This short slide deck summarizes the motivation behind investing in memory forensics, the options we considered and tech stack we're using to acquire memory of an EC2 instance, and our approach to memory analysis.

1. Memory Forensics
In AWS
Marc Vilanova
May, 2019

2. About me.
Security Incident Response Team (SIRT)Marc Vilanova
Senior Security Engineer

3. Unique insights into runtime system activity such as:
● Open network connections
● List of running processes
● Memory resident infections
● and many other forensic artifacts
Important in cloud environments where:
● Write access to disk is very limited
● Memory can be a better place for an attacker to operate and maintain temporary
persistence
Motivation.

4. Option #1: /proc/kcore
● Pseudo-file that represents the physical memory of the system and is stored in the ELF
core file format
● Pros
○ Enabled in supported base AMI kernel configs
○ Userland tools for acquisition available
● Cons
○ Getting disabled in future base AMI kernel configs
○ Acquiring memory can be tedious and require specialized tools
○ Acquisition limited to the first 896MB of memory in 32-bit instances
Acquisition.

5. Option #2: LiME ~ Linux Memory Extractor
● Loadable Kernel Module which allows for volatile memory acquisition from Linux-based
devices
● Pros
○ Minimal process footprint
○ Does not require userland-based tools
○ Supports multiple acquisition formats (padded, lime, and raw)
○ Image format supported by popular analysis frameworks (Volatility and Rekall)
● Cons
○ Requires compilation and loading of kernel module
Acquisition.

6. Option #3: From Hypervisor Via AWS API
● Pros
○ Unlikely detection from guest
○ Forensic soundness
● Cons
○ We depend on AWS to develop and expose this capability
Acquisition.

7. Tech Stack
● Python
● Boto3 (AWS SDK for Python)
● AWS Systems Manager (SSM)
● Pre-compiled LiME kernel module
● AWS Simple Storage Service (S3) (or Elastic Block Store (EBS))
Acquisition.

8. LiME Builder and Publisher
● Spinnaker pipeline that builds and publishes modules to our artifactory
● Triggers on every unstable foundation AMI build
● Uses lime-forensics-dkms Ubuntu package
Acquisition.

9. Orchestration
● Demisto SOAR
Acquisition.

10. Tech Stack
● Started with Volatility Framework
○ Does not support Python >= 3.0
○ Not all plugins support JSON output
○ Needs better support as a library
● Moving to Rekall Memory Forensic Framework
○ Very modular, easy to use as a library
○ JSON output support for all plugins
● Invoke AWS Lambda function on new memory image S3 event
● Use Titus¹ container platform for parallelizing analysis
Analysis (work in progress).
¹ Netflix Cloud Container Runtime Platform

11. Workflow.
¹ Forensic Evidence Storage Layer

12. Thank you.