For A-plus Writer Only

patisa

extended_learning_module__h_435-469.pdf

Home >Information Systems homework help >For A-plus Writer Only

Management Information Systems for The Information Age

Haag, S., & Cummings, M. (2013). Management information systems for the information age .

New York: McGraw-Hill.

MANAGEMENT INFORMATION I svsTEMs r FOR THE 1N~ORMAT10N AGE

> > Ninth Edition Stephen HAAG I Maeve CUMMINGS L_ - - -- ____,

-·

EXTENDED LEARNING MODULE H

Define computer crime and list three types of computer crime that can be

perpetrated from inside and three from outside the organization.

Identify the seven types of hackers and explain what motivates each group.

Define digital forensics and describe the two phases of a forensic investigation.

Describe what is meant by anti-forensics and give an example of each

of the three types.

Describe two ways in which businesses use digital forensics .

...

-f 1ntroductio~ Computers play a big part in crime. They're used to commit crime, unfortunately. But they are also used to solve crimes. This should come as no surprise since computers are by now such an integral player in every part of our lives. Computers are involved in two ways in the commission of crime: as targets and as weapons or tools. A computer or network is a target when someone wants to bring it down or make it malfunction, as in a denial-of-service attack or a computer virus infection. Crimes that use a computer as a weapon or tool would include acts such as changing computer records to com- mit embezzlement, breaking into a computer system to damage information, and steal- ing information like customer lists. See Figure H.l for examples of computer-related offenses in which computers are used as weapons/tools and targets of crime.

Some crimes are clearly what we call computer crimes, like Web defacing, denial-of- service attacks, e-mail scams, and so on. But as is the case in so many parts of our modern lives, computers are also so integrated into crime that it's hard to separate them out.

A member of a crime syndicate was sprayed with drive-by gunfire and was severely wounded. Believing that his services were no longer wanted by his crime gang, he switched sides, agreeing to become a witness for the state. The police secured an iso - lated intensive care unit room for him and guarded it heavily, allowing access only to medical staff and those on a very short list of visitors. Because the man was so badly wounded, there was a distinct danger of infection, and since he was allergic to penicillin, the doctor prescribed a synthetic alternative.

One evening, a nurse wheeling a medicine cart went through the police cordon and into the man's room. He injected the patient with penicillin, and the patient died shortly thereafter. An investigation started immediately and the nurse was potentially in big trouble. He insisted that when he looked at the patient's chart on the computer, there was an order there for penicillin. Subsequent examination of the computer records showed no such order. Eventually, it occurred to someone that perhaps a digital foren- sic expert should look at the computer angle more closely. Having retrieved the backup tapes (nightly backups are standard operating procedure in most places) , the expert found evidence that exonerated the nurse. The patient chart had been changed in the computer to indicate penicillin and later changed back to its original form. Examination further revealep the point and time of access, and indicated that the medical record was

Ins ide the Organization Outs ide the Organizat ion

• Intellectual property theft • Murder (/)

• Accessing information • Theft of information 0

~ on others for personal • Embezzlement (/) reasons • Harassment c 0 • Acts of spite or revenge • Extortion

rn Cl. co • Acts of extortion • Cred it card theft <tl Q) rn s • Reading the e-mail of • Cargo theft by d iverting i..

others shipments Q) +' :::i

• Informatio n destruction • Virus attacks a. E • Planting destructive code • Den ial-of-serv ice attacks 0 • Stea ling customer • Web defacing () (/)

Q) i nformation • Rerouting network traffic ~ • Altering information • Crashing servers ~

Figure H.1 Examples of Computer Crimes That Organizations Need to Defend Aga inst

437

438 Extended Learning Module H

I LEARNING OUTCOME 1

Figure H.2 Crimes in Which Computers Usually Play a Part

changed by someone outside the hospital. A hacker had electronically slipped into the hospital's network unnoticed, made the change, and slipped out again-twice.

Most crimes involving a computer are not as lethal as murder, hut that doesn't mean they're insignificant. Organizations want to make sure their networks' defenses are strong and can prevent their computers from being used for unlawful or unethical acts. That's why so much time, money, and effort goes into security. We discussed security in Chapter 8.

This module focuses on the sort of threats that computer systems are susceptible to and the examination of electronic evidence. The latter is called digital (or computer) forensics.

Computer Crime For our purposes, a computer crime is a crime in which a computer or computers play a significant part. See Figure H.2 for a list of crimes in which computers, although per- haps not essential, usually play a large part. '

In this section we'll focus on crime from the organization's viewpoint. First, we'll examine some of the more high-profile types of computer crime committed against orga- nizations that are perpetrated from the outside. Then we'll discuss the varying moti- vations of people who commit these acts. Lastly, we'll briefly discuss computer crime within the organization.

OUTSIDE THE ORGANIZATION

Computer security is a big issue in business. The concern is about people stealing elec- tronic information, accessing systems without authorization, introducing viruses into networks, defacing Web sites, to name just a few of the dangers. The Computer Security Institute ( CSI) together with the FBl's Computer Intrusion Squad have conducted stud- ies every year since 1996 to assess the extent of the security problem nationwide. The picture is grim. Online fraud is increasing ever more rapidly and financial and other con-

• Illegal gambling

•Forgery

• Money laundering

•Child pornography

• Hate message propagation

• Electronic stalking

• Racketeering

• Fencing stolen goods

• Loan sharking

• Drug trafficking

• Union infiltration

fidential data is falling into the hands of crooks to be sold or used on the black market. Malware is software designed to harm your computer or computer security, engage in criminal activity, or compromise resources in some way.

VIRUSES, WORMS, AND BOTNETS Viruses are a type of malware. A computer virus or (virus) is software that was written with malicious intent to cause annoyance or damage. The early computer viruses depended on people exchanging infected storage media like disks. Later viruses dispensed with the need for human help. The most preva- lent of these is a worm. A worm is a computer virus that replicates and spreads itself, not only from file to file, but from computer to computer via e-mail and other Internet traffic. A decade ago the most famous was the Love Bug worm that destroyed files but was easily detected since it changed the extensions on the files it infected.

During 2007 and 2008 the most common type of worm was a bot, a much more sophis- ticated type of worm. A botnet is a collection of computers that have been infected with blocks of code (called bots) that can run automatically by themselves. A computer infected with such a bot that is part of a botnet is called a zombie computer. The computers get infected when the bot sends out copies of itself to other machines. A malicious botnet can:

• Collect e-mail addresses from the machines it infects as the Damballa botnet did.

• Distribute vast amounts of e-mail as the Storm botnet did .

• Lie dormant to be used at a later date by the crooks-this is perhaps the most frightening aspect of botnets.

The Storm botnet started in early 2007 and wreaked havoc with massive amounts of spam until September 2008. One example was what was called the "World War III" scam that sent false messages announcing the start of World War III. The main objective of the Storm botnet was to create zombies that could be rented out to spammers who would then use those machines to serve spam to the rest of us .

YouTube was also a target. Millions of e-mails told recipients to look at a YouTube video that featured them. When the unsuspecting user clicked on the link, the malicious Web page tried to infect the user's computer.

At its height the Storm botnet had about 500 ,000 zombies under its control. As detection programs became widely used, that number dropped to an estimated 47,000 in late 2008. The United States has the most botnet-infected computers with 18 percent of all zombie computers. Storm eventually became a victim of its own success in that it became so well publicized that it couldn't operate effectively. The last observed activity of the Storm bot was in September 2008.

One interesting feature of Storm was its ability to launch DDos attacks against anti- virus researchers. A Distributed Denial-of-Service (DDoS) attack is where hackers over- whelm a computer system or network with so many requests that it goes down (discussed in more detail later in this chapter). How can your computer become infected? One way is through a malicious Web site you visit. It comes through your browser. This is pos- sible because when you visit any Web page, not just the bad ones, you may get content from many different sources, i.e. third-party ads, maps, online videos, etc. The extra- ordinary array of features that you can build into your Web site increases the complexity of the Web browser. Each one of these components can cause you to be vulnerable to attack. However, as attractive to the bad guys as it is to infect individual computers, it's much more effective to infect Web servers. The more sophisticated infections can get thousands of servers at once. Mostly, the objective of such attacks is to redirect visitors to the attacker's server.

Computer Crime 439

438 Extended Learning Module H

I I LEARNING OUTCOME 1

Figure H.2 Crimes in Which Computers Usually Play a Part

<"'

changed by someone outside the hospital. A hacker had electronically slipped into the hospital's network unnoticed, made the change, and slipped out again-twice.

Most crimes involving a computer are not as lethal as murder, but that doesn't mean they' re insignificant. Organizations want to make sure their networks' defenses are strong and can prevent their computers from being used for unlawful or unethical acts. That's why so much time, money, and effort goes into security. We discussed security in Chapter 8.

This module focuses on the sort of threats that computer systems are susceptible to and the examination of electronic evidence. The latter is called digital (or computer) forensics.

OUTSIDE THE ORGANIZATION

Computer security is a big issue in business. The concern is about people stealing elec- tronic information, accessing systems without authorization, introducing viruses into networks, defacing Web sites, to name just a few of the dangers. The Computer Security Institute ( CSI) together with the FBI's Computer Intrusion Squad have conducted stud- ies every year since 1996 to assess the extent of the security problem nationwide. The picture is grim. Online fraud is increasing ever more rapidly and financial and other con-

• Illegal gambling

• Forgery

• Money laundering

• Child pornography

• Hate message propagation

• Electronic stalking

• Racketeering

• Fencing stolen goods

• Loan sharking

• Drug t rafficking

• Union infiltration

VIRUSES, WORMS, AND BOTNETS Viruses are a type of malware. A computer virus or (virus) is software that was written with malicious intent to cause annoyance or damage. The early computer viruses depended on people exchanging infected storage media like disks. Later viruses dispensed with the need for human help. The most preva- lent of these is a worm. A worm is a computer virus that replicates and spreads itself, not only from file to file , hut from computer to computer via e-mail and other Internet traffic. A decade ago the most famous was the Love Bug worm that destroyed files hut was easily detected since it changed the extensions on the files it infected.

During 2007 and 2008 the most common type of worm was a bot, a much more sophis- ticated type of worm. A botnet is a collection of computers that have been infected with blocks of code (called bots) that can run automatically by themselves. A computer infected with such a hot that is part of a hotnet is called a zombie computer. The computers get infected when the hot sends out copies of itself to other machines. A malicious hotnet can:

• Collect e-mail addresses from the machines it infects as the Damhalla hotnet did.

• Distribute vast amounts of e-mail as the Storm hotnet did.

• Lie dormant to he used at a later date by the crooks-this is perhaps the most frightening aspect of hotnets.

The Storm hotnet started in early 2007 and wreaked havoc with massive amounts of spam until September 2008 . One example was what was called the "World War III" scam that sent false messages announcing the start of World War III. The main objective of the Storm botnet was to create zombies that could be rented out to spammers who would then use those machines to serve spam to the rest of us .

YouTube was also a target. Millions of e-mails told recipients to look at a YouTuhe video that featured them. When the unsuspecting user clicked on the link, the malicious Web page tried to infect the user's computer.

At its height the Storm hotnet had about 500,000 zombies under its control. As detection programs became widely used, that number dropped to an estimated 4 7 ,000 in late 2008. The United States has the most hotnet-infected computers with 18 percent of all zombie computers. Storm eventually became a victim of its own success in that it became so well publicized that it couldn' t operate effectively. The last observed activity of the Storm hot was in September 2008.

