Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC

Transcription

1 Digital Forensics: The aftermath of hacking attacks AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC

2 Topics Digital Forensics: Brief introduction Case Studies Case I: Data Theft investigations Case II: Disaster Recovery Challenges

3 A brief about Digital Forensics Wikipedia Definition DF is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. Importance facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions. Digital Forensics Branches Computer Mobile devices Network Databases

4 DF Process Collection Extracting Analysis Reporting

5 Topics Digital Forensics: Brief introduction Case Studies Case 1: Data Theft investigations Case 2: Disaster Recovery Challenges

6 Case I: Data Theft A cyber-attacks has been carried out, leading to 2 catastrophic results: Deletion of critical data Theft of critical information. Discovery of the attack... Data loss recovery was done using disaster recovery techniques Theft of critical information was overwhelming!

7 Case I: Data Theft Questions to be answered: What was the attack source For how long the organization have been under attack What data was leaked

8 Case I: Collection Collection Extract Analysis Reporting Utilizing court-accepted network DF tools to monitor and log the traffic. The data was ready to be collected from the network forensics server farm The data collected from the Storage using bit stream image, and digitally signed.

9 Case I: Extract Collection Extract Analysis Reporting The data was fed to a big-data analysis forensics toolkit to be prepared for analysis After 24 hours of data digestion, the data was indexed and ready to be viewed by the specialized teams

10 Case I: Analysis Collection Extract Analysis Reporting Network Team: identifying the source and destination of the suspected traffic Management/Legal Team: to identify the interesting information of the data collected

11 Case I: General Outcome Network Investigation Team Results The initiation of the attack was due an sent from an anonymous to an employee in the IT department containing a photo in the signature. Steganography is used to unhide hidden TOR URL in the Photo, leading to backdoor toolkit. The backdoor toolkit was downloaded and activated by a Trojan horse that was received in an earlier Management/Legal Investigation Team Results Successfully identified all the files used in the transfer. wellknown keywords and phrases are used to identify the data that was illegally transferred the employee who received the files was identified and was referred to the administrative investigation

12 Case I: Reporting and Action Taken Collection Extract Analysis Reporting A legal case filed, and the supporting evidences were transferred to the local court custody Competition is the drive! The competitor organization was prosecuted, case closed in the customers favor.

13 Case I: Computer Sub-investigation The hard disk was extracted from the employee s Computer and placed the in an anti-static bag A two bit-stream images of the hard disk was created using tools such as FTK, MD5 hashes are generated for the bitstream images. Retrieve related data Identifying a relation between the employee and a main competitor company. Case File reports were generated and added to the documents in the lawsuit.

14 Case II: Virus Attack A private bank was infected with MaWin.w32 virus, deleting 1 week of non-backed up sensitive data from 400 computers. Virus formatted Hard disks Digital forensics team is hired to recover the data from all the 400 computers

15 Case II: Methodology Collection Extract Analysis Reporting Imaging 400 infected PCs, storage required is about 80 Terabyte The forensics team removed the infected hard disks, and placed them in anti-static bags and transported them to the forensics laboratory

16 Case II: Extract Collection Extract Analysis Reporting The team of forensics investigators made bitstream images of all the hard disks using tools such as FTK and EnCase.

17 Case II: Analysis Collection Extract Analysis Reporting Data recover possibility analysis Actual Data Recovery. Job done! The team restored all the 5 partitions along with the deleted files to their local C: drive. all recovered files in good condition.

18 Case II: Outcome Collection Extract Analysis Reporting Success of restoration reasons. Restoring all disks following the same procedure. The investigation team investigated the data related to the virus, to identify the source of the virus, and tracked the infection process

19 Case II: Reporting Collection Extract Analysis Reporting The team sent back the hard drives to the bank, along with the report of restoration process, and the report of the infection which showed that it was due to an attachment, which actually was a Trojan horse.

20 Topics Digital Forensics: Brief introduction Case Studies Case 1: Data Theft investigations Case 2: Disaster Recovery Challenges

21 Challenges Technical issues Encryption Increasing storage space New technologies Anti-forensic techniques Accepted standards and legal issues.

22 Jamal Abdulhaq Mobile: