Slashdot Mirror
Alternative Browsers Impede Investigations
rbochan writes "Allegations in an article over at CNET propose that alternate browsers such as Firefox and Opera impede law enforcement and investigation efforts because they "use different structures, files and naming conventions for the data that investigators are after", which can "cause trouble for examiners.""
This is one of the dumbest articles I've read in a while...
From TFA:Implying that 'alternate browsers' such as Firefox and Opera, 'hide' data? Shenanigans! These other browsers don't 'hide' anything...you just have to know where to look.
Also from TFA:You can't be serious. If it's this easy to thwart the authorities, maybe I should tender my resume.
God help these 'professionals' if a suspect's computer happens to run Linux...which brings up a disturbing thought...is the presence of a 'non-standard' browser or OS now going to be 'suspicious' to investigators, because they can't seem to penetrate its 'arcane secrets'?
____
~ |rip/\/\aster /\/\onkey
Heaven forbid that they have to learn to deal with a different file layout. I mean, it's not like these are supposed to be skilled professionals practicing their trade here...
sed "s/SJW.*$/... never mind. I was about to say something stupid, and also, I'm a troglodyte./Ig"
...the terrorists have already won.
In other news, bad guys hide in secret hideouts, which makes it hard for the Police to do their job.
Damn I have deployed TOR for nothing. Installing Firefox was enough.
http://ebgp.net/ccc/
It sounds like a lot of the people doing this kind of investgation aren't actually computer experts, but using pre-packaged software or following a list of directions someone has tailored for IE.
Effectively, they're professional script kiddies working for the common good instead of against it.
The lesson? Training. You wouldn't put a detective in the morgue and hand him a scalpel, and you wouldn't drop him in a science lab. You'd hire a coroner, you'd hire someone trained in forensic science. If you're going to search someone's computer for evidence, hire an expert or train someone to become an expert.
Help me out, /.!!!
1. Submit patent.
2. ???
3. Profit!
Reminder: Apple owns 1/255th of the internet.
Firefox and Opera store information on typed URLs in a different file than IE does, and the files are somewhat tough to decipher
You would think since Firefox is open-source, it would be a trivial matter to determine the format of the cache files by examining the source code.
And then I realized that they were serious.
Now I weep for them.
RTFA again for the best results.
So with a few low-res pictures of some metal objects in Iraq we can determine they have biological weapons... but the 'trained professionals' working for the police can't figure out how to find Firefox's internet logs?
...Firefox... on Linux! "Find what they've been browsing? Hell, we can't even find C: !"
Let me see now (Jon Stuart grin), the police haven't learned how "alternative" browsers store data. Users of these "alternative" browsers even have been known to "flush" their data caches. This , um, "flushing" is a suspicious behavior - AND these "alternative" browsers are resistant to spyware that we normally use to "spy" on our "citizens."
I say, if these "citizens" don't want to be "spied" on, they are SUSPICIOUS! SEND THEM TO GUANTANAMO!
Meanwhile, in Soviet Russa...
As a criminal defense attorney specializing in computer crimes, I can say authoritatively that the investigators are typically poorly trained. Most that I have dealt with are not IT or CS degree holders. In fact, the norm is for it to be a police officer who has taken a 2 week course in Encase, nothing more. Their knowledge of operating systems is lacking to say the least. Of course, this can result in some poor schmuck being convicted for something he didn't do, both because the cops don't know any better, and the juries - who typically take the word of the police as gospel down here in Arizona, know even less and rely on the uninformed testimony of law enforcement.
http://www.theregister.co.uk/2004/01/28/a_visit_fr om_the_fbi/
A visit from the FBI
By Scott Granneman, SecurityFocus
Published Wednesday 28th January 2004 13:05 GMT
[snip]
I teach technology classes at Washington University in St. Louis, a fact that I mentioned in a column from 22 October 2003 titled, "Joe Average User Is In Trouble". In that column, I talked about the fact that most ordinary computer users have no idea about what security means. They don't practice secure computing because they don't understand what that means. After that column came out, I received a lot of email. One of those emails was from Dave Thomas, former chief of computer intrusion investigations at FBI headquarters, and current Assistant Special Agent in Charge of the St. Louis Division of the FBI.
Dave had this to say: "I have spent a considerable amount in the computer underground and have seen many ways in which clever individuals trick unsuspecting users. I don't think most people have a clue just how bad things are." He then offered to come speak to my students about his experiences.
I did what I think most people would do: I emailed Dave back immediately and we set up a date for his visit to my class.
It's not every day that I have an FBI agent who's also a computer security expert come speak to my class, so I invited other students and friends to come hear him speak. On the night of Dave's talk, we had a nice cross-section of students, friends, and associates in the desks of my room, several of them "computer people," most not.
