It's been more than a few years since I took my programming classes and to be honest, it's difficult to keep a skill unless you use it often. So I decided I'd like to take a programming class and took a close look at Python and Perl. Has anyone tried to find a good post-secondary class in either language?? Didn't go well.
I persisted in my search and believe I've found a fantastic opportunity...and it's free!!! You may ask "Yeah, but how good can a free class in programming really be??". Well, I'll answer that in three letters - M.I.T.
That's right, MIT offers several courses under their MITOPENCOURSEWARE program from courses in Aeronautics and Astronautics, to Writing and Humanistic Studies. Of course, they have several courses under the area "Electrical Engineering and Computer Science." Take for instance, the course "Introduction to Computer Science and Programming - Course #6.00". The course includes full video of classroom lectures, assignments, exams, solutions - they even have transcripts of the classroom lectures. You can also download everything so you can study offline if necessary. Did I mention that it's free? How about a course specifically in Python - as taught in January, 2010 - A Gentle Introduction to Programming Using Python - Course #6.189. There are classes in Java, C++, and numerous other areas.
Their Privacy and Terms of Use and information about the Creative Commons licence can be found here.
Wednesday, August 18, 2010
Monday, August 2, 2010
"The Missing Link" in my computer forensic training.....Network Forensics!
Over the years, I've taken several classes in computer forensics (vendor specific and neutral), information security and networks. Back in April, I realized what was missing - specific training in acquiring and analyzing network-based evidence in a methodical and reproduceable format. Oh sure, I've used many of the current network tools, but I've always wondered if there was a better way to collect the evidence. That's when a colleague of mine pointed out a new training course, specifically aimed at meeting this need; and perhaps completing my "Circle of Forensics".
In July, 2010 I had the privilege of attending the new Network Forensics Course - Forensics 558 being offered by the SANS Institute (Washington, DC). The instructors were Johathan Ham (co-author of the course) and Alan Ptak who provided outstanding training over the 5-day course. I can tell you, it was very different than my previous training in "traditional forensics". For over a year now, we've been preparing, training and researching various techniques for acquiring targeted data in a scenario which required us to specifically target and forensically acquire the data which will/would form our evidence (and ensure we do not miss anything, overtly or covertly). In the day and age of TB-sized hard drives, FDE, volatile data, etc, the move to identify and target key evidentiary information is needed. Jonathan and Alan's training not only identified key areas to focus on, but several techniques on how to acquire and analyze this information in a more forensically-sound manner. The course requires a "moderate" degree of Linux familiarity; the instructor's exceptional knowledge and instructional technique more than made up if someone was a little weak in any area.
One point worth mentioning. While SANS appears to offer laptops on some courses, I have to say that the pre-loaded laptop provided on this course was a good move. The SNIFT kit had been preloaded onto the laptop and for five straight days, I never heard a single complaint of "something not working", "hardware issues", "I don't have that version", etc. The laptop had a 250GB hard drive, with VM Workstation and several pre-configured VM sessions (which were essential to the course). If anyone from SANS reads this - good call! The hardware (Lenovo S10-3) and software (SNIFT Kit) worked - each and every time. (if it didn't, it was likely my fault :)
From hearing the various instructors and other speaking during the Summit and Network Forensics course, it appears that SANS has found another niche with a huge demand. It was an expensive trip - but all in all, very well worth the high quality training.
ps..the presentation from Chris Pogue on Sniper Forensics was awesome and coincidentally, complemented the training provided by Jonathan. If you ever get to attend this presentation by Chris, don't pass on the opportunity.
In terms of identifying information "to be sniped" from within a larger system, I see a huge need for someone to lead discussion in this area. It will be necessary to qualify the type of investigation, type of guest/target systems and OS, type of forensics system/tools available, criminal/non-criminal, etc. The biggest problem I see is that discussions in this area focus on EITHER network/volatile-based evidence, or that normally acquired through "traditional" hard-drive forensics. We need a discussion which includes all areas of forensics.
