Some Memories Never Fade: Techniques for Extracting Juicy Information from an OS’s Memory

NTK 2016
Stopnja 300
Datum sreda
18. maj 2016 09:00

For hobbyists, working with an operating system’s memory can be useful to troubleshoot and understand exactly how certain solutions work. Just as it is crucial to understand an operating system’s internals and security aspects, it is equally critical to understand what’s in the operating system’s memory. This valuable content contains evidence of user’s actions, hacker’s tasks, malicious code behaviors, and the eternal history of what happened on a system. Acquiring and analyzing physical memory as done by forensics professionals is a skill crucial to understanding how an operating system works or worked during the incident. Join Security Expert, Paula Januszkiewicz who will explain and of course demo the techniques for memory acquisition, secrets to obtaining the juicy data, and how to find someone’s memory dump! This session is expected to be very intense with practical takeaways.

Paula Januszkiewicz is the IT Security Auditor and Penetration Tester, Enterprise Security MVP and trainer (﴾MCT)﴿ and Microsoft Security Trusted Advisor. She is also a top speaker at many well-‐known conferences including TechEd North America, TechEd Europe, TechEd Middle East, RSA, TechDays, CyberCrime, etc., and is often rated as number-‐one speaker. Paula is engaged as a keynote speaker for security related events and she writes articles on Windows Security. She drives her own company CQURE, working on security related issues and projects. Paula has conducted hundreds of IT security audits and penetration tests, including those for governmental organizations. Her distinct specialization is definitely on Microsoft security solutions in which she holds multiple Microsoft certifications, besides being familiar with and possessing certifications in other related technologies. Paula is passionate about sharing her knowledge with others. In private, she enjoys researching new technologies, which she converts to authored trainings. She wrote a book about Threat Management Gateway 2010, and is working on her next book. She has access to a source code of Windows! Every year she makes over 200 flights (﴾2013 -‐ 248)﴿ to gain more and more experience, provides penetration tests and consults Customers about how to secure their infrastructures.