To overcome the need for investigators to travel far and wide to gather evidence from infected computers after a cyberattack, a Kaspersky Lab expert has developed a simple tool that can remotely collect vital data without risk of its contamination or loss. Named BitScout, the tool can build a swiss-army knife for the remote forensic investigation of live systems and has been made freely available for all investigators to use.

 

In most cyberattacks, legitimate owners of compromised systems fall victim to unidentified perpetrators. Victims usually agree to cooperate and help security researchers find the infection vector or other details about the attackers.

 

However, it is a longstanding concern among forensic researchers that the need to travel long distances to collect crucial evidence such as malware samples from infected computers can result in expensive and delayed investigations.

The longer it takes for an attack to be understood, the longer it is before users are protected and perpetrators identified. However, the alternatives have either involved expensive tools and a knowledge of how to operate them, or the risk of contaminating or losing evidence by moving it between computers.

 

To solve the problem, Vitaly Kamluk, Director of Kaspersky Lab’s Global Research and Analysis Team in Asia Pacific (APAC) has created an open-source digital tool that can remotely collect key forensic materials, acquire full disk images via the network or locally attached storage, or simply remotely assist in malware incident handling.

 

Evidence data can be viewed and analyzed remotely or locally while the source data storage remains intact through reliable container-based isolation.

 

“The need to analyze security incidents as efficiently and swiftly as possible is increasingly important, as adversaries grow ever more advanced and stealthy. But speed at all costs is not the answer either – we need to ensure evidence is untainted so that investigations are trusted and results can be qualified for use in court if required. I couldn’t find a tool that allowed us to achieve all of this, freely and easily – so I decided to build one,” said Vitaly Kamluk.

 

Kaspersky Lab experts work closely with law enforcement agencies across the world to help in the technical analysis of cyber investigations. This gives them a unique insight into the challenges LEA personnel face when fighting modern cybercrime.

 

The cybersecurity landscape is now so complex and sophisticated that investigators need tools that can adapt and scale to the demands of the job. BitScout is a good example of this. It can be adjusted to the particular needs of an investigator, and improved and upgraded with additional features and custom software.

 

Most importantly it comes free of charge, based on open-source solutions and is fully transparent: instead of relying on third party tools with proprietary code, experts can use the Bitscout open-source code to build their own swiss-army knife for digital forensics.

 

The list of BitScout features includes:

●Disk image acquisition even with un-trained staff

●Training people on the go (shared view-only terminal session)

●Transferring complex pieces of data to your lab for deeper inspection

●Remote Yara or AV scanning of offline systems (essential against rootkits)

●Search and view registry keys (autoruns, services, plugged USB devices)

●Remote file carving (recovering deleted files)

●Remediation of the remote system if access is authorized by the owner

●Remote scanning of other network nodes (useful for remote incident response)

 

The tool is freely available at the GitHub code repository: https://github.com/vitaly-kamluk/bitscout

 

Read more on Securelist.com.


RECOMMENDED ARTICLE FOR TECHWORLD


 
PLDT, Smart Unlock Amazing Digital Experiences Powered by PH’s Fastest Network
Techworld Date Posted: 7 November 2018 3:57 PM | 264 Views
Fresh from their latest recognition as the Philippine’s fastest fixed and mobile networks, leading digital services provider PLDT Inc. and its mobile arm Smart Communications are ushering in a new wave of innovative products.... See More
 
PLDT, Smart Unlock Amazing Digital Experiences Powered by PH’s Fastest Network
Techworld Date Posted: 3:57 PM | 264 Views
Fresh from their latest recognition as the Philippine’s fastest fixed and mobile networks, leading digital services provider PLDT Inc. and its mobile arm Smart Communications are ushering in a new wave of innovative products...See More

 
Elevate Creativity and Collaboration with Microsoft Office 2019
Techworld Date Posted: 26 October 2018 4:06 PM | 237 Views
Premier Apple partner Power Mac Center, together with tech giant Microsoft, launched the Microsoft Office 2019 products, letting users explore advanced tools and functions excellent for creating top-notch school projects and engaging work presentations.... See More
 
Elevate Creativity and Collaboration with Microsoft Office 2019
Techworld Date Posted: 4:06 PM | 237 Views
Premier Apple partner Power Mac Center, together with tech giant Microsoft, launched the Microsoft Office 2019 products, letting users explore advanced tools and functions excellent for creating top-notch school projects and engaging work presentations...See More

 
Kingston and Authorized Partners to Bring High-Quality Storage Solutions to the Philippines
Techworld Date Posted: 22 March 2019 9:45 AM | 104 Views
Kingston Technology, a world leader in memory storage products and technology solutions, has teamed up with channel partners to promote the authorized partner program in the Philippines. Ranked as the World’s No. 1 memory.... See More
 
Kingston and Authorized Partners to Bring High-Quality Storage Solutions to the Philippines
Techworld Date Posted: 9:45 AM | 104 Views
Kingston Technology, a world leader in memory storage products and technology solutions, has teamed up with channel partners to promote the authorized partner program in the Philippines. Ranked as the World’s No. 1 memory...See More

