CIS 4385, Spring 2016: Introduction to Digital Forensics and Cybercrime

Eoghan Casey defines "Digital Evidence" as "any data stored or transmitted using a computer that support or refute a theory of how an offense occurred or that address critical elements of the offense such as intent or alibi." (Page 12, DECC.)

Introduction to Digital Forensics and Cybercrime

This is a far-ranging definition, and includes much of what we want. To make sure that "computer" is comprehensive, Casey breaks the category "computer" into three sub-categories: (1) open computer systems — that is, traditional systems such as stand-alone computers; (2) communication systems, such as the Internet; (3) embedded systems, such as cell phones and systems such as those that automobiles might utilize. (Page 12, DECC.)
But with a future ubiquitous Internet of Things that is rapidly becoming our reality, it isn't sufficient. When your car directly communicates with other vehicles on the road (perhaps even autonomous ones), when it communicates with metering systems, when it checks information collection and dispersal systems, when even your driving license might be accessible via mobile device, we are moving to a ubiquity of information interaction in the Information Age.

Digital Forensics

Casey also provides a characterization of "forensic" that I think is useful: "... a characteristic of evidence that satisfies its suitability for admission as fact and its ability to persuade based upon proof (or high statistical confidence.)" (Page 20, DECC.)

But what does a dictionary say? Here's an older Merriam-Webster take on the word "forensics" (and here is a more recent one):

forensic, noun
Definition of FORENSIC
1 an argumentative exercise
2 plural but sing or plural in constr : the art or study of argumentative discourse
3 plural but sing or plural in constr : the application of scientific knowledge to legal problems; especially : scientific analysis of physical evidence (as from a crime scene)

Here's what vocabulary.com has to offer:

Forensics (noun), 1 scientific tests or techniques used in the investigation of crimes

Digital Forensics

CFCLE on page 27 gives this characterization: "Computer forensics is a branch of forensic science that focuses on criminal procedure law and evidence as applied to computers and related devices."
The upshot of all of this is, for the purposes of this class, that forensics is fundamentally the application of scientific principles in a way useful in the justice system.

In 2013, Florida adopted the Daubert standard in its statutes on the rules of evidence; in particular, look at sections 702 and 704.

Some of the important points about using the Daubert standard:

Has empirical testing been done on methods used by an expert?
Is there any peer review of the methods employed?
What error rate is expected from the methods employed?
Are the methods "generally accepted" in the scientific community?

Cybercrime

CFCLE characterizes cybercrime thusly: "Cybercrime involves the use of the Internet, computers, and related technologies in the commission of a crime. It includes technologically specific crimes that would not be possible without the use of computer technology as well as traditional crimes committed with the assistance of a computer." (Page 2 of CFCLE)
The use of the Internet empowers criminals and other bad actors to operate across the world, sometimes with great impunity.

Computer Science and the Idea of "State"

Finally, let me introduce one more computer science term into the discussion: "state." As computer scientists, we use this word a lot because state is a fundamental computer science idea (although with quantum computing now coming to life, our ideas about state and computing are going to change over the next few years!) We have this idea of computing as a transition from one state to the next — for that matter, a true "Turing-complete" computer would be one that can take on an infinite number of states.

Digital Evidence can be Transitory and Evanescent

One of the most difficult aspects of dealing with digital evidence is its propensity to disappear.
(Another related problem is that even if it's still there, it may not be useful as evidence if it has not been handled carefully).

Digital Evidence can be Transitory and Evanescent

While it is famously difficult to remove all traces of state associated any computing activity (see for example Locard's Exchange Principle, WFA pp. 4-6, DA p. 93), its fundamental malleability is omnipresent. If, like DRAM, state depends on the constant application of electrical power, when that electrical power disappears, so does that state. While new and innovative techniques such as freezing DRAM (pdf) do come along, practical application of them is often challenging and not feasible in all cases.

Digital Evidence can be Transitory and Evanescent

Even if it is preserved in a useful fashion, modern ways of efficiently keeping state often mean that the logically associated data are often physically not proximate. Remote backups are the norm, and are often a regulatory requirement for businesses. Companies such as Carbonite and Sungard/FIS provide these as commodity and bespoke services. Just think about how much information from a cell phone can be saved remotely for access by other devices — including password recovery information.

Digital Evidence is Often Indirect and Only Circumstantial

In the world of computer system administration, just divining the intent of ordinary software in order to use and configure can be challenging — we even teach classes on the subject.
Taking this one step more, trying to figure out a sequence of events of "who"/"what"/"when"/"where" — let alone their meaning (the "why" part of any analysis) — can be very challenging.
For instance, trying to figure out just the "who" of the Sony situation in November 2014 was quite a challenge — and not one that we are yet certain that we have solved.

