Network Intrusions Responder Program (NITRO). Instructor Guide

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Factor Guessing/Cracking, continued

Possible Artifacts

Possible artifacts of authentication factor cracking or guessing

include:



Large numbers of failed authentication attempts for a single

account, as seen in the logs of the authentication system (e.g.,

The Windows Security Event Log, or the /var/log/secure file

on a Linux or Unix system with SSH).



Failed authentication attempts for one or more non-existent

user account names, as seen in the logs of the authentication

system.



Failed authentication attempts that show a series of passwords

that match a pattern indicative of an attack, such as the “aa”,

“ab”, “ac”, etc. that might be seen in a brute force value set.

Authentication logs do not always record the password that

was entered, but they may be visible in a network sniffer log.



IDS logs referencing a password or authentication attack.



User accounts that are locked out due to an unusually high

number of failures.



A list of passwords or password hashes found in a text file in

an abnormal location.



The presence of password/hash dumping utilities such as

pwdump (pwdump.dll).



Authentication attempts (successful or failed) at abnormal

times, or for which the authorized user of the account does not

recall.

6-36

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Credential Recovery/Reset

Credential

People lose their credentials (i.e., authentication factors). They

Recovery and

tend to forget their passwords, lose their tokens and sometimes

Reset Mechanisms

cannot remember their user names. To account for this, most

authentication systems include a mechanism for either resetting a

user’s credentials to a new value, or for recovering a copy of lost

credentials. These credential recovery and reset mechanisms

include:

 Password reset links on Web sites that allow you to have your

password, or a reset link e-mailed to the address attached to a

given account.

 Password reset links on Web sites that will reset a password if

you know the answer to a “secret question.”

 Help desk staff (available by phone or in person) that will reset

or unlock an account.

 Operating system and directory user account management

interfaces that allow an account with sufficient privilege to

reset the credentials to any other account on the system or in

the directory.

01/09

For Official Use Only - Law Enforcement Sensitive

6-37

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Credential Recovery/Reset, continued

Credential

Examples of credential recovery and reset attack techniques

Recovery/Reset

include:

Attack Techniques

 Requesting a password reset, and then capturing the password

from network traffic as it is sent to the user.

 Registering a domain name previously belonging to another

person, recreating a previously existing e-mail address at that

domain name, and using that e-mail address as an

authentication factor and recipient for reset credentials

transmissions.

 Directly requesting an individual’s credentials, while using

personal information about that individual (birth date, mother’s

maiden name, etc.) as authentication factors necessary for the

reset.

Possible Artifacts

Possible artifacts of attacks against credential reset and recovery

mechanisms include:

 Successful authentication attempts for an account that was

believed to be no longer in use, as seen in the logs of the

authentication system

 Password resets for an account that was believed to be no

longer in use

 Password resets for which the legitimate user of the account

claims to not be responsible

6-38

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Credential Injection

Credential

Almost all systems that include a mechanism for authenticating

Injection /

users and programs also include a mechanism for creating new

Modification

accounts when necessary. If an attacker has access to this

mechanism, he or she can use that mechanism to create new

accounts. Techniques for accomplishing this include:

 Calling a help desk and requesting the creation of an account.

This will usually require that the attacker masquerade as

someone who can legitimately request such an action.

 Using an online mechanism to request an account. This can be

done to gain initial access to information on Web sites that

provide information as long as you register and sometimes pay.

Some Web sites might require that you validate your identify

for registration, using some type of personal information.

Others allow you to input whatever information you choose to

provide.

 Directly creating user accounts using an available

administrative utility (e.g., the Active Directory Users and

Computers console), or by directly inserting them into a list of

users (e.g., /etc/passwd).

Possible Artifacts

Possible artifacts of credential injection and modification include:

 Existence of a user account in an account repository for which

there is no legitimate authorized user.

 Existence of a user account in an account repository that does

not match the account naming convention for the organization.

 Recorded logins of an account for which there is no legitimate

authorized user as seen in OS or application

security/authentication logs.

 Log entries referencing account creation.

01/09

For Official Use Only - Law Enforcement Sensitive

6-39

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Credential Theft

Credential Theft

Authentication factors may also be stolen. Possible techniques

used to accomplish this include:

 Capturing credentials as they are transmitted across a network.

In order to sniff the traffic, this requires that the attacker have

control or be present on one of the network mediums through

which the credentials are sent.

 Tricking an individual into revealing his or her credentials by

contacting the individual in person. For example, an attacker

might claim to be a system administrator or security

representative that needs a user’s credentials for some kind of

troubleshooting or verification.

 Tricking an individual into revealing credentials by sending an

electronic request for the information. For example, an attacker

might send an e-mail that has been falsified to appear to be

from a legitimate bank or online service.

 Physical tokens such as ID cards and USB tokens can be

physically stolen.

Possible Artifacts

Possible artifacts of credential theft include:

 Reports of the theft of physical credentials by a user, or reports

of the disclosure of credentials to someone the user believed

was authorized to request such information.

 Successful authentication requests at abnormal times, or for

which the authorized user of the account does not recall.

 Existence of e-mails in an e-mail repository or logged by a

proxy that include requests for credentials, or links to Web

pages where such requests are made.

6-40

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Strategies - Unexpected Input

Unexpected Input Strategies that use unexpected input to conduct an attack are listed

Strategies

below. Each will be described in further detail on following pages.

 Excessive Input: Sending more input than a system or

application was expecting, or is able to handle.

 Unexpected Input Content: Sending input content that a system

or application will process incorrectly due to the inability to

recognize and/or properly control the input type.

 Unexpected Input Timing: Sending input at times that a

system, application or communication session is temporarily

vulnerable to interference.

01/09

For Official Use Only - Law Enforcement Sensitive

6-41

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Excessive Input

Excessive Input

A basic attack method is to supply an excessive amount of input to

an application, operating system, or network. The effect of this

input could be to simply crash the target. Excessive input could

break a control system and allow the attacker to perform additional

unauthorized actions. Techniques for supplying excessive input

include:

 Buffer Overflow Attacks

 Flooding

Input Size

All attacks that use excessive input to influence target behavior

Validation

take advantage of a lack of input validation. Properly coded

applications should verify that any user-supplied input is of the

proper size, and if not, truncate that input or simply produce an

error message and/or stop the process. Likewise, network devices

should terminate or block all communication from hosts that are

supplying an excessive number of packets or service requests.

6-42

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Excessive Input/Buffer Overflow

Buffers

A buffer is a temporary storage area, usually in RAM, allocated for

the manipulation of data within a process. For example, when

logging into an e-mail server, there might be a 32-character space

for your user name. This limitation is established in the code of the

e-mail server application and controls how much input will be

accepted from the user.

Buffer Overflow

A buffer overflow attack purposely sends an entry too large for the

Attack

buffer to hold. It sends it in such a way that a portion of the entry

is written to the target computer where program instruction code is

stored.

An attacker uses this method to intentionally cause the execution

of his code. The result of this code execution could be anything,

but will often be a denial-of-service, a command terminal session

sent back to the attacker’s computer or the injection of a DLL

(dynamic link library) or other program code into the remote

process.

Possible Artifacts

Possible artifacts of buffer overflow attacks include:

 Unexplained errors in the log files for the application or

service that was attacked. If an OS service was attacked, then

these log entries may exist in the operating system’s main log

files, or supplementary crash logs (such as Dr. Watson).

 Intrusion detection system alerts indicating a buffer overflow,

shellcode or NOOPs.

 Sniffer logs that show large blocks of repetitive data, such as

0x90 or other hex values.

 Sniffer logs that show blocks of data that do not conform to

normal rules for the network protocol being used.

 IDS alerts or sniffer logs showing common post-attack events

such as reverse shells, DLL transfer, OS commands, etc.

01/09

For Official Use Only - Law Enforcement Sensitive

6-43

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Unexpected Input Content / XSS Attacks

Web Scripting

Program code executed in the context of a Web page, either by the

server or the client system, is called a Web script.

Cross-Site

Cross-site scripting occurs when an attacker supplies a script that

Scripting (XSS)

is executed by another system’s Web browser or in another

browser window accessing a different site. There are several ways

of accomplishing this. Possible techniques include:

 An attacker posts a script to a Web site that will permanently

store the script, and serve it to other systems when they request

the Web page to which it was posted. This allows the attacker

to run code in another person’s browser. These are called

“persistent” or “stored” XSS attacks.

 An attacker will embed script in a URL that, if loaded by

another user, will cause a Web server to supply malicious code

to the requesting browser to be executed in the context of the

requested page. These are called “non-persistent” or

“reflected” XSS attacks, and rely upon a user or browser to

load the URL.

Possible Artifacts

Possible artifacts of XSS include:

 IDS alerts referencing an XSS attack.

 URLs containing scripting (such as the presence of the

“<script>” tag), as seen in Web server and proxy server logs,

or in Web browser history.

 Web pages containing embedded scripting, as seen in proxy

server logs where the proxy records full page.

 Unusual character encodings in URLs as seen in Web server or

proxy server logs, or in Web browser histories.

6-44

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Lesson 4 - Entrenchment

Introduction

Continued, undetected control over a compromised system is

required for any extended operations such as data mining and theft,

or further penetration into a larger network.

Purpose of this

The purpose of this lesson is to explain how an attacker retains

Lesson

remote control of a system and hides or removes any traces of that

control.

