Last year, we gave a presentation proving that what we have been calling USB serial numbers, turns out to not be serial numbers. In fact, we showed a number of examples where Windows reported multiples of "serial numbers" for the same USB item. We were able to show this because of the luxury of conducting testing on a known device. The downside is that often you don't have that device when conducting your investigation, so you have to trust what Windows is reporting. At the time I gave the talk, I couldn't explain why. Subsequent intensive training has answered the question. In fact, now I can plug in multiple different devices to get the SAME "serial number!" This talk will cover demonstrations and answer the questions we couldn't answer last year. Come and listen to the rest of the story!SANS DFIR Summit 2023
Speaker: Kevin Ripa, Senior Instructor, SANS Institute
View upcoming Summits:
Музыка
Фильмы
ТВ Шоу
Категории видео
