CIS 4385, Summer 2014: Introduction to Digital Forensics and Cybercrime

Eoghan Casey defines "Digital Evidence" as "any data stored or transmitted using a computer that support or refute a theory of how an offense occurred or that address critical elements of the offense such as intent or alibi." (Page 12, DECC.)

Introduction to Digital Forensics and Cybercrime

This is far-ranging definition, and includes much of what we want. To make sure that "computer" is comprehensive, Casey breaks the category "computer" into three sub-categories: (1) open computer systems — that is, traditional systems such as stand-alone computers; (2) communication systems, such as the Internet; (3) embedded systems, such as cell phones and systems such as those that automobiles might utilize. (Page 12, DECC.) [Of course, now that BMW has used QNX and Wind River's VxWorks (after having even tried using Microsoft Windows) for an operating system for its automobiles — and there is active discussion of using Linux next — and Delta is already using Linux for its flight video system, there is of course blurring of these once bright lines as we create ubiquitous communications/computing.]

Digital Forensics

Casey also provides a characterization of "forensic" that I think is useful: "... a characteristic of evidence that satisfies its suitability for admission as fact and its ability to persuade based upon proof (or high statistical confidence.)" (Page 20, DECC.)

But what does a dictionary say? Here's Merriam-Webster's take on the word "forensics":

forensic, noun
Definition of FORENSIC
1 an argumentative exercise
2 plural but sing or plural in constr : the art or study of argumentative discourse
3 plural but sing or plural in constr : the application of scientific knowledge to legal problems; especially : scientific analysis of physical evidence (as from a crime scene)

Here's what vocabulary.com has to offer:

Forensics (noun), 1 scientific tests or techniques used in the investigation of crimes

Digital Forensics

The upshot of all of this is that forensics is fundamentally the application of scientific principles in a way useful in the justice system.
CFCLE on page 27 gives this characterization: "Computer forensics is a branch of forensic science that focuses on criminal procedure law and evidence as applied to computers and related devices."

Please read about issues of the admissibility of scientific and other technical testimony embodied in the Frye standard (still in use in Florida, although in 2012 a bill was proposed to change this: Daubert, Frye ... or Both? Tracking Florida's Buy-In) and the newer Daubert standard. Original Supreme Court material from both can be found in this pdf. (This is the one also linked on the class page as "starred" material.)

What's the upshot of Frye versus Daubert/Coppolino? Frye requires experts use "general acceptance" in the scientific community; Daubert allows more latitude by experts, and is based on assessing the following criteria: (see CFCLE, pp. 44-45)

Has empirical testing been on methods used by an expert?
Is there any peer review of the methods employed?
What error rate is expected from the methods employed?
Are the methods "generally accepted" in the scientific community?

Cybercrime

CFCLE characterizes cybercrime thusly: "Cybercrime involves the use of the Internet, computers, and related technologies in the commission of a crime. It includes technologically specific crimes that would not be possible without the use of computer technology as well as traditional crimes committed with the assistance of a computer." (Page 2 of CFCLE)
The use of the Internet empowers criminals and other bad actors to operate across the world, sometimes with great impunity.

Computer Science and the Idea of "State"

Finally, let me introduce one more computer science term into the discussion: "state." As computer scientists, we use this word a lot because state is a fundamental computer science idea (although with quantum computing now coming to life, our ideas about state and computing are going to change over the next few years!) We have this idea of computing as a transition from one state to the next — for that matter, a true Turing-complete computer would be an infinite state machine.

Digital Evidence can be Transitory and Evanescent

One of the most difficult aspects of dealing with digital evidence is its propensity to disappear.
(Another related problem is that even if it's still there, it may not be useful as evidence if it has not been handled carefully).

Digital Evidence can be Transitory and Evanescent

While it is famously difficult to remove all traces of state associated any computing activity (see for example Locard's Exchange Principle, WFA pp. 4-6), its fundamental malleability is omnipresent. If, like DRAM, state depends on the constant application of electrical power, when that electrical power disappears, so does that state. While new and innovative techniques such as freezing DRAM do come along, practical application of them is often challenging and not feasible in all cases.

Digital Evidence can be Transitory and Evanescent

Even if it is preserved in a useful fashion, modern ways of efficiently keeping state often mean that the logically associated data are often physically not proximate. Remote backups are the norm, and are often a regulatory requirement for businesses. Companies such as Carbonite and Sungard provide these as commodity and bespoke services. Just think about how much information from a cell phone can be saved remotely for access by other devices — including password recovery information!

Digital Evidence is Often Indirect and Only Circumstantial

In the world of computer system administration, just divining the intent of ordinary software in order to use and configure can be challenging — we even teach classes on the subject.
Taking this one step more, trying to figure out a sequence of events of "who"/"what"/"when"/"where" — let alone their meaning (the "why" part of any analysis) — can be very challenging.

