Computer Counter-Forensics

By Rodrigo Farnham & Chris Miceli

Concerns on Data

Computer seizure concerns:

Image hard drive Recover deleted files Bypass OS file security mechanisms Swap file, hibernation, filesystem metadata Cookies, Cache, Local Shared Objects (Flash Cookies) Wear leveling on solid state drives

Flash cookies after clearing privacy

Non-holistic solutions

There is software available that scrubs sensitive data from system. Less than ideal because data can remain in unexpected areas

Registry Swap Spotlight database

Concerns on Data

Live acquisition concerns

Image RAM Cold boot attack Firewire Complete memory access Keylogger

Van eck phreaking

Tamper with system Screen Unlock

Beryl, Starcraft

Preventative Measures

To Protect Data

Wipe disks before usage Random fill Shred files Encrypt Wear leveling Encrypt prior to use Make password harder to crack than key

English sentences have surprisingly little entropy, employ caution

Data Encryption

Per-File Encryption

Each file encrypted separately Does not guarantee sensitive material secure
Filesystem encrypts each file Metadata unencrypted Every block written to disk fully encrypted

Filesystem Encryption

Full Disk Encryption

Not a panacea

Concerns on Networking

Network traffic snooping ISP asked for logs Content providers asked for logs Honey pots Man in the middle attacks

Preventative Measures

To Protect Network

Use wireless security

WEP vulnerable to attack WPA vulnerable with TKIP

End-to-end encryption Freenet

Darknet support Can only access Freenet content Plausible deniability Encrypted data store

Gnunet

Preventative Measures

Tor Onion Routing

Access regular internet anonymously Hidden services Possible leak of identity

Flash HTTP Referrer Timing attack Malicious nodes Low latency network vulnerable to timing attacks

Physical Security

Always prevent physical access to resources

Some cryptosystems leave instrumental pieces of code vulnerable to adulteration.

Disable FireWire DMA Dont leave unattended encrypted volumes mounted

Best to have several rings of protection, so that compromises arent all encompassing

Questions?

Resources

http://www.youtube.com/watch?v=JDaicPIgn9U http://www.torproject.org/ http://freenetproject.org/ http://www.truecrypt.org/

Cross platform volume encryption software. Supports full disk encryption on Windows with hidden OS capability

http://md.hudora.de/presentations/firewire/2005-firewirecansecwest.pdf

More information on FireWire exploits