Building a Decoder for the CVE-2014-0502 Shellcode

Yesterday on the Volatility Labs blog I published a post on analyzing some interesting shellcode from a recent attack campaign and 0day exploit. The shellcode was encrypted multiple times and required full static reversing before revealing the algorithm needed to decrypt the backdoor URL. I think you will like it:

http://volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.html

Interview on the Healthy Paranoia podcast

I was recently interviewed on the Healthy Paranoia podcast about memory forensics during DFIR as well as other related topics. It was a really fun time, and I hope to be on the show again in the future. Read about the interview and listen to the MP3 here:

http://packetpushers.net/healthy-paranoia-show-14-digital-forensics-and-incident-response-with-andrew-case/

Please contact me if you any feedback or comments about the show.

Thanks,
Andrew (@attrc)

Windows Memory Forensics Training for Analysts by Volatility Developers

We are please to announced the public offering of our Windows Memory Forensics for Analysts training course delivered by Volatility developers.

Information on the course and the December offering can be found on the Volatility Labs blog:

http://volatility-labs.blogspot.com/2012/11/windows-memory-forensics-training-for.html

Please contact me with any questions or comments.