1. Next Back MAP MAP B-1 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Extended Learning Module B Computer Crime and Forensics

2. Next Back MAP MAP B-2 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Main Map Computer Crime Computer Crime Computer Crime Computer Crime Computer Forensics Computer Forensics Computer Forensics Computer Forensics Recovery and Interpretation Recovery and Interpretation Recovery and Interpretation Recovery and Interpretation

3. Next Back MAP MAP B-3 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Introduction Computers are primarily used in two ways to commit a crime or misdeed Computers are primarily used in two ways to commit a crime or misdeed  As a target  As a weapon A computer is a target when someone wants to bring it down or make it malfunction A computer is a target when someone wants to bring it down or make it malfunction A computer used as a weapon would include acts like changing computer records to commit embezzlement, stealing information and intentionally spreading viruses A computer used as a weapon would include acts like changing computer records to commit embezzlement, stealing information and intentionally spreading viruses

4. Next Back MAP MAP B-4 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Introduction Figure B.1 Examples of Computer Crime that Organizations Need to Defend Against page 343

5. Next Back MAP MAP B-5 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Computer Crime Computer Crime Computer Forensics Computer Forensics Recovery and Interpretation Recovery and Interpretation

6. Next Back MAP MAP B-6 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Computer crime - a crime in which a computer, or computers, play a significant part. Computer crime - a crime in which a computer, or computers, play a significant part.  Illegal gambling  Forgery and money laundering  Child pornography  Electronic stalking  The list goes on…

7. Next Back MAP MAP B-7 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Computer virus (or virus) - software that was written with malicious intent to cause annoyance or damage. There are two types of viruses. Computer virus (or virus) - software that was written with malicious intent to cause annoyance or damage. There are two types of viruses.  Benign viruses display a message or slow down the computer, but don’t destroy any information.  Malignant viruses damage your computer system.

8. Next Back MAP MAP B-8 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Macro viruses - spread by binding themselves to software such as Word or Excel. Macro viruses - spread by binding themselves to software such as Word or Excel. Worm - a computer virus that replicates and spreads itself, not only from file to file, but from computer to computer via e-mail and other Internet traffic. Worm - a computer virus that replicates and spreads itself, not only from file to file, but from computer to computer via e-mail and other Internet traffic.

9. Next Back MAP MAP B-9 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Figure B.3 The Love Bug Worm page 346

10. Next Back MAP MAP B-10 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Denial-of-service (DoS) attacks - flood a Web site with so many requests for service that it slows down or crashes. Denial-of-service (DoS) attacks - flood a Web site with so many requests for service that it slows down or crashes. Distributed denial-of-service (DDos) –attacks from multiple computers that flood a Web site with so many requests for service that it slows down or crashes. Distributed denial-of-service (DDos) –attacks from multiple computers that flood a Web site with so many requests for service that it slows down or crashes.

11. Next Back MAP MAP B-11 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Figure B.4 Distributed Denial of Service Attack page 347

12. Next Back MAP MAP B-12 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Code Red was the first virus that combined a worm and DoS attack. Code Red was the first virus that combined a worm and DoS attack. Probably a hoax e-mail if: Probably a hoax e-mail if:  Says to forward it to everyone you know, immediately.  Describes the awful consequences of not acting immediately.  Quotes a well-known authority in the computer industry.

13. Next Back MAP MAP B-13 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization On Your Own What Polymorphic Viruses Are Floating Around Cyberspace? (p. 348)

14. Next Back MAP MAP B-14 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Outside the Organization Stand alone worms can run on any computer that can run Win32 programs. Stand alone worms can run on any computer that can run Win32 programs. Spoofing - the forging of the return address on an e-mail so that the e- mail message appears to come from someone other than the actual sender. Spoofing - the forging of the return address on an e-mail so that the e- mail message appears to come from someone other than the actual sender. Trojan horse virus - hides inside other software, usually an attachment or download. Trojan horse virus - hides inside other software, usually an attachment or download. Key logger, or key trapper, software - a program that, when installed on a computer, records every keystroke and mouse click. Key logger, or key trapper, software - a program that, when installed on a computer, records every keystroke and mouse click.

15. Next Back MAP MAP B-15 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Web Defacing Web defacing replaces the site with a substitute that’s neither attractive nor complimentary. Web defacing replaces the site with a substitute that’s neither attractive nor complimentary. Web defacing is a favorite sport of the people who break into computer systems. Web defacing is a favorite sport of the people who break into computer systems.

