Forensic Blogs

An aggregator for digital forensics blogs

by

Intrusion into the IoT: The Final Blog

D-Link intrusion footage screenshot Recap: Intrusion Blogs 1/2

In last month’s blog, the IoT Intrusion team hit a major roadblock with the TP-Link Kasa camera, but were able to overcome it through research into Man in the Middle Attacks. Now, armed with more knowledge than before, our team pressed on to new devices. We moved much faster this month than last. We started investigations into the intrusion of two devices, one of which we completed. These devices proved to be good subjects for investigation, but there are so many at the LCDI that we would have liked to look into. Hopefully, the end of the year does not bring the end of the project.

Picture of the D-Link DCS 5030L

D-Link DCS 5030L

After our struggles with the TP-Link, the team decided to work on a different IoT security camera: the D-Link DCS 5030L. We were originally attracted to this device by a statement that the FTC put out saying that D-Link needs to increase their security in order to market themselves as offering, “advanced network security.” This gave us hope that the device might not be secure. This proved to be true, as we were able to exploit features letting users control their camera from a browser. We were able to gain access to all elements of the camera. We were able to change the password as well as view a live feed.

Malicious Intrusion Opportunity

Through this, we were able to brainstorm all the ways a malicious hacker could use this intrusion to their advantage. They could hold the device for ransom and require the owner to pay in order to regain access. An attacker could physically break into a room that had one of these cameras in it and then upon leaving erase the camera footage from the SD card. The quick success that our team had the D-Link camera allowed us to move on to another device this month. 

picture of the WeMo Insight Switch

WeMo Insight Switch 

The next device we decided to work on was the WeMo Insight Switch from Belkin. This device showed up on our radar as a potential subject back in our initial research phase of the project. A serious issue with the device was reported by Bitdefender saying that they had discovered a vulnerability that the switch leaks out wifi passwords. This was based on research done by McAfee that found a vulnerability in the UPnP ports listening on the local network in the device. Our team wants to see what we can do with this information on the device. We have it all set up and ready to test.

The Future of IoT Intrusion

Although this may be the team’s final blog post, this is not the end of our project. We still have a few more weeks scheduled at the Leahy Center. After we attempt our intrusion on the WeMo Insight Switch, we will complete our final report. Make sure to look out for that here when it is published. As our project comes to a close, we ponder what the future may hold. We were only able to scratch the surface of this very in depth and involved line of research. That said, we hope this project laid the groundwork for future research.

Stay up to date with Twitter @ChampForensics, Instagram @ChampForensics, and Facebook @ChamplainLCDI so you always know what we’re up to!

The post Intrusion into the IoT: The Final Blog appeared first on The Leahy Center for Digital Forensics & Cybersecurity.

by

Recovery of Data Fall Blog 1

Comic about data recovery Data Recovery Project Goal

This semester, The Leahy Center for Digital Investigation created a project to solve issues related to data recovery. This project shows that the average user often does not truly delete their data, and that it is possible to recover this data without spending money on high end tools, such as EnCase and Axiom. These are tools which range from $1,700 to $4,800 a year. The Data Recovery Team at the LCDI has researched free tools that anyone can use to recover deleted files, whether you are someone who has erased files they need or the next owners of a poorly wiped drive. 

Is data ever “deleted”?

PC hard drives often contain data known as Personally Identifiable Information, or PII. This includes names, credit card numbers, addresses and other information important to one’s personal life. This is why true data deletion is so important. The average user doesn’t understand that they’re not actually deleting their data. The fact that this data is not always deleted is what can lead to the leak of the user’s PII when they sell the drive. One can truly delete their data by using the common standards for wiping drives.  

Visual vs Actual Deletion

Many people assume that they are deleting the file when it is no longer visible (for example, after it is in the recycle bin). This is never the case. After dragging said file to the bin, the user still needs to empty it. Even when the user empties the bin, the user has not actually deleted the file. When a user drags a file to the Recycle Bin, all that does is remove the link to said file from the user. The user has hidden the data, not deleted it. It will stay available on the computer until that part of the hard drive is overwritten by other files.

Proper Data Recovery Services

To achieve proper data deletion, one needs to use common drive wiping standards, such as US DoD 5220.22-M. This standard implements a three pass system, working as follows:

First pass: Overwrite all addressable locations with binary “zeroes”. Second pass: Overwrite all addressable locations with binary “ones”. Third pass: Overwrite all addressable locations with a random bit pattern Verify the final overwrite pass.

Another common standard for deleting data is the NIST method. This method describes different types of sanitation for drives, and recommends using more than one type.

Who Cares?

Net collecting black, yellow and white squares symbolizing data.

One of the most important questions that we at the Data Recovery Team ask is: why does any of this matter? This information can serve to help the user protect their PII. Whether it is by teaching the user how to delete their data, or teaching them how to recover it. This means that a normal user could recover their data without having to spend a lot of money. We understand that sometimes accidents happen and data may get erased unintentionally. Hopefully, with the information that this project will provide, users can retrieve their own lost data. 

Be sure to look for future posts and stay up to date with Twitter @ChampForensics, Instagram @ChampForensics, and Facebook @ChamplainLCDI!

 

The post Recovery of Data Fall Blog 1 appeared first on The Leahy Center for Digital Forensics & Cybersecurity.

by

Virtual Currency Investigations: Fear Not the Blockchains

At the Magnet User Summit this year, I listened to a presentation by Eric Huber, Vice President of National White Collar Crime Center (NW3C). With a broad background in digital forensic investigations, he spoke about the changing field in cryptocurrencies and blockchain analysis. He gave a brief overview on different types of cryptocurrencies and how to use them. Then he dove into how cryptocurrencies are evolving and how digital forensics needs to catch up to the changes.

Cryptocurrencies

Cryptocurrencies are a little bit more complicated than just currencies that solely run on the internet or through the cyberspace. Currencies like Ethereum and Bitcoin are purchased and are traded in cyberspace to purchase goods and services just like fiscal currencies, but because of the push back against government control, these currencies can be used to purchase illegal goods and services without being tracked easily. Cryptocurrencies are on the rise and are becoming more popular than ever. With ATMS popping up all over the world, they are becoming even more accessible.

Blockchains

Blockchains are the ledgers of cryptocurrencies. Unlike most banks and budgets, blockchains never list the total cryptocurrency that someone might have. Instead, they list who exchanged it and how much. Cryptocurrency mining is figuring out the hashes or the specific string of characters and numbers to figure out the transaction and post it directly on the ledger. After claiming that position, not only would the miner claim some cryptocurrency, but every time that section of the ledger is referenced to calculate how much an individual has of that cryptocurrency, the miner earns more cryptocurrency.

Public vs Private

Different types of cryptocurrencies have different types of blockchains. The public can openly access public blockchains, like what Ethereum and Bitcoin. Law enforcement can also subpoena them to learn who performed the possibly illegal transaction. However, there can always be more privacy. The more privacy achieved, the more complicated arresting and subpoenas become. Private blockchains involve each individual block becoming private and not available to the public. Not only is the ledger inaccessible, but law enforcement is unable to subpoena individual miners. They would only have parts of the ledger anyways.

With a developing field, digital forensics and incident response is developing blockchain analysis to track backwards after figuring out specific blocks of ledgers to figure out the specifics of transactions and more. This is the changing part of cryptocurrencies and how digital forensics needs to evolve to adapt to accommodate these changes since cryptocurrencies are not fading away anytime soon.

 

Blog written by Champlain College’s Nurit Elber.

Be sure to check us out on Twitter @ChampForensics, Instagram @ChampForensics, and Facebook @Champlainforensics to see other important information pertaining to our project!

The post Virtual Currency Investigations: Fear Not the Blockchains appeared first on The Leahy Center for Digital Forensics & Cybersecurity.