating inquiring have a lot of
blogs and at the end we can't find an
application the one that you've seen
there at the bottom there's something
that's strange let's do an investigation
but this is quite striking what what
about this application what are the
programmed tasks maybe the program is
there it's embedded this is not in Azure
byte effect so this is strange
and then we see other things and the
last activity views and there is
something that is not in the right place
so we can have leads and it's a whole
investigation and it gathers a lot of
information
we are getting to the end of this part
here we have a information available and
then we can inform about this event so
you have this information you have no
clue so you have to mine the process and
go back to the initial process you need
to have a vision and investigate what
this process does this application is a
malware according to several certain
people but if you go to the source code
code and to the github will realize it
to control and administration in Windows
so there's a link where you see the tool
how it is created how it's compiled and
how you can adapt it to your needs
with a lots of options that was in the
machine that was the incident so we
analyzed it because we have a ram memory
we didn't see anything we've seen the
artifacts we have the RAM memory that is
key in this case so we use volatility we
do an analysis this is just a summary so
we have the profile half of the ram
memory that we've taken this instance
that was connected to a specific port
through specific IP there was an
established connection and it was
kinetic controlling the system so it's
important to know volatility to use
volatility for these cases all the data
there were in the artifact station do
correspond to what appears in the memory
in the RAM memory at this precise moment
and we finish
this part
now we get to go to the last demo so
extraction of a hard drive partition of
a hard drive of various elements in this
Google cloud we're going to use
configured program week we are going to
connect will extract partitions of this
driving the enough forensic environment
we can go to a bucket in the storage in
Google we can do it also but here we see
the Google cloud platform we have our
platform here let's see what happens
what I do at the beginning with all the
instances that exists I Cho choose the
one I selected version 7 which is
enterprise and here you have the
features the cost of this environment it
doesn't matter because I had some server
some several dollars to test so I
believe in it
location is important this is our
machine it's working
CPUs it's a very basic machine the
drives of this machine that are created
by defect 10 gigas we have no capture no
snapshot or whatsoever and this is the
Italy let's do a capture a snapshot of
what's happening about this precise
instance we can do it visually but if we
have a fire the best is to do it through
the command line the console
well it takes some time let's analyze
the sentence you have eg cloud you type
the project you identify the instance
and what we're gonna see now is the fact
that we're going to create a snapshot
that will be named precisely like I said
it takes some time
we have shortened to the time we are
using a basic version and at the other
day cloud computation takes takes its
time here there's a hard drive in
captures it is not theirs for the moment
it's still processing when it finishes
we'll see that in the drive file let's
do an image snapshot let's see the
difference with an image so we pushed it
hasn't finished yet
now it's there finished it's done
it doesn't refresh properly but anyway
let's browse and here we see a snapshot
ready it's here I don't only want to do
a snapshot I do anything that it's
required I've done a snapshot because I
can't stop the environment I have to do
it very quickly
and now have the possibility to create
an image for this purpose I have to stop
the machine I'm doing it now and I
launch another command for the creation
of new images we've done it more rapidly
here I have the created image for saber
cam I run the process in a rapid mode
and I have the our image the information
is quite scarce in the command process
it's richer and here I could make an
instance there's another post that is
associated different environments cost
without one are going to do it now here
the message is created done all the
details are going to be sent to my
github the instance it can run again
because we already have the image so we
can continue its own operation and these
are different elements each provider
this is a storage a file with the image
that I created through the command line
or the web I can send it here with it
this is eh it's launched from the web
you don't need to have client installs
which you can do it but that you have
the option you you enter from there and
you see what's in the instance we can
the dvv and we can send you can compress
said we can do a lot of things with this
from the the instance itself
we have added a we have our Klee and
then we can send it to our PC or to a
bucket let's see if I stopped it with
this instruction this rau I wanted to
include in my D in Drive in my machine
in the file called evidence it could go
to a bucket of course we only need to
change the instruction and g-cloud is
the command is SCP so we run it
depending on the weight on the size it
says it's okay it's clear
the time that it takes it's quite long
ish so I accelerate the process and
that's it and we can apply other
commands for integrity I said it's
important
from there we're doing and I'm DS 556
whatever that's quite powerful and here
this is from a colleague Tony de la
Fuente this slide was taken from his
presentation and it's very interesting
indeed the here we have a series of
tasks that he runs when there's an
incident a security incident and
something that you can manage for
instance the case yeah we see a process
that is quite nice to see of all the
tasks that are carried out but you need
time for this at the end when there are
instances that are compromised do you
see the process if it's dead if it's
alive
there's a series of applications then
you have to read it with time all the
forensics stations that can be used the
tools we've seen some of them a whole
process that at the end of the day has
to be automatized automated automated
and you can create a case with the
provider so the more automated it is the
better especially in the main levels at
the beginning all this part has to be
automated then there's a point when we
have to do a manual work but in this
cases a time is money this is the last
part my conclusions we have to make
differences from the point of view of
the client that gives service these
points are fundamental we need to create
these environments from the point of
view of security of IT security because
normally if there is a store it's
critical for the store or the client
that customer service are critical so
you have to see it from the point of
view security as four pallets that's
fundamental people managing these
environments have to be careful about
islets that you need to have a refined
system of alerts and alarms in all your
developments you need to have a strong
auditing behind it
auditing all the systems and all the
people who work and for all developments
you need control over that and from the
point of view of what would give people
we people giving service we need to have
the permissions and the authorizations
that we have an action plan for each
customer so it's our responsibility to
ask for those permissions otherwise we
can't offer that our service
it's important also to have a resource
pool we can have spree software or
proprietary software but you didn't you
don't need to marry with anyone in
particular choose whatever you like in
Prosecco we we have the cellar right for
mobile devices because it's a rapid
service which can do a lot of things in
it's a proprietary service but we can
use free so free software so just that's
just not not a single choice choose
whatever you like and we need a
continuous training you have to be a
well all not new elements in security
have to be a hundred percent updated
there many providers many features and
the evolution level and speed of each
provider is very very high so we have to
be updated thank you very much here
you'll see my contact in the github you
see the code the presentation videos
everything is there you can contact me
through the social media I'll be here
for the whole day and I hope you
appreciate it thank you if you have any
questions but I'll be here for the whole
weekend so I'll be here for you you can
stop me we'll have a coffee we'll drink
coffee and we'll we can discuss