dfm covers
 
 

Criminal Profiling Part 2

A detailed look at the phases of a computer hack attack - part 2 of 2  

by Lucas Donato



The second of a two part of a series of articles that looks at how criminal profi ling can support digital forensic investigations, this article takes a detailed look at all phases of a computer intrusion, from the choice of victim through to the removal of traces after the obtainment of “root”, by joining a technical and a psychological approach in an unprecedented way by Lucas Donato


In the first fascinating article, we introduced the topic of the phases of a computer hacking attack by presenting the first three

phases of our model:

• The process to choose a target

• Footprinting

• Fingerprinting


In this article Lucacs discusses the remaining phases of “vulnerability identification and exploration”, “privilege escalation”, “actions with the target and access maintenance”, whilst finishing with a look at “trace removal”.


As identified in the first article of the series, the vulnerability identifi cation phase is one of the most critical phases in a hacking attack. After all, if a burglar wants to penetrate a house with success, he needs to identify with a certain level of precision those entrance points that offer more chance of success and under what conditions. In the same way, if a killer wants to approach his victim with a greater chance of success, he will need to know the victim’s habits and in which situations the victim is more exposed.


To support the process of identifying vulnerabilities in the digital world, a large number of tools exist, and the success rate of an intruder will be directly infl uenced by the arsenal of tools he has access too (e.g. public tools, commercial tools, group restrict tools), his ability to use the tools and by the amount of information that he has (or will obtain) regarding his victim.


In the previous article we looked at how to distinguish vulnerability identification tools and how to analyze the way the tool can be used. We also look at whether this phase was mandatory or not and investigated the challenge between automated and manual testing. To follow this we have identified other characteristics of this phase that are useful in our investigation, before moving to look at the subsequent phases:


1. Build a timeline of suspect probes regardless of their sources; attackers often use different origins to test or to collect information about the target. Websites such as the “Shodan Computer Search Engine” are rich sources of information to would be hackers. [Shodan].

2. When did the probes used, start to appear? Is it possible that the attacker was acting from home or from his office during business hours? Make a note of differences between time zones (this information can help in reveal the country of origin of the attack).

3. For local users, is someone trying to list installed software, existing accounts or using vulnerability scanners on the server? 

4. Try to identify if the kind of probes used reveals a previous knowledge of the target (e.g., probing specific services and unusual ports). If yes, how could the attacker obtain this kind of knowledge?

5. Is it possible to assess how much emphasis the attacker is placing on probing his target and for how long? This can reveal his determination.


Read the rest of Lucas Donato's final article on Criminal Profiling in Issue 7 of DFM - out now - login or subscribe today!



 
Please make cache directory writable.
 

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

Dr Tim Watson

Dr Tim Watson is the head of the Department of Computer Technology at De Montfort University

 

Coming up in the Next issue of Digital Forensics Magazine

Coming up in Issue 34 on sale from February 2018:


Device Forensics in the Internet of Things

As more businesses and consumers adopt IoT devices, privacy violations and cyber-attacks by malicious actors will become commonplace due to the insecure IoT infrastructure. Read More »

Data Destruction In Current Hard Disks & Data Destruction Techniques

Data destruction is a process traditionally applied using physical techniques, aiming at the completely destruction of the hard disk, however, there is an increasing interest in the use of logical techniques for data destruction, that allow reusing the physical device. Read More »

Subscribe today


Faster Searching For Known Illegal Content

Cryptographic (“MD5”) hash searching for known illegal material is one of the most thorough methods of digital forensic investigation. However, the technique is hampered by the ever-increasing size of media being examined, and the size of the hash list being searched. Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the next issue