Saturday, October 29, 2011

Protecting Code


As the world is shifting from compiled languages such as C, C++ and Pascal to scripting languages such Python, Perl, PHP and Javascript, so does the growth in exposure of intellectual property (the source code). While previously “fat clients” usually written in C and C++ were a compiled machine code executables, more modern applications written in .NET and Java consist of bytecode which is a “is the intermediate representation of Java programs” (Petter Haggar, 2001). The same is applicable to .NET applications which could be disassembled using tools shipped with the .NET Framework SDK (such as ILDASM) and decompiled back into source code (Gabriel Torok and Bill Leach, 2003). With web technologies such as HTML, Javascript and Cascading Style Sheets (CSS) where the source has to be downloaded to the client side in order to be executed by the web browser, the end user has unrestricted access to the entire source code.
Ability to access source code can be used both for legitimate and malicious intent. For example, security tools are using the ability to decompile Java applets and Flash to “performs static analysis to understand their behaviours” (Telecomworldwire, 2009). Moreover, the ability to disassemble the source code can be used by the software developers for debugging. On the other hand, it can also be used to reverse engineer the source code which directly impact the ability to protect the intellectual property.
One obvious way to try to protect the source code, thus the intellectual property it carries, is to use obfuscation (Gabriel Torok and Bill Leach, 2003)(Peter Haggar, 2001)(Tony Patton, 2008). Regardless of the language used to the develop the application, obfuscation usually means:
  • replacement of variable names to non-meaningful character streams
  • replacement of constants with expressions
  • replacement of decimal values with hexadecimal, octal and binary representation
  • addition of dummy functions and loops
  • removal of comments
  • concatenating all lines in the source code
In a way, the process of obfuscation changes the source code to make it difficult for the “reader” to understand the logic behind it. It (obfuscation) could be seen as “your kid sister encryption” - “cryptography that will stop your kid sister from reading your files” (Bruce Shneier, 1996). Of course, persistent “reader” can invest enough time and resources to reproduce the source code (deobfuscate) by applying obfuscation principals in reverse.

Bibliography

Posted by at No comments:
Labels: , , , , ,

Saturday, October 22, 2011

Adaptave Web Site Design


Paul De Bra (1999), identifies a number of issues related to adoptive web site design including “the separation of a conceptual representation of an application domain from the content of the actual Web-site, the separation of content from adaptation issues, the structure and granularity of user models, the role of a user and application context” Paul De Bra (1999). This essay will discuss separation of conceptual representation and the role of the user in the application context more than ten years after publication of the original article.
Modern web application development frameworks such as .NET, Spring Framework, JavaServer Faces, Apache Orchestra, Grails and Struts offer clear separation between application representation and the content. The separation is achieved by implementation of Model-View-Controller (MVC) architecture where “Model” layer is responsible for storing and managing access to relevant pieces of data, “View” layer is responsible for rendering and layout of the data, and “Controller” layer is responsible for interaction with the end user (i.e. Internet browser). No more the entire content has to be “stored” statically in the HTML page, but generated dynamically based on input received from the user. Moreover, HTML5 Web Storage API greatly increase the storage capacity (compared to HTML session cookies) which allows web application to store structured data on a client side (WHATWG, 2011). This could further facilitate user centric web site design such as storage of user preferences, data catch, etc.
On the other hand, when discussion “the role of a user and application context” Paul De Bra (1999), the methodology and the technology is not as mature. Qiuyuan Jimmy Li ties the issue to the organization of the web application structure and notes that majority of web sites do not adapt the content to the individual user. Instead, the web server “provides the same content that has been created beforehand to everyone who visits the site” (Qiuyuan Jimmy Li, 2007). Instead, he suggest a framework which accounts for users' cognitive style and adopts information content for each individual user. Justin Brickell at. al. (2006) takes a slightly different approach and instead suggest mining site access longs to identify access patterns and user behavior such as scrolling, time spent on each page, etc. The collected information could be used for shortcutting - “process of providing links to users’ eventual goals while skipping over the in-between pages” (Brickell at. al., 2006).
In addition, it is important to highlight the security and privacy issues when discussing adaptive web-site design. In order for a web application to provide customized content, it (web application) requires to acquire or collect personal data about individual user and users' behavior patterns. For example, Google Gmail uses automated scanning and filtering technology to “show relevant ads” (Google, 2011). This could be considered by some individuals as intrusion into privacy, especially if the processed message contains sensitive information such as health records or financial information.