Objectives

After completing this lesson, you will be able to:

 Explain the goals of entrenchment

 List the major strategies used to conduct entrenchment

 Explain some of the specific techniques that an attacker can

use to maintain remote access and control

 Explain some of the specific techniques that an attacker can

use to hide traces of unauthorized activity

In this Lesson

The following table shows the contents of this lesson.

Topic

See Page

Goals

6-46

Strategies

6-47

Techniques - Log Cleaning

6-48

Techniques - Automatic Execution

6-50

Techniques - Hooking

6-52

Techniques - File Type Manipulation

6-54

Techniques - Naming Conventions and

6-55

Placement

Techniques - Remote Connectivity

6-58

Techniques - File System Date/Time Stamp

6-62

Manipulation

Privilege Escalation

6-63

01/09

For Official Use Only - Law Enforcement Sensitive

6-45

Phases of an Intrusion

Network Intrusion Responder Program

Goals

Entrenchment

The access resulting from a successful attack can sometimes be

Goals

tenuous. A buffer overflow may have resulted in a Windows

command shell back channel that will be lost if the user decides to

shut down or reboot the target system. An attack against Internet

Explorer (IE) may last only as long as the IE window stays open.

Despite these scenarios, an intruder may require extended access

for more extensive operations.

Entrenchment is the process of solidifying access to a

compromised system, and is used in pursuit of the following goals:

 Attack Pivot Point: The attacker requires continued control of

the system to use it as a pivot point from which to attack other

systems and networks.

 Data Theft: The attacker requires continued control of the

system to perform data mining operations on that asset and any

local storage media.

 General Control Maintenance: The attacker wants to maintain

control of the system as an asset for various other uses as

required or for a future undetermined use. For example, an

attacker may simply want to maintain control of a network in

order to disrupt it during a future conflict.

Entrenchment

Regardless of goals above, entrenchment requires that the attacker

Goal Attributes

retain some ability to remotely control or manipulate the target,

and also for that method of control to remain undetected.

6-46

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Strategies

Entrenchment

Activities conducted during entrenchment include:

Strategies

 Log Cleaning: Removing records of unauthorized activities to

hide attacker presence.

 Automatic Execution: Adding configuration changes that will

cause unauthorized programs to start when the host OS boots,

or restart if they are unexpectedly terminated.

 Naming Conventions and Placement: Naming unauthorized

files, processes and configuration changes in such a way that

they appear legitimate or otherwise benign.

 File Type Manipulation: Changing the attributes which identify

a file’s type, such as the signature and extension.

 Hooking: Intercepting calls to the operating system to interfere

with any data returned, such as lists of files or processes.

 Remote Connectivity: Maintaining one or more channels

through which a compromised system can be remotely

controlled.

Entrenchment and

Because of the requirement for persistent control of a

Unauthorized

compromised system, entrenchment activities typically involve the

Code

installation of some sort of unauthorized code. This code will serve

to perform one or more of the functions identified above including

when a human attacker is not currently administering the system.

Common types include backdoors, rootkits and trojans.

01/09

For Official Use Only - Law Enforcement Sensitive

6-47

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Log Cleaning

Log Cleaning

To entrench properly, an attacker must remove records of

unauthorized activity. A common record of unauthorized activity

is a log entry. Log cleaning is the process of deleting individual

log entries, or clearing entire log files to achieve this goal. This

can be done manually, with specific log cleaner malware, or with a

general-purpose rootkit.

Log Cleaning -

The most precise method of log cleaning is to delete individual log

Record Deletion

entries (records) that correspond to the activity that needs to be

hidden. By deleting those records and leaving all others, there is a

better chance that the act of log cleaning will go undiscovered.

Removing individual records is easy with text logs. The attacker

simply needs to open the log in a text editor, delete the associated

lines and save the file. Proprietary log formats are much more

difficult to handle. To remove a record, either the attacker (or his

or her tools) must understand the format of the log, and be able to

identify the beginning and end of each entry. The log viewers that

correspond to proprietary logs (e.g., The Windows Event Viewer)

do not typically include a function for removing an individual line.

Note: If an attacker can open individual records, he or she may

be able to change the content of an individual record

instead of deleting it. This could be used to achieve the

same goals.

Log Cleaning -

An alternative to deleting individual records is to clear an entire

Log Clearing

log. The log file itself is left, but all records within are removed.

This is done in situations where the attacker is in a hurry or does

not have a mechanism for deleting individual records. Some log

viewing applications include a mechanism for clearing all records.

Within the Windows Event Viewer, you can clear a log by right

clicking on the log name and choosing “Clear All Events.”

The downside of log clearing is that it is quite noticeable.

Therefore, record deletion is preferable. You may also find that an

attacker may clear a log when he or she is not as concerned with

hiding the intrusion as with removing any information that can be

used to trace the attack back to its source, although this is not

characteristic of entrenchment.

6-48

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Log Cleaning, continued

Log Cleaning -

In lieu of record deletion or log clearing, an attacker may choose to

File Deletion

delete an entire log file. This is the least desirable of log cleaning

methods, as the deletion of an actual log file is the most noticeable,

and may cause system errors or crashes. It is more useful when

dealing with more obscure log files that are not as likely to be

noticed. For example, an administrator is much less likely to notice

that a Dr. Watson dump log has been deleted than a missing IIS

Web server log file.

Log Cleaning -

Possible artifacts of log cleaning include:

Possible Artifacts

 File system date/time stamps: File system date/time stamps

may be changed during log cleaning. For example, if a log

were cleared, the NTFS last written time would be updated on

a Windows system at the time of the clearing, meaning that the

attacker may have been active on the system at that time.

 Time gaps: Log files that have had specific entries removed

may have abnormal time gaps between remaining entries.

 Empty or completely missing log files

 Log entry recording the deletion: For example, Event ID 517

corresponds to the clearing of all entries in the Windows

Security Event Log for Windows 2000/XP/2003. It is only

added when the administrator user account performs the

deletion.

 Existence of malicious code on a system that includes log

cleaning as one of its functions.

01/09

For Official Use Only - Law Enforcement Sensitive

6-49

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Automatic Execution

Automatically

Computers, especially workstations, are often shut down or

Starting Malware

rebooted. Sometimes they simply lose power. Furthermore,

individual processes are sometimes terminated by anti-virus

software or by a suspicious user or administrator.

Starting Processes

It is extremely common for malicious code to be installed to

at Boot: Registry

automatically start when Windows boots. The main mechanism for

Entries

accomplishing this is by adding a Registry key that will start an

executable file as a new process or load a library into another

process.

There are dozens of Registry keys that can be used to run code.

Some of the more common methods include creating “Run” keys

for executables, installing a new service, or trojanizing a legitimate

service by changing the ServiceDLL key to load a malicious DLL.

See the appendices for a full listing of relevant Registry keys.

Run key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Services:

HKLM\System\ControlSet***\Services\<service_name>\

ImagePath

HKLM\System\ControlSet***\Services\<service_name>\

Parameters\ServiceDLL

*** Represents a number, usually 001, 002 or 003. That number

corresponds to one of the control sets used by the Registry for

configuration. There is a typically a “current control set,” and

another set representing the last known good configuration.

6-50

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Automatic Execution, continued

Directories

During boot, Windows checks certain directories and executes any

files found there. Depending on the version of Windows,

directories that are checked at boot may include:

 C:\Documents and Settings\All Users\Start

Menu\Programs\Startup

 C:\Documents and Settings\<username>\Start

Menu\Programs\Startup

 C:\Windows\Tasks

Job Scheduling

Most operating systems include a mechanism for scheduling

executions to occur with various triggers, usually date/time. For

Microsoft operating systems, this is the Windows Task Scheduler.

For Linux/Unix derivatives, this is the “cron” daemon.

Possible Artifacts

Possible artifacts of malware configured to auto-start include:

 Existence of Registry entries that load unauthorized

executables or libraries

 Unauthorized executables in auto-start directories

 Unauthorized executables specified in an INI file used by

Windows or another automatically started program

 The existence of “.job” files on Windows which represent a

Task Scheduler (Usually found in C:\windows\tasks or

C:\winnt\tasks). The log file SchedLgU.txt also keeps a record

of Tasks Scheduler job executions.

 Entries in the “crontab” file in Linux/Unix derivatives, which

contain a list of scheduled cron jobs.

 Malicious code that is found on the system which adds

automatic start configurations when executed.

01/09

For Official Use Only - Law Enforcement Sensitive

6-51

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Hooking

Hooking

Hooking is the process of intercepting calls from one program to

another to interfere with any data exchanged. This can be used to

hide data such as processes, files and specific file contents.

The OS API

An API is an Application Programming Interface. Operating

systems provide an API in order for programs to run on and

interface with the operating system. Common functions that use

this interface include operations such as:

 Directory listings

 File copy and move operations

 File editing operations

 Network sending and receiving

 Process and thread starting, stopping and enumeration

For example, when you use Windows Explorer to view the

contents of a directory, this is done via a standard API call from

explorer.exe to a Windows OS DLL file.

These operations are common during every day usage of any given

OS. They are important during entrenchment, because these same

API calls can be used to find malicious code. It is therefore

important to prevent these calls from revealing signs of malware

presence.

OS API Hooking Rootkits can be used to hook these API calls by intercepting them

at various points. Sensitive values can then be edited out of any

returned values. For example, a call used to obtain a directory

listing from C:\windows\system32 may be intercepted, and the

name of the unauthorized .exe and .dll files that make up the

rootkit and backdoor programs could then be removed from the

results.