One interesting feature of Storm was its ability to launch DDos attacks against anti- virus researchers. A Distributed Denial-of-Service (DDoS) attack is where hackers over- whelm a computer system or network with so many requests that it goes down (discussed in more detail later in this chapter). How can your computer become infected? One way is through a malicious Web site you visit. It comes through your browser. This is pos- sible because when you visit any Web page, not just the had ones, you may get content from many different sources, i.e. third-party ads, maps, online videos, etc. The extra- ordinary array of features that you can build into your Web site increases the complexity of the Web browser. Each one of these components can cause you to be vulnerable to attack. However, as attractive to the bad guys as it is to infect individual computers, it' s much more effective to infect Web servers. The more sophisticated infections can get thousands of servers at once. Mostly, the objective of such attacks is to redirect visitors to the attacker's server.

Computer Crime 439

440 Extended Learning Module H

In early 2009 the big story was the Conficker worm that could he called the successor to the Storm worm. There were various permutations of the Conficker worm. One ver- sion, for example, installed fake security software that popped up a bogus security warn- ing telling you that you needed to install Spyware Protect 2009. The only way to stop the pop-ups was to pay $50 for a useless program. As with the Storm virus, Conficker infected machines for spammers . Another of Conficker's features was to block you from getting to Microsoft's Windows update site.

Experts were worried about what else Conficker might do. One fear was that some sort of attack would he launched on the infected zombies on April 1, 2009. However, that date passed without incident. In all, about 10 million PCs are estimated to have been infected by Conficker. Since one infected machine can infect a whole network, the evil spread rapidly.

STUXNET In 2010 the Stuxnet worm came to light. Stuxnet represents a new level in the development of worms because it was such a finely honed target seeker. The worm, which was transported from computer to computer using a USB stick, was designed to attack Iran's nuclear fuel enrichment centrifuges and send them ~pinning out of con- trol while making the readout screens indicate that everything was working the way it was supposed to. The worm secretly recorded the normal readings and played those hack while it did its other work. The worm infected Windows computers and then hid itself, hut did nothing to most of the computers that it infected. It only activated when it encountered computers running Step 7, the software that runs the Siemens motors con- trolling the centrifuges, called PLCs or programmable logic controllers (see Figure H.3). Even then it only attacked equipment made by two specific manufacturers, one Iranian and one Finnish, and didn' t go into operation until 33 or more pieces of equipment were running in the plant at a speed above a certain threshold.

Another interesting feature of Stuxnet was that if it made it onto a computer con- nected to the Internet it downloaded the latest version of itself. Experts believe that Stuxnet was designed and released by a well-funded group , possibly working in con- junction with one or more governments. The worm spread to other countries including India, Indonesia, and United Arab Emirates.

Stuxnet was not the first worm to attack a nuclear plant. The Slammer worm infected the monitoring system of a nuclear power plant in Ohio, hut fortunately it did not pose a safety hazard. Again, this worm was introduced to the system via the corporate network using a SUB stick. Slammer had none of the sophistication of Stuxnet, hut it highlighted a vulnerability in the system. What makes Stuxnet of great concern to computer security experts is that it represents a new kind of threat where the software that runs various types of machinery, turbines in power stations, for example, or oil pipelines, can he compromised.

In 2011 , along with concerns about Stuxnet, phishing attacks and other types of malware became even more numerous. PandaLabs reported that about 40 new malware programs were created every minute during the first quarter of 20 11. On a different front, two loosely knit groups, Anonymous and LulzSec, came on the scene and blurred the line between hacktivism and criminality. LulzSec, which is a play on geekspeak for LOL or laugh out loud , and Anonymous portray themselves as consumer champions pointing out vulnerabilities in systems that have a lot of personal data. However the groups crossed the line when they published the information they found on their hack- ing expeditions. LulzSec is believed to have breached Sony's Playstation system, shut- ting it down for a month or so, and published personally identifiable information on Sony's servers. The group also penetrated organizations such as RSA Security, the U.S. Department of Defense, the International Monetary Fund, the European Space Agency, Citigroup, and SEGA using distributed denial- of-service (DDoS) attacks. Several mem- bers of both groups have been arrested in various parts of the world.

Computer Crime 441

How Stuxnet Spreads Experts who have disassembled the code of the Stuxnet worm say it was designed to target a specific configuration of computers and industrial controllers, likely those of the Natanz nuclear facility in Iran.

Stuxnet-infected removable drive

Initial Infection Stuxnet can enter an organization through an infected removable drive. When plugged into a computer that runs Windows, Stuxnet infects the computer and

Target Organization Limited Internet access

········Arrows show the spread of Stuxnet

....- -~Windows computer Stuxnet

updates itself / hides itself.

Update and Spread If the computer is on the Internet, Stuxnet may try to download a new version of itself. Stuxnet

Command Web server

fr2 ~ _Q~IJ Internal /ra--r~ nework

then spreads by infecting other computers, as well as any removable drives plugged into them.

3~ ~ ~ !l.~ computers ~ r Removable drives

Final Target Stuxnet seeks out computers running Step 7, software Secure Facility used to program Siemens controllers. No Internet access The controllers regulate motors used in centrifuges and other machinery. While the computers in a secure facility may not be on a network, they can be infected with a removable drive. After infecting a controller, Stuxnet hides itself. After several days, It begins speeding and slowing the motors to try to damage or destory the machinery. It also sends out false signals to make the system think everything is running smoothly.

Computer running Step 7

STAND-ALONE VIRUSES In any given month, between 200 and 300 viruses are travel- ing from system to system around the world, seeking a way in to spread mayhem. 2 And they're getting more deadly. Whereas the Love Bug worm was a Visual Basic script virus (i.e., it needed Visual Basic to run), the latest worms can stand alone and run on any com- puter that can run Win32 programs (Windows 98 or later versions). Examples are SirCam, Nimda, and Klez. Nimda adds JavaScript to every home page on the server it infects, then passes it on to visitors to the site. Viruses of this independent type are very numerous.

The Klez virus is actually a family of worms that introduced a new kind of confu- sion into the virus business. They spoof e-mail addresses. Spoofing is the forging of the return address on an e-mail so that the e-mail message appears to come from someone

Siemens controllers

(P.L.C .'S)

Industrial motors

Figure H.3 The Stuxnet Worm 1

442 Extended Learning Module H

other than the actual sender. Previous worms went to the recipient from the infected sender's computer and contained the infected person's return e-mail address. The worm found recipient addresses in the infected computer's address book.

Klez goes a step fu rther and uses the address book to randomly find a return address as well as recipient addresses. The result is that people who are not infected with the virus get e-mail from the irate recipients and spend time looking for a virus they may not have. Even worse , some of the virus-laden e-mails look as though they came from a technical support person, leading an unsuspecting victim to open them, believing them to be safe.

TROJAN HORSE VIRUSES A type of virus that doesn't replicate is a Trojan-horse virus. A Trojan horse virus hides inside other software, usually an attachment or down- load. The principle of any Trojan horse software is that there's software you don' t want hidden inside software you do want. For example, Trojan horse software can carry the ping-of-death program that hides in a server until the originators are ready to launch a DoS attack to crash a Web site. .

Key logger software is usually available in Trojan horse form , so that you can hide it in e-mail or other Internet traffic. Key logger, or key trapper, software is a program that, when installed on a computer, records every keystroke and mouse click. Key logger soft- ware is used to snoop on people to find out what they're doing on a particular computer. In a small school district in Missouri, cybercriminals smuggled a key logger program onto a computer in the administrative offices of the School District Supervisor. The computer was the one used by the bookkeeper who handled all transactions with the bank. With the key logger the crooks were able to get the ID and passwords to the school district's bank accounts. Before a bank official noticed unusual activity in the accounts , $200,000 was transferred elsewhere in amounts less than $10 ,000 each. Transfers of $10,000 or more must be reported, so criminals keep the amounts below that. You can find out more about key logging in Chapter 8.

MISLEADING E-MAIL One type of misleading e-mail is a virus hoax. This is e-mail sent intending to frighten people about a virus threat that is, in fact, bogus. People who get such an alert will usually tell others, who react in the same way. The virus is non- existent, but the hoax causes people to get scared and lose time and productivity. Within companies the losses can be very severe since computer professionals must spend pre- cious time and effort looking for a nonexistent problem.

Following are some general guidelines for identifying a virus hoax.3

• Urges you to forward it to everyone you know, immediately.

• Describes the awful consequences of not acting immediately .

• Quotes a well-known authority in the computer industry.

These are signs that the e-mail is not meant to help but to cause harm. If you get such an e-mail, delete it immediately.

Another type of misleading e-mail is designed to get people to actually take action that results in setting a virus loose or to do something that will disrupt the functioning of their own computers. The first step is usually to make people believe that they have inadvertently e-mailed a virus to others . They get a message (maybe it purports to come from Microsoft) that they have sent out a virus and that they need to run an attached program or delete a file to fix the problem. They then do what the e-mail says believing it to be genuine, and furthermore, they e-mail everyone they sent messages to telling them about the problem. The recipients e-mail the people in their address books and so on. Be advised that Microsoft never sends out attachments in any official e-mail in a public

mass mailing. It's possible that Microsoft may e-mail you warning you of a problem, hut it will only indicate where you can download a file to take care of it. Before you delete a file from your computer, which may he an important system file without which your computer can't function, ask someone who knows or check out the various Web sites that keep up with the latest viruses, like www.syman tec.com.

DENIAL-OF-SERVICE ATTACKS Many organizations have been hit with denial-of- service attacks. Denial-of-service (DoS) attacks flood a server or network with so many requests for service that it slows down or crashes. The objective is to prevent legitimate customers from getting into the site to do business. There are several types of DoS attacks. A DoS attack can come from a lone computer that tries continuously to access the target computer, or from many, perhaps even thousands, of computers simultaneously. The latter is called a distributed denial-of-service attack and is considerably more devastating.

DISTRIBUTED DENIAL-OF-SERVICE ATTACKS Distributed denial-of-service (DDos) attacks are attacks from multiple computers that flood a server or network with so many requests for service that it slows down or crashes. A common type is the Ping of Death, in which thousands of computers try to access a Web site at the same time, overloading it and shutting it down. A ping attack can also bring down the firewall server (the computer that protects the network), giving free access to the intruders. E*Trade, Amazon.com, and Yahoo!, among others, were victims of this nasty little game in the early days. The process is actually very simple (see Figure H.4).

The plan starts with the hackers planting a program in network servers that aren't protected well enough. Then, on a signal sent to the servers from the attackers, the pro- gram activates and each server "pings" every computer. A ping is a standard operation that networks use to check that all computers are functioning properly. It's a sort of roll call for the network computers. The server asks, "Are you there?" and each computer in turn answers, "Yes, I'm here." But the hacker ping is different in that the return address of the are-you-there? message is not the originating server, but the intended victim's server. So on a signal from the hackers, thousands of computers try to access E*Trade or Amazon.com, to say "Yes, I'm here." The flood of calls overloads the online companies' computers and they can't conduct business.

For many companies, a forced shutdown is embarrassing and costly but for others it's much more tqan that. For an online stockbroker, for example, denial-of-service attacks can he disastrous. It may make a huge difference whether you buy shares of stock today or tomorrow. And since stockbrokers need a high level of trust from customers to do business, the effect of having been seen to be so vulnerable is very bad for business.

MALWARE BOTS AND ROOTKITS A vital component of the increase in the spread of viruses and denial-of-service attacks is the use of hots. A bot is a computer program that runs automatically. Bots (the term comes from robot) can perform all sorts of tasks, both good and evil. In Chapter 4, Decision Support, Analytics, and Artificial Intelligence, you saw how hots take the form of intelligent agents, finding information and automati- cally performing computer-related tasks. Two examples are bots or intelligent agents that continuously monitor networks to find a problem before it knocks out the network and shopping h~ts that find products and services on the Internet for you.

