Forensic Analyzing Memory Image - Bulk-extractor

Bulk_extractor is a program that extracts features such as email addresses, credit card numbers, URLs, and other types of information from digital evidence files. It is a useful forensic investigation tool for many tasks such as malware and intrusion investigations, identity investigations and cyber investigations, as well as analyzing imagery and pass-word cracking.

1. Start Kali Linux and download memdump.mem [512 MB]
2. Run bulk_extractor -o bulk wordlist memdump.mem. The results will be placed in the "bulk" folder. 
3. Run cd bulk and then ls -l you will see a list of files
4. Use nano to view the files
• nano domain_histogram.txt. You will see domains visited on this computer and the number of times. You can use ctrl+W to search term, eg. ccsf.edu
• ctrl+X to close nano.
• nano ccn_historam.txt You will see the credit card numbers found. 
• nano wordlist.txt. You will see the words and the frequency. Useful for cracking encrypted files.

Note: Copy files from host to VM: you need to shutdown the guest and setup the "shared folder" so VM can access files on a folder on the host. Or you can enable USB on VM so you can access files through USB on guest. 

Reference: https://samsclass.info/121/proj/p4-Bulk.htm

Tensor Product

Tensor product is an outer product of two vectors. Here are some examples:

For two qubits:

For three qubits:

In "general",

Develop a static website on AWS

1. Have your webfiles ready. Such as index.html 

2. Sign in to the AWS Console 

3. Add a bucket under S3, eg. cs590.bucket 

3.1 unckeck "block all public access" so people can access your website. 

4. Click the "cs590.bucket" and copy the ARN 

5. Under "Objects", upload the webfiles. Note that the index.html file should be in the root folder. 

6. Go to the "Properties", edit the "Static website hosting" 

6.1 enable static website hosting 

6.2 choose "host a static website" 

6.3 type index.html as the index document. 

6.4 type error.html in error document. (Don't worry for now if you don't have this file.) 6.5 save changes.

7. Go to the "Permissions" tab, add a "bucket policy" 

7.1 click "Edit" button

7.2 click the "policy generator" button and then select "S3 bucket policy" 

7.3 type "*" in the Principal 

7.4 select "all actions" checkbox 

7.5 paste the ARN you copied in step 4. Something like this "arn:aws:s3:::cosc590.bucket". 

7.6 click "add statement" 

7.7 Click "Generate Policy" button 

7.8 Copy the JAON policy document. Something like this: 

{
  "Id": "Policy1605400973864",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1605400930003",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::cosc590.bucket",
      "Principal": "*"
    }
  ]
}

7.9 add "\*" at the end of the resource line. So the policy should like this:

{
  "Id": "Policy1605400973864",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1605400930003",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::cosc590.bucket\*",
      "Principal": "*"
    }
  ]
}

7.10 paste the policy to the "bucket policy" (step 7.1)

8. Go back to the "Properties" tab

9. Scroll down to the bottom 

10. Click the link to launch your website. The URL is something like this:

http://cosc590.bucket.s3-website-us-east-1.amazonaws.com

-------------------

Optional:

a. Add logs.cs590.bucket to store logs and enable under "properties". 

b. Add www.cs590.bucket and to redirect to cs590.bucket. 

Q: Why adding a policy (step 7)?

A: For security reason, the bucket access is disabled by default. This follows the "least privilege" security policy. 

CNOT Gate

 Controlled NOT gate: 

⏐x, y⟩ → ⏐x, x ⨂ y⟩

Matrix:  

The CNOT maps 

⏐0 0⟩ → ⏐0 0⟩

⏐0 1⟩ → ⏐0 1⟩ 

⏐1 0⟩ → ⏐1 1⟩

⏐1 1⟩ → ⏐1 0⟩

Proof:

⏐00⟩ = [1 0 0 0], ⏐01⟩ = [0 1 0 0], ⏐10⟩ = [0 0 1 0], ⏐11⟩ = [0 0 0 1], all vectors transposed for easy typing. 

Here ⏐0⟩ == [1 0] and ⏐1⟩ == [0 1] and ⏐ab⟩ = ⏐a⟩ ⨂ ⏐b⟩

Apply matrix multiplications: 

CNOT × ⏐00⟩ → ⏐00⟩

CNOT × ⏐01⟩ → ⏐01⟩

CNOT × ⏐10⟩ → ⏐11⟩

CNOT × ⏐11⟩ → ⏐10⟩

#

In math, left Kronecker product ⨂ is

For example: 

Qubit Operation (2)

CNOT gate: to flip iff  (if and only if) the control quit is |1>, otherwise it does nothing. 

Entanglement:

⏐+⟩ == [1/sqrt (2) * (|0> + |1>) == 0.707 |0> + 0.707 |1>

⏐-⟩ == [1/sqrt (2)] * (|0> - |1>)

X (a, b) = (b, a), NOT gate

|a, b> == |b, a>, see below qubit swap:

[a |0> + b |1>] |0> == a|00> + b|10>

|𝝍> == a |0> + b |1>

|𝝍>|𝝍> == a^2|00> + ab|01> + ab|10> + b^2|11>

Bell state (entanglement):

Linear Algebra - Qubit Operations

Vectors are commonly written in column format. Sometimes, we also use shorthand format such as (3, 4).

In quantum computing, the state |0> corresponds to vector (1, 0), and |1> corresponds to vector (0, 1). 

Commonly used quantum gates, quantum circuit symbols, and math representations: 

The Bloch sphere representation of X (NOT), H (Hadamard), and Z, S, T (phase) gates. 

We can see that 

• X gate rotates along X axis 180 degree (or less depending on the initial angle to Z axis). (NOT) 
• H gate rotates along Y  axis 90 degree (or less). 
• Z, S, T gates rotate along Z axis at certain degree. (phase)

PGP Encryption

Developed by Phil Zimmerman in 1991. It combines symmetric, asymmetric (public key) encryption, hash, and digital signature all together providing confidentiality, integrity, and authentication. Good for email. The algorithm:

At the sender (Alice) side: 

1. Alice: Message M is hashed
2. Sign (encrypt) the hash value with her private key (EP)
3. Compress (zip) the message + signed hash value
4. Use a session key Ks to encrypt zipped output (ES)
5. Use Bob's public key to encrypt session key (EP)
6. Send encrypted message and encrypted session key 

At the recipient (Bob) side:

1. Use Bob's private key to decrypt session key (DP)
2. Use session key Ks to decrypt the zipped message
3. unzip, got message and signed hash value
4. Use Alice's public key to decrypt the hash value 
5. Computing hash value for the message received
6. Compare with hash value Alice computed.

Below are the PGP diagram:

Mathematically:

Note:

Image copyright: Author of this post. Free to use but reference is required.