Question

What is caching and what is protected memory? What are Spectre and Meltdown? why memory forensics is important and what are its potential implications for the future of memory forensics?

Answer 1

What is caching?

Before knowing the meaning of cache . Please understand the term cache .

Cache : According to computer science , cache is a temporary storage area where frequently used or called data is stored.

Cache storage area is also called cache memory . Cache memory is highly useful for fast accessing of data.

It supplies user with the requested data without any delays and without any communications with the processors or    registers.

Generally CPU communicates with RAM for retrieving data , here RAM is another chip and CPU is another chip , but Cache stores memory recently visited in RAM but Cache is the part of the CPU chip . Hence it can provide speed memory access.

Example : The most suitable real time example for cache is mobile phone data. When we frequently use one app reference of that app will be stored in a cache memory and when we want to open it again we need not go to Home screen ,search all apps and open the required one . Instead we can open cache and the app we used recently will be on the top of cache.

Explaining technically , When we open a website in a browser and navigate through several links in the browser , for the first time all the links are requested to the server hosting the website , but later they are stored in cache to reduce the burden on server and not to make the user wait for long time

The process of storing data in cache is called Caching.

Caching is most preferred when computations are huge and we have to do same computation multiple times . It is the process of storing data in cache so that the future request for that data will be responded quickly.

###################################################################################################

What is protected memory?

Protected memory is a part of storage area in a system which cannot be accessed by other processes without permissions and proper authentications . Generally we protect memory during multi processing in order to protect our memory from being accessed or inferred by other processes in the same system.

Memory protection can be done at software level and hardware level . In the software level process isolation will be done which is process of separating process from one contacting other. It provides protection somehow in software level whereas in hardware level we achieve complete protection , hardware level of protection assigns particular memory locations to process so that no two processes infer with each other .

Memory protection is most commonly used in modern days CPU architectures and System software

This is done to achieve confidentiality , integrity and availability of data.

###################################################################################################

What is Spectre?

Spectre is a vulnerability that may result in serious problems of security . Spectre allows an attacker to hack even error free program and steal secret information from it. Generally in a system or in a mobile one program is not allowed to read data of another program . But this spectre is something that makes the programs to read data of another programs and steal valuable information like passwords, photos , important mails , business information , financial documents etc.,

It breaks separation of application programs and make them infer one another.

Spectre mostly affects modern processors and it is really tough to detect whether a system is being exploited by spectre.

Systems tha are generally affected by spectre are as follows:

Desktops

Laptops

Smartphones

Cloud servers

Mostly modern processors.

It is verified by the researchers that INTEL , AMD and ARM processes are mostly exploited by Spectre.

How to get protected from Spectre?

We can protect our PCs from Spectre by doing the following:

Updating OS

Using active and updated Anti-Virus Software

Updating firmware.

Keeping our browsers updated .

###################################################################################################

What is Meltdown?

Meltdown is also a vulnerability similar to Spectre but different in some specifications.As Spectre breaks separation of application programs Meltdown breaks basic isolation of user application and OS and allows the user to access the memory that contains sensitive information. It is easier to exploit when compared to spectre and there are software available that protect from the vulnerability of meltdown.

As Spectre it also affects modern processors.

How to get protected from Meltdown?

We can protect our operating systems from Meltdown by just updating to the recent software fixes released by particular OS handling companies like Windows , Apple etc

##################################################################################################

What is memory forensics?

Forensics is the term used to say scientific tests conducted to detect any type of technical crime . Memory forensics is predicting and investigating advanced computer attacks that happens on RAM , computer memory .

Information Security professionals do generally memory forensics, because they are fits to detect any attacks on computer's volatile memories. They have to investigate and detect the computer attack which generally doesn't leave any clues to find it.

Why memory forensics is important?

To predict any serious online crimes.

To protect from stealing of important information through our browsers.

To protect ourselves from leakage of data through our recent chats and messages.

To protect the leaked data if any from the RAM before the system crashes.

It helps to be alert of any crimes like social media crimes , financial data stealing etc.,

Potential Implications for the future of Memory Forensics

One of the limitations of memory forensics is in order to access volatile memory quickly the tools could not do more effort on detection , hence one of the potentials implications in future is creating smearing acquisition tools.

These tools keep track of the information changed or smeared in volatile memory and helps in detecting attacks more easily.

Second implication is Leveraging Virtual Machine Hardware Extensions .

This is the method of freezing one operating system and loading a small and second operating operating systems.

These are the possible potential implications that may help in improvising memory forensics and help information security professionals to do better forensics.

###################################################################################################