CIS3605 - Digital Forensics

Event

Any observable occurrence in a system or network

Incident Response and Team

The coordinated activities from people with different roles to manage an incident from detection to resolution

Incident

A violation or threat of violation of computer security policies, acceptable use policies or standard security practices

Digital Forensics

The application of science where evidence is digital. The evidence is used by Law Enforcement and Corporations.

Stakeholders

The people affected or impacted by forensics investigations both vertically and horizontally. Examples include Legal, Business or Clients, Government, Peers, Management, Court of Law

Love Hertz Case

Victims were reporting of scams through Craiglist. Perps were selling stolen cars from rental companies (i.e. Hertz) using forged registrations and documentation.

The investigators started by doing undercover investigations, reaching out to the perps to get their online details, locations, contact information. When the investigation moved forward, the team used warrants to search through devices, cellular towers, and online postings from the perps’ account.

With enough evidence collected (photos, geolocation, messages), the perps got convicted. About 75 stolen cars were retrieved and 34 perps were found guilty of wire fraud, fraud by wire, and interference of state commerce.

CISSP

An independent information security certification granded by the International System Security Certification Consortium (ISC).

The certification showcases the cybersecurity professional ethics.

Computer Crime

Crimes committed with computers

Cyber Crime

Computer crimes that involve the Internet

Computer Related Crime

Illegal activity enabled using computers

Digital Crime

Illegal activity, referring specifically to intrusions, unauthorized access, and acts against electronic data affecting the availability (destruction), confidentiality (dissemination) or integrity (alternation) of electronic data

Michelle Theer (2000)

John Diamond was found killing Marty Theer. However, the motive was unclear, as the men has barely a connection between each other. The case took for a turn when examining John’s devices. Using access to emails, messages, and personal ads (cookies), they were able to link Michelle as the mastermind behind the murder due to evidence of an affair with John and conspiracy of murder.

US Government Regional Computer Forensics Laboratory (RCFL)

17 regional labs across the US that is dedicated to support investigations in crimes such as terrorism, CP, violence, and trade secrets.

The labs are for forensic research as well as training.

Chain of Custody

An accountability document that is used to track and maintain the integrity of evidence. Anyone who is handling evidence must review and update the documentation.

Kali Linux

• Free and open source distribution

• User Interface (UI) is based on GNOME

• Contains over 600 open source tools to aid in Penetration Testing, Auditing, and Forensics

Live DVD, USB Drive, Virtual Environment

What are ways to launch Kali Linux?

RISC Processor

• Advanced RISC Machine (ARM)

• Reduced Instruction Set Computing

• Ideal for devices, lightweight laptops/tablets, phones, and IoT

dd (disk dump)

Copies the entire content of the input file into the output file

• Clones bit by bit from the source

• Great way to keep the original state of the artifact

Apple Imaging

.dmg (Disk Image) are created using Mac OS X disk utility

rahash2

Command: Tool to generate a hash value (SHA256)

Syntax: —— filename

grep

Command used to search the contents of a file

Syntax: —— “string” /sourcefolder/filename

ls

Command: Output list of all files found in a folder

Syntax: —— -las | more

file

Command: One way to learn the properties of the file

Syntax: —— -s /devicepath/filename

fdisk

Command: Displays more information about a device’s partition

Syntax: —— -l

mount

Command: Makes a partition accessible in the file directory

mkfs

Command: Formats the partition, AKA makes a file system

Linux Kernel

Separates the operating system core from the user space in rings

• Inner ring is where the kernel operates, outer ring is the user’s space

• Hardware: Kernel detects/configures hardware/peripherals

• Processes: Tasks that are running

• Users: Manages user requests

• Permissions: Manages authentication and roles

• File Systems: File structure controls

apt-get install

• Gets the listing of the package index files from the remote repository

• Determines if packages are installed and if they have the latest release

apt-update

• Downloads most recent index list

  • Synchronizes the package index file

apt-upgrade

• Updates packages already in the system

• Will not install new packages

• Will not remove unused packages

• Will not make changes to packages that shares dependencies with another package that is not included in the upgrade

apt-cache

Command: Used to find a package name after an update was made

File System Format

The way data is physically stored in a drive

• Ext2, Ext3, FAT

ps aux

Processes are running instance of an application managed by the kernel which allocates resources

This command shows all the processes that are currently running

chmod

Command: Changes permissions of a file

syntax: —- filename

ping

The command is used to test connectivity between the host system and the client system

• Great for network diagnostics as it checks if you can connect to a system

whois

Command that gives information regarding domains and IP addresses, specifically the owner of the domain.

• How it works is that is searches the whois database with the given domain/IP

• It shows: Organization, Host, Registration Dates, Registration Expiration

nslookup

Command used for DNS queries, used to find domain names or IP address

nmap

A free network directory tool that allows users to:

• Find live host on a network

• Scan ports

• Ping sweeps

• OS and version detection

telnet

• Command used on other network devices such as routers or switches

• Uses to check open/closed ports

• A way to connect to another system in the network

curl

Sends requests to another device in the network to generally transfer data

wget

Command to generally download files from another system in the network

Autopsy

An open source digital forensic tool used to investigate and analyze computer systems.

