Fast Forensics Using Simple Statistics and Cool Tools

Presented at DEF CON 21 (2013), Aug. 4, 2013, 1 p.m. (45 minutes).

Ever been attacked by malicious code leaving unknown files all over your computer? Trying to figure out if a file is encrypted or just compressed? Is the file really something else? Is there hidden data? Are you short on time! This talk leads you through file identification and analysis using some custom FREE tools that apply statistics and visualization to answer these questions and more. You can often identify files by their statistical picture and I am going to show you how. We can find some hidden data (steganalysis), easily determine if an executable file is packed or obfuscated, find appended data, figure out if the file is really what it purports to be and even aid in reversing XOR encryption. The final proof of concept program allows you to statistically identify (i.e. no magic numbers or header information used) some file types autonomously for an entire hard drive. The Windows-based tools (mostly math so adaptable to Linux) and source code are free!

Presenters:

• John Ortiz

Links:

• https://defcon.org/html/defcon-21/dc-21-speakers.html#Ortiz
• https://infocon.org/cons/DEF CON/DEF CON 21/DEF CON 21 video and slides/DEF CON 21 - John Ortiz - Fast Forensics Using Simple Statistics and Cool Tools - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=BcDbKlz06no

Similar Presentations:

• BSidesDC 2015 / Deductive Reasoning: File Analysis Techniques
• ShmooCon XI (2015) / Cockroach Analysis: A Statistical Analysis of the Flash and Java Files that Infest the Internet
• BSidesLV 2019 / So you think you can CHMOD