Slashdot Mirror
Windows Forensics and Incident Recovery
The intended audience, according to the author, is "anyone with an interest in Windows security, which includes Windows system and security administrators, consultants, incident response team members, students and even home users." The author assumes the reader is familiar with basic networking (including TCP/IP) and has some Windows administration skills. Some programming ability, though not actually required, will help out greatly with reading and understanding the many examples provided, and will let you make your own modifications (this is encouraged by the author throughout the book).
The chapter on data hiding was a real eye-opener -- it's amazing the things Microsoft has implemented as part of the operating system (and included applications) that can be used to hide things. Discovering the hidden information is talked about, as well how it is hidden. Sample topics include file attributes, alternate data streams, OLE and stenography. This is an excellent chapter with many examples; I found myself stopping after each subject to try out each of the discussed techniques.
The next chapter delves into incident preparation. Carvey addresses some of the things that administrators can do to harden their systems. He goes over the application of security policies in general, as well as intelligent assignment of file permissions. He then covers Windows File Protection and how it is implemented, and includes a perl script to implement your own file watcher. He touches briefly on patch management and anti-virus programs, then moves into monitoring. He provides quite a few scripts, and discusses other means by which you can monitor your system.
The next chapter describes tools that can be used in incident response. This chapter has quite a lot of information and took me the longest to get through, because of all the tools mentioned that I had to download and check while I was reading the book. Carvey uses a mixture of his own perl scripts and programs that can be downloaded from places like Sysinternals, Foundstone, DiamondCS and others. All of the tools used are open source (or are at least freely available). That equips the reader with a low-cost toolkit, especially important to the home user or small business owner who cannot afford to buy the commercial equivalent. Carvey does acknowledge, though, that there are quite a few commercial tools with great functionality out there.
The first part of the incident-response tools chapter deals with the collection of volatile information (processes, services, etc.); this is a vital part of live analysis. The second part deals with the collection of non-volatile information (the content of the Windows registry, file MAC times and hashes, etc.) and tools for analyzing files. Carvey also shows how some of the tools complement each other, and that there is not one almighty tool that will find all the data you need. (This is also proven by example in a later chapter when he talks about rootkits.)
The next chapter deals with developing a security methodology, and it's handled differently than in most books: the author presents the material as a series of dreams that a Windows system administrator has, showing how an individual can come up with and fine tune a methodology as incidents happen. Carvey has used this approach before in a series of articles entitled "No Stone Unturned" for SecurityFocus.com, and the creative approach appeals to me. As he moves from dream to dream, you can relate to the admin's circumstances (and mistakes), and how be and becomes better at responding to different incidents.
The next chapter talks about what to usefully look for with the tools the book has introduced. It discusses infection vectors, types of malware and rootkits, and demonstrates tools and techniques for detecting them. This is where the author makes a clear point of why you would need to run several different tools, even if some overlap. His example uses an installed rootkit; running a particular program from a previous chapter, he shows that it fails to find that anything untoward is running -- it takes another program from the same chapter to actually reveal the rootkit's presence. By cross referencing the output for both programs, you can see why you should run more then one type of analysis tool for certain areas to make sure you are not missing anything.
Finally, the author dedicates an entire chapter to his own Forensic Server Project, a two-pronged approach to live forensic analysis which uses two machines simultaneously. The first piece, the Forensic Server Module, is the listener software; this runs on a clean PC where the data will be sent from the compromised system. The other piece, called the First Responder Utility, runs several of the programs and scripts from the incident tools chapter on the compromised system . After installing everything needed for both parts of this system, I followed the author's instructions on how to run it. What a slick tool! I ran it from a couple of PCs on my home network and was able to get a lot of the information that was described in the book as well as hash values for each log file that was produced, and a general log of everything the First Responder Unit did. The whole principle of this is that when you have an incident there will be very little interaction with the compromised system, since everything is scripted to begin with.
