Decrypting Live SSH Traffic in Virtual Environments

Mclaren, Peter; Russell, Gordon; Buchanan, William J; Tan, Zhiyuan

Abstract

Decrypting and inspecting encrypted malicious communications may assist crime detection and prevention. Access to client or server memory enables the discovery of artefacts required for decrypting secure communications. This paper develops the MemDe-crypt framework to investigate they discovery of encrypted artefacts in memory and applies the methodology to decrypting the secure communications of virtual machines. For Secure Shell, used for secure remote server management, file transfer, and tunnelling inter alia, MemDecrypt experiments rapidly yield AES-encrypted details for a live secure file transfer including remote user credentials, transmitted file name and file contents. Thus, MemDecrypt discovers cryptographic artefacts and quickly decrypts live SSH malicious communications including detection and interception of data exfiltration of confidential data.

Citation

Mclaren, P., Russell, G., Buchanan, W. J., & Tan, Z. (2019). Decrypting Live SSH Traffic in Virtual Environments. Digital Investigation, 29, 109-117. https://doi.org/10.1016/j.diin.2019.03.010

• Journal Article Type: Article
• Acceptance Date: Mar 26, 2019
• Online Publication Date: Mar 29, 2019
• Publication Date: Jun 1, 2019
• Deposit Date: Mar 26, 2019
• Publicly Available Date: Mar 30, 2020
• Journal: Digital Investigation
• Print ISSN: 1742-2876
• Publisher: Elsevier
• Peer Reviewed: Peer Reviewed
• Volume: 29
• Pages: 109-117
• DOI: https://doi.org/10.1016/j.diin.2019.03.010
• Keywords: network traffic; decryption; memory analysis; IoT; Android; VMI; Secure Shell; SSH; AES; Secure File Transfer; data exfiltration; insider attacks
• Public URL: http://researchrepository.napier.ac.uk/Output/1689113