Computer Forensics Analysis

The URL of this document is
http://home.ie.cuhk.edu.hk/~shlam/ssem/for/
Title: Computer Forensics Analysis
Date: 5th October 2000
Time: 14:00 - 16:00
Venue: Seminar Room 833, HSH Engineering Building

Abstract:

This seminar introduces some basic techniques in Computer Forensics. It shows you how to collect evidence without interfering the activities of the inspected system. It also discusses how hackers hide their traces when breaking into a system and the methods to work against it.

Seminar Outline

Part I On-line inspection

Part II Off-line inspection

Part III Recovery and exam of removed files (not from back up tape)

Part IV How hackers cover their traces (live demo)

Part V Q&A, Discussion and Suggestion

References

Part I On-line inspection

Never trust any program or tool at a compromised host because they can be trojaned. Use your own tursted toolkit on floppy or cdrom

Clone the disk and copy data

Memory Dump

Using dd to snasphot the memory 
        dd if= /dev/kmem of=output
        dd if= /dev/mem  of=output

Process Investigation

Collect Network Information

Surveillance

Part II Off-line inspection

Always examin the cloned disk and mount the disk as read only file system

Check the MAC time (modfiy, access and status changed time stamp)

find -mtime|atime|ctime
ls -lt|lut 
csh> find . -mtime -1 -type f -print | xargs ls -l 
-rw-------   1 shlam    daemon     68215 Jun  9 10:10 ./ltrace_0.3.10.tar.gz
-rw-------   1 shlam    daemon     44933 Jun  9 16:10 ./www.hack.com.tar.gz
(find the file that modified lesser than a day)


csh> ls -lut
lrwxrwxrwx   1 shlam    daemon         2 Jun  9 17:52 m5 -> mm
drwxrwxr-x   2 shlam    root         104 Jun  9 17:50 .X11-pipe/
drwxrwxr-x   2 shlam    root         104 Jun  9 17:50 .X11-unix/
drwxrwxrwx   2 root     root         107 Jun  9 17:50 .pcmcia/
drwxrwxrwt   2 root     root         161 Jun  9 17:50 .rpc_door/
drwx--x--x   7 shlam    daemon      1052 Jun  9 17:50 autofs-3.1.5/
drwx--x--x   2 shlam    daemon       683 Jun  9 17:50 forensic/
(list the more recent asscess file and directory)
Note. Do not draw conclusion form MAC time stamp hastily becasue MAC time stamp can be forged easily.

Check the log files

Check the log files (syslog, messages, secure , mail, wtmp, utpmp, lastlog ...) in /var/adm , /var/log. Theese log files location is usually specified in /etc/syslog.conf 
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none              /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  /var/log/maillog

# Everybody gets emergency messages, plus log them on another
# machine.
*.emerg                                                 *

# Save mail and news errors of level err and higher in a
# special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
Note. Log files can easily be erased or forged. Hence, besides looking for anything unusual entries in the log files, we should also look for any abnormal log entry absence.

Check the consistency among your log files too. For example, if your NDIS log file show that there were lots of www traffic to your host, but your host httpd access.log does not show that. Then some of your httpd access.log entries may be erased.

Check if any files are infected

Do not use the IDS which just based on file size and check sum to determine if a file is infected or trojaned because they can be forged; use md5 instead.

Reverse engineering of suspicious program

Part III Recovery and exam of removed files (not from back up tape) 





  od -cx directory

  ils inode

  icat /dev_name inode > outfile


ntec5:/tmp/tt> ls
./  ../  abcdefg  hijklmn


ntec5:/tmp/tt> cat abcdefg
Hello.
This is a testing.
Bla... Bla...  testing

testing


ntec5:/tmp/tt> rm abcdefg
rm: remove `abcdefg'? y

ntec5:/tmp/tt> ls
./  ../  hijklmn


(see the current directory inode)
ntec5:/tmp/tt> ls -i
 198049 ./   160321 ../   198054 hijklmn

(see the file system device)
ntec5:/tmp/tt> df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/hda3              2016044   1463012    450620  76% /

(view the removed file inode)
ntec5:/tmp/tt> icat /dev/hda3 198049|od -cx
0000000   ¡ 005 003  \0  \f  \0 001 002   .  \0  \0  \0   A   r 002  \0
        05a1 0003 000c 0201 002e 0000 7241 0002
0000020   0  \0 002 002   .   .  \0  \0   ¢ 005 003  \0 024  \0  \f 001
        0030 0202 2e2e 0000 05a2 0003 0014 010c
0000040   .   h   i   j   k   l   m   n   .   s   w   p   £ 005 003  \0
        682e 6a69 6c6b 6e6d 732e 7077 05a3 0003
                                      ^^^^^^^^^
                                       (198051) 
0000060 020  \0  \a 001   a   b   c   d   e   f   g   p   ¦ 005 003  \0
        0010 0107 6261 6463 6665 7067 05a6 0003
0000100   Ä 017  \a 001   h   i   j   k   l   m   n   n   .   s   w   p
        0fc4 0107 6968 6b6a 6d6c 6e6e 732e 7077


(retrive the removed by icat)
ntec5:/tmp/tt> icat /dev/hda3 198051
Hello.
This is a testing.
Bla... Bla...  testing

testing


(list the removed inode)
ntec5:/tmp/tt> ils /dev/hda3 198051
class|host|start_time
ils|ntec5|960574486
inum|allocation|uid|gid|m_time|a_time|c_time|dtime|mode|links|size|block0|block1
198051|f|0|0|960574079|960574139|960574162|960574162|100644|0|60|418630|0
                                                            ^^ (links = 0) 

ntec5:/tmp/tt> ls -i
 198049 ./   160321 ../   198054 hijklmn

ntec5:/tmp/tt> ils /dev/hda3 198054
class|host|start_time
ils|ntec5|960574631
inum|allocation|uid|gid|m_time|a_time|c_time|dtime|mode|links|size|block0|block1
198054|a|0|0|960574099|960574099|960574099|0|100644|1|25|418631|0

Part IV How hackers cover their traces (live demo)

Using rootkit

When a system is compromised, hacker can install a rookit (some trojaned program) to hide their activities and traces. 
Linux Root Kit V contains the follow program

bindshell       port/shell type daemon!
chfn            Trojaned! User->r00t
chsh            Trojaned! User->r00t
crontab         Trojaned! Hidden Crontab Entries
du              Trojaned! Hide files
find            Trojaned! Hide files
fix             File fixer!
ifconfig        Trojaned! Hide sniffing
inetd           Trojaned! Remote access
killall         Trojaned! Wont kill hidden processes
linsniffer      Packet sniffer!
login           Trojaned! Remote access
ls              Trojaned! Hide files
netstat         Trojaned! Hide connections
passwd          Trojaned! User->r00t
pidof           Trojaned! Hide processes
ps              Trojaned! Hide processes
rshd            Trojaned! Remote access
sniffchk        Program to check if sniffer is up and running
syslogd         Trojaned! Hide logs
tcpd            Trojaned! Hide connections, avoid denies
top             Trojaned! Hide processes
wted            wtmp/utmp editor!
z2              Zap2 utmp/wtmp/lastlog eraser!
sshd            backdoored sshd-2.0.13
su              backdoored su

Wiping out the evidence

Using stolen accounts

Most hackers run sniffer program to collect user password information. Once they get these user password, they will use these accounts to cover up their activities

Using remote control and cron job

Hacker may use untraceable remote control method (e.g. tfn2k) to control the compromised hosts. They may also automate their control through user cron job

Counter Measures

Part V Q&A, Discussion and Suggestion

References