Reflection paper

Abdullah94k

lectures.zip

Home >English homework help >Reflection paper

Lecture 09 - Memory Forensics.pdf

L E C T U R E 9 B Y : D R . I B R A H I M B A G G I L I

Memory Forensic Analysis

P A R T 1

RAM overview

Volatility overview

http://www.bsatroop780.org/skills/images/ComputerMemory.gif

Understanding RAM

•  Two main types of RAM –  Static

•  Not refreshed •  Is still volatile

–  Dynamic •  Modern computers •  Made up of a collection of cells •  Each cell contains a transistor and a capacitor •  Capacitors charge and discharge (1 and zeros) •  Periodically refreshed

RAM logical organization

•  Programs run on computers •  Programs are made up of processes

–  Processes are a set of resources used when executing an instance of a program

–  Processes do not generally access the physical memory directly –  Each process has a �virtual memory space�

•  Allows operating system to stay in control of allocating memory –  Virtual memory space is made up of

•  Pages (default size 4K) •  References (used to map virtual address to physical address) •  May also have a reference to data on the disk (Page file) – used to

free up RAM memory

RAM logical organization

!  Each process is represented by an EPROCESS Block:

Normal memory

• Each process is represented by an _EPROCESS block. • Contained within each _EPROCESS block is both a pointer to the next process (fLink – Forward Link) and a pointer to the previous process (bLink – Back Link). •  When OS is operating, the _EPROCESS blocks and their pointers come together to resemble a chain, which is known as a doubly-linked list. • Chain is stored in kernel memory and is updated every time a process is launched or terminated. • Windows API walks this list from head to tail when enumerating processes via Task Manager, for example.

Not so normal

• Hides processes from windows API • Known as Direct Kernel Object Manipulation (DKOM) • Involves manipulating the list of _EPROCESS blocks to �unlink� a given process from the list • By changing the forward link of process 1 to point to the third process, and changing the �bLink� of process 3 to point to process 1, the attacker�s process is no longer part of the list of _EPROCESS blocks. • Since the Windows API uses this list to enumerate processes, the malicious process will be hidden from the user but still able to operate normally.

P A R T 2

Introduction to Memory forensics

Before & Now

!  Traditionally !  We have always been told to �pull the plug� on a live system !  This is done so that the reliability of the digital evidence is not

questioned

!  Now !  People are considering live memory forensics

" Data relevant to the investigation may lie in memory " Whole Disk Encryption….

Challenges in traditional method

•  High volume of data (Aldestein, 2006) –  Increases the time in an investigation –  Increases storage capacity needed for forensic images –  Number of machines that could be included in the investigation

(Sommer, 2004) •  Ubiquity of digital evidence

–  Many types of digital devices (Mp3, gaming consoles etc.) •  Evidence in memory only

–  Messaging applications (Carvey, 2004) –  Malaware in memory (Burdach, 2004) –  Privacy mode of browsers (Google, 2008; Zeigler, 2008)

•  Size of RAM is increasing (Sutherland et al. , 2008) –  Potential for more digital evidence

•  Encryption!

Live investigations VS. dead investigations

•  According to Carrier (2005 p.5), �A dead analysis occurs when you are running trusted applications in a trusted operating system to find evidence� and a live analysis is defined as �when you use the operating system or other resources of the system being investigated to find evidence.� –  That is a little contradictory. What if a live CD was used on the

suspect machine to perform �dead� analysis?

Live investigation VS. dead investigations

•  Mandia et al. (2003 p.27) simply states that �a live response is conducted when a computer system is still powered on and running.� This would suggest that a bootable Linux CD is indeed a live investigation.

•  Carrier 2nd definition: using the operating system of the system being investigated to acquire, analyze or present digital evidence will be used to describe a live investigation.

When is RAM analysis useful?

!  Cases where large volumes of data is involved (many computers)

!  Mission critical systems !  Relevant digital evidence is stored in memory only !  When machine under investigation is using

encryption (finding the decryption key) !  Click here for video

Live investigations

!  Involve examining a digital system while it is running and using the OS !  Acquire !  Analyze !  Present

!  They are permitted by the 2nd principle of the ACPO guidelines !  Principle 2 of the Association of Chief Police Officers� Good

Practice Guide for Computer-Based Electronic Evidence states, �In circumstances where it is necessary to access original data held on a computer or storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions� (ACPO, 2007).

Encryption example 1

!  At Senate hearings in September 1997, Jeffery Herig, special agent with the Florida Department of Law Enforcement, testified that they were unable to access protected files within a personal finance program in an embezzlement case at Florida State University. He said the files could possibly hold useful information concerning the location of the embezzled funds.

Encryption example 2

•  [It is] also reported that they had encountered unbreakable encryption in a US customs case involving an illegal, world-wide advanced fee scheme. At least 300 victims were allegedly bilked out of over $60 million. Herig said they had encountered three different encryption systems. Although they were able to defeat the first two, they were unsuccessful with the third. The vendor told them that there were no back doors.

Encryption example 3

•  An employee of a company copied proprietary software to a floppy disk, took the disk home, and then stored the file on his computer encrypted under PGP. Evidently, his intention was to use the software to offer competing services, which were valued at tens of millions of dollars annually (the software itself cost over $1 million to develop). At the time we heard about the case, the authorities had not determined the passphrase needed to decrypt the files. Information contained in logs had led them to suspect the file was the pilfered software.

Example 4..etc

!  At one university, the investigation of a professor thought to be trafficking in child pornography was aborted because the campus police could not decrypt his files.

!  Many more child pornography cases…

Decryption options?

