1 •Forensics: •The use of science and technology to investigate and establish facts in criminal or civil courts of law. •Computer Forensics: • Commonly defined as the collection, preservation, analysis and court presentation of computer related evidence. •Gathering and analyzing data in a manner as free from distortion or bias as possible to reconstruct data or what has happened in the What is Computer Forensics?
30
Embed
1 Forensics: The use of science and technology to investigate and establish facts in criminal or civil courts of law. Computer Forensics: Commonly defined.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
1
•Forensics: • The use of science and technology to
investigate and establish facts in criminal or civil courts of law.
•Computer Forensics: • Commonly defined as the collection,
preservation, analysis and court presentation of computer related evidence.
• Gathering and analyzing data in a manner as free from distortion or bias as possible to reconstruct data or what has happened in the past on a computer system.
What is Computer Forensics?
2
•Understand what happenedo Proper acquisition and preservation of computer
evidence.o Authentication of collected Data for court Presentationo Recovery of all available data, including delete fileso Prevention of future incidents
Often similar problems to Audit But audit trail may be inadequate! o Audit information incomplete/insufficiento Audit trail damagedo We don’t own the computer
What is Computer Forensics?
3
What is the Challenge?
• Audit information incomplete/erased o Reconstruct deleted information
• “Acceptable” state of system unknown o Need to identify violation in spite of this
• Goal not obvious Goal not obviouso Transformations may have been applied to data
• Strong burden of proof Strong burden of proofo Not enough to know what happenedo Must be able to prove it
4
FBI List of Computer Forensic Services
• Content (what type of data) • Comparison (against known data) • Transaction (sequence) • Extraction (of data)• Deleted Data Files (recovery) • Format Conversion • Keyword Searching • Password (decryption) • Limited Source Code (analysis or compare) • Storage Media (many types)
5
The Coroner’s Toolkit (TCT) Overview
• Collections of tools to assist in a forensic examination of a computer (primarily designed for Unix systems)
• mactimes - report on times of files• ils - list inode info (usually removed files) • icat - copies files by inode number• unrm - copies unallocated data blocks• lazarus - create structure from unstructured data• file - determine file type• pcat - copy process memory• grave-robber - captures forensic data
6
mactime
• mactime is shorthand reference to the three time attributes - mtime, atime, and ctimeo atime - time of last accesso mtime - time of last modificationo ctime - time of last status change of
inodeo dtime - time of deletion (Linux only)
• Examples Examples# mactime -m /var/adm
7
ils
• ils lists inode information of removed files. • Can be used to identify deleted files for possible
attempt to undelete with possible attempt to undelete with icat.
• Specify a device file which contains a file system.
• Exampleils /dev/hdb1
8
Unix file
9
Icat, file
• icat copies files by copies files by inode number from a device which contains a file system
• Can be used to recover a deleted fileExample
icat /dev/hdb1 17
• file – determine file type• Similar to UNIX System V file command, but
may generate better indication of file type
10
unrm
• unrm – copies unallocated data blockso Used to copy unallocated blocks to an output
file in order to be processed by lazarus.Example# unrm /dev/hdb1 > /tmp/unrm.of.hdb1
• lazarus – attempts to make sense out of raw data blocksExample
# lazarus /tmp/unrm.of.hdb1
11
pcat
• pcat – copies process memoryoThis is used to try to understand what a program is (doing), especially when the executable file has been deleted.
• Modern UNIX systems have a /proc filesystem that makes process information available in a convenient manner, including the executable file, current directory, and process memory.
12
grave-robber
• grave-robber captures system forensic datao Runs many of TCT tools under the covers
• Three types of optionso general options
where output goes, verbosity, etc
o micro optionsfiner control over what data is collected
o macro optionsputs micro data collection into logical groups
13
Law Enforcement Challenges
• Many findings will not be evaluated to be worthy of presentation as evidence
• Many findings will need to withstand rigorous examination by another expert witness
• The evaluator of evidence may be expected to defend their methods of handling the evidence being presented.