Digital Evidence is Often Indirect and Only Circumstantial

Think, then, about the taking the process one step beyond, trying to divine the intent of a possible malefactor. It's yet another level of puzzle, and often solving such puzzles can take many people a good amount of time — look at the questions that still surround the well-studied but still puzzling Conficker worm, its propagation, and how its originators might have been planning to use it. (See, for instance, the most recent manifestations of this malware.)

Categories of Cybercrimes: Physical Crimes

Among the first crimes associated with computers was simple theft of computers and computers parts. While some of this was done for profit, there were also technology spies who, as parts of operations such as the Soviet Line X program, stole western technology as part of a formal national policy. (A recent movie, Farewell, was made on this subject.)
Theft of computer parts still continues to this day, since they are often small and often are of reasonably high value. (For that matter, one of our department's more often seen problems has been that of theft, particularly of laptops.)

Categories of Cybercrimes: Physical Crimes

Computers have also been the target of vandalism; violent groups such as Earth First! and other ecoterrorism groups have specifically made computers a target.

A good general reference noted for its characterizations and categorizations of computer crime is Donn Parker's book Fighting Computer Crime, which I abbreviate FCC. In particular, for fundamental characterizations, see pp. 16-18 of FCC.

The four crime categories that FCC establishes are (1) object of a crime (2) subject of a crime (3) tool for criminal activity (4) symbolic, used for intimidation or deception. DECC adds a fifth category, computers as a source of digital evidence, noting in particular the email correspondence between President Clinton and Monica Lewinsky strongly suggesting that Clinton had perjured himself.

Categories of Cybercrimes: Illegal Access and Use

Florida, as noted by Donn Parker in FCC, was one of the first states to pass any laws regarding computer crime with its "Florida Computer Crimes Act" in response to a fraudulent ticket scandal at the Flagler Dog Track (now Magic City Casino). In this case, illegal access to a computer was used to print fraudulent tickets.

Categories of Cybercrimes: Illegal Access and Use

DECC notes a 2003 case in California where two people used illegal access into a court's computer systems in order to change court records to incorrectly show that various charges had been dropped.

Categories of Cybercrimes: Illegal Access and Use

That type of classic hacking, of course, is an instance of illegal access. However in addition to such simple hacking, we have the rise of automated illegal access and use, especially in the area of "botnets".

Categories of Cybercrimes: Illegal Access and Use

Botnets have been a highly successful criminal activity, one that puts the control of thousands of computers under the control of a malefactor (and there exists evidence of botnets well in excess of 10 million computers; see here), who then proceeds to use them to send spam, disrupt networks with denial-of-service attacks, or click fraud.

Categories of Cybercrimes: Illegal Access and Use

One of the most famous automated access cases was the 1988 case of the Internet Worm let loose by Robert Morris. While the intentions of the author were not malicious, he ended up being convicted under the Computer Fraud and Abuse Act.

Categories of Cybercrimes: Computers as a Simple Tool

Criminals also use computers as tools: everything from keeping records of criminal activity using to Microsoft Office to using a smartphone, like every other area of modern life, ubiquitous communications/computers proliferate — and maybe smart dust will be the next level after the rapidly proliferating "Internet of (Insecure) Things".

Big Computer Crimes

Among the largest known computer crimes in dollar terms was discovered over 35 years ago: Equity Funding Corporation of America literally created a whole computer system around 64,000 fake customers in order to defraud its reinsurers. (see FCC, page 65; also, there's a book The Great Wall Street Scandal on the subject). For a more brief description, Mainframe: Madoff-size Money, Monstrous Misapplication - LOOP).

Big Computer Crimes

In the largest of all (known) financial computer crimes, the Madoff scandal, computers were also involved; indeed, two of the people convicted were computer programmers: SEC Charges Madoff Computer Programmers; also, see The United States of America v. Jerome O'Hara and George Perez.

here

Big Computer Crimes

Computers also played a part in the fall of Barings Bank, when Nick Leeson used his overly wide access to both front and back office information to hide massive trading losses. (See Nick Leeson's autobiography Rogue Trader.)

References

DECC: Digital Evidence and Computer Crime, 2nd edition, by Eoghan Casey. Academic Press, 2004. ISBN 0-12-163104-4.
FCC: Fighting Computer Crime, by Donn Parker. Wiley, 1998. ISBN 0-471-16378-3.
CFCLE: Computer Forensics: Cybercriminals, Laws, and Evidence, by Marie-Helen Maras. Jones & Bartlett, 2012. ISBN 978-1-4496-0072-3.
DA: Digital Archaeology, by Michael W. Graves. Addison-Wesley, 2013. ISBN 0-321-80390-6