6-52

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Hooking

Possible Artifacts

Possible artifacts of API hooking include:

 OS files that have been hooked through direct modification of

the file on disk will have hashes that do not match those in

hash sets of known-good executables.

 For live systems, the results of API directory listings and

Registry key enumerations can be verified by directly checking

the file system for the same data (e.g., looking for files by

reading the file table itself rather than asking the OS).

Mismatches indicate the potential presence of API hooks in

memory. This technique is used by some rootkit detection

programs such as Rootkit Revealer.

 Discovery of API hooks during the analysis of malicious code

files found on a compromised system.

01/09

For Official Use Only - Law Enforcement Sensitive

6-53

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - File Type Manipulation

File Types

There are many different types of files found on a computer, such

as text files, executables, database files, office documents, etc.

When a user opens a file, the operating system first determines the

file type. Depending on the operating system, this is done by

checking either:

 File Extension: Series of letters at the end of a file name,

separated from the actual name by a period. Used primarily by

Windows variants to determine file type.

 File Signature: Series of bytes in the file, usually at the very

beginning or end, that marks the file type. Used primarily by

Linux/Unix variants to determine file type.

As an example, a GIF image file could be identified either by the

“.gif” file extension, or by the characters “GIF89” found at the

very beginning of the file.

File Type

The attributes that define a file’s type can be manipulated to hide

Manipulation

that file from general searches and from some specific forensic

analysis strategies. Techniques for manipulating file type include:

 Changing the file extension to make the file appear to

Windows or a casual observer as a different file type. For

example, an executable may be disguised by changing its file

extension from “.exe” to “.doc”.

 Changing the file signature to make it appear as a different file.

For example, the “GIF89” at the beginning of an image could

be changed to “MZ” to make it appear to be an executable to

someone conducting file signature analysis.

Possible Artifacts

Possible artifacts of file type manipulation include:

 File signatures that do not match the extension, or vice versa.

 Files that have a matching signature and extension, but which

cannot be read by the appropriate application.

6-54

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Naming Conventions and Placement

Naming

Some of the simplest methods for hiding unauthorized files,

Conventions and

processes and configuration changes are to name them something

Placement

that appears benign or to place them in a location where they are

less likely to be noticed.

Naming

Naming conventions used to hide activity include:

Convention

Strategies

 Giving files/processes the same name as a legitimate file or

process.

 Giving files/processes a name that is slightly modified from the

name of a legitimate file or process. For example, a file may be

named lssas.exe, which is similar to the legitimate file

“lsass.exe.”

 Assigning a name that appears similar to the names of other

files. For example, there are many DLLs in the System32

directory. Most of those DLLs have names that are not

recognizable to most users and administrators. An attacker

could assign an unauthorized DLL a random 8 character name,

and it would probably go unnoticed.

 Use of special characters within names that will either cause

the name to blend in with other files, or will cause the name to

not be rendered in certain interfaces. For example, a directory

could be created named “…”, which would blend in with the

“.” and “..” directories that refer to the current and parent

directories respectively.

01/09

For Official Use Only - Law Enforcement Sensitive

6-55

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Naming Conventions and Placement,

continued

Placement

Placement strategies include:

Strategies

 Placing unauthorized files in a directory where an average user

is unlikely to look.

 Placing unauthorized files named a certain way into a directory

with other files with similar names. For example, DLLs could

be placed into System32 along with many of the other DLLs

found on a Windows system. There they will be more difficult

to identify.

 Using directory names that are normal, but are in the wrong

location. For example, because the name “temp” is commonly

used for directories, a new directory named temp created in

any location would not stand out to most individuals.

 Storing files or file fragments in disk space not currently in use

(slack or unallocated space).

 Fragmenting a file and inserting it into another file in small

amounts so that the host file can still be opened and read

(steganography).

6-56

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Naming Conventions and Placement,

continued

Possible Artifacts

Recognizing naming conventions used to hide unauthorized

activity relies heavily upon your knowledge of what is normal and

not normal within the directory structure and running processes of

an operating system. Common artifacts include:

 File names, Registry keys and process names that appear to be

misspelled or in the wrong location.

 Files with normal names that do not have the appropriate hash

value or file signature.

 A process that seems to be running in more than one instance

when that is not typical, or when a process is a child of itself.

 Abnormal capitalization patterns in names. For example,

Winhex could be spelled wInhex.

 The presence of programs on the system used for file hiding.

 File names and directory locations discovered during the

analysis of malicious code found on a compromised system.

01/09

For Official Use Only - Law Enforcement Sensitive

6-57

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Remote Connectivity

Communicating

For extended operations, an intruder will require dependable

with

access to compromised systems. This could be a legitimate

Compromised

channel that an attacker accesses with stolen credentials or a new

Machines

channel created by the attacker.

Subverting

If available, an attacker can use an already existing communication

Legitimate

channel for remote access to a compromised system. Here are

Communication

some examples:

Channels

 SMB/CIFS and DCE/RPC: Windows file sharing and remote

procedure protocols can be used to move data to and from, or

even configure a remote system. This requires that the attacker

has credentials to that system. This is most useful for

manipulating a system from another device within the same

network, as these protocols are not allowed to traverse most

Internet-facing network perimeters.

 Remote administration applications: Terminal Services, VNC

and Remote Desktop are all examples of applications that

allow someone to open a graphical interface to another system.

The attacker can authenticate to these pre-existing applications

with stolen credentials. Other applications such as SSH and

telnet can also be used to administer a system through a

command line interface.

 VPN tunnels: An attacker can utilize tunnels that already exist

to or from a compromised system to jump to other devices

and/or networks.

6-58

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Remote Connectivity, continued

Remote Backdoors A backdoor is a non-legitimate method for listening for remote

connections from an attacker to a compromised system. This is

typically accomplished by starting a process that listens for remote

connection attempts. That attempt might be a normal TCP

connection attempt, or it may involve a series of packets sent to

specific ports in a specific order which will then cause a full

listening socket to be opened (called “port knocking”).

Outbound

Sometimes, a compromised system may sit behind a firewall that

Initiated Channels

prevents inbound remote connection attempts from reaching the

system. As an alternative to a process listening for inbound

connection attempts, a malicious code package may be configured

to initiate communication outbound from the victim

system/network to an external computer that is controlled by an

attacker (called a “Command and Control Server”). These

connections, called “Reverse Channels,” are frequently successful

due to the fact that firewall egress rules are typically less stringent

than ingress rules.

01/09

For Official Use Only - Law Enforcement Sensitive

6-59

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - Remote Connectivity, continued

Possible Artifacts:

Artifacts of the usage of a legitimate communication channel by an

Legitimate

attacker include:

Channel Usage

 Unusual login times for an otherwise authorized account. They

are shown in authentication logs such as /var/log/secure or the

Windows Security Event Log.

 Login times for an authorized account that the user of that

account claims he/she did not initiate.

 Authentication or subsequent activity that occurs to fast for a

human to be manually directing the activity.

 The existence of malicious code on a compromised system that

includes functions for connecting to remote administration

applications such as SSH or VNC.

Possible Artifacts: Possible artifacts of the usage of unauthorized backdoor listeners

Backdoors

include:

 Abnormal ports open on a system. These may be suspicious

ports that correspond to known backdoors that are visible from

a port scan or from the results of a command such as netstat.

 Suspicious processes attached to a listening port. These may be

viewable from the output of programs such as tcpview or fport.

 Inbound connection attempts to workstations. Connection

attempts blocked by firewalls or routers may show in the logs

of those devices.

 Abnormal patterns of inbound packets or connection attempts.

Again, blocked packets may be recorded in firewall or router

logs. Otherwise this activity would be viewable in a recording

of network traffic.

 The existence of malicious code on a compromised system that

is found to start a listening service when executed.

6-60

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Techniques - Remote Connectivity, continued

Possible Artifacts:

Possible artifacts of the usage of reverse channels include:

Outbound

Channels

 DNS queries for known-bad domain names or DNS hosts, as

seen in the logs of any available DNS servers, or their

upstream forwarders.

 Outbound connection attempts to known-bad or suspicious IP

addresses or IP ranges, which may be seen in firewall logs.

 Outbound connection attempts occurring over abnormal ports,

which may be seen in firewall logs.

 Outbound connection attempts which exhibit abnormal

content. For instance an outbound session that occurs over

TCP port 80, but contains no HTTP headers or HTML. This

may be observed in proxy server logs when traffic is rejected

due to the appropriate content.

 The existence of malicious code on a compromised system that

is found to beacon to a domain name or IP address when

executed.

01/09

For Official Use Only - Law Enforcement Sensitive

6-61

Phases of an Intrusion

Network Intrusion Responder Program

Techniques - File System Date/Time Stamp

Manipulation

File System

An attacker may attempt to hide unauthorized activity by changing

Date/Time Stamp

associated date/time stamps to make it appear as if the activity is

Manipulation

unrelated.

Possible Artifacts

Artifacts of date/time stamp manipulation include:

 Date/time stamps for malicious code executables or DLLs that

match the date/time stamps on Windows files that were created

much earlier than other related activity.

 Date/time stamps for suspicious Registry keys that are set

much earlier than other related activity.

 The existence of malicious code on a system that is found to

modify date/time stamps on files or Registry keys when it is

executed.

6-62

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Privilege Escalation

Escalation/

The Escalation or advancement phase of a network intrusion is

Advancement

where a hacker in possession of a system seeks to elevate

privileges.

What is

Once hackers gain access to a system, they must advance from an

Advancement?

unprivileged user account to a privileged to control the system.

