Anti-forensic techniques - Revision history

.FUF: /* Externals Links */

2010-01-08T21:54:44Z

‎Externals Links

.FUF: /* Targeting forensic tool vulnerabilities */

2009-12-19T18:42:05Z

‎Targeting forensic tool vulnerabilities

.FUF at 13:17, 10 September 2009

2009-09-10T13:17:34Z

.FUF: Reverted edits by 2L (Talk) to last revision by Jessek

2009-09-10T13:15:44Z

Reverted edits by 2L (Talk) to last revision by Jessek

2L: Undo revision 9433 by Jessek (Talk) Vulnerability not confirmed/exploit not working

2009-09-10T06:44:20Z

Undo revision 9433 by Jessek (Talk) Vulnerability not confirmed/exploit not working

Jessek: Undo revision 9418 by 2L (Talk) - Why was this link removed? It seems appropriate to the page

2009-09-09T01:42:21Z

Undo revision 9418 by 2L (Talk) - Why was this link removed? It seems appropriate to the page

2L at 15:57, 8 September 2009

2009-09-08T15:57:39Z

Irongeek: Just adding what I hope is a useful link to a video of a class I gave.

2009-08-24T14:59:36Z

Just adding what I hope is a useful link to a video of a class I gave.

N1XY at 10:07, 24 June 2009

2009-06-24T10:07:34Z

Netstat: /* Steganography */

2008-12-30T00:10:56Z

‎Steganography

← Older revision		Revision as of 21:54, 8 January 2010
Line 88:		Line 88:

	* [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques		* [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques
		+
		+	* [http://www.computer-forensics-lab.org/pdf/Linux_for_computer_forensic_investigators_2.pdf Linux for computer forensic investigators: problems of booting trusted operating system]
		+
	[[Category:Anti-Forensics]]		[[Category:Anti-Forensics]]

@@ Line 63: / Line 63: @@
 ==Targeting forensic tool blind spots==
 ==Targeting forensic tool vulnerabilities==
 ==Targeting generic tool/lib vulnerabilities==
 =References=

@@ Line 79: / Line 79: @@
 * [http://ws.hackaholic.org/slides/AntiForensics-CodeBreakers2006-Translation-To-English.pdf Anti Forensics: making computer forensics hard]
-* [http://seclists.org/bugtraq/2008/Nov/0038.html PTK Forensic Local Command Execution Vulnerability]
+* [http://seclists.org/bugtraq/2008/Nov/0038.html PTK Forensic Local Command Execution Vulnerability (fixed in 1.0.1, see CHANGELOG)]
 * [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques
 [[Category:Anti-Forensics]]

@@ Line 78: / Line 78: @@
 * [http://ws.hackaholic.org/slides/AntiForensics-CodeBreakers2006-Translation-To-English.pdf Anti Forensics: making computer forensics hard]
 * [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques
 [[Category:Anti-Forensics]]

@@ Line 78: / Line 78: @@
 * [http://ws.hackaholic.org/slides/AntiForensics-CodeBreakers2006-Translation-To-English.pdf Anti Forensics: making computer forensics hard]
 * [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques
 [[Category:Anti-Forensics]]

← Older revision		Revision as of 14:59, 24 August 2009
Line 81:		Line 81:
	* [http://seclists.org/bugtraq/2008/Nov/0038.html PTK Forensic Local Command Execution Vulnerability]		* [http://seclists.org/bugtraq/2008/Nov/0038.html PTK Forensic Local Command Execution Vulnerability]

		+	* [http://www.irongeek.com/i.php?page=videos/anti-forensics-occult-computing Anti-Forensics Class] Little over 3hr of video on the subject of anti-forensic techniques
	[[Category:Anti-Forensics]]		[[Category:Anti-Forensics]]

@@ Line 19: / Line 19: @@
 ===Overwriting Metadata===
-If the examiner knows when an attacker had access to a Windows, Mac or Unix system, it is frequently possible to determine which files the attacker accessed, by examining file “access” times for every file on the system. Some CFTs can prepare a “timeline” of the attacker’s actions by sorting all of the computer’s timestamps in chronological order. Although an attacker could wipe the contents of the media, this action itself might attract attention. Instead, the attacker might hide her tracks by overwriting the access times themselves so that the timeline could not be reliably constructed.
+If the examiner knows when an attacker had access to a Windows, Mac or Unix system, it is frequently possible to determine which files the attacker accessed, by examining file “access” times for every file on the system. Some CFTs can prepare a “timeline” of the attacker’s actions by sorting all of the computer’s timestamps in chronological order. Although an attacker could wipe the contents of the media, this action itself might attract attention. Instead, the attacker might hide their tracks by overwriting the access times themselves so that the timeline could not be reliably constructed.
 For example, [[Timestomp]] will overwrite [[NTFS]] “create,” “modify,” “access,” and “change” timestamps ([[Metasploi]]t 2006). [[The Defiler’s Toolkit]] can overwrite inode timestamps and deleted directory entries on many Unix systems; timestamps on allocated files can also be modified using the Unix touch command ([[The Grugq]] 2003).

@@ Line 42: / Line 42: @@
 Packed programs that require a password in order to be run can be as strong as their encryption and password. However, the programs are vulnerable at runtime. Burndump is a loadable kernel module (LKM) that automatically detects when a Burneye-protected file is run, waits for the program to be decrypted, and then writes the raw, unprotected binary to another location (ByteRage 2002). Packed programs are also vulnerable to static analysis if no password is required (Eagle 2003).
-===	Steganography ===
+=== Steganography ===
 Steganography can be used to embed encrypted data in a cover text to avoid detection. Steghide embeds text in JPEG, MBP, MP3, WAV and AU files (Hetzl 2002). Hydan exploits redundancy in the x86 instruction set; it can encode roughly 1 byte per 110 (El-Khalil 2004). Stegdetect (Provos 2004) can detect some forms of steganography.
 StegFS hides encrypted data in the unused blocks of a Linux ext2 file system, making the data “look like a partition in which unused blocks have recently been overwritten with random bytes using some disk wiping tool” (McDonald and Kuhn, 2003).
-[[TrueCrypt]] allows a second encrypted file system to be hidden within the first (TrueCrypt 2006). The goal of this filesystem-within-a-filesystem is to allow the [[TrueCrypt]] users to have a “decoy” file system with data that is interesting but not overtly sensitive. A person who is arrested or captured with a [[TrueCrypt]]-protected laptop could then give up the first file system’s password, with the hope that the decoy would be sufficient to satisfy the person’s interrogators.
+[[FreeOTFE]] and [[TrueCrypt]] allow a second encrypted file system to be hidden within another encrypted file system. The goal of this filesystem-within-a-filesystem is to allow the users to have a “decoy” file system with data that is interesting but not overtly sensitive. A person who is arrested or captured with a laptop encrypted using this software could then give up the first file system’s password, with the hope that the decoy would be sufficient to satisfy the person’s interrogators.
 ===	Generic Data Hiding===