DOCSLIB.ORG

Digital Investigation and Trojan Defense.Pdf

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Digital Investigation and Trojan Defense.Pdf Digital Investigation and the Trojan Defense, Revisited Golden G. Richard III Professor of Computer Science and University Research Professor Director, Greater New Orleans Center for Information Assurance (GNOCIA) University of New Orleans GIAC-certified Digital Forensics Investigator Founder, Arcane Alloy, LLC [email protected] / [email protected] / @nolaforensix http://www.cs.uno.edu/~golden 2 Who? Professor of Computer Science and University Research Professor, Director, Greater New Orleans Center for Information Assurance (GNOCIA), University of New Orleans http://www.cs.uno.edu/~golden Digital forensics, OS internals, reverse engineering, offensive computing, pushing students to the brink of destruction, et al. Founder, Arcane Alloy, LLC. http://www.arcanealloy.com Digital forensics, reverse engineering, malware analysis, security research, tool development, training. Co-Founder, Partner / Photographer, High ISO Music, LLC. http://www.highisomusic.com Music. Rock stars. Earplugs. Copyright 2015 by Golden G. Richard III (@nolaforensix) 3 Digital Forensics “Tools and techniques to recover, preserve, and examine digital evidence stored on or transmitted by digital devices.” Computers, PDAs, cellular phones, videogame consoles, digital cameras, copy machines, printers, digital voice recorders… 4 What That Really Means • Data. “You only think it’s gone.” • Sensitive data tenaciously clings to life. • The vast majority of users—and lots of technical people, too— have no idea what’s really stored on their digital devices… • …and no ability to properly “clean up” even if they do suspect what’s there Copyright 2015 by Golden G. Richard III (@nolaforensix) 5 Where’s the Evidence? Files and Filesystem Application Windows Deleted Files metadata metadata registry Print spool Hibernation Temp files Log files files files Browser Network Slack space Swap files caches traces RAM: OS and app data Volatile Evidence structures Copyright 2015 by Golden G. Richard III (@nolaforensix) How awesome are we? 7 File Carving unrelated disk blocks interesting file one cluster one sector header, e.g., footer, e.g., 0x474946e8e761 0x003B (GIF) (GIF) “milestones” or “anti-milestones” Copyright 2015 by Golden G. Richard III (@nolaforensix) 8 Awesomeness Progression: File Carving Can carve Chaos: files, but More can't Faster not very accurate Yay! carve files well Tools Manual File type Fragmentation, appear, Multithreading, hex editor aware damned but have better design stuff carving, et al spinning disks! issues Images: https://easiersaidblogdotcom.files.wordpress.com/2013/02/hot_dogger.jpg http://cdn.bigbangfish.com/555/Cow/Cow-6.jpg, http://f.tqn.com/y/bbq/1/W/U/i/Big_green_egg_large.jpg http://i5.walmartimages.com/dfw/dce07b8c-bb22/k2-_95ea6c25-e9aa-418e-a3a2-8e48e62a9d2e.v1.jpg Copyright 2015 by Golden G. Richard III (@nolaforensix) 9 Memory Analysis • physical memory dumping tool Capture RAM • VM memory snapshot from live system • VM introspection • strings Analyze • carving Memory Dump • Volatility • VM introspection Expose interesting volatile evidence Copyright 2015 by Golden G. Richard III (@nolaforensix) 10 Memory Analysis: Evidence Processes (dead / alive) e.g., discover and analyze unauthorized programs e.g., detect keystroke loggers, Open files hidden processes e.g., find backdoors, connections Network connections to contraband sites Volatile registry contents portions of Windows registry that are never stored on disk Volatile application data e.g., plaintext for encrypted material, chat messages, email fragments, volatile web browser history Clipboard data volatile contents of clipboard Copyright 2015 by Golden G. Richard III (@nolaforensix) 11 Awesomeness Progression: Memory Forensics Pioneering Chaos: More, efforts Beyond run more, show great Windows ?? strings? more promise pt_finder et al More attention Manual, Mac, … awesome but to malware, run strings, Linux, BSD filling in the gaps, little context limited functionality GPU stuff, etc. Images: https://s-media-cache-ak0.pinimg.com/736x/75/5a/37/755a37727586c57a19d42caa650d242e.jpg,, http://img.photobucket.com/albums/v136/Hell2Pay77/SS-trucks.jpg http://skateandannoy.com/wp-content/uploads/2007/12/sportsbars.jpg, http://gainesvillescene.com/wp-content/uploads/2013/03/dog-longboard.jpg Copyright 2015 by Golden G. Richard III (@nolaforensix) 12 Memory Analysis: 2004 $ grep –i murder /dev/mem