Bibliography

Posted by at No comments:
Labels: , , , , ,

Friday, July 29, 2011

Forensic Software Analysis

Linux/GNU provides a wealth of tools which can be used to analyze binaries such as file, strings, md5sum, hexdump, ldd, strace and gdb. Moreover, profiling tools such as AppArmor could be useful when analyzing behaviour of an unknown binary. For the purpose of demonstrating forensic software analysis process and recoverable artifacts, a number of Linux/GNU tools will be used to investigate Skype application. Conclusions of the investigation will be presented at the end of the document.

file

file command helps identifying file type and displays general information about the suspected binary.

file command

ldd

ldd command can be used to identify all shared libraries used by the suspicious software.

ldd command

gdb

gdb is a GNU debugger useful for debugging executable “see what is going on 'inside' another program while it executes—or what another program was doing at the moment it crashed” (Free Software Foundation, Inc. 2002). gdb allows an investigator to run a suspicious program step by step, view a value of a specific expression or print a stacktrace using bt command.

gdb command

gdb stacktrace

strace

strace can be used to display system calls and signals, including access to local and remote resources such as /etc/passwd. strace command could be used with -o parameter to output the content to a specified file.
The information includes:
  • a name of a system call
  • arguments; and
  • return values

strace command

strace output

The output file could be parsed with grep with appropriate regular expression to identify accessed and/or modified system resources.

grep strace output

strings

strings prints all printable characters in a specified file. It could be useful to identify system calls, resources, URLs, IP addresses, names, etc. when analyzing a suspected software.

strings command

strings output

AppArmor

AppArmor is a “Linux application security system” (AppArmor Security Project, 2011) using whitelist approach to protect the operating system and its users. It is done by enforcing “good” behaviour including open ports, allowed resources, etc. to prevent from known and unknown application flows.

AppArmor includes a “a combination of advanced static analysis and learning-based tools” (AppArmor Security Project, 2011) which could be helpful when investigator a malicious software behaviour. For purpose of forensic investigation aa-genprof command can be used to record all software activities which could be analyzed at the later stage.

When using aa-genprof to analyze potential malware behaviour, the investigator has to invoke all possible functionality to force the software to access all local and remote resource. In many cases, it is required to let the software run for a few days as some malware such as infected bots communicate with the bot controller periodically.

aa-genprof command

skype command

Skype main window

Skype calling echo123

Skype messaging echo123
aa-genprof analyzing Skype access to Pulse resources

aa-genprof analyzing Skype access to system fonts configuration

aa-genprof analyzing Skype access to local chat

aa-genprof analyzing Skype access to Firefox bookmarks

aa-genprof analyze Skype access to Firefox extensions

Conclusions

Skype application access resources required to display a graphic user interface (GUI) using Qt library, interact with audio devices through Pulse framework and resources required to use a network, all of which could be considered ass legitimate behaviour for a VoIP application.

On the other, Skype access to resources such as Firefox bookmarks and extensions such as LassPass (advance password manager), and system resources such as /etc/passwd raise suspicious as it resembles typical malware behaviour.

