Links
WFA Translations Thanks to the great folks at Elsevier and BJ Public, Windows Forensic Analysis 2/e is now available in Korean! Very cool! A copy of this goes on my shelf right next to the French translation, as well as the Chinese translation of WFA 1/e. I have to say, this is very, very cool...to look up at my bookshelf and see that someone thought enough of something I wrote to translate it. I have no idea what it says, but it's cool, just the same!
Security Ripcord
After a lengthy absence, Don is finally back blogging again...and he returns with a bang! Don's latest post, It will never be too expensive, takes a shot at the statement made by security "professionals" and "experts" to their customers for years...that one should employ/deploy enough "security" to make it too expensive for an attacker to get in, and they'll go away. It's pretty clear from Don's comments and reasoning that this is clearly a statement that has been made over and over for years, without folks really thinking about what's being said, and how the threat itself has evolved. This statement may have been true in the early days of the Internet, but the Internet and cybercrime have changed and developed...but apparently, the thinking behind the statement hasn't. Don does a great job of pointing this out, and with all the talk about advanced persistent and subversive multi-vector threats, doesn't it stand to reason that for some folks, for the really dedicated folks, they're just gonna laugh at your expensive security as they blow right on through it? Much like he did when he was in the Corps, Don takes a shot at this statement and hits it squarely, center of mass.
Sniper Forensics
Speaking of snipers, Part 3 of Chris's Sniper Forensics series has been posted to the SpiderLabs Anterior blog, be sure to check it out. I think that one of the biggest things that Chris points out in this segment is defining the target...with respect to IR, why are you there? What are you there to do? When it comes to digital forensic analysis, the same thing applies; if someone where to ship me a drive (or image), with clearly defined goals of what they were looking for, I might usually estimate an analysis time of 24 hrs or less. However, if you were to ship me a drive and say, "...find all bad stuff...", I could spend several weeks looking and never find why you define as "bad"...in part, because you never defined it. I've seen analysts leave site with a drive, having been told to find "bad stuff"; some initial searching found clear indications of the existence and use of "hacker" tools. However, upon reporting that to the customer, the analyst was told that the former employee's job was to hack stuff, so the existence of hacking tools wasn't "bad". Hey, who knew.
Defining the goals of an engagement, and the parameters for success, are critical to that engagement. Having a contract that just says "do analysis" without any defined goals of that analysis leave the analyst or the team with...what? Once the hours in the contract have been consumed, a report is delivered to the customer who then says, "no, this isn't what we wanted."
This isn't just an important point for consultants, it's equally important (or perhaps even more so) for the customer. If you're seeking IR or DF services, ensure that you clearly define what you're looking for, and ensure that this is stated clearly in the contract before you sign it.
MFT Slack
Lance posted an Enscript recently that was written to extract the slack space from MFT records. This isn't something that I've had a need to do before, but it is interesting and worth taking a look at. I'm not entirely sure what context you can get from items found in MFT slack, as MFT records are 1024 bytes long; however, Lance thought enough of this to write an Enscript for it, so there must be something there!
On that note, I recently updated the online repository for the Windows Registry Forensics tools, to include Jolanta's regslack tool for locating deleted keys and values in hive files. For usage and examples of how this tool has been used, check out the book.