However, there's another class of hots-the kind that are used for fraud or sabotage. In Extended Learning Module E, Network Basics, you learned that bots (software robots) can be used to break into computer systems. Having placed the unauthorized code into a computer, attackers set up servers that are used for such things as distributing illegal copies of movies, music, and software. These compromised machines may be used to

Computer Crime 443

444 Extended Learning Module H

Figure H.4 Distributed Denial-of-Service Attack

Hackers hide their program in hundreds

or thousands of vulnerable servers.

Hackers

Signal from hackers causes hidden program in servers to "ping" their network computers a signal from hackers (a "ping" is a call from the server to the cli ents asking

"Are you there?") .

The computers all answer " I'm here!" And these responses go, not to the server that sent the message, but

to the target server, overloading it.

E*Trade

rn The target server is

flooded and locks up. No one can get in .

distribute kits for breaking into other computers. Malware bots are designed to be con- trolled by an attacker to perform unauthorized work over some period, like sending out spam or becoming part of a denial-of-service attack. Estimates are that about three- quarters of all spam mailings come from this source.

A malware bot is a bot that is used for fraud , sabotage, DoS attacks , or some other malicious purpose. It allows an unauthorized user to take control of a host computer without the victim's knowledge or permission. The term bot is sometimes used to mean a compromised machine, i.e., a computer that has been compromised with a bot. Bot- infected computers are also called zombies or drones.

Malware hot activity has become very sophisticated over the past few years and there is a whole underground society in the had hot business. The lowest level of the under- ground comprises the people who find vulnerable machines and install had hots. The next level up are bot herders. Bot herders assemble battalions of hot-infected computers and sell this network of hots or hotnet to people who are called fraudsters. A botnet is a network of malware-infected computers. Bot herders typically sell their networks for about $1 per machine, hut the price can go up to $100 per system, per month, for access to a major organization that has lots of valuable information like customer and employee data. The fraudsters, in turn, use the hotnet to steal this customer and employee data along with intellectual property, and anything else of value that they can get access to. Computers in organizations as varied as the Department of Defense and Colton School

Computer Crime 44 5

District in California have been compromised. Here are two other examples: _.

• In early N ovemher 2006, the computer of a water plant worker in Harrisburg, Pennsylvania, was invaded by a hot which then spread to the organization's server, which was hijacked into becoming part of a hotnet that was then used to send out spam. 4

• One Sunday morning in 2005 , the Seattle's Northwest Hospital & Medical Center computer system was very slow and documents wouldn't print. The next day things got worse as lots of strange things started happening. The operating- room doors stopped opening, doctors' pagers wouldn't work, and computers in the intensive care unit shut down. It was all the result of a hotnet attack. Three teenagers in California managed to infect a single computer with a had hot. The code spread and soon all the computers in the network had become part of a hotnet. The hospital had to wipe several hard drives clean and reinstall software at a cost of$150,000. The oldest of the teenagers, who was 19, was sentenced to 37 months in federal prison and ordered to pay compensation to the hospital. 5

Malware hots can infect a computer in any one of a number of ways including oper- ating system or application vulnerabilities, e-mail, instant messaging, and computer viruses. One very effective way of commandeering computers is to use a rootkit. It's hard to detect and even when detected, it's hard to remove. A rootkit is a Trojan-horse type program that is activated when you start your computer. It carries code that, once inside, can do whatever it was programmed to do.

A rootkit is software that gives you administrator rights to a computer or network and its purpose is' to allow you to conceal processes, files , or system data from the operating system. It can he used to carry code to perform virtually any type of malicious activity. It can take full control of a system and use that computer or network for spam, denial- of-service, or spyware, and, more chillingly, create a "hackdoor" into the system for the attacker, who can then commandeer the system to he part of a hotnet.

An attacker exploits an operating system vulnerability to get a rootkit onto your com- puter. A rootkit is hard to detect since it runs while the operating system is starting and looks to the operating system like it belongs.

Probably the most widely publicized example of a rootkit was the one that Sony put into CDs and DVDs as part of a copy protection scheme in 2005. It got onto your com- puter when you played the disc and was then exploited by hackers.

WEB DEFACING

Web defacing is a favorite sport of some of the people who break into computer sys tems. They replace the site with a substitute that's neither attractive nor complimentary. Or perhaps they convert the Web site to a mostly blank screen with an abusive or obscene

446 Extended Learning Module H

I LEARNING OUTCOME 2

...

message, or the message may just read "So-and-so was here." In essence, Web site defac- ing is electronic graffiti, where a computer keyboard and mouse take the place of a paint spray can. The USA Today Web site was once a victim. The USA Today Web site was attacked in July 2002, causing the newspaper to shut down the whole site for three hours to fix the problem. The hackers replaced several news stories on the site with bogus sto- ries that were full of spelling errors. One story said that the Pope had called Christianity "a sham." The phony stories were only on the site for 15 minutes before they were spot- ted and the site was taken offiine. 6

CYBER .WAR

Richard A. Clarke, government security expert, has defined cyber war as "actions by a nation-state to penetrate another nation's computers or networks for the purposes of caus- ing damage or disruption."7 The difference between cyber war and hacktivism or cyber terrorism (see definitions below) is that cyber war is perpetrated by one nation on another. It's a better-organized, better-funded, more targeted attack on national infrastructure.

The Department of Defense has said that a cyber attack that cripples the U.S. power grid and/or government and/or financial systems will very likely be the next Pearl Harbor. Intrusions in the last few years have compromised some of the most crucial systems in the Pentagon. These included surveillance technologies and satellite communications systems. The defense industry is also vulnerable and its networks have suffered penetra- tions of military systems such as missile tracking systems and drone aircraft.

THE PLAYERS

Who's spreading all this havoc? The answer is hackers. This is the popular name for people who break into computer systems. Hackers are knowledgeable computer users who use their knowledge to invade other people's computers. There are several catego- ries of hackers, and their labels change over time. The important thing to note in the fol- lowing discussion is that the motivation and reasons for hacking are as many and varied as the people who engage in it.

THRILL-SEEKER HACKERS Thrill-seeker hackers break into computer systems for entertainment. Sometimes, they consider themselves to be the "good guys" since they expose vulnerabilities and some even follow a "hackers' code." Although they break into computers they have no right to access, they may report the security leaks to the victims. Their thrill is in being able to get into someone else's computer. Their reward is usually the admiration of their fellow hackers . There's plenty of information on the Web for those who want to know how to hack into a system-about 2,000 sites offer free hacking tools, according to security experts .

WHITE-HAT HACKERS The thrill-seeker hackers used to be called white-hat hackers. But lately, the term white-hat is being increasingly used to describe the hackers who legiti- mately, with the knowledge of the owners of the IT system, try to break in to find and fix vulnerable areas of the system. These white-hat hackers, or ethical hackers are computer security professionals who are hired by a company to break into a computer system, so as to find security lapses. These hackers are also called counter hackers, or penetration testers.

BLACK-HAT HACKERS Black-hat hackers are cybervandals. They exploit or destroy the information they find, steal passwords, or otherwise cause harm. They deliberately cause trouble for people just for the fun of it. They create viruses, bring down computer systems, and steal or destroy information.

A 16-year-old black-hat hacker was sentenced to detention for six months after he hacked into military and NASA networks. He caused the systems to shut down for three weeks. He intercepted more than 3,000 e-mails and stole the names and passwords of 19 defense agency employees. He also downloaded temperature and humidity control software worth $1. 7 billion that helps control the environment in the international space station's living quarters. 8

CRACKERS Crackers are hackers for hire and are the people who engage in electronic corporate espionage and other profitable ventures. This can be a pretty lucrative under- taking, paying up to $1 million per gig. Typically an espionage job will take about three weeks and may involve unpleasant tasks like dumpster diving to find passwords and other useful information and " social engineering." Social engineering is conning your way into acquiring information that you have no right to. Social engineering methods include calling someone in a company and pretending to be a technical support person and getting that person to type in a login and password, sweet talking an employee to get information, and for sophisticated jobs, perhaps even setting up a fake office and identity.

HACKTIVISTS Hacktivists are politically motivated hackers who use the Internet to send a political message of some kind. The message can be a call to end world hunger, or it can involve an alteration of a political party's Web site so that it touts another party's candidate. It can be a slogan for a particular cause or some sort of diatribe inserted into a Web site to mock a particular religious or national group.

Hacktivism, in the form of Web defacing, is becoming a common response to disagree- ments between nations. For example, hackers in Iraq and the United States have traded intrusions during the Iraq War. Such attacks are common in the Middle East between Israel and Saudi Arabia and other Arab states. A popular target of hacktivists is companies that are located in regions of conflict but are based in some other country.

CYBERTERRORISTS Since the September 11, 2001, terrorist attacks on New York and the Pentagon, officials have become increasingly worried about the threat of cyber- terrorists. This group of hackers, like the hacktivists, is politically motivated, but its agenda is more sinister. A cyberterrorist is one who seeks to cause harm to people or destroy critical systems or information. Possible targets of violent attacks would be air traffic control systems and nuclear power plants, and anything else that could harm the infrastructure of a nation. At a less lethal level, cyberterrorist acts would include shutting down e-mail or even part of the Internet itself, or destroying government records, say, on social security benefits or criminals.

In 2000 a disgruntled employee took over a water-treatment plant in Australia and released more than 200,000 gallons of sewage into parks, rivers, and the grounds of the Hyatt hotel. According to the Central Intelligence Agency, cyberattacks have interrupted power in multiple regions of the world. During the last part of 2008 and the early part of 2009, the U.S. government spent $17 billion in repairing cyber damage. Government officials believe that the attacks came from outside the United States. Another $17 billion is earmarked to protect the networks from further attack. 9

SCRIPT KIDDIES Script kiddies or script bunnies are people who would like to be hackers but don't have much technical expertise. They download click-and-point soft- ware that automatically does the hacking for them.

The concern about script kiddies, according to the experts, apart from the fact that they can unleash viruses and denial-of-service attacks, is that they can be used by more sinister hackers. These people manipulate the script kiddies, egging them on in chat rooms, encouraging and helping them to be more destructive.

Comput er Crime 447

44 8 Extended Learning Module H

r Digital Forensics - • Digital forensics experts are called in to help solve crimes of all kinds from white collar ·= .. ---------- 3 ---.1 fraud and traffic accidents to terrorist activities and political scandals. They investigate

LEARNING OUTCOME . r . h h ll £ h d d ' k d · h d h imormat10n t at t ey co ect rom computer ar is nves, smartp ones an ot er

...

cell phones , flash drives , CDs , and DVDs and build a picture of the crime or incident. Some high profile cases where electronic evidence has been crucial are listed below:

• In 2007, a disturbed student went on a killing rampage and in the space of two hours, in two separate attacks , killed 32 people and wounded 25 others before killing himself. To try to understand what had happened, authorities collected his electronic devices, such as his computer and cell phone, and pieced toge ther a profile of the young man from the information they found.

• In 2009 a big rig truck driver killed a Buffalo mother of two when he was watching pornography while driving and didn' t see her brok~n-down parked car. Police forensics experts found the evidence on his computer, leading to his arrest and being charged with second degree manslaughter.

• In Fort Collins, Colorado, parents of six-year-old Falcon Heene reported that a helium balloon had floated up into the atmosphere with their son on board. The balloon landed about 12 miles outside the Denver airport after traveling about 50 miles. When the balloon came down and the boy was not on board authorities launched a massive search believing that the boy had fallen out. Later, on the basis of evidence found by computer forensics experts, it was established that the story was a hoax and that the boy had been hiding in the attic all the time. The parents went to jail after costing taxpayers 2 million dollars.