Bibliography

Posted by at No comments:
Labels: , , , , ,

Tuesday, July 19, 2011

Criminal Activity On Peer-To-Peer (P2P) Networks


Criminal activity on peer-to-peer (P2P) networks are usually associated with sharing of illegal such as copyrighted or offensive material (music, movies, snuff films or pornography). There are a number of cases when a law enforcement agencies successfully taken down the sites such as the case with Elite Torrents group (Charles Montaldo, 2005). But recently different peer-to-peer protocols such BitTorrent and Kad are being used to command and control an army of digital zombies (botnet). Botnet, controlled by a botmaster, can be used to attacks such as spam and denial of service.
As bots are getting more and more sophisticated allowing the controller to capture keystrokes, take screen shots, send spam and participate in denial of service attacks, and much harder to detect due to inclusion of rootkit capabilities, “the most significant feature, however, is the inclusion of peer-to-peer technology in the latest version of the botnet's code” (Peter Bright, 2011). Moreover, some bots allow controllers to “sublet”, for a price, an IP address to be used as anonymous proxy.
Peer-to-peer technology allows hacker to eliminate a “single point of failure” - a single (sometimes multiple) Internet Relay Chat (IRC) server or a Really Simple Syndication (RSS) feed to command the botnet. Over the years, there were a number of attempts by a botnet developers to develop the next generation utilizing peer-to-peer control mechanism such as “Slapper, Sinit, Phatbot and Nugache have implemented different kinds of P2P control architectures” (Ping Wang, Sherri Sparks, Cliff C. Zou, 2007), each with its weaknesses. For example, Sinit bot used random probing techniques to discover other Sinit infected machines which resulted in easily detected network traffic. Insecure implementation of authentication mechanism made Slapper easy to hijack. Whereas Nugache contained a list of static IP addresses used as initial seed (David Dittrich, Steven Dietrich 2008) (David Dittrich, Steven Dietrich 2009).
Modern implementation of the bots utilizing peer-to-peer protocol with combination of encryption (based on TLS/SSL) of the network traffic, public-key based authentication mechanism, randomly used ports with protocol mimicking to avoid anomalies detection on the network level and prevent hijacking of the botnet network by competing botmasters and law enforcement agencies. The TDL4 (or Alureon) dubbed as “the ‘indestructible’ botnet” and it is running on over 4.5 million infected computers at the time of writing (Sergey Golovanov, Igor Soumenkov 2011).
To make botnet more resilient, a hierarchical structure is used with each servant (a hybrid of bot and server) communicates with a small subset of bots, and each not contains a small list of other peers (in case servant is not available). The servants themselves are rotated (dynamic) and updated periodically to prevent capturing and disturbing the botnet network. Locally, the malware uses rootkit functionality to avoid detection by anti-viruses. For example, Alureon botnet “infects the system's master boot record (MBR), part of a hard disk that contains critical code used to boot the operating system” (Peter Bright 2011), meaning that rootkit is loaded before operating system and an antivirus software.
Forensic investigation of crime involved advanced peer-to-peer botnet involves a combination of reverse engineering, operating system and network forensic. For example, TDL4 infects victims MBR which, up on investigation, immediately identify the presence of the rootkit. Moreover, a presence of certain files (recoverable from offline forensic image) such as cfg.ini and ktzerules in certain locations could indicate infection. On a network level, upon infection the malware downloads and “installs nearly 30 additional malicious programs, including fake antivirus programs, adware, and the Pushdo spambot” (Sergey Golovanov, Igor Soumenkov 2011) making it possible to monitor and detect the botnet activity.