In July, 2010 I had the privilege of attending the new Network Forensics Course - Forensics 558 being offered by the SANS Institute (Washington, DC). The instructors were Johathan Ham (co-author of the course) and Alan Ptak who provided outstanding training over the 5-day course. I can tell you, it was very different than my previous training in "traditional forensics". For over a year now, we've been preparing, training and researching various techniques for acquiring targeted data in a scenario which required us to specifically target and forensically acquire the data which will/would form our evidence (and ensure we do not miss anything, overtly or covertly). In the day and age of TB-sized hard drives, FDE, volatile data, etc, the move to identify and target key evidentiary information is needed. Jonathan and Alan's training not only identified key areas to focus on, but several techniques on how to acquire and analyze this information in a more forensically-sound manner. The course requires a "moderate" degree of Linux familiarity; the instructor's exceptional knowledge and instructional technique more than made up if someone was a little weak in any area.
One point worth mentioning. While SANS appears to offer laptops on some courses, I have to say that the pre-loaded laptop provided on this course was a good move. The SNIFT kit had been preloaded onto the laptop and for five straight days, I never heard a single complaint of "something not working", "hardware issues", "I don't have that version", etc. The laptop had a 250GB hard drive, with VM Workstation and several pre-configured VM sessions (which were essential to the course). If anyone from SANS reads this - good call! The hardware (Lenovo S10-3) and software (SNIFT Kit) worked - each and every time. (if it didn't, it was likely my fault :)
From hearing the various instructors and other speaking during the Summit and Network Forensics course, it appears that SANS has found another niche with a huge demand. It was an expensive trip - but all in all, very well worth the high quality training.
ps..the presentation from Chris Pogue on Sniper Forensics was awesome and coincidentally, complemented the training provided by Jonathan. If you ever get to attend this presentation by Chris, don't pass on the opportunity.
In terms of identifying information "to be sniped" from within a larger system, I see a huge need for someone to lead discussion in this area. It will be necessary to qualify the type of investigation, type of guest/target systems and OS, type of forensics system/tools available, criminal/non-criminal, etc. The biggest problem I see is that discussions in this area focus on EITHER network/volatile-based evidence, or that normally acquired through "traditional" hard-drive forensics. We need a discussion which includes all areas of forensics.
Sunday, July 11, 2010
What's next in Volume Shadow Copies...?
Having just attended a presentation by Mark McKinnon (RedWolf Computer Forensics) and Lee Whitfield (Disklabs and Forensic4cast) at the SANS What Works in Forensics and Incident Response Summit 2010, I'd like to make a few comments on the excellent presentation by Mark and Lee.
The presentation was on Volume Shadow Copies and started with a detailed description of what is currently known about this relatively new avenue in digital forensics. From the information presented in this 1 hr presentation, if you have not started to think about Volume Shadow Copies, you had better start paying attention in the months to come. While the process of getting information is moderately complex, the amount of information produced by the Volume Shadow Service will eventually be one of those tasks we must not ignore. The presentation did a live demo of the product, and gave us an idea of just what we're missing. While the state of the file may be dependent on the quality/existence of the previous snapshots in place, Mark and Lee have developed a tools which intends to automate the Volume Shadow Copy recovery process. Timeline to release you ask....? The authors indicated a few months. They appear very committed to releasing a stable and tested product.
From their new site for Shadow Analyzer, here's a small idea of what the product can recover:
Keep up the progress guys.....great presentation and even greater tool !! Oh yeah....forgot to mention, the tool will be "tri-platform" - Win, Linux and Mac.
For more information on Volume Shadow Copies, take a look here:
Into the Shadows
Reliably recovering evidential data from Volume Shadow Copies in Windows Vista and Windows 7 (pdf)
Volume Shadow Copy Forensics - the Robocopy method Part 1
Volume Shadow Copy Forensics - the Robocopy method Part 2
More to come on the Summit...it's take days to digest!