•  Ask for the key during the interview with the suspect •  Locate unencrypted copies of the encrypted data (deleted

stuff?) •  Locate copy of the key on the disk, or surrounding areas

–  Build a dictionary -- use the dictionary •  Intelligent passoword attacks

–  Uses words from suspect�s personal details •  Brute force attack •  Vulnerabilities in the implementation of the encryption

system •  Surveillance (keyloggers etc.)

–  Hardware and software

Live investigation methodology

!  Wait (2008) methodology !  Establish a trusted command prompt !  Establish a method for transmitting and storing the collected

information !  Running various tools and creating hashes of the output

Live investigation tools

• cmd.exe'A'trusted'copy'of'the'command'prompt.'This'will'change'for'different'versions'of' Windows.)Built'in.' • PsLoggedOn'A'u?lity'that'shows'all'users'connected'locally'and'remotely.'www.foundstone.com' • Rasusers'A'command'that'shows'which'users'have'remoteaccess'privileges'on'the'target'system.' NT'Resource'Kit'(NTRK)' • Netstat'A'system'tool'that'enumerates'all'listening'ports'and'all'current'connec?ons'to'those'ports.' Built'in' • Fport'A'u?lity'that'enumerates'all'processes'that'opened'any'TCP/IP'ports'on'a'Windows)NT/2000) system.)www.foundstone.com' • PsList'A'u?lity'that'enumerates'all'running'processes'on'the'target'system.'www.foundstone.com' • ListDLLs'A'u?lity'that'lists'all'running'processes,'their'command'line'arguments,'and'the' dynamically'linked'libraries'(DLLs)'on'which'each'process'depends.'www.foundstone.com' • Nbtstat'A'u?lity'that'lists'the'recent'NetBIOS'connec?ons'for'approximately'the'last'10'minutes.' Built'in' • Arp'A'system'tool'that'shows'the'MAC'addresses'of'systems'that'the'target'system'has'been' communica?ng'with,'within'the'last'minute.'Built'in' • Kill'A'command'that'terminates'a'process.'NTRKMd5sum'A'u?lity'that'creates'MD5'hashes'for'a' given'file.'www.cygwin.com' • rmtshare'A'command'that'displays'the'shares'accessible'on'a'remote'machine.'NTRK'

P A R T 3

Memory acquisition

Live disk acquisition

!  FTK Imager (now also RAM) !  dd !  Helix Live CD

Live memory acquisition

•  \\.\PhysicalMemory (user mode): Similar to \dev \memory in Linux, this object –  provides access to the physical memory of Windows XP

(Vidstrom, 2006a). –  Can be accessed and copied using user-mode programs such as

a modified version of dd (Carvey, 2007b). –  Has the advantage that no software needs to be installed on the

system under investigation (Schuster, 2005). –  Practical problem: requires administrator privileges on the live

suspect machine (Schuster, 2005). User mode access to the \\. \PhysicalMemory object is also not possible unavailable under Windows Server 2003 SP1 onwards, including Windows Vista (Schuster, 2005)

Live memory acquisition

!  \\.\PhysicalMemory (kernel mode): Recently a number of options have become available that overcome the problem of lack of user mode access to the !  \\.\PhysicalMemory object. These allow imaging of the

memory of a Windows Vista machine using a kernel mode driver to access the \\.\PhysicalMemory object (Schuster, 2008b).

Live memory acquisition

•  Tools that use \\.\PhysicalMemory (kernel mode): –  WinEn: This is included with EnCase versions 6.11 onward.

It is also included on the latest version (2.0) of the Helix Live CD (e-fense, 2008).

–  mdd (Stotts, 2008): The Memory DD tool from ManTech is open source and available on SourceForge (ManTech, 2008).

–  win32dd (Suiche, 2008b): This tool is also open source but uses more kernel mode functions, including writing the output file, rather than mdd, in which �the [kernel] driver is only used to get \Device\PhysicalMemory handle (Suiche, 2008a).

Live memory acquisition

•  Firewire (IEEE 1394): Firewire devices use Direct Memory Access (DMA) –  Can access the memory of a system without using the CPU (Carvey,

2007b). –  Bolieau (undated) describes a way to use this property to obtain an

image of a machine�s physical memory. –  Images memory, even if a machine is locked. –  More difficult to configure and use than the \\.\PhysicalMemory

tools –  Target system must have a working Firewire port. –  Documented problems in Vidstrom (2006b), e.g. dumping the Upper

Memory Area (UMA) –  Can cause a fatal error and blue screen if non existent memory

addresses are accessed (Schuster, 2008a).

Live memory acquisition

!  Process Memory Acquisition Tools: !  Dump the memory used by a specific process. Examples of

such tools include pmdump (Vidstrom, 2002) and userdump (Microsoft, 2007c).

Live memory acquisition

•  Cooling + Reboot (Video) –  Halderman et al (2008) and explains that even though data in RAM does decay when the

power is removed, �retention times can be increased by cooling� (Halderman et al., 2008). –  By cooling RAM chips to -50ºC using an inverted can of compressed air and using a warm

or cold reboot, the bit deterioration may be reduced sufficiently so that by rebooting the system to a custom operating system with a minimal memory footprint (network based or on USB) the contents of RAM can still be imaged, albeit with some bit errors.

–  This has the advantage of providing a trusted operating system in which to perform imaging. •  At time of writing the tool from Halderman et al (2008) (ram2usb) was

not available but an alternative that uses the same principles is available from McGrew (2008). There are also additional problems to the bit errors: it is possible that the machine has been configured not to boot to network or USB, preventing an operating system from being loaded that can perform the memory imaging. It is also possible that the machine may perform a destructive memory test when restarting.

Live memory acquisition

•  Crash Dumps: A system can be configured in advance through the Windows Registry or Start-up and Recovery settings to create a full dump of its memory to disk on a key press (on PS\2 keyboards) (Microsoft, 2007e).

•  This has the significant advantage that the entire system is halted when the contents of RAM are being written (Carvey, 2007b), this means that this is a true �image� of memory rather than a �smear�, since the data is not constantly changing as it is being copied.

•  It is necessary to reboot the system for the Registry change to take effect (Microsoft, 2007e)

•  Difficult to use in real cases when system is not configures •  There is also a further limitation described in Huebner et al. (2007)

that �the key sequence used to generate the crash dump is insecure and could be intercepted by an application program�.

Live memory acquisition

!  Hibernation File: When a Windows system is put into hibernate mode, the system�s state is stored in hiberfil.sys file. !  Using the Sandman Framework the hibernation file can be converted to

a flat, dd style image (Suiche and Ruff, 2008). !  Advantage: system is completely stopped.

"  Image is coherent and does not suffer the same �smearing� as other techniques. !  Examined offline, it is not possible for malware to hide from an analysis. !  If the system�s power is disconnected and the hibernation file later

imaged, the hibernation file may be significantly out of date !  Intentionally putting the system to sleep will overwrite data in the current

hibernation file on the disk. !  Ruff and Suiche (2007) also states that there is �no guarantee that 100%

of physical memory has been saved�. !  Hibernation file is not available when certain types of encryption product

are in use.

Live memory acquisition

•  Hardware Devices: Carrier and Grand (2004) describes a PCI card that can be fitted to a PC which can dump memory to an external storage device.

•  Since this approach is hardware based it does not rely on potentially untrusted code.

•  The hardware needs to be installed before an incident occurs (Carvey, 2007b) and as a result this is unlikely to be an option.

P A R T 4

Memory analysis techniques

•  String searches: –  Early analyses of memory dumps consisted of simply

extracting text strings (Carvey, 2007b p.88). –  This is achieved using tools such as strings (Russinovich,

2007), grep (on Linux) or bintext (Foundstone, 2000) and enables searches for passwords, IP and e-mail addresses and other text strings.

–  The difficulty with evidence obtained in this way is that it is difficult to attribute to a specific process (Carvey, 2007b p.89).

Memory analysis techniques

•  Process Enumeration: –  If one EPROCESS block can be found in memory, the Forward

Link (FLINK) and Backwards Link (BLINK) pointers can be used to enumerate all processes in the memory dump.

–  Relies on locating an EPROCESS block. –  There are a number of methods described for achieving this.

•  First dump system process (ID4) using a perl script •  Then locate the other processes

Memory analysis techniques

•  Process Carving: –  Schuster (2006) provides an alternative to the process

enumeration approach that is similar to file carving in disk images.

–  Scans through a memory image testing for valid process and thread structures using a 20 rule criteria.

–  Implemented in PTFinder.pl. There is also another implementation of this approach in Carvey (2007b p.104), lsproc.pl, which is limited to identifying processes rather than threads.

Memory analysis techniques

•  VAD Tree Based Process Recovery: –  Recovery of memory that belongs to a specific process. –  VAD tree provides access to areas of memory assigned to a

process. –  Root of the VAD tree is stored in the process�s EPROCESS

block at offset 0x11C. –  From this pointer the VAD tree can be traversed and the areas

of memory assigned to the process can be extracted (Dolan- Gavitt, 2007).

–  VAD tree offset has changed in Server 2003, and Vista.

P A R T 5

Memory analysis toolkits

Create your own?

!  Understand how memory is stored !  Program your own way of parsing processes out etc. !  Use string searches

Responder

!  Commercial product, one of the first ones released to analyze memory dumps

!  Allows investigators to view both physical and virtual memory dumps

Volatility framework !  Leading open source toolkit, implemented in python,

works on Windows XP SP2 and SP3 dumps (Outdated) ' connec?ons:'Print'list'of'open'connec?ons.' connsca:'Scan'for'connec?on'objects.' date?me:'Get'date/?me'informa?on'for'image.' dlllist:'Print'list'of'loaded'DLLs'for'each'process.' dmp2raw:'Convert'a'crash'dump'to'a'raw'dump.' dmpchk:'Dump'crash'dump'informa?on.' diles:'Print'list'of'open'files'for'each'process.' hibinfo:'Convert'hiberna?on'file'to'linear'raw'image.' ident:'Iden?fy'image'proper?es.' memdmp:'Dump'the'addressable'memory'for'a'process.' memmap:'Print'the'memory'map.' modscan:'Scan'for'modules.' modules:'Print'list'of'loaded'modules.' regobjkeys:'Print'list'of'open'Registry'keys'for'each' process.' ' ' ''

procdump:'Dump'a'process'to'an'executable' sample.' pslist:'Print'list'of'running'processes.' psscan:'Scan'for'EPROCESS'objects.' raw2dmp:'Convert'raw'dump'to'a'crash'' dump.' sockets:'Print'list'of'open'sockets.' sockscan:'Scan'for'socket'objects.' thrdscan:'Scan'for'ETHREAD'objects.' vaddump:'Dump'the'VAD'sec?ons'to'files.' vadinfo:'Dump'the'VAD'info.' vadwalk:Walk'the'VAD'tree.' Strings:'Match'physical'offsets'to'virtual' addresses.' '

Vola%lity)command)Informa%on)Obtained)

P A R T 6

Challenges in live digital investigations

Challenge 1: Trusting the results

•  Mohay et al. (2003) states that �any system being examined live should be considered to be hostile until proven otherwise.�

•  Carrier (2006) goes as far as saying that �the only difference between live and dead analysis is the reliability of results.�

•  Extensive use of DLLs in windows •  Operating system has to be modified in some way to

provide false info –  Rootkit/Malware installed on a system, either intentionally or

unintentionally –  Logic bombs

Challenge 2: Intrusiveness of techniques

!  Contaminating the digital evidence (volatile nature) !  Can�t use write blockers !  Modifying as little as possible (Carvey, 2004) !  Minimally invasive techniques !  No way to avoid making changes !  Amount of change will vary depending on hardware

and software used

Challenge 3: Verification of results

!  Results should be verifiable and repeatable (Pollitt, 1995)

!  Evidence gathered represents a live system that cannot be reproduced at a later date

!  Image can only be verified against itself, and not the �original� media

!  Could prevent it from being admissable

Challenge 4: Ensuring a complete set of evidence

!  Selective file copying, rather than the complete image

!  Some data not captured may have proved innocence…

!  First responders are used to: Identifying and preserving digital evidence !  Now they have to identify relevant digital evidence

The end.

Lecture 6 - AntiForensics.pdf

Anti-‐Forensics Modified by Dr. Ibrahim Baggili

Originally created by Marcus Rogers – Purdue University

Some refreshers •  What is Cyber/Digital Forensics? •  What are some of the issues with Digital Forensics? •  What are the three As? •  What is a file system? •  What is CHS?

Lecture Outline •  What is anJ-‐forensics? •  Taxonomy of AnJ-‐forensics •  Countering AnJ-‐forensics •  Looking ahead •  Summary

AnJ-‐forensics • APempts to negaJvely effect the existence, amount and/or quality of evidence from a crime scene, or make the analysis and examinaJon of evidence difficult or impossible to conduct.

• Digital evidence (DE) is not immune to this •  The volaJlity of DE and the reliance on tools makes cyber forensics very vulnerable to AF

•  Issue for all the Digital Forensics CommuniJes •  LE, Private Sector, Military/Intelligence

Overall Taxonomy • Data hiding • ArJfact wiping • Trail obfuscaJon • APacks against the CF process/tools **

Data Hiding Taxonomy Nothing new here! • Rootkits have been around for quite some Jme • APempt to hide data in unusual places

• Memory • Slack space • Hidden directories • Modifying metadata • Bad blocks • Alternate Data Streams • Hidden parJJons • Data EncrypJon

• Steganography •  No one is sure how big a problem this is •  Mixed results on idenJfying stego

Common Data Hiding Techniques •  Rename files/directories •  Delete files/directories •  Copy files/directories •  Print files •  Format a disk

Renaming Files •  Rename files and/or file extensions •  Example: •  Rename extorJon_lePer.doc to fuzzy_bunny.jpg •  People looking for incriminaJng evidence probably won’t

check a picture file called fuzzy_bunny.jpg

Copying files •  Scenario #1: Copying a file to a floppy disk or hard disk.

–  If you run out of space, the pointer to the file is removed, but the data that was copied to the sectors is lec in place

•  Scenario #2: Computer crashes while copying a file. –  Again, the file contents copied to the unallocated sectors will

exist, but the pointer to the data will not have been created.

PrinJng a file •  When prinJng a file, it is spooled to the hard disk before it is

printed. •  Spooling involves copying the file to a temporary locaJon,

prinJng it, then deleJng it. •  Acer the temporary file is deleted, the data sJll exists on disk

•  Most printer drivers convert print to graphics these days prior to prinJng so…..

Formafng a disk •  When a disk is quick formaPed, the file table on the disk is

cleared, but the data on the disk is lec in place. •  Again, similar to deleJng all the files on a disk.

•  Data can also be recovered from a full format •  Low level formafng is a different story!

APributes •  In Windows, set the “hidden” aPribute on a file or

directory. •  Can sJll view files if the “Show hidden files and folders”

opJon is checked in Windows Explorer. •  Other tools may or may not display hidden files.

Folders •  In Unix, rename a file or directory starJng with a “.”

•  Example: mv important.doc .important.doc •  Can sJll be viewed by lisJng all files “ls –a” •  Other methods???

•  ., …, ., .., etc. •  Root kits love making these kind of hidden folders

FS UNIX •  In Unix it is possible to hide files and directories “under” a

filesystem •  Example:

•  mkdir /temp •  Create files/directories in /temp •  Mount a filesystem at /temp •  The files are not visible, and cannot be read/written •  The files are accessible again after the filesystem has been

unmounted

•  This might be detectable, but not always. •  Example: / is 10 GB, space used is 2 GB, but only 4 GB are

free. This could indicate the presence of files hidden under a filesystem

Swap space •  Swap Space (also called a page file) is used to increase the

amount of memory available to the system •  The total memory available (real RAM and the swap space) is

called virtual memory. •  InformaJon is constantly being wriPen to memory, and

therefore to the hard disk. •  InformaJon can then be extracted from this file

Core dumps •  Core dumps are created on Unix systems when a process or

program generates a fault •  The core dump will contain all the data from CPU registers

and memory at the Jme of the fault •  InformaJon can then be extracted from core dump

Slack space •  When files are deleted, both the deleted data and the data in

slack space sJll exists •  When a file is wiped from the system (permanently removed),

any data in the slack space sJll exists •  The data in the slack space will only be removed when it is

overwriPen, or it is explicitly removed

Alternate data streams (ADS) •  Microsoc introduced the Alternate Data Stream (ADS) into

NTFS in the early 1990’s •  Created so Microsoc Windows NT could be a file server for

Macintosh files •  Mac’s Hierarchical File System (HFS) uses alternate streams

called Resource Forks to store addiJonal file informaJon, such as icons

ADS •  Unlike FAT (and other filesystems) which only have one data

stream, NTFS allows the creaJon of mulJple data streams •  ADSs in NTFS can be used to store summary informaJon

about files •  This informaJon is not transportable to other filesystem types

(eg. FAT, ext2)

ADS

ADS •  Most file system uJliJes (such as Windows Explorer) will only report on the default data stream

•  The reported file size will remain the same, regardless of the number of ADSs aPached to a file

•  Microsoc does not provide any tools to detect ADS’s

•  LADS, created by Frank Heyne, is a command-‐line tool that will search a NTFS filesystem for ADSs

•  LADS is available from hPp://www.heysoc.de/en/ socware/lads.php?lang=EN 21

ADS

• CreaJng an ADS – echo text in default stream > myfile.txt

– echo extra text in ADS > myfile.txt:hidden.txt

ADS •  C:\temp>echo some text > myfile.txt

•  C:\temp>dir myfile.txt •  Volume in drive C has no label. •  Volume Serial Number is 40AB-8351

•  Directory of C:\temp

•  2003-03-04 03:11p 12 myfile.txt •  1 File(s) 12 bytes •  0 Dir(s) 3,227,021,312 bytes free

•  C:\temp>type bigfile.tgz > myfile.txt:hidden

•  C:\temp>dir myfile.txt •  Volume in drive C has no label. •  Volume Serial Number is 40AB-8351

•  Directory of C:\temp

•  2003-03-04 03:12p 12 myfile.txt •  1 File(s) 12 bytes •  0 Dir(s) 3,183,009,792 bytes free

•  C:\temp>

ADS •  C:\temp>lads

www.heysoft.de) •  This program lists files with alternate data streams (ADS) •  Use LADS on your own risk!

•  Scanning directory C:\temp\

•  size ADS in file •  ---------- --------------------------------- •  44010926 C:\temp\myfile.txt:hidden

•  44010926 bytes in 1 ADS listed

•  C:\temp>

ADS •  Running a hidden command in ADS (try this on a NTFS file

system): –  C:\>echo some text > c:\temp\file.txt –  C:\>type c:\winnt\system32\calc.exe > c:\temp

\file.txt:hidden.exe –  C:\>type c:\temp\file.txt –  C:\>start /b c:\temp\file.txt:hidden.exe

•  This will start the Windows calculator program from a 12 byte file!

Summary •  There are various areas that can be used to conceal data. •  Start simple then work to the more complex. •  Understanding common hiding techniques and where arJfacts

can be found is crucial.

Win2K/XP recycle bin •  “Recycled” Folder for FAT:

• INFO2 • Place holder(s) • Desktop.ini

Win 2K/XP recycle bin •  “Recycler” Folder for NTFS

•  SID named subdirectory contains: (For each user there is a security ID (SID))

• Place holder(s) • INFO2 • Desktop.ini

•  NTFS Recycle Bin

Placeholders •  D<original drive lePer><#>.<original extension>

• DC1.TXT • DC2.JPG • DC3.BMP

•  Entry for each deleted item: –  Hidden from view in GUI environment –  Date & Jme unchanged from original file

•  If a subdirectory is deleted only one placeholder is made 29

INFO 2 File •  800 Byte Entry is made for each Recycled object

–  Recycled date –  Original path and filename –  Place holder drive lePer and #

INFO 2 file

Counter Drive Letter

Recycled Date and Time (GMT)

Offset 260 – 275 of an INFO2 entry

INFO 2 File •  Recycled date and Jme issue

–  The date and Jme are stored in GMT in hexadecimal format –  Recycle Bin tools (IEHistory, Datalicer) will convert the Jme for you!

–  Something wrong here?

Hint! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation 32

Desktop.ini •  Created when Recycle Bin is created •  Only modified if recycle bin is EMPTIED

–  All Date / Time informaJon updated when bin is empJed

Recovering from recycle bin •  Copy placeholders to separate drive •  Copy INFO2 file; use uJlity to parse out date / Jme data

–  Datalicer –  IE History

Steganography •  Hiding informaJon in plain site •  Centuries old

– Spartans – Greeks

•  Extremely hard to detect •  AcJve research for NaJonal Security reasons

– StaJsJcal Analysis •  DetecJon Algorithms

Steganography •  Types of Encoding

•  Least Significant Bit (LSB) • Encode the message in the least significant bit of every byte in an image. The value of each pixel is changed slightly, but not enough to make significant changes to the image.

•  Frequency Domain encoding • This method encodes messages within images by working with the 2-‐dimensional Fast Fourier Transform, or 2-‐D FFT of the container image.

Source:hPp://www.owlnet.rice.edu/~elec301/Projects01/steganosaurus/background.html 36

Stegonography •  InjecJon

–  Unused areas in a file (end of a song) •  SubsJtuJon

–  Least significant bits •  GeneraJon

–  Creates an new file

Steganalysis •  DetecJon methods??

– Remnants of stego socware on system (registry) – Comparison files

•  (MD5), Visually –  size diff??

– LocaJng stego socware on system – StaJsJcal analysis

•  average bytes •  skew, kurtosis •  average deviaJon

•  Problem of false posiJves

Summary •  DeleJng and formafng on a Hard Drive does not touch the

data area. •  Ocen evidence can be found in deleted files, and the recycle

bin. •  Steganography is a real problem •  Work from the obvious to the less obvious •  Go for the low hanging fruit first •  When are you done???

References •  NW3C Basic Data Recovery & Analysis Course •  NW3C Advanced Data Recovery & Analysis (NTFS) •  Kessler, G. (2001). An overview of steganography for the computer forensics examiner. Retrieved July 1, 2005 from hPp://www.wi.gov/hq/lab/fsc/backissu/july2004/research/ 2004_03_research01.htm

ArJfact wiping taxonomy • ArJfact wiping • Disk cleaners

• EffecJve but obvious that it was used • Free space and memory cleaners

• Less obvious • Most don’t work properly and leave signatures behind (Geiger, 2005 -‐ DFRWS) • Nothing really new

• ProphylacJc • Not producing any arJfacts/remnants

• No writes to the disk or readable memory 46

Trail obfuscaJon •  Trail obfuscaJon

– Where is the source located – Who is the source

•  Log cleaners •  Spoofing •  MisinformaJon •  Backbone hoping •  Zombied accounts •  Trojan commands

Not new either!

