DOCSLIB.ORG

Digital Investigation and Trojan Defense.Pdf

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Digital Investigation and the Trojan
Defense, Revisited

Golden G. Richard III

Professor of Computer Science and University Research Professor
Director, Greater New Orleans Center for Information Assurance (GNOCIA)
University of New Orleans

GIAC-certified Digital Forensics Investigator
Founder, Arcane Alloy, LLC

[email protected] / [email protected] / @nolaforensix http://www.cs.uno.edu/~golden

2

Who?

Professor of Computer Science and University Research Professor, Director, Greater New Orleans Center for Information Assurance (GNOCIA), University of New Orleans

http://www.cs.uno.edu/~golden

Digital forensics, OS internals, reverse engineering, offensive computing, pushing students to the brink of destruction, et al.

Founder, Arcane Alloy, LLC. http://www.arcanealloy.com

Digital forensics, reverse engineering, malware analysis, security research, tool development, training.

Co-Founder, Partner / Photographer, High ISO Music, LLC.

http://www.highisomusic.com

Music. Rock stars. Earplugs.

Copyright 2015 by Golden G. Richard III (@nolaforensix)

3

Digital Forensics

“Tools and techniques to recover, preserve, and examine digital evidence stored on or transmitted

by digital devices.”

Computers, PDAs, cellular phones, videogame consoles, digital cameras, copy machines, printers, digital voice recorders…

4

What That Really Means

• Data. “You only think it’s gone.”

• Sensitive data tenaciously clings to life.

• The vast majority of users—and lots of technical people, too— have no idea what’s really stored on their digital devices…

• …and no ability to properly “clean up” even if they do suspect what’s there

Copyright 2015 by Golden G. Richard III (@nolaforensix)

5

Where’s the Evidence?

Files and
Deleted Files
Filesystem metadata
Application metadata
Windows registry

Print spool files
Hibernation files

  • Temp files
  • Log files

Browser caches
Network traces

  • Slack space
  • Swap files

RAM: OS and app data

Volatile Evidence

structures

Copyright 2015 by Golden G. Richard III (@nolaforensix)

How awesome are we?

7

File Carving

one cluster one sector

  • unrelated disk blocks
  • interesting file

header, e.g., 0x474946e8e761 (GIF) footer, e.g., 0x003B (GIF)

“milestones” or “anti-milestones”

Copyright 2015 by Golden G. Richard III (@nolaforensix)

8

Awesomeness Progression: File Carving

Can carve
Chaos: files, but

not very well
More accurate

  • Faster
  • can't

Yay!

carve files

Tools appear, but have issues
File type aware carving, et al
Fragmentation, damned spinning disks!
Manual hex editor stuff
Multithreading, better design

Images: https://easiersaidblogdotcom.files.wordpress.com/2013/02/hot_dogger.jpg http://cdn.bigbangfish.com/555/Cow/Cow-6.jpg, http://f.tqn.com/y/bbq/1/W/U/i/Big_green_egg_large.jpg http://i5.walmartimages.com/dfw/dce07b8c-bb22/k2-_95ea6c25-e9aa-418e-a3a2-8e48e62a9d2e.v1.jpg

Copyright 2015 by Golden G. Richard III (@nolaforensix)

9

Memory Analysis

• physical memory dumping tool • VM memory snapshot • VM introspection

Capture RAM from live system

• strings • carving • Volatility

Analyze
Memory Dump

• VM introspection

Expose interesting volatile evidence

Copyright 2015 by Golden G. Richard III (@nolaforensix)

10

Memory Analysis: Evidence

e.g., discover and analyze unauthorized programs

Processes (dead / alive)

e.g., detect keystroke loggers, hidden processes

Open files

e.g., find backdoors, connections to contraband sites

Network connections

Volatile registry contents

Volatile application data

portions of Windows registry that are never stored on disk

e.g., plaintext for encrypted material, chat messages, email fragments, volatile web browser history

volatile contents of clipboard

Clipboard data

Copyright 2015 by Golden G. Richard III (@nolaforensix)

11

Awesomeness Progression: Memory Forensics

Pioneering efforts show great promise
More, more, more
Chaos: run strings?
Beyond
Windows

??