References

Posted by at No comments:
Labels: , , , , , , ,

Friday, July 8, 2011

Legal Aspect of Remote Monitoring


Regardless of the device owners awareness, remote monitoring of a computer or mobile device can be done by an agent deployed on the device, or by analyzing the traffic generated by the device. Each of these approaches have its own pros and cons that will be discussed below.
Remote monitoring of a computer utilizing locally deployed agent (such as event log monitor or key logger) can provide a wealth of information such as currently running processes, existing and active users, access to installed applications, etc. Legitimate deployment of such agents usually done by installing the software on a workstation or laptop by a system administrator either with or without users knowledge, while tools such as key loggers used by malicious users or criminal are usually deployed using existing vulnerabilities in the operating system, web browser or other installed applications. It is interesting to note that many legitimate monitoring software packages are using technology and methods previously used my malware. For example, many of employee monitoring software have capabilities such as keystroke monitoring, send and received Email messages logging, website activity, accessed documents, etc (TopTenReviews, 2011).
On the other hand, monitoring computer activities by analyzing the generated network traffic does not require the installation of a user agent (malware), means it leaves no traces on the computer itself which can be uncovered by a digital forensic investigator. The disadvantage, of course, is that the information can be deducted only from services and applications generating network traffic. For example, laptops connected to a domain will try to communicate to a domain controller, Java JRE and Adobe Reader periodically checks for available updates therefore providing the intruder with a list of potential targer (services and applications). In some cases, when devices communicates using insecure protocols, it is possible to gather information such as user names and passwords. Moreover, there are some attack vectors which can subvert the traffic such as DNS poisoning, ARP poisoning and Man In The Middle (MiTM) Proxy to servers/devices controlled by the intruder.
From a legal point of view, the technical aspect of data acquisition could fall into a different category. For example, in the US data collected while in transit, such as Email message, falls under the Wiretap Act therefore requires special permission. On the other hand, “dropping” a key-logger and collecting data as it is being drafted does not violate the Wiretap Act. Similarly, “at the recipient’s end, the U.S. District Court of New Hampshire in Basil W. Thompson v. Anne M. Thompson, et al., ruled that accessing email stored on a hard drive was not an "interception" under the Wiretap Act” (Ryan, DJ. & Shpantzer, G. 2005). Moreover, the age of the acquired data impacts the applicable legal requirements; Recent data, less than 180 days, which would include network log files, even logs, etc. “requires a warrant issued under the Federal Rules of Criminal Procedure or equivalent State warrant, while older communications can be accessed without notice to the subscriber or customer” (Ryan, DJ. & Shpantzer, G. 2005).
Finally, network environment introduces unique challenges to the digital forensic process, such as inability to take a snapshot, distributed geographic locations with different legal requirements and the amount of available data, requires some adaptation of the AAA principals (Laureate Online Education B.V., 2009). In order to be admissible in the court of law, the handling of network traffic as a digital forensic evidence, has to be in accordance with Daubert guidelines which “assess the forensic process in four categories: error rate, publication, acceptance and testing” (John Markh 2011). Moreover, due to the high volatility of the artifacts, the investigators are required to pay additional attention to the chain of custody.

Bibliography

  • Laureate Online Education B.V. 2009, “Computer Forensics Seminar for Week 6: Network Forensics I”, Laureate Online Education B.V.
  • Markh J. 2011, “Week 5 Discussion Question - UNIX Forensic Tools”. Laureate Online Education B.V.
  • Ryan, DJ. & Shpantzer, G. 2005. “Legal Aspects of Digital Forensics” [online]. Available from: http://euro.ecom.cmu.edu/program/law/08-732/Evidence/RyanShpantzer.pdf (accessed: July 07, 2011).
  • TopTenReviews 2011, “2011 Monitoring Software Review Product Comparisons” [online], TechMediaNetwork.com, Available from: http://monitoring-software-review.toptenreviews.com/ (accessed: July 7, 2011).
Posted by at No comments:
Labels: , , ,