The presentation was on Volume Shadow Copies and started with a detailed description of what is currently known about this relatively new avenue in digital forensics. From the information presented in this 1 hr presentation, if you have not started to think about Volume Shadow Copies, you had better start paying attention in the months to come. While the process of getting information is moderately complex, the amount of information produced by the Volume Shadow Service will eventually be one of those tasks we must not ignore. The presentation did a live demo of the product, and gave us an idea of just what we're missing. While the state of the file may be dependent on the quality/existence of the previous snapshots in place, Mark and Lee have developed a tools which intends to automate the Volume Shadow Copy recovery process. Timeline to release you ask....? The authors indicated a few months. They appear very committed to releasing a stable and tested product.
From their new site for Shadow Analyzer, here's a small idea of what the product can recover:
Shadow Analyser eliminates the hassle of analysing Microsoft volume shadow files. It allows a digital forensic investigators to take a disk image and, using that image:The authors are putting a lot of time into the development of this tool; the shear volume of information that they are finding within the Volume Shadow Copies seems to be a driving force and motivation behind getting this tool to the end-stages of development. You can follow their development on Twitter as well at @ShadowAnalyzer .
■view the contents of the hard disk drive at a point in time
■recover deleted and erased files
■extract older versions of current files
■view historic date and time information for all files, both live and deleted
■view changes to files across days, weeks, or even months
■extract complete files from volume shadow files
Keep up the progress guys.....great presentation and even greater tool !! Oh yeah....forgot to mention, the tool will be "tri-platform" - Win, Linux and Mac.
For more information on Volume Shadow Copies, take a look here:
Into the Shadows
Reliably recovering evidential data from Volume Shadow Copies in Windows Vista and Windows 7 (pdf)
Volume Shadow Copy Forensics - the Robocopy method Part 1
Volume Shadow Copy Forensics - the Robocopy method Part 2
More to come on the Summit...it's take days to digest!
Sunday, July 4, 2010
The iPhone and Corporate Security
I have done my fair share of mobile analyses over the last 4-5 years including logical extractions of Blackberry's and both logical and physical extractions of iPhones. With a larger number of cellular providers carrying iPhones, I am often asked to compare the Blackberry to the iPhone within a corporate domain.
While I understand that the iPhone is constantly increasing the number of "apps" that they carry, I simply cannot find a logical reason why a corporation (who presumably does not want company information/secrets shared with the world) would opt to incorporate the iPhone into it's corporate enterprise.
As recent as last week, I was reminded that many corporations will almost always opt for "availability" over "confidentiality". While I believe that both are important, I simply do not see why a company would so severely sacrifice data integrity as to choose the iPhone over the Blackberry.
Let's look at a few ideas with which to draw a comparison:
- the iPhone allows both a logical and full physical extraction of it's user partition.
- the iPhone password can be bypassed with a known commercial technique.
- Insofar as data, the iPhone retains vasts amount of data in relatively easy to extract/read format. The use of EnCase and FTK to analyze a physical iPhone partition exposes just how robust the information is.
- there are no commercial techniques to bypass the Blackberry password (yes, I know about BES pwd resets, looking for IPD backups, etc).
- Blackberry does not seem to have jumped on the "app train", pushing out new apps each day. (this is good, no?)
So I ask....beyond being the "new kid with a new toy", why are companies asking about iPhones and security?
Last time I did an iPhone analysis, I mentioned to my colleagues that we ought to be classifying the iPhone analysis the SAME as a full Mac analysis. File structure, artifacts, geo information, Internet History, Email, .... it may just be my .02 cents, but any company with any sense of security ought to give this a very long, hard look before seriously considering an iPhone within their corporate domain.
ps...note to Apple....why has it taken you so long to realize this. (or have you already realized it and simply believe that pushing out "apps" for the home market would be more lucrative? (huh?))
While I understand that the iPhone is constantly increasing the number of "apps" that they carry, I simply cannot find a logical reason why a corporation (who presumably does not want company information/secrets shared with the world) would opt to incorporate the iPhone into it's corporate enterprise.
As recent as last week, I was reminded that many corporations will almost always opt for "availability" over "confidentiality". While I believe that both are important, I simply do not see why a company would so severely sacrifice data integrity as to choose the iPhone over the Blackberry.