More attention to malware, filling in the gaps,
GPU stuff, etc.

pt_finder et al

awesome but limited

…

Manual, run strings, little context
Mac,
Linux, BSD

functionality

Images: https://s-media-cache-ak0.pinimg.com/736x/75/5a/37/755a37727586c57a19d42caa650d242e.jpg,, http://img.photobucket.com/albums/v136/Hell2Pay77/SS-trucks.jpg http://skateandannoy.com/wp-content/uploads/2007/12/sportsbars.jpg, http://gainesvillescene.com/wp-content/uploads/2013/03/dog-longboard.jpg

Copyright 2015 by Golden G. Richard III (@nolaforensix)

12

Memory Analysis: 2004

$ grep –i murder /dev/mem

I loved Sally, but I murdered her in the park on… Murder Murderer! Blood is on your shoulders! Murderous You murdered my hamster! Murdered

Copyright 2015 by Golden G. Richard III (@nolaforensix)

13

Detecting Hidden Resource Utilization

• Adversary: Direct Kernel Object Manipulation (DKOM) • Strategy: Deep analysis and cross-correlation of data kernel data structures to reveal hidden resource utilization

PID =
2260

Doubly-linked process list in Windows kernel

Processes continue to run because Windows
C:\> fu –ph 2260 scheduler handles

threads, not processes

PID = 2260

Copyright 2015 by Golden G. Richard III (@nolaforensix)

14

Copyright 2015 by Golden G. Richard III (@nolaforensix)

15

FU on PID 2260

DKOM Hidden Process Detection in Volatility

Copyright 2015 by Golden G. Richard III (@nolaforensix)

So we're awesome, right?

17

Unfortunately

What evidence is present and what can be recovered?
How hard is it to recover?

Technical Difficulty Increasing

What “evidence”
Did malware play

a role? was actually
“recovered”?

Copyright 2015 by Golden G. Richard III (@nolaforensix)

18

Unfortunately, Part 2

What evidence is present and what can be recovered?
How hard is it to recover?

Misinformation
Abounds

What “evidence”
Did malware play

a role? was actually
“recovered”?

Copyright 2015 by Golden G. Richard III (@nolaforensix)

19

Digital Forensics

Settle Intellectual Property Disputes
Investigate Employee Misconduct
Uncover Fraud
Discover Insider Threats
Investigate Child Exploitation

Prosecute Thieves, Kidnappers, Murderers

Copyright 2015 by Golden G. Richard III (@nolaforensix)

20

Digital Forensics

Settle Intellectual Property Disputes
Investigate Employee Misconduct
Uncover Fraud

malware

Discover Insider Threats
Investigate Child Exploitation

Prosecute Thieves, Kidnappers, Murderers

Copyright 2015 by Golden G. Richard III (@nolaforensix)

Recommended publications
  • Protecting the Children: Challenges That Result In, and Consequences Resulting From, Inconsistent Prosecution of Child Pornography Cases in a Technical World, 16 Rich

    Protecting the Children: Challenges That Result In, and Consequences Resulting From, Inconsistent Prosecution of Child Pornography Cases in a Technical World, 16 Rich

