Network Forensics and Security Analysis Study Guide
Introduction to Network Forensics and the DFIR Process
Scope of the Lecture Series * Network Forensics 1 and 2: Focuses on security and privacy in a networked environment. * DFIR Process: Covers Digital Forensics and Incident Response and how it integrates with broader network monitoring. * Emerging Technologies: Future segments will touch upon Cloud forensics, Internet of Things (IoT), Artificial Intelligence (AI), and data visualization.
The Evolution of Data Volume * In the 1990s, data traffic across the wire was minimal. * In contemporary business environments, gigabit connections are standard and often considered slow compared to high-speed enterprise requirements. * The challenge lies in how organizations process, manage, and store the massive amount of data generated.
Context of Application * Network forensics primarily takes place in private, business-oriented contexts. * Focus resides on DFIR solutions for organizations with a Security Operations Center (SOC) or those dealing with data breaches. * Contrast with Host-Based Forensics: Host forensics (mobiles, computers) typically focuses on individual investigations, whereas network forensics looks at the wider corporate landscape.
Defining the Scope and Complexity of Network Forensics
The "Nebulous" Nature of Network Forensics * Network forensics is a murky, cloudy, and nebulous field because the definition of a "network" spans multiple layers. * A network includes physical cables, switches, servers, and individual endpoint machines (desktops, laptops, mobiles).
Integration of Disciplines * Host-Based Forensics: While often the last step in a network investigation, it is crucial. In malware cases, one must start broad (network-wide) to narrow down thousands of systems to specific infected machines before analyzing disks/memory. * Traditional Networking: Requires deep knowledge of protocols and technologies (TCP, IP, routing, flow data). * Offensive Security: Incorporates penetration testing and ethical hacking concepts, utilizing devices like Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). * Privacy Technologies: Includes encryption, tunneling, and privacy-preserving protocols that increase the difficulty of investigations. * Open Source Intelligence (OSINT): Essential when a network connects to the outside world. Investigators must identify external IPs, host countries, and domain names from entities they do not control.
Primary Sources and Methodologies of Data Collection
The Importance of Proactive Logging * Forensics is foundational upon logging; if data is not being captured proactively, it cannot be analyzed of the fact. * Sources include network appliances, network services (Apache, FTP servers, Mail servers), and physical devices.
Data Collection Methods * Backtracking (Step-by-Step Tracing): A physical/logical process of following a network connection back through nodes. It involves logging into one machine, identifying where the connection originated, and hopping to the next device. This is limited by the edge of organizational authority and legal jurisdictions. * Live Traffic Capture (PCAP): Captures raw packets in real-time. While detailed, this is difficult to scale to billions of packets. * Network Artifacts: Includes lower-level data such as Address Resolution Protocol (ARP) tables, Simple Network Management Protocol (SNMP) messages, and Internet Group Management Protocol (IGMP). * Centralized Logging: Essential for SOC roles where high-level data is used to find starting points before correlating with disk artifacts.
Identifiable Network Information: IP Geolocation and Reverse DNS
IP Geolocation * Determines the approximate physical location of an IP address. * It is not an exact science. Data can be skewed by specialized network setups. * Example (Janet Network/Zscaler): An IP appearing in Manchester despite being on a different campus due to high-capacity pipes and routing through specific egress points. * Residential Accuracy: Generally more accurate, often pinning an IP to a specific postcode or town (e.g., Hamilton).
DNS and Reverse DNS * Forward DNS: Maps a domain (e.g., google.com) to a routable IP. * Reverse DNS (Pointer Records/PTR): Maps an IP back to a hostname or domain. * Canonical Name (CNAME) Verification: Used in phishing and email security to check if the sender is authorized to send from a specific domain. Mail servers frequently drop emails if the PTR record does not match the domain (standard anti-spam practice). * Subdomain Tracking: Mobile ISPs (e.g., Three, Virgin Media) often embed unique subscriber identifiers or IPs in reverse DNS hostnames, providing stable identification even if the IP address changes.
Encryption Protocols and Visibility Challenges
Symmetric vs. End-to-End Encryption * TLS/SMTP: Encrypts data in transit, but it is decrypted once it reaches the destination server. * PGP/WhatsApp: Uses full end-to-end encryption so data remains encrypted "at rest" on the server.
Transport Layer Security (TLS) and SSL * SSL () is largely deprecated and replaced by TLS (). * A TLS connection involves three main parts: The Protocol (TLS), Key Exchange (e.g., RSA or Elliptic Curve Diffie Hellman/ECDH), and Symmetric Encryption (e.g., AES with modes like CBC or GCM).
The Server Name Indication (SNI) Leak * Even within encrypted TLS streams, the SNI field—which contains the domain name being visited—is frequently transmitted in plain text. * Investigators can often see the destination domain even if they cannot see the specific URL path or payload.