Some of the ways in which privileges are escalated include:

 Through local system attacks

 Cracked or guessed passwords

 Running trojans on the system

Local Attacks

A local attack takes place either sitting directly at the system or

remotely through a command prompt or GUI. A hacker with inside

access has many options available to compromise systems that will

not work over the network. The default installation of most

operating systems has open doors through which attackers can

escalate privileges. These doors are often overlooked, which

makes advancement possible.

Some of the commonly used local attacks are:

 Physical abuse

 Editing the boot.ini to boot another kernel

 Path abuse

 Using boot media (Knoppix, Linux-on-a-Floppy)

 Null connections

 Session Hijacking

Physical Abuse

If hackers can restart a system, they can often boot into a debugger

or recover console, which usually has administrator-level access.

While at this prompt, the hacker can create user names and

passwords, edit access control lists and install programs in start-up

directories that will provide them with administrator-level access

when the system restarts.

01/09

For Official Use Only - Law Enforcement Sensitive

6-63

Phases of an Intrusion

Network Intrusion Responder Program

Privilege Escalation, continued

Boot Prompt

Most operating systems use boot loaders to load their default

Attacks

kernel. The boot loader allows other kernels to be chosen in case

the system has difficulty booting. Accessing boot loader

configuration files can be as easy as pressing a key upon boot.

Path Abuse

A path tells the operating system where to look for programs

required to run. If the default path is changed or appended, hacker

installed programs may be executed.

Boot Media

Booting from a CD can bypass logon screens and directly access

the system allowing for the hacker to search, crack, and extract

passwords. Complete operating systems like KNOPPIX or Linux-

on-a-floppy exist, and if the default boot sequence allows for

booting from a floppy, then placing a Linux-on-a-floppy diskette

into the drive will allow hackers to mount and access the system.

This allows them to swap out and edit files that provide root-level

access.

Null Connections

During the reconnaissance phase, a hacker may have created a null

connection while attempting to run services that provide

administrator-level access. A system administrator may have

blocked these service ports at the firewall, but left them open on

local systems. Simply connecting to these ports with a dummy or

null connection, while at a command prompt, can provide

administrator-level access.

Session Hijacking A hacker sniffing the network traffic can detect when a root user is

connected to the network. He can either interrupt the existing

session or wait until the session is almost terminated and block the

end of transmission signal from being sent.

6-64

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Privilege Escalation, continued

Local Password

Usernames and passwords are the security mechanisms used to

Cracking

authenticate to a system. If this authentication can be bypassed or

defeated the system can be compromised.

Windows systems store encrypted passwords locally in the

registry, and if a hacker can gain access to these files, he can run a

brute force cracking program. A brute force program uses a

dictionary to encrypt words with various encryption algorithms

and seeks to match encrypted passwords with those stored in the

registry.

Many times, hackers have physical access to a system. Having

inside access to these systems might allow hacker control by

simply pressing a key combination to bypass authentication

mechanisms.

Some of the ways that passwords can be defeated on a local

system are:

 Booting from a CD or floppy diskette, extracting the password

files and cracking them offline

 Hijacking a connection with administrator privileges

 Logging onto the system as a service

 Brute force password attacks

 Sniffing clear text passwords

 Change entries in system critical files for services that

authenticate login and login privileges

Some popular password cracking programs are:

 pwdumpX

 Crack

 John the ripper

 L0phtcrack

 LSADump

01/09

For Official Use Only - Law Enforcement Sensitive

6-65

Phases of an Intrusion

Network Intrusion Responder Program

Privilege Escalation, continued

Trojans in

Trojans are programs that pretend to be normal or useful software

Advancement

tools. Many commands used by the system administrator for

system and network control are often trojanized by hackers. They

can also be batch files (.BAT) with the same name as the program

and execute the program along with the Trojan.

Examples of commonly trojanized binary programs are:

 task manager

 login

 ipconfig

 secpol

 dir

 ntbackup

These executables are often trojanized because only the system

administrator has a right to run them. For example, the system

administrator creates a new user and assigns a password, but uses a

trojanized program that captures the password and sends it back to

the hacker.

A Trojan might also sabotage the installation of security patches

informing the system administrator that updates were installed

when in actuality they were not. Such vulnerabilities might allow

the hacker to gain entry though unpatched security holes.

6-66

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Lesson 5 - Infiltration and Extraction

Introduction

Once a hacker becomes entrenched in a system, he uses that

system as a mainstay with which to gather data, mine for useful

information, and launch attacks on other systems.

Purpose of this

This lesson explains how to infiltrate other systems and determine

Lesson

data extraction methods.

Objectives

After completing this lesson, you will be able to:

 Explain the purpose and methods of infiltration

 Explain the importance of trust relationships

 Determine the data types targeted by hackers and how these

types are extracted

In this Lesson

The following table shows the contents of this lesson.

Topic

See Page

Sniffers

6-68

Trust Relationships

6-69

Data Extraction

6-70

01/09

For Official Use Only - Law Enforcement Sensitive

6-67

Phases of an Intrusion

Network Intrusion Responder Program

Sniffers

A sniffer is a program that is used to monitor or capture network

traffic. Hackers often eavesdrop seeking data, like usernames and

passwords that they can use to access other systems. This collected

data is usually stored on the compromised system in a hidden file.

Sniffers often run as disguised processes on systems. Some of the

common ways they run as disguised processes include:

 Trojanzed device drives

 Renamed programs that are configured to start at boot

 Trojanized applications

6-68

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Phases of an Intrusion

Trust Relationships

Trust

A trust relationship is a mechanism whereby users who are logged on

Relationships

and authenticated to one server are allowed to access resources on

another server without the need to re-authenticate.

If server A trusts the users logged into server B, then server A has

established what is called a one-way trust.

If server A trusts server B, and server B trusts server A, then they have

established what is called a two-way or absolute trust.

Server A and B have a two-way trust. Server B also trusts server C.

Server C can now access server A through what is called a pass through

or transitive trust.

Server A ¯ ------- Server B (One way trust)

Server A ¯ -------˘ Server B (Two-way or absolute trust)

Server A ¯ -------˘ Server B ¯ -----Server C (Transitive trust)

Some of the ways in which trust relationships are exploited are:

 Compromising a trusted system, domain or server

 Using or exploiting the LDAP service

 Forging or spoofing authentication credentials

 Spoofing source information

 Piggybacking off an already trusted system

 Hijacking a session from a trusted system

01/09

For Official Use Only - Law Enforcement Sensitive

6-69

Phases of an Intrusion

Network Intrusion Responder Program

Data Extraction

Data extraction is the process of obtaining data off a compromised

system. Hackers must find a way to extract collected data in a

stealthy manner so as to avoid detection. To help avoid detection,

the desired data is filtered for relevancy and sent in a way that will

not overload the system or trigger an IDS.

Hackers know that most traffic loggers, IDS, and sniffers are

configured to only capture the beginning of most packets.

Embedding data deep into packets often allows the hacker to

extract the data without being detected.

Sometimes a hacker will schedule a job to send extracted data

during times when network traffic is heavy. This technique

attempts to avoid detection by using the network traffic volume

against the system administrator; much like trying to find a needle

in a haystack.

Some of the common ways data is extracted include:

 E-mail

 Masked as services like HTTP, DNS or ARP

 Backdoor connections

 Services run on a regular basis

 Ftp or telnet login by the attacker

 A print job run to a remote location or file

6-70

For Official Use Only - Law Enforcement Sensitive

01/09

Course Introduction

Classification

Information contained in this instruction is UNCLASSIFIED.

However, certain methodologies are Law Enforcement Sensitive.

Introduction

NITRO is a three-week course consisting of 14 days of lessons,

incremental practical exams and a final practical exam.

Objective of this

NITRO is designed to introduce the officer to basic network

Course

intrusion investigation techniques.

Learning

After completing this course the trained officer should be able to

Outcomes

successfully conduct a network intrusion investigation.

Course Protocols

Information contained in each section of this student book is

presented in sequential order so that knowledge gained from later

lessons is built on a foundation of what was learned earlier. Other

course protocols include the following:

 Practical exercises - Instructors will provide directives and

handouts for practical exercises completed in the lab.

 Appendices - Include course related materials provided by the

instructors.

Practical Exercises

Practical exercises in NITRO are hands-on. Each exercise is

instructor-directed. In the exercises, students will:

 Perform network wiring and connecting activities

 Conduct manual log analysis

 Use automated log analysis tools

 Perform “Live” network gathering and analysis activities

In addition, every morning the students will have an opportunity to

ask questions and/or review materials discussed on the previous

day. This allows instruction to remain fresh and aids students with

building practical connections to the training.