• A Missouri auto parts store owner pled guilty to conspiring to help a terroris t network. He admitted to sending more than $23,000 to al Qaeda and performing oth er tasks. He communicated with others in the network through steganography, where messages are hidden inside other messages. The FBI in Kansas City cracked the code and secured evidence against him.

• In 2010 the University of Kansas athletic department announced an internal investigation into the multi-million-dollar ticket scalping scam perpetrated by several employees over a number of years where they diverted ticket sales for their own profit. The ticket director at the university controlled the computer that would have detected the theft if she hadn' t changed the settings.

Investigators found damning e-mails including one where the director of ticket operations promised eight free tickets to a neighbor who complained that work being done on the ticket operations director's home was causing him grief and a soggy lawn. The perpetrators went to jail.

Law enforcement has been turning to digital forensics for several years now to help solve crime. The Federal Bureau of Investigation has fourteen Regional Computer Forensics Laboratories with 224 forensic examiners who have processed more than 3,000 terabytes of information which is the equivalent of three million copies of the Encyclopedia Britannica. Their work is not confined to the 57,000 hard disks they worked on in 20 IO-they're also examined innumerable digital cameras, smartphones, wireless storage devices, and various other storage components. 10

Of course, the FBI and other law enforcement agencies are not the only organizations that use digital forensics. And not all digital forensics companies investigate criminal cases. Many work on property cases, where a company believes that an employee is secretly

copying and perhaps selling proprietary information such as schematics, customer lists, financial statements, product designs , or notes on private meetings. Other investigations involve domestic disputes, labor relations, and employee misconduct cases.

Digita'L 'foren sics 449

Digital forensics is the collection, authentication, preservation, and examination of electronic informa- tion (often for presentation in court) . Electronic evi- dence can be found on any type of computer storage media, such as hard disks, smartphones, CDs, flash cards, USB devices, etc. But investigators have had cases that involved rather unusual media such as the black boxes used by the railroad that record infor- mation about trains and the black boxes on cranes that might yield clues as to why a crane collapsed. Forensics can even be applied to such systems as the da Vinci Surgical System, which is a robot used by hospitals where mechanical arms do the actual surgery while the surgeon operates the controls (see photo). The da Vinci system has a hard disk that stores video clips, records of who logged on, and other data. If someone were to erase a file that contained evidence of an error that occurred during surgery, an investigator could find remnants of that file.

In the da Vinci system, the surgeon sits at a viewfinder (left) and remote ly mani pul ates probes and instruments on actuator arms over t he o perating table .

There are two basic motivations for engaging in digital forensics. The first is to gather and preserve evidence to present in court. The second is to establish what activities have occurred on a computer, often for the pur- pose of dispute settlement. Evidentiary standards differ for criminal and civil cases. In criminal cases, the standard is beyond a reasonable doubt. In civil cases, it's the pre- ponderance of evidence . Perhaps the situation doesn' t involve the legal system at all. It could be that you have an employee that you suspect has been using the company's computer system to gamble online. In this case your proof can be lower, perhaps just enough to reprimand or fire the person while reducing the risk of being named in a wrongful termination lawsuit.

In a well-conducted digital forensics investigation, there are two major phases: ( 1) col- lecting, authenticating, and preserving electronic evidence; and (2) analyzing the findings.

THE COLLECTION PHASE

The collection phase consists of two steps: getting physical access to where information is stored and creating a forensic image copy.

PHYSICAL ACCESS Since getting physical access to the computer and related items is necessary, the digital forensics team collects computers, cell phones, CDs and DVDs, printouts, post-it notes, and so on and takes them back to the lab. This process is similar to what police do when investigating crime in the physical world: collecting hair, clothing fibers, bloodstained articles , papers, and anything else that they think might be useful. The crime investigators usually take these potential clue carriers with them and secure them under lock and key, where only authorized personnel may have access, and even they must sign in and out. This is to preserve the " chain of custody" of the evidence.

Digital forensics experts use the same kind of protocol. To conduct a thorough inves - tigation, they first take digital photos of the surrounding environment and start devel- oping extensive documentation. Then they start collecting anything that might store

4 50 Extended Learning Module H

Figure H.5 Where You Might Fi nd Electron ic Evidence

information. The hard disk is an obvious place to look, but digital forensics investigators also collect any other media where information might be stored. See Figure H.5 for a partial list of places where evidence, called artifacts , can be found.

Cell phones, of which there are almost as many in the world as there are people, are another obvious source of informational artifacts. When you have your phone on it's cons tantly in communication with nearby cell towers so that a call can be handed off to the base station receiving the strongest signal from your phone, and as you move , your change in location is being recorded. In urban areas with a lot of towers , a phone's loca- tion can be tracked almos t to the block. If your phone has GPS capabilities, your exact location can p inpointed in real time. If the phone photos are geotagged (i.e. include the location where the pho to was taken) there may be a wealth of information there. Phones with passwords may stop th e investigator examining the phone, but if you back up your phone files on your computer that copy is not pass-worded. Cell phones are very useful in discovering who is talking to whom. When an investigation is announced, it's likely that the p eople involved in the fraud will start a flurry of phone calls to others involved. T h e list of recent calls as well as any texts or voicemail messages can be very revealing.

Since there are so many people using cell phones, it stands to ; eason that some of them are using them to commit crime . The list of cell phone crimes includes much of the illegal activity that' s possible with computers (or without them) and some that' s unique to cell p hones. Some examples are

• Illegal drug deals.

• Stealing data and storing it on a cell phone.

• Using a cell p h one to fraud ulently obtain goods and services. A variation on this theme is stealing subscriber information and using it to create duplicate accou nts which are then used to purchase goods from the Internet using the original subscribers' accounts . T hese crimes are particularly prevalent in Europe and japan, where people use their cell phones to buy snacks and drinks out of vending machines , pay parking tickets, make credit payments, and engage in a hos t of other types of mobile commerce.

Hard drives

CD's and DVD's

USB drives

Flash memory cards like SD cards

Backup media

Vo ice mail

Cell phones

Electronic calendars

MP3 players and iPods

Scanners

Photocopiers that usually have hard disks nowadays

Fax machines

Xbox system

• On a vastly more serious scale, cell phones have been used by terrorists to set off explosives. This happened in Madrid in 2004 when bombs went off in commuter trains; at Hebrew University in Jerusalem, in 2002, when seven people died; and in Bali outside a night club in 2002 and in the Jakarta Marriott Hotel. 11

As well as electronic media, investigators collect any other potentially helpful items, especially passwords, for use in case any of the files they come across are encrypted or otherwise difficult to access. Passwords that are written down are often stored very near the computer, making it easy for forensics experts-and thieves-to find them. Other items that might be useful include address books and business cards of associates or contacts of the person being investigated.

AUTHENTICATION AND PRESERVATION. Step two of the collection process is to make a forensic image copy of all the information. A forensic image copy is an exact copy or snapshot of the contents of an electronic medium. It is sometimes referred to as a bit-stream image copy. To get a forensic image copy, specialized forensic software copies every fragment of information, bit-by-bit, on every storage medium-every hard disk, every CD, every USB drive, every flash card, and every cell phone involved in the investigation. Hard disk drives today hold upward of 2 terabytes and even a CD holds about half a gigabyte. That can amount to the equivalent of hundreds of millions of printed pages. The copying alone can take a long time since the chain of custody must be protected.

To get a forensic image copy of a hard disk and other computer media contents, inves- tigators physically remove the hard disk from the computer. If the suspect computer is off, they don't turn it on, because Windows performs hundreds of changes to files. Access dates change, and so do temporary files, and so on. So, once turned on, the hard drive is no longer exactly the same as it was when it was shut down. Thus, opposing counsel could argue that this is not the same hard disk that the suspect used.

Having removed the hard disk, investigators connect it to a special forensics com- puter that can read files but can't write or rewrite any medium. Another tool that forensic experts use is a write blocker that permits read commands but not write com- mands. This allows you to gather information from a drive without changing or delet- ing any information on the original source. There are both hardware and software write blockers . The software types are usually specific to a particular operating system while hardware write blockers work with any operating system and plug into USB or Firewire ports.

Investigators prefer to remove storage devices like hard disks, but if that's not pos- sible, they copy the contents in place using cables. Then they use forensic software like FTK (Forensic Tool Kit) or EnCase to extract a forensic image copy of the original medium without changing the files in any way.

How do we know that nothing changed on any media during the entire investigation from the time they were seized? That's the question that opposing counsel will ask the digital forensics expert on the witness stand. So, during the collection phase and, later, the analysis phase, the investigators have to make sure that evidence to be used in a trial could not have been planted, deleted, or changed. This is a basic evidentiary rule for all court proceedings.

In a digital forensics investigation, experts use an authentication process so that they can show sometime in the future-perhaps even five or six years later-that no entry or file changed in the interim. They do this by generating an authentication code (unique

Digital Forensics 451

452 Extended Learning Module H

Figure H.6 MDS and SHA-1 Hash Values for the Forensic Tool Kit (FTK) Program

...

identifier or checksum value) for each file and/or each medium. There are three such authentication coding systems in wide use: The MD5 hash value, the SHA- I, and the SHA-2 hash values. These codes are mathematically generated strings ofletters and dig- its and each code is unique to an individual file or disk at a specific point in time. The authentication codes are based on the contents of the file or medium and any change in content will change the authentication code.

Hash values are seemingly meaningless sets of characters. For example , a hash value could be the sum of the ISBN s and the number of pages in all the books on a bookstore shelf. The result, which would be a mixture of ISBN codes and quanti- ties of pages, would be meaningless for anything except identification. If a book, or even a page, were added to or removed from the shelf the hash total would change , so the contents of the shelf could be shown not to be the same as they were when the hash value was originally computed. Similarly, adding so much as one space to a Word document on a disk will change the authentication code . Authentication codes are the electronic equivalent of DNA for people. The probability of two hard disks with dif- ferent contents having the same MDS hash value is I in I 0 to the power of 38: that' s I with 38 zeros after it. You would actually have better odds of winning the Powerball lottery 39 times in your lifetime than you would of finding two hard disks with differ- ent contents h aving the same MDS hash values. SHA hash values are even stronger, since the character string is longer; however, the MDS is accepted by most organiza- tions as strong enough. Figure H.6 shows a screen from the Forensic Tool Kit (FTK) that has an MDS hash value and an SHA-I hash value for the Internet/chat files direc- tory on the medium being examined.

