Memory Forensics Using Virtual Machine Introspection for Cloud Computing

by Tobias Zillner Sept. 15, 2017 via www.blackhat.com submitted by belen_caty

In the underlying research of this talk a practical approach has been developed that gives the user additional capabilities in the field of forensic investigations. The solution focuses on a memory forensic service offering. To reach this goal, a management solution for cloud environments has been extended with memory forensic services. Self-developed memory forensic services, which are installed on each cloud node and are managed through the cloud management component, are the basis for this solution. Forensic data is gained via virtual machine introspection techniques. Compared to other approaches it is possible to get trustworthy data without influencing the running system. Additionally, a general overview about the underlying technologies is provided and the pros and cons are discussed. The solution approach is discussed in a generic way and practically implemented in a prototype.

https://www.blackhat.com/us-16/briefings.html#memory-forensics-using-virtual-machine-introspectio...

Avatar
Steven Ulm 1 month ago

Cloud Computing is more and more used every day... too bad more and more vulnerabilities just show up..

Reply