The framework that this software constitutes is very flexible. I was able to add two new features to the Forensic Server Module and the First Responder Utility with very little code. The first addition I made was to mark all the logs as read-only on the file system after they were written from the Forensic Server module. The next addition I made was to add a perl script to scan the c:\ drive of the PC that the First Responder Utility was running on. After I made both additions, I tested everything out, and it worked great. I had my extra log files and they were all read-only. My hat goes off to the author for coming up with and including this in the book, a really nice piece of software.
You can purchase Windows Forensics and Incident Recovery from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.
I can just see the "sharing violation" and "file in use" message boxes flying everywhere.
-- Mike Keryeski
http://freemp3players.fasturl.us
How do you keep a windoze box running long enough to do any forensic work on it?
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
Fuck you, spammer.
From article:
" Sample topics include file attributes, alternate data streams, OLE and stenography"
Should that be Steganography?
Does the book offer any comprehensive ideas beyond tools you can download and hwo to use them? I'm really more interested in knowing where an attacker's footprints are likely to be evident, not in using some sort of footprint detector. Tools are nice, but one should have basics to fall back on when tools are unavailable or untrusted. That said, the best Windows security tool is Nero. It's great for burning Debian .isos. . .:)
You are not the customer.
Bring the computer to my office.
Administer a morphine injection.
Ask the computer about his feelings (particularly towards his parenting fab)
Administer another morphine injection (to myself this time).
Play some Diablo 2 on the computer.
Upgrade computer's video card.
Play some more Diablo 2.
Charge computer's owner some big money.
One last morphine injection for the road.
Lather, rinse, repeat and you've got one hell of a business!
A Multiplayer Strategy Game for Mac OS X, Windows, and Linux
Cool, I love arcane knowledge *hugs his falconry for dummies book*
"It's too bad she won't live, but then again who does?" - Gaff
We had an SGI IRIX system rooted a while ago. One of those obscure machines that sat in a corner running for years, rarely updated or touched. When it was discovered that the machine was taken over the person that admin'd the machine left it exactly as is but firewalled and VLAN'd the machine from touching anything outside of a test VLAN he set up.
In February he gave us (network guys visiting his branch) a look at the machine and what he found. The machine, the root kit and the IRC bot were all left intact and running. It was pretty neat, he wrote up a lengthy port-mortem of the event.
Trolling is a art,
You got the security part right ;)
"It's too bad she won't live, but then again who does?" - Gaff
I'm willing to bet that he doesn't have a hardware drive copier that supports SATA
;^)
Really ?? How much are you willing to bet on that ??
Hmmm, I wonder if Google will predict roulette numbers for me too
I spent a lot of money on booze, birds and fast cars. The rest I just squandered. - George Best
The tool that you're probably referring to is EnCase by Guidance Software.
Find out about the Lexus Rx400h Hybrid!
Good grief! Are you serious? I think a "police budget" can stretch to *zero* dollars to install Linux and mount your super 31337 ReiserFS drive.
The only way you've any chance of hiding your Pr0n is by using an encrypted filesystem like CryptFS, an encrypted loopback or whatever...
Code, Hardware, stuff like that.
Because you can't pick up a SATA drive dock?
Mod point free since 2001
I'm willing to bet that he doesn't have a hardware drive copier that supports SATA. And his software doesn't recognize reiser4 or xfs.
I'm willing to bet you're wrong. A SATA-PATA converter is 20 bucks, if thats what it takes. And even if you don't recreate the files, you can still search bit for bit for tags like "JFIF" which denote the start of a jpeg file, and then just grab the data to see what the jpeg file is of.
Believe me, linux is not beyond the long arm of the law. When the FBI raids the big warez sites, do you think those are all windows machines? They manage to get convictions.
I don't need no instructions to know how to rock!!!!
i'm sure most police forensics people have a copy of dd and netcat :)
"I disapprove of what you say, but I will defend to the death your right to say it." - Voltaire
If you're going to repost other people's posts, at least preserve the formatting, you lazy turd.
