365 Computer Security Training » Computer Forensics

Top Forensics Tools for Business

admin — Fri, 30 Apr 2010 00:22:47 +0000

Computer or digital forensics is an extremely fast growing and important industry. Digital crimes are becoming more and more commonplace, and organizations need quick and reliable tools to gather and provide digital evidence. Computer forensic teams, whether they are from an organization’s internal team, or from a law enforcement unit, require certain items in their forensic toolkits.

Drive acquisition is a fundamental process in the field of digital forensics, but the acquisition of an entire hard drive must be a forensically sound image that is a flat file bit stream image. Volatile data is extremely valuable evidence that can easily be lost, as it is data that is stored in RAM, a Window’s page file, or other repository that is wiped clean when a computer is shutoff. Both of these items need to have their accuracy guaranteed through hashing, which is basically a digital signature from the original hard drive or volatile data that is matched to the exact mirror image backup of that data. If these hashes do not match, the copy of the data is not considered to be a true, forensically sound copy of the original data.

The following table summarizes details of a handful of the top forensic tools on the market today.

Forensic Tool	Type of Data Searched	Features	Cost
Forensic Toolkit (FTK) by AccessData	Passwords Computer data and files Steganography E-mail	Create images, analyze the registry, conduct an investigation, decrypt files, crack passwords, identify steganography, and build a report all with a single solution. Recover passwords from over 80 applications; harness idle CPUs across the network to decrypt files and perform robust dictionary attacks. KFF hash library with 45 million hashes. Supports the largest, most complex datasets. Never lose case data due to a crash. True multi-processor and multi-threading support that takes advantage of hardware advancements. Automated recovery during pre-processing ensures the job gets done. Easy-to-understand and easy-to-use GUI with pre-defined and customizable data views, advanced filtering, dockable windows and automated data categorization. Multi-data views allowing users to analyze a given file in a number of different ways, such as native, hex, text and filtered.	$2,995 as of 5/1/2008
Helix3 Enterprise by E-fense Carpe Datum	Hard drives w/in the enterprise Any data on enterprise computers or servers Defined data criteria	Electronic data discovery (EDD) and computer forensics, including imaging and examination of hard drives Information Security personnel can monitor each computer or server on the network from a central administration tool when a tiny agent is installed. Helix3 Enterprise simplifies the issues by allowing information security personnel to search for defined data criteria, and either copy the data to a central store or report its presence. Allows you to quickly detect, identify, analyze, preserve and report giving you the evidence to reveal the truth and protect your business.	Former versions were free and open-source, version 3 requires users to contact for individual quote.
EnCase Forensic by Guidance Software	Computer data and files	Acquire data in a forensically sound manner using software with an unparalleled record in courts worldwide. Works on Windows, Linux, AIX, OS X, Solaris and more. Save days, if not weeks, of analysis time by automating complex and routine tasks with prebuilt modules, such as Initialized case and event log analysis. Find information despite efforts to hide, cloak or delete. Easily manage large volumes of computer evidence, viewing all relevant files, including deleted files, file slack and unallocated space. Transfer evidence files directly to law enforcement or legal representatives as necessary. Review options allow non-investigators, such as attorneys, to review evidence with ease. Reporting options enable quick report preparation.	$3,600 for a corporate license, plus support. $2,850 for a government/law enforcement license, plus support.
EnCase Enterprise by Guidance Software	Computer data and files	Allows teams to securely investigate and analyze multiple machines simultaneously over a network, at the disk and memory level. Acquires data in a forensically sound manner, with bit-stream imaging and more. It has an unparalleled record in courts worldwide. Allows for immediate response, limiting impact and system downtime. Works on Windows, Linux, AIX, OS X, Solaris and more. Proactively audit large groups of machines for sensitive or classified information, as well as unauthorized processes and network connections. Silently and invisibly helps to identify fraud, security events and employee integrity issues wherever they are taking place. Finds and corrects zero-day events, injected dlls, rootkits and hidden/rogue processes.	From $25,000 for 1,000 workstations