Thursday, July 7, 2011

Criminal Profiling in Digital Forensic


Criminal profiling has been used by crime investigators for centuries. It gained world wide attention after being used in England in Jack the Ripper case. Diamon A. Muller (2000) describes criminal profiling as a process “designed to generate information on a perpetrator of a crime, usually a serial offender, through an analysis of the crime scene left by the perpetrator” allowing law enforcement agencies to better utilize limited resources. Criminal profiling has two distinct approaches: inductive and deductive analysis (Rogers M. 2003). The inductive approach relies on the statistical analysis of behaviour patterns from previously convicted offenders while deductive focuses on the case specific evidence. One of the examples of criminal profiling methodologies is “diagnostic evaluation (DE), crime scene analysis (CSA), and investigative psychology (IP)” (Diamon A. Muller, 2000).
There are two contradicting points of view on criminal profiling; some claim it is an art while others claim it is a science similar to criminology and psychology. Moreover, as oppose to criminology or physiology, human lives may be depended on accuracy of criminal profiling: “if a profile of an offender is wrong or even slightly inadequate police maybe misled allowing the offender to escape detection for a little while longer—and innocent people may be dead as a result.” (Diamon A. Muller, 2000). As a result, many law enforcement agencies are still evaluating the adoption of criminal profiling.
Since digital forensic investigation is in essence crime investigation, that has similar investigation phases (acquisition of evidence, authentication, analysis and reporting/presentation), criminal profiling can be used as well to predict offenders behaviour. Just like in the traditional crime investigation, “digital” offenders have motives, different skill levels and tools. Regardless on the profiling methodology (inductive or deductive), the results of criminal profiling can greatly aid digital forensic investigation.
“The network evidence acquisition process often results in a large amount of data” (Laureate Online Education B.V. 2009) and the results of criminal profiling can help the investigator conduct a more specific keyword search, focus of specific area (i.e. allocated and unallocated space) and geographical location (IP addresses). Moreover, the profiling information can pinpoint supporting or corroborating evidence such as IRC chat channels, FTP sites, underground forums and newsgroups (Rogers, M 2003).
Just like traditional criminals, “digital” offenders have weaknesses that could be used when interviewing/interrelating suspects or witnesses. Although the interview process itself could be completely different from what we traditionally understand as “interview” (i.e. IRC chat rooms, forums, mailing lists, etc.), Rogers M. notes that “individuals who engage in deviant computer behaviour share some common personality traits, and given the proper encouragement, show a willingness to discuss and brag about their exploits” (Rogers, M 2003).

Bibliography

  • DAMON A. MULLER 2000, “Criminal Profiling: Real Science or Just Wishful Thinking?” [online], HOMICIDE STUDIES, Vol. 4 No. 3, August 2000 234-264. Sage Publications, Inc. Available from: http://www.uwinnipeg.ca/academic/ddl/viol_cr/files/readings/reading22.pdf (accessed: July 7, 2011).
  • Laureate Online Education B.V. 2009, “Computer Forensics Seminar for Week 6: Network Forensics I”, Laureate Online Education B.V.
  • Rogers, M 2003, 'The role of criminal profiling in the computer forensics process', Computers & Security, May, Business Source Premier, EBSCOhost, viewed 7 July 2011.
Posted by at 1 comment:
Labels: , , ,

Saturday, July 2, 2011

Forensic Investigation of Celullar and Mobile Phones

“In general, the same forensic principles that apply to any computing device also apply to mobile devices in order to enable others to authenticate acquired digital evidence.” (Casey E. at. al. 2011) therefore a forensic investigator should follow the same forensic process as with any computing device. When an acquired digital evidence involves a recovered phone call, the investigation process usually include accessing data collected by the cellular network provider. A number of countries have erected laws to expedite the access of the law enforcement agencies to the client information, such as The Regulation of Investigatory Power Act of 2000 (RIPA) in UK, USA Patriot Act, The Surveillance Devices Bill 2004 in Australia and The Search and Surveillance Powers Bill 2008 in New Zealand. These laws require (telephone and internet) service providers to maintain a log of all communication such as calls, Email messages, SMS (text messages), MMS (multimedia messages), established Internet connection, etc.
With appropriate legal documents (as required), the investigator can obtain information such as customer name, billing name, geographic locations (based on the Base Station Transceiver), list of calls, etc. which could be helpful for the investigation process. More over, while it is generally believed that prepaid cellular phones are cheap enough and difficult to trace (Casey E. at. al. 2011), the device can still contain useful information. In addition, service provider could maintain information such as “credit card numbers used for purchases of additional time or an email address registered online for receipt of notifications” (Jansen W. and Ayers R. 2007).
Due to the diversity in the functionality and capabilities of the mobile devices (cellular phones, smart phones, etc) there is no one single investigation methodology of the cellar phone. In general, the process involves manual review of the information available through the menu such as address book, last call, text messages, etc. Specialized tools are used only when extraction of deleted information or access to “hidden” data (such as Apple iPhone cell towers and Wi-Fi hotspots database) is required (Laureate Online Education B.V. 2009). The potential evidences related to the mobile device include:
  • handset identifier - International Mobile Equipment Identity (IMEI)
  • Subscriber Identifier (SIM)
  • call register
  • address book
  • calendar
  • photographs
  • videos
  • voice mail
  • passwords such as Internet Mail accounts, desktop (for synchronization), etc.
  • installed applications
  • attached peripheral devices and special modification
  • accessed Wifi hotspots
  • cell towers

