Handling Encrypted Evidence & Password Recovery. Nataly Koukoushkina June 2010 CCFC 2010, Workshop

Transcription

1 Handling Encrypted Evidence & Password Recovery Nataly Koukoushkina June 2010 CCFC 2010, Workshop

2 Passware In business for 12 years Offices in USA and Russia Products included in Certified Computer Examiner (CCE) training Passware Kit Forensic Password recovery & decryption for 180 file types and hard disks Scans computers for encrypted data Acquires memory images over FireWire Supports Tableau TACC and GPU to speed up password recovery Supports Distributed Password Recovery Includes USB Portable version

3 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

4 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

5 Stored passwords Internet browsers, etc. Files Passwords Disks Full Disk Encryption Software BitLocker PGP TrueCrypt Hardware

6 No more homegrown encryption Standard and widely accepted encryption algorithms are used Password is hashed, i.e. with SHA1 and then the key is used of encryption (AES) Key strengthening SHA1 is used 10,000 times. Office 2010, WinZip, RAR use SHA1/AES This is secure!

7 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

8 Passware Encryption Analyzer

9 Scans computers and network for password protected files Detects over 160 different file types Scan speed over 4,000 files per minute Detailed reports, lists encryption types and how difficult it might be to decrypt the file

10 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

11 Password (or encryption key) attacks Surprise seizure of the running computer

12 For password attacks with encryption getting more secure it is important to find the weakest link. Same (or similar) passwords are used Find the least secure encryption type first

13 Finding the weakest link: Start with file types that are easy to decrypt Build a good dictionary Use wizard if password pattern is known

14 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

15 Multiple-core CPUs Tableau TACC Hardware Accelerator - x25 GPU-based attacks (nvidia cards) x20 Distributed password recovery

16

17 Multiple-core CPUs Tableau TACC Hardware Accelerator - x25 GPU-based attacks (nvidia cards) x20 Distributed password recovery

18 CPU CPU+GPU MS Office 2007 RAR 3

19 Linear performance scalability Each computer supports CPUs, GPUs, and TACC accelerators simultaneously Uses all types of password recovery attacks

20

21 Know the enemy - find out what is encrypted and how Find the weakest link first it will help to defeat stronger encryption Use the most effective tool both software and hardware

22 Questions? Nataly Koukoushkina +1 (650) x 101 nataly@passware.com /kit-forensic.htm

23 Handling Encrypted Evidence & Password Recovery Nataly Koukoushkina June 2010 CCFC 2010, Workshop

24 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

25 BitLocker Drive Encryption is a full disk encryption feature included with Windows 7/Vista Ultimate and Enterprise, and Server Provides encryption for entire volumes. Also encrypts removable drives BitLocker ToGo. TrueCrypt is a free software application used for real-time encryption. Creates a virtual encrypted disk within a file or an encrypted volume on either an individual partition or an entire storage device.

26 Encryption keys are located in computer memory, while the volume is mounted, even if the computer is locked Passware Kit Forensic: acquires the memory image of the seized hot computer; analyzes the memory image and extracts the encryption keys; decrypts the TrueCrypt volume

27 Preserve the state - do not turn off the computer BitLocker and TrueCrypt keep the encryption keys in memory

28 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

29 Passware Kit Forensic creates a bootable USB flash drive with a portable memory imaging tool (FireWire Memory Imager), which can be used on any computer with a FireWire port Passware FireWire Memory Imager acquires a memory image of the target computer over FireWire port

30

31 Part I. Encrypted Evidence Discovery & Decryption. Overview of encryption types Discovering encrypted evidence Recovering easy and strong passwords Hardware acceleration methods Part II. Hard Disk Decryption. Overview of hard disk encryption Acquiring memory image Decrypting hard disk

32 Extract encryption keys from the memory Decrypt the disk with the keys

33 Original password recovery: Dictionary attack Xieve attack Brute-force attack Previous Passwords attack Any combination of attacks above

34 Don t power off the target computer HD encryption keys are stored in RAM If the computer is shut down, use brute-force password recovery attacks

35 Know the enemy - find out what is encrypted and how Find the weakest link first it will help to defeat stronger encryption Use the most effective tool both software and hardware Don t power off the target computer HD encryption keys are stored in RAM If the computer is shut down, use brute-force

36 Questions? Nataly Koukoushkina +1 (650) x 101 nataly@passware.com /kit-forensic.htm