16. Next Back MAP MAP B-16 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime The Players Hackers - are knowledgeable computer users who use their knowledge to invade other people’s computers. Hackers - are knowledgeable computer users who use their knowledge to invade other people’s computers. Thrill-seeker hackers - break into computer systems for entertainment. Thrill-seeker hackers - break into computer systems for entertainment. Black-hat hackers - cyber vandals. Black-hat hackers - cyber vandals. Crackers - hackers for hire, and are the people who engage in electronic corporate espionage. Crackers - hackers for hire, and are the people who engage in electronic corporate espionage.  Social engineering - conning your way into acquiring information that you have no right to.

17. Next Back MAP MAP B-17 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime The Players Hacktivists - politically motivated hackers who use the Internet to send a political message of some kind. Hacktivists - politically motivated hackers who use the Internet to send a political message of some kind. Cyberterrorist - one who seeks to cause harm to people or destroy critical systems or information. Cyberterrorist - one who seeks to cause harm to people or destroy critical systems or information.

18. Next Back MAP MAP B-18 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime The Players White-hat (or ethical) hackers - computer security professionals who are hired by a company to break into its computer system. White-hat (or ethical) hackers - computer security professionals who are hired by a company to break into its computer system. Script Kiddies or script bunnies - people who would like to be hackers but don’t have much technical expertise. Script Kiddies or script bunnies - people who would like to be hackers but don’t have much technical expertise.

19. Next Back MAP MAP B-19 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime The Players Team Work Make up a Good Password (p. 351)

20. Next Back MAP MAP B-20 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Inside the Company Along with the traditional crimes of fraud and other types of theft, managers sometimes have to deal with harassment of one employee by another. Along with the traditional crimes of fraud and other types of theft, managers sometimes have to deal with harassment of one employee by another. Chevron Corporation and Microsoft settled sexual harassment lawsuits for $2.2 million each because employees sent offensive e-mail to other employees and management didn’t intervene. Chevron Corporation and Microsoft settled sexual harassment lawsuits for $2.2 million each because employees sent offensive e-mail to other employees and management didn’t intervene.

21. Next Back MAP MAP B-21 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Crime Inside the Company On Your Own Digital Signatures and Certificates (p. 352)

22. Next Back MAP MAP B-22 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Computer Crime Computer Crime Computer Forensics Computer Forensics Recovery and Interpretation Recovery and Interpretation

23. Next Back MAP MAP B-23 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Computer forensics - the collection, authentication, preservation, and examination of electronic information for presentation in court. Computer forensics - the collection, authentication, preservation, and examination of electronic information for presentation in court. In a well-conducted computer forensics investigation, there are two major phases: In a well-conducted computer forensics investigation, there are two major phases: 1. Collecting and authenticating electronic evidence. 2. Analyzing the findings. Computer forensics experts use special hardware and software tools to conduct investigations. Computer forensics experts use special hardware and software tools to conduct investigations.

24. Next Back MAP MAP B-24 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics The Collection Phase Step one of the collection phase is to get physical access to the computer and related items. Step one of the collection phase is to get physical access to the computer and related items.  Computers  Hard disks  Floppy disks  CD’s and DVD’s  Zip disks  Printouts  Post-it notes, etc. This process is similar to what police do when investigating crime in the brick world. This process is similar to what police do when investigating crime in the brick world.

25. Next Back MAP MAP B-25 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase I - The Collection Phase Step two of the collection phase is to make a forensic image copy of all the information. Step two of the collection phase is to make a forensic image copy of all the information.  Forensic image copy - an exact copy or snapshot of the contents of an electronic medium.

26. Next Back MAP MAP B-26 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase I - The Collection Phase The Authentication and Preservation Process. The Authentication and Preservation Process. During the collection phase and later, the analysis phase, the investigators have to make absolutely sure that nothing that might be used as evidence in a trial could have been planted, contaminated, or altered in any way. During the collection phase and later, the analysis phase, the investigators have to make absolutely sure that nothing that might be used as evidence in a trial could have been planted, contaminated, or altered in any way.

27. Next Back MAP MAP B-27 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase I - The Collection Phase Investigators use an authentication process to show that nothing changed on the hard drive or other storage medium since seizure. Investigators use an authentication process to show that nothing changed on the hard drive or other storage medium since seizure. MD5 hash value - a mathematically generated number that is unique for each individual storage medium at a specific point in time, because it’s based on the contents of that medium. MD5 hash value - a mathematically generated number that is unique for each individual storage medium at a specific point in time, because it’s based on the contents of that medium.

28. Next Back MAP MAP B-28 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase I - The Collection Phase Figure B.5 MD5 hash value page 355

29. Next Back MAP MAP B-29 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase I - The Collection Phase Computer forensics experts use special hardware and software tools to conduct investigations. Computer forensics experts use special hardware and software tools to conduct investigations.

