Forensics Book 4: Investigating Network Intrusions and Cybercrime

1. Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 1: Network Forensics and Investigating Logs

2. Objectives • Look for evidence • Perform an end-to-end forensic investigation • Use log files as evidence • Evaluate log file accuracy and authenticity • Understand the importance of audit logs

3. Objectives (continued) • Understand syslog • Understand Linux process accounting • Configure Windows logging • Understand NTP

4. Case Example • In August 2005, a Moroccan named Farid Essebar and a Turk named Atilla Ekici were arrested in their respective home countries on the charges of creating and distributing the Zotob, Rbot, and Mytob worms • The Mytob worm affected a wide range of Windows systems, including Windows NT, 2000, XP, and Server 2003 • The Zotob worm affected the systems of corporate giants, such as the New York Times Company, CNN, ABC News, Caterpillar Inc., and General Electric Co • Within 12 days of the release of the worm, the culprits were arrested

5. Introduction to Network Forensics and Investigating Logs • This module: • Focuses on network forensics and investigating logs • Starts by defining network forensics and describing the tasks associated with a forensic investigation • Covers log files and their use as evidence • Concludes with a discussion about time synchronization

6. Network Forensics • Network forensics • The capturing, recording, and analysis of network events in order to discover the source of security attacks • Capturing network traffic over a network is simple in theory, but relatively complex in practice • Because recording network traffic involves a lot of resources, it is often not possible to record all of the data flowing through the network

7. Analyzing Network Data • The most critical and most time-consuming task • There are not enough automated analysis tools that an investigator can use for forensic purposes • There is no foolproof method for discriminating bogus traffic generated by an attacker from genuine traffic • Network forensics can reveal the following: • How an intruder entered the network • The path of intrusion • The intrusion techniques an attacker used • Traces and evidence

8. The Intrusion Process • Network intruders can enter a system using the following methods: • Enumeration • Vulnerabilities • Viruses • Trojans • E-mail infection • Router attacks • Password cracking

9. Looking for Evidence • An investigator can find evidence from: • The attack computer and intermediate computers • Firewalls • Internetworking devices • The victim computer

10. End-to End Forensic Investigation • Involves following basic procedures from beginning to end • Some of the elements of an end-to-end forensic trace: • The end-to-end concept • Locating evidence • Pitfalls of network evidence collection • Event analysis

11. Log Files as Evidence • Log files • Primary recorders of a user’s activity on a system and of network activities • Provide clues to investigate • Basic problem with logs: they can be altered easily • An investigator must be able to prove in court that logging software is correct • Computer records are not normally admissible as evidence • Must meet certain criteria to be admitted at all

12. Legality of Using Logs • Legal issues involved with creating and using logs: • Logs must be created reasonably contemporaneously with the event under investigation • Log files cannot be tampered with • Someone with knowledge of the event must record the information • Logs must be kept as a regular business practice • Random compilations of data are not admissible • Logs instituted after an incident has commenced do not qualify under the business records exception • If an organization starts keeping regular logs now, it will be able to use the logs as evidence later

13. Legality of Using Logs (continued) • Legal issues: (continued) • A custodian or other qualified witness must testify to the accuracy and integrity of the logs • A custodian or other qualified witness must also offer testimony as to the reliability and integrity of the hardware and software platform used • Including the logging software • A record of failures or of security breaches on the machine creating the logs will tend to impeach the evidence • If an investigator claims that a machine has been penetrated, log entries from after that point are inherently suspected

14. Legality of Using Logs (continued) • Legal issues: (continued) • In a civil lawsuit against alleged hackers, anything in an organization’s own records that would tend to exculpate the defendants can be used against the organization • An organization’s own logging and monitoring software must be made available to the court • So that the defense has an opportunity to examine the credibility of the records • The original copies of any log files are preferred • A printout of a disk or tape record is considered to be an original copy, unless and until judges and jurors come equipped with USB or SCSI interfaces

15. Examining Intrusion and Security Events • Monitoring for intrusion and security breach events is necessary to track down attackers • Examining intrusion and security events includes both passive and active tasks • Post-attack detection or passive intrusion detection • Detection of an intrusion that occurs after an attack has taken place • Inspection of log files is the only medium that can be used to evaluate and rebuild the attack techniques • Usually involve a manual review of event logs and application logs

16. Examining Intrusion and Security Events (continued) • Active intrusion detection • Detects attack attempts as soon as the attack takes place • Administrator or investigator follows the footsteps of the attacker and looks for known attack patterns or commands • Intrusion detection • Process of tracking unauthorized activity using techniques such as inspecting user actions, security logs, or audit data • There are various types of intrusions