    Richmond Journal of Law and Technology Volume 16 | Issue 3 Article 5 2010 Protecting The hiC ldren: Challenges That Result In, And Consequences Resulting From, Inconsistent Prosecution Of Child Pornography Cases In A Technical World Francis S. Monterosso Follow this and additional works at: http://scholarship.richmond.edu/jolt Part of the Computer Law Commons, and the Internet Law Commons Recommended Citation Francis S. Monterosso, Protecting The Children: Challenges That Result In, And Consequences Resulting From, Inconsistent Prosecution Of Child Pornography Cases In A Technical World, 16 Rich. J.L. & Tech 11 (2010). Available at: http://scholarship.richmond.edu/jolt/vol16/iss3/5 This Article is brought to you for free and open access by UR Scholarship Repository. It has been accepted for inclusion in Richmond Journal of Law and Technology by an authorized administrator of UR Scholarship Repository. For more information, please contact [email protected]. Richmond Journal of Law & Technology Volume XVI, Issue 3 PROTECTING THE CHILDREN : CHALLENGES THAT RESULT IN, AND CONSEQUENCES RESULTING FROM , INCONSISTENT PROSECUTION OF CHILD PORNOGRAPHY CASES IN A TECHNICAL WORLD By Francis S. Monterosso * Cite as: Francis S. Monterosso, Note: Protecting the Children: Challenges that Result In, and Consequences Resulting From, Inconsistent Prosecution of Child Pornography Cases in a Technical World , XVI Rich. J.L. & Tech. 11 (2010), http://jolt.richmond.edu/v16i3/ article11.pdf. INTRODUCTION Of all the sinister things that Internet viruses do, this might be the worst: They can make you an unsuspecting collector of child pornography. Heinous pictures and videos can be deposited on computers by viruses—the malicious programs better known for swiping your credit card numbers.
  • Ethical Hacking

    Ethical Hacking

    Ethical Hacking Alana Maurushat University of Ottawa Press ETHICAL HACKING ETHICAL HACKING Alana Maurushat University of Ottawa Press 2019 The University of Ottawa Press (UOP) is proud to be the oldest of the francophone university presses in Canada and the only bilingual university publisher in North America. Since 1936, UOP has been “enriching intellectual and cultural discourse” by producing peer-reviewed and award-winning books in the humanities and social sciences, in French or in English. Library and Archives Canada Cataloguing in Publication Title: Ethical hacking / Alana Maurushat. Names: Maurushat, Alana, author. Description: Includes bibliographical references. Identifiers: Canadiana (print) 20190087447 | Canadiana (ebook) 2019008748X | ISBN 9780776627915 (softcover) | ISBN 9780776627922 (PDF) | ISBN 9780776627939 (EPUB) | ISBN 9780776627946 (Kindle) Subjects: LCSH: Hacking—Moral and ethical aspects—Case studies. | LCGFT: Case studies. Classification: LCC HV6773 .M38 2019 | DDC 364.16/8—dc23 Legal Deposit: First Quarter 2019 Library and Archives Canada © Alana Maurushat, 2019, under Creative Commons License Attribution— NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) https://creativecommons.org/licenses/by-nc-sa/4.0/ Printed and bound in Canada by Gauvin Press Copy editing Robbie McCaw Proofreading Robert Ferguson Typesetting CS Cover design Édiscript enr. and Elizabeth Schwaiger Cover image Fragmented Memory by Phillip David Stearns, n.d., Personal Data, Software, Jacquard Woven Cotton. Image © Phillip David Stearns, reproduced with kind permission from the artist. The University of Ottawa Press gratefully acknowledges the support extended to its publishing list by Canadian Heritage through the Canada Book Fund, by the Canada Council for the Arts, by the Ontario Arts Council, by the Federation for the Humanities and Social Sciences through the Awards to Scholarly Publications Program, and by the University of Ottawa.
  • Investigating and Prosecuting Cyber Crime: Forensic Dependencies and Barriers to Justice

    Investigating and Prosecuting Cyber Crime: Forensic Dependencies and Barriers to Justice