1) This is no "one" tool accepted in court, many tools are accepted and it is almost always the competency of the examiner and only rarely is the tool that is ever called into question. Companies like Guidance Software (makers of Encase) would like you to think that way...
2) Most dedicated computer forensic tools, especially those for examining hard drive images, can work with any filesystem from FAT12 to xfs on a RAID 5 set. Again, the burden falls on the examiner to know the proper tools/methods for examining these file structures.
3) SATA drives can be copied with any dedicated hardware copier (such as Logicube's MD5 or Solitaire), but dd combined with an SATA interface will work just fine. Any memory image (RAM, IDE, SCSI, SATA, etc.) can be imaged with just dd, even over a network.
4) "Average nerds and hackers are so far ahread of the forensics guys"...what nonsense. Computer forensic analysts are without a doubt some of the most talented people in IT period. Computer forensics is multi-discipline and analysts typically have backgrounds in engineering, programming, criminology, and languages. And why are you assuming that most computer forensics experts are in law enforcement? The best analysts are in the private sector, military, and government intelligence.
Or here if you'd rather not use an affiliate link and pay someone who didn't do anything more than type a few words into a search box.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
"Forensics" on a live system is a misnomer. For incident response, collecting live data on open ports, running processes, logged on users, and mounted devices is useful and sometimes necessary. Investigators should be sure to check -- gingerly -- whether any encrypted volumes are mounted.
Generally, however, if there's any chance that the investigation could wind up in court, it's best to pull the plug (literally) and conduct a static analysis of the hard drive. You lose access to running processes and some live registry keys, but otherwise just about everything exists on the hard drive and is accessible through standard forensic tools.
As a forensic programmer/consultant, one of the biggest problems I run into is when J. Random Sysadmin is tasked with conducting an initial investigation and ends up rampaging through the hard drive like a bull in a china shop. If you ever find yourself in this situation, stop and get the facts. There's no better way for a sysadmin to wind up in the doghouse than to ruin a legal investigation.
Jon
(Disclaimer: I work at Guidance Software, makers of EnCase, which is the all-in-one tool that can do all of the things mentioned in the review. But not for free...)
Windows Forensics
crack whore at the gynecologists
----
Only until a judge orders you to decrypt it. And then you decide whether you want to face child porn charges, or somewhat weaker child porn charges + contempt of court charges.
If you're at the point that your hardware was siezed, you know they already have enough on you to get a warrant. The cops are just trying to make their case against you airtight, but that doesn't mean that it doesnt already float.
I don't need no instructions to know how to rock!!!!
There are data recovery shops that probably do have the necessary equipment...though I don't see a problem with taking the drive, booting off of a CD and doing a bit copy to another drive using dd.
In either case, I think your confidence level is a bit too high. The forensics software I've used has checksum ID strings for known files and uses that as the basis for finding the known parts. These checksum databases are available for Unix-like systems, not just Windows. Once accounted for, the remaining file space can be investigated for other data.
The average hacker vs. the average cop, no doubt you are correct. The average hacker vs. a professional data forensics expert...it all depends on how much time the forensics expert has to do the investigation.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
As is always the case, the degree of security you need depends on how much effort anyone is going to put into compromising it. If you're a low-level pot dealer, you're probably right that your obscurity provides adequate secuity. On the other hand, if you're Osama bin Laden, I'm thinking they'll get your drive to someone who can read reiser partitions.
What I'm listening to now on Pandora...
He is just spamming with his amazon account.
"Then they use this software tool, which I forget the name of, which is the only tool that holds water in a court of law."
No.
It's the only tool they know how to use.
EnCase (which by the way supports reiserfs), iLook and SMART are perhaps the three most common drive analysis tools. Dont discount forensics guys, perhaps your local pd might not have a lot of knowledge, but the fbi, air force and several other agencies all have labs developing and deploying technology to do digital forensics, and i doubt theyre hiring idiots.