I loved Sally, but I murdered her in the park on… Murder Murderer! Blood is on your shoulders! Murderous You murdered my hamster! Murdered Copyright 2015 by Golden G. Richard III (@nolaforensix) 13 Detecting Hidden Resource Utilization • Adversary: Direct Kernel Object Manipulation (DKOM) • Strategy: Deep analysis and cross-correlation of data kernel data structures to reveal hidden resource utilization PID = 2260 Doubly-linked process list in Windows kernel Processes continue to run because Windows C:\> fu –ph 2260 scheduler handles threads, not processes PID = 2260 Copyright 2015 by Golden G. Richard III (@nolaforensix) 14 Copyright 2015 by Golden G. Richard III (@nolaforensix) 15 FU on PID 2260 DKOM Hidden Process Detection in Volatility Copyright 2015 by Golden G. Richard III (@nolaforensix) So we're awesome, right? 17 Unfortunately What evidence is How hard is it to present and what recover? can be recovered? Technical Difficulty Increasing What “evidence” Did malware play was actually a role? “recovered”? Copyright 2015 by Golden G. Richard III (@nolaforensix) 18 Unfortunately, Part 2 What evidence is How hard is it to present and what recover? can be recovered? Misinformation Abounds What “evidence” Did malware play was actually a role? “recovered”? Copyright 2015 by Golden G. Richard III (@nolaforensix) 19 Digital Forensics Settle Intellectual Property Disputes Uncover Fraud Investigate Employee Misconduct Investigate Child Exploitation Discover Insider Threats Prosecute Thieves, Kidnappers, Murderers Copyright 2015 by Golden G. Richard III (@nolaforensix) 20 Digital Forensics Settle Intellectual Property Disputes Uncover Fraud Investigate Employee Misconduct malware Investigate Child Exploitation Discover Insider Threats Prosecute Thieves, Kidnappers, Murderers Copyright 2015 by Golden G. Richard III (@nolaforensix) 21 Digital Forensics Settle Intellectual Property Disputes Uncover Fraud Investigate Employee Misconduct malware Investigate Child Exploitation Discover Insider Threats Prosecute Thieves, Kidnappers, Murderers Copyright 2015 by Golden G. Richard III (@nolaforensix) 22 Malware Software whose execution carries out actions crafted with malicious intent Or, basically, Software that does bad stuff. Copyright 2015 by Golden G. Richard III (@nolaforensix) 23 Malware: Then, Now • “Traditional” Malware – Hacking exercise – “My mad skillz are better than yours” – Mostly, annoying – Possibly, data destruction • Now – Monetized, targeted – Skillz Skill$ – Extremely sophisticated, hard to investigate – Persistent – Serious risks for data theft / catastrophic damage Copyright 2015 by Golden G. Richard III (@nolaforensix) 24 Malware: Effects • Capture data – Keystrokes – Audio – Video – Email – Text messages – Screenshots – Network traffic • Exfiltrate data • Delete important data • Hold data for ransom • Deliberately incriminate users – Cyberattacks – NSFW imagery / documents – Child porn – … Copyright 2015 by Golden G. Richard III (@nolaforensix) 25 Malware: Fallacies • "It's incredibly hard to write!" – Sometimes. – But you can buy it, copy it from the Internet. – And basic malicious intent is very easy to code. • "Antivirus! Yay, Antivirus!" – Generally, no. – Doesn't mean you don't want to use it. – Just don't lean on it too much. – It's not that awesome. • "Criminals are stupid!" – Generally, we catch the stupid(er) ones. – The rest are pretty smart. Copyright 2015 by Golden G. Richard III (@nolaforensix) 26 The Trojan Defense • Variant of the SODDI defense—"Some Other Dude Did It" • Claim by accused: "Wasn't me. Malware did it." – “I didn’t download that stuff—a virus did it” – “I didn’t take the money out of that account” – “I didn’t leak that document!” • Problem #1: – Overused. We can't let everyone walk. • Problem # 2: – Increasingly, the malware might actually have done it. [1] Brenner, Susan W., Brian Carrier, and Jef Henninger. The Trojan Horse Defense in Cybercrime Cases," Santa Clara Computer & High Tech. LJ 21 (2004): 1. Copyright 2015 by Golden G. Richard III (@nolaforensix) 27 The second problem… "As Mark Rasch, former head of the Department of Justice's Computer Crime and Intellectual Property Section, explained, it is relatively easy to manufacture and plant electronic evidence consistent with guilt. In fact, with a few skills and tools, not only could you plant such evidence, but you could do so in such a way as to be virtually undetected, and so that it would be virtually impossible to determine that your target was not guilty…" Plus, "determining" can