Top Banner
Employee Data Theft Case Study Jonathan Grier ACSAC 2011
34

Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Apr 11, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Employee Data Theft

Case Study

Jonathan Grier

ACSAC 2011

Page 2: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Concerning

Confidentiality

To preserve client confidentiality, this

case’s circumstantial information

(names, places, dates, and settings) has

been omitted or altered.

The data and techniques presented

have not been altered.

Page 3: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Can you find the data thief?

Page 4: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Harlan Carvey, Windows Forensic Analysis, 2009

Page 5: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Harlan Carvey, Windows Forensic Analysis, 2009

No Artifacts = No Forensics

Page 6: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Harlan Carvey, Windows Forensic Analysis, 2009

No Artifacts = No Forensics ???

Page 7: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.
Page 8: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Access timestamps updates during:

Routine access

Page 9: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.
Page 10: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Access timestamps updates during:

Copying a folder Routine access

Page 11: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Copying Folders Routine Access

Nonselective All subfolders and files accessed

Selective

Temporally continuous Temporally irregular

Recursive Random order

Directory accessed

before its files

Files can be accessed

without directory

Page 12: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

COPIED NOT COPIED

Page 13: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

“slap-your-head-and-say-'doh-wish-I'd-thought-of-

that’” -- an anonymous colleague

No Artifacts Yes Forensics

Page 14: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Not so fast...

1. Timestamps are overwritten very

quickly

2. There are other nonselective,

recursive . activities (besides

copying)

Page 15: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Not so fast...

1. Timestamps are overwritten very

quickly Can we use this method months

later?

On a heavily used system?

Won’t most of the timestamps have

been overwritten?

Page 16: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Not so fast...

1. Timestamps are overwritten very

quickly Can we use this method months

later?

On a heavily used system?

Won’t most of the timestamps have

been overwritten?

YES!

YES!

Not

really!

Page 17: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Two observations:

1. Timestamps values can increase,

but never decrease.

2. A lot of files just collect dust.

Most activity is on a minority of files.

Page 18: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Farmer & Venema, Forensic Discovery, 2005

Page 19: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

At tcopying:

• All files have access_timestamp = tcopying

Page 20: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

At tcopying:

• All files have access_timestamp = tcopying

Several weeks later:

• All files have access_timestamp ≥ tcopying

Page 21: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

At tcopying:

• All files have access_timestamp = tcopying

Several weeks later:

• All files have access_timestamp ≥ tcopying

• Many files still have access_timestamp =

tcopying

Page 22: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

After 300 days of simulated activity

Histogram of access timestamps

Page 23: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Data from investigation:

Jonathan Grier, Detecting Data Theft Using Stochastic Forensics, J. Digital Investigation 2011

Page 24: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.
Page 25: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Copying creates a

cutoff cluster

cutoff – No file has timestamp < tcluster

cluster – Many files have timestamp = tcluster

Page 26: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Aren’t there other recursive access patterns besides

copying?

Affirming the

consequent A ⟶ B doesn’t prove B ⟶ A.

The absence of a cutoff

cluster can disprove

copying, but the existence

can’t prove copying.

Perhaps they ran grep.

Page 27: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Indeed, there are!

vs. Affirming the

consequent A ⟶ B doesn’t prove B ⟶ A.

Abductive reasoning An unusual

observation

supports inferring a

likely cause.

The absence of a cutoff

cluster can disprove

copying, but the existence

can’t prove copying.

Who’s trying to prove

anything?

Investigate! One clue leads

to another until the case

unravels.

Perhaps they ran grep. Indeed! Check if grep is

installed, if they’ve ever

run it before, or after, on

any folder. Check why they were still

in the building at 11 PM.

Page 28: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Implications

for the field of

forensics...

Page 29: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Page 30: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

What do I want

to know about?

What

behavior is

associated?

How does that

behavior affect

the system?

Measure

those effects.

Draw a

(quantifiable)

inference.

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Stochastic

Forensics:

Page 31: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

What do I want

to know about?

What

behavior is

associated?

How does that

behavior affect

the system?

Measure

those effects.

Draw a

(quantifiable)

inference.

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Stochastic

Forensics:

What data can we find?

What did this person do?

Page 32: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

Lesson Learned:

Forensics doesn’t really

matter...

Col. John Boyd

Military Strategist

Author, Patterns of

Conflict

Page 33: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

For more information:

• Read my paper

Detecting Data Theft

Using Stochastic Forensics http://www.grierforensics.com/datatheft/Detecting_Data_Theft_Using_Stochastic_Forensics.

pdf

• These slides will be available at http://www.grierforensics.com/datatheft/Employee_Data_Theft_Case_Study_ACSAC.pdf

• Ask me!

See next slide for my contact info

Page 34: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder.

I’m very interested in hearing

your

feedback, ideas, and questions.

Please share them with me

here at ACSAC.

Or, if we miss each other: Jonathan Grier

443.501.4044 x1

jdgrier at grierforensics.com


Related Documents
Studyto Establish Ride Comfort Criteria for High Speed ...

Studyto Establish Ride Comfort Criteria for High Speed ...

Category: Documents
Expressões regulares, grep e sed

Expressões regulares, grep e sed

Category: Technology
GREP en InDesign

GREP en InDesign

Category: Documents
Kloke grep 190 268 ORIG.indd

Kloke grep 190 268 ORIG.indd

Category: Documents
Grep Introduction

Grep Introduction

Category: Software
A dynamic model for sodium intoxication unravels salt ...

A dynamic model for sodium intoxication unravels salt ...

Category: Documents
InDesign GREP 1 | 5€¦ · GREP 1 | 5 InDesign GREP Mti dem Grep-Stil besteht die Möglichkeit, innerhalb eines Absatzformats automatisch bestimmte Wörter, Zahlenfolgen, Leerräume,

InDesign GREP 1 | 5€¦ · GREP 1 | 5 InDesign GREP Mti...

Category: Documents
multi-line record grep

multi-line record grep

Category: Software
Beyond accessibility: ATAC-seq footprinting unravels ... · 1 1 Beyond accessibility: ATAC-seq footprinting unravels kinetics 2 of transcription factor binding during zygotic genome

Beyond accessibility: ATAC-seq footprinting unravels ... ·...

Category: Documents
CS 471 Operating Systems Yue Chengyuecheng/teaching/materials/lec-08... · MapReduce Grep 63 Very big data Split data Split data Split data Split data grep grep grep grep matches

CS 471 Operating Systems Yue...

Category: Documents
MicroRNome Analysis Unravels the Molecular Basis of SARS ... · MicroRNome Analysis Unravels the Molecular Basis of SARS Infection in Bronchoalveolar Stem Cells Bibekanand Mallick1.,

MicroRNome Analysis Unravels the Molecular Basis of SARS...

Category: Documents
Reconstructed historical distribution and phylogeography unravels … · 2018. 5. 3. · ORIGINAL ARTICLE Reconstructed historical distribution and phylogeography unravels non-steppic

Reconstructed historical distribution and phylogeography...

Category: Documents