    International Journal of Cyber Criminology Vol 9 Issue 1 January – June 2015 Copyright © 2015 International Journal of Cyber Criminology (IJCC) – Publisher & Editor-in-Chief – K. Jaishankar ISSN: 0973-5089 - January – June 2015. Vol. 9 (1): 55–119. DOI: 10.5281/zenodo.22387 This is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial-ShareAlikeHTU 4.0 International (CC-BY-NC-SA 4.0) License,UTH whichT permits unrestricted non-commercial use,T distribution, and reproduction in any medium, provided the original work is properly cited. ThisT license does not permit commercial exploitation or the creation of derivative works without specific permission. Investigating and Prosecuting Cyber Crime: Forensic Dependencies and Barriers to Justice Cameron S. D. Brown1 Australian National University, Australia Abstract The primary goal of this paper is to raise awareness regarding legal loopholes and enabling technologies, which facilitate acts of cyber crime. In perusing these avenues of inquiry, the author seeks to identify systemic impediments which obstruct police investigations, prosecutions, and digital forensics interrogations. Existing academic research on this topic has tended to highlight theoretical perspectives when attempting to explain technology aided crime, rather than presenting practical insights from those actually tasked with working cyber crime cases. The author offers a grounded, pragmatic approach based on the in-depth experience gained serving with police task-forces, government agencies, private sector, and international organizations. The secondary objective of this research encourages policy makers to reevaluate strategies for combating the ubiquitous and evolving threat posed by cyber- criminality. Research in this paper has been guided by the firsthand global accounts (via the author’s core involvement in the preparation of the Comprehensive Study on Cybercrime (United Nations Office on Drugs and Crime, 2013) and is keenly focused on core issues of concern, as voiced by the international community.
  • The Trojan Horse Defense in Cybercrime Cases, 21 Santa Clara High Tech

    The Trojan Horse Defense in Cybercrime Cases, 21 Santa Clara High Tech

    Santa Clara High Technology Law Journal Volume 21 | Issue 1 Article 1 2004 The rT ojan Horse Defense in Cybercrime Cases Susan W. Brenner Brian Carrier Jef Henninger Follow this and additional works at: http://digitalcommons.law.scu.edu/chtlj Part of the Law Commons Recommended Citation Susan W. Brenner, Brian Carrier, and Jef Henninger, The Trojan Horse Defense in Cybercrime Cases, 21 Santa Clara High Tech. L.J. 1 (2004). Available at: http://digitalcommons.law.scu.edu/chtlj/vol21/iss1/1 This Article is brought to you for free and open access by the Journals at Santa Clara Law Digital Commons. It has been accepted for inclusion in Santa Clara High Technology Law Journal by an authorized administrator of Santa Clara Law Digital Commons. For more information, please contact [email protected]. ARTICLES THE TROJAN HORSE DEFENSE IN CYBERCRIME CASES Susan W. Brennert & Brian Carrier with Jef Henninger* TABLE OF CONTENTS I. INTRODUCTION ............................................................. 3 II. LEGAL ISSUES ............................................................ 14 A. How the Trojan Horse Defense Is Used ...................... 16 1. Raise Reasonable Doubt ............................................ 16 2. Negate Mens Rea ..................................................... 18 3. Establishing the Defense .......................................... 18 B. How Can the Prosecution Respond? ............. .......... 21 1. Establish Defendant's Computer Expertise .............. 22 2. "Character" Evidence ..............................................
  • Resource Materials on Technology-Enabled Crime