Clicking that link or modding the parent post up = making spam profitable. Friends don't let friends support spam.
That's not entirely true.
The local Computer Investigation B. has some prety sofisticated stuff, all there software is used much the same way you described in court.
There was a case a few years back here where a guy had some files on his linux box that were incriminating. He set a script to do 10 DOD wipes. That's writing 1's and 0's 7 times over the HD, X 10.
The lab was able to 1:1 the drive, then recreate every file that was saved to the HD since the purchase date.
My friend runs this lab, he said his record is 15 reformats, and still recovered data. He recently had his first SATA case, he was able to dup the drive, and, since the guy had never reformated, and was on his first linux install, he had no problems!
Remember, the NSA can ALWAYS do it, most of the time before hackers can! They in turn hand down the info (as needed) to the FBI, CIB, and finally in the form of books, like this guy did.
It wouldn't suprise me if SATA has been cracked from day 1 release to the public. And xfs, the same.
My 2cents worth, take it for face value, it's all I got.
Fuck you and your harmless self-interest. How dare you try to benefit from others without actually harming them. You make me sick.
There are all kinds of ways to image a SATA drive. It's a non-issue. Worse comes to worst, we boot your system up in DOS and acquire it via crossover cable.
EnCase supports Reiser3. I don't know whether Reiser4 is so radically different from Reiser3 that we can't decode the filesystem currently, but I'm sure we could roll it out the door quickly if there was a large need. We've done it for our customers before.
We can't yet do XFS, but we could still recover quite a bit of data from unallocated. As others have noted, all you need to get an image is good old dd.
In many respects, savvy forensics investigators are far ahead of most criminals. Police forces band together to create high tech task forces, and they tend to have plenty of budget (e.g. they have their own clean rooms for manufacturing damaged hard drive parts). With all the ways that Windows and most applications leak information, it requires an extreme amount of discipline to avoid littering your hard drive with evidentiary artifacts.
It sounds like you do need a book.
cheers,
Jon
That is why any good investigator keeps more than one tool in his kit. Personally I have a bootable windows environment that I custom build for doing work with Windows. And for a system like yours I pop out my handy bootable Linux CD. It is based off of Gentoo and has more than enough bells and whistles to handle reiser or xfs and pretty much anything else you care. If I need something more I tweak the packages and kernel and recompile. Once you have that bit for bit copy you have all the time you need to work on it. And FYI there are many many packages that "hold water" in a court of law. I will also be giving a lecture in December at a nearby university on computer forensics. Funny how arrogant attitudes like that in most cases get you busted when you think you are smarter than those doing the looking.
but against someone using out of the ordinary stuff this guy is screwed. I've got serial ATA drives and reiser4 and xfs file systems. I'm willing to bet that he doesn't have a hardware drive copier that supports SATA. And his software doesn't recognize reiser4 or xfs. He would either need a different tool or he would have to send the drive someone higher up to be examined.
Man, you just the exact situation I had happen last year. My Linux email server was compromised do to a vulnerabilty in squirrelmail/UW Imap. They didn't do any damage that I could find, so I just took the email server off line, and buitlt a brand new one and hardened it. Unfortunatelly, my boss had to find out, because email was down for 1 day. Since she found out, she wanted me to report it to the Feds. I relunctantly did so. 3 Feds showed up. I handed them the drive, and they made an image of it with the device that you have mentioned. They then tried to use their SW to examine it. Guess what, it only works on WINBLOWS FORMATTED DRIVES. They couldn't see any of the data. They have since stopped investigating the case.
Crackers and hackers always find ways to exploit the code to access or share protected content. There is not a DRM system that has not been cracked within months of widespread release.