30. Next Back MAP MAP B-30 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase II - The Analysis Phase The analysis phase consists of the recovery and interpretation of the information that’s been collected and authenticated. The analysis phase consists of the recovery and interpretation of the information that’s been collected and authenticated. The analysis phase of the investigation is when the investigator follows the trail of clues and builds the evidence into a crime story. The analysis phase of the investigation is when the investigator follows the trail of clues and builds the evidence into a crime story.

31. Next Back MAP MAP B-31 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase II - The Analysis Phase You can recover files from: You can recover files from:  E-mail (including deleted)  Program files and data files  Web activity files  Network server files

32. Next Back MAP MAP B-32 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase II - The Analysis Phase Computer forensic programs can pinpoint a file’s location on the disk, its creator, the date it was created, the date of last access, the date it was deleted, as well as file formatting, and notes embedded or hidden in a document. Computer forensic programs can pinpoint a file’s location on the disk, its creator, the date it was created, the date of last access, the date it was deleted, as well as file formatting, and notes embedded or hidden in a document.

33. Next Back MAP MAP B-33 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Computer Forensics Phase II - The Analysis Phase Figure B.7 History of File Activity page 356

34. Next Back MAP MAP B-34 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Computer Crime Computer Crime Computer Forensics Computer Forensics Recovery and Interpretation Recovery and Interpretation

35. Next Back MAP MAP B-35 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Much of the information comes from: Much of the information comes from:  Recovered  Deleted files  Currently unused disk space  Deliberately hidden information or files People whose e-mail was recovered to their extreme embarrassment (or worse) were: People whose e-mail was recovered to their extreme embarrassment (or worse) were:  Monica Lewinsky  Arresting officer in the Rodney King case  Bill Gates of Microsoft

36. Next Back MAP MAP B-36 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information Information is written all over a disk, not only when you save a file, but also when you create folders, repartition the disk, and so on. Information is written all over a disk, not only when you save a file, but also when you create folders, repartition the disk, and so on. File remnants could be found in: File remnants could be found in: 1. Slack space 2. Unallocated disk space 3. Unused disk space 4. Hidden files

37. Next Back MAP MAP B-37 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information 1. Deleted Files and Slack Space  Slack space - the space left from the end of the file.  Leftover information there can be recovered by forensic software.

38. Next Back MAP MAP B-38 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information Figure B.7 page 358 Figure B.7 Fragment of E- Mail Found in Slack Space by EnCase page 358

39. Next Back MAP MAP B-39 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information 2. Unallocated Disk Space  Unallocated space - the set of clusters that have been set aside to store information, but have not yet received a file, or still contain some or all of a file marked as deleted.

40. Next Back MAP MAP B-40 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information 3. Unused disk space  Part of the disk that is left over when the disk is reformatted or repartitioned..

41. Next Back MAP MAP B-41 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Ways of Hiding Information Rename the file. Rename the file. Make the information invisible (white text on white background.) Make the information invisible (white text on white background.) Use windows to hide files. Use windows to hide files. Protect the file with a password. Protect the file with a password.

42. Next Back MAP MAP B-42 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Ways of Hiding Information Encrypt the file. Encrypt the file.  Encryption - scrambles the contents of a file so that you can’t read it without having the right decryption key. Use steganography. Use steganography.  Steganography - the hiding of information inside other information. Compress the file. Compress the file.

43. Next Back MAP MAP B-43 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation Places to Look for Stray Information Figure B.9 Steganography Hides a File in an Image page 361

44. Next Back MAP MAP B-44 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Recovery and Interpretation A Day In The Life Of Computer Forensics Experts Being a computer forensics expert is a profession that’s very demanding. Being a computer forensics expert is a profession that’s very demanding.  Know a lot about computers  Keep learning  Be careful and patient  Be cool under pressure  Be good at explaining to juries how computers work

45. Next Back MAP MAP B-45 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Summary Student Learning Outcomes 1. Define computer crime and list three types of computer crime that can be perpetrated from inside and three from outside the organization. 2. Define hackers, and identify the seven types of hackers and what motivates each group. 3. Define computer forensics and describe the two phases of a forensic investigation. 4. Identify and describe three places on a storage medium where you can find stray information. 5. Identify and describe seven ways of hiding information.

46. Next Back MAP MAP B-46 Management Information Systems for the Information Age Second Canadian Edition Copyright 2004 The McGraw-Hill Companies, Inc. All rights reserved Summary Assignments & Exercises 1. Find computer forensics software 2. Is your financial identity at risk for theft? 3. The international anti-cybercrime treaty