 
Realme Announces First In-Store Grand Flash Sale on December 16, 10AM at MemoXpress SM City North EDSA
Techworld Date Posted: 14 December 2018 10:45 AM | 308 Views
After a successful round of online flash sales, Realme Philippines adheres to the demand of consumers for offline store availability. #RealEntryLevelKing Realme C1 will be available at MemoXpress SM City North EDSA starting December.... See More
 
Realme Announces First In-Store Grand Flash Sale on December 16, 10AM at MemoXpress SM City North EDSA
Techworld Date Posted: 10:45 AM | 308 Views
After a successful round of online flash sales, Realme Philippines adheres to the demand of consumers for offline store availability. #RealEntryLevelKing Realme C1 will be available at MemoXpress SM City North EDSA starting December...See More

 
AOC Monitors Continuously Dominate the PH Market in Monitor Sales
Techworld Date Posted: 28 January 2019 4:25 PM | 159 Views
According to the most recent report from the International Data Corporation (IDC), the world’s premiere global market intelligence firm, AOC has once again overtaken the Philippine market in monitor sales during the third quarter.... See More
 
AOC Monitors Continuously Dominate the PH Market in Monitor Sales
Techworld Date Posted: 4:25 PM | 159 Views
According to the most recent report from the International Data Corporation (IDC), the world’s premiere global market intelligence firm, AOC has once again overtaken the Philippine market in monitor sales during the third quarter...See More

 
5 Simple WiFi Problems and the Easy Ways to Fix Them
Techworld Date Posted: 12 July 2018 4:09 PM | 589 Views
Home WiFi issues can be really frustrating, especially if you’re in the middle of sending an important work file, a video call with a relative living overseas, or a Netflix-bingeing marathon. But most of.... See More
 
5 Simple WiFi Problems and the Easy Ways to Fix Them
Techworld Date Posted: 4:09 PM | 589 Views
Home WiFi issues can be really frustrating, especially if you’re in the middle of sending an important work file, a video call with a relative living overseas, or a Netflix-bingeing marathon. But most of...See More

 
PLDT, Smart Emerge as Undisputed Fastest Fixed and Mobile Networks in PH
Techworld Date Posted: 11 April 2019 11:08 AM | 144 Views
Filipinos enjoy a much better digital experience whether at home or on the go with PLDT and Smart, which recently emerged as the undisputed fastest fixed and mobile networks in the Philippines, based on.... See More
 
PLDT, Smart Emerge as Undisputed Fastest Fixed and Mobile Networks in PH
Techworld Date Posted: 11:08 AM | 144 Views
Filipinos enjoy a much better digital experience whether at home or on the go with PLDT and Smart, which recently emerged as the undisputed fastest fixed and mobile networks in the Philippines, based on...See More

 
CES 2018: HyperX Reveals First Wireless Headset and New Suite of RGB Gaming Gear
Techworld Date Posted: 11 January 2018 10:58 AM | 348 Views
HyperX®, the gaming division of Kingston Technology, today demonstrated its first wireless gaming headset, the HyperX Cloud FlightTM, and an expanded suite of RGB gaming peripherals including the HyperX Alloy Elite RGBTM mechanical keyboard.... See More
 
CES 2018: HyperX Reveals First Wireless Headset and New Suite of RGB Gaming Gear
Techworld Date Posted: 10:58 AM | 348 Views
HyperX®, the gaming division of Kingston Technology, today demonstrated its first wireless gaming headset, the HyperX Cloud FlightTM, and an expanded suite of RGB gaming peripherals including the HyperX Alloy Elite RGBTM mechanical keyboard...See More

 
Transcend Wins Good Design Award 2017
Techworld Date Posted: 17 October 2017 3:05 PM | 454 Views
Transcend Information, Inc. (Transcend), a leading manufacturer of storage and multimedia products, today announced that its M.2 SSD Enclosure kit CM42 has won the "Good Design Award 2017" for top-quality, groundbreaking design. The Good.... See More
 
Transcend Wins Good Design Award 2017
Techworld Date Posted: 3:05 PM | 454 Views
Transcend Information, Inc. (Transcend), a leading manufacturer of storage and multimedia products, today announced that its M.2 SSD Enclosure kit CM42 has won the "Good Design Award 2017" for top-quality, groundbreaking design. The Good...See More

 
Honeywell Awards Three Scholarships to Chemical Engineer Students in the Philippines
Techworld Date Posted: 7 November 2017 4:41 PM | 308 Views
Honeywell (NYSE: HON) announced today that it has awarded scholarships to three Filipino students majoring in chemical engineering at a leading university in Philippines, affirming Honeywell’s continued investment in building the future engineering talent.... See More
 
Honeywell Awards Three Scholarships to Chemical Engineer Students in the Philippines
Techworld Date Posted: 4:41 PM | 308 Views
Honeywell (NYSE: HON) announced today that it has awarded scholarships to three Filipino students majoring in chemical engineering at a leading university in Philippines, affirming Honeywell’s continued investment in building the future engineering talent...See More


Power by

Download Free AZ | Free Wordpress Themes