PRIVACY PROTECTION AND COMPUTER FORENSICS
CONTENTS COMPUTER FORENSICS WHAT IS COMPUTER FORENSICS? WHY IS COMPUTER FORENSICS OF VITAL INTEREST TO YOU? AS AN EMPLOYEE AS AN EMPLOYER OR CORPORATE EXECUTIVE AS A LAW ENFORCEMENT OFFICIAL AS AN INDIVIDUAL AS A LAWYER FOR THE DEFENSE AS AN INSURANCE COMPANY AS A USER OF OTHERS’ COMPUTERS IF YOU HAVE DONE NOTHING ILLEGAL, YOU HAVE NOTHING TO FEAR: NOT TRUE ANYWHERE! COMPUTER FORENSICS USER RIGHTS TO PRIVACY? THE FORENSICS INVESTIGATOR MUST KNOW UP FRONT FORENSICS IS DECEPTIVELY SIMPLE BUT REQUIRES VAST EXPERTISE COMPUTER FORENSICS TOP-LEVEL PROCEDURE FORENSICS SPECIFICS DIGITAL EVIDENCE IS OFTEN EVIDENCE OF NOTHING SELECTED BIBLIOGRAPHY LOCATING YOUR SENSITIVE DATA IN YOUR COMPUTER DELETING DOES NOT DELETE—WHAT DOES? GENERAL DISK WIPING FILE- AND DISK-WIPING SOFTWARE MAGNETIC MICROSCOPY FORENSIC EXAMINATION OF DISKS WHERE IS THE SENSITIVE DATA HIDING? CLUSTER TIPS OR SLACK FREE SPACE THE SWAP FILE SPOOL AND TEMPORARY FILES FORENSICS ON NONMAGNETIC DISKS HISTORY FILES DATA IN THE REGISTRY FILES DATA FROM SLOPPY USE OF PERSONAL ENCRYPTION SOFTWARE NONVOLATILE MEMORY THE SWAP FILE AS A SOURCE OF FORENSIC DATA SECURELY WIPING THE SWAP FILE THE REGISTRY AS A SOURCE OF FORENSIC DATA WHY IS THE REGISTRY A MAJOR SOURCE OF FORENSIC EVIDENCE? WHERE IS ALL THIS PRIVATE INFORMATION HIDING IN THE REGISTRY? BACKING UP THE REGISTRY AND RESTORING A CORRUPTED ONE CLEANING UP SENSITIVE DATA IN THE REGISTRY REFERENCE SPECIALIZED FORENSICS APPLICATIONS DIGITAL WATERMARKING THE BRITISH RIP ACT AND THE US CARNIVORE (DCS1000) HOW CAN SENSITIVE DATA BE STOLEN FROM ONE’S COMPUTER? PHYSICAL POSSESSION OF ONE’S COMPUTER TEMPORARY PHYSICAL ACCESS TO ONE’S COMPUTER COMMERCIAL HARDWARE KEYSTROKE LOGGERS COMMERCIAL SOFTWARE KEYSTROKE LOGGERS GOING ONLINE BY ONE’S ISP OR BY ANYONE HAVING COMPROMISED THE ISP’S SECURITY BY A LEGAL OR AN ILLEGAL TELEPHONE TAP BY REMOTE WEB SITES THAT ONE ACCESSES SPYWARE IN YOUR COMPUTER BY COMMERCIAL SPYWARE AND ADWARE VAN ECK RADIATION USING COMMERCIALLY AVAILABLE SYSTEMS PROTECTIVE MEASURES OPTICAL EMANATIONS AND THEIR INTERCEPTION BEING ON A NETWORK, CABLE MODEM, OR XDSL MODEM OTHER MEANS INSERTION OF INCRIMINATING DATA IN YOUR COMPUTER BY OTHERS SECURITY PROTECTION STEPS THAT DON’T WORK WELL ENOUGH THE FALLACY OF CMOS PASSWORD PROTECTION THE FALLACY OF PASSWORD PROTECTION OFFERED BY POPULAR COMMERCIAL SOFTWARE THE FALLACY OF PROTECTION BY HIDING FILES FROM VIEW THE FALLACY OF PROTECTION BY HIDING DATA IN THE SLACK THE FALLACY OF PROTECTION BY PLACING DATA IN NORMALLY UNUSED LOCATIONS OF A DISK THE FALLACY OF PROTECTING DATA BY REPARTITIONING A DISK FOR A SMALLER CAPACITY THAN THE DISK REALLY HAS THE FALLACY OF PROTECTION THROUGH PASSWORD-PROTECTED DISK ACCESS THE FALLACY OF PROTECTION THROUGH THE USE OF BOOBY-TRAP SOFTWARE THE FALLACY THAT OVERWRITING A FILE REMOVES ALL TRACES OF ITS EXISTENCE THE FALLACY OF ENCRYPTION PROTECTION OTHER PROTECTION FALLACIES THAT DON’T DELIVER REFERENCES WHY COMPUTER PRIVACY AND ANONYMITY? ANONYMITY PRACTICAL ANONYMITY PRIVACY YOU CANNOT TRUST TRUSTE? IS PRIVACY A RIGHT? THE IMPACT OF TECHNOLOGY ON PRIVACY PRACTICAL MEASURES FOR PROTECTING SENSITIVE INFORMATION INSTALLING SECURE WINDOWS RECOMMENDED BEST PRACTICES IF USING WINDOWS NT IF USING WINDOWS IF USING WINDOWS XP HEROIC PROTECTIVE MEASURES REGARDLESS OF THE VERSION OF WINDOWS LAST BUT NOT LEAST ADDITIONAL PRIVACY THREATS AND COUNTERMEASURES INDIVIDUALLY SERIAL-NUMBERED DOCUMENTS ONLINE ACTIVATION AND ONLINE SNOOPING BY SOFTWARE MICROSOFT DOCUMENTS THAT CALL HOME THE NETBIOS AND OTHER THREATS FROM UNNEEDED NETWORK SERVICES TCPA/PALLADIUM THE VULNERABILITY OF BACKUPS PROTECTING SENSITIVE DATA ON HARD DISKS FULL DISK ENCRYPTION ENCRYPTING DISK PARTITIONS BASIC PROTECTION FROM COMPUTER DATA THEFT ONLINE PROTECTION FROM WHICH OF MANY ONLINE THREATS? INSTALLATION OF WINDOWS FOR SECURE ONLINE OPERATION ONLINE SECURITY THREATS AND ISSUES WEB BROWSER HIJACKING THE ROMANTIC E-CARD AND RELATED CON SCHEMES E-MAIL BOMBS SOFTWARE TO ENHANCE ONLINE SECURITY JUNKBUSTER SURFSECRET ASSORTED CLEANERS OF BROWSERS BASIC DO’S AND DON’TS DON’T’S DO’S PRACTICAL MEASURES FOR ONLINE COMPUTER ACTIVITIES NETSCAPE NAVIGATOR/COMMUNICATOR MICROSOFT INTERNET EXPLORER DESIRABLE E-MAIL SOFTWARE CONFIGURATION AND MODIFICATIONS FREE WEB-BASED E-MAIL OFFERS THAT REQUIRE JAVASCRIPT: DON’T! OUTLOOK AND OUTLOOK EXPRESS EUDORA E-MAIL SOFTWARE SECURE E-MAIL CONDUCT ONLINE SELF-PROTECTING E-MAIL ACCESSING E-MAIL FROM ANYWHERE ON EARTH E-MAIL FORENSICS AND TRACES: THE ANONYMITY THAT ISN’T TRACKING SUSPECT E-MAIL SENDING ANONYMOUS E-MAIL: ANONYMOUS REMAILERS GENERAL NETWORK TRACING TOOLS ADVANCED PROTECTION FROM COMPUTER DATA THEFT ONLINE VIRUS/TROJAN/WORM PROTECTION PROTECTION FROM KEYLOGGERS PROTECTION FROM KEYSTROKE-CAPTURING SOFTWARE PROTECTION FROM KEYSTROKE-CAPTURING HARDWARE PROTECTION FROM COMMERCIAL ADWARE/SPYWARE PROTECTION FROM WEB BUGS: AN INSIDIOUS AND FAR-REACHING THREAT USING ENCRYPTED CONNECTIONS FOR CONTENT PROTECTION USING PROXY SERVERS FOR ANONYMITY USING ENCRYPTED CONNECTIONS TO ISPS FOR CONTENT PROTECTION SSL SSH THE FAILED PROMISE OF PEER-TO-PEER CLOUDS CALLER ID TRAPS TO AVOID TRAPS WHEN CONNECTING ONLINE FROM A CELLULAR PHONE TRAPS WHEN USING FTP USING INSTANT MESSAGING SCHEMES PITFALLS OF ONLINE BANKING SECURE USENET USAGE ANONYMITY FROM OTHER USENET READERS ANONYMITY FROM ONE’S IN-COUNTRY ISP USENET PRIVACY IN OPPRESSIVE REGIMES PORTS TO PROTECT FROM SNIFFERS FIREWALLS PERSONAL SOFTWARE-BASED FIREWALLS SOFTWARE THAT CALLS HOME ENCRYPTION INTRODUCTION AVAILABILITY AND USE OF ENCRYPTION OLD-FASHIONED ENCRYPTION CONVENTIONAL (SYMMETRIC) ENCRYPTION PUBLIC-KEY ENCRYPTION ELLIPTIC-CURVE ENCRYPTION VOICE ENCRYPTION ONLINE ATTEMPTS TO CONTROL AGAINST ENCRYPTION LEGAL ISSUES CRYPTO LAWS AROUND THE WORLD CAN ENCRYPTION BANS WORK? SOCIETAL ISSUES TECHNICAL ISSUES COUNTERMEASURES STATE SUPPORT FOR ENCRYPTION THE FUTURE OF ENCRYPTION QUANTUM CRYPTOGRAPHY QUANTUM COMPUTING DNA-BASED ENCRYPTION COMMENTS PRACTICAL ENCRYPTION ENTIRE-DISK ENCRYPTION ENCRYPTING FOR E-MAIL: PGP HOW PGP WORKS DO’S AND DON’TS OF PGP INSTALLATION AND USE THE NEED FOR LONG PUBLIC KEYS THE MAN-IN-THE-MIDDLE PROBLEM DH OR RSA? DSS? SELECTING THE SYMMETRIC ENCRYPTION ALGORITHM A MINOR FLAW IN PGP PGP WEAKNESSES OTHER USES OF PGP ENCRYPTING ONE’S OWN FILES: ENCRYPTED DISK PARTITIONS STEGANOGRAPHY PRACTICAL CONSIDERATIONS IN STEGANOGRAPHY DETECTING STEGANOGRAPHY: STEGANALYSIS OTHER WAYS THAT STEGANOGRAPHY CAN BE DETECTED RECOMMENDATIONS FOR MAINTAINING PRIVACY THROUGH STEGANOGRAPHY PASSWORD CRACKING FILE INTEGRITY AUTHENTICITY: DIGITAL DIGESTS EMERGENCIES PROTECTING SENSITIVE DATA FROM A REPRESSIVE REGIME A WORD OF CAUTION GETTING DISCOVERED AS A DESIRABLE PERSONA LINK ENCRYPTION: VPNS SPLIT TUNNELING IPSEC SUMMARY SECURITY OF WIRELESS CONNECTIVITY: WI-FI AND BLUETOOTH BACKGROUND THE 802 11 TECHNOLOGIES WEP INSECURITY WAR DRIVING AND WAR CHALKING USING WI-FI WHILE TRAVELING WPA BLUETOOTH WIRELESS LINK SECURITY ISSUES BLUETOOTH SECURITY THREATS RECOMMENDED STEPS FOR ENHANCING SECURITY OF BLUETOOTH DEVICES OTHER COMPUTER-RELATED THREATS TO PRIVACY COMMERCIAL GPS DEVICES RF ID DEVICES MODERN VEHICLES’ BLACK BOXES CELL PHONES PREPAID CALLING CARDS CREDIT CARDS INTELLIGENT MAIL FAX MACHINES AND TELEPHONE ANSWERING MACHINES OFFICE AND HOME COPIERS FREQUENT-ANYTHING CLUBS CONSUMER ELECTRONICS BIOMETRICS: PRIVACY VERSUS NONREPUDIATION ARE THEY EFFECTIVE? IT DEPENDS BIOMETRICS CAN BE EASILY SPOOFED IDENTIFICATION IS NOT SYNONYMOUS WITH SECURITY AS AN EMPLOYEE RECENTLY A NORTHWEST AIRLINES FLIGHT ATTENDANT HOSTED A MESSAGE BOARD ON HIS PERSONAL WEB SITE ON THE INTERNET AMONG THE MESSAGES POSTED ON IT BY OTHERS WERE A FEW ANONYMOUS ONES BY OTHER EMPLOYEES URGING COWORKERS TO PARTICIPATE IN SICKOUTS CONTENTS 1 1 WHAT IS COMPUTER FORENSICS? 1 2 WHY IS COMPUTER FORENSICS OF VITAL INTEREST TO YOU? 1 3 IF YOU HAVE DONE NOTHING ILLEGAL, YOU HAVE NOTHING TO FEAR: NOT TRUE ANYWHERE! 1 4 COMPUTER FORENSICS C H A P T E R (WHICH ARE ILLEGAL UNDER U S FEDERAL LABOR LAWS) SO AS TO FORCE THAT AIRLINE TO CANCEL PROFITABLE FLIGHTS DURING THE 1999 CHRISTMAS SEASON INDEED, OVER THREE HUNDRED NORTHWEST AIRLINES FLIGHTS WERE CANCELLED DURING THAT TIME INTERESTINGLY, NORTHWEST AIRLINES OBTAINED PERMISSION FROM A FEDERAL JUDGE IN MINNEAPOLIS TO SEARCH 22 FLIGHT ATTENDANTS’ COMPUTER HARD DRIVES LOCATED NOT ONLY IN UNION OFFICES BUT IN THEIR HOMES AS WELL SO AS TO FIND THE IDENTITIES OF THOSE WHO HAD URGED THE SICKOUTS OTHER COMPANIES, TOO, HAVE SUED IN AN EFFORT TO FIND THE IDENTITIES OF POSTERS OF ANONYMOUS MESSAGES WHOSE CONTENT WAS DEEMED DISAGREEABLE BY THESE COMPANIES; THEY INCLUDE VARIAN MEDICAL SYSTEMS, RAYTHEON, AND OTHERS THE RESULT OF SUCH LAWSUITS IS THAT THE SUING COMPANIES GET THE COURTS TO SUBPOENA COMPUTER RECORDS AND DATA-STORAGE MEDIA; IF WHAT IS SUBPOENAED BELONGS TO A THIRD PARTY (SUCH AS AN INTERNET BULLETIN BOARD), THAT THIRD PARTY OFTEN COMPLIES RIGHT AWAY WITHOUT EVEN BOTHERING TO NOTIFY THE PERSON WHO POSTED THE CONTESTED MESSAGE(S) AS AN EMPLOYER OR CORPORATE EXECUTIVE MANY HAVE HEARD BY NOW OF THE EMBARRASSING, TO MICROSOFT, E-MAIL FOUND THAT MADE REFERENCES TO “CUTTING THE AIR OFF” FROM THE COMPETING NETSCAPE INTERNET BROWSER NUMEROUS OTHER COMPANIES HAD ELECTRONIC FILES SUBPOENAED DURING LEGAL CIVIL DISCOVERY PROCESSES THAT PROVED TO BE DAMAGING TO THOSE COMPANIES; SUCH COMPANIES INCLUDE AUTODESK, WHICH RECEIVED A $22 5 MILLION JUDGMENT IN A CASE WHERE SOME E-MAIL APPEARED TO SUPPORT AN ALLEGATION OF THEFT OF TRADE SECRETS FROM VERMONT MICROSYSTEMS COMPUTER FORENSICS 1 AOL AND MICROSOFT NOTIFY CHAT ROOM POSTERS 14 DAYS IN ADVANCE BEFORE THEY COMPLY WITH A CIVIL SUBPOENA MOST OTHERS GIVE NO SUCH NOTICE 2 THIS IS NOT ENTIRELY ALTRUISTIC ON THE PART OF EMPLOYERS, ALTHOUGH IT CERTAINLY BENEFITS EMPLOYEES WHO NEED TO STAY AT HOME FOR SUCH VALID REASONS AS RISKY PREGNANCIES, ILLNESSES, NEED TO CARE FOR SICK CHILDREN, AND THE LIKE FROM AN EMPLOYER’S PERSPECTIVE, THERE IS LESS NEED FOR EXPENSIVE OFFICE SPACE AND ANCILLARY OFFICE EQUIPMENT SLOPPY DELETION OF EVIDENCE USUALLY HURTS MORE THAN IT HELPS; IN AUTO- DESK’S CASE, EVIDENCE OF PARTIALLY DELETED EVIDENCE WAS FOUND ON AN EMPLOY- EE’S WORK AND HOME COMPUTERS TO SUPPORT VERMONT MICROSYSTEMS’ CASE EVEN EFFECTIVE DELETION OF SUCH ELECTRONIC EVIDENCE IS NOT NECESSARILY A VIABLE WAY OUT EITHER HUGHES AIRCRAFT COMPANY LOST A WRONGFUL TERMINA- TION CASE BROUGHT BY GARRETH SHAW, A FORMER ATTORNEY OF THAT COMPANY, LARGELY BECAUSE OF SOME ROUTINELY DELETED E-MAIL; IN THIS CASE, HUGHES ALLEG- EDLY HAD A POLICY OF ROUTINELY DELETING ELECTRONIC MESSAGES OLDER THAN THREE MONTHS, AND SHAW’S ATTORNEY ARGUED THAT HUGHES SHOULD NOT HAVE DONE SO AFTER IT KNEW THAT IT WAS BEING SUED SPRINT COMMUNICATIONS SETTLED A CASE OF ALLEGED PATENT INFRINGEMENT INVOLVING APPLIED TELEMATICS AFTER A COURT FOUND THAT SPRINT HAD DESTROYED PERTINENT ELECTRONIC EVIDENCE ENCRYPTION OF FILES BY INDIVIDUAL EMPLOYEES IN A MANNER THAT THE COM- PANY CANNOT DECRYPT CAN ALSO GET AN EMPLOYER INTO LEGAL TROUBLE ACCORDING TO JOHN JESSEN, CHIEF EXECUTIVE OFFICER (CEO) OF ELECTRONIC EVIDENCE DISCOV- ERY OF SEATTLE, WASHINGTON, IF ELECTRONIC EVIDENCE IS SUBPOENAED AND A COM- PANY CANNOT DECRYPT IT, THAT COMPANY COULD BE CHARGED WITH “PURPOSEFUL DESTRUCTION OF EVIDENCE ” AN EMPLOYER HAS AN OBVIOUS VESTED INTEREST IN ENSURING THAT NO EMPLOYEE STEALS A COMPETITIVE EDGE THAT EXISTS IN THE FORM OF PROPRIETARY DESIGNS, MARKETING PLANS, CUSTOMER LISTS, INNOVATIVE PROCESSES, AND THE LIKE