14
Broader Picture: What to Do
•do not start looking through files
•start a journal with the date and time, keep detailed notes
•unplug the system from the network if possible
•do not back the system up with dump or other backup utilities
•if possible without rebooting, make byte by byte copies of the physical disk
•capture network info
•capture process listings and open files
•capture configuration information to disk and notes
•collate mail, DNS and other network service logs to support host data
•capture exhaustive external TCP and UDP port scans of the host
•contact security department or CERT/management/police or FBI
•if possible freeze the system such that the current memory, swap files, and even CPU registers are saved documented
•short-term storage
•packaging/labeling
•Shipping
15
Risk management
16
Likelihood Vs. Consequence
17
– A countermeasure is an action, device, procedure, or technique used to eliminate or reduce one or more vulnerabilities.
COUNTERMEASURE
18
– Procedures:• security policies and procedures• training• personnel transfer
– Hardware:• doors, window bars, fences• paper shredder• alarms, badges
– Manpower:• guard force
Examples of Countermeasures
19
– A consequence is that which logically or naturally follows an action or condition.
CONSEQUENCE
20
– “The worse the consequence of a threat harming the system, the greater the risk”
– determine:• the threat• the vulnerability• the likelihood of attack• the consequence of an attack
– apply this formula by: • postulating attacks• estimating the likelihood of a successful attack• evaluating the consequences of those successful
attacks
Risk Calculation Process
22
– Developed in the NSA Information Systems Security Organization (ISSO)
– Used for INFOSEC Products and Systems– Can Use During Entire life Cycle– Not Widely Used Outside of the ISSO
NSA ISSO Risk Assessment Methodology
23
– Understanding the system– Developing attack scenarios– Understanding the severity of the
consequences– Creating a risk plane– Generating a report
The NSA ISSO Risk Assessment Process
24
The Risk Plane
Source: Courtesy of Professors Chris Clifton & Matt Bishop
25
Risk Index• Risk Index, as defined by the “Yellow
Book”, is the disparity between the minimum clearance or authorization of system users and the maximum sensitivity of data processed by a system– Minimum User Clearance=Rmin– Maximum Data Sensitivity=Rmax– Risk Index=Rmax – Rmin
• Risk index is between O and 7
26
Rating Scale for Minimum User Clearance (Rmin)
MINIMUM USER CLEARANCE RATING(Rmin)
Uncleared (U) 0Not Cleared but Authorized Access to Sensitive UnclassifiedInformation (N)
1
Confidential (C) 2Secret (S) 3Top Secret (TS)/Current Background Investigation (BI) 4Top Secret (TS)/Current Special Background Investigation(SBI)
5
One Category (1C) 6Multiple Categories (MC) 7
27
Rating Scale for Maximum Data Sensitivity (Rmax)
Maximum DataSensitivity RatingsWithout Categories
Rating(Rmax)
Maximum Data Sensitivity With Categories Rating(Rmax)
Unclassified (U) 0 N/ANot Classified But
Sensitive1 Unclassified but Sensitive With One or More
Categories2
Confidential (C) 2 Confidential With One or More Categories 3Secret (S) 3 Secret With No More Than One Category
Containing Secret Data
Secret With Two or More CategoriesContaining Secret Data
4
5Top Secret (TS) 5 Top Secret With One or More Categories
With No More Than one CategoryContaining Secret or Top Secret Data
Top Secret With Two or More CategoriesContaining Secret or Top Secret Data
6
7
28
* = Security Requirements Beyond State of the Art
Computer Security Requirements
RISKINDEX
MODE MINIMUM CRITERIA FOROPEN ENVIRONMENTS
MINIMUM CRITERIA FORCLOSED ENVIRONMENTS
0 Dedicated None None0 System High C2 C21 Compartmented