Dave arrived and set his laptop up, an IBM ThinkPad A31. He didn't connect to the Internet - too dangerous, and against regulations, if I recall - but instead ran his presentation software using movies and videos where others would have actually gone online to demonstrate their points. While he was getting everything ready, I took a look at the first FBI agent I could remember meeting in person.
[snip]
Dave had some surprises up his sleeve as well. You'll remember that I said he was using a ThinkPad (running Windows!). I asked him about that, and he told us that many of the computer security folks back at FBI HQ use Macs running OS X, since those machines can do just about anything: run software for Mac, Unix, or Windows, using either a GUI or the command line. And they're secure out of the box. In the field, however, they don't have as much money to spend, so they have to stretch their dollars by buying WinTel-based hardware. Are you listening, Apple? The FBI wants to buy your stuff. Talk to them!
Dave also had a great quotation for us: "If you're a bad guy and you want to frustrate law enforcement, use a Mac." Basically, police and government agencies know what to do with seized Windows machines. They can recover whatever information they want, with tools that they've used countless times. The same holds true, but to a lesser degree, for Unix-based machines. But Macs evidently stymie most law enforcement personnel. They just don't know how to recover data on them. So what do they do? By and large, law enforcement personnel in American end up sending impounded Macs needing data recovery to the acknowledged North American Mac experts: the Royal Canadian Mounted Police. Evidently the Mounties have built up a knowledge and technique for Mac forensics that is second to none.
[snip]
It's the silliest thing I've read about non-IE browsers, and how they're BAD since I read this one.
This is going to be moot if the law enforcement is dealing with people who are serious about what they're doing. I'm sure that if someone is planning an elaborate high-profile attack, they would have the sense to be careful as well, so it won't matter if you use IE or if you use Firefox or if you use Lynx--it's not that hard to wipe out all traces of activity from your computer no matter what browser you use. So I doubt that this is going to be of any help in dealing with smart criminals.
;)
And if the law enforcement can't figure out how to write a simple tool to decipher the files that are left behind from alternative browsers (especially one like Firefox that is open-source, meaning that the format of such files would be easy to determine), then that's just, well, pathetic.
And finally, I think that this is a good thing. Most people in this world will probably never ever have to deal with law enforcement. But they do have to deal with snooping parents, snooping friends, snooping girlfriends, snooping spouses, snooping bosses, etc., so I welcome this as good news.
In other words, they seem to be slamming Firefox, but actually it is pretty good advertisement for Firefox. They should put on their front page.
"Even the brightest police investigators can't look at your browser history! Get Firefox today, the most secure browser."
Police, baffled by the lack of a blue "e" can't figure out how they used the Internet.
"And there's no START button! How are we supposed to find anything?"
I like microcars
I question the trust that slashdotters seem to have in this new story. Why should we believe it?
The general police forces have managed to get a new story published on how they can not deal with any sort of semi-modern technology. Why should we believe it?
If I were the police, and I'm sure the police have at least one or two people smarter than me. then I would go to great lengths to get this story published. Why? Not because I can't figure out Firfox, be because I -can- figure out Firefox.
If my suspect thinks that I am too dumb to understand Firfox, then my suspect is far less likely to use powerful encryption. Without the powerful encruption, I -can- read Firefoxes files, and a significant proportion of criminals will think they are safe when they are not.
Hell, I'm not even law enforcement but I still find it obvious how this story is a great advantage for the law enforcement community.
to accept the praise of personal wisdom is an affront to the very ideal i hold dear.
Seriously, what do you propose? Educate them? This is national security that is potentially at stake here, people. We cannot simply turn to the logical solution. There's only one way to deal with this problem and that is to nip it in the bud. All non-IE browsers should be outlawed forthwith and anyone caught using them should be sent to Guantanamo for interrogation.
From Apple's website:
"Using Safari's new Private Browsing feature, no information about where you visit on the Web, personal information you enter or pages you visit are saved or cached. It's as if you were never there."
Nobody should ever make it easy for script kiddies (especially because they have a Chicken Inspector Badge).
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Detroit, MI - The American Union of Automechanics is complaining loudly that different makes and models of cars use different parts. "It makes our job very difficult." said Winston Q. Crescenthead. "I mean, we have to work on a Vega, and then turn around and try to fix one of these new Toyota 4Runners. Some of these cars even use different kinds of wrenches. You should see the tools I have to use." Other mechanics have shared similar horror stories. "I got some little British roadster in the shop. It's taken six months of deep psychotherapy, and I think I might be up to the task of putting air in my kid's bicycle tire." The AUA is demanding that Congress pass law a forbidding the sale or use of any vehicle other than a 1972 Chevy Nova.
The world's burning. Moped Jesus spotted on I50. Details at 11.
... homicide investigators admitted they were stumped when a murderer used an aluminum bat to bludgeon his victim to death rather than the standard lead pipe.
... traces from a pipe ... lead is what makes it a crime scene."