Bibliography

Posted by at No comments:
Labels: , , , , ,

Friday, June 24, 2011

Vishing and VoIP Forensics


Royal Canadian Mounted Police (2006) defines Vishing (or Voice Phising) as “the act of leveraging a new technology called Voice over Internet Protocol (VoIP) in using the telephone system to falsely claim to be a legitimate enterprise in an attempt to scam users into disclosing personal information”. Vishing could be viewed as natural evolution of Phishing which uses Email messages by the con artists to glean private information such as credit cards, social insurance numbers and PIN numbers. While the general public is getting more and more familiar with this type of con as well as Email software vendors include functionality to prevent Phishing attacks, the fraudsters are moving on to the technology still trusted by the users – telephony.
Traditionally, in the world of public switched telephone network (PSTN), although possible (Art of Hacking, 2000) it was much harder to spoof Caller ID (CID) as “each circuit on either end of the call is assigned a phone number by the phone company.” (Reardon M. 2009). Today, with the the move to SIP trunks and VoIP technology, spoofing caller ID is fairly trivial. Moreover, there are legitimate ways to acquire a telephone number in a any region in the world such as Skype Online Number. According to Adam Boone (2011), “telecom security researchers over the past two years have reported a very sharp rise in attacks against unsecured VoIP systems”. As a result, phishers have access to infrastructure which could be used to launch vishing attacks as demonstrated in scam targeting Motorola Employees Credit Union, Qwest customers and Bank of the Cascades (Krebs B. 2008).
In most cases, vishing attack involves calling someone using either a war dialler or legitimate voice messaging company. When call is answered, an automated message informs the caller that either the credit card or their bank account has an suspicious activity, and asks to call a predefined number to verify their account by entering their credit card number.
Digital forensic investigation of a vishing suspect is not a trivial matter. Since the attack is usually initiated by calling or texting (SMS) a large number of phone numbers, an investigator could look for unusual behaviour pattern. A number of forensic software can parse Skype artifacts, either in memory (RAM) or on an acquired image, such as Skypeex, Nir Sofer Skype Log Viewer and Belkasoft Skype Analyzer. For other software such as Astrix, a manual review of the log file will be required. Moreover, a forensic investigator utilize foremost command to look for .wav or .mp3 files which could be used as a recorded message. Finally, the SIP trunk service provide which was used by the frtaudsters could provide information such as user-id. This information could be used in the string search (srch_strings command) in acquired memory or non volatile storage images to identify suspected hardware.