Digital Evidence is Often Indirect and Only Circumstantial

Think, then, about the taking the process one step beyond, trying to divine the intent of a possible malefactor. It's yet another level of puzzle, and often solving such puzzles can take many people a good amount of time — look at the questions that still surround the Conficker worm, its propagation, and how its originators might have been planning to use it.

Categories of Cybercrimes: Physical Crimes

Among the first crimes associated with computers was simple theft of computers and computers parts. While some of this was done for profit, there were also technology spies who, as parts of operations such as the Soviet Line X program, stole western technology as part of a formal national policy. (A recent movie, Farewell, was made on this subject.)
Theft of computer parts still continues to this day, since they are often small and often are of reasonably high value. (For that matter, one of our department's more often seen problems has been that of theft, particularly of laptops.)

Categories of Cybercrimes: Physical Crimes

Computers have also been the target of vandalism; violent groups such as Earth First! and other ecoterrorism groups have specifically made computers a target.

A good general reference noted for its characterizations and categorizations of computer crime is Donn Parker's book Fighting Computer Crime, which I abbreviate FCC. In particular, for fundamental characterizations, see pp. 16-18 of FCC.

The four crime categories that FCC establishes are (1) object of a crime (2) subject of a crime (3) tool for criminal activity (4) symbolic, used for intimidation or deception. DECC adds a fifth category, computers as a source of digital evidence, noting in particular the email correspondence between President Clinton and Monica Lewinsky strongly suggesting that Clinton had perjured himself.

Categories of Cybercrimes: Illegal Access and Use

Florida, as noted by Donn Parker in FCC, was one of the first states to pass any laws regarding computer crime with its "Florida Computer Crimes Act" in response to a fraudulent ticket scandal at the Flagler Dog Track (now Magic City Casino). In this case, illegal access to a computer was used to print fraudulent tickets.

Categories of Cybercrimes: Illegal Access and Use

DECC notes a 2003 case in California where two people used illegal access into a court's computer systems in order to change court records to incorrectly show that various charges had been dropped.

Categories of Cybercrimes: Illegal Access and Use

That type of classic hacking, of course, is an instance of illegal access. However in addition to such simple hacking, we have the rise of automated illegal access and use, especially in the area of "botnets".

Categories of Cybercrimes: Illegal Access and Use

Botnets have been a highly successful criminal activity, one that puts the control of thousands of computers under the control of a malefactor (and there exists evidence of several botnets well in excess of 1 million computers; see here), who then proceeds to use them to send spam, disrupt networks with denial-of-service attacks, or click fraud.

Categories of Cybercrimes: Illegal Access and Use

One of the most famous automated access cases was the 1988 case of the Internet Worm let loose by Robert Morris. While the intentions of the author were not malicious, he ended up being convicted under the Computer Fraud and Abuse Act.

Categories of Cybercrimes: Computers as a Simple Tool

Criminals also use computers as tools: everything from keeping records of criminal activity using to Microsoft Office to using a smartphone, like every other area of modern life, ubiquitous communications/computers proliferate.

Big Computer Crimes

Among the largest known computer crimes in dollar terms was discovered over 35 years ago: Equity Funding Corporation of America literally created a whole computer system around 64,000 fake customers in order to defraud its reinsurers. (see FCC, page 65; also, there's a book The Great Wall Street Scandal on the subject). For a more brief description, Mainframe: Madoff-size Money, Monstrous Misapplication - LOOP).

Big Computer Crimes

In the largest of all (known) computer crimes, the Madoff scandal, computers were also involved; indeed, two of the people who have been charged (but not yet tried) are computer programmers: SEC Charges Madoff Computer Programmers; also, see The United States of America v. Jerome O'Hara and George Perez.

Big Computer Crimes

Computers also played a part in the fall of Barings Bank, when Nick Leeson used his overly wide access to both front and back office information to hide massive trading losses. (See Nick Leeson's autobiography Rogue Trader.)

Reading

Required reading: WFA, pp. 1-61; MF, pp. 1-91; all starred articles linked on class home page in "Other Material".
Suggested reading: DECC, pp. 1-85; FCC, pp. 1-80; all other articles linked on class home page in "Other Material".

References

DECC: Digital Evidence and Computer Crime, 2nd edition, by Eoghan Casey. Academic Press, 2004. ISBN 0-12-163104-4.
FCC: Fighting Computer Crime, by Donn Parker. Wiley, 1998. ISBN 0-471-16378-3.
CFCLE: Computer Forensics: Cybercriminals, Laws, and Evidence, by Marie-Helen Maras. Jones & Bartlett, 2012. ISBN 978-1-4496-0072-3.