Said an officer who wished to remain anonymous: "We're not even sure there was a murder without some trace of lead at the scene. A bullet
Actually it does suck, and I say this as an OS X fan. I don't want my home directory encrypted. Why should I encrypt my mp3s and photo collection? But I do want the option of encrypting a folder. The amount of data that really needs encryption is tiny compared to the amount of stuff on my hard drive.
In some states, parole for sex offenders can require that they don't look at pornography.
Their parole office will drop by periodically and check their PC. They have some sort of forensic software that does this.
I've heard some jurisdictions require that you only run Windows on your computer as a condition of your parole. Logically this translates to going back to prison for owning a knoppix cd.
There simply aren't the resources to train all parole officers in computer forensics, expose them to various obscure operating systems, or to perform regular offline analysis of offenders hard drives.
The resources are (probably) there for big cases, but when there are probably close to half a million sex offenders on parole - it's just not practical.
Boo Hoo!
To counter that with my own anecdotal evidence, I've used File Vault on my laptop since Panther was released and have never had the slightest problem.
I like my women like my coffee... pale and bitter.
""Allegations in an article over at CNET propose that alternate browsers such as Firefox and Opera impede law enforcement and investigation efforts because they "use different structures, files and naming conventions for the data that investigators are after", which can "cause trouble for examiners.""
Allegations in an article over at Police Magazine propose that alternate vehicles such as motorcycles and buses impede bank robbery law enforcement and investigation efforts because they "use different shapes, different numbers of seats, and different logos for the manufacturers that investigators are after", which can "cause trouble for get-away car examiners".
Obviously, only Dodge Chargers, like the "General Lee" should be allowed to criminals, to make them easier to catch.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
I spent 2 years doing electronic crime analysis, and as all law enforcement, the pay and conditions suck. Lack of resourses and lack of understanding the requirements to constantly update skills/knowledge adn training (from the non-technical bean counters ) make life difficult. Add this to report writing and presenting evidence in court to clueless laywers and all in all you have a shit-house job. But on the plus side, chicks dug it !!
Firefox is OPEN SOURCE! That means the file formats are OPEN. Microsoft IE is CLOSED SOURCE, meaning you need to reverse engineer everything to figure out where stuff lives.
That said, I wonder what would prevent someone from creating a wireless fileserver and embedding it behind their drywall. Using an NFSmount or Share, an evildoer's PC wouldn't hold anything evil when the FED's nabbed it.
Realistically I bet it would though - They can do some pretty amazing things with Forensics these days, and I wouldn't be surprised if they could take a ram chip and see previous states of 0's and 1's.
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
I work in computer forensics and it isn't that goddamned hard to develop tools to process different kinds of databases, encrypted or otherwise. Besides, I'm certain that if it were in the interests of "National Security", Federal investigators could get ensure cooperation between developers of FireFox or Opera and the contractors who actually do the forensics work.
All you have to do is play "follow the money" and it quickly sounds like Micro$oft is using the God-and-Country argument to win by default the Second Browser War. Considering how invested Micro$oft has been in the US Justice Dep't. (one of former USAG John Ashcroft's biggest campaign contributors and still heavily involved to this date) it would be unsurprising if they were the ones pulling the strings on the issuance of a statement like this.
What ought to happen is for the Dep't. of Homeland Security to proclaim Internet Explorer as the single largest cause of "electronic terrorism" because of Micro$oft's half-assed security measures.
That'd shut them up real quick...
Even worse, those non-IE browsers make it really hard for police to install spyware and keylogging software on the user's computer. With IE, they just insert a little bit of code into any web page and they are done, but Opera and Firefox put up obstacles to that kind of legitimate law enforcement activity! Evil! Terrorism!
> I suspect it would be very hard to thwarte a computer forensics expert
An encrypted filesystem would presumably make their job rather harder.
Of course, that only works for ex-post-facto forensics. If someone plants a hidden camera where it can see your screen and keyboard for a week, your encrypted filesystem has accomplised, to a first approximation, nothing.
Of course, the *best* way to avoid having computer forensics experts crack your computer is to just be innocuous, i.e., just don't do anything that will make computer forensics experts want to investigate your computer. Granted, not everyone can do this; if, for instance, you are an executive for a major international corporation, you should probably assume that at some point someone will attempt to investigate you and/or your computers -- if not law enforcement, then the competition or a freelance information seller. So you do want to think at least briefly about the question, "Who would want to break into my computer, and what will it cost me if they succeed?" In my case I've concluded, at least for the time being, "Maybe some neighborhood kid fooling around" and "Not much if I have offsite backups." YMMV.
Cut that out, or I will ship you to Norilsk in a box.
I love it. Think of the advertising potential.
Male voiceover
"Microsoft, used by 100% of all sex offenders. Its not only the law, it their punishment."
Oh! I just fell off my chair.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.