    Resource Materials on Technology-Enabled Crime

    Resource materials on technology-enabled crime Gregor Urbas Kim-Kwang Raymond Choo Technical and Background Paper No. 28 © Australian Institute of Criminology 2008 ISSN 1445-7261 ISBN 978 1 921185 70 0 Apart from any fair dealing for the purpose of private study, research, criticism or review, as permitted under the Copyright Act 1968 (Cth), no part of this publication may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Inquiries should be addressed to the publisher. Project no. 0074a Published by the Australian Institute of Criminology GPO Box 2944 Canberra ACT 2601 Tel: (02) 6260 9272 Fax: (02) 6260 9299 Email: [email protected] Website: http://www.aic.gov.au Please note: minor revisions are occasionally made to publications after release. The online versions available on this website will always include any revisions. Disclaimer: The views expressed do not necessarily represent the policies of the Australian Government or AHTCC. Edited and typeset by the Australian Institute of Criminology Resource materials on technology-enabled crime Gregor Urbas Kim-Kwang Raymond Choo Technical and Background Paper No. 28 Contents Foreword and acknowledgements v Introduction 1 Background 2 Terminology and definitions 2 Brief historical background 3 Main types of technology-enabled crime 5 Future trends 6 Prevalence and costs of technology-enabled crime 6 Issues for law enforcement agencies, prosecutors
  • Analysis of the Use of XOR As an Obfuscation Technique in a Real Data Corpus Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak

    Analysis of the Use of XOR As an Obfuscation Technique in a Real Data Corpus Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak

    Analysis of the Use of XOR as an Obfuscation Technique in a Real Data Corpus Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak To cite this version: Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak. Analysis of theUse of XOR as an Obfuscation Technique in a Real Data Corpus. 10th IFIP International Conference on Digital Forensics (DF), Jan 2014, Vienna, Austria. pp.117-132, 10.1007/978-3-662-44952-3_9. hal-01393766 HAL Id: hal-01393766 https://hal.inria.fr/hal-01393766 Submitted on 8 Nov 2016 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Distributed under a Creative Commons Attribution| 4.0 International License Chapter 9 ANALYSIS OF THE USE OF XOR AS AN OBFUSCATION TECHNIQUE IN AREALDATACORPUS Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras and Kyle Gorak Abstract The only digital forensic tools known to provide an automated approach for evaluating XOR obfuscated data are DCCI Carver and DC3 Carver, two general-purpose carvingtools developed by the Defense Cyber Crime Center (DC3). In order to determine the use of XOR as an obfuscation technique and the need to adapt additional tools, we analyzed 2,411 drive images from devices acquired from countries around the world.
  • Prismvol. 7, No. 2 | 2017

    Prismvol. 7, No. 2 | 2017

    PRISMVOL. 7, NO. 2 | 2017 THE FIFTH DOMAIN PRISM VOL. 7, NO. 2 NO. VOL. 7, | 2017 cco.ndu.edu A JOURNAL OF THE CENTER FOR COMPLEX OPER ATIONS PRISM ABOUT VOL. 7, NO.2 2017 PRISM, a quarterly journal published by the Center for Complex Operations (CCO) at National Defense University, aims to illuminate and provoke debate on whole-of- government efforts to conduct reconstruction, stabilization, counterinsurgency, and EDITOR NDU’S CENTER FOR COMPLEX OPERATIONS irregular warfare operations. Since its inaugural issue in 2010, PRISM’s readership Mr. Michael Miklaucic has expanded to include more than 10,000 officials, servicemen and women, and The United States Congress in 2009 authorized the establishment of a Center for practitioners from across the diplomatic, defense, and development communities in Complex Operations (CCO) in response to a widely perceived need for interagency interoperability in analysis of, planning for, and intervening in complex operations DEPUTY EDITOR more than 88 countries. worldwide. These include reconstruction, stabilization, counterinsurgency, and Ms. Patricia Clough irregular warfare—operations that demand support from all elements of national COMMUNICATIONS power to succeed. WEBMASTER PRISM encourages authors to aggressively seek out and identify problems that should Created within DOD as a collaborative initiative with support from the Department be addressed irrespective of prevailing U.S. Government policy or current military of State and the U.S. Agency for International Development, the aim of CCO is to: Ms. Rebecca Harper doctrine. We welcome unsolicited manusscripts from policymakers, practitioners, and scholars, particularly those that present emerging thought, best practices, or ■ enable more effective networking, coordination, and synchronization of DESIGN training and education innovations.
  • Trusted Computing and the Digital Crime Scene