A stealth virus is one that, while active, hides the modifications it has made to files or boot records. It usually achieves this by monitoring the system functions used to read files or sectors from storage media and forging the results of calls to such functions. This means that programs that try to read infected files or sectors see the original, uninfected form instead of the actual, infected form. Thus the virus's modifications may go undetected by antivirus programs.
OS based DRM systems can still successfully lock a user, and any program, even if is running under localsystem/root privilege, out of areas of diskspace and memory. Microsoft's Mediaplayer , Active-X ( used with some DRM protection ), Real's realplayer, and even Microsoft's and Sun's Java JVMs, have in the past had remotely exploitable vulnerabilities. Such enviable offers the malware creator the ability to hide the virus from any antivirus tool or live forensic analysis.
The DRM encryption offers the ability for the malware to store content, and without the keys to decode the content, it is hidden from any forensic analysis.
I think you may be right about the private sector, but I went to a presentation by someone in the Dallas FBI "cyber crime" unit, and I wouldn't exactly call him the cream of the crop. (Not that it means all of them sucks) The extent of his comments on analysis was the software they used. Encase was one he mentioned. The presentation included many deterrents to the technologically knowledgeable, with statements such as "Nimbda infects web pages." peppering the fairly contentless background. He seemed fairly uninterested in the deep technical aspects of his job ... he snuffed the few technical questions in the Q&A session and indicated that his division didn't have time to delve into deep technical issues.
...and I'd have to say that the review was pretty thorough. I couldn't put the book down when I first got it (which would probably be true for any other self described nerd on here). Here's the link to the book's web site if you want to read anything about it. There is a sample chapter there as I'm sure there probably is on amazon or bn.com.
Is that postmortem available online?
Bleh!
I've always wondered how people can claim they can 1:1 a drive that's been rewritten 70 times. I'd believe 1:71, but there's no way the tool could pick the only incriminating cycle out of 71 cycles without recovering all of them to examine. Alternatively, you could try overwriting your incriminating xfs disks with filesystems of non-incriminating images and text, and see if they quit when they find data.
you mean the FIF!
I don't need no instructions to know how to rock!!!!
That's because you're an idiot and you don't understand the concept behind referrer linking. Since that jackasses that post those links here are only looking to waste space so they can make money, it does not benefit anyone except them to encourage the behavior. If the link had been posted in the article where it was relevant, it would have been acceptable. However, it was posted in the body of messages only as board spam, which is not.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
2) Cracking the DRM code is not the same as cracking the key used to encrypt each item of encrypted content. If the key is not accessable then the content cannot be decrypted without major difficulty . If the virus/malware retains the decrypt key only in DRM OS protected resident memory, then the key is not accessable to the user. Also it is possible to construct polymorphic virus code which encrypts the decode key in the virus startup code.
you mean plead the filth!
wake up and hold your nose
Serious analysis would take place in the lab in DC, not in the office of some schmuck in the field office cyber-crimes unit.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
The point is that you have a lot of very clever people trying to reverse engineer the code, which exposes code which has often undergone very little peer review. Most of the times this also exposes vulnerabilities in the decoding software, some of which are remotely or locally exploitable.
I know, I know, it was a typo... still funny.
EnCase is not free to law enforcement, though, and can be quite expensive. As far as networked machines go, this requires the Enterprise edition, which has to be previously-installed to the machine.
iLook, however, is free to law enforcement and government agencies and generates rather nice forensics reports. It doesn't have the same bells-and-whistles feel as EnCase does, but it is free and thus provides a nice tool to budget-strapped law enforcement agencies.
However, the grandparent post's attitude is one which computer forensics can rely on. As long as people believe they are invincible, then it makes the job easier. They don't realize that, essentially using free tools, you can recover deleted files from their machine and find just about anything, including stuff hidden in slack space.
Foremost is another free tool which works in file recovery. Very, very nice tool. I would say that last time we used it, we got more information out of it than EnCase, although I am not putting EnCase down by any means.
