Amazon no longer offers textbook rentals. We do!

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

by: Stephenson; Peter

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

by: Stephenson; Peter

ISBN 13:
9780849322181
ISBN 10:
0849322189
Format: Hardcover
Copyright: 09/28/1999
Publisher: CRC Press
Newer Edition

Rent

Sorry, this item is currently unavailable.

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

Extend or Purchase Your Rental at Any Time

Need to keep your rental past your due date? At any time before your due date you can extend or purchase your rental through your account.

Summary

Written by an experienced information security specialist, Investigating Computer-Related Crime is tailored to the needs of corporate information professionals and investigators. It gives a step-by-step approach to understanding and investigating security problems, and offers the technical information, legal information, and computer forensic techniques you need to preserve the security of your company's information.Investigating Computer-Related Crime discusses the nature of cyber crime, its impact in the 21st century, its investigation and the difficulties encountered by both public law enforcement officials and private investigators. By detailing an investigation and providing helpful case studies, this book offers insights into collecting and preserving evidence, interrogating suspects and witnesses; handling the crime in progress, and issues in involving the authorities. The seasoned author offers valuable, firsthand information on using the forensic utilities for preserving evidence and searching for hidden information, to help you devise solutions to the computer-related crimes that threaten the well-being of your company.

Section 1---The Nature of Cyber Crime

Cyber Crime as We Enter the Twenty-First Century

(12)

What Is Cyber Crime?

(1)

How Does Today's Cyber Crime Differ from the Hacker Exploits of Yesterday?

(3)

The Reality of Information Warfare in the Corporate Environment

(1)

Industrial Espionage---Hackers for Hire

(4)

Public Law Enforcement's Role in Cyber Crime Investigations

(1)

The Role of Private Cyber Crime Investigators and Security Consultants in Investigations

(1)

References

(1)

The Potential Impacts of Cyber Crime

(16)

Data Thieves

(6)

How Data Thieves Avoid Detection During an Attack

(1)

Masking Logins

(1)

Masking Telnet

(2)

How Data Thieves ``Clean Up'' After an Attack

(1)

Techniques for Detecting File Reads and Uploads

(1)

Misinformation

(4)

Denial of Service

(4)

Data Floods and Mail Bombs

(1)

Attacks from Inside the Organization

(1)

Attacks Which Require Access to the Computer

(1)

Chapter Review

(2)

Rogue Code Attacks

(14)

Viruses, Trojan Horses, and Worms

(7)

Types of Viruses

(1)

File Infector

(1)

Resident Program Infector

(1)

Boot Sector Infector

(1)

Multi-Partite Virus

(1)

Dropper

(1)

Stealth Virus

(1)

Companion Virus

(1)

Polymorphic Virus

(1)

Mutation Engine

(1)

Detection Methods

(1)

Pattern Scanners

Integrity Checkers

(1)

Behavior Blockers

(1)

Trojan Horses

(1)

Worms

(1)

Logic Bombs

(1)

Modifying System Files

(1)

Responding to Rogue Code Attacks

(2)

Viruses

(1)

Trojan Horses and Logic Bombs

(1)

Protection of Extended Mission-Critical Computer Systems

(1)

Post-Attack Inspection for Rogue Code

(1)

Summary

(1)

Reference

(2)

Surgical Strikes and Shotgun Blasts

(18)

Denial of Service Attacks

(4)

Service Overloading

(1)

Message Flooding

(1)

Signal Grounding

(1)

Other Attacks

(1)

Attacking from the Outside

(1)

Attacking from the Inside

(1)

Dumping Core

(1)

Symptoms of a Surgical Strike

(2)

Panics

(1)

Other Surgical Attacks

(1)

Masquerading

(4)

User Masquerades

(1)

System Masquerades

(1)

Spoofing

(1)

E-Mail

(1)

Web Site

(1)

IP Spoofing

(1)

Case Study: The Case of the Cyber Surgeon

(1)

Symptoms of Shotgun Blasts

(1)

``Up Yours''---Mail Bombs

(1)

Flooding Attacks

(1)

Summary

(1)

References

(4)

Section 2---Investigating Cyber Crime

A Framework for Conducting an Investigation of a Computer Security Incident

(18)

Managing Intrusions

(3)

Why We Need an Investigative Framework

(1)

What Should an Investigative Framework Provide?

