SHARE

Five Essential Computer Forensics Tools

By the Numbers I recently had a look at the most recent CSI security survey. While a lot of things have changed over the past year, one thing is definitely consistent: attacks happen. At one point, attacks on companies were as high as 70 percent (in 2000) but today we see that the reported amount […]

Written By

Lyne Bourque

Nov 21, 2008

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

By the Numbers

I recently had a look at the most recent CSI security survey. While a lot of things have changed over the past year, one thing is definitely consistent: attacks happen. At one point, attacks on companies were as high as 70 percent (in 2000) but today we see that the reported amount is down to as low as 43 percent.

What is interesting is the fact that the number that checked off the unknown box (that is, those that aren’t sure if they were compromised or not) increased to 13 percent. This is still an overall lower figure if we were to assume that they were compromised, but really, IT security professionals ought to be aware if their organization is compromised or not.

Of those that were compromised, 47 percent said that they only had 1 to 5 events. What isn’t made obvious is whether the events were small or massive breaches. Granted a single massive event can be devastating for an organization while 10 small ones can present less of a problem.

And even here, we see that 26 percent are unaware as to how many times they were compromised. These unknowns present, in my opinion, a reason to be concerned since that opens up the possibility of continued compromise and the habitual existence of vulnerabilities within a system.

What seems rather disturbing, however, is the belief that the majority of attacks come from external sources. Of those polled, 51 percent believe that none come from inside and 25 percent said it only accounted for 1 percent to 20 percent of their breaches. This is something to watch in the next survey as the economic factors of this year have an impact on employee behavior as well as increased possibilities for compromise by those desperate for funds.

So the challenge then is how to find those attacks and determine how they got into a system. Since most of us use a Windows system of some type, it made sense to look through some simple tools to do forensics against a system to see if it was compromised.

Tools and Techniques

One of the first things that you’d need to do is take the compromised system out of the picture. Live View, an open source utility, creates a virtual machine out of the existing system. And if it doesn’t detect Workstation 5.5 or VMware Server 1.x, it will download it for you.

Live View creates a virtual disk out of the system that allows you to then safely investigate a copy of the system without interfering with anything installed. On another basis, you could use VMware Converter to create a vmdk (virtual machine disk) to use in more recent versions of Server or Workstation.

Once you’ve rebooted the system you can then go to Merijn and download StartupList. This is a great way to start the investigation of a system and determine what things might have potentially been put on the system to restart each time the system does. Of course, you can use HijackThis as an additional tool and rule out obvious malware or other items that tie themselves into the registry.

The next trick is to determine what additional files, other than the usual, are open. In Linux we use lsof, which lists open files but for Windows, by default, there is no similar command. Instead, there is OpenFilesView, a Windows executable that lists all the files and processes – both local and network based – on the system.

While that’s running, Wireshark can let you review all network traffic to see if anything unexpected is being sent out to another location. If there is, it’s worthwhile to enable a firewall to block the traffic or better yet, just yank out the network cable to avoid the possibility of intellectual property from being stolen from the system.

This allows us to determine if anything suspicious exists in the system while it’s running live. Once this has been completed, you can look into determining what has been changed.

Helix 3, a newly updated version of the live Linux forensics tool, can be used to examine the disk safely to see what has been finally changed. Forensics of a system is critical to know what has been compromised. It is one thing to know if we’ve been attacked but it’s another to find out what those attackers have done to the system.

If we don’t look into what happened we may miss out on critical data being compromised or learn how the system was first broken into. Once this investigation is done, we can then rebuild the system with appropriate additional security in place to prevent the attack from happen.

And we can do this all at minimal cost, an important factor to consider in this day and age of economic belt-tightening.

This article was first published on EnterpriseITPlanet.com.