Bsides Exeter 2026

As defenders, over the last few years we’ve seen a seemingly relentless stream of incidents, vulnerabilities and attack campaigns targeting network edge devices and appliances. Exposed at the edge of our networks defending these devices is critical, but their proprietary and locked down operating systems mean we often lack the detection and response tools we use every day to quickly triage, investigate and remediate commodity server and client operating systems.

But under the hood, almost all modern network edge devices run some flavour of Linux. Memory collection and analysis on Linux is well supported by both commercial and open source tools such as Volatility 3. In this talk I’ll discuss some of the challenges of collecting and analysing memory on Linux-based appliances, and show how with some creativity (and a little reverse-engineering) you can often get the same level of visibility and analysis we get on more standard Linux operating systems.

Whether you’re an incident responder, part of a security team responsible for these devices or a device vendor I’ll discuss how you can be better prepared for incidents involving these types of systems and use memory analysis as a part of your investigation.