Burglars have been known to check their Facebook pages while conducting a rob- bery and that information, putting them in the burgled home at a precise time has been used. So, an obvious place to look for information about a person nowadays is social networking sites. Facebook would be a good place to start. More than three-quarters of people who have Facebook pages don't restrict who can access their photo albums and SI percent don't restrict who can see their recent activity, which has updates that record

MDS Hash Value

ilil Access Data Fqreosic Toolkit Version:. 3.2.0.32216 Oatabase. loalhost ""'c: (Mel -Edltt'.ation - Blc f dit 'i]ew Evidence FJfter Iools Manage l::lelp

Alter: - unfiltered- Alti!fMi!li..-... I !ii EE ._Explort' Overview Equiil G~ Bookm!irXs Uve Search Index5e3cch Volatfle

-ciie -OVeiVJeo.V' . • Ploper ties ~AleCatt'QOIY{S,073 { 5,073} " , ~)!. I

ffi- '(I Ardllv'l!!i ( 39 / 3'1) a NTFS Information - !i t ~{O/O) MFTRecordNumber

$- \:t1 Documeot5(618/618) 440

, f!! G:'..! Ernail(tl/U)

i& L!Ex..wtable(2{ 2 ) !ll-t,J Folders{ 2,035/2,035)

i $ ~Gri!ph lcs(t,033/l ,033)

Record date

8 - "al fnl£met/Ch atAll'S( 10) ' IE-~ IntemetExplorer (10/!0)

Resident Offllne

Sparse Tempor&ry

Owner SID

Owner Name Group SID Group Name

6 MobllePhoneDati(O/ ) ffi- i,J Mul~media ( lG / 10) ff/$" 0S/Ale SystemA!PS(312 12) at -.rOther EnoyptJonAtes( 16( )

ffiSf OtherKnownTypes(l/1) Pr6efltition ~ ( o / o l

8- Slack/Free~(SJ / 53) ; ~ Ale5ystem51ad<(l / l)

~ SIM!<Space(41 / 41)

_ ,..,. ~ Un<lll~-Space(ll / 11)

Rte u~t

• label [ Item .!Ext

'" 3178 dat 1973 d.)t

1344"" 1911 dat 1286 dat

j Altered: 10

e Fiie content Info

e Has h Infonnation MOS Hash SHA-1 Hash

"""' 8239109C7E9C2E8A8CJBDE09 5295 0391

J8S06 10C8CC007CF3 2FA1 50 EC1 D1 124F076C2 796

- Ale Content Properties ,- H~'f~te:;.p;".eter

Cate .•. 1P·Slze IL-Size ! MOS ! .. s ..• ISHA ... ] Created I Accessed IMo<ifled MS! ... 64.0 ... 64.0 ... All... 033 ... 871. .. 6{30/200 ... 10/15/20 .•.

Mst ... 32.0 .•. 32.0 ... E48 ... 056 ... 014... 7{3/ 2009 . .. 7{3/2009 .•.

MS!.. 32.0 ... 3 2.0 ... 702 ... 007 ... DJF ... 7{3/2009 ... 7/3/2009 .. . 48.0 ... 48.0 .. 823. .. 385 ... 86F ... 10{14/20. 10/14/20 .. .

9ED .. . JBF ... OA ... 7/4/2009 ..• 7/4/2009 .•. 82 B ... 411... 2E5 ... 10/10/20 ... 10/10/20 ...

ITotal:IO I Hl1!11Qhted: 1 ICheci:ed: 1 rTotali..Size:512.0KB

•/ Elly/ Local Settlngs/ Hlstory/ History.IE5/ MSH!SW1200910142 0091015/lndex.dat

Folde r being examined SHA-1 Hash Value

where the person is at a certain time using geo-location tools, according to a survey by Wehroot. Wehroot is an anti-virus and anti-spyware company. When you use Facehook, temporary files are stored on your hard disk that are not readily apparent. They don't show up when you search through folders and there's a wealth of information in those files. The files contain information on Facehook ID numbers and who they were in con- tact with. You can even do a reverse search and p ut in an ID number to get the user's name. It's also possible to re-create the threads of chat sessions.

THE ANALYSIS PHASE

The second phase of the investigation is the analysis phase when the investigator follows the trail of clues and builds the evidence into a story. The analysis phase consists of the recovery and interpretation of the information that's been collected and authenticated .

RECOVERY Digital forensics experts use a variety of software tools to recover infor- mation. They usually use specialized digital forensics programs like Forensic Tool Kit (FTK) or En Case. With these programs investigators can find a wealth of information on storage media. They can find deleted files pretty easily and files with extensions that don' t match the file format (e.g. an image file with the extension .xlxs). If a deleted file has been overwritten, it' s very possible that fragments of that file remain in unallocated space, i.e. space that is marked as being available for storage. See Figure H. 7 showing a file fragment in unallocated space.

In Figure H.8 you can see some of the files that can he recovered from storage media with fore nsic software. A program like FTK can pinpoint a file's location on the disk, its creator, the date it was created, the date oflast access, and sometimes the date it was deleted as well as formatting and notes embedded or hidden in a document.

A digital forensics program can find and display all the images on a storage device so that you don't have to look in separate places and by different extensions . In Figure H.8 you can see that FTK has collected images togeth er in a separate folder and you can examine that folder to see what pictures are on the disk and where they are stored.

Digital forensics experts use a lot of other software too. For example, they might use something like Internet Evidence Finder (IEF) or N etAnalysis that search a hard drive

liJa AccessData For nsic: Toolkit Version; 3.2032216 D.:i.tab.lre: Jocalhost Cue C<'!Sel -Educ .. tion·

Rll:H : ·unfiltered· AlterMan~ ••• I !ii 83

c m,1

Hex vi ew of unalloca ted space

• ~oc--~~ !Wn ... ! Ext :·.:: 14.6-.. 14.6... n/a

a..AMPETl2.EO .. . Unal ... 102 ... 102... llfa 60H Cl.AMPET12.EO ..• Unal ... too .... 100.... n/a nfa 5025 QAMPETl 2.EO ... Una! ... 100 .... 100... . nid n/a

,-, -fAltfftd:-u--~:1·1---fHi¢iT~~-,,-'"aledtd:""l--~LSIU:799:-fi;i"B

- t·

File fragment left over after a file has been deleted and the space rewritten

'i:

Digital Forensics 453

Figure H.7 File Fragment in Unallocated Space in the Forensic Took Kit (FTK) Program

454 Extended Learning Module H

Figure H.8 Col lection of Images on a Hard Drive from the Forensic Tool Kit(FTK) Program

. -

II AccessData fore nsic Toolkit Version: 31032216 Database: localhos! Case: Casel -Education- {Not Responding)

[

file Edit 'ija<t fvjQence F!ltB Iools 1::1aMge Help ----·

'Y' __ ~lter; - unfi!teral - • AlterMilllaqer ... j iii GE -~~Email Graphies_Bookmarlts uve search lnde.tSearth v•i...

i - Case Ovi:rvlcw ' _ _ __ _ ' ~ fileCoritffit

1 9 ~n1ecategorv(S,on/s,on) A fHeXrTlii""""' "' ffi-l) Archives{J<;l/J!J) ••••••11111111111111 il ' Datal>as!.>s(O/O) s.; ,§} Document'i(618/618) - _ .-.- ' ll ~ - _.-

' :1! 8 Emi!il(ll/ll) · a;-LJ &ea!tlble(2/2) ~Fdder'S(2,035/2,035}

m;.;i Gr<l(.lh1c;:{t.on/ 1,nn1 ffi ..:) Jn~et,IOiatFlle.(10/10)

6 MQbil~Phone Data{O / O) !E .IJ.Multimeda(t0/10} <E (lf OS/fi!eSystemRles(312/Jt 2) $-f' otherEnoyptionfill'5(16/16) ffi~ =:i:~;~\1 / 1 ) !i!-..J Slad::/free~(SJ / SJ)

:~ =~::::J~/930) ---_t, UserTypes(O {O)

ff!{ ]jFileSt;ti.rs EE-.f· ~ Emi!ilsratus

~] • i? '

~j ~ l1 ! I

J > 11 r£- U li'Jbels(o/o)

lF*Us1 m · · ·• · N~• ~""'nmo z-,c~""°""'"''"m' -"'°'"""'"'' I

~ ___ f!le_~ Properties Hexlfll:erp(eter

i!I I A tm1e l labtl !Ittrn .. J &t ! P<th ! CR ... ! P.-9le ! L-Sl?f! I MD5 ! SHA! l ~A . ! c:.rwttd ! Acas5td ! MOilfmi 1 o; 3n8'1997@NO... 1400 JPQ CLAMPETl2.f0 ... JPEG 5648 56-48 F<IA. .. C!E ... 996 .. l i)/14/20. .. 7/4{2009 .. 10/14{2fL. ,-;§-·:I 0~ 38d0f542bb:5Sf... 1514 JP9 Cl.AMPff12.EO... JPEG 409 ... 383._ 7FF... 3F4... 4f7... 10/M/20... 7/4/2WJ ... 10/H/20... · -- 0~ 3945138755_8... 1117 Jpg Cl.A~1PET12EO ... JPEG 90.0 ... 89.9 .•. OFF .•. 041 .•. 121 ... 7{3[2fH} .•. 10/16/20 ... 10/10/211... I 0~ 3tt&67t791)4. 1515 JPIJ CLAMP€T12.E-O... JPEG 409... 357... 388... 709. .. 04E... iot1<1120... 11412009 .. 10/14120... ~ I Loade<:I: l ,033 jnrte<ro: 1,033 lrotai: 1,033 fHl11i~rJittd: 1 f ctied:ed: 1 j Totil l.5W!: 4U.9'! MS

~Cl~[NTFS]/[root)/Olxumcnts11nd5ctting~6uddy/O&top/Some-~~.:=~:!7_ _ _ __J

for Internet-related artifacts. Of course, also stored on the hard disk is information about where the computer user went on the Web. Every graphic image you view on the Internet is copied to your hard disk, usually without your knowledge . But also available are copies of Facebook Chat, Facebook E-mail, Google Talk, Hotmail Webmail, Twitter status updates, Firefox artifacts and on and on. Experts will often use two similar recov- ery packages on the same data to confirm results, known as dual tool verification.

E-mail comes in many formats and various e-mail conversion programs like Transend and Aid4Mail convert these formats into a form that the digital forensics investigator can work with easily. These programs allow you to search for specific terms in e-mails and attachments and show only those that are relevant. For videos, there's VLC media player which is a free and open source multimedia player that will play most multimedia files as well as DVDs, CDs , and streaming video files.

Live Ana lysis It's not always possible, or advisable , to collect information when a computer is off. For one thing, you will lose the information in volatile storage, i.e. RAM. Therefore, the forensic team has to gather the information it needs while the system is still running. This is called a live analysis. Live analysis is the term used to describe an examination of a system while it is still running. Live analysis may be necessary under certain circumstances such as:

• If the company hosts a Web site that takes customer orders. In this situation a complete shutdown would cost the company precious business, and a judge might consider such action as an " undue burden" on the company .

• If information that is needed is in RAM and the examiner pulls the plug that information will be lost. So in this case it would actually be better for the forensic experts to get data from a computer that's still running. For example, if someone is caught red-handed using a computer for some illicit activity it might be much better to get a memory dump from the system rather than pull the plug which would wipe out the contents of volatile RAM.

• If the user is using a whole disk encryption program, like BitLocker that comes with Windows 7 or Guardian Edge, turning off a computer will trigger the encryption process and a password will th en be required to access the data.

• With hard disk storage now in the terabyte range, it's simply too wasteful to copy all the data when only a small portion of it is relevant to the investigation. Under these circumstances, it may be accep table to extract only certain well-defined portions .

In a live analysis , the examiner doesn' t make a forensic image of the disk, and therefore, there's no MD5 or SHA hash value. This is a big disadvantage should you need to make a case in court. All you have is a momentary snapshot of what's going on within that system. On the plus side, examiners can glean information from memory and on processes and services that are running and also on open ports on the computer. The collection would usually start with memory, which is the most volatile, and then proceed on to swap file (used in virtual memory) and network processes, and other volatile areas. Live forensics is often used to determine whether an event has occurred. Data can be collected from memory on the video card and on the network card as well as the contents of RAM.

Helix, which is freeware, is often used for this purpose. It's Linux-based and provides a utility that allows the examiner to download to a PDF, which is not easily changeable, detail- ing what the examiner did in the correct sequence and what tools were used. This provides some assurance that the examiner did what was necessary and followed proper procedure.

One of the new problems facing digital forensics experts is the problem of access to cloud computing data. The data may be stored outside the country making access to it problematic if not impossible. Even if you use a cloud computing provider based in this country (like Gmail, Hotmail, Google Docs, or Dropbox) the company may outsource actual storage of the data to a company that operates on the other side of the world. Since laws are applicable only to particular geographical jurisdictions, the legal complications can be a nightmare.

