dfm covers

Criminal Profiling Part 2

Written by DFM team

A detailed look at the phases of a computer hack attack - part 2 of 2  

by Lucas Donato

The second of a two part of a series of articles that looks at how criminal profi ling can support digital forensic investigations, this article takes a detailed look at all phases of a computer intrusion, from the choice of victim through to the removal of traces after the obtainment of “root”, by joining a technical and a psychological approach in an unprecedented way by Lucas Donato

In the first fascinating article, we introduced the topic of the phases of a computer hacking attack by presenting the first three

phases of our model:

• The process to choose a target

• Footprinting

• Fingerprinting

In this article Lucacs discusses the remaining phases of “vulnerability identification and exploration”, “privilege escalation”, “actions with the target and access maintenance”, whilst finishing with a look at “trace removal”.

As identified in the first article of the series, the vulnerability identifi cation phase is one of the most critical phases in a hacking attack. After all, if a burglar wants to penetrate a house with success, he needs to identify with a certain level of precision those entrance points that offer more chance of success and under what conditions. In the same way, if a killer wants to approach his victim with a greater chance of success, he will need to know the victim’s habits and in which situations the victim is more exposed.

To support the process of identifying vulnerabilities in the digital world, a large number of tools exist, and the success rate of an intruder will be directly infl uenced by the arsenal of tools he has access too (e.g. public tools, commercial tools, group restrict tools), his ability to use the tools and by the amount of information that he has (or will obtain) regarding his victim.

In the previous article we looked at how to distinguish vulnerability identification tools and how to analyze the way the tool can be used. We also look at whether this phase was mandatory or not and investigated the challenge between automated and manual testing. To follow this we have identified other characteristics of this phase that are useful in our investigation, before moving to look at the subsequent phases:

1. Build a timeline of suspect probes regardless of their sources; attackers often use different origins to test or to collect information about the target. Websites such as the “Shodan Computer Search Engine” are rich sources of information to would be hackers. [Shodan].

2. When did the probes used, start to appear? Is it possible that the attacker was acting from home or from his office during business hours? Make a note of differences between time zones (this information can help in reveal the country of origin of the attack).

3. For local users, is someone trying to list installed software, existing accounts or using vulnerability scanners on the server? 

4. Try to identify if the kind of probes used reveals a previous knowledge of the target (e.g., probing specific services and unusual ports). If yes, how could the attacker obtain this kind of knowledge?

5. Is it possible to assess how much emphasis the attacker is placing on probing his target and for how long? This can reveal his determination.

Read the rest of Lucas Donato's final article on Criminal Profiling in Issue 7 of DFM - out now - login or subscribe today!

Please make cache directory writable.

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

Andrew Hoog

Andrew Hoog is the Chief Investigative Officer at viaForensics'


Coming up in the Next issue of Digital Forensics Magazine

Coming up in Issue 38 on sale from February 2019:

Crowd Sourcing Digital Evidence The Risk v The Reward

All digital devices used today can be considered as a potential source for digital evidence. Andrew Ryan investigates the current state in the art of crowd sourced digital evidence. Read More »

Recovery of Forensic Artifacts from Deleted Jump-List in Windows 10

Jump-Lists are widely discussed in forensics community since the release of Windows 7 and are having more capabilities to reveal forensics artifacts in Windows 10. Read More »

Subscribe today

Operacion Bitcoin

The article is an actual case study of an Interpol investigation carried out in association with CertUY that has been ongoing for some months. It is written by the first hacker sent to prison in Uruguay who is currently out on bail pending sentencing. Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the next issue