Electronic Crime: Incident Reporting and Forensics Between Law Enforcement and Private Industry D/Sgt. Michael Harrington CEECS, CFCE, EnCE Michigan State Police Computer Crimes Unit

Topics  MSP Computer Crimes Unit  Trends  Evidence Collection  Incident Reporting  Evidence Analysis

Mission Statement  CCU was established to provide computer and Internet investigative support in the acquisition of digital evidence for the law enforcement community.

Forensic & Investigative Services  Forensics –Perform Forensic examinations of computers –Assist state, county, & local law enforcement agencies  Investigations –Online Investigations –Illegal Websites –Hacking complaints –Internet Crimes Against Children

Trends  Child Exploitation  Identity Theft –Ebay –Credit Cards –Phishing  Organized Crime

Fraud Trends

Phishing  What is “Phishing”? –Phishing defined: the act of attempting to fraudulently acquire through deception sensitive personal information such as passwords and credit card details by masquerading in an official-looking , IM, etc. as someone trustworthy with a real need for such information. –Wikipedia.org

Phishing  Growing faster than any other online threat  The number of unique phishing attacks increased by 1400% in 2004  An estimated $300-$400 million in fradulent (read unauthorized) bank transfers last year

Phishing  Phishing has been called “The Perfect Crime” –All that is needed is a PC, Internet and a little ingenuity –Difficult to catch the criminals –Hackers are doing for profit and criminals following suit

Phishing  People who receive Phishing attacks are three times as likely to become victims.  Phishing scams are for sale on the internet  Ebay hijacking becoming more and more common (phishing example)phishing example

Phishing  How is phishing done? –Believable to victim –Use programming tricks to hide fake sites –Using pop-up windows to cloak the real address in the victim’s address bar –“Pharming” victim redirected to a scam website when the victim types in the real address

Phishing  How can you protect yourself? –Monitor credit card statements, bills –Keep up-to-date anti-virus protection/anti- spyware/firewallsoftware installed –Obtain credit reports on a regular basis –Don’t answer unknown –If it looks to good to be true….

Child Exploitaion  Business maybe liable to victims if employees are using company Internet for illicit activities  Control chat programs/internet usage through routine monitoring of systems  Hostile work environment through inappropriate usage  AUP/Banners/Incident Response Plans

Liability  Mobile Units –PDAs –Mobile Phones  Wireless Connections  Web Applications  Banners, AUP, Employee Handbooks

Incident Reporting  Must report to the agency that has jurisdiction for the alleged offense  Who/what/when/where/how  Explain in plain English the incident  rg rg  Contact local law enforcement for Digital Forensic contact  MSP Computer Crimes Contact

Digital Forensics

 Definition  Develop a methodology  Evidence Collection  Evidence Analysis

Digital Forensics  Definition-Digital Investigation –Process where we develop and test hypothesis that answer questions abut digital events using the scientific method –Carrier, Brian. File System Forensic Analysis, Addison Wesley 2005

Digital Forensics  Definition-Digital Evidence –A digital object that contains reliable information that supports or refutes a hypothesis. –Carrier, Brian. File System Forensic Analysis, Addison Wesley 2005

Digital Forensics  Definition-Digital Forensic Investigation –Process that uses science and technology to analyze digital objects and develops and tests theories which can be entered into a court of law to answer questions about events that have occurred. –Carrier, Brian. File System Forensic Analysis, Addison Wesley 2005

Digital Forensics  Digital Investigations comprised of three phases –1) System Preservation Reduce the amount of evidence that may be overwritten This continues after acquisition because of further analysis and court

Digital Forensics  Digital Investigations comprised of three phases –2) Evidence Searching Looking for data to support or refute event theories Keywords, internet history graphics

Digital Forensics  Digital Investigations comprised of three phases –3) Incident Analysis This phase is done to reconstruct the execution of the event The “how” of the incident

Evidence Collection  Evidence Collection should be done in a forensically sound manner –Baseline –Minimize invasiveness –Protect original –Document everything

Evidence Analysis  Develop/adopt a forensic methodology –Examine and document the original System Settings Peripherals Add on cards –Write protect hard disks, media –Create an exact bit by bit “forensic copy” of the subject media

Evidence Analysis  Maintain a controlled environment  Correlate and validate data obtained  Document actions taken and evidence obtained

Forensic Software  Commercial software –EnCase Enterprised Edition –SMART for Linux –Forensic Tool Kit –ProDiscover  Open Source –Sleuthkit/autopsy –Live Linux Cds Helix Knoppix STD

Questions? D/Sgt. Michael Harrington 4000 Collins Rd Lansing MI TX: