Memory FORESHADOW: Memory FOREnSics of HArDware CryptOcurrency wallets - A Tool and Visualization Framework

被引：8
作者：
Thomas, Tyler [1 ,2 ]
Piscitelli, Mathew [1 ,2 ]
Shavrov, Ilya [1 ,2 ]
Baggili, Ibrahim [1 ,2 ]
机构：
[1] Univ New Haven Cyber Forens Res & Educ Grp UNHcFR, Samuel S Bergami Jr Cybersecur Ctr, West Haven, CT 06516 USA
[2] Univ New Haven, Connecticut Inst Technol, West Haven, CT USA
来源：
FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION | 2020年 / 33卷
基金：
美国国家科学基金会;
关键词：
Memory Forensics; Data recovery; Hardware wallet; Cryptocurrency; Bitcoin; Ethereum; Ledger; Trezor; VOLATILE MEMORY; ACQUISITION;
D O I：
10.1016/j.fsidi.2020.301002
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
We present Memory FORESHADOW: Memory FOREnSics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client memory forensics. Our exploratory analysis revealed forensically relevant data in memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the Ledger and Trezor hardware wallet clients. The framework can be generalized for use in future memory forensics work. (C) 2020 The Author(s). Published by Elsevier Ltd on behalf of DFRWS. All rights reserved.
引用
收藏
页数：10
相关论文
共 45 条
[1]  
Ali S.S., 2018, P INT C SECURITY MAN, P153
[2]  
[Anonymous], 2018, BITCOINNEWS
[3]  
Baum J.B., 2014, WINDOWS MEMORY FOREN
[4]   Linux memory forensics: Dissecting the user space process heap [J].
Block, Frank ;
Dewald, Andreas .
DIGITAL INVESTIGATION, 2017, 22 :S66-S75
[5]   Memory forensics: The path forward [J].
Case, Andrew ;
Richard, Golden G., III .
DIGITAL INVESTIGATION, 2017, 20 :23-33
[6]   Detecting objective-C malware through memory forensics [J].
Case, Andrew ;
Richard, Golden G., III .
Digital Investigation, 2016, 18 :S3-S10
[7]   Dynamic recreation of kernel data structures for live forensics [J].
Case, Andrew ;
Marziale, Lodovico ;
Richard, Golden G., III .
DIGITAL INVESTIGATION, 2010, 7 :S32-S40
[8]  
Casey P., 2019, INCEPTION VIRTUAL SP
[9]  
Chainalysis, 2019, CRYPT CRIM REP DEC I
[10]   A Survey on Security and Privacy Issues of Bitcoin [J].
Conti, Mauro ;
Kumar, E. Sandeep ;
Lal, Chhagan ;
Ruj, Sushmita .
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, 2018, 20 (04) :3416-3452
12345