• User-friendly interface for the Sleuth Kit (TSK)

  • Allow analysis on hard drives, mobile devices, and other digital media

Virus

• Malicious code

• opposing the protection to the CIA triad

• meant to cause harm

Threat

The possibility a system is vulnerable to an attack

Attack/Exploit

The execution of a threat to a target

APT

Advanced Persistence Threats

Cyber-attacks that call for an unauthorized attacker to code their way into a system network.

Siphons financial information and other critical security information

Confidentiality, Integrity, Availability

What are the pillars of the CIA triad?

Cyber Kill Chain

Defines the pre and post exploit steps an adversary must conduct to reach the objective

• Reconnaissance

• Weaponized

• Deliver

• Exploit

• Install

• Command and Control

  • Act on Objective

Mitre Framework

• Addresses threats through modeling

• Drive security controls

• List of adversarial groups

System Data Source

Type of Data Source

• Process command line monitoring

• File and registry monitoring

• Authentication logs

• Package captures

Injection

Exploits a valid input field in a form or website

Cross Site Scripting

Exploits a web server response to a client by inserting malicious JS code to the web page

Brute Force

Guess every possible input value

Rainbow tables

A collection of commonly used passwords with hash values

• Used to aid in attacks by comparing a given value to the hash sets

Birthday Attack

Frequency of hash collisions

Klein Attack

Wireless password guessing

Distinguishing attack

Technique that makes a distinction between cipher text and random data

Cryptanalysis Attacks

Finding a weakness iin the encryption implementation like weak keys

ransomware

encrypts an asset then asking for monetary ransom to unlock the data

malware

malicious code

phishing

emails containing malicious code or links

Spoofing

manipulation of email headers

bombing

excessive amounts of emails to overwhelm a server

APT29

A threat group related to Russia’s Foreign Intelligence Service (SVR).

• Compromised the Democratic National Committee

• Targeted NATO member countries, research institutes, and government networks

• Campaigns: SolarWinds and Operation Ghost

Botnets

A plethora of zombie computers that are used to carry out meticulous Distributed Denial of Service DDoS attacks.

• Overwhelms the victim and make them give in to paying the ransom and gain back control of their system

Crypto Jacking

Steals CPU resources from the computers they infiltrate

Trojan Horse

A program that appears legitimate but is infected with a myriad of viruses

Rootkits

A collection of tools that are placed on a network by an attacker that has exploited a system security vulnerability.

SQL Injection

Malicious code used to exploit security vulnerabilities and obtain or destroy private data.

Network Forensics

Monitor network intrusions and analyzes network traffic, such as local, WAN and Internet

Network Packet

A data source used to show evidence of an event

• Basic unit of formatted data carried by the network

Data Sources

Four major categories

• Files

• Operating Systems

• Network Traffic

• Applications

Communication Models

Industry standards model communication protocols

Models designed for interoperability between syste,s

Used to communicate between systems.

OSI (Open System Interconnection)

A communication model created by the military

Contains 7 layers:

• Application

• Presentation

• Session

• Transport

• Network

• Data Link

• Physical

TCP (Transmission Control Protocol)

A standard protocol written by Vincent Cerf and Bob Kahn to send data from one network device to another.

Located in the Transport layer of the OSI model.

UDP (User Datagram Protocol)

A standard protocol developed by John Postal to send data across the network, specifically asynchronously. UDP is a best-effort method, where data packets are expected to be loss between transfer.

Network Ports

A process specific or service as a communication endpoint for an application

• 1024 Known Ports

• Used by the Transport Layer

Telnet

Port 23

Used to manage network devices at the command level

FTP

Port 20/21

Moves files on the Internet and within private networks

SSH

Port 22

Enables secure remote connects to allow users to execute commands on a server.

Netstat

Displays active ports

Displays network connections

Provides IP addresses of the connections

Displays process ids associated to the port

SMTP (Simple Mail Transfer Protocol)

Port 25

Uses for two primary functions:

• Transfer mail from source to destination between mail servers

• Used by end users to send email to a mail system

DNS (Domain Name System)

Port 53

Used on public and private networks to translate domain names into IP addresses, typically for network routing

DHCP (Dynamic Host Configuration Protocol)

Port 67/68

Uses on networks that do not use static IP addresses assignment

TFTP

Port 69

Offers a method of file transfer without session establishment.

Used for software and firmware upgrades

HTTP/HTTPS

Port 80/443
Browsing internet/getting web pages

POP3

Port 110
One of the two main protocols used to retrieve mail from a server

NTP

Port 123
Synchronizes time on devices

NETBIOS

Port 137/138/139
Used to connect Windows devices together

IMAP

Port 143

Retrieves mail from email server

SNMP

Port 161/162
Network management tool

LDAP

Port 389

Protocol for accessing directories on a server

NTFS

Newer File System

Used on Windows OS

exFat

A file system that is better than Fat32

Lightweight compared to NTFS

Fat32

Legacy File System used in early computing

EXT2, EXT3, EXT4

Three types of file systems on Linux distributions

HFS+

File system particularly for MaxOs X

APFS

An custom file system from Apple to replace HFS+.

Used in flash drives, SSDs