    Trusted Computing and the Digital Crime Scene

    ARTICLE: TRUSTED COMPUTING AND THE DIGITAL By Yianna Danidou and CRIME SCENE Burkhard Schafer This paper analyses the future of digital company that patrolled the house regularly and forensics in an environment where control is checked all rooms and storage facilities for increasingly taken away from PC users and intruders or explosive devices. The company had remotely managed by trusted third parties, outsourced several of its activities to other typically to improve internet security. Trusted partner companies, making copies of the key available to them as needed. Their records Computing (TC) is used as the most developed confirm without doubt that nobody but the owner example to illustrate some of the possible legal and employees or agents of the company entered issues that arise. the room between the time of the murder and the police search that seized the knife. Introduction Consider the following physical world crime scene What can we say in these four scenarios about the scenarios: evidential value of the knife? Intuitively, it seems clear that the owner of the house in scenario 1 has some 1. The house of a suspect in a murder inquiry is explaining to do. Objects found in his possession can searched. In a locked room, and a locked chest be clearly attributed to him, and there is no obvious within that room, a bloodied knife is found that explanation for the knife other than that he hid it has the DNA of a murder victim on its blade. The there. Equally, it seems intuitively clear that the room and the chest were securely locked, the situation is considerably different in scenario 2.
  • Download Download

    Download Download

    ARTICLE: DIGITAL FORENSICS INSTITUTE IN MALAYSIA: THE WAY FORWARD THE TROJAN HORSE DEFENCE – a modern PROBLEM OF DIGITAL EVIDENCE By Miha Šepec The Trojan horse defence is an important aspect He asserts that somebody else must have committed of the investigation of crimes involving digital the crime using malicious software, or placed it in his evidence. In raising this defence, the accused claims computer system. The prosecutor must prove that the that they are not responsible for some or all of the crime was not committed by malicious software or some digital evidence that forms the offence, but by someone other perpetrator using this software, which can be else who has abused their computer system with a difficult. The purpose of this defence is often to create Trojan horse or other malicious code. The prosecution doubt in the minds of the jury and the judge. The defence must refute such claims with certainty, otherwise will be hard to refute and will often suffice for an acquittal the court (or the jury) will have to find the defendant on the basis of reasonable doubt. innocent of the crime. At first glance it is obvious that this is an extremely difficult issue that requires the cooperation of various To avoid the Trojan horse defence, law enforcement experts – criminal lawyers that know the legal system, but agents will also, in addition to presenting digital evidence are restricted in terms of technical know-how; and digital (which must not only prove the existence of a crime, but evidence specialists, who have technical and expert also the absence of malicious codes and other offenders knowledge, but often lack knowledge of the legal system.
  • The Trojan Horse Defense Revisited

    The Trojan Horse Defense Revisited

    Journal of Digital Forensics, Security and Law Volume 9 Number 4 Article 4 2014 Technical Soddi Defenses: The Trojan Horse Defense Revisited Chad M. Steel Steel George Mason University Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer Engineering Commons, Computer Law Commons, Electrical and Computer Engineering Commons, Forensic Science and Technology Commons, and the Information Security Commons Recommended Citation Steel, Chad M. (2014) "Technical Soddi Defenses: The Trojan Horse Defense Revisited," Journal of Digital Forensics, Security and Law: Vol. 9 : No. 4 , Article 4. DOI: https://doi.org/10.15394/jdfsl.2014.1192 Available at: https://commons.erau.edu/jdfsl/vol9/iss4/4 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Technical SODDI Defenses: The Trojan Horse Defense Revisited JDFSL V9N4 This work is licensed under a Creative Commons Attribution 4.0 International License. TECHNICAL SODDI DEFENSES: THE TROJAN HORSE DEFENSE REVISITED Chad M. S. Steel George Mason University MS 2B5 Fairfax, VA 22030 [email protected] ABSTRACT In 2004, the Trojan horse defense was at a crossroads, having been successfully employed in two child pornography cases in the United Kingdom, resulting in acquittals. Despite the early successes, the Trojan horse defense has failed to become a regularly employed strategy. The original Trojan horse defense has now become part of the more general technical SODDI (Some Other Dude Did It) defense, which includes the possibility of unknown actors using unsecured Wi-Fi connections or having physical access to a computer to perform criminal acts.