*-*-*-*-*-*-*-*
"We are Linux. Resistance is measured in Ohms."
Computer forensic analysts are without a doubt some of the most talented people in IT period. Computer forensics is multi-discipline and analysts typically have backgrounds in engineering, programming, criminology, and languages. And why are you assuming that most computer forensics experts are in law enforcement? The best analysts are in the private sector, military, and government intelligence.
Exactly. From my experience, the forensic analysts I have experience with came from Computer Science and Electrical Engineering backgrounds, and are highly trained. The "average nerds and hackers" fail to realize, sometimes, that the best among them sometimes cross the road to become these top-notch forensics analysts. It is not uncommon to find an ex-blackhat pop up in the private sector years later as a computer forensics analyst. In training, they bring in the guys who were on the "other side" and teach you to think like those guys, so that you can catch them.
And the tools (iLook--which is free to law enforcement, EnCase, Foremost, etc., etc.) are fairly effective against your average case. Some people do not realize that even NASA has a computer forensics division.
It is, however, the attitude of being invincible that makes most guys all the more catchable.
As far as #1 goes, anything that doesn't fit under the Dauber rules of evidence (at least, if there is a good DA involved) will be quickly made null, but programs like EnCase certainly qualify.
*-*-*-*-*-*-*-*
"We are Linux. Resistance is measured in Ohms."
Hmm... From the feature list:
* Mirror Copy -- Simple sector-by-sector copying for all proprietary partition types (e.g. MAC, Linux, SUN, OS6).
I wasn't aware that Linux file systems were "proprietary"...
Xfce: Lighter than some, heavier than others. Just right.
And if the case is too small they wont bother.
This is partially true in that most crimes are taken on a "Big fish versus Small fish" basis. This is no different from traditional crime. In the case that a hacker hit a small business with very little effect, it is generally more practical for an incident response team to find out what happened, restore from a trusted backup, and then go about fixing the problem so it doesn't happen again.
However, if you're trading kiddie porn or decide to peruse your local financial institution or any other institution regulated and required by law to report hacking incidents, I will guarantee that you become a "Big Fish" fairly quickly.
And the range of forensic tools available to a good forensics analyst is likely to cover most anything you throw at it. You are correct in that local PD cyber crime units are often started by guys who have very little computer expertise and do not initially know how to get forensically-sound evidence. However, free software like iLook and expanded forensics education programs are changing that. And, if you do become a "Big Fish," you can almost bet that the guy assigned to your case knows what he is doing.
*-*-*-*-*-*-*-*
"We are Linux. Resistance is measured in Ohms."
Well, if you're viewing kiddy porn then I'm probably not feeling sorry for you if you're nailed anyhow - however there are other factors. I think the easiest place to get nailed is cache. Either your browser cache or whatever. Unless you're pointing *that* to an encrypted FS (or the whole thing is encrypted, which is super-high overhead) you'll probably have something in there.
The big problem I see is that you can have such things in your cache without being a pedo. How many pr0n sites advertise lolita pics, and there are fuzzy banners etc. I've had a few times where my normal pr0n-browsing misadventures have ended up with all sort of interesting popups (moz helps this, mind, but not always)... anything from animals to underage and other types of filth. Even if I haven't viewed it, the bazillion popups it spawns have probably nicely laced my browser caching will also sorts of incriminating crud.
I've always wondered if those things would be used against you, but it probably depends on how bad they want to nail you or if they just don't like you. Hopefully I'll never have to find out, and lately moz has been doing a good job of blocking the popups.
"[...]Sample topics include file attributes, alternate data streams, OLE and stenography.[...]"
People always confuse these two words,
stenography - typing fast on a weird machine,
steganography - information hiding techniques.
Wasn't this posted on Tuesday?
0 9/ 202220&tid=192&tid=172&tid=6
http://books.slashdot.org/article.pl?sid=04/11/
RandomAndInteresting.comdefending the world from stupidity since 1979