APacks against CF Process/tools •  Houston we have a problem! •  RelaJvely new •  VicJm of our own success in making CF standardized and public

•  Vendor & Tool dependency has made us very vulnerable! •  RelaJve immaturity of the discipline has not helped •  Focus area for the computer underground because of its relaJve ease

Tools and processes •  Evidence PreservaJon & CollecJon

•  Some novel aPacks discussed but few so far have been documented in the “wild” •  Bad blocks •  Odd disk sectors •  Altering the HPA or DCO at the drive level (Host Protected Area, Device ConfiguraJon Overlay)

•  This CF process is very tool centric •  EnCase, FTK, DD, or other integrated device

•  APacks seek to prevent the creaJon of bitstream images or prevent integrity checking •  Image appears to be +4 Terabytes •  Hashes never match

•  For the most part it is obvious that something is amiss 49

ExaminaJon and Analysis •  Can be a much more subtle aPack •  Relies on vulnerabiliJes of the examinaJon and analysis tools •  AssumpJon is most LE and CF pracJJoners are “tool monkeys” who don’t understand what is happening under the hood

• Documented aPacks against •  FTK, EnCase, iLook, WinHex, TCT, Sleuthkit, etc.

•  Compression bombs •  Nested directories •  Altering the MFT and inodes •  File signature altering, hash fooling

•  The more automated the tool the more suscepJble it is to aPack!

AnJ-‐forensics: The soluJon? •  AnJ-‐AnJ-‐ Forensics

•  Understand what the tools are doing or supposed to do •  Error logging on tools •  Don’t automate everything by default

•  Funded research on AF •  Most research is to date is grass roots and ad hoc

•  Focus research on the Windows world as opposed to *NIX •  Majority of LE and Private sector cases involve Windows OS

•  Academic research has tended to be *NIX centric as it is bePer understood, relaJvely open, and documented

•  Don’t publish all of our tricks??

The future •  AnJ-‐forensics is here to stay

– We are now in an arms race of sorts –  Data wiping tools (free space etc.) will get bePer –  APacks will get more subtle –  Unfortunately tools will get more automated, more levels of abstracJon

•  Data mining, Expert systems, Evidence aggregaJon tools, AI •  Data mining and evidence aggregaJon are needed due to the increasing storage capaciJes and thus increase in volume of data

Summary •  Most anJ-‐forensics techniques are not new •  Most are obvious •  Increased aPenJon by the underground •  More research is needed •  More informaJon sharing within the community is needed •  BePer training for pracJJoners •  Vendors need to listen to the community bePer •  This issue is here to stay!

Suggested Readings •  Butler, G. H. J. (2005). Rootkits: SubverJng the windows kernel: Addison Wesley Professional.

•  Foster, J., & Liu, V. (2005). Catch me, if you can... Retrieved Sept 5th, 2005, from www.metasploit.com/projects/ anJforensics/BH2005-‐

•  Catch_Me_If_You_Can.ppt •  Geiger, M. (2005, August 18th). Evalua&ng commercial counter-‐ foreniscs tools. Paper presented at the DFRWS, New Orleans.

•  Grugq. (2005). The art of defiling. Blackhat Briefings Retrieved Sept 9, 2005, from www.blackhat.com/presentaJons/ bh-‐asia-‐03/bh-‐asia-‐03-‐ grugq/bh-‐asia-‐03-‐grugq.pdf

•  Mcleod, S. (2005). Smart anJ-‐forensics. Retrieved June 1, 2005, from hPp://members.ozemail.com.au/~steven.mcleod/ SMART_AnJ_Forensics.pdf

•  Peikari, A. C. C. (2004). Security warrior: O'Reilly. •  Peron, C., & Legary, M. (n.d.). Digital anJ-‐forensics: Emerging trends in data transformaJon techniques. Retrieved Sept 1, 2005, from

•  www.seccuris.com/documents/papers/Seccuris-‐AnJforensics.pdf 54

Lecture 6.2 - Anti Forensics New Taxonomy.pdf

Kevin Conlan MS, Ibrahim Baggili PhD, Frank Breitinger PhD

Graduate Researcher & UNHcFREG Member Presenting @ DFRWS USA 2016, Seattle

Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy

Cyber Forensics Research & Education Group

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy

Anti-forensics: Tools and techniques used to invalidate the digital forensic process.

So…would using this tool, Tracks Eraser Pro, be an example of anti-forensics?

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 2

How about this encryption tool?

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 3

And this popular disk cleaner/registry wiper?

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 4

And this VPN?

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 5

Agenda

• Problem statement • Contribution • Related work • Methodology • Results & discussion • Limitations • Conclusions & future work

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 6

Problem statement

Not enough research on anti-forensics. Baggili et al. (2012): Out of 500 digital forensic research papers, only 2% pertained to anti-forensics.

Anti-forensic tools and techniques can be used to: • Remove • Alter • Disrupt Or otherwise interfere with evidence of criminal activities on digital systems.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 7

Contribution

I. A categorical data set of 308 anti- forensic tools.

II. An extended version of the Rogers (2006) anti-forensic taxonomy (Figure 1).

III. The calculated hash values of 2780 unique installation-related files of the anti-forensic tools, and an analysis of their presence in the newest 2016 NSRL1.

1http://www.nrsrl.nist.gov/(last accessed 2016-02-10).10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 8

• Data hiding • Encryption • Steganography • Other forms of data hiding

• Artifact Wiping • Disk cleaning utilities • File wiping • Disk degaussing / destruction

techniques • Trail obfuscation • Attacks against computer forensic tools

and processes

Figure 1:

Related Work

Harris (2006): there are no general or contemporary frameworks with which to analyze anti-forensics.

