Category Archives: Book Review

?

Rating: ***

Even though I’m a qualified ISO 27001 Lead Auditor and former “management consultant” I’m still basically a technical geek. So when I was asked to review this book I was not particularly looking forward to it and I asked myself what relevance did this book have to digital forensics?  I have to say having reviewed the book my mindset has changed.

The book contains 12 chapters, divided into three sections. The first section contains four chapters.  It explains social engineering and describes the risks to an organization of social engineering attacks.  It then goes on to explain why people are the weakest link in an organization.  Finally it explains why current thinking and approaches, including ISO 27001, do not pay due attention to social engineering risks. The second section then goes on to explain human vulnerabilities.  It does this by examining a number of topics in the section’s chapters, including building trust, reading a person, subconscious techniques (including Neuro-Linguistic Programming) and then different roles a social engineer attacker could take.  The final section concentrates on countermeasures to social engineering.  It does this by describing techniques to assess an organization’s vulnerabilities, explaining security controls to counter defined vulnerabilities, including awareness and training.  Finally the section explains how the countermeasures can be tested.

The book comprises 254 pages and given the retail price it is not the best value book I have come across.

So given all of the above, why did I get some value out of reviewing it?  The answer lies within the number of examples and incidents of social engineering attacks it describes.  There are over a dozen.  Whilst a few of them have only a human element to them, most involve to some degree IT or phone technology.  So I started thinking!  If one of these attacks occurred what evidence would I need to find to prove such an attack had occurred, or how would it be possible to establish an innocent victim wasn’t actually the perpetrator?  It was quite thought provoking.

This is not a book on IT security, or Digital Forensics.  Given the number of pages and the sell price it is not particularly good value.  However if you would like to understand social engineering attacks and consider its relevance to digital forensics this is a reasonable edition to your library.

John Hughes

Book Title: Hacking the Human

Book Subtitle: Social Engineering Techniques & Security Countermeasures

Author(s): Ian Mann

Publisher: Gower Publishing Ltd.

Date of Publishing: November 2008

ISBN(13): 978-0566087738

Price: $104.95 / £60.00

(7824)

Title: Malware Forensics: Investigating and Analyzing Malicious Code

Authors: James M. Aquilina, Eoghan Casey, Cameron H. Malin

Publisher: Syngress

Reviewer: Tony Campbell

Review:

It has seemed for some time to me that publisher, Syngress, has the Digital Forensics book market almost exclusively to itself. After reading Malware Foresnics, my mind had not been changed one iota. This book, although published in June 2008, is by far the most comprehensive introduction to the inner workings of malware that I’ve come across. Understanding malware is a really complicated subject, for sure, covering a broad spectrum of illicit software types, but there is no doubt that the combined efforts of James Aquilina, Eoghan Casey, and Cameron Malin delivers a fantastic result. Quite often I personally struggle with reading heavyweight textbooks cover to cover, often with these books ending up on my bookshelf as unread references just in case I will need them in the future. However, I did read this one, cover to cover, and have come out the other side of that experience a better man. The authors go into the low-level details of both Windows and Linux malware and decompose the inner working of each type of illicit software to a fundamental degree of understanding that is consumable by programmers and non-programmers (like me). Another great feature of this book is that the authors do not hold back on their use of Windows and Linux tools, taking the reader through the processes involved analyzing real examples of malware in both operating system environments. I would recommend this book to anyone who has an interest in understanding malware and certainly recommend it to anyone who has a need to understand the context of malware in computer forensics. It is very apparent from the style of delivery and especially after re-reading the introductory section on the context of forensics that the authors are very focused on the evidentiary weight of their malware analysis. I applaud them for these efforts and highly recommend this book as not just being for malware geeks, but really important for anyone trying to understand the nature of malicious code and how it can adversely affect your forensic investigation. At 592 pages, this book is a true heavyweight contender and is truly the best value for money I’ve found on this subject. Well done, Syngress and well done autors for Winner of Best Book Bejtlich read in 2008.

(5455)

Title: Real Digital Forensics: Computer Security and Incident Response

Authors: Keith J. Jones, Richard Bejtlich, Curtis W. Rose

Publisher: Addison-Wesley

ISBN-13: 978-0-321-24069-9

Reviewer: Chris Bilger

Review:

Although “Real Digital Forensics: Computer Security and Incident Response” was published as long ago as 2005, it still provides a solid all-round introduction to IT forensics. (A new edition entitled “Real Digital Forensics 2” is planned for mid-2010). Weighing in at 688 pages, this book covers Windows, Unix and Linux and explains digital forensics from the perspectives of incident response and case law. It also discusses in depth a number of commercial and open source tools used to perform forensic analysis. The DVD which accompanies the book contains several sets of sample intrusion data generated by attacking live systems, and is extremely useful for practice forensic examinations.
The first section, Live Incident Response, shows how to carry out an incident response process on Windows and Unix platforms. It covers the types of information to collect from a machine, what to look for, and why this information is important in determining that an attacker has compromised a resource.
The next part, Network-Based Forensics, looks into the different kinds of data that can be collected on a network. It examines how to use each type of data in a forensic examination, and describes the tools used to capture different kinds of data. As before, specific details are given on analysing evidence on different operating systems.
The third part, Acquiring a Forensic Duplication, is devoted to creating a sound forensic image. It is important that suitable guidelines are followed so the process of creating an image will hold up in a court of law. This is done by following appropriate procedures and using write blocking tools. Detailed information is provided on creating images with commercial and open source products.
Part four, Forensic Analysis Techniques, is the longest section of the book. It covers a myriad of techniques that can be used to squeeze the last drop of useful information from data. The topics include:
* Recovering deleted files;
* Electronic discovery;
* Reconstructing web browsing and email activity;
* Windows registry reconstruction;
* Analysis of different forensic tools sets for Windows and Unix/Linux;
* Analysing unknown files.
These chapters provide the critical information that is needed for most forensic examinations.
Part five, Creating a Complete Forensic Toolkit, deals with tools for Windows and Unix/Linux and how to create a robust toolkit that will aid a forensic investigator during examinations. It shows how to make sure the tools that are used do not alter information on the host system. Additional information is given on how to make a bootable Linux distribution that includes the tools.
The sixth section, Mobile Forensics, discusses forensics as applied to mobile devices. It covers multiple tools that can be used for forensic analysis of a Personal Digital Assistant (PDA). Chapters are devoted to creating duplications of USB devices and compact flash cards and the analysis of these devices.
The last section of the book, Online-Based Forensics, looks into popular on-line email sites and how to track emails sent through these services. It also investigates ways to determine domain name ownership. There is an appendix that introduces the Perl scripting language, which can be useful for sorting through large amounts of data.
This book is easy to read and comprehend, and its authors have an abundance of experience in the field of forensics and incident response. Keith Jones has been an expert witness on several cases. Richard Bejtlich is Director of Incident Response at the General Electric Company and author of the TaoSecurity blog; he has written and contributed to a number of other books on IT security (Extrusion Detection: Security Monitoring for Internal Intrusions, The Tao of Network Security Monitoring: Beyond Intrusion Detection…) Curtis Rose has 18 years of experience in computer forensics and Information Security, and leads teams that conduct computer examinations.
The authors do a great job of stepping through each chapter and explaining techniques in a way that is easy to understand. The section of the book that helped me most professionally was section five, Creating a Complete Forensic Toolkit, which explains exactly how to create a bootable toolkit that will not alter data on the host system. On the whole, this book provides a consistent introduction to a wide array of IT forensics topics. One topic that feels incomplete, however – perhaps because of the book’s vintage – is Mobile Device Forensics. There is no information on mobile phones and MP3 players. That is an isolated shortcoming, however. The book introduces and discusses many of the tools that are widely used in the field, and its screenshots are helpful in illustrating sample output from tools. In my opinion “Real Digital Forensics: Computer Security and Incident Response” is a great resource for any forensic investigator.

Chris Bilger

(2568)

Book Title: iPhone Forensics
Subtitle: Recovering Evidence, Personal Data & Corporate Assets
Author: Jonathan Zdziarski
Publisher: O’Reilly
Date of Publication: 17 September 2008
Price: £30.99 (UK), $39.99 (USA)
ISBN: 978-0-596-15358-8

Reviewer: Tony Campbell

Review

I love my iPhone and so should you (he says in a monotone, robotic voice). But, the real question is, am I just another Apple fanboy, brainwashed by Steve Jobs’ celebrity industry presence and marketing genius? Or have I really made a buying decision based on the facts? It’s true that the iPhone is probably the sexiest piece of kit in this arm of the Milky Way, but is there something lurking under the glitzy hood, that could rise up and bite us in the proverbial “you know what”?
Whether you are an individual or an organisation (and on whatever side of the law you happen to operate), you’ll need to know exactly how much risk you are taking when you do business on your iPhone. How secure is your data and, forensically, how many of your daily activities, transactions and communications are accountable in the eyes of the law?

So, how do you dig into Apple’s prizewinning marrow while donning the cap of the forensics investigator? That’s the easy part: pick up a copy of Jonathan Zdziarski’s iPhone Forensics, published by O’Reilly Media, and you’ll see exactly what’s going on beneath the glossy veneer. This book is a great technical companion for computer forensics guys who have a need (or a calling) to dig into the iPhone platform. True, it’s a very short book with a high price point (just 113 pages of technical content for £30.99), so the real proposition is pitched in terms of technical punch rather than kilograms of rainforest.

The foreword, written by the enigmatic John T Draper (Cap’n Crunch), sets the scene for the rest of the book, showing that it’s fairly easy for investigators to get a bucket load of valuable data from the iPhone as long as they know where to look. Zdziarski kicks off with a great introductory chapter that takes us through the rules of evidence collection and good forensic practice, before launching into the technical chapters. Even if it is aimed primarily at the newbie investigator, this introduction gives the book a nice, well-rounded feel.

Chapters 2 and 3 cover the basics of understanding the iPhone architecture and how to gain access to the underlying system. These chapters are invaluable and written in an easy to follow style, but quickly get you to the stage where you are looking at the iPhone device with its pants pulled well and truly down. Zdziarski then spends the next three chapters focusing on the forensic recovery of data, and analysing a whole bunch of interesting tools, such as Foremost and Scalpel. He then launches into e-discovery where he details techniques for finding evidence inside iPhone database files (SQLite) and XML property lists (these contain items such as cookies, account details, and Safari browsing history).

Chapter 6 ties the iPhone forensic investigation to the desktop PC, describing tools and techniques for pairing evidence between the two platforms. Finally, Chapter 7 cuts to the chase and explains in terms of specific kinds of investigation (and real-life cases) which information is the most useful, and how it would be presented in court.

This book is an excellent resource for any computer forensics investigator. I recommend buying it, and also registering on O’Reilly’s website for their up-to-date iPhone Forensics Data Recovery Training and listening to some of the webcasts by Jonathan Zdziarski himself. For more information on these resources, see http://search.oreilly.com/?q=iphone+forensics .

(1282)