RSA 2008 - Computer Anti Forensics
By Simon Bisson & Mary Branscombe in Editorial
How do you know you’ve been hacked? You may have a suspicion that someone’s inside your network, but if your log files don’t show anything, don’t assume that your systems are secure. The bad guys know all about standard compouter forensic techniques and have toolkits full of techniques and programs to cover up their traces. The computer security team at Verizon are finding that anti-forensics are used in more than 2/3 of intrusions.
One of the most common techniques is data wiping, used to reduce the evidence available to security analysts. Used in only 18% of cases in 1998, things are very different today, with data wiping used in 80% of cases. The popularity of data wiping can be seen by the sheer number of tools available on black file sites - with more available than all the other types of anti-forensic tools combined.
Luckily for us data wiping is not perfect, and even the best tools leave some files behind - especially when files have been locked or are still in use. It’s a good idea to think outside the box - often literally. Perhaps a backup has traces of the bad guy at work, or there may be traces of his tools and actions on a clustered storage array somewhere else in your data centre. And of course there’s the old forensic stand-by: running memory. A memory dump can show traces of running programs in old page files.
The next most popular technique is data corruption, closely followed by data injection. The aim here is to hide from your logging tools - or even make your log files unreliable. One technique is very simple, with intruders resetting system clocks to create a whole new log that can be deleted when they leave. If there unexpected holes in log files, there’s a distinct possibility that someone is changing your system clock. More complex techniques use tools to corrupt log files to cover up attacks, or to edit out an attackers actions.
One case Verizon worked on was a retail customer that was seeing unexpected charges on its credit card system. Nothing was found in the logs, but the Verizon forensic team was sure that something was happening, so they began to monitor the system.
A few days later a tripwire was triggered, and they were able to watch (and screen capture) someone from the credit processing vendor coming in to the network on a trusted connection. The attacker first changed the system clock to hide their actions, and then using the debug mode in the credit card software to steal transaction data. The security team watched the attacker tidy up after themselves, deleting the debug files. Finally the attacker reset the system clock and edited the system logs to replace their external IP address with an internal one. They’d only made one mistake, which was how the security forensics team was convinced that there was an attacker.
What was it?
The internal IP address they were using wasn’t actually assigned to anything.
It’s clues like that that you need to look out for when assessing a system to see if it’s been compromised. You know what makes your network tick, what addresses are in use, and what your system logs should look like. Vigilance is the only way you’re going to be secure.
In the immortal words of Hill Street Blues: Be careful out there.
– Simon
Rated: 80% (1 votes)
Loading ...Make a comment
Tag cloud
Archives
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
Most commented posts
- Java’s SSVAGENT.EXE: training the monkey
5 comments
- Wubi Tuesday
- Not very open, not very social
- The best mobile game ever
- A Big Day In The Enterprise IT World
- Employees are our most valuable asset (snigger)
- Biometrics - it's not the technology that's broken
- More battery life, fewer explosions
- Spam Fighting in Exchange
- IDF: Will SSD mean the end of 5GB free?
Highest Rated Blog Posts
- Nobody knows what Web 2.0 really is (100%)
- Songs of distant satellites (100%)
- Log in and lock in (100%)
- Mommy, why is there a home server in the office? (100%)
- Employees are our most valuable asset (snigger) (100%)
- Locking down IT or blocking creativity (100%)
- Video opera? What would you do with huge bandwidth and millions of pixels? (100%)
- Consumer BlackBerrys are good for business (100%)
- HD Trek (100%)
- Top tips for speeding up Vista (100%)