Digital forensics and cybercrime - Appunti

Cybercrime threat landscape

Risk e sicurezza

1. Risk: measure of exposure to damage. It is directly proportional to Vulnerabilities, Assets and Threats: the first two are the only variables that can be controlled.

2. Security is a matter of managing costs according to risk: it makes no sense to adopt a security mechanism that costs more than what is risked.

Threats should be analysed according to 3 dimensions:

• Internal or External.
• Generic or Targeted (our bias suggests us that targeted threats are less effective).
• Financially Motivated or Others (typically Emotions).

a. Financially Motivated attacks/attackers are:

• Easier to predict.
• Easier to defend against => attackers are only moved by economics (pay more than they can earn or risk much, i.e. prison).

Typically, internal attacks are less desirable since security mechanisms are thought for protecting what is inside against what is outside (castle model). As humans we have this bias: we think that the major threats come from outside (this is not true; instead, internal attacks are usually more effective).

In general, targeted attacks are stronger than generic since precisely thought for a certain objective.

Gartner quadrant of threats

Internal threats

• Reckless employee: employee not respecting all the security mechanisms put in place by the company.
• Inside agent: person hired by a company with the exact aim of performing some action from the inside of another company.
• Third-party user: person not from the company that takes advantage of its position in it to perform some action against its security. (consultant, vendors, clients…)
• Emotional employees: employee that perceived something in the wrong way, willing to have a revenge on the company.
• Malicious insider: person taking advantage of his privileges for personal gain.

Data breaches and targeted attacks

Breach reported ≤ breach detected ≤ breach performed.

Reports are always incomplete, but they can be used as a sample to give indications. The reality is different since a large part of compromises are social engineering delivered.

Threat hunting: companies may have a team that analyses possible threats of an organization.

APT: Advanced Persistent Threat, a malware that wants to stay hidden in a network and maintain control.

Financially oriented attacks

Many of the attacks put in place are financially motivated. They could be divided into:

a. Direct monetization

• Bank or credit card frauds: directly steal the money from victim.
• Dialers: almost extinguished, based on premium lines and pay-per-use services that were activated.
• Fake Antiviruses: pop ups that open while navigating that tell the victim he has some virus on his computer. The fake antivirus then requires a payment to remove a virus that has never been there.
• Ransomware.

b. Indirect monetization

• Information gathering.
• Renting or selling botnets.
• Abuse of computing resources.

Ransomware

A ransomware is a type of software that encrypts your device and asks for a ransom (payment) in order to release it.

Ransomwares are made possible by:

• The presence of a widely used operating system.
• Devices storing data that is valuable (at least to the user).
• Digital payments (cryptocurrencies) that are difficult to trace, easy to be performed and not revertible.

CryptoLocker was the first famous Ransomware, to the point that sometimes ransomwares are known as CryptoLockers.

Would it be a good policy to block a company from paying ransoms? Yes, but it could block freedom of getting back to production.

How does the encryption work in ransomware? Encryption does not involve all computer files, but:

• Only some valuable files, images, documents... otherwise the computer is no more usable in order to commit payment and get the decryption key.
• Files are encrypted with a generated symmetric key.
• The symmetric key is encrypted with a public asymmetric key.
• The encrypted symmetric key is attached to files.

In this way the only way to decrypt the files is to have the private asymmetric key to decrypt the symmetric key. Once that is decrypted it can be used to decrypt all files.

Botnet

Botnet: Network of infected computers that are controlled by a Control&Command server. They could be sold or rented and allow to perform attacks such as Denial of Service and more…

Geolocation of IP addresses is never 100% correct. While we are not surprised of finding US and Russia in top positions, China and India are not in expected positions, like Singapore for example.

Malware

Some types of malwares:

• Credential stealer: an example is bank trojans.
• Loader: they do not perform anything except for installing something, typically malwares.
• RAT (Remote Access Tool): they aim to control computers (botnets).
• E-banking trojans: credential stealers targeted to steal banking accounts. (Famous was Zeus).

It’s difficult to collect data about known cybercrimes since there is not enough data.

The area of cybercrime we know better is bank-related attacks since we have data transaction; on the opposite we don’t know anything about targeted attacks on the industrial system (blame culture, no legal obligation to share, no community).

Identity stealing

Identity has a value too! Also, data that are not directly connected to the stealing of money, like social security numbers, is valuable. For instance, it can be used to impersonate someone. These data obviously can be sold.

Cybercrime ecosystem

Cybercrime ecosystem: Cybercrime became so well organized that we can use the term “ecosystem”. It is possible to buy exploit kits, monitor victims, rent and buy botnets, buy installations of a certain software…

There are two main ways to get infected:

• By email (Mass Email Attack).
• Drive-by download: while surfing on the internet, you visit a site that takes advantage of vulnerabilities in your browser to download and install malwares.

Monetization

As in any crime involving money, also in digital crimes money are then required to be converted. Once the criminal has the stolen money from the victim they can:

• Buy something physical with it.
• Buy something digital, such as plane tickets to be sold on ethnical market.
• Use money mules to move them somehow: digitally, through Western Union, or physically, for example with the Nigerian prince scam.

Bitcoin

Bitcoin is an information technology that defines and implements a secure, decentralized payment system and a tool for the storage, verification and auditing of information, including digital representation of values.

The bitcoin protocol defines an overlay network over the internet that mines bitcoins (validates transactions blocks), each node manages a group of addresses that holds coins, each address is a hashed image of an underlying private-public pair of cryptographic keys and acts as a pseudonym of the coin’s holder.

The node’s view of this common state is formed by a so-called Blockchain: a shared, append-only, trustable, ledger of all coin transactions. The limits of distributed consensus defined in the Byzantine Problem and CAP Theorem (consistency, availability, partitioning) are solved using the technique of proof-of-work (using some difficult mathematical problems).

The equivalent of a bank account in BitCoin is the wallet, uniquely identified by an alphanumeric string from 26 to 35 characters that can be used both to receive payments and access transaction’s history.

Bitcoin transaction

The “magic” of the Bitcoins is the fact that there is no central authority. The mining process uses a “competition” mechanism, which is needed to prevent tampering with the transaction history.

How does a transaction work? Every transaction contains the hash of the previous transaction of that account hashed with the receiver public key and signed with the sender private key. The obtained hash is then inserted in the next transaction to prevent tampering.

Blocks and blockchain

A blockchain is a chain of blocks in which each block is reliant on all previous blocks (using hash). In this way changing one block means changing all previous blocks.

The idea to make this “impossible” is to use a very difficult mathematical problem to solve (Mining process):

• Miners must solve a complex mathematical problem to find the next block to append to the blockchain.
• The difficulty of finding the block is proportional to the number of miners competing against one another. Valid block of transaction.

Because lots of work is needed to mine a block, it is statistically difficult to append two concurrent blocks at the top of the blockchain. In case this happens, the longest chain is the one maintained. If someone would ever tamper with the blockchain he would have to mine several blocks faster than every node on the chain to create a longer chain than others. This is very difficult, and it is necessary to control over 51% of the entire computing power of the bitcoin network => highly improbable.

Why would someone use their time and power to insert a transaction in the blockchain? Because they will receive some reward for each mined block.

Anyone in the network can immediately verify the block.

Fork in the chain

1. Fork in the chain.

What happens if two miners find a solution at the same time? There is a fork in the chain.

Let’s suppose that two miners find two different blocks (green and red). Nobody knows exactly what the block is to consider, so it is aleatory. When someone finds the next block, this happens:

Now the blockchain follows a simple rule, the longest chain is the real one. So, in this scenario, the right chain is the correct one, so new blocks have to be attached to that one.

A transaction is confirmed when it belongs to a block at least 6/7 blocks away from the end of the chain.

Bitcoin usage

Bitcoins are often used by cybercriminals to perform illegal transactions because the number of identities that one can have is arbitrarily large.

Contrary to what is commonly believed, bitcoin transactions are perfectly and publicly traceable. However, transactions happen between public/private keys and not between people and keys does not require any sort of identification.

Bitcoins provides then pseudo-anonymity and not anonymity. Moreover, each user has different keys for each transaction, so it is more difficult to “connect the dots”.

How is it possible to track and link transactions to people?

If you have multiple inputs from a transaction they are from the same entity but how to know which addresses are the change? In general, the new ones are the change.

So, it is possible to extract information. For example, if a transaction has multiple inputs, is very likely that the inputs are all owned by the same entity. Often shadow addresses are used for change. Until 2013 a bug in the reference implementation made it deterministic to figure out the shadow address: if you have 2 outputs and one is new, that’s probably the shadow address.

Real example: Silk Road

Silk Road was a dark web marketplace ran by someone under the nickname of “Dread Pirate Roberts”. In 2013 Ross William Ulbreicht was arrested for several crimes related to Silk Road. How was this possible?

• Sign up to silk road.
• Deposit a small amount.
• Note deposit address.
• Track the flow.
• Problem: coins are mixed together by Silk Road with more than 25000 others.
• Solution:
  • Examine with more attention transactions.
  • Analyse the found address over time.

This address is the one that moved more bitcoins in the world in that year.

There are other cryptocurrencies offering stronger anonymity than Bitcoin, but the latter is widely used since it is easy to trade and use them (in the case of ransomware, it should be easy for the victim to pay if the attacker is willing to receive the money.)

