To overcome the need for investigators to travel far and wide to gather evidence from infected computers after a cyberattack, a Kaspersky Lab expert has developed a simple tool that can remotely collect vital data without risk of its contamination or loss. Named BitScout, the tool can build a swiss-army knife for the remote forensic investigation of live systems and has been made freely available for all investigators to use.

 

In most cyberattacks, legitimate owners of compromised systems fall victim to unidentified perpetrators. Victims usually agree to cooperate and help security researchers find the infection vector or other details about the attackers.

 

However, it is a longstanding concern among forensic researchers that the need to travel long distances to collect crucial evidence such as malware samples from infected computers can result in expensive and delayed investigations.

The longer it takes for an attack to be understood, the longer it is before users are protected and perpetrators identified. However, the alternatives have either involved expensive tools and a knowledge of how to operate them, or the risk of contaminating or losing evidence by moving it between computers.

 

To solve the problem, Vitaly Kamluk, Director of Kaspersky Lab’s Global Research and Analysis Team in Asia Pacific (APAC) has created an open-source digital tool that can remotely collect key forensic materials, acquire full disk images via the network or locally attached storage, or simply remotely assist in malware incident handling.

 

Evidence data can be viewed and analyzed remotely or locally while the source data storage remains intact through reliable container-based isolation.

 

“The need to analyze security incidents as efficiently and swiftly as possible is increasingly important, as adversaries grow ever more advanced and stealthy. But speed at all costs is not the answer either – we need to ensure evidence is untainted so that investigations are trusted and results can be qualified for use in court if required. I couldn’t find a tool that allowed us to achieve all of this, freely and easily – so I decided to build one,” said Vitaly Kamluk.

 

Kaspersky Lab experts work closely with law enforcement agencies across the world to help in the technical analysis of cyber investigations. This gives them a unique insight into the challenges LEA personnel face when fighting modern cybercrime.

 

The cybersecurity landscape is now so complex and sophisticated that investigators need tools that can adapt and scale to the demands of the job. BitScout is a good example of this. It can be adjusted to the particular needs of an investigator, and improved and upgraded with additional features and custom software.

 

Most importantly it comes free of charge, based on open-source solutions and is fully transparent: instead of relying on third party tools with proprietary code, experts can use the Bitscout open-source code to build their own swiss-army knife for digital forensics.

 

The list of BitScout features includes:

●Disk image acquisition even with un-trained staff

●Training people on the go (shared view-only terminal session)

●Transferring complex pieces of data to your lab for deeper inspection

●Remote Yara or AV scanning of offline systems (essential against rootkits)

●Search and view registry keys (autoruns, services, plugged USB devices)

●Remote file carving (recovering deleted files)

●Remediation of the remote system if access is authorized by the owner

●Remote scanning of other network nodes (useful for remote incident response)

 

The tool is freely available at the GitHub code repository: https://github.com/vitaly-kamluk/bitscout

 

Read more on Securelist.com.


RECOMMENDED ARTICLE FOR TECHWORLD


 
ASUS Announces Cutting-Edge AiMesh Whole-Home Wi-Fi for ASUS Routers
Techworld Date Posted: 5 January 2018 10:51 AM | 259 Views
ASUS today announced AiMesh, an innovative and breakthrough feature upgrade for ASUS routers that allows users to easily create a flexible and powerful whole-home Wi-Fi system using any compatible ASUS models.. See More
 
ASUS Announces Cutting-Edge AiMesh Whole-Home Wi-Fi for ASUS Routers
Techworld Date Posted: 10:51 AM | 259 Views
ASUS today announced AiMesh, an innovative and breakthrough feature upgrade for ASUS routers that allows users to easily create a flexible and powerful whole-home Wi-Fi system using any compatible ASUS models.See More

 
Philips Monitors in Collaboration with 20th Century Fox Will Rock Local Cinemas with the Most Anticipated Rock Band Story Ever Told
Techworld Date Posted: 5 November 2018 9:16 AM | 107 Views
Philips monitors and display solutions are very known in the world as one of the highest performing innovative monitors for both productivity and gaming.. See More
 
Philips Monitors in Collaboration with 20th Century Fox Will Rock Local Cinemas with the Most Anticipated Rock Band Story Ever Told
Techworld Date Posted: 9:16 AM | 107 Views
Philips monitors and display solutions are very known in the world as one of the highest performing innovative monitors for both productivity and gaming.See More

 
Realme C1: King of Entry Level Smartphones Is Now Ready for Its First Flash Sale on December 5th 12NN
Techworld Date Posted: 4 December 2018 5:07 PM | 138 Views
Realme Philippines, the newest game changer smartphone brand in the Philippines recently unveiled its first smartphone in the country, the Realme C1.. See More
 
Realme C1: King of Entry Level Smartphones Is Now Ready for Its First Flash Sale on December 5th 12NN
Techworld Date Posted: 5:07 PM | 138 Views
Realme Philippines, the newest game changer smartphone brand in the Philippines recently unveiled its first smartphone in the country, the Realme C1.See More