Harris (2006) notes that while there a few general groupings of anti- forensic methods, there are no identifiable groupings of anti-forensic software.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 9

Methodology Our methodology included the following overarching steps:

I. Data set creation II. Data set organization III. Data set analysis IV. Hashing V. Data set comparison with NSRL VI. Extended taxonomy creation

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 10

Methodology

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 11

Figure 2: Extended Taxonomy of anti- forensics

Results and discussion

Comparing anti-forensic tools hashes to the NSRL Python script was written to acquire 2780 unique MD5 and SHA1 hash values of the anti-forensic tool installation related files, and was compared against the newest 2016 Reference Data Set (RDS). Only 423 hashes were found.

The unmatched hashes would be example Presence of anti- forensic tools/files/installation files under the category of Possible indicators of anti-digital forensics.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 12

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 13

Figure 3: Number of tools found per anti- forensic category

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 14

0 20 40 60 80 100 120 140 160 180

Windows Phone Windows

Unix Symbian

SUSE Solaris POSIX OSV

OpenSolaris OpenIndiana

OpenBSD NetBSD

Multi-platform/unspecified Maemo

Mac Linux iOS

Illuminos distributions HP-UX

FreeBSD DragonFly BSD

Blackberry Android

Figure 4: Instances of operating systems/platforms

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 15

0 5 10 15 20 25 30 35

USA Ukraine

UK Thailand

Switzerland Sweden Spain

Singapore Russia Poland

New Zealand Moldova

Japan Italy Israel India

Germany France Finland

Denmark Croatia China

Canada Brazil

Austria Australia

Figure 5: Tools by identifiable country of origin

Limitations

A considerable limitation was the number of software tools that may be considered “anti-forensic” in nature is vast and continuously growing.

It is difficult to determine the entire scope of the anti- forensics domain. However, this is not as much a “limitation” as it is an opportunity for future research endeavors.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 16

Conclusions and future work

The goals of this work was the following:

A categorical data set that would be useful to the digital forensic community through the collection and organization of 308 anti-forensic tools.

An extended classification of the original anti-forensics taxonomy, to more fully encapsulate the domain of anti- forensics.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 17

Conclusions and future work

Future work: Expanding the scope of the categorical data set to include more tools, of which there are many.

“Internet-of-things”: anti-forensic tools will follow this digital migration. Expand taxonomy to include the forms of digital devices that anti-forensics could exist on.

A similar methodology applied to other fields of the information assurance domain (e.g., hacking/penetration tools).

Ways of automating the classification of anti-forensic tools with computational linguistics, by parsing metadata of tools online and leveraging machine learning.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 18

Acknowledgments

Sidharth S. Nandury and Mohammad M. Hassan

Douglas White (NIST)

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 19

Questions?

Thank you!

[email protected]

Data sets for this research are available at www.unhcfreg.com under Data & Tools.

10/26/16 Anti-forensics: Furthering digital forensic science through a new extended, granular taxonomy 20

Lecture 7 - E-mail Forensics.pdf

E-‐mail Forensics

By: Dr. Baggili

Source: h2p://www.cim.mcgill.ca/~jer/email.html 1

Some other project ideas: •  Vola<le memory fingerprints of chat clients •  Comparison of soBware/hardware imaging solu<ons •  Android forensics •  Blackberry chat forensics •  Network ar<facts – predic<ng the opera<ng system based on network traffic

•  Detec<ng e-‐mail servers used based on e-‐mail header informa<on •  Wri<ng soBware for the extrac<on of EXIF data from jpeg images •  Logical versus Physical acquisi<on tools •  A survey inves<ga<ng the type of data that is saved on computers/ mobiles/other devices

E-‐mail Forensics •  E-‐mail history •  E-‐mail evidence •  E-‐mail tracing

History of e-‐mail •  Older than ARPANET •  It was like leaving a note on someone’s desk – when a person logged on, they would find the e-‐mail (mul<ple people using the same computer) •  MIT – MailBox (1965) •  SNDMSG

•  Ray Tomilson (inventor of e-‐mail 1972) •  Chose @ symbol •  user@computer

Ian Peter: h2p://www.nethistory.info/History%20of%20the%20Internet/email.html

History of e-‐mail •  1974 – extensive use by military because ARPANET encouraged it

•  Lary Roberts invented e-‐mail folders for his boss •  1975 – John vital invented a way to organize e-‐mail •  1976 – e-‐mail took off (and 75% of all ARPANET traffic was e-‐ mail)

•  Offline readers •  SMTP & POP •  Euodora – Steve Dorner – 1988 •  Web e-‐mail

Ian Peter: h2p://www.nethistory.info/History%20of%20the%20Internet/email.html

E-‐mail usage, a partial look •  In April, 2008 USA Today ar<cle cites ComScore Media Metrix figures for February, 2008: •  MicrosoB webmail proper<es: 256.2 million users •  Yahoo: 254.6 million users •  Google: 91.6 million users •  AOL webmail proper<es: 48.9 million users

h2p://www.email-‐marke<ng-‐reports.com/metrics/email-‐sta<s<cs.htm 6

8 e-‐mail statistics to bring up at a party 1.  If email was a country, its 1.4 billion users would make it the largest in the

world. Bigger than China, bigger than the popula<ons of the USA and European Union combined.

2.   247 billion emails are sent each day. That's one email every 0.00000035 seconds.

3.  In the <me it takes you to read this sentence, some 20 million emails entered cyberspace.

4.  Every second, the world's email users produce messages equivalent in size to over 16,000 copies of the Complete Works of Shakespeare (assuming a 30KB average email size).

5.   13.4 billion: the number of direct marke<ng dollars forecast to go on email in the US in 2009.

6.   $583 billion: the return from that investment if you use DMA figures on email marke<ng ROI. That's four Bmes the market value of MicrosoB.