QUIC Protocol * Developed by Google to replace TLS/TCP; based on User Datagram Protocol (UDP). * Aims to reduce latency in the handshake process (Quick UDP Internet Connection). * Despite being newer, it often still leaves the SNI unencrypted by default.
Bypassing and Exploiting Cryptographic Protections
Passive vs. Active Interception * Key Logging: Browsers like Chrome can be configured to log all session keys to a file, allowing for the decryption of historical PCAPs. * Man-in-the-Middle (MITM): Intercepting the key exchange. This requires subverting the Certificate Authority (CA) trust chain. Organizations often use TLS proxies to scan traffic, effectively performing a legitimate MITM on their own users for auditing.
Protocol Attacks * Downgrade Attacks (e.g., POODLE): Forcing a client and server to use an older, vulnerable protocol (like SSL or DES) that is easier to break. * Implementation Flaws: Vulnerabilities such as chip-level issues where Initial Vectors (IV) for encryption are set to zeros, making exploitation trivial.
Certificate Pinning * An application-level security measure where the app checks if the server's certificate matches a specific, expected fingerprint to prevent MITM attacks.
The Evolution and Security of Domain Name System (DNS)
Traditional DNS * Generally ephemeral and uses cleartext; queries are not typically stored unless specifically logged.
Passive DNS * Involves historical databases that store timestamped records of DNS changes. * Crucial for identifying malware campaigns that pivot between various IPs and parking domains. * Obtained by listening to authenticated communications between backend DNS root servers rather than the end-user resolver.
Modern DNS Privacy Protocols * DNSSEC: Authenticates that the source is legitimate but does not provide encryption. * DNSCrypt: Provides both authentication and payload encryption. * DoH (DNS over HTTPS): Tunnels DNS queries through standard HTTPS traffic on port . This obscures DNS requests from ISPs and firewalls as they look like standard web traffic. * DoT (DNS over TLS): Wraps DNS in a TLS layer; more robust than standard DNS but easier for network admins to identify and block than DoH. * DoQ (DNS over QUIC): Tunnels DNS over the QUIC protocol.
Techniques for Concealing Network Location and Traffic
Proxies and Tunnels * SSH Tunneling: Routing application traffic through an SSH connection to an intermediate server, which then passes the request on. Effectively hides the originating IP from the destination. * DNS/ICMP Tunneling: Using non-standard protocols (like DNS requests or Ping packets) as vehicles for data exfiltration. Data is often Base64-encoded and appended to transaction IDs or subdomains.
Virtual Private Networks (VPNs) * Creates a virtual network adapter at the OS level to route all traffic through an encrypted tunnel. * Limitation: Many older VPNs suffer from "DNS leakage," where DNS queries bypass the tunnel and go to the ISP, revealing the user's destination.
Tor (The Onion Router) * Hides both the source and the destination through a series of nodes (Entry, Middle, and Exit). * No single node knows the entire path; the Entry node only knows the user, and the Exit node only knows the destination.
De-anonymization and Operational Security (OPSEC) Failures
Technological De-anonymization * Node Control: If an adversary (e.g., the FBI) controls enough nodes on the Tor network, they can use correlation attacks to link entry and exit traffic. * Side-Channel Attacks: Using malicious JavaScript to force a browser to phone home via a non-Tor connection, revealing the real IP.
Browser Fingerprinting * Piecing together small bits of information (Entropy) to uniquely identify a user. * Metrics include: Screen resolution, installed fonts, Canvas rendering, CPU core count, and the "Do Not Track" flag. * Websites like Panopticlick or AmIUnique demonstrate how unique a browser becomes when multiple features are combined.
Operational Security (OPSEC) Failures * Most anonymization failures occur due to human error rather than technology flaws. * Examples include bragging in IRC chats, logging in once without a VPN, or leaking personal details like local weather or proximity to landmarks.
Data Volume and Procedural Challenges in Network Investigations
The Big Data Problem * Capturing and storing every packet (Full Packet Capture) is infeasible for modern enterprise traffic (Terabytes of data). * Investigators must rely on abstraction, such as flow data and logs, rather than raw packets.
Standard Investigative Process * Trigger: A real-world event (breach, crime, suspicious activity). * Scope: Identifying what needs to be gathered and which machines are involved. * Acquisition: Collecting data while maintaining integrity. * Analysis: Investigating logs first to find the "starting point" before diving into deep packet inspection.
Investigative Types * Corporate Intrusion: Focuses on logs, SOC monitoring, and EDR (Endpoint Detection and Response) systems. * Employee/Individual Investigation: Often starts with host-based artifacts but uses network logs for corroboration.
Questions & Discussion
Q: How big is that TV (in the lecture hall)? * A: It is estimated diagonally. While 91-inch screens exist, the hall screen is much larger, perhaps around 150 inches. It appears to be constructed from many smaller rectangular panels slatted together.
Q: What kind of cheese would you (the lecturer) have on meatballs/spaghetti? * A: (No specific cheese mentioned, interaction serves as a break in technical content).