dfm covers

Criminal Profiling Part 2

A detailed look at the phases of a computer hack attack - part 2 of 2  

by Lucas Donato

The second of a two part of a series of articles that looks at how criminal profi ling can support digital forensic investigations, this article takes a detailed look at all phases of a computer intrusion, from the choice of victim through to the removal of traces after the obtainment of “root”, by joining a technical and a psychological approach in an unprecedented way by Lucas Donato

In the first fascinating article, we introduced the topic of the phases of a computer hacking attack by presenting the first three

phases of our model:

• The process to choose a target

• Footprinting

• Fingerprinting

In this article Lucacs discusses the remaining phases of “vulnerability identification and exploration”, “privilege escalation”, “actions with the target and access maintenance”, whilst finishing with a look at “trace removal”.

As identified in the first article of the series, the vulnerability identifi cation phase is one of the most critical phases in a hacking attack. After all, if a burglar wants to penetrate a house with success, he needs to identify with a certain level of precision those entrance points that offer more chance of success and under what conditions. In the same way, if a killer wants to approach his victim with a greater chance of success, he will need to know the victim’s habits and in which situations the victim is more exposed.

To support the process of identifying vulnerabilities in the digital world, a large number of tools exist, and the success rate of an intruder will be directly infl uenced by the arsenal of tools he has access too (e.g. public tools, commercial tools, group restrict tools), his ability to use the tools and by the amount of information that he has (or will obtain) regarding his victim.

In the previous article we looked at how to distinguish vulnerability identification tools and how to analyze the way the tool can be used. We also look at whether this phase was mandatory or not and investigated the challenge between automated and manual testing. To follow this we have identified other characteristics of this phase that are useful in our investigation, before moving to look at the subsequent phases:

1. Build a timeline of suspect probes regardless of their sources; attackers often use different origins to test or to collect information about the target. Websites such as the “Shodan Computer Search Engine” are rich sources of information to would be hackers. [Shodan].

2. When did the probes used, start to appear? Is it possible that the attacker was acting from home or from his office during business hours? Make a note of differences between time zones (this information can help in reveal the country of origin of the attack).

3. For local users, is someone trying to list installed software, existing accounts or using vulnerability scanners on the server? 

4. Try to identify if the kind of probes used reveals a previous knowledge of the target (e.g., probing specific services and unusual ports). If yes, how could the attacker obtain this kind of knowledge?

5. Is it possible to assess how much emphasis the attacker is placing on probing his target and for how long? This can reveal his determination.

Read the rest of Lucas Donato's final article on Criminal Profiling in Issue 7 of DFM - out now - login or subscribe today!

Please make cache directory writable.

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

George Bailey

George Bailey is an IT security professional with over 15 years of experience


Coming up in the Next issue of Digital Forensics Magazine

Coming up in Issue 33 on sale from November 2017:

Triage Solution for Sex Offender Managers

This article considers a proof of concept triage solution for sex offender managers for a local police force which if successful could simplify and modify the way that sex offenders are managed. Read More »

Advancements in Windows Hibernation File Forensics

Brian Gerdon looks at how the windows hibernation files can be a valuable source of information for digital forensic investigators. Read More »

Subscribe today

Why Are Cybercriminals Attracted To Commit Crimes

Individuals who engage in cybercrime have a psychological mindset that is attuned to it. This paper discusses the motives behind cybercrime and what makes cybercrime attractive to cybercriminals. Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the next issue