P2 Enterprise Shuttle Edition by Paraben Corporation	Reactive: all typical functions of a forensics suite	Allows for complete examination and investigation over any network. Drive acquisition, volatile data acquisition, network searching, client snapshot, reporting and more. All monitoring and data acquisition activities are completely invisible to the user, as they run silently and with complete stealth on Windows 2000, XP, 2003, Vista, and 2008 machines. Works with other forensic suites on a network to allow organizations to fully watch over their systems and provide digital evidence when needed. Adheres to strict forensic practices, Sarbanes-Oxley, and many other laws and requirements by ensuring that data integrity is maintained.	$6,995, plus support, as of 4/1/2007
P2 Enterprise Edition by Paraben Corporation	Proactive: all typical functions of a forensics suite, in real-time Reactive: all typical functions of a forensics suite	Live network forensic tool for proactive protection of digital evidence to guard against risks of intellectual property theft, embezzlement, employee lawsuits, or any general insider threat. Drive acquisition, network monitoring, volatile data acquisition, telnet (through the secure proxy server), network searching, client snapshot, P2 Navigator, reporting and more. Rather than waiting to learn of an incident requiring forensics, proactive forensics actually constantly monitors for the occurrence of an incident with an immediate forensic response to ensure evidence is preserved. Proactive capabilities include the ability to monitor and track system logins, running processes, file activity, event logs, network sniffing, hardware monitoring, application installs/uninstalls, data copied to internal systems, deleted activity, and more. Also provides reactive forensics in case the protection was breached, allowing organizations to automatically acquire images, take snapshots, or mount systems. All monitoring and data acquisition activities are completely invisible to the user, as they run silently and with complete stealth on Windows 2000, XP, 2003, Vista, and 2008 machines. Works with other forensic suites on a network to allow organizations to fully watch over their systems and provide digital evidence when needed. Adheres to strict forensic practices, Sarbanes-Oxley, and many other laws and requirements by ensuring that data integrity is maintained.	Requires users to contact for individual quote.
ProDiscover® Investigator by Technology Pathways, LLC	Reactive: all typical functions of a forensics suite	Remotely investigate the disk contents of systems over a network. Stealth operation to avoid detection by users. Preview and search suspect files to find evidence quickly and without altering any data or metadata. Create a bit-stream image of the target system disk and physical memory to preserve evidence and restore the system quickly with MD5, SHA1, or SHA256 hashes of evidence files to prove data authenticity and integrity. Captures volatile data images of RAM, Bios, and CMOS memory to find evidence. Examines multiple disk formats such as any FAT or NTIFS file systems. Integrated viewers for graphics, Internet history, registry, email, documents, and more. Quick and easy to use.	$ 9,995.00 for a single user license, law enforcement and government receive a discount upon contacting.

Based on the various features and types of data searched, if a company were to purchase just one of these tools, it would have to be P2 Enterprise Edition (P2EE) by Paraben Corporation. P2EE offers all of the required functions and features for most forensic teams, while also giving an organization the tools it needs to be proactive in monitoring and storing digital evidence.

However, if an organization truly had no budget limitation, it should purchase:

P2 Enterprise Edition by Paraben Corporation
Forensic Toolkit (FTK) by AccessData
EnCase Enterprise from Guidance Software

FTK provides numerous features that P2EE does not, such as recovering passwords from a plethora of applications, as well as steganography, which many terrorist and child pornography rings use to avoid detection. EnCase Enterprise is very similar to PS Enterprise Edition, so it may simply be overkill to have both, but a larger company should definitely consider it since the cost of running both would be minimal compared to the consequences of one missing something that the other may catch.

By combining these three forensic suites, a digital forensic team would be able to accurately track, monitor, gather, and report digital evidence to any law enforcement or organization that requires it, both proactively and reactively.

Sources:

http://www.accessdata.com/forensictoolkit.html
http://www.e-fense.com/h3-enterprise.php
http://www.guidancesoftware.com/products/ef_index.aspx
http://www.paraben-enterprise.com
http://www.paraben-enterprise.com/p2es.html
http://www.paraben-enterprise.com/p2ee.html
http://www.techpathways.com
http://www.techpathways.com/prodiscoverin.htm
http://www.scmagazineus.com/Forensic-Toolkit-v20/Review/2380/
http://www.scmagazineus.com/Paraben-P2-Enterprise-Shuttle/Review/78/
http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=369&osCsid=2ba225bcdf31dd81d958f939efd173d3
http://www.techpathways.com/order.htm
http://www.scmagazineus.com/Guidance-Software-EnCase-Forensic-v-6/Review/159/
http://findarticles.com/p/articles/mi_m0EIN/is_2002_August_1/ai_89956939/

How to Detect a Rogue Access Point

admin — Tue, 27 Apr 2010 16:12:24 +0000

A rogue access point is any Wi-Fi access point connected to a network without authorization. In order to protect sensitive data, it is critical to prevent the use of unauthorized access points. Since a rogue AP is not under the management of network administrators, nor does it necessarily conform to network security policies, then rogue access points can allow attackers to bypass network security and attack the network or capture sensitive data.

In the absence of a wireless probe to monitor the airwaves, security personnel can manually search for rogue access points. An inexpensive but effective method for finding potential rogues is to use a freely available Transmission Control Protocol (TCP) port scanner that identifies enabled TCP ports from various devices connected to the network.

The steps to discover a rogue access point begin with running the port scanner software from a computer connected to the network. The utility uncovers all Port 80 (HTTP) interfaces on the network, which include all Web servers, some printers, and nearly all access points. The access point will generally respond to the port scanner’s ping with the vendor name and its corresponding Internet Protocol (IP) address.

Once an access point is discovered, the network administrator must determine if the access point is or is not a rogue. Ideally, the administrator would use software that would allow a pre-configured authorized list of access points. If the scanning for rogue access points is manual, a list of authorized access points is still necessary. The authorized list can be populated using the following attributes:

MAC Address
SSID
Vendor
Radio Media Type
Channel

The aforementioned attributes, determined automatically or manually if software is not being used, will alert the detection tool if access points with differing attributes from the authorized list are present.

When rogue access points are determined, the administrator must have procedures in place to identify their locations.

Perhaps the most difficult step in this discovery process is to determine the physical location of the rogue access point. Router table entries may help. A routing table is present on all IP nodes.

The routing table stores information about IP networks and how they can be reached. Because all nodes perform some form of IP routing then any node loading the TCP/IP protocol has a routing table. When an IP packet is to be forwarded, the routing table is used to determine the physical or logical interface used to forward the packet to either its destination or the next router.

With the information derived from the routing table, a rogue IP address may be located by determining which node the address utilizes. Keep in mind that the location of nodes must be correlated with the addresses in the routing table. The limited operational distance of the RF signal can be useful in narrowing down the physical location of the rogue access point as well.

Perhaps the most fundamental step in protecting against a rogue access point may be having a security policy. A security policy should outline the rules against unauthorized wireless devices and employees should be educated about the policy. This will help stop the most common users of unauthorized devices, employees.

Sources:

1. http://compnetworking.about.com/cs/wireless/g/bldef_ap.htm

2. http://www.wi-fiplanet.com/tutorials/article.php/1564431

3.http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/cnet/cnbb_tcp_oauc.mspx?mfr=true

4. http://whitepapers.zdnet.co.uk/0,1000000651,260114539p,00.htm

5. http://www.manageengine.com/products/wifi-manager/rogue-access-point-detection.html

6. http://www.smallbusinesscomputing.com/webmaster/article.php/3590656

7. How to Cheat at Securing a Wireless Network, Chris Hurley and Lee Barken

Best Free Computer Vulnerability Scanners

admin — Tue, 02 Mar 2010 09:37:16 +0000

A vulnerability scanner is a computer program that searches for weaknesses in a computer application, network or the computer itself. Typically there are four types of vulnerability scanners:

Port scanner
Network scanner
Web application security scanner
Computer malware scanner

While it isn’t important to delve into detail about what each of these scanners does, it is extremely important that you understand the weaknesses in your system. The Internet is awash with suggestions about which security scanner would be best for your computer. But don’t worry, these are free! So you can try them all and choose the one you are most comfortable using.

Let’s start with the Nessus Project. This program provides heavy Internet users a free, powerful, and easy to use remote scanner. Nessus scanner can be used throughout an entire enterprise, inside DMZs and across physically separate networks. It is available for a variety of operating systems including: Window, Mac, Linux, FreeBSD, and Solaris.

Next comes the MBSA or Microsoft Baseline Security Analyzer is a free tool to analyze a Window’s computer security configuration. This tool points out the weaknesses in your system AND recommends how to fix them.

GFI LANguard on the other hand analyzes and archives events logs of all machines in a network and alerts you in real time of a security breach. This network and security scanner addresses patch management, network auditing, and vulnerability issues in one package.

Next up is the Tripwire. This is software that checks for major changes in your system. It also monitors key attributes of all files that should not change including binary signature, size, expected change of size etc.

Then there is the Nmap (Network Mapper), which even though is not a vulnerability scanner technically; it helps find potential vulnerabilities that are hiding in plain sight. Nmap is able to fingerprint a network and tell what types of operating systems, applications, versions, firewalls, etc may be running on a network.

Just picking and running a vulnerability scanner is not enough. You have to take time to evaluate the results of the scan and always apply the appropriate remedies. Keep in mind that as useful as these tools are for network administrators to assess the security of their systems, they are also useful for attackers. An attacker uses vulnerability scanners to perform network reconnaissance on a potential target. Their aim is to determine what weaknesses are present that they may be able to exploit and break-in.

How To Tell If Your Computer Is Infected

admin — Thu, 04 Feb 2010 21:55:09 +0000

Do you feel nervous when you log into your bank account? Or have to calculate which credit card can afford to be compromised when you are making a payment or purchase online? Perhaps you feel uncertain whether the personal data you have stored on your computer is truly confidential. Well, perhaps we can ease your fears.

Here are some easy ways to spot if your computer is infected by malware. For your convenience, we will divide the symptoms in two broad categories: Symptoms found during surfing the net and symptoms found while generally working on the computer.

While Internet browsing, your computer may be infected if:

Excessive pop-ups that keep popping up no matter whatever you are browsing. Also if these pop-ups are X-rated, you can be sure that something is not right!
You are greeted with a homepage that you don’t recognize or don’t remember having set it. If repeated attempts at changing the settings fail, you should definitely be concerned.
Your browser crashes unexpectedly or presents error messages mentioning unusual file names.
Browsing speed is slow. But in certain countries owing to a difference in bandwidth, browsing speed maybe naturally slow. What I mean is, if your browsing speed is slower than usual and if you find pages taking an eternity to open, you should definitely scan your computer for infections.
Your bookmarks or your favorites have changed without your knowledge.
The search engine preferences have been changed without your knowledge.

While general use, your computer may be infected if:

Your computer becomes slow, programs do not respond to commands and machine hangs.
You notice unfamiliar icons and shortcuts on your desktop which weren’t there before. Also if there are significant changes in your desktop appearance, color schemes wallpaper, font size etc.
Your computer shuts down unexpectedly.
Your taskbar vanishes.
You notice unfamiliar message boxes.
While shutting down, your machine notifies you that there are ‘other users’ connected to the same network.
Your machine freezes without warning.