Hardware Keylogger Case Study - SANS DFIR Summit 2015

Подробнее о видео

Steve Gibson, Director, KPMG
David Nides, Director, KPMG @davnads

Hardware keyloggers were identified in a client environment. Upon analysis identified the mass storage volume associated with the hardware key logger data was not accessible due password protection at hardware level. Using a teensy (USB-based microcontroller development system) created a hardware based brute force device which was used to emulate a dictionary of keystrokes.

Ultimately this device exposed the password for the keylogger allowing sufficient analysis. Upon analysis of the device was able to tie the keylogger back to a hostname and user name with unique and surprising artifacts. Demo of teensy will be provided.

David Nides, Director – Forensic Technology Practice, KPMG
David is a Director with KPMG’s Forensic Technology practice in
Chicago, IL. Currently, he plays a national leadership role overseeing innovation and delivery of KPMG’s Cyber Investigations services.


Steve Gibson, Director – Forensic Technology Practice, KPMG
Steve is a former US Marine infantry sergeant and a former police
officer with the Austin Police High Tech Crime Unit. Having worked in DFIR since 1998, a programmer and Linux advocate, Steve is currently a Director with KPMG, supporting the Forensic Technology practice with custom software and solutions.

Download Slides Here: