INVESTIGATING COMPUTER-RELATED CRIME
CONTENTS SECTION 1 — THE NATURE OF CYBER CRIME CHAPTER CYBER CRIME AS WE ENTER THE TWENTY-FIRST CENTURY WHAT IS CYBER CRIME? HOW DOES TODAY’S CYBER CRIME DIFFER FROM THE HACKER EXPLOITS OF YESTERDAY? THE REALITY OF INFORMATION WARFARE IN THE CORPORATE ENVIRONMENT INDUSTRIAL ESPIONAGE — HACKERS FOR HIRE PUBLIC LAW ENFORCEMENT’S ROLE IN CYBER CRIME INVESTIGATIONS THE ROLE OF PRIVATE CYBER CRIME INVESTIGATORS AND SECURITY CONSULTANTS IN INVESTIGATIONS REFERENCES CHAPTER THE POTENTIAL IMPACTS OF CYBER CRIME DATA THIEVES HOW DATA THIEVES AVOID DETECTION DURING AN ATTACK MASKING LOGINS MASKING TELNET HOW DATA THIEVES “CLEAN UP” AFTER AN ATTACK TECHNIQUES FOR DETECTING FILE READS AND UPLOADS MISINFORMATION DENIAL OF SERVICE DATA FLOODS AND MAIL BOMBS ATTACKS FROM INSIDE THE ORGANIZATION ATTACKS WHICH REQUIRE ACCESS TO THE COMPUTER CHAPTER REVIEW CHAPTER ROGUE CODE ATTACKS VIRUSES, TROJAN HORSES, AND WORMS TYPES OF VIRUSES FILE INFECTOR RESIDENT PROGRAM INFECTOR BOOT SECTOR INFECTOR MULTI-PARTITE VIRUS DROPPER STEALTH VIRUS COMPANION VIRUS POLYMORPHIC VIRUS MUTATION ENGINE DETECTION METHODS PATTERN SCANNERS INTEGRITY CHECKERS BEHAVIOR BLOCKERS TROJAN HORSES WORMS LOGIC BOMBS MODIFYING SYSTEM FILES RESPONDING TO ROGUE CODE ATTACKS VIRUSES TROJAN HORSES AND LOGIC BOMBS PROTECTION OF EXTENDED MISSION-CRITICAL COMPUTER SYSTEMS POST-ATTACK INSPECTION FOR ROGUE CODE SUMMARY REFERENCE CHAPTER 4 — SURGICAL STRIKES AND SHOTGUN BLASTS DENIAL OF SERVICE ATTACKS SERVICE OVERLOADING MESSAGE FLOODING SIGNAL GROUNDING OTHER ATTACKS ATTACKING FROM THE OUTSIDE ATTACKING FROM THE INSIDE DUMPING CORE SYMPTOMS OF A SURGICAL STRIKE PANICS OTHER SURGICAL ATTACKS MASQUERADING USER MASQUERADES SYSTEM MASQUERADES SPOOFING E-MAIL WEB SITE IP SPOOFING CASE STUDY: THE CASE OF THE CYBER SURGEON SYMPTOMS OF SHOTGUN BLASTS “UP YOURS” — MAIL BOMBS FLOODING ATTACKS REFERENCES SECTION 2 — INVESTIGATING CYBER CRIME CHAPTER A FRAMEWORK FOR CONDUCTING AN INVESTIGATION OF A COMPUTER SECURITY INCIDENT MANAGING INTRUSIONS WHY WE NEED AN INVESTIGATIVE FRAMEWORK WHAT SHOULD AN INVESTIGATIVE FRAMEWORK PROVIDE? ONE APPROACH TO INVESTIGATING INTRUSIONS DRAWBACKS FOR THE CORPORATE INVESTIGATOR A GENERALIZED INVESTIGATIVE FRAMEWORK FOR CORPORATE INVESTIGATORS ELIMINATE THE OBVIOUS HYPOTHESIZE THE ATTACK RECONSTRUCT THE CRIME PERFORM A TRACEBACK TO THE SUSPECTED SOURCE COMPUTER ANALYZE THE SOURCE, TARGET, AND INTERMEDIATE COMPUTERS COLLECT EVIDENCE, INCLUDING, POSSIBLY, THE COMPUTERS THEMSELVES TURN YOUR FINDINGS AND EVIDENTIARY MATERIAL OVER TO CORPORATE INVESTIGATORS OR LAW ENFORCEMENT FOR FOLLOW-UP SUMMARY REFERENCES CHAPTER LOOK FOR THE HIDDEN FLAW THE HUMAN ASPECTS OF COMPUTER CRIME AND THE FBI ADVERSARIAL MATRIX CRACKERS CRIMINALS VANDALS MOTIVE, MEANS, AND OPPORTUNITY EVIDENCE AND PROOF LOOK FOR THE LOGICAL ERROR VANITY SUMMARY REFERENCE CHAPTER ANALYZING THE REMNANTS OF A COMPUTER SECURITY INCIDENT WHAT WE MEAN BY A COMPUTER SECURITY INCIDENT WE NEVER GET THE CALL SOON ENOUGH COMPUTER FORENSIC ANALYSIS — COMPUTER CRIMES AT THE COMPUTER DOS DISKS — A BRIEF TUTORIAL SLACK SPACE UNALLOCATED SPACE WINDOWS SWAP FILES AND WEB BROWSER CACHES PROCESSING FORENSIC DATA — PART ONE: COLLECTION COLLECTION TECHNIQUES ANALYSIS TOOLS AND TECHNIQUES CHAINING UNIX AND OTHER NON-DOS COMPUTERS CYBER FORENSIC ANALYSIS — COMPUTER CRIMES INVOLVING NETWORKS SOFTWARE FORENSIC ANALYSIS — WHO WROTE THE CODE? THE LIMITATIONS OF SYSTEM LOGS THE LOGS MAY TELL THE TALE — BUT WHAT IF THERE ARE NO LOGS? MULTIPLE LOG ANALYSIS SUMMARY REFERENCES CHAPTER LAUNCHING THE INVESTIGATION LAUNCHING THE INVESTIGATION ANALYZING THE INCIDENT ANALYZING THE EVIDENCE AND PREPARING YOUR PRESENTATION SECURING THE VIRTUAL CRIME SCENE CLEAR EVERYONE AWAY FROM THE COMPUTER UNDER INVESTIGATION EXAMINE FOR COMMUNICATIONS CONNECTIONS, DOCUMENT ALL CONNECTIONS, AND UNPLUG COMMUNICATIONS FROM THE COMPUTER PULL THE PLUG COLLECTING AND PRESERVING EVIDENCE RULES OF EVIDENCE INTERROGATING AND INTERVIEWING WITNESSES PREPARATION AND STRATEGY THE INTERVIEW ESTABLISHING CREDIBILITY REDUCING RESISTANCE OBTAINING THE ADMISSION DEVELOPING THE ADMISSION THE PROFESSIONAL CLOSE DEVELOPING AND TESTING AN INTRUSION HYPOTHESIS INVESTIGATING ALTERNATIVE EXPLANATIONS YOU MAY NEVER CATCH THE CULPRIT DAMAGE CONTROL AND CONTAINMENT SUMMARY REFERENCES CHAPTER DETERMINING IF A CRIME HAS TAKEN PLACE STATISTICALLY, YOU PROBABLY DON’T HAVE A CRIME BELIEVE YOUR INDICATIONS USING TOOLS TO VERIFY THAT A CRIME HAS OCCURRED UNIX CRASH DUMP ANALYSIS IDENTIFYING THE UNIX RELEASE AND HARDWARE ARCHITECTURE THE MESSAGE BUFFER OTHER UNIX UTILITIES RECOVERING DATA FROM DAMAGED DISKS RECOVERING PASSWORDS