Network Intrusion Responder Program

Table of Contents

Network Intrusion Responder Program (NITRO)

Table of Contents - Book II

Topic

Page

Module 7 - Report Writing

7-1

Lesson 1 - Defining an Intrusion

7-3

The Forensic Report

7-4

Examiner Notes

7-5

Forensic Reporting

7-6

Title Page

7-8

Items Analyzed

7-10

Relevant Software

7-11

Glossary

7-12

Details of Findings

7-13

Items Provided

7-16

Creating a Hyperlink in Microsoft Word

7-17

Lesson 2 - Cyber Crime Interviews

7-19

Cyber Crime Interviews

7-20

Interview Process

7-22

Module 8 - Legal Issues

8-1

Lesson 1 - Search Warrants

8-3

Search Warrants

8-4

Search Warrant Exceptions

8-10

Consent Searches

8-11

Search Incident to Arrest or Apprehension

8-14

Other Search Warrant Exceptions

8-16

Lesson 2 - Internet Service Providers

8-19

Legal Framework

8-20

Express Consent

8-24

01/09

For Official Use Only - Law Enforcement Sensitive

II-1

Table of Contents

Network Intrusion Responder Program

Topic

Page

Written Consent

8-26

Preservation Letters

8-29

Subpoena

8-30

Search Warrant

8-31

Available Data

8-32

Module 9 - Fundamentals of Log Analysis……………………..9-1

Lesson 1 - Understanding Network Traffic

9-3

Overview of Network Traffic

9-4

Investigation Techniques

9-5

Lesson 2 - The Scientific Method and Intrusion Analysis

9-9

Overview of the Scientific Method

9-10

Digital Forensic Analysis and the Scientific Method

9-12

Lesson 3 - Observing Intrusion-related Activity and Generating a Hypothesis . 9-15

Common Observations

9-16

Hypothesis Formation

9-19

Incident Classification

9-21

Lesson 4 - Predicting the Nature and Location of Intrusion Artifacts

9-25

Predicting the Nature and Location of Intrusion Artifacts

9-26

Relating Observed Events to Network Services and Traffic Types

9-27

Mapping Observed Activity to Traffic Flow

9-29

Using Traffic Flow and Service Type to Predict Artifact Location

9-33

Lesson 5 - Using Log Analysis to Evaluate an Intrusion Hypothesis

9-37

Hypothesis Evaluation

9-38

Acquiring Target Log Files

9-39

Reviewing Target Log Formats

9-40

Establishing Search/Extraction Criteria

9-41

Searching Target Logs and Extracting Relevant Data

9-42

Recording and Correlating Findings

9-43

II-2

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Table of Contents

Topic

Page

Keeping Track of New Leads

9-45

Module 10 - Log Sources

10-1

Lesson 1 - Windows Log Sources

10-3

Windows Logs

10-4

Windows Services Logs

10-6

Lesson 2 - Linux Log Sources

10-9

Linux Logs

10-10

Lesson 3 - Solaris Log Sources

10-13

Solaris Logs

10-14

Lesson 4 - Log Searching

10-15

Log Searching

10-16

Regular Expressions

10-17

Regular Expressions: Literal Characters

10-18

Lesson 5 - IDS Logs

10-19

IDS Logs

10-20

Module 11 - Log Analysis

11-1

Lesson 1 - Binary Traffic Analysis

11-3

Introduction to Wireshark

11-4

Converting Binary Logs to Text Format

11-5

Filtering and Searching in Wireshark

11-6

Filtering Data during Capture with Wireshark

11-7

Filtering Displayed Data in Wireshark

11-8

Colorizing Data Using Filters in Wireshark

11-14

Searching in Wireshark

11-16

Generating Statistics with Wireshark

11-17

Exporting Data from Wireshark

11-22

Lesson 2 - Manual Log Analysis

11-23

Filtering and Searching Text Logs

11-24

Deciding What to Search For

11-25

01/09

For Official Use Only - Law Enforcement Sensitive

II-3

Table of Contents

Network Intrusion Responder Program

Topic

Page

Example Log

11-26

Lesson 3 - Automated Log Analysis Tools

11-29

What is Sawmill?

11-30

Installing Sawmill

14-31

Network Log Analysis Using Sawmill

14-38

Module 15 - LiveWire Investigations

12-1

Lesson 1 - Data Collection

12-3

Locating Physical Devices

12-4

Attaching Storage Equipment

12-6

Lesson 2 - Introduction to LiveWire

12-9

Live Digital Investigations

12-10

LiveWire Installation

12-13

LiveDiscover Installation

12-14

Updating LiveWire

12-16

Updating LiveDiscover

12-17

LiveWire Initial Setup

12-19

Lesson 3 - LiveDiscover

12-31

LiveDiscover Network Scanning

12-32

Lesson 4 -Volatile Data Analysis

12-39

LiveWire Initial Inquiry

12-40

System State

12-49

Current User Activity

12-55

Active Network State

12-68

Lesson 5 - Evidence Collection

12-73

File System Status

12-74

Physical vs. Logical

12-78

Collection and Preservation

12-84

Hashing

12-88

Lesson 6 - Malicious Code Analysis

12-93

Malicious Program Search

12-94

II-4

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Module 7

Report Writing

Overview

Investigations require comprehensive reporting that documents

actions and summarizes findings. The best reports are clear,

concise, accurate, and report only information relevant to the facts

of the case.

Purpose of this

The purpose of this module is to introduce you to an acceptable

Module

format and strategy for reporting. You will learn how to

summarize the steps and findings of an investigation involving

digital data.

Objectives

After successfully completing this module, you will be able to:

 Discuss the importance of writing an organized, clear, concise

and accurate report

 Write an organized, clear, concise, and accurate report

 Discuss appropriate questions and interviewing techniques for

computer crimes

In this Module

The following table lists the contents of this module.

Lesson

See Page

Lesson 1 - General Report Writing Techniques

7-3

Lesson 2 - Cyber Crime Interviews

7-19

01/09

For Official Use Only - Law Enforcement Sensitive

7-1

Network Intrusion Responder Program

Report Writing

Lesson 1 - General Report Writing Techniques

Introduction

Forensic reports involving the analysis of digital evidence should

address the same basic information. No matter how well an

investigator conducts analysis, it is of little value if results cannot

be reported in an organized, clear, complete and concise manner.

Purpose of this

The purpose of this lesson is to provide guidance for generating a

Lesson

document to report the forensic analysis results of digital evidence.

Objectives

After completing this lesson, you will be able to create a forensic

report that:

 Discusses the purpose and need for forensic analysis

 Explains what physical and/or logical evidence was analyzed

 Defines programs, terms, and their relevance

 Explains findings in an orderly manner

 Associates relevant evidence with users

In this Lesson

The following table lists the contents of this lesson.

Topic

See Page

The Forensic Report

7-4

Examiner Notes

7-5

Forensic Reporting

7-6

Title Page

7-8

Items Analyzed

7-10

Relevant Software

7-11

Glossary

7-12

Details of Findings

7-13

Items Provided

7-16

Creating a Hyperlink in Microsoft Word

7-17

01/09

For Official Use Only - Law Enforcement Sensitive

7-3

Report Writing

Network Intrusion Responder Program

The Forensic Report

Introduction

The forensic report is the culmination of a process often involving

intensive and painstaking work. It should reflect the time, effort

and professionalism involved in building the case and acquiring

the information. No matter how overwhelming conclusive the

evidence is in determining guilt or innocence, if the evidence is not

presented in an organized, clear and concise manner, it may be of

little use to its intended audience.

Ultimately you should consider the report a reflection of yourself,

your skills, attention to detail, experience and work ethic. In this

respect, the report is much like a resume. It deserves the same

attention that you would put into the development of your resume.

The report should be well organized, include only relevant

information, and be free of grammatical, punctuation and spelling

errors. The recipient should be able to read it one time and have a

very clear understanding of the message you are trying to convey.

If the reader cannot do that your forensic report may disregarded

or discarded.

The consequences of such a fate for a resume are obvious but the

impact is limited to the individual. The consequences of that

happening to a forensic report could be far more reaching. If the

evidence to convict a child predator was apparent but discarded for

lack of organization and presentation the consequences could be

felt by an innocent child or many children in the future.

Again, consider the report a reflection of your professionalism and

develop it as such. It is a professional document and could very

well be one of the most important reports you will ever write.

7-4

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Examiner Notes

Importance of

The documentation that is created during the analysis process

Documentation

provides the basis for the examiner to report the results of the case.

Remember, all written notes and documentation created during the

investigation should be preserved and may be discoverable in

court.

Examiner notes taken during the execution of a forensic

examination along with the final report of your findings are the

foundation on which many digital media-related cases are built.

Note Taking

Note taking is an essential part of a forensic examination. Your

notes help create a document that will provide a record of all of the

procedures and processes performed. The examination notes

should present a clear timeline of the actions taken and the results

of those actions. For example:

January 15th, 2008

0800 - Performed a signature check on the suspect media, Item

#1, Partition1, NTFS, 6.0GB. There were a total of 243 file

signature mismatches identified.

0835 - Reviewed signature mismatched files and found 23 files of

interest …

0900 - Used Adobe Photoshop 8.5 to review image files for

existence of layered images. None were found.

Properly recorded notes provide a repeatable roadmap of your

examination. Another examiner should be able follow your notes

to reproduce the same results obtained in the original exam.

You should number, date, and initial all note pages using the [page

#] of [total # of pages] numbering schema to account for all note

pages. It is not uncommon for extensive periods of time to pass

between the time of the examination and prosecutorial action.

Thorough note taking will help ensure that you can accurately

testify to actions taken during the examination. When taking

examiner notes, always follow the rule, “If it wasn’t documented,

it didn’t happen.”

01/09

For Official Use Only - Law Enforcement Sensitive

7-5

Report Writing

Network Intrusion Responder Program

Forensic Reporting

Introduction

A forensic analysis report should contain all of the relevant

evidence that you find during your examination. Your final report

must clearly identify persons related to the examination including

you, the requestor, suspects, and any other pertinent individuals.