Digital forensics

Introduction to digital forensics

Forensics VS Digital Forensics:

• Forensics: application of scientific analysis methods to reconstruct evidence.
• Digital forensics: applying scientific analysis methods on digital data, computer systems and network data to reconstruct evidence.

Forensics is based on evidence. Evidence could be:

• Physical evidence (weapon used to murder, DNA…)
• Witnesses that can declare what they have seen, but often only memory is not trustable as evidence. It is needed something stronger to prove witness’s point.

So, in any nation, not everyone can be called to testify, only witnesses and experts. How can we define what is acceptable as evidence? Since we are computer science experts, we have to propose our scientifically motivated analysis and not opinion.

Daubert standard

Testimony by expert witnesses:

A witness who is qualified as an expert by knowledge, skill, experience, training or education may testify in the form of an opinion or otherwise if:

• The expert’s scientific, technical or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue.
• The testimony is based on sufficient facts or data.
• The testimony is the product of reliable principles and methods.
• The expert has reliably applied the principles and methods to the facts of the case.

The Daubert standard states the conditions under which the testimony of an expert witness should be taken into consideration:

• Relevance: the testimony must be relevant for the case.
• Reliability: the testimony must rest on a reliable foundation (for example methods are correctly applied).
• Scientific: the testimony must be scientific and so objective.

What does “scientific” mean?

Something is scientific when:

• Is repeatable (Galileo): can someone else recreate the same experiment and have the same outcome?
• Is falsifiable (Popper): A theory is scientific if it admits the possibility of refutation and provides a way to test it.

Defining what is scientific, and what is not, is a wide and historical philosophical issue so, for the sake of using “science” in courts, Daubert distinction could be followed.

A testimony is scientific if:

• It is based on scientific techniques or theories generally accepted by the scientific community (scientific consensus).
• It has been subject to peer review and publication (review).
• It is possible to, and it has been tested (testing).
• The test error rate must be clearly stated (test error rate).
• It is provided with the intent of showing a scientific truth and not manipulating the case, trying to provide the proposed testimony (scientific truth).

These factors need then to be evaluated by a judge: the reason for consensus is because that, even if the judge is considered the maximum expert, the reality is that he does not know all.

Investigation

Investigation is divided into 4 phases:

• Source acquisition: process of getting the elements of the source and trying to ensure its integrity.
• Identification: analysis where we try to extract from the sources of evidence the information that we need.
• Evaluation: trying to match the technical information against what needs to be proven in the court.
• Presentation: presenting evidence in court.

Acquisition

Forensics was born in US, so most of the foundational concepts were developed on US laws. This is a problem, because we have a completely different law’s system in Italy/Europe. This is particularly true in the acquisition phase:

• USA Trials are by jury of peers/citizens. The judge gives them laws and guidelines, but:
  • The jury actually decides if one is guilty or not.
• Judge decides if evidence is admissible or not.
  • Example: if a weapon used to murder has been found illegally (robbing it, for example) the evidence is not admissible.
• Evidence follows a “chain of custody”: there is a log/diary to trace whatever happens to evidence. If the chain of custody is broken, the evidence becomes inadmissible.
• Italy/UE Trials is by a judge, not by citizens.
  • It is always the same person that decides. So, also inadmissible evidence can influence judge’s opinion, even if he/she can’t refer to it in a court.
• Evidence is inadmissible if it has been found illegally, but we don’t have a sort of “chain of custody”.
• Applicable international law in Counsel of Europe states: Convention of Budapest on cybercrime.
• Applicable international standards:
  • ISO/IEC 27037:2012.
  • ISO/IEC 27035:2011.
  • They are not mandatory to use.

Digital evidence is brittle: if modified, there is no way to tell. Evidence is not tamper evident.

• It is theoretically possible to create a perfect fake.
  • I can reconstruct files, with timestamps that I want.
  • Example: Garlasco case.

We need procedures that ensure that digital evidence sources become tamper evident.

• Needed to ensure:
  • Legal compliance.
  • Ethical behaviour from all parties.
  • Detection of errors in good faith.
  • Detection of natural decay.

Hashes and digital signatures are used to seal digital evidence.

Hashes ensures identity, authenticity and non-tampered state since the moment the hash was calculated.

• Hashes are not a dogma: you cannot just say “there is no hash” and dismiss everything. Has any other measure been taken? Can we still reconstruct the chain of acquisition?
• Hashes are not magic: computing a hash does not say anything about what happened before the hashing took place.

To be useful, hashes must be either sealed in writing or encrypted to form a digital signature.

Bistream images

In digital forensics we want to acquire a bitstream image, a bit-by-bit clone, of the original media. In this way we don’t lose any information, as it would be by just copying the content.

Basic procedure of acquisition