CIS 4385, Spring 2011: Introduction to Digital Forensics and Cybercrime

Eoghan Casey defines "Digital Evidence" as "any data stored or transmitted using a computer that support or refute a theory of how an offense occurred or that address critical elements of the offense such as intent or alibi." (Page 12, DECC.)

Introduction to Digital Forensics and Cybercrime

This is far-ranging definition, and includes much of what we want. To make sure that "computer" is comprehensive, Casey breaks the category "computer" into three sub-categories: (1) open computer systems — that is, traditional systems such as the ones in front of you; (2) communication systems, such as the Internet; (3) embedded systems, such as cell phones and systems such as those that automobiles might utilize. (Page 12, DECC.) [Of course, now that BMW is using Wind River's VxWorks (after having even tried using Microsoft Windows) for an operating system for its automobiles, and Delta is using Linux for its flight video system, there is of course blurring of these once bright lines.]

Digital Forensics

Casey also provides of "forensic" that I think is useful: "... a characteristic of evidence that satisfies its suitability for admission as fact and its ability to persuade based upon proof (or high statistical confidence.)" (Page 20, DECC.)

Digital Forensics

The upshot of all of this is that forensics is fundamentally the application of scientific principles in a way useful in the justice system.

Please read about issues of the admissibility of scientific and other technical testimony embodied in the Frye standard (still in use in Florida) and the newer Daubert standard. Original Supreme Court material from both can be found in this pdf. (This is the one also linked on the class page as "starred" material.)

Computer Science and the Idea of "State"

Finally, let me introduce one more computer science term into the discussion: "state." As computer scientists, we use this word a lot because state is a fundamental computer science idea (although with quantum computing now coming to life, our ideas about state and computing are going to change over the next few years!) We have this idea of computing as a transition from one state to the next — for that matter, a true Turing-complete computer would be an infinite state machine.

Digital Evidence can be Transitory and Evanescent

One of the most difficult aspects of dealing with digital evidence is its propensity to disappear.

Digital Evidence can be Transitory and Evanescent

While it is famously difficult to remove all traces of state associated any computing activity (see for example Locard's Exchange Principle, WFA pp. 4-6), it's also just state. If, like DRAM, state depends on the constant application of electrical power, when that electrical power disappears, so does that state. While new techniques (such as freezing DRAM) might come along, practical application of them is often not feasible.

Digital Evidence can be Transitory and Evanescent

Even if it is preserved in a useful fashion, modern ways of efficiently keeping state often mean that the logically associated data are often physically not proximate. Remote backups are the norm, and are often a regulatory requirement for businesses. Companies such as Carbonite and Sungard provide these as commodity and bespoke services.

Digital Evidence is Often Indirect and Only Circumstantial

In the world of computer system administration, just divining the intent of ordinary software in order to use and configure can be challenging — we even teach classes on the subject.

Digital Evidence is Often Indirect and Only Circumstantial

Think, then, about the taking the process one step beyond, trying to divine the intent of a possible malefactor. It's yet another level of puzzle, and often solving such puzzles can take many people a good amount of time — look at the confusion surrounding the Conficker worm, its propagation, and how its originators might be planning to use it.

Categories of Cybercrimes: Physical Crimes

Among the first crimes associated with computers was simple theft of computers and computers parts. While some of this was done for profit, there were also technology spies who, as parts of operations such as the Soviet Line X program, stole quite a lot of Western technology. Theft of computer parts still continues to this day, since they are often small and often are of reasonably high value. (For that matter, one of our department's more often seen problems is that of theft, particularly laptops.)

Categories of Cybercrimes: Physical Crimes

Computers have also been the target of vandalism; violent groups such as Earth First! and other ecoterrorism groups have specifically made computers a target.

A good general reference noted for its characterizations and categorizations of computer crime is Donn Parker's book Fighting Computer Crime, which I abbreviate FCC. In particular, for fundamental characterizations, see pp. 16-18 of FCC.

The four crime categories that FCC establishes are (1) object of a crime (2) subject of a crime (3) tool for criminal activity (4) symbolic, used for intimidation or deception. DECC adds a fifth category, computers as a source of digital evidence, noting in particular the email correspondence between President Clinton and Monica Lewinsky strongly suggesting that Clinton had perjured himself.

Categories of Cybercrimes: Illegal Access and Use

Florida, as noted by Donn Parker in FCC, was one of the first states to pass any laws regarding computer crime with its "Florida Computer Crimes Act" in response to a fraudulent ticket scandal at the Flagler Dog Track. In this case, illegal access to a computer was used to print fraudulent tickets.

Categories of Cybercrimes: Illegal Access and Use

DECC notes a 2003 case in California where two people used illegal access into a court's computer systems in order to change court records to incorrectly show that various charges had been dropped.

Categories of Cybercrimes: Illegal Access and Use

That type of classic hacking, of course, is an instance of illegal access. However in addition to such simple hacking, we have the rise of automated illegal access and use, especially in the area of "botnets".

Categories of Cybercrimes: Illegal Access and Use

Botnets have been a highly successful criminal activity, one that puts the control of thousands of computers under the control of a malefactor (and there is evidence of botnets in excess of 1 million computers; see here), who then proceeds to use them to send spam, disrupt networks with denial-of-service attacks, or click fraud.

Categories of Cybercrimes: Illegal Access and Use

One of the most famous automated access cases was the 1988 case of the Internet Worm let loose by Robert Morris. While the intentions of the author were not malicious, he ended up being convicted under the Computer Fraud and Abuse Act.

Categories of Cybercrimes: Computers as a Simple Tool

Criminals also use computers as tools: everything from using Microsoft Office to keep records of criminal activity to using an iPhone, like every other area of modern life, computers are proliferating.

Big Computer Crimes

The largest known computer crime in dollar terms was discovered over 35 years ago: Equity Funding Corporation of America literally created a whole computer system around 64,000 fake customers in order to defraud its reinsurers. (see FCC, page 65; also, there's a book The Great Wall Street Scandal on the subject)

Big Computer Crimes

Computers also played a part in the fall of Barings Bank, when Nick Leeson used his overly wide access to both front and back office information to hide massive trading losses. (See Nick Leeson's autobiography Rogue Trader.)

Reading

Required reading: WFA, pp. 1-61; MF, pp. 1-91; all starred articles linked on class home page in "Other Material".
Suggested reading: DECC, pp. 1-85; FCC, pp. 1-80; all other articles linked on class home page in "Other Material".

References

DECC: Digital Evidence and Computer Crime, 2nd edition, by Eoghan Casey. Academic Press, 2004. ISBN 0-12-163104-4.
FCC: Fighting Computer Crime, by Donn Parker. Wiley, 1998. ISBN 0-471-16378-3.