Your report should:

 Provide details about the purpose for the forensic analysis

 Describe the physical and/or logical evidence analyzed

 Define related programs, terms and their relevance

Most importantly, the forensic report must clearly and concisely

explain the items of evidentiary value that were found on the

suspect media as a result of your analysis. It must also identify the

location and relevance of the items of evidentiary value as relating

to the reason for the analysis and/or the investigation.

Report Contents

Each completed forensic report should always contain the

following information, although the headings used within your

report may vary from organization to organization:

 Report heading

 Support requested, reason or purpose for analysis

 Summary of findings

 Digital media analyzed

 Analysis/Suspect Software Listings

 Glossary of Technical Terms

 Detail of Findings

 Items Provided

Your forensic report should define all technical terms using

common language that non-technical investigators and prosecutors

can understand. It should clearly indicate relevant items you

discovered, how they were discovered, where they were located,

and how the evidence relates to the case and/or investigation.

7-6

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Forensic Reporting, continued

Note Taking

It is important to distinguish between note taking and reporting.

versus Reporting

The forensic report is the final result of your analysis and its focus

is to respond to the allegations or charges that led to the

investigation, defined by:

 The request or purpose for the analysis

 Information compiled as the case progressed including search

authorization documents

 Information provided by other sources, legal, victims, and

informants

 Your experience as a forensic examiner

The report should include those items that directly relate to and are

relevant to the allegations or charges in the request for analysis.

Notes, however, should include references to all steps taken by the

analyst during the examination with either positive or negative

results. The primary goal of note taking is to document all steps

taken as well as to serve as a chronicle of the examination. It may

be used as a reference later during prosecution.

01/09

For Official Use Only - Law Enforcement Sensitive

7-7

Report Writing

Network Intrusion Responder Program

Title Page

Contents of the

The title page provides an overview of the case, including:

Title Page

 Report Header

 Support Requested

 Current Case Status

 Summary of Findings

Description

In the table below, you will find standard information that should

be included in the title page of all reports. A sample report follows

this chart.

Item

Description

Title (To:)

Indicates report’s recipient and date. This

information is usually directly related to the

charging document or request for service.

From

Identifies report’s author, including name,

organization, and contact information.

Subject

Indicates the type of work performed, as well as

any suspect and/or local case reference

information.

Support

Concisely states what charges or allegations

Requested or

were addressed by the analysis, charging

Purpose for

jurisdiction or entity, with regard to a specific

Analysis

investigation.

Status

Indicates the current case status, usually Open

or Closed. This may change the nature from a

report to a status update.

Summary of

A short narrative describing the type and nature

Findings

of any evidentiary items located during analysis

with respect to the specific allegations or

charges. The failure to locate items that support

the allegations should also be indicated here, as

well as items that may exonerate.

Footer

Includes author’s name, title/rank, and a

“Released” field for approval signature. Footer

may include a legal disclaimer. All pages of the

report should be numbered in the Page X of X

format.

7-8

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Title Page, continued

Title Page Example

Computer Forensic Analysis Report

MEMORANDUM FOR Trooper William Barksdale, MD State Police

January 30, 2008

FROM:

Trooper Michael Ghaler, Forensic Examiner

MD State Police Forensics Laboratory

Pikesville, Maryland 21208-3899

SUBJECT:

Forensic Media Analysis Report

Subject(s):

John M. Smith

Born:

October 11, 1960

Case Number:

2008-0123A

1. Support Requested

Trooper Barksdale, MD State Police requested the examination of the submitted digital media

seized as the result of an ongoing criminal investigation related to the theft and subsequent sale of

weapons from a U.S. Army facility in Baltimore, Maryland. The request asked that the submitted

media be examined for any evidence related to the theft and/or sale of explosives, particularly C4,

and the existence of possible co-conspirators who participated in, or facilitated the unlawful activity.

2. Status: Pending (or closed)

3. Summary of Findings

The examination of submitted media, which was conducted during the period of 2008/01/14 and

2008/01/18 resulted in the discovery of numerous image files depicting the type of explosives

indicated in the Request for Analysis. A number of the image files also showed the suspect,

SMITH, in possession of the materials. Additionally, a review of Internet activity resulted in the

discovery of a number of instances where the suspect’s computer was used to access Internet

auction sites in an attempt to sell explosive materials. While the suspect received numerous email

correspondences from individuals apparently responding to his auction advertisements and

participated in newsgroup conversations regarding the sale of explosives, little information was

found which indicates the existence of a conspiracy between the suspect and any other individuals

in this activity.

Trooper Michael Ghaler

Computer Forensic Analyst

Released by: ______

01/09

For Official Use Only - Law Enforcement Sensitive

7-9

Report Writing

Network Intrusion Responder Program

Items Analyzed

Introduction

The Items Analyzed section of the report describes in detail the

analyzed physical and/or logical evidence. It should always

include the original and verified hash values of all evidence items.

Physical Items

The Items Analyzed section of the report may contain a reference

to the actual physical evidence. Give a detailed description,

including:

 Manufacturer

 Model, serial, and part number (when possible)

 Item description

 Any specific markings

Logical Items

The Items Analyzed section of the report details images sent to

you for analysis as well as any “original” evidence items you may

receive for examination. In addition to listing the physical

containers, you should also list the image files. Do this by original

file name and include any hash or other validation mechanism. An

example follows.

Items Analyzed Example

Items Analyzed

Tag # 01 Western Digital Caviar 31600 Hard Drive

Serial #: WT2891586134

Size: 40GB

Hash Provided: 1234567890ABCDEF1234567890ABCDEF

Tag # 02 One Memorex DVD-R disk containing image files derived from a Fujitsu

M1636TAU Hard Drive, Serial #: 08613105, Size: 1226MB:

Suspect_dvd.e01

Suspect_dvd.e02

Suspect_dvd.e03

Suspect_dvd.e04

Hash Provided: ABCDEF1234567890ABCDEF1234567890

Verified Hash: ABCDEF1234567890ABCDEF1234567890

Hash values indicated above are for the entire device image. Individual file hash

values were not provided.

7-10

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Relevant Software

Introduction

This section of the report identifies the software found on the

evidence media that is relevant to the case as well as the identity of

forensic software used to perform the examination.

Analysis Software

List all software applications used during the forensic examination

to process or analyze the suspect media, including the primary

analysis tool. Be sure that all applications in this listing include the

appropriate software version information and a brief description of

the software’s functionality or use.

Suspect Software

Identifying the software on a suspect’s machine is a necessary

component of the case. Also include any software that may have

created and/or interacted with data of evidentiary value located

during the forensic examination. Include any software that you can

identify as being deleted from the suspect’s machine. Pay

particular attention to software which is commonly used to hide

data or securely erase data from the device. Each software listing

should include the:

 Software name and version

 The full path to where the application was located on the

suspect media

 A brief description of the program functionality and how it

relates to the Request for Analysis and/or investigation

 You should be prepared to further explain items in this listing

during prosecution

Relevant Software Example

Analysis Software:

Program Name/Version

Program Description

LiveWire Investigator 2007

Live Forensic Analysis Suite

Sawmill Professional 7.2.14

Forensic Log Analysis Tool

Suspect Software:

Program Name/Version

Directory Location

Program Description

AOL Instant Messenger

C:\Program Files\AIM

Internet Chat Application

Microsoft Internet Explorer

C:\Program Files\Internet Explorer

Internet Browsing

Application

Microsoft Outlook Express

C:\Program Files\Outlook Express

Email Application

01/09

For Official Use Only - Law Enforcement Sensitive

7-11

Report Writing

Network Intrusion Responder Program

Glossary

The Glossary defines any technical terms, document formats, and

procedure details referenced within your report that may not be

readily understood by the average non-technical reader. Only

define the terms that are integral to the understanding of your

examination findings as presented in the report.

Glossary Example

Glossary

Term

Definition

HTML (Hypertext Markup

One of the authoring languages used to create documents

Language)

on the World Wide Web.

IRC (Internet Relay Chat)

A multi-user chat system, which is real-time

communication between two users via computer. Once a

chat has been initiated, either user can enter text by

typing on the keyboard and the entered text will appear

on the other user’s monitor. It is often used on the

Internet.

JPG (Joint Photographic

A graphic image file format.

Experts Group)

7-12

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Details of Findings

Introduction

The Details of Findings section provides detailed information

about any items of evidentiary value found on the suspect media

during the forensic examination. The information in this section

should be thorough, yet concise, and only contain details relevant

to the request for analysis and/or the investigation. It should not

contain information about processes executed that did not produce

relevant information, unless the negative result is relevant.

Information about these non-productive processes should be

included in your notes.

Organization

There are several different ways to organize your report. You may

find yourself using different organizational strategies on different

investigations. You might, for example, organize a report on a case

that contained many pieces of media by listing all of the items

found on each piece of media as one section.

In other cases it may be more effective to organize the data by date

and time. This approach works particularly well in cases where the

organization of data such as e-mail, chat and downloads is easier

to understand if organized in chronological order.

Another method of organizing your report would be to organize

evidence by its relationship to a particular criminal charge and

subject. This approach works well for criminal prosecution. It

allows the prosecutor to quickly see the evidence, which is

relevant to a particular charge and subject.

As shown in the following example, the evidence can also be

ordered or segregated by device. This would be a good

organizational choice for a case that has many pieces of media

such as a large quantity of CDs or DVDs. This organizational

strategy is not normally the best choice when all of the evidence is

located on one device.

If the evidence has multiple partitions, you should further

subdivide your results by individual partition. Make sure you

detail the partition’s file format and size. To further clarify

evidence, you may also want to divide your findings by each user

account or profile. You should detail important files, structure,

data, and discrepancies. Explain your techniques, methodology,

and the relevance of information in brief narrative statements

whenever possible.

01/09

For Official Use Only - Law Enforcement Sensitive

7-13

Report Writing

Network Intrusion Responder Program

Details of Findings, continued

Organization,

If the analysis of a particular item of evidence did not result in the

continued

discovery of any items of evidentiary value, a simple statement

should be included stating the negative results to ensure that the

reader does not misinterpret an omission as the failure to analyze

evidence.

Include in the report the techniques you used to locate or extract

evidence. Later, you can refer to your report if asked in court how

you found a specific piece of evidence. For example, if you found

the file by manually inspecting the drive, then state this.

Remember, not every search has to be done with an automated

tool.

You should take time to develop an organized structure for your

report before writing it.

Hyperlinks

If your report is included on a CD or other large media, use

hyperlinks where possible to illustrate items of evidentiary value.

Hyperlinks allow the reader to click on a description of the

document, or data, when viewing the electronic copy of the report

and display the actual file on the screen.

7-14

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Details of Findings, continued

Details of Findings A skeletal example of the layout for the Details of Findings section

Example

follows.

Details of Findings

A complete analysis of all computer media analyzed (listed above) revealed the following

information pertinent to the Request for Analysis and/or of evidential value to this investigation.

Analysis of the Tag #1, image files Suspect.E01 through E04 from 3.0262GB Maxtor hard drive

revealed:

Partition 0, NTFS 2.0GB

[Detail your findings in this section relative to the indicated partition located on

the hard drive specified. Use narratives, tables, lists, etc. to describe what you

found, where, and relevance to the case, etc.]

Partition 1, FAT32, 1.0GB

[Detail your findings in this section relative to the indicated partition located on

the hard drive specified. Use narratives, tables, lists, etc. to describe what you

found, where, and relevance to the case, etc.]

Disk Free Space, 0.0262GB

[Detail your findings in this section relative to the indicated disk area located on

the hard drive specified. Use narratives, tables, lists, etc. to describe what you

found, where, and relevance to the case, etc.]

Analysis of Tag #2, black Memorex floppy disk revealed:

[Detail your findings in this section relative to any items of evidentiary value

located on the floppy disk. Use narrative, tables, lists, etc. to describe what you

found, where, and relevance to the case, etc.]

Analysis of Tag #3, SONY CD-R media labeled “My Plan” revealed:

[Detail your findings in this section relative to information located on the CD. Use

narrative, tables, lists, etc. to describe what you found, where, and relevance to

the case, etc. In the event of multiple session CDs, it may be necessary to further

subdivide this information by specific session.]

01/09

For Official Use Only - Law Enforcement Sensitive

7-15

Report Writing

Network Intrusion Responder Program

Items Provided

This section details all of the physical items returned to the

requestor with this report. It should include all of the items

specified in the Items Analyzed section. Be sure to include items

that were generated as a result of your analysis, such as a ZIP disk,

floppy disk, CD-Rs, and hard copy documents.

Example

Items Provided

Tag # 01

Western Digital Caviar 31600 Hard Drive

Serial #: WT2891586134

Size: 40GB

Tag # 02

One Memorex DVD-R disk containing the image files listed below

derived from a Fujitsu M1636TAU Hard Drive, Serial #: 08613105, Size: 1226MB:

Suspect dvd.e01

Suspect dvd.e02

Suspect dvd.e03

Suspect dvd.e04

One CD Labeled “Findings of Case Number: 2004-0123A”, which contains

information referred to in this document.

One printed document consisting of three pages, entitled “C4 - What’s it good

for?” that explains the uses of C4 and methods to surreptitiously sell it using

publicly available Internet auction web sites.

7-16

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Creating a Hyperlink in Microsoft Word

Introduction

Hyperlinking is a good way to direct readers to items referred to in

a written report on electronic media. It is often not practical to

display certain items in the actual report. For example, the report

may reference an offensive, graphic image of child pornography.

Some readers may not have the need to view the image. Others

may be required to do so in order to confirm its existence. In this

scenario, a simple hyperlink would allow those with the need to

inspect the file while sparing others from having to view it.

Additionally, there may be so many items of interest that it would

be too cumbersome to include all of the actual images in the

written report. In this situation, a hyperlink could lead to an entire

directory that contains multiple files.

These are both excellent examples of when hyperlinking would

compliment your report.

Procedure:

Use the following procedure to create a hyperlink in Microsoft

Create a

Word.

Hyperlink in

Microsoft Word

Step

Action

Use the mouse to highlight the reference item.

From Microsoft Word’s pull-down menu, select Insert

> Hyperlink.

In the Insert Hyperlink dialog box, traverse the

directory structure until you locate the file or directory

to which you want to establish a link.

Click OK. The reference item should change color to

indicate that it is now a hyperlink.

01/09

For Official Use Only - Law Enforcement Sensitive

7-17

Network Intrusion Responder Program

Report Writing

Lesson 2 - Cyber Crime Interviews

Introduction

Interviews are an essential element of developing information that

is relevant to a criminal investigation. When conducting a cyber

crime investigation, investigators must prepare for the interview,

develop rapport with interview subjects, ask questions that

generate corroborative information and leads, and terminate the

interview in a way that leaves the door open for further questions.

Purpose of this

In this lesson, you will learn guidelines that will assist you in

Lesson

conducting interviews for cyber crime investigations.

Objectives

After completing this lesson, you will be able to:

 Develop a plan to conduct interviews in a cyber investigation

 Explain the psychology and culture of the technology world

and ways to apply that knowledge to the interview process

 Ask questions that will provide you with information that will

assist the investigation

In this Lesson

The following table shows the contents of this lesson.

Topic

See Page

Cyber Crime Interviews

7-20

Interview Process

7-22

01/09

For Official Use Only - Law Enforcement Sensitive

7-19

Report Writing

Network Intrusion Responder Program

Cyber Crime Interviews

Overview of Cyber

When most investigators think about cyber crime investigations,

Crime Interviews

they think of the data stored on the digital media, volatile data

from the physical devices associated with the incident, and logs

from witness devices. All of these items contain information that is

valuable to the case and should not be overlooked by an

investigator.

However, none of this data completes the picture by itself because

machines do not act on their own free will. In order to complete

the puzzle that the investigator is trying to solve, he/she must

obtain information from all of the people who are involved with

the incident.

The witnesses and victims of a crime can help direct the

investigation and assist the investigator in understanding the nature

of the crime, locating more evidence, and identifying suspects. A

proper interview of a suspect may assist in revealing the true scope

of the investigation and provide the information needed to ensure

the conviction of a suspect.

Interviews are an integral part of any investigation because the

victims, witnesses, and perpetrators of a crime all have pieces of

the puzzle that the investigator is trying to put back together.

When confronted with an incident that involves complex technical

issues and multiple sources of evidence, an investigator must

skillfully navigate the human landscape to develop leads, confirm

events, and obtain a complete picture of the crime.

Accusatory versus

There is a difference between an interview and an interrogation.

Non-Accusatory

The purpose of an interview is to gather information that will

Interviews

confirm events, develop suspects and leads, and identify facts that

lead an investigator to identify the root causes of the incident being

investigated.

Interviews are not focused on getting an individual to confess, but

on developing information. In order to obtain the information he

needs, an investigator develops rapport with the subjects and

conducts interviews in a non-confrontational manner.

Interrogations focus on presenting the facts of the case to the

suspect and eliciting statements that confirm the suspect’s

involvement in the incident.

7-20

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Cyber Crime Interviews, continued

Accusatory versus

Understanding the difference between an interview and an

Non-Accusatory,

interrogation is critical to the investigator’s success. If the

continued

investigator takes an aggressive and accusatory approach to

communicating with interview subjects, there is a strong

possibility that this type of interaction will close the door for any

further effective communication.

The investigator must also take into account the perceptions of the

interviewees. Many of the people that you will encounter during

the initial interviews of a cyber crime investigation have little to no

exposure to law enforcement outside of what they have watched

on television. The subjects may also view any interaction with

government agents through the lens of their personal attitudes,

experiences, and beliefs about law enforcement.

In the hacker culture, law enforcement is often cast in a negative

light and government agents are seen as dimwitted and

overbearing. By taking these issues into account, an agent can

prepare for the interview process and maximize the amount of

information he can obtain.

01/09

For Official Use Only - Law Enforcement Sensitive

7-21

Report Writing

Network Intrusion Responder Program

Interview Process

Interview Process Interviews are often open-ended, free flowing conversations that

develop information and enhance an investigator’s understanding

of the case. Following a structured process that progresses from

basic to detailed questions provides more relevant results to the

case agent.

Interviews during a cyber crime investigation are the first and best

opportunity to determine what has happened and obtain

clarification. The crime scene and evidence are not visible to an

investigator during a computer incident. Therefore, investigators

need to gather information about the victim network and machines

from other people. The individuals who control the machines

understand the geography of the digital environment. An

investigator must obtain this information from these people.

The interview process has been broken down into the following

model which can be used to structure the approach taken when

interviewing subjects from a technical backg0round.

 Planning/Research

 Opening/Rapport

 General Questioning

 Detailed Questioning

 Interview Termination

Planning and

Prior to conducting an interview, it is a good idea to conduct

Research

preliminary research on the interviewee and the organization that

he or she represents. Understanding a person’s training,

experience, area of expertise, the nature of his or her daily

business, and role within an organization can help the investigator

draft appropriate questions and an interviewing approach that will

be successful in a specific corporate culture.

Investigators who are knowledgeable and comprehend a technical

subject’s area of expertise present a professional and approachable

image to the interview subject. The knowledge gained through

planning and research also sets the stage for establishing a

situation where the interviewer can ask more intelligent questions.

7-22

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Interview Process, continued

Opening/Rapport The initial contact with subjects in a cyber crime investigation is

critical to obtaining cooperation during an interview. Showing

respect for the needs of the individual and the organization and

explaining the importance of the interview questions are vital steps

in obtaining a subject’s cooperation. You should explain to the

interview subjects that you will need their assistance in

determining the facts of the case and understanding some of the

issues that are involved.

General

Start with open-ended questions that allow the subject to relate to

Questioning

you his or her knowledge of the events. These questions should

develop a general framework of the incident that is derived from

the subject’s personal knowledge of factual events. During a

technical investigation, it is important that an investigator obtain

the general outline of the events that transpired in order to

document information that is relevant to the case.

You should obtain the following information:

 Key incidents that brought the situation to light

 Hardware that was involved (routers, firewalls, IDS)

 Specific individuals who were involved in the incident and the

physical actions they took with any evidence

 Physical locations of effected machines and people

 Technology that will need clarification during the Detailed

Questioning phase

01/09

For Official Use Only - Law Enforcement Sensitive

7-23

Report Writing

Network Intrusion Responder Program

Interview Process, continued

Detailed

After obtaining a general picture of the incident, the investigator

Questioning

can probe deeper into issues that are relevant to the case. The

investigator can ask the subjects to describe in more detail how

they became aware of the incident, what physical actions they

took, and how they came to any conclusions. These questions are

important to obtaining a complete picture for the investigator.

The following information should be pursued and collected at this

stage:

 Software and hardware model numbers and versions

 Network monitoring and logging setup

 Collection of current logs

 Network diagrams

 User policies

 List of people who had logical and physical access

 Ownership and authorized access of systems

 User account information

 Statements of how the systems are used

 Individual access to relevant systems and/or data

 Specific commands or tools used during the discovery of the

incident

 Security video or proximity card logs

7-24

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Interview Process, continued

Interview

It is not uncommon for the investigator to go back for more details

Termination

as his knowledge of the incident grows or if he needs assistance

explaining a complex technical subject to other people. The

investigator should ask the subject for contact information in case

the investigator needs to clarify or elaborate upon material

discussed during the interview. By terminating the interview in

this manner, the investigator has another opportunity to speak with

people that may become suspects at a later time.

Interview

Investigators should take into account the subject’s perspective

Psychology

and culture. Many times people in the computer field are

distrustful of government agents and often have a skewed

perception of what sort of evidence an investigator may need or

want. System administrators from a college campus or library will

typically have very different values and perceptions than a system

administrator that has worked in a DoD environment. By

identifying the work place environment, professional experience

and culture, and common characteristics that influence the

interviewees, the case agent can determine the best approach to

building rapport with the individuals that hold insight to key

elements of the case.

Establishing the right tone for an interview is important in making

sure that the interviewer is obtaining all of the necessary

information that is available from the subject.

The approach an investigator takes to a case differs depending on

whether the investigator initiates contact with an organization for

information or whether the investigator is called in by the

organization who is a victim of the crime. This issue will

determine how the investigator structures his approach to the

interviews.

When an organization calls in an investigator, most of the

organization’s key players are already involved in the incident.

Upper management will typically support the initial stages of the

investigation. In this situation, you should obtain written

documentation from everyone involved in the incident and begin

working on controlling the investigation. It is important to

minimize the mishandling or destruction of evidence and the

spread of information about the investigation to keep potential

suspects in the dark.

01/09

For Official Use Only - Law Enforcement Sensitive

7-25

Report Writing

Network Intrusion Responder Program

Interview Process, continued

Investigator

When an investigator is tracking down a cyber incident, the case

Initiated Contact

will often lead to an external organization that may have computer

logs or actual systems that are relevant to the case.

First the investigator must identify a point of contact within that

organization. This can be done by looking up registration

information for the company via an Internet search engine and

then identifying the legal counsel and network administrator.

There are also a wide variety of state, federal, and private registries

that contain this information and will provide it to law

enforcement agencies. You can also find several Internet service

provider lists that include contact information for major

communications providers such as AOL, Microsoft, Google,

Yahoo, and others.

Then investigators must decide how they will contact a complex

organization that they may know nothing about. These are some of

the considerations that an investigator should take into account:



Is the system administrator or someone with root access

responsible for the activity?



Do they know the suspect and are they relaying information

about the investigation to their associate?



Are there any regulatory or legal barriers to the organization

giving information to the investigator (ECPA, PPA, FERPA,

HIPPA, Organizational Policy, etc.)



How critical is the evidence held by the company to the case?

Is a life or national security at stake?



Does the investigator have access to request the legal

instruments such as subpoenas, search warrants, FISA, or other

items in a timely manner?



Does the investigator have the technical knowledge to handle

the systems or logs that will be obtained from the scene or will

he need additional assistance?



Will the evidence be contained all at one physical location or

spread out over a national or global network infrastructure?



Does the investigating agency have the manpower, technical

knowledge, and resources to obtain what they need from the

target organization?

7-26

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Interview Process, continued

Investigator

When an investigator reaches out to an organization, it is best to

Initiated Contact,

identify the senior management, legal counsel, and technical heads

continued

prior to making contact. If the investigation allows, you should

start at the top of the organization’s hierarchy and work down

towards individuals who are responsible for managing or using

various computer and network services. An investigator can

address legal issues, business impact, and concern for the

organization’s needs in order to gain more cooperation.

If an investigation could be compromised by reaching out to the

organization in this manner, the investigator should avoid “tipping

off” the organization or individuals. The investigator can then do

the research and case preparation to obtain the most effective legal

authority that will allow him to gather evidence and interviews in

the most effective and efficient manner possible.

Organization

If the victim organization is reaching out to the investigator to

Initiated Contact

report an incident, the investigator will more than likely have

cooperation. At this point, the victim performed an internal

investigation that may or may not have been done properly. The

investigator will still need to follow up to ensure the accuracy of

any information provided by the victim organization. Again,

properly document any actions taken by people at the company.

It can be very important to work with the organization’s legal

counsel and network administrators. The legal counsel can assist

with collecting information that is governed by organizational

policies.

01/09

For Official Use Only - Law Enforcement Sensitive

7-27

Report Writing

Network Intrusion Responder Program

Interview Process, continued

Organization

Many organizations are ignorant of the investigation’s process and

Initiated Contact,

do not use proper evidence handling procedures. Common

continued

practices used by organizations to minimize or repair damage

caused by an incident will often hamper the investigation. Some of

these issues are:

 When a machine has been compromised it is common practice

to just restore the machine from a base image.

 Many times untrained system administrators or management

will work on live systems and alter system artifacts and time

lines.

 There is more concern for system/network integrity compared

to retaining any evidence or identifying the cause of the

incident.

 Chain of custody issues are often not followed

 Lack of network maps and diagrams

 Incomplete knowledge of system functions and passwords

 Poor documentation of system builds, organizational policies,

or security controls

Investigators should address these issues in advance to minimize

problems with this type of situation.

Witness and

These individuals often provide the investigator with the initial

Victims

foundation of a case and the information needed to build the

framework for the investigation. A system administrator or a user

of an online database may be the first to notice strange system

behavior or altered data in a critical database. A relative or friend

may discover suspected child pornography images on a computer

and report it to the police. In either situation, the investigator will

need to elicit information from people to obtain facts that will lead

them to a suspect.

7-28

For Official Use Only - Law Enforcement Sensitive

01/09

Network Intrusion Responder Program

Report Writing

Interview Process, continued

Witness and

Investigators must keep in mind that anyone could be a suspect.

Victims, continued

During the initial response and interviews, an investigator needs to

obtain clear and concise written documentation from the people

involved with the incident. This documentation should consist of

any actions taken by the witnesses and events observed by them

during the incident. Your documentation is an important part of

freezing the crime scene and creating a permanent record of events

that occurred during the discovery of the crime.

Investigators should keep in mind that the people who are being

interviewed may have had little contact with law enforcement and

may not recognize the type of evidence needed to further the

investigation. It is the investigator’s job to develop a rapport with

the interview subjects and guide the interview in a direction that

will obtain the most relevant and complete information possible.

Issues to be

There are various issues that should be addressed during

Addressed During

interviews with witnesses. Here are some important questions:

Interviews

 Are system administrators or people with administrative

powers potential suspects? If so, the investigator must move

quickly and efficiently to build the case. If immediate action is

not an option, the investigator must ensure that the suspect’s

access to evidence or sensitive material is removed. Covert

tactics may become necessary if you have the proper

administrative approval, legal documents, and technical

capabilities in place.

 Obtaining witness statements about the suspect’s access to the

machine or data is also important. Investigators should

supplement any network logs and/or forensic analysis with as

much traditional detective work as possible.

 Do people share machines, use passwords, or share passwords?

 Have there been any strange phone calls or repairmen asking

for user accounts, passwords, or other sensitive technical

information? If so, these incidents may have been a suspect

trying to obtain information about the victim organization in

order to commit the crime.

01/09

For Official Use Only - Law Enforcement Sensitive

7-29

Network Intrusions Responder Program (NITRO). Instructor Guide - page 6