Email Forensics & Malware Forensics Vocabulary

Flashcards for reviewing key vocabulary terms from the lecture notes on Email Forensics and Malware Forensics.

Phishing

An attempt to obtain personal information from a reader through email, often containing links to a fake webpage.

Pharming

Redirecting users to a bogus website by corrupting the domain name system (DNS).

Spoofing email

The practice of disguising an email's origin to commit fraud.

Spam Act 2003

Prohibits the sending of unsolicited commercial electronic messages with an Australian link.

Email Header

The 'envelope' of the email containing information such as sender, receiver, subject, and timestamps.

Email Body

The actual content or text of the email message.

MIME (Multipurpose Internet Mail Extensions)

A protocol allowing non-ASCII files (video, graphics, audio) to be included in email messages.

UUCODE

A UNIX format for encoding attachments in email.

BINHEX

A Mac format for encoding attachments in email.

Email Attachment

An extra file sent along with an email message, supplementing the body.

SMTP

Simple Mail Transfer Protocol, used to transfer email from client to server and server to server.

POP3

Post Office Protocol, allows clients to retrieve stored email from a server.

IMAP

Internet Message Access Protocol, provides a means of managing email messages on a remote server.

Applicable privacy laws for jurisdiction

Electronic Communications Privacy Act and Stored Communications Act

ARIN (American Registry for Internet Numbers)

To find point of contact of a domain’s IP address

Router logs

records all incoming and outgoing traffic and have rules to allow or disallow traffic.

Firewall logs

Filters e-mail traffic and verify whether the e-mail passed through

/etc/sendmail.cf

Configuration file for Sendmail

/etc/syslog.conf

Specifies how and which events Sendmail logs

master.cf and main.cf

configuration files of Postfix

Information Store Files

Database files used by Microsoft Exchange Server (*.edb).

Malware

Software that cybercriminals use to harm a computer system or network.

Objective of Malware Forensics

examining the malicious code and its behaviour in a secure and preserved environment

Malware forensics artifacts

the pieces of data that shows malicious activity.

Malware Forensics (Static Analysis)

code analysis, involves going through the executable binary codes without the actual execution

Malware Forensics (Run-Time Analysis)

behavioral analysis, involves executing malware code to simulate the environment