×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New tool helps reconstruct sneakiest of attacks

alphadogg (971356) writes | more than 4 years ago

Security 0

alphadogg (971356) writes "Certain attacks that leave no trace on computer hard drives may be discoverable using a new tool that will be demonstrated at the Black Hat conference in Las Vegas next week, which will feature many security advances [spam URL stripped]. Researchers who work for Mandiant will present a means for piecing together what malicious activity might have been carried out by an attacker's payload that runs only in memory and so evades traditional disk forensics, the researchers say. In particular, the memory forensics tool being presented finds traces in memory of what activity might have been performed via Meterpreter, a software module for the open-source Metasploit penetration testing framework. Meterpreter can be injected into a legitimate running process on a victim computer and thereby avoid detection by host IDS/IPS software. Meterpreter can then be used as a platform for further attack, the researchers say."
Link to Original Source

0 comment

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...