Let's look at a few ideas with which to draw a comparison:
- the iPhone allows both a logical and full physical extraction of it's user partition.
- the iPhone password can be bypassed with a known commercial technique.
- Insofar as data, the iPhone retains vasts amount of data in relatively easy to extract/read format. The use of EnCase and FTK to analyze a physical iPhone partition exposes just how robust the information is.
- there are no commercial techniques to bypass the Blackberry password (yes, I know about BES pwd resets, looking for IPD backups, etc).
- Blackberry does not seem to have jumped on the "app train", pushing out new apps each day. (this is good, no?)
So I ask....beyond being the "new kid with a new toy", why are companies asking about iPhones and security?
Last time I did an iPhone analysis, I mentioned to my colleagues that we ought to be classifying the iPhone analysis the SAME as a full Mac analysis. File structure, artifacts, geo information, Internet History, Email, .... it may just be my .02 cents, but any company with any sense of security ought to give this a very long, hard look before seriously considering an iPhone within their corporate domain.
ps...note to Apple....why has it taken you so long to realize this. (or have you already realized it and simply believe that pushing out "apps" for the home market would be more lucrative? (huh?))
Tuesday, May 11, 2010
BackTrack R1 Dev Public Release is out!
I notice that the creators of BackTrack have released "BackTrack R1" version. I didn't read much fanfare about the "unofficial build", but the improved drivers, updated kernel and other programs updated make the D/L worth a try. It appears that many changes are geared towards addressing hardware issues.
Friday, April 30, 2010
Symantec Internet Security Threat Report (April, 2010)
Symantec has published their Internet Security Threat Report - both the Internet Security Threat Report: Volume XV: April 2010 and their Executive Summary. Their annual reports confirms many of the threat vectors we've heard about over the previous months including PDF documents, Active X, web-based attack, etc. Included is browser comparison, and more definitive information related to hacking, phishing, spam and botnets.
I have been looking for information which can be added to a presentation that I can present to various C-Level Executives. Realizing that the focal points of said presentation is inevitably different than that directed at mid-level managers, I found such information within this report. For example, on Pg. 48 of the full document, there is a bar graph detailing New malicious code signatures from 2002 - 2009. The significance is obvious when you look at the graph. The question is however, can we translate this trend into additional resources to enhance IT/Information Security within an organization?
I have been looking for information which can be added to a presentation that I can present to various C-Level Executives. Realizing that the focal points of said presentation is inevitably different than that directed at mid-level managers, I found such information within this report. For example, on Pg. 48 of the full document, there is a bar graph detailing New malicious code signatures from 2002 - 2009. The significance is obvious when you look at the graph. The question is however, can we translate this trend into additional resources to enhance IT/Information Security within an organization?
Thursday, April 22, 2010
Mac OSX Forensics becomes "The Apple Examiner"
For the last few years, MacOSXForensics.com has been a continuing reference source for my Mac-based forensic investigations. The website has now changed names, and moved to The Apple Examiner Website. The site is very nicely laid out, easy to understand and contains information on the newest of Apple technology. I see a new area on iPhone/IPad/IPod.
I've been analyzing some iPhones lately, and instead of focusing on the (logical) information parsed out by Cellebrite and XRY, I've been throwing the images into FTK and EnCase. FTK does a very good job parsing out the PLISTS for examination. If you're more partial to EnCase, there is a PLIST parser on the Guidance Website (created 03/2010 by Simon Key) which can be downloaded from here (you'll likely need an account to log into the Support Portal.) Once these PLISTS have been parsed out, you cannot imagine the information forensically available within an iPhone. I'm doing up some screenshots of how to bring the Physical Image into FTK and EnCase to preview it (you have to change a byte). Of course, I maintain the original, and flip the byte on a copy.
Check out Ryan and Dave's website. If you're interested in Mac Forensics, you HAVE to bookmark this one.
