UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS New mobile apps, underground networks, and crypto-phones are appearing daily. More sophisticated technologies such as mesh networks allow mobile devices to use public Wi-Fi to communicate from one device to another without ever using the cellular network or the Internet. Anonymous and encrypted email services are under development to evade government surveillance. Learn how these new technology capabilities are making anonymous communication easier for fraudsters and helping them cover their tracks. You will learn how to: Define mesh networks. Explain the way underground networks can provide untraceable email. Identify encrypted email services and how they work. WALT MANNING, CFE President Investigations MD Green Cove Springs, FL Walt Manning is the president of Investigations MD, a consulting firm that conducts research related to future crimes while also helping investigators market and develop their businesses. He has 35 years of experience in the fields of criminal justice, investigations, digital forensics, and e-discovery. He retired with the rank of lieutenant after a 20-year career with the Dallas Police Department. Manning is a contributing author to the Fraud Examiners Manual, which is the official training manual of the ACFE, and has articles published in Fraud Magazine, Police Computer Review, The Police Chief, and Information Systems Security, which is a prestigious journal in the computer security field. “Association of Certified Fraud Examiners,” “Certified Fraud Examiner,” “CFE,” “ACFE,” and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without the prior consent of the author. ©2015 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES Introduction Technology is making it easier for fraudsters to cover their tracks while avoiding detection. Underground networks, new mobile apps, and encrypted cell phones are appearing daily. More sophisticated technologies such as mesh networks allow mobile devices that use public Wi-Fi to communicate from one device to another without ever using the cellular network or the Internet. Anonymous and encrypted email services are under development to evade government surveillance. Fraud examiners need to be aware of these tools to understand how they could be used to hide evidence of fraud. Underground Networks and Tools The Tor Network In 2003, the U.S. Naval research laboratory launched what came to be called The Onion Router Project, which came to be known by its acronym TOR. The reason the project name contained the name “onion” was that the original concept intended to construct a way to route Internet network traffic through multiple encrypted layers, or nodes, which would effectively hide a user's location and the network through which they were connected. Tor was designed for use by people who had a need for online anonymity. Normally, users on the Internet can be traced by their Internet protocol, or IP, address. When you use the Tor software, your IP address remains hidden. Tor is made up of two different parts. The first is the software that you can download and install on many devices. The second and critical piece is the Tor 26th Annual ACFE Fraud Conference and Exhibition ©2015 1 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES network, which is comprised of over 5000 volunteer computers that allow Tor users to route traffic through these network nodes. Tor is not designed to anonymize a user’s identity—it only hides where the user’s Internet traffic originates. The first Tor network node that a user accesses will know where that single transmission came from. However, as the transmission proceeds to the next Tor node, the second node will only know that the transmission came from the previous node—not where the transmission originated. This process continues through at least three Tor nodes, each of which only knows the address of the previous node in the chain. There is no way for the final destination of the transmission to be able to trace the random pathway back through the Tor network to identify the user. There are other applications, such as email clients, chat clients, and instant messaging clients designed to work with the Tor network. Use of the Tor network does not guarantee complete anonymity, because the packets sent across the Tor network are the only parts of the transmission that are modified. The actual contents of the data in these packets are not modified in any way. Users who desire an even higher level of privacy have been known to encrypt their data before transmitting it on the Tor network, and possibly also use a virtual private network, or VPN, to provide even more anonymity and protection. https://www.torproject.org 26th Annual ACFE Fraud Conference and Exhibition ©2015 2 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES The Invisible Internet Project (I2P) I2P is an open source project that has been in active development since 2003. The I2P network is designed to provide even better anonymity than Tor. Even though it is currently much smaller in scale than Tor, it is quickly gaining in popularity. Tor is good at hiding the identity and location of the user and recipient of transmissions, but I2P carries this to another level. Where a Tor user creates a connection circuit to communicate through the network, I2P users create multiple user-defined tunnels to communicate with each other. These tunnels can be reconfigured or changed by a user at any time. I2P tunnels operate in only one direction—either in- bound or out-bound. Users can configure as many tunnels as they need, and they have the ability to create a single tunnel that is used only one time for one communication. Once that communication has ended, the user can deactivate the tunnel and never use it again. Where the message headers on Tor are encrypted, the message body may not be (unless the user has used another application to do so). On I2P, there are multiple levels of encryption that protect the entire message from end to end. I2P is also a packet-switched network, which means that each message is broken down into different packets, each of which can travel the I2P network by different routes. This packet switching also allows I2P to balance the transmission workload across multiple routers on the network, which can make it much more fast and efficient. 26th Annual ACFE Fraud Conference and Exhibition ©2015 3 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES Users of I2P can also customize their configuration of tunnels on the network to require that their communication be forwarded through more network routers, which could enhance a user’s security even more. Since this means that every message would need to go through more “hops,” it could decrease the speed of the transmission. But the user has the flexibility to adjust his network settings according to his perceived risk profile. I2P is considered in many ways to be more secure than Tor, but making effective use of I2P may require significantly more technical knowledge than the easier- to-use Tor network. Cybercriminals and other people for whom additional security is important will not hesitate to migrate to I2P, which may help this network to grow rapidly. https://geti2p.net/en The Amnesiac Incognito Live System (Tails) Tails is a Linux-based operating system designed for anonymity. It can be run from a USB stick, DVD, or SD memory card on any computer. Information from the website states that since Tails is a completely separate operating system, it does not use or depend on the operating system of the computer being used. Tails supposedly leaves no tracks on the host computer and does not use the host computer’s data storage. When shut down, Tails also claims to automatically erase the contents of RAM memory. Tails can be used to access either the Tor or I2P networks, so it provides a portable, independent, and secure operating system, with additional protection added through these underground networks. 26th Annual ACFE Fraud Conference and Exhibition ©2015 4 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES The software package also comes with encrypted email and messaging clients, and secure data wiping software. https://tails.boum.org/download/ Freenet Freenet is a peer-to-peer software application that allows anonymous browsing and distributed file storage. All communication with Freenet is encrypted and routed through multiple nodes. It has a Darknet mode that communicates only with people that are trusted by the user. Users contribute some of their bandwidth and even a portion of their hard drive space for use by other users of the network, which could make it problematic to identify the actual storage location of potential electronic evidence. https://freenetproject.org Encrypted Cell Phones Burner cell phones, which are pre-paid and usually low- cost phones capable of being used for short periods of time and then exchanged for a new device, have been around for many years. Burner phones present challenges for fraud examiners and law enforcement, as the devices and airtime cards can be purchased with cash, leaving no links to identify or trace the user. However, growing concerns over both government surveillance and corporate data collection have resulted in companies producing cell phones specifically designed to provide security and privacy. There are also a growing number of mobile device apps that are also designed with these goals in mind. These new technologies can create more challenges for fraud investigators attempting to 26th Annual ACFE Fraud Conference and Exhibition ©2015 5 UNTRACEABLE LINKS: TECHNOLOGY TRICKS USED BY CROOKS TO COVER THEIR TRACKS NOTES identify fraudsters and also in the preservation of electronic evidence.