dfm covers

Criminal Profiling Part 2

Written by DFM team

A detailed look at the phases of a computer hack attack - part 2 of 2  

by Lucas Donato

The second of a two part of a series of articles that looks at how criminal profi ling can support digital forensic investigations, this article takes a detailed look at all phases of a computer intrusion, from the choice of victim through to the removal of traces after the obtainment of “root”, by joining a technical and a psychological approach in an unprecedented way by Lucas Donato

In the first fascinating article, we introduced the topic of the phases of a computer hacking attack by presenting the first three

phases of our model:

• The process to choose a target

• Footprinting

• Fingerprinting

In this article Lucacs discusses the remaining phases of “vulnerability identification and exploration”, “privilege escalation”, “actions with the target and access maintenance”, whilst finishing with a look at “trace removal”.

As identified in the first article of the series, the vulnerability identifi cation phase is one of the most critical phases in a hacking attack. After all, if a burglar wants to penetrate a house with success, he needs to identify with a certain level of precision those entrance points that offer more chance of success and under what conditions. In the same way, if a killer wants to approach his victim with a greater chance of success, he will need to know the victim’s habits and in which situations the victim is more exposed.

To support the process of identifying vulnerabilities in the digital world, a large number of tools exist, and the success rate of an intruder will be directly infl uenced by the arsenal of tools he has access too (e.g. public tools, commercial tools, group restrict tools), his ability to use the tools and by the amount of information that he has (or will obtain) regarding his victim.

In the previous article we looked at how to distinguish vulnerability identification tools and how to analyze the way the tool can be used. We also look at whether this phase was mandatory or not and investigated the challenge between automated and manual testing. To follow this we have identified other characteristics of this phase that are useful in our investigation, before moving to look at the subsequent phases:

1. Build a timeline of suspect probes regardless of their sources; attackers often use different origins to test or to collect information about the target. Websites such as the “Shodan Computer Search Engine” are rich sources of information to would be hackers. [Shodan].

2. When did the probes used, start to appear? Is it possible that the attacker was acting from home or from his office during business hours? Make a note of differences between time zones (this information can help in reveal the country of origin of the attack).

3. For local users, is someone trying to list installed software, existing accounts or using vulnerability scanners on the server? 

4. Try to identify if the kind of probes used reveals a previous knowledge of the target (e.g., probing specific services and unusual ports). If yes, how could the attacker obtain this kind of knowledge?

5. Is it possible to assess how much emphasis the attacker is placing on probing his target and for how long? This can reveal his determination.

Read the rest of Lucas Donato's final article on Criminal Profiling in Issue 7 of DFM - out now - login or subscribe today!

Please make cache directory writable.

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

Noemi Kuncik

Noemi Kuncik is an IT Forensics Specialist at Grant Thornton


Coming up in the Next issue of Digital Forensics Magazine

Graph Database Technology

Attackers examine how your assets are connected, looking for a vulnerable part of the network, and navigating via methods such as “spear phishing.” What they’re really doing is abstracting out the graph of your networked systems, which is the set of security dependencies. Read More »

Fraudulent Use of Digital Images and Detection Survey

This article looks at the basic concepts related to image forgery; the types, detection procedure algorithms and all possible techniques to detect malicious signatures ibased on forgery types and detection techniques. Read More »

Subscribe today

Discovery in the Cloud: An Investigator’s Close Look at Unexpected Risks and Challenges

Documents residing in cloud storage accounts are increasingly coming into scope in digital forensic investigations such as IP theft, regulatory, corruption, merger clearance and civil matters.  Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the future issues