Cell Phones At the end of 2010 there were just over 303 million cell phones in the United States, where the population is just over 310 million people. Considering the flexibility of today's cell phones, especially smartphones, they can be great sources of information for investigative bodies. There's much more information on smartphones than calls sent and received. A modern smartphone is a combination of many devices , such as phone, personal digital assistant, still and video digital cameras, music and video players, game console, and resources traditionally available on a larger computer such as Web access, e-mail access , and word processing and spreadsheet capabilities.

See Figure H.9 for a list of some of the information stored on cell/ smartphones. Many smartphones use MicroSD cards and there may be information there too .

Phone book with phone numbers, addresses, work and home contact information

Subscriber, equipment, and service provider identifiers

Calendar ,

To-do list

Phone number log with recently incoming and outgoing calls and missed calls

E-mail

Web activity with bookmarks and cached Web pages

Text messages and multimedia messages

Voice mail

Electronic documents

Last active location and other networks encountered

Graphics, photos, and videos

Instant messages

GPS fixes, locations, and journeys

Digital Forensics 455

Figure H.9 Recoverable Cell Phone Information

456 Extended Learning Module H

The big problem with doing forensic investigations on smartphones is that, unlike computers , over 90 percent of which run Windows, Smartphones run a whole range of software that varies from company to company and even phone to phone. The first deci- sion that an expert may have to make is whether or not to turn the phone off. Leaving it on will run the battery down and make it susceptible to an e-mail "bomb" that floods the phone's memory with messages that wipe out previous calls and messages. Putting the phone in a metal-mesh shielding bag to block signals would avoid the bomb problem but will drain the battery more quickly because the phone will boost its transmitting power to try to reach a cellphone tower. Turning the phone off may cause problems later because the phone may have a password that will prevent access. To know what cables to use will necessitate having the model number, which is usually stored under the battery and removing it to see the number will then kill the power to the phone.

No one forensic tool will retrieve all information from all smartphones but there are several programs on the market that will copy information from phones. Most of these are not specifically designed for forensic investigation so they don't have the safeguards , like hash values, against data tampering that specialized tools do. Many of the tools avail- able are synchronization tools that people use to transfer stored info; mation between phones.

GSM (Global System for Mobile Communications) phones have SIM cards. GSM is the most common type of phone outside the United States and is used by some compa- nies within the United States. Apart from storing the phone number and other authen- tication information it acts as a secondary storage area of contacts, text messages, and other artifacts. Deleting a message from the SIM card only marks it as deleted and does not remove it until the space is needed.

INTERPRETATION As with all evidence, the analysis of the electronic clues and the assembling of the pieces into a credible and likely scenario of what happened are very important. Much of the information may come from recovered deleted files , currently unused disk space, and deliberately hidden information of files. Following is a discus- sion, not necessarily exhaustive, of places where information can be found on a magnetic hard disk.

Information is written all over a disk, not only when you save a file, but also when you create folders , print documents, repartition the disk, and so on. System and applica- tion software alike continually create temporary files resulting in space and file locations being rearranged. Leftover information stays on the disk until another file writes over it, and is often recoverable with forensic software.

Deleted Files and Slack Space It's difficult to get rid of information on a magnetic hard disk completely. When you delete a file it's not gone. What actually happens is the file is marked as deleted , meaning that that space is available to accept new information. The actual information in the file is not affected at all by the delete action.

If you delete a file from the hard disk it goes into the Recycle Bin and you recover it later from there. In the case of a removable medium, like a USB flash drive, it's a little harder, but not much since you can get the file back with one of any number of utility programs.

When you mark a file as deleted, the space is freed up for use by some other file. So, another file may shortly be written to that space. However, it's not quite that straightforward. The operating system divides storage space into sectors of bytes or characters. The sectors are grouped into clusters. A file is assigned a whole number of clusters for storage, whether it completely fills the last cluster or not. This stor- age allocation method usually leaves unused portions of clusters. This is analogous to

writing a three and one-half page report. So, the fourth page is allocated to the report but not completely used. If the previously stored file (the deleted one) was bigger and used that last part of the space, then the remnants of the deleted file remain and can be recovered using the appropriate software. The space left over at the end of the file to the end of the cluster is called slack space, and information left from previous files can be recovered by forensic software.

Solid-state hard drives (SSDs) are based on flash memory and do not function in the same way as magnetic hard drives . Flash memory is not divided into the traditional blocks of bytes, but is instead in pages of 2 KB, 4 KB or larger. Rewriting a block at the operating system level will not necessarily put the data back in the same place. The infor- mation may be remapped to avoid wear in certain spots or to avoid failing pages. Each page can be erased and rewritten only a limited number of times (up to 10,000 or so). Hard drive sectors can be rewritten millions of times . SSD information can be erased very quickly- typically in seconds-and the data is more thoroughly wiped than it would be in one pass on a magnetic drive. While this is a very desirable feature from the point of view of the owner of the data, it's causing nightmares among digital forensics experts who are struggling with this new medium and have to develop some new approaches.

System and Registry Files The operating system manages the hardware and soft- ware of your computer and lets your application software access hardware without your having to know how all the various types of hardware function. As one of its many func- tions, the operating systems controls virtual memory. Virtual memory is hard disk space that is used when RAM is full. Details of virtual memory activity are stored in system files. For example, if you have several applications running and you're instant messaging someone, that exchange may be stored on the hard disk without your knowing it simply because there wasn't room for it in RAM.

The registry on your computer is a multidimensional database structure that is part of the operating system. Registry files contain a wealth of information including pref- erences for users of the system, settings for the hardware, system software, installed programs, and a list of all the USB devices that were ever attached to the system. Even if you uninstall a program, remnants of the install process remain in the registry file. Thus, if someone uses a wiping program like CCleaner that clears out artifact areas and unallocated space, and then uninstalls the program, the fact that it was once installed is still accessible. Windows keeps track of programs that were run on the computer in its UserAssist Key 'registry file. With a freeware program like UserAssist you can display these entries along with last execution date and time.

Unallocated Disk Space If your hard disk gets a lot of use, it's probable that each sector has had information put onto it many times. The operating system is always mov- ing files around, and if you changed a Word file and resaved it, the previous version is marked as deleted and the space becomes unallocated. Unallocated space is the set of clusters that have been marked as available to store information, but have not yet received a file or files. Unallocated space may still contain some or all of a file marked as deleted. Until the new information takes up residence, the old information remains. The bigger the hard disk, the longer it usually takes for old space to be used.

Unused Disk Space Unused space results from rearranging disk space. For example, when a hard drive is repartitioned , the new partitioning may not use all the space on the hard disk. So, again, those unused portions are not overwritten. The partition table and other operating system information are stored on their own tracks and are not visible under normal circumstances, but may have once stored a Word document. To be able to see the fragments of files tucked away in these tracks you need forensic software.

Digital Forensics 457

458 Extended Learning Module H

Erased Information By now you may be asking whether it's possible to completely erase information from a storage medium. It is possible, but you need to know what you're doing. You can get disk-wiping programs that erase information from a disk by writing nonsense information over the previous contents. However, wiping a disk takes many hours. Even then you're not necessarily safe, for three reasons:

• A single overwrite may not erase the information completely. It must usually be written over multiple times. Government agencies have specific policies in place as to how many wipes are required.

• Some programs keep track of what was deleted and by whom, and that record is viewable if you know where to look.

• Disk-wiping programs vary greatly in which parts of the hard disk they clean. For most of them, you have to change the settings to reach certain parts of the disk. Some claim to go through the wipe process multiple times but that still doesn't erase the areas that the software isn't set to erase. Also keep in mind that if people are trying to erase information because of some illicit activity, traces may still he left of the information they're trying to discard , and unless they're very careful, they'll leave traces of their attempts to wipe the disk. At the very least, they'll most likely leave a record in the Registry that they installed the wiping program.

ANALYTICS IN FORENSICS

So far we've been concentrating on the mechanics of what's on information devices such as computers, smartphones, etc. But there's a very important movement in digital forensics toward forensics analytics. You read a lot about analytics in Chapters 3 and 4 and here you will see another example of where those same methods are applicable.

Most of the fraud, and certainly the high-dollar fraud, in the corporate world is per- petrated by insiders. It's estimated that about two-thirds of the fraud that is uncovered comes to light by means of a tip or by accident. The internal auditor or fraud investigative community is always looking for ways to detect and even predict fraud. About 80 percent of communications within organizations is unstructured as in e-mail, documents, pre- sentations, Web content, text messages, chat sessions, calendar entries, and so on.

The Fraud Triangle, as proposed by Dr. Donald Cressey in the 1950s, is useful for getting a handle on the most likely culprits. Fraud Triangle Analytics can be helpful in predicting who in the company is more likely to commit fraud as well as in finding the fraud and the culprits. The Fraud Triangle as shown in Figure H. l 0 is used in analyzing the e-mail content of employees. 12 The Fraud Triangle incorporates three scores: the 0-Score which is a measure of the opportunity available to an employee; the P-Score which assigns a numeric value to the incentive or pressure an employee might be under; and the R-Score which represents the employee's level of rationalization. The ACFE (Association of Certified Fraud Examiners) and Ernst and Young have put together thousands of keywords that correspond to each of these three points in the triangle and they have found that these keywords start appearing in e-mails when fraud is being con- templated or planned and that the words correlate to the presence of the three pressure points. Some of these words are shown in Figure H.11.

The analysis of perhaps millions of e-mails allows investigators to narrow down the field of people likely to commit fraud, and then the exploration can concentrate on a small number of probable suspects. The presence of high 0-, P-, and R-Scores does not necessarily mean that fraud has been committed or that the person with the high scores is a perpetrator, but it gives examiners a way of approaching massive amounts of unstructured data. The traditional controls that are in place concentrate on structured accounting documents and there are far fewer of those.

Key Words • Override • Write-off • Recongnize revenue

Key Wo rds • Meet the deadlin e • M ake sales quota • Under the gun

R Score

Key Wo rd s • I th ink it's OK • Sou nd s

reason abl e •I deserve it

E-mails and other communications can be analyzed with text analytics that can answer questions such as who is talking to whom (social networks analytics); what they are saying (semantic analytics) ; and the time period during which the communications take place (time series analysis).

All investigations, whether criminal or civil, include a survey of social networking sites and other publically available sources. For example, suppose someone is suing a grocery store claiming that they got hurt in a fall and can' t work because of the injury. Investigators might look on that person' s Facebook p age and if there' s a recent photo there of the person waterskiing that would be pretty good evidence that the injury was not as bad as reported.

Modern computer forensics goes a step beyond that and includes semantic analysis of all available information structured and unstructured. Businesses investigating fraud would use three approaches: computer forensics , foren sic accounting, and analytics.

lngenium is software that does latent semantic analysis , also known as concept search- ing. This m~ans that it can search for your meaning rather than just terms that match exactly. For example, if you type in " house" as a search term, the software will search for

Opportunity Incentive/Pressure Rationalization

Correct Problem Deserve

Conditional Clarify Owe me

Discount Revise Get back

Miscount Sorry Figure out

Override Meet the deadline/quota Sounds reasonable

Special fees Don't leave a trail Don't get paid enough

Side commission Only a timing difference Company can afford it

Digital Forensics 4 59

Figure H.10 Fraud Trian g le Analyt ics

Figure H.11 Keywords Compiled by Ernst & Young an d the Association of Certified Fraud Examiners

4 60 Extended Learning Module H

Figure H.12 Modern Computer Fo rensics Involves More than Just What 's on the Hard Disk

= LEARNING O~TCOME 4

·Digital Forensics

• Analysis of social networking

Foren sic A cc ounti ng

•Pred ict ive Analyt ics/Fraud T ri ang le

•Pub li c so urces of information

·Semantic ana lys is

cottage, hut, domicile , home , property, estate, holdings , manor, housing, mansion, cabin, bungalow, chalet, lodge, residence, dwelling, abode, residence , habitat, apartment, etc. It uses a neural network to find other terms that are close in meaning to your search term. You can learn more about neural networks in Chapter 4, Analytics, Decision Support, and Artificial Intelligence .