Bibliography

  • 'Beware of phishing--and vishing' 2006, Nursing, 36, 12, p. 66, Academic Search Complete, EBSCOhost, viewed 24 June 2011.
  • Art of Hacking (2000), “Beating Caller ID” [online]. Available from: http://artofhacking.com/files/beatcid.htm (accessed: June 24, 2011).
  • Boone, A 2011, 'Return of the Phone Phreakers: Business Communications Security in the Age of IP', Security: Solutions for Enterprise Security Leaders, 48, 4, pp. 50-52, Business Source Premier, EBSCOhost, viewed 24 June 2011.
  • Chow, S, Gustave, C, & Vinokurov, D 2009, 'Authenticating displayed names in telephony', Bell Labs Technical Journal, 14, 1, pp. 267-282, Business Source Premier, EBSCOhost, viewed 24 June 2011.
  • Krebs B. 2008, “The Anatomy of a Vishing Scam” [online]. Available from: http://blog.washingtonpost.com/securityfix/2008/03/the_anatomy_of_a_vishing_scam_1.html (accessed: June 24, 2011).
  • Swarm, J 2007, 'A Closer Look at Phishing and Vishing', Community Banker, 16, 7, p. 56, Business Source Premier, EBSCOhost, viewed 24 June 2011.
  • Reardon M. 2009. “Protect yourself from vishing attacks” [online]. CNET News. Available from: http://www.zdnet.com/news/protect-yourself-from-vishing-attacks/303175 (accessed: June 24, 2011).
  • Royal Canadian Mounted Police (2006), “Vishing or Voice Phishing” [online]. Available from: http://www.rcmp-grc.gc.ca/scams-fraudes/vish-hame-eng.htm (accessed: June 24, 2011).
Posted by at No comments:
Labels: , , ,

Thursday, June 23, 2011

Firefox 3 Forensic Analysis

Accessing information on the Internet leave variety of footprints such as visited websites, viewed content, downloaded documents, etc. The forensic information could be found in single files, directories, local databases and Windows registry. Moreover, Windows operating system maintains in registry a log of all local and wireless network connections (including the MAC address of the switch/router) which can further help forensic investigation to identify the physical location of the suspect (Laureate Online Education B.V., 2009) (Jonathan Risto, 2010).

According to W3School (2011), the five most used web browsers are Firefox (42%) followed by Chrome (25%) and Internet Explorer (25%), then Safari (4%) and Opera (2.4%). As such, digital forensic investigator should be knowledgeable in all four and geared up to perform extraction and analysis of the data collected by these Internet Browsers. In most cases, Internet browsers use local cache to store information to increase access time, history of visited web sites, favourites, etc. In some cases (Firefox), the stored information indicates if the suspect typed the Uniform Resource Locator (URL) showing intent of criminal or illegal activity. Furthermore, autocomplete history and cookies can provide the forensic investigator on information typed entered to the websites, or stored locally. In addition to that, the increasing use of web chats such as Yahoo! Chat and Gmail Chat allow provides potential access to additional information.

While Internet Explorer and Firefox traditionally stored the information in a file, from Firefox version 3 the information stored in the SQLite databases. For example, bookmarks and browsing history are stored in places.sqlite, passwords are stored in the key3.db and signons.sqlite, autocomplete history in formhistory.sqlite and cookies in cookies.sqlite (Mozilla.org, n.d.) Numerous tools are available to perform forensic analysis of the information captured by the Firefox, including f3e and a simpel SQLite command line utility.

To locate SQLite 3 database, an investigator can utilize signature based search (i.e. foremost command) and look for the following hex value: 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33. To make sure that the identified SQLite database file is indeed a file used by Firefox, the following signature could be used to validate the file: 43 52 45 41 54 45 20 54 41 42 4C 45 20 6D 6F 7A 5F 62 6F 6F 6B 6D 61 72 6B 73.


After curving the SQLite 3 database file (using dd or foremost commands), it could be accessed simply by using sqlite command. All Firefox SQLite 3 files, are in essense a database with multiple tables. For example, places.sqlite contains the following tables: moz_anno_attributes, moz_favicons, moz_keywords, moz_annos, moz_historyvisits, moz_places, moz_bookmarks, moz_inputhistory, moz_bookmarks_roots and moz_items_annos.

