9780132564717

Network forensics is transforming the way investigators examine computer crime: they have discovered that the network holds far more evidence than could ever be retrieved from a local hard drive. Network forensic skills are in especially short supply, and professionals are flocking to the scarce resources available for mastering these skills. Now, for the first time, there's a comprehensive and practical book on the subject. Building on their pioneering SANS Institute course, top network forensics experts Jonathan Ham and Sherri Davidoff take readers through an exciting, entertaining, and technically rigorous journey through the skills and principles of successful network investigation. One step at a time, they demonstrate how to recover usable forensic evidence from firewalls, web proxies, IDS, routers, wireless access points, and even raw packet captures. Coverage includes: * Understanding the unique challenges associated with network investigation * Mastering the state-of-the-art OSCAR Network Forensics Investigative Methodology * Acquiring evidence passively, actively, and interactively * Aggregating, correlating, and analyzing event logs * Investigating compromised encryption and SSL interception * And much more Every section contains a real-world case study, and the book culminates with a "Capstone" case study walking through an entire investigation from start to finish, and challenging readers to solve the crime themselves.

TERM	PRICE	DUE
SEMESTER	$49.54	Aug 02
QUARTER	$47.06	Jul 19
SHORT TERM	$44.59	Jun 21

Sherri Davidoff is a founder of LMG Security, an information security consulting and research firm. Her specialties include network penetration testing, digital forensics, social engineering testing, and web application assessments. She holds her S.B. in Computer Science and Electrical Engineering from MIT.

Jonathan Ham has been commissioned to teach NCIS investigators how to use Snort, performed packet analysis from a facility more than two thousand feet underground, taught intrusion analysis to the NSA, and chartered and trained the CIRT for one of the largest U.S. civilian federal agencies. He is a founder of LMG Security. His favorite field is ip[6:2].

Foreword          xvii
Preface         xix

Acknowledgments          xxv

About the Authors         xxvii

Part I: Foundation 1

Chapter 1: Practical Investigative Strategies 3

1.1 Real-World Cases 3

1.2 Footprints 8

1.3 Concepts in Digital Evidence 9

1.4 Challenges Relating to Network Evidence 16

1.5 Network Forensics Investigative Methodology (OSCAR) 17

1.6 Conclusion 22

Chapter 2: Technical Fundamentals 23

2.1 Sources of Network-Based Evidence 23

2.2 Principles of Internetworking 30

2.3 Internet Protocol Suite 35

2.4 Conclusion 44

Chapter 3: Evidence Acquisition 45

3.1 Physical Interception 46

3.2 Traffic Acquisition Software 54

3.3 Active Acquisition 65

3.4 Conclusion 72

Part II: Traffic Analysis 73

Chapter 4: Packet Analysis 75

4.1 Protocol Analysis 76

4.2 Packet Analysis 95

4.3 Flow Analysis 103

4.4 Higher-Layer Traffic Analysis 120

4.5 Conclusion 133

4.6 Case Study: Ann’s Rendezvous 135

Chapter 5: Statistical Flow Analysis 159

5.1 Process Overview 160

5.2 Sensors 161

5.3 Flow Record Export Protocols 166

5.4 Collection and Aggregation 168

5.5 Analysis 172

5.6 Conclusion 183

5.7 Case Study: The Curious Mr. X 184

Chapter 6: Wireless: Network Forensics Unplugged 199

6.1 The IEEE Layer 2 Protocol Series 201

6.2 Wireless Access Points (WAPs) 214

6.3 Wireless Traffic Capture and Analysis 219

6.4 Common Attacks 224

6.5 Locating Wireless Devices 229

6.6 Conclusion 235

6.7 Case Study: HackMe, Inc. 236

Chapter 7: Network Intrusion Detection and Analysis 257

7.1 Why Investigate NIDS/NIPS? 258

7.2 Typical NIDS/NIPS Functionality 258

7.3 Modes of Detection 261

7.4 Types of NIDS/NIPSs 262

7.5 NIDS/NIPS Evidence Acquisition 264

7.6 Comprehensive Packet Logging 267

7.7 Snort 268

7.8 Conclusion 275

7.9 Case Study: Inter0ptic Saves the Planet (Part 1 of 2) 276

Part III: Network Devices and Servers 289

Chapter 8: Event Log Aggregation, Correlation, and Analysis 291

8.1 Sources of Logs 292

8.2 Network Log Architecture 306

8.3 Collecting and Analyzing Evidence 311

8.4 Conclusion 317

8.5 Case Study: L0ne Sh4rk’s Revenge 318

Chapter 9: Switches, Routers, and Firewalls 335

9.1 Storage Media 336

9.2 Switches 336

9.3 Routers 340

9.4 Firewalls 344

9.5 Interfaces 348

9.6 Logging 352

9.7 Conclusion 355

9.8 Case Study: Ann’s Coffee Ring 356

Chapter 10: Web Proxies 369

10.1 Why Investigate Web Proxies? 369

10.2 Web Proxy Functionality 371

10.3 Evidence 375

10.4 Squid 377

10.5 Web Proxy Analysis 381

10.6 Encrypted Web Traffic 392

10.7 Conclusion 401

10.8 Case Study: Inter0ptic Saves the Planet (Part 2 of 2) 402

Part IV: Advanced Topics 421

Chapter 11: Network Tunneling 423

11.1 Tunneling for Functionality 423

11.2 Tunneling for Confidentiality 427

11.3 Covert Tunneling 430

11.4 Conclusion 439

11.5 Case Study: Ann Tunnels Underground 441

Chapter 12: Malware Forensics 461

12.1 Trends in Malware Evolution 462

12.2 Network Behavior of Malware 484

12.3 The Future of Malware and Network Forensics 491

12.4 Case Study: Ann’s Aurora 492

Afterword 519

Index 521

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

Amazon no longer offers textbook rentals. We do!

Network Forensics Tracking Hackers through Cyberspace

Network Forensics Tracking Hackers through Cyberspace

0132564718

Summary

Author Biography

Table of Contents

Supplemental Materials

Write a Review