(1)

One Approach to Investigating Intrusions

(2)

Drawbacks for the Corporate Investigator

(1)

A Generalized Investigative Framework for Corporate Investigators

(10)

Eliminate the Obvious

(1)

Hypothesize the Attack

(1)

Reconstruct the Crime

(1)

Perform a Traceback to the Suspected Source Computer

(1)

Analyze the Source, Target, and Intermediate Computers

(1)

Collect Evidence, Including, Possibly, the Computers Themselves

(3)

Turn Your Findings and Evidentiary Material over to Corporate Investigators or Law Enforcement for Follow-Up

(1)

Summary

(1)

References

(1)

Look for the Hidden Flaw

(14)

The Human Aspects of Computer Crime and the FBI Adversarial Matrix

(4)

Crackers

(1)

Criminals

(1)

Vandals

(1)

Motive, Means, and Opportunity

(1)

Evidence and Proof

(4)

Look for the Logical Error

(2)

Vanity

(1)

Summary

(1)

Reference

(1)

Analyzing the Remnants of a Computer Security Incident

(26)

What We Mean by a Computer Security Incident

(2)

We Never Get the Call Soon Enough

(1)

Computer Forensic Analysis---Computer Crimes at the Computer

(13)

DOS Disks---A Brief Tutorial

(1)

Slack Space

100

(1)

Unallocated Space

101

(1)

Windows Swap Files and Web Browser Caches

101

(1)

Processing Forensic Data---Part One: Collection

102

(1)

Collection Techniques

103

(3)

Analysis Tools and Techniques

106

(1)

Chaining

107

(1)

Unix and Other Non-DOS Computers

108

(3)

Cyber Forensic Analysis---Computer Crimes Involving Networks

111

(2)

Software Forensic Analysis---Who Wrote the Code?

113

(1)

The Limitations of System Logs

114

(2)

The Logs May Tell the Tale---But What If There Are No Logs?

116

(1)

Multiple Log Analysis

117

(2)

Summary

119

(1)

References

119

(2)

Launching the Investigation

121

(28)

Launching the Investigation

121

(1)

Analyzing the Incident

122

(1)

Analyzing the Evidence and Preparing Your Presentation

122

(1)

Securing the Virtual Crime Scene

123

(4)

Clear Everyone away from the Computer Under Investigation

124

(1)

Examine for Communications Connections, Document All Connections, and Unplug Communications from the Computer

124

(1)

Pull the Plug

125

(2)

Collecting and Preserving Evidence

127

(10)

Rules of Evidence

128

(9)

Interrogating and Interviewing Witnesses

137

(7)

Preparation and Strategy

138

(2)

The Interview

140

(1)

Establishing Credibility

141

(1)

Reducing Resistance

142

(1)

Obtaining the Admission

142

(1)

Developing the Admission

143

(1)

The Professional Close

143

(1)

Developing and Testing an Intrusion Hypothesis

144

(1)

Investigating Alternative Explanations

145

(1)

You May Never Catch the Culprit

146

(1)

Damage Control and Containment

147

(1)

Summary

147

(1)

References

148

(1)

Determining If a Crime Has Taken Place

149

(22)

Statistically, You Probably Don't Have a Crime

149

(1)

Believe Your Indications

150

(2)

Using Tools to Verify That a Crime Has Occurred

152

(14)

Unix Crash Dump Analysis

153

(2)

Identifying the Unix Release and Hardware Architecture

155

(1)

The Message Buffer

155

(1)

Other Unix Utilities

156

(1)

Recovering Data from Damaged Disks

157

(2)

Recovering Passwords

159

(1)

Physical Password Recovery

159

(1)

Password Cracking

159

(1)

By Inference

160

(1)

Examining Logs---Special Tools Can Help

161

(1)

Investigating Non-Crime Abuses of Corporate Policy

162

(2)

Clues from Witness Interviews

164

(2)

Maintaining Crime Scene Integrity Until You Can Make a Determination

166

(1)

The Case of the CAD/CAM Cad

166

(2)

The Case of the Client/Server Tickle

168

(1)

Summary

168

(1)

Reference

169

(2)

Handling the Crime in Progress

171

(16)

Intrusions---The Intruder Is Still Online

171

(3)

Direct Dial-In

173

(1)

Should You Trap, Shut Down, or Scare Off the Intruder?

174

(3)

Trap-and-Trace

175

(1)

Network Trap-and-Trace Techniques

176

(1)

Legal Issues in Trap-and-Trace

177

(1)

Back Doors---How Intruders Get Back In

178

(6)

Back Doors in the Unix and NT Operating Systems

179

(1)

Password Cracking Back Door

179

(1)

Rhosts + + Back Door

180

(1)

Checksum and Timestamp Back Doors

180

(1)

180

(1)

Telnetd Back Door

181

(1)

Services Back Door

181

(1)

Cronjob Back Door

181

(1)

Library Back Doors

181

(1)

Kernel Back Doors

182

(1)

File System Back Doors

182

(1)

Bootblock Back Doors

182

(1)

Process Hiding Back Doors

182

(1)

Rootkit

183

(1)

Network Traffic Back Doors

183

(1)

TCP Shell Back Doors

183

(1)

UDP Shell Back Doors

184

(1)

ICMP Shell Back Doors

184

(1)

Encrypted Link

184

(1)

Windows NT

184

(1)

Stinging---Goat Files and Honey Pots

184

(1)

Summary

185

(1)

Reference

186

(1)

``It Never Happened''---Cover-Ups Are Common

187

(10)

Case Study: The Case of the Innocent Intruder

187

(2)

The Importance of Well-Documented Evidence

189

(1)

Maintaining a Chain of Custody

190

(1)

Politically Incorrect---Understanding Why People Cover Up for a Cyber Crook

191

(3)

Before the Investigation

192

(1)

During the Investigation

192

(1)

After the Investigation

193

(1)

When Cover-Ups Appear Legitimate

194

(1)

Summary

195

(2)

Involving the Authorities

197

(10)

When to Involve Law Enforcement

197

(1)

Who Has Jurisdiction?

198

(2)

What Happens When You Involve Law Enforcement Agencies?

200

(3)

Making the Decision

203

(2)

Summary

205

(2)

When an Investigation Can't Continue

207

(10)

When and Why Should You Stop an Investigation?

207

(1)

Legal Liability and Fiduciary Duty

208

(2)

Political Issues

210

(2)

Before the Investigation Begins

210

(1)

During the Investigation

210

(1)

After the Investigation Is Completed

211

(1)

Civil vs. Criminal Actions

212

(1)

Privacy Issues

213

(1)

Salvaging Some Benefit

213

(1)

Summary

214

(3)

Section 3---Preparing for Cyber Crime

Building a Corporate Cyber ``SWAT Team''

217

(18)

Why Do Organizations Need a Cyber SWAT Team?

217

(1)

What Does a Cyber SWAT Team Do?

218

(1)

A Standard Practice Example

218

(14)

Who Belongs on a Cyber SWAT Team?

232

(1)

Training Investigative Teams

232

(1)

Summary

233

(2)

Privacy and Computer Crime

235

(10)

The Importance of Formal Policies

235

(2)

Who Owns the E-Mail?

237

(1)

The Disk Belongs to the Organization, But What About the Data?

237

(1)

The ``Privacy Act(s)''

238

(3)

The Computer Fraud and Abuse Act

238

(1)

Electronic Communications Privacy Act

239

(1)

The Privacy Protection Act

240

(1)

State and Local Laws

240

(1)

Wiretap Laws

240

(1)

Fourth Amendment to the U.S. Constitution

241

(1)

Summary

241

(1)

Reference

241

(4)

Section 4---Using the Forensic Utilities

Preface---How the Section Is Organized

245

(24)

Preserving Evidence---Basic Concepts

247

(6)

Timely Evidence Collection and Chain of Custody

247

(2)

``Marking'' Evidence with an MD5 Hash and Encryption---CRCMD5 and PGP

249

(2)

FileList

249

(1)

CRCMD5

250

(1)

Sealing Evidence

250

(1)

Summary

251

(2)

Collecting Evidence---First Steps

253

(6)

Using SafeBack 2.0 to Take an Image of a Fixed Disk

253

(4)

Taking a Hard Disk Inventory with FileList

257

(1)

Summary

258

(1)

Reference

258

(1)

Searching for Hidden Information

259

(8)

The Intelligent Filter---Filter_I v. 4.1

259

(2)

IP Filter---v. 2.2

261

(1)

GetSlack and GetFree

261

(1)

TextSearch Plus v. 2.04

262

(2)

Using the Norton utilities

264

(1)

Summary

265

(2)

Handling Floopy Disks

267

(2)

AnaDisk v. 2.10LE

267

(1)

Copying Floppies to a Work Disk

268

(1)

Summary

268

(1)

Appendix A Introduction to Denial of Service Attacks

269

(16)

Foreword

269

(1)

Introduction

269

(1)

What Is a Denial of Service Attack?

269

(1)

Why Would Someone Crash a System?

270

(2)

Introduction

270

(1)

Subcultural Status

270

(1)

To Gain Access

270

(1)

Revenge

270

(1)

Political Reasons

271

(1)

Economic Reasons

271

(1)

Nastiness

271

(1)

Are Some Operating Systems More Secure?

271

(1)

What Happens When a Machine Crashes?

272

(1)

How Do I Know If a Host Is Dead?

272

(1)

Using Flooding---Which Protocol Is Most Effective?

272

(1)

Attacking from the Outside

272

(4)

Taking Advantage of Finger

272

(1)

UDP and SUNOS 4.1.3

273

(1)

Freezing Up X-Windows

273

(1)

Malicious Use of UDP Services

273

(1)

Attacking with Lynx Clients

274

(1)

Malicious Use of Telnet

274

(1)

ICMP Redirect Attacks

274

(1)

E-Mail Bombing and Spamming

275

(1)

Hostile Applets

275

(1)

Attacking Name Servers

275

(1)

Attacking from the Inside

276

(2)

Malicious Use of Fork()

276

(1)

Creating Files That Are Hard to Remove

277

(1)

Directory Name Lookupcache

277

(1)

How Do I Protect a System Against Denial of Service Attacks?

278

(4)

Basic Security Protection

278

(1)

Introduction

278

(1)

Security Patches

278

(1)

Port Scanning

278

(1)

Check the Outside Attacks Described in This Paper

278

(1)

Check the Inside Attacks Described in This Paper

279

(1)

Tools That Help you Check

279

(1)

Extra Security Systems

280

(1)

Monitoring Security

280

(1)

Keeping Up to Date

280

(1)

Read Something Better

281

(1)

Monitoring Performance

281

(1)

Introduction

281

(1)

Commands and Services

282

(1)

Programs

282

(1)

Accounting

282

(1)

Some Basic Targets for an Attack, Explanations of Words, Concepts

282

(2)

Swap Space

283

(1)

Bandwidth

283

(1)

Kernel Tables

283

(1)

RAM

283

(1)

Disks

283

(1)

Caches

283

(1)

Inetd

284

(1)

Tmpfs

284

(1)

Loopback

284

(1)

NFS

284

(1)

Suggested Reading---Information for Deeper Knowledge

284

(1)

Appendix B Technical Report 540-96

285

(8)

Introduction

285

(1)

Spoofing Attacks

285

(2)

Security-Relevant Decisions

286

(1)

Context

286

(1)

TCP and DNS Spoofing

287

(1)

Web Spoofing

287

(1)

Consequences

287

(1)

Surveillance

287

(1)

Tampering

288

(1)

Spoofing the Whole Web

288

(3)

How the Attack Works

288

(1)

URL Rewriting

288

(1)

Forms

288

(1)

Starting the Attack

289

(1)

Completing the Illusion

289

(1)

The Status Line

289

(1)

The Location Line

290

(1)

Viewing the Document Source

290

(1)

Bookmarks

290

(1)

Tracing the Attacker

291

(1)

Remedies

291

(1)

Short-Term Solution

291

(1)

Long-Term Solution

291

(1)

Related Work

292

(1)

Acknowledgments

292

(1)

For More Information

292

(1)

References

292

(1)

Index

293

Amazon no longer offers textbook rentals. We do!

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

9780849322181

0849322189

Summary

Table of Contents

Supplemental Materials

Write a Review

Amazon no longer offers textbook rentals. We do!

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

Investigating Computer-Related Crime : A Handbook for Corporate Investigators

9780849322181

0849322189

Summary

Table of Contents

Supplemental Materials

Write a Review

Related Products