Since SQLlite does not require authentication to work with the database, SQL statements could be used to retrieve relevant information (case specific). For example, the following query will retrieve 20 most visited websites:
sqlite> SELECT rev_host FROM moz_places ORDER BY visit_count DESC LIMIT 20;
to retrieve all places associated with the word “drugs”:
sqlite> SELECT * FROM moz_places WHERE url like "%drugs%";
or, to display all completed downloads (firefoxforensics.com, 2008):
SELECT url, visit_date
FROM moz_places, moz_historyvisits
WHERE moz_places.id = moz_historyvisits.place_id AND visit_type = "7"
ORDER by visit_date

Firefox Anti-forensic Features

Firefox includes a number of anti forensic features which could be either invoked by the suspect, or automatically by the Firefox itself such as removal of old history records after a period of 90 days. Moreover, a suspect could use “Private Browsing” functionality or manually invoke “Clear Recent History”. In these cases, Firefox fills the space of each record with zeros, effectively wiping the data.


Regardless, although the content of the records is wiped, Pereira, M (n.d.) has demonstrated that “when searching all disk, record vestiges was found in unallocated space” either due to reallocated data by the underlying OS or due to the “rollback” journal used by the SQLite engine.

Bibliography

Posted by at No comments:
Labels: , ,

Friday, June 17, 2011

Destruction of Sensitive Information


Destruction of sensitive information has being on the agenda of many organizations and governments. As a result, numerous standard were developed such as U.S. Department of Defence (DoD) 5220.22-M, National Institute of Standards and Technology (NIST) 800-88 and Canada Communications Security Establishment (CSE) ITSG-06, to provide guidance to the IT administrators and owners to protect against information retrieval when recycling or disposing of storage media.
NIST lists four types of sensitization types: disposal, cleaning, purging and destroying. In most cases, disposal of the storage media is not considered as secure method of discarding media containing sensitive information. The rest of this paper will review the defined standard for the data cleaning standards.
Cleaning refers to a method of removing sensitive infromation that would protect the data “against a robust keyboard attack” (Richard Kissel at. al., 2006). Simple deletion of files is not sufficient for clearing as operating systems simply mark the appropriate entries in the FAT File Allocation Table, or equivalent in other file systems, as deleted leaving in the Data Region unchanged. As a result, the data could be potentially recovered using forensic tools. Up until 2001, the standard method of securely clearing sensitive information was overwriting the data with zero, one, random or predefined patterns such as “Gutmann Method” (Peter Gutmann, 1996). For example, Communications Security Establishment (2006) defines overwrite process as “process itself must include a minimum of three passes including 1s, 0s, and a pseudo-random pattern over the entire accessible area of the magnetic tape or disk, followed by verification of results by the human operator.”
The intent of the overwriting process is to overcome the the track-edge phenomenon allowing recovery of the magnetic pattern residue from track boundaries using magnetic force microscope. Using the microscope, the researches examine the relative peaks of magnetic transitions, to recover the binary data. Although the attack on the track-edges were documented in the laboratory environment, “it requires a very well equipped research laboratory with costly microscopy equipment and highly trained researchers with a great deal of time and patience” Communications Security Establishment (2006). Moreover, as the data written to the magnetic media become and more dense. According to Seagate press release (2011), it has reached “areal density of 625 Gigabits per square inch”, which is 310 million times over the density of the first hard drive. As a result, the effort required to recover the data makes it virtually impossible. Richard Kissel et. al. (2006) writes that “studies have shown that most of today’s media can be effectively cleared by one overwrite.”
Furthermore, since about 2001, all ATA IDE, SATA and SCSI hard drive manufacturer include support for the "Secure Erase" or “Secure Initiate” commands which writes binary zeros using internal fault detection hardware. Although the method not does precisely follows the DoD 5220.22 “three writes plus verification” specification, the university of California Magnetic Recording Research (2008) “showed that the erasure security is at the level of DoD 5220, because drives having the command also randomize user bits before storing on magnetic media”. Moreover, NIST Special Publication 800-88 classifies “Secure Erase” command as acceptable method of purging, equivalent to media degaussing.

Bibliography

Posted by at No comments:
Labels: , ,
Subscribe to: Posts (Atom)