7.   181: the number of marke<ng emails it would take to produce enough revenue to buy one share in MicrosoB.

8.   83,689,738,832,367: the number of marke<ng emails it would take to produce enough revenue to pay the US Na<onal Debt.

Mark Brownlow: h2p://www.email-‐marke<ng-‐reports.com/iland/2009/08/8-‐email-‐sta<s<cs-‐to-‐use-‐at-‐par<es.html

E-‐mail misuse: SPAM – 24 hrs 2010

E-‐mail misuse: SPAM – 24 hrs 2011

E-‐mail misuse: SPAM – 1 week 2010

E-‐mail misuse: SPAM – 1 week 2011

24 Hours (Now)

1 Week (Now)

Evidence can we get from e-‐mails? •  Dates/Times •  Sender/Receiver •  E-‐mail servers •  Culpatory evidence •  Example case •  Purchased items, communica<on etc.

•  Words used •  Mood •  Personality traits •  Authorship a2ribu<on •  IP addresses 14

E-‐mail Forensics •  Step 1 – Get the e-‐mail header! •  Get the most accurate <meline possible •  Be sure the original e-‐mail is not deleted •  Different e-‐mail clients/web clients have different ways of repor<ng the headers. Learn those ways and familiarize yourself with them.

What is the e-‐mail header? •  Informa<on that travels with every e-‐mail •  Contains details about: •  The sender •  Route •  Recipient

•  It is like a flight <cket: •  Who booked it (who sent the email) •  Departure informa<on (when the email was sent) •  Route (from where it was sent and how did it arrive to you) •  Arrival details (who is the receiver and when it was received).

•  You can book a <cket with fake iden<ty •  Sender can par<ally fake sender details pretending that the email was sent from a different account (common for spammers or viruses).

h2p://www.emailaddressmanager.com/<ps/header.html

Rogers (2006)

18 Rogers (2006)

Rogers (2006)

Right Click

Rogers (2006)

Viewing e-‐mail headers •  MicrosoB Outlook 98, 2000, 2002, 2003 •  Double-‐click on the message to open it in a separate window. •  Click on View and then Op#ons on the drop-‐down menu at the top of the window.

•  Look for the sec<on <tled INTERNET HEADERS near the bo2om of the Op#ons window.

•  You can highlight the text within the INTERNET HEADERS sec<on to copy it to a new message if you need to send these headers to someone.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 28

Viewing e-‐mail headers •  MicrosoB Outlook Express 5 & 6 •  Right-‐click on the message and select ProperBes. •  Select the Details tab. •  You should see a sec<on <tled Internet Headers for this message. •  You can highlight the text within the Internet Headers sec<on to copy it to a new message if you need to send these headers to someone.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 29

Viewing e-‐mail headers •  Pegasus Mail Clients •  Double-‐click on the message to open it in a separate window. •  Hit the backspace key or type Ctrl-‐h on your keyboard to show the full headers.

•  If you want to forward these headers to someone, hit the F key aBer comple<ng step 2.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 30

Viewing e-‐mail headers •  Mozilla Thunderbird •  Double-‐click the e-‐mail you want to view the headers on. •  Click on the View drop-‐down menu and select Headers and then select All.

•  This will show the headers for any message you view.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 31

Viewing e-‐mail headers •  Mail for Mac OS X •  ABer you open the Mail app, click the on the Mail drop-‐down menu and select Preferences.

•  Click on the Viewing icon. •  Click on the arrow on the Show header detail and select All. •  You will now see the full headers of each message you view.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 32

Viewing e-‐mail headers •  Eudora Mail Clients •  Double-‐click on the message to open it in a separate window. •  Click on the bu2on labeled BLAH BLAH BLAH at the top of the window. This will show the message headers.

•  You can then highlight and copy the headers into a new message for forwarding to someone.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 33

Viewing e-‐mail headers •  Hotmail •  Once you are logged in, click on OpBons •  Click on Mail. •  Click on Mail Display SeSngs. •  Change the Message Headers sec<on to Advanced. •  Click OK. •  Now when you read an e-‐mail, it should show you the full message headers.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 34

Viewing e-‐mail headers •  Yahoo! Mail •  Once you are logged in, click on Mail OpBons. •  Click on General Preferences. •  Under the Messages sec<on, select Show all headers on incoming messages for the Headers op<on.

•  Click Save. •  You should now see the full headers of every message you view.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 35

Viewing e-‐mail headers •  Gmail •  While viewing a message, click on the More opBons arrow in the upper-‐right of your message pane.

•  Click on Show original. •  This will display the headers for that message in a new window.

h2ps://hdc.tamu.edu/reference/documenta<on/index.php?sec<on_id=589 36

Comprehensive list acquiring e-‐ mail headers •  Spamcop thank you! •  h2p://www.spamcop.net/fom-‐serve/cache/19.html

Understanding e-‐mail headers •  Tip 1: Read from the bo2om up. •  Ex. E-‐mail sent from [email protected] to [email protected]

Delivered-‐To: [email protected] Received: by 10.36.81.3 with SMTP id e3cs239nzb; Tue, 29 Mar 2005 15:11:47 -‐0800 (PST) Return-‐Path: Received: from mail.emailprovider.com (mail.emailprovider.com [111.111.11.111]) by mx.gmail.com with SMTP id h19si826631rnb. 2005.03.29.15.11.46; Tue, 29 Mar 2005 15:11:47 -‐0800 (PST) Message-‐ID: <[email protected]> Received: from [11.11.111.111] by mail.emailprovider.com via HTTP; Tue, 29 Mar 2005 15:11:45 PST Date: Tue, 29 Mar 2005 15:11:45 -‐0800 (PST) From: Mr Jones Subject: Hello To: Mr Smith