View
2
Download
0
Category
Preview:
Citation preview
Principles of NetworkForensics
Richard Baskerville
Georgia StateUniversity
P Internet Concepts Review
PNetwork-based LiveAcquisitions
PNetwork Forensics Principles
Agenda
Principles of Network Forensics
Internet Concepts Review
IPv4
Packet Switched Networks
ErrorCheck Data Header
Packets
Customers
Cust. Cust. Cust.Cust.
LargCeu stomer
Packet Network
1
2
3
4
5
6 7
A-C
D-H I-M N-PQ-Y
Z
X.25 Packet
MessageFramCeh eckSequence
Flag01111110
Flag01111110
Address Control
Open Systems Interconnection (OSI) Model
PhysicLaal yer
DataL inkL ayer
NetworLka yer
TranspoLrat yer
SessioLna yer
PresentatioLna y.
ApplicatioLna yer
PhysicLaal yer
DataL inkL ayer
NetworLka yer
TranspoLrat yer
SessioLna yer
PresentatioLna y.
ApplicatioLna yer
Client Server
P Application Layer
P Host-to-Host Transport Layer
P Internet Layer
P Network Access Layer
Internet Model
Internet Layers
Data
Data + TL Pr
Data + TL/IL Pr
Application Layer
Transport Layer
Internet Layer
Network Access Layer
Data + TL/IL/NA Pr
FTP
TCP
IP
X.25
Data
Data + TL Pr
Data + TL/IL Pr
FTP
TCP
IP
X.25
< CCITT X.25< IEEE 802.3< Ethernet< Novell Netware< CSMA/CD< Token Ring (IEEE 802.5)
Network Access Layer
P Internet Protocol (IP)
P Datagram< Header (5-6 words)< Data
P Types of network nodes< Gateways< Hosts
P Internet Control Message Protocol (ICMP)
Internet Layer
P Transmission ControlProtocol (TCP)
< 6-word header< "reliable"< connection oriented
P User Datagram Protocol(UDP)
Transport Layer
P FTP
P Telnet
P SMTP
P DNS
P NFS
P RIP
P Gopher
P WAIS
P WWW
Application Layer
P IP Addresses< 4-byte numbers
– eg 121.11.21.18
< Network addresses– 121.11.21.0
< Multihomed hosts andgateways have twoaddresses
P Domain Name Service< Host tableNIC Host table
Internet Addressing
IPv4
Nesting Packets
Data
Header
Header
Header
Header
HeaderHeader
Data
Data
Data
Application Layer
Transport Layer
Internet Layer
Network Access Layer
Domain Hierarchy
Domain Name Server Response
ww.ibm.com?
com NS nic.com
www.ibm.com?
ibm.com NS vm1.ibm.com
www.ibm.com?
www.ibm.com A 111.222.101.111
nic.cbs.dk
nic.com
vm1.ibm.com
First
Second
Third
PTransport layer routingtables< lists destination nets with
gateways< "default" gateway where
unlisted IP packets aresent
PAddress resolution< Network access layer
Routing
Ports and Sockets
Telnet Client
Telnet Server
131.71.8.1
211.14.21.2
Socket:131.71.8.1.3121,211.14.21.2.23
Socket:211.14.21.2.23,131.71.8.1.3121
PSlowed Exhaustion ofIPv4 address space
PRouting tables simplified< Base address< Size of subnet
PEnabled more fluidsubnet proliferation
Classless Inter-Domain Routing
(CIDR)
P32-byte address numbers< Addresses IPv4 Address
Exhaustion
PAutoconfiguration < Router solicitation & advertisement
PMany other features, e.g.,< Multicast capability no longer
optional< Network layer security (encryption)
no longer optional
IPv6
Network-based LiveAcquisitions
PCases where circumstances preventremoving the media from the computer.
PSpecialty hardware (e.g., some laptops)
PUnusual hard drive geometries< Host Protected Areas (HPA)< Device Configuration Overlays (DCO)
PDisclosure of ongoing investigation < “Black bag” jobs
Motivation: Live Acquisitions
PHelix< Linux boot of Windows machine< C:\ drive write protected< Encase, FTK, dd imaging
PForensic Boot Disk< Diskette or CD< DOS< Windows 98< EnCase Boot Disk
Safely Booting Target Machine
Homemade
PUSB adapter
PDisk-to-disk< No boot required< Open the box, connect directly to drive
PCross-over cable< Use network acquisition technology
Connecting Acquisition Devices
PServlet installed on target machine< Requires administrator access< Can be installed remotely
PServlet feeds image to acquiring machine
PMay require authentication< (E.g., EnCase)
Live Network Acquisitions (I)
Live Network Acquisition (II)
AuthenticationServer
ForensicsExaminer
AcquisitionTarget
Network
Servlet
Network ForensicsPrinciples
The action of capturing, recording, andanalyzing network autdit trails in order todiscover the source of security breaches orother information assurance problems.
Network Forensics
Kim, et al (2004) “A fuzzy expert system for networkfornesics”, ICCSA 2004, Berlin: Springer-Verlag, p. 176
PProtocol< Eg, SQL-Injection
PMalware< Eg, Virus, Trojan, Worm
PFraud< Eg, Phishing, Pharming, etc.
Network Attacks
PSuccessful< Obfuscation of residue
PUnsuccessful< Residue is intact
Attack Residue
PManaging data volume
PManaging logging performance
PEnsuring logs are useful to reconstruct theAttack
PCorrelation of data in logs< Importance of timestamping
Network Traffic Capture
Logging Issues Driving Automated Support
Honeytraps
Systems Designed to be Compromised and Collect AttackData
From Yasinac, A. andManzano, Y. (2002)“Honeytraps, A NetworkForensic Tool” FloridaState University.
PSessionizing
PProtocol parsing andanalysis
PDecryption
PSecurity of Analysis andData< Avoiding detection and
analysis-data compromise
Network Traffic Analysis
Usually Requires Software Tools
PMinimizing distance to source
PTraversing firewalls, proxies and addresstranslation
PMuliple cooroborating collectors
PTime and location stamping
Traceback Evidence Processing
Principles of NetworkForensics
Richard Baskerville
Georgia StateUniversity
Recommended