17. Using Multiple Logs as Evidence • Recording the same information in two different devices makes the evidence stronger • Logs from several devices collectively support each other • Firewall logs, IDS logs, and TCPDump output can contain evidence of an Internet user connecting to a specific server at a given time

18. Maintaining Credible IIS Log Files • Questions before presenting IIS logs in court: • What would happen if the credibility of the IIS logs was challenged in court? • What if the defense claims the logs are not reliable enough to be admissible as evidence? • Investigator must secure the evidence and ensure that it is accurate, authentic, and accessible • In order to prove that the log files are valid: • Investigator needs to present them as acceptable and dependable by providing convincing arguments, which makes them valid evidence

19. Maintaining Credible IIS Log Files (continued) • Log file accuracy • The accuracy of IIS log files determines their credibility • Accuracy here means that the log files presented before the court of law represent the actual outcome of the activities related to the IIS server being investigated • Logging everything • In order to ensure that a log file is accurate, a network administrator must log everything • IIS logs must record information about Web users

20. Maintaining Credible IIS Log Files (continued) • Extended logging in IIS server • Limited logging is set globally by default • So any new Web sites created have the same limited logging • An administrator can change the configuration of an IIS server to use extending logging

21. Keeping Time • With the Windows Time service, a network administrator can synchronize IIS servers by connecting them to an external time source • Using a domain makes the time service synchronous to the domain controller

22. Maintaining Credible IIS Log Files (continued) • UTC Time • IIS records logs using UTC time, which helps in synchronizing servers in multiple zones • Windows offsets the value of the system clock with the system time zone to calculate UTC time • A network administrator can verify a server’s time zone setting by looking at the first entries in the log file

23. Maintaining Credible IIS Log Files (continued) • Avoiding missing logs • When an IIS server is offline or powered off, log files are not created • When a log file is missing, it is difficult to know if the server was actually offline or powered off, or if the log file was deleted • To combat this problem, an administrator can schedule a few hits to the server using a scheduling tool

24. Maintaining Credible IIS Log Files (continued) • Log file authenticity • IIS log files are simple text files that are easy to alter • The date and time stamps on these files are also easy to modify • They cannot be considered authentic in their default state • Logs should be moved to a master server and then moved offline to secondary storage media such as a tape or CD-ROM

25. Maintaining Credible IIS Log Files (continued) • Working with copies • Investigator should create copies before performing any post-processing or log file analysis • When using log files as evidence in court, an investigator is required to present the original files in their original form • Access control • In order to prove the credibility of logs, an investigator or network administrator needs to ensure that any access to those files is audited • The investigator or administrator can use NTFS permissions to secure and audit the log files

26. Maintaining Credible IIS Log Files (continued) • Chain of custody • The chain of custody must be maintained for log files • When an investigator or network administrator moves log files from a server, and after that to an offline device, he or she should keep track of where the log file went and what other devices it passed through • IIS centralized binary logging • Process in which many Web sites write binary and unformatted log data to a single log file • A parsing tool is required to view and analyze the data • Decreases the amount of system resources that are consumed during logging

27. Maintaining Credible IIS Log Files (continued) • ODBC logging • Records a set of data fields in an ODBC-compliant database like Microsoft Access or Microsoft SQL Server • When ODBC logging is enabled, IIS disables the HTTP.sys kernel-mode cache • Tool: IISLogger • Provides additional functionality on top of standard IIS logging • Produces additional log data and sends it using syslog • IISLogger is an ISAPI filter that is packaged as a DLL embedded in the IIS environment

28. Maintaining Credible IIS Log Files (continued) Figure 1-1 IISLogger provides additional IIS logging functionality.

29. Importance of Audit Logs • Reasons audit logs are important: • Accountability • Reconstruction • Intrusion detection • Problem detection

30. Syslog • Syslog • A combined audit mechanism used by the Linux operating system • Permits both local and remote log collection • Allows system administrators to collect and distribute audit data with a single point of management • Controlled on a per machine basis with the file /etc/syslog.conf • The format of configuration lines is: • facility.level <Tab><Tab> action

31. Syslog (continued) • Primary advantage of syslog • All reported messages are collected in a message file • Logging priorities can be enabled by configuring /var/log/syslog • Remote logging • Centralized log collection makes simpler both day-to-day maintenance and incident response • Causes the logs from multiple machines to be collected in one place • Advantages include more effective auditing, secure log storage, easier log backups, and an increased chance for analysis across multiple platforms

32. Syslog (continued) • Log replication may also be used to audit logs • Log replication copies the audit data to multiple remote-logging hosts • Preparing the server for remote logging • Central logging server should be set aside to perform only logging tasks • Server should be kept in a secure location behind the firewall • Make sure that no unnecessary services are running on the server • Delete any unnecessary user accounts

33. Syslog (continued) • Configuring remote logging • Run syslogd with the -r option on the server that is to act as the central logging server • Allows the server to receive messages from remote hosts via UDP • Three files that must be changed: • /etc/rc.d/init.d/syslog • /etc/sysconfig/syslog • /etc/services • A reference should appear in the var/log/messages file indicating that the remote syslog server is running • The syslog server can be added to the /etc/syslogd.conf file in the client

34. Tool: Syslog-ng • A flexible and scalable audit-processing tool • Offers a centralized and securely stored log for all the devices on a network • Features of Syslog-ng: • Guarantees the availability of logs • Compatible with a wide variety of platforms • Used in heavily firewalled environments • Offers proven robustness • Allows a user to manage audit trails flexibly • Has customizable data mining and analysis capabilities • Allows a user to filter based on message content

35. Tool: Syslog-ng (continued) Figure 1-2 An administrator can use Syslog-ng to manage logs for all devices on a network.

36. Tool: Syslog-ng (continued) • Tool: Socklog • Small and secure replacement for syslogd • Runs on Linux (glibc 2.1.0 or higher, or dietlibc), OpenBSD, FreeBSD, Solaris, and NetBSD • Tool: Kiwi Syslog Daemon • Freeware syslog daemon for Windows • Receives logs and displays and forwards syslog messages from routers, switches, UNIX hosts, and any other syslog-enabled device

37. Tool: Syslog-ng (continued) Figure 1-3 Kiwi Syslog Daemon offers administrators a wealth of customizable options.

38. Tool: Microsoft Log Parser • A powerful, versatile, robust command-line tool • Offers a SQL interface to various log file formats • Fast enough for log file analysis of many Web sites • Features of Microsoft Log Parser: • Enables a user to run SQL-like queries against log files of any format • Produces the desired information either on the screen, in a file, or in a SQL database • Allows multiple files to be piped in or out as source or target tables • Generates HTML reports and MS Office objects • Supports conversion between SQL and CSV formats

39. Tool: Microsoft Log Parser (continued) Figure 1-4 Microsoft Log Parser allows a user to analyze log files using SQL-like queries.

40. Tool: Microsoft Log Parser (continued) • Microsoft Log Parser Architecture • Log Parser provides a global query access to text-based data such as IIS log files, XML files, text files, and CSV files, and key data sources like the Windows Event Log, the registry, the file system, user plug-ins, and Active Directory • Operating systems for Microsoft Log Parser: • Windows 2000 • Windows Server 2003 • Windows XP Professional

41. Tool: Firewall Analyzer • Web-based firewall monitoring and log analysis tool • Collects, analyzes, and reports information on enterprise-wide firewalls, proxy servers, and RADIUS servers • Features of Firewall Analyzer include: • Bandwidth usage tracking • Intrusion detection • Traffic auditing • Anomaly detection through network behavioral analysis • Web site user access monitoring

42. Tool: Firewall Analyzer (continued) Figure 1-5 This is the main screen of Firewall Analyzer.

43. Tool: Adaptive Security Analyzer (ASA) Pro • Security and threat intelligence application • Continuously monitors dynamic, high-volume, heterogeneous security-related data • Recognizes and quantifies the extent of event abnormality • Advises security personnel of the factors that contributed most to the event’s classification • Features of ASA Pro include: • Accelerates threat response • Has improved preemptive capabilities • Expands resource capacity • Maximizes return on security and other IT assets

44. Tool: Adaptive Security Analyzer (ASA) Pro (continued) Figure 1-6 ASA Pro provides extensive details about security events.

45. Tool: GFI EventsManager • Collects data from all devices that use Windows event logs, W3C, and syslog • Applies rules and filtering to identify key data • Provides administrators with real-time alerting when critical events arise • Suggests remedial action

46. Tool: GFI EventsManager (continued) • Features of GFI EventsManager: • Network-wide analysis of event logs • Explanations of cryptic Windows events • Centralized event logging • High-performance scanning engine • Real-time alerts • Advanced event filtering features • Report viewing for key security information happening on the network

47. Tool: GFI EventsManager (continued) • How does GFI EventsManager work? • GFI EventsManager divides the events management process in two stages: • Event collection • Event processing

48. Tool: GFI EventsManager (continued) Figure 1-7 GFI EventsManager manages events in two stages.

49. Tool: Activeworx Security Center • Security information and event management product • Monitors security-related events for a variety of devices from one central console • Allows for the discovery of threats, the correlation of relevant security information, and the analysis of vulnerabilities and attacks • Provides intelligence for security personnel to act upon

50. Tool: Activeworx Security Center (continued) Figure 1-8 GFI EventsManager manages events in two stages.