I've been analyzing some iPhones lately, and instead of focusing on the (logical) information parsed out by Cellebrite and XRY, I've been throwing the images into FTK and EnCase. FTK does a very good job parsing out the PLISTS for examination. If you're more partial to EnCase, there is a PLIST parser on the Guidance Website (created 03/2010 by Simon Key) which can be downloaded from here (you'll likely need an account to log into the Support Portal.) Once these PLISTS have been parsed out, you cannot imagine the information forensically available within an iPhone. I'm doing up some screenshots of how to bring the Physical Image into FTK and EnCase to preview it (you have to change a byte). Of course, I maintain the original, and flip the byte on a copy.
Check out Ryan and Dave's website. If you're interested in Mac Forensics, you HAVE to bookmark this one.
Monday, April 5, 2010
MoonSols Windows Memory Toolkit
Matthieu Suiche has "made the move in a new direction" and created a new website and toolkit. His new site/company is MoonSols.
Matthieu states:
Matthieu's WinDD tool has been part of our lab's Incident Response toolset for almost 2 years now. I expect that testing of his toolset will be equally as effective as WinDD.
The continued R&D and commitment of persons like Matthieu (and several others) continue to move our profession forward - almost at a rate that is difficult to keep up with :)
Matthieu states:
MoonSols is releasing his first product called "MoonSols Windows Memory Toolkit". MoonSols Windows Memory Toolkit is the most advanced toolkit for Windows physical memory snapshot management.Two versions are available - Community (free) and Professional (cost).
MoonSols Windows Memory Toolkit had been designed to deal with Microsoft Windows hibernation file (from Microsoft Windows XP to Microsoft Windows 7 in both 32-bits and 64-bits (x64) Editions), Microsoft full memory crashdump (in both 32-bits and 64-bits (x64) Editions), and raw memory dump files (from memory acquisition tools like win32dd or win64dd, or Virtualization application like VMWare). Moreover, MoonSols Windows Memory Toolkit also contains new version of win32dd and win64dd.
Matthieu's WinDD tool has been part of our lab's Incident Response toolset for almost 2 years now. I expect that testing of his toolset will be equally as effective as WinDD.
The continued R&D and commitment of persons like Matthieu (and several others) continue to move our profession forward - almost at a rate that is difficult to keep up with :)
Saturday, March 27, 2010
Windows Memory Analysis - EnScript
I recently tried an EnCase EnScript called "Memory Forensic Toolkit". The tool is used as any EnScript is used, and uses the processes run in Volatility however, within the Windows EnCase environment. The download has three distinct directories for the various Windows OS versions it supports (XP, Win7 and Server2003). From some basic testing, so far the EnScripts (13 or so for each OS Version) have worked as anticipated. My tests using the EnScripts with Vista - not so good (although it does not claim to support Vista). Newest version 1.69 was just released today.
The site is in primarily Japanese CCI: Computer Crime Investigation and appears to be run by Takahiro Haruyama.
Next up...comparing the EnScript results with those produced by running Volatility.
The site is in primarily Japanese CCI: Computer Crime Investigation and appears to be run by Takahiro Haruyama.
Next up...comparing the EnScript results with those produced by running Volatility.
Friday, March 26, 2010
SIFT v2.0
I have been taking SIFT 2.0 for a test drive over the week and notice that the official release has been posted to the SANS Computer Forensics website. The amount of information on this release is incredible. It is quite apparent that Rob Lee has spent considerable time and thought in this update. You will need an account with SANS to be able to download.
There is also a detailed SIFT Tool Listing (download link). The document is very detailed and for those who may be new to SIFT VM appliance, the first few pages may help you get started. An example of the robustness - Volatility has over 50 plug-ins, many programs for Timeline Analysis, artifact and Registry analysis, Data Carving...and the list goes on.
There is also a detailed SIFT Tool Listing (download link). The document is very detailed and for those who may be new to SIFT VM appliance, the first few pages may help you get started. An example of the robustness - Volatility has over 50 plug-ins, many programs for Timeline Analysis, artifact and Registry analysis, Data Carving...and the list goes on.
Subscribe to:
Posts (Atom)