 
MSI-ECS Offers New Training Courses to Expand ICT Learning Platform
Techworld Date Posted: 8 January 2019 1:43 PM | 207 Views
As more local enterprises develop a growing appetite for digital technologies, country’s largest distributor MSI-ECS Philippines Inc., hopes to complement this growth by expanding its education platform. See More
 
MSI-ECS Offers New Training Courses to Expand ICT Learning Platform
Techworld Date Posted: 1:43 PM | 207 Views
As more local enterprises develop a growing appetite for digital technologies, country’s largest distributor MSI-ECS Philippines Inc., hopes to complement this growth by expanding its education platformSee More

 
Kaspersky Lab Unravels the Truth on Cyber Espionage at its 3rd APAC Cyber Security Conference
Techworld Date Posted: 17 October 2017 1:26 PM | 327 Views
Kaspersky Lab unriddled the mysterious threat of cyberespionage against countries, critical infrastructure, and companies in the region on its 3rd Asia Pacific (APAC) Cyber Security Weekend in Phuket, Thailand last week.. See More
 
Kaspersky Lab Unravels the Truth on Cyber Espionage at its 3rd APAC Cyber Security Conference
Techworld Date Posted: 1:26 PM | 327 Views
Kaspersky Lab unriddled the mysterious threat of cyberespionage against countries, critical infrastructure, and companies in the region on its 3rd Asia Pacific (APAC) Cyber Security Weekend in Phuket, Thailand last week.See More

Rhea Sanvictores
Earmark That Irresistible Yearn for the Zen
Techworld • By: Rhea Sanvictores | Date Posted: 20 March 2017 2:24 PM | 828 Views
Tech experts and various computer enthusiasts, from what it seems to be an uncontested case, are blown away by AMD’ next-generation processor.. See More
Rhea Sanvictores
Earmark That Irresistible Yearn for the Zen
Techworld • By: Rhea Sanvictores | Date Posted: 2:24 PM | 828 Views
Tech experts and various computer enthusiasts, from what it seems to be an uncontested case, are blown away by AMD’ next-generation processor.See More

 
Lenovo Opens 20th Concept Store in the Philippines
Techworld Date Posted: 30 July 2018 3:47 PM | 494 Views
Lenovo, the world’s leading PC manufacturer, recently opened its 20th concept store in the Philippines and the second one in Cebu City, located at the third floor of Ayala Center Cebu.. See More
 
Lenovo Opens 20th Concept Store in the Philippines
Techworld Date Posted: 3:47 PM | 494 Views
Lenovo, the world’s leading PC manufacturer, recently opened its 20th concept store in the Philippines and the second one in Cebu City, located at the third floor of Ayala Center Cebu.See More

 
KINGMAX’s Entry-Level M.2 PCIe SSD PJ3280 Satisfies the Need for Upgrades Where Speed Is of Paramount Importanc
Techworld Date Posted: 30 August 2018 4:56 PM | 164 Views
KINGMAX, a world-renowned professional memory manufacturer, has consummated its product line of M.2 2280 PCIe NVMe solid-state drives (SSDs). See More
 
KINGMAX’s Entry-Level M.2 PCIe SSD PJ3280 Satisfies the Need for Upgrades Where Speed Is of Paramount Importanc
Techworld Date Posted: 4:56 PM | 164 Views
KINGMAX, a world-renowned professional memory manufacturer, has consummated its product line of M.2 2280 PCIe NVMe solid-state drives (SSDs)See More

 
Lian Li Readies CES 2019 Showcase Featuring New Products and Collaborations
Techworld Date Posted: 9 January 2019 12:44 PM | 274 Views
Lian Li Industrial Co. Ltd., the world’s leading manufacturer of aluminum chassis for gaming enthusiasts, custom OEM/ODM case solutions and case accessories, is thrilled to invite everyone to the Consumers Electronics Show (CES) 2019. See More
 
Lian Li Readies CES 2019 Showcase Featuring New Products and Collaborations
Techworld Date Posted: 12:44 PM | 274 Views
Lian Li Industrial Co. Ltd., the world’s leading manufacturer of aluminum chassis for gaming enthusiasts, custom OEM/ODM case solutions and case accessories, is thrilled to invite everyone to the Consumers Electronics Show (CES) 2019See More

 
CORSAIR Announces Partnership with League of Legends Organization ROX
Techworld Date Posted: 24 August 2017 10:49 AM | 378 Views
CORSAIR�, a world leader in enthusiast memory, PC components and high-performance gaming hardware today announced its title sponsorship with ROX , a leading League of Legends eSports organization in South Korea.ROX will be the.... See More
 
CORSAIR Announces Partnership with League of Legends Organization ROX
Techworld Date Posted: 10:49 AM | 378 Views
CORSAIR�, a world leader in enthusiast memory, PC components and high-performance gaming hardware today announced its title sponsorship with ROX , a leading League of Legends eSports organization in South Korea.ROX will be the...See More


Power by

Download Free AZ | Free Wordpress Themes