Other more mundane analysis methods can still be very revealing. Examining lists of mail drops like at Mailboxes Etc. , P.O. Boxes , and FedEx Kinkos and matching those to a list of vendors could be useful in a case where goods have been disappearing from a warehouse. Comparing Social Security numbers (SSN) with those on the death index or searching for an SSN that is not consistent with the Social Security Administration's method of assigning numbers where there' s a state code, a region code, and a date- related number may indicate a fraudulent identity.

All these methods together- computer and cell phone examination, social network- ing site analysis , public information sources, semantic analysis, predictive analytics iden- tifying high risk employees-help digital forensics investigators build a story of how fraud was conceived and perpetrated and who the people were who engaged in it (see diagram in Figure H.12).

ANTI-FORENSICS

Because of high-profile digital forensics cases, people nowadays understand more about how data is stored on computer storage media and how it can be accessed by forensic software. As a result, a new branch of the digital forensics industry is growing fast-the anti-forensics industry. Some of the tools now available that make it hard or impossible to trace user activity or access the data in files were not specifically intended to defeat law enforcement probes; rather they are there mainly to help computer owners to protect themselves and their data. For example, encryption is a very good way to protect the data on your notebook computer so that if it's stolen, the thief can' t get the data. Another is keeping deleted files out of the Recycle Bin, so that someone can't recover your files easily. Others, however, products with names such as EvidenceEiminator, are clearly intended to keep the bad guys from getting caught.

Anti-forensic tools fall into three categories:

1. Configuration settings-included in your operating system, browser, and applications like Word and Excel.

2. Third-party tools-utility software on the market that performs specific tasks.

3. Forensic defeating software developed to remove or change the sort of data that forensics experts look for.

CONFIGURATION SETTINGS This category includes the Shift + Delete option that you can use instead of simple Delete so that the file is not listed in the Recycle Bin. However, if you use this bypass option you still leave a special signature that digital forensics experts can find. In Windows there are several options that mask user activity, like renaming the file with a different extension. This is probably the simplest, and most easily detected, way of deliberately hiding a file. Say you had an Excel file that had cal- culations you didn't want anyone to know about. You could name the file Space Needle. jpg. It would then appear in Windows Explorer in the list of files as an image file , with the name implying that it's just a vacation photo or something else equally innocuous. If you click on that file , Windows will try to load it with the default jpg viewer, and of course, it won't load. What digital forensic experts usually do is load the file into a program that accommodates many file formats. This way, you save a lot of time trying to load the renamed file into lots of different types of software. Even more helpful is having a forensic tools like EnCase that actually flag files with extensions that don' t match the contents and also show files in their true formats.

Another thing you can do would be to use the option that clears out virtual memory so that any RAM data that was temporarily stored on the hard disk for use by the proces- sor is removed when the system no longer needs it. Enabling this option, however, will make your system shutdown much slower. The Defrag option rearranges data on your hard disk and overwrites deleted files . Disk Cleanup, listed as an option in the Properties of the C:\drive, lets you delete ActiveX controls and Java applets (little blocks of code that generate Web page content) that you downloaded automatically and without real- izing it from Web sites you visit.

Internet Explorer has similar features like the option to clear temporary Internet files when you close the browser. Another one is the option to clear the history file so that your Internet' surfing activity is not easy to find.

When creating a Word or Excel file , you could use a very small font or make the characters the same color as the background. Plug-ins are available for Word to remove hidden data and to redact a document. Redacting means blacking out portions of the document, usually to protect confidential information, so that it cannot be recovered later. The redacted portion of the document has black bars covering the selected text and the text is no longer there.

Office lets you password protect files so that when someone tries to open the file a pop-up window asks for the password. Unless you know the password, you won't be able to read the file. Forensic software can sometimes view the contents of a file with- out opening the file , eliminating the effectiveness of many types of password protection. And of course there are very effective third-party password cracking programs available, although not as part of the operating system.

THIRD-PARTY TOOLS There are lots of these utility programs. For example, there are some that alter your registry-the file that logs installations of hardware and soft- ware. Another type hides Excel files inside Word documents and vice versa. This does not protect files from an experienced examiner. Others change the file properties in

Digital Forensics 461

462 Extended Learning Module H

Figure H.13 Steganography Hides a File in an Image

...

Windows like the creation date or the extension. Still another type can split files, pass- word protecting and encrypting parts of the file or storing parts in different places on the storage medium.

Probably the best known type of third-party tools are the wiping programs that over- write the disk, effectively obliterating the information that was there before. They work well enough to clean a hard disk that you may be giving away to someone, but, depend- ing on the actual software, there may be lots of fragments that digital forensics experts can still recover.

There are lots of encryption programs available that protect files so that even if some- one manages to get them, it won't be any good because they're not readable without the decryption key. Encryption scrambles the contents of a file so that you can't read it without the right decryption key. Often investigators can find the decryption key in a password file or on a bit of paper somewhere around the keyboard. Password cracking programs can find passwords very easily (alarmingly easily, in fact). They have dictionar- ies of words from multiple languages, so whole words from any widely used language are not hard to crack. Some people put a digit or two on the front or back of a word. That doesn't fool password-cracking programs at all. '

Using images to hide data is another way of protecting information. This is called steganography. Steganography (see Figure H.13) is the hiding of information inside other information. Paper money is a good example of steganography. If you hold a dol- lar bill up to the light you'll see a watermark. The watermark image is hidden inside the other markings on the bill, but it can be seen if you know what to do to see it.

A very useful tool, but a hardware/software combination this time, is a U3 Smart drive which looks like and is a USB flash drive, but it stores and can launch and run software on any computer. You can have all the software and files you need on the U3

You can't see the parts of the picture that were changed to encode the hidden message. You'll on ly be able to access the hidden fi le when you put the r ight password into a pop-up w indow.

Who Needs Digital Forensics Investigators? 463

and plug it into any computer, and it can take over computer resources like the CPU, screen, and keyboard-nothing gets stored on the hard disk of the computer you're using, and you can have all your own programs-even your own wallpaper- on the screen. All cache, cookie items go to the U3 and it runs it own programs. This works because it appears to your computer to be a CD and so Windows AutoPlay feature auto- matically runs the U3 LaunchPad which is the U3's own user interface. It works very similarly to the Windows interface. You can get a large range of software for a U3 device.

One of the most effective ways to evade detection for someone who is doing some- thing illicit like accessing child pornography is to use a U3 Smart device since it can be plugged into virtually any computer and leaves no trace of the user or the user's activity. Other methods are detailed below.

FORENSIC DEFEATING SOFTWARE In addition to the utilities that could arguably be acquired for personal privacy or protection purposes, there is software that makes no secret of its purpose to fool investigators. One type removes residual data- data left when files are deleted and the space is partially overwritten. Other software is designed to erase cache memory, cookies, Internet files, Google search history, and so forth. Some programs are aimed at specific forensic software. EnCase is the usual target because of its standing as the most popular and most accepted software in the industry. Of course, if you're doing something illegal and there are records of it on your computer, for example, if you're keeping track of drug dealing, you could also use any or all of the tools provided by Windows or the utilities supplied by third parties.

Even given all these tools and more, it's not as easy as it may sound to hide your activ- ity on a computer. First, not all programs function as advertised, or as fully as promised. Second, very few people have the knowledge and skill to completely hide their tracks. Third, the installation of third-party utilities or forensic defeating software or even oper- ating system settings can be detected and can indicate intent to hide something.

A final note on the use of software to evade detection by law enforcement: If you find yourself in litigation and use such tools to get rid of information you believe may be incriminating and then claim that it was never there, you might be in for a rude awak- ening. The law says that "any product used to circumvent discovery" may be taken as consciousness of guilt. Even though the documents are not available, during the court hearing the inference may be made that you had them and that, by destroying them, you have showra yourself to be guilty. So, being able to determine that such tools have been used is almost as good as finding the evidence itself. This line of reasoning has often been used in cases of illegal distribution of movies and music.

-[ Who Needs Digital Forensics Investigators?l

Digital forensics is widely used wherever and whenever the investigation of electroni- cally stored files is warranted, such as:

• In the military, both as part of national security intelligence gathering and analysis and for internal investigations of military personnel.

• In law enforcement, when the FBI, state investigatory agencies, and local police departments need to gather electronic evidence for criminal investigations.

• Inside corporations or not-for-profit organizations, when conducting internal audits, for example, or investigating internal incidents.

• In consulting firms that specialize in providing digital forensic services to corporations and law enforcement.

I LEARNING OUTCOME 5

464 Ext ended Learning Mo dule H

Figure H.14 Professiona l Orga nizations and Standa rds

Digital forensics experts work both proactively, educating and warning people about possible problems, and reactively, when they're called in to help in response to an inci- dent. The need for such expertise is growing, especially considering that it is estimated that 93 percent of all information is generated in digital form. Since computing and investigative techniques are improving continuously, digital forensics experts need a forum to exchange ideas and information (see Figure H.14).

PROACTIVE DIGITAL FORENSICS EDUCATION FOR PROBLEM PREVENTION

Companies are increasingly providing proactive education for two reasons: first, to edu- cate employees on what to do and not to do with computer resources and why; and second, to teach employees what to do if they suspect wrongdoing, and how not to make things worse by destroying evidence.

People who use computers every day are often not very knowledgeable about what, when, and how information is stored on computers. For example', many corporations have strict policies on how long e-mails will be kept on the system (or in the form of backups). Usually the period of time is about 60 days. You might decide to save your e-mails on your hard disk so that you'll have them indefinitely. This might not be wise since the reason that companies have this policy is that should the company find itself involved in litigation, all electronic information, including e-mail, may be discoverable. That is , the company may have to hand it over to opposing counsel. The more there is, the more it costs to collect, organize, and deliver it.

The second reason for providing some education in computer forensics has to do with conducting internal investigations properly. Say a company wants to file a com- plaint with law enforcement about the suspected illegal activity of an employee. Before law enforcement can look into the situation, however, it needs to have sufficient cause to

Professional organizations exist that support digital forensic experts in doing their jobs . The organizations below provide interaction between members who share information, experience, and methods. Such organizations also provide ethical guidelines and certification.

• IACIS (International Association of Computer Investigation Specialists) is open to law enforcement personnel and sets standards and guidelines for computer forensic investigations.

• ACFE (Association of Certified Fraud Examiners) focuses on serving those who investigate fraud. Members include people in law enforcement, auditors, accountants, and digital forensic experts.

•The HTCIA (High Technology Crime Investigation Association) is open to law enforcement and corporate investigators alike and facilitates the sharing of resources among its members.

A group called the Sedona Conference Working Group on Electronic Document Production published The Sedona Principles: Best Practices, Recommendations & Principles for Addressing Electronic Document Production. The document, the first draft of which emerged in 2003, is a new set of standards pertaining to properly conducting a digital forensic investigation. These principles were developed by lawyers, consultants, academics, and jurists to address the many issues involved in antitrust suits, intellectual property disputes, and other types of complex litigation.

Who Needs Digital Forensics Investigators? 465

do so. It can happen that in collecting relevant information the company inadvertently contaminates or destroys the "crime scene." The result may be that law enforcement can't prosecute after all because oflack of evidence.

REACTIVE DIGITAL FORENSICS FOR INCIDENT RESPONSE

Companies need digital forensics, in a reactive mode, to track what employees have been doing with company resources. You saw in Chapter 8 that employees may be using the Internet to such an extent during working hours that their productivity is affected, and the level of personal traffic on the company network may be such that people who are actually working are slowed down. This is just one example of misuse of the company computer system. The evidence of such misappropriation of computer resources can be found on the system itself-on individual client computers and on the servers.

A second reason for reactive digital forensics is changes in laws and government regulations and new laws passed as a consequence of recent corporate crime and mis- behavior, probably the most important being the Sarbanes-Oxley Act of 2002, signed into law by President Bush. Known as "Sarbanes-Oxley," the law requires companies to (1) implement extensive and detailed policies to prevent illegal activity within the com- pany and (2) respond in a timely manner to investigate illegal activity.

The act expressly states that executives must certify that their financial statements are accurate. They will be held criminally liable for fraudulent reporting, removing the insulation that executives previously had of being able to say that they didn't know about misstatements. Sarbanes-Oxley also specifically requires publicly traded companies to provide anonymous hotlines so that employees and others can report suspicious activity.

The provision that suspicious activity must be investigated in a timely manner in many instances automatically requires digital forensics. In earlier litigation, courts have determined that computer-stored evidence is crucial to the proper investigation of alleged corporate fraud. Add to that the fact that delay in investigating alleged wrongdo- ing meets with severe penalties and that courts impose severe sanctions on those judged guilty of destroying evidence including electronic information.

A DAY IN THE LIFE

The career of a digital forensics expert can be very rewarding and satisfying. But it can also mean spending long hours carefully poring over the contents of hundreds of files looking for the clue that will unravel the mystery and show what actually happened. It also means being able to explain to lawyers,judges,juries and other noncomputer people what the evidence is and what it means. You also need to be able to keep your cool since "dispute resolution" usually means someone is aggrieved or scared and such feelings are often expressed as anger. People can even turn violent during an investigation-some have gone as far as rigging their computers with explosives to thwart an investigation.

Lanny Morrow is a digital forensics and data mining expert with the Forensics and Valuation Services division of BKD, LLP, one of the largest accounting firms in the United States. He's an experienced forensics expert who has all the abilities necessary to succeed as an investigator along with years of experience. He has solved many cases while working with a list of clients that includes for-profit and nonprofit organizations; litigants in civil suits; and defendants and plaintiffs in criminal proceedings. Following are two examples from his case files.

The first involves MySpace. A high-school girl posted on MySpace her account of her own molestation by her father. Her shocked friends told their parents about her plight and the parents alerted the authorities , who initiated an investigation. The girl's

466 Extended Learning Module H

...

parents were deeply distressed and vigorously disputed the claim. They cooperated fully in the investigation, handing over family computers and cell phones to Lanny who began the process of finding the truth.

• He found multiple drafts of the text that the girl posted on MySpace describing the incident. The date stamps showed that they had been created before the rape was alleged to have taken place.

• Further examination revealed e-mails and chat logs where the girl expressed resentment at being grounded by her parents for attending a party without permission. In her communications, the girl stated her intention and explained her plan to get even.

• Lastly, Lanny found cell phone text messages and e-mails from her friends offering pledges to corroborate her story along with suggestions of details to include in the fictitious report.

As often happens, when presented with the overwhelming evidence of her lies, the girl admitted that she had made up the whole story to get revenge on her parents. She then had to explain to her teachers and peers what she had done ~nd why. The friends who were co-conspirators in the plan were also identified and had some explaining of their own to do.

The second case involved three employees who filed a civil case against their former employer alleging wrongful termination. They had been fired on the basis of inadequate performance in their jobs and when company exec;:utives were notified of the lawsuit they hired Lanny to see ifhe could find evidence that the employees' performance on the job was inadequate and the termination was , therefore, justified. Since the employees' jobs all involved heavy use of the company's computer system, Lanny and his team went to work right away and what they found was very revealing

• They used En Case's Timeline feature to generate a profile of computer usage by each of the employees. This report shows, down to the second, when a computer was being used and what it was being used to do. The analysis showed large gaps during working hours indicating that the employees had taken extended breaks.

• Furthermore, they found files that revealed that one of the employees was using the company' s time and resources to run her own business on the side. It was later established that she had taken office supplies home for her private use.

• An analysis of the activity on the computer of another one of the complainants established that she had spent up to three hours a day, during business hours, surfing the Net, often participating in eBay auctions, and had routinely spent all morning e-mailing her friends and family.

• The third employee spent a large portion of his work time gambling online.

All in all, over an extended period, the three employees had spent only about one- third of their working hours doing what they were being paid to do. To cover their tracks they delegated their tasks to other employees who believed that this was standard oper- ating procedure. After the investigation was over the office managers were also fired for allowing such conduct and because it came to light during the investigation that one of them had been having an affair with one of the fi red employees. Examination of the man- ager's own computer confirmed the relationship .

Summary: Student Learning Outcomes Revisited 467

SUMMARY: STUDENT LEARNING OUTCOMES REVISITED

1. Define computer crime and list three types of computer crime that can he perpetrated from inside and three from outside the organization. Computer crime is a crime in which a computer, or computers, played a significant part in its commission. Crimes perpetrated outside the organization include

• Computer viruses

• Denial-of-service (DoS) attacks

• Malware bots

• Web defacing

• Trojan-horse virus

Crimes perpetrated inside the organization include

• Fraud

• Embezzlement

• Harassment

2. Identify the seven types of hackers and explain what motivates each group. Hackers are knowledgeable computer users who use their knowledge to invade other people's computers. The seven types are

• Thrill-seeker hackers, who are motivated by the entertainment value of breaking into computers

• White-hat hackers, who are hired by a company to find the vulnerabilities in its network

• Black-hat hackers, who are cyber vandals and cause damage for fun

• Crackers, who are hackers for hire and are the people who engage in electronic corporate espionage

• Hac.ktivists, who are politically motivated hackers who use the Internet to send a political message of some kind

• Cyberterrorists, who seek to cause harm to people or destroy critical systems or information for political reasons

• Script kiddies or script bunnies, who would like to be hackers but don't have much technical expertise

3. Define digital forensics and describe the two phases of a forensic investigation. Digital forensics is the collection, authentication, preservation, and examination of electronic information for presentation in court. Electronic evidence can be found on any type of computer storage medium. A computer forensic investigation has two phases: (I) collecting, authenticating, and preserving electronic evidence; and (2) analyzing the findings. The collection phase consis ts of

• Getting physical access to the computer and any other items that might be helpful

• Creating a forensic image copy of all storage media

468 Extended Learning Module H

• Authenticating the forensic image copy by generating an MD5 hash value, that, when recalculated at a later date will be exactly the same number, as long as nothing at all on the storage medium has changed in any way

• Using forensic hardware that can read storage media but cannot write to them

• Using forensic software that can find deleted, hidden, and otherwise hard-to- access information

The analysis phase consists of

• Finding all the information and deducing what it means

• Assembling a crime story that fits the information that has been discovered

4. Describe what is meant by anti-forensics and give an example of each of the three types. Anti-forensics is a name for tools that mask or eliminate traces of user activity on a computer. The three types are:

1. Configuration settings-included in your operating system, b\owser, and applications like Word and Excel. An example is Shift + Delete to bypass the Recycle Bin.

2. Third-party tools-utility software on the market that performs specific tasks. An example is encryption software.

3 . Forensic defeating software developed to remove or change the sort of data that forensics experts look for. An example is software that changes creation and access dates on files .

5. Describe two ways in which businesses use digital forensics. Corporations use computer forensics for proactive education and for reactive incident response. Education serves to explain to employees what they should and should not do with computer resources and also how to conduct an internal computer forensic investigation. Incident response involves uncovering employee wrongdoing and preserving the evidence so that action can be taken.

- --· KEY TERMS AND CONCEPTS

Black-hat hacker, 446 Bot, 443 Botnet, 439 Computer crime, 438 Computer virus "fvirus), 439 Cracker, 447 Cyberterrorist, 447 Cyber war, 446 Denial-of-service (DoS) attack, 443 Digital forensics, 449 Distributed denial-of-service (DDoS) attack, 443 Drone, 444 Encryption, 462 Forensic image copy, 451 Hacker, 446 Hacktivist, 447 Key logger (key trapper) software, 442 Live analysis, 454

Malware, 439 Malware bot, 444 MD5 hash value, 452,468 Redacting, 461 Rootkit, 445 Script bunny (script kiddie), 447 Slack space, 457 Social engineering, 447 Spoofing, 441 Steganography, 462 Thrill-seeker hacker, 446 Trojan horse virus, 442 U3 Smart drive, 462 Unallocated space, 453, 457 White-hat hacker (ethical hacker), 446 Worm, 439 Zombie, 439, 444

SHORT-ANSWER QUESTIONS

1. In what two ways are computers used in the commission of crimes or misdeeds?

2. What constitutes a computer crime?

3. What kind of software is a computer virus?

4. How does a denial-of-service attack work?

5. What is the effect of a virus hoax?

6. What is the difference between the Klez family

of viruses and previous worms?

ASSIGNMENTS AND EXERCISES

1. FIND DIGITAL FORENSICS SOFTWARE On the

Web there are many sites that offer digital

forensics software. Find five such software

packages and for each one answer the

following questions:

• What does the software do? List five features it

advertises.

• Is the software free? If not, how much does it

cost?

• Is there any indication of the software's

target market? If so, what market is it (law

enforcement, home use, or something else)?

2. WHAT EXACTLY ARE THE SEDONA PRINCI PLES?

Figure H.14 mentioned the Sedona Principles.

These 14 principles were developed by lawyers,

consultants, academics, and jurists to address

the many issues involved in antitrust suits,

intellectual property disputes, and other types

of complex litigation.

Write a report on the stipulations of the

Sedona Principles. Do some research and find

out exactly what the Sedona Principles suggest.

Here's the first one to get you started:

1. Electronic data and documents are

potentially discoverable under Fed.R. Civ. P.

34 or its state law equivalents. Organizations

must properly preserve electronic data

and documents that can reasonably be

anticipated to be relevant to litigation.

Be sure to explain in your paper any legal

terms, such as "discoverable," which appears

Assignments and Exercises 469

7. What is a white-hat hacker?

8. What do crackers do?

9. Is there a difference between a cyberterrorist

and a hacktivist? If so, what is it?

10. What is digital forensics?

11. What is anti-forensics?

12. What is live analysis?

in the 1st principle above, and "spoliation," in

the 14th principle.

3. THE INTERNATIONAL ANTl-CYBERCRIME

TREATY Find out what the provisions of the

international anti-cybercrime treaty are and

how they will affect the United States. One of

the concerns that will have to be addressed

is the issue of whether laws of one country

should apply to all. For example, if certain

sites are illegal in Saudi Arabia, should they

be illegal for all surfers? Or if Germany has a

law about hate language, should a German or

a U.S. citizen be extradited to stand trial for

building a neo-Nazi Web site? What do you

think?

4. DOES THE FOURTH AMENDMENT APPLY

TO COMPUTER SEARCH AND SEIZURE?

The U.S. Department of Justice's Computer

Crime and Intellectual Property Section has

an online manual to guide digital forensics

experts through the legal requirements

of the search and seizure of electronic

information. It's available at www.cybercrime.

gov/searchmanual.htm and has a section on

"Reasonable Expectation of Privacy." There

are four subsections: general principles,

reasonable expectation of privacy in

computers as storage devices, reasonable

expectation of privacy and third-party

possession, and private searches. Read

and summarize these four subsections.