Mozilla has released an open-source memory forensics tool for servers called Masche (an acronym for Memory Analysis Suite for Checking the Harmony of Endpoints) that checks the memory of processes, without affecting normal system activity .
The utility is part of the Mozilla InvestiGator (MIG) library, an endpoint security system, and runs on Windows, Linux, and OS X systems.
MIG is designed to allow investigators to collect data from a large number of systems simultaneously, a technique that reduces incident verification time and other daily security activities.
The platform retrieves information from agents distributed across all infrastructure systems.
Masche was designed and built by a team of students (Marco Vanotti, Patricio Palladino, Nahuel Lascano and Agustin Martinez Sune) from the University of Buenos Aires in Argentina.
The students worked on the project for six months. They are part of the Mozilla Winter of Security program, whose mission is to find less invasive and more user-friendly methods of monitoring memory.
“Compared to frameworks like Volatility or Rekall, Masche doesn’t provide the same level of advanced forensics functionality. Instead, it focuses on searching for regexes and byte strings in system processes, and it does so in real-time and very quickly,” explains Julien Vehent of Mozilla in a blog post.
Masche's capabilities "include searching for processes that load a specific library and access a process's memory. It also includes "pgrep," a function also available for Linux and BSD, which allows searching for processes that match patterns provided in a regular expression.
Vehent says that fully implementing the current scanning solution across three different operating systems was a difficult task.
Masche is distributed under the Mozilla Public License, version 2.0, and can be downloaded from GitHub, where related instructions are also provided.