  • To Download Notes on Unit 5 Notes Trojan Horse

    LNCT GROUP OF COLLEGES Name of Faculty: Shubha Mishra Designation: Assistant Professor Department: Information Technology Subject & Subject Code: WMC & IT-602 Unit: V Topic: Trojan Horse Defense LNCT GROUP OF COLLEGES Trojan Horse A Trojan horse or Trojan is a kind of malware that frequently changed as authentic software. Unlike computer worms and viruses, Trojans are not able to self-replicate. Hackers and cyber-thieves who try to gain access to a user’s system use Trojans. Users fall for some form of social engineering and accidentally load and execute Trojans onto their systems. After the activation process, Trojans allow cybercriminals to spy on the users, steal their personal data, and gain backdoor access to their system. Top 5 Actions of Trojan Horse Virus These actions can include: . Blocking data . Deleting data . Copying data . Modifying data . Disrupting the performance of computer networks or computers Types of Trojan Viruses Some of the key Trojan varieties include: . Trojan-Banker This Trojan has been designed for stealing account data for online banking systems, debit and credit cards. Rootkit This is a sophisticated type of Trojan capable of providing remote control of a victim’s device to the cybercriminal. These Trojans allow the victim’s device to be used as part of a botnet. Trojan-FakeAV This Trojan horse program misrepresents the security status of a computer. These programs convince the user to purchase software in order to remove non-existent malware or security risks from the computer. They continually prompt users to pay for the software using their credit cards. Some programs make use of strategies designed to disrupt or irritate the activities of the user until the software is purchased.
  • Using Social Media Evidence in the Criminal Procedure ______

    Using Social Media Evidence in the Criminal Procedure ______

    Alma Mater Studiorum – Università di Bologna In collaborazione con LAST-JD consortium: Università degli studi di Torino Universitat Autonoma de Barcelona Mykolas Romeris University Tilburg University DOTTORATO DI RICERCA IN Erasmus Mundus Joint International Doctoral Degree in Law, Science and Technology Ciclo 29 – A.Y. 2013/2014 Settore Concorsuale di afferenza: 12H3 Settore Scientifico disciplinare: IUS20 TITOLO TESI Knowledge Production from Social Network Sites - Using Social Media Evidence in the Criminal Procedure _______________________________ Presentata da: Chih-Ping Chang Coordinatore Relatore Prof. Giovanni Sartor Prof. Dr. Alberto Artosi CIRSFID, University of Bologna, Italy Co- Relatore Prof. Dr. Giovanni Ziccardi University of Milan, Italy Esame finale anno 2018 Alma Mater Studiorum – Università di Bologna in partnership with LAST-JD Consoritum Università degli studi di Torino Universitat Autonoma de Barcelona Mykolas Romeris University Tilburg University PhD Programme in Erasmus Mundus Joint International Doctoral Degree in Law, Science and Technology Cycle 29 – a.y. 2013/14 Settore Concorsuale di afferenza: 12H3 Settore Scientifico disciplinare: IUS20 (Title of the Thesis) Knowledge Production from Social Network Sites - Using Social Media Evidence in the Criminal Procedure Submitted by: Chih-Ping Chang The PhD Programme Coordinator Supervisor (s) Prof. Giovanni Sartor Prof. Dr. Alberto Artosi CIRSFID, University of Bologna, Italy Prof. Dr. Giovanni Ziccardi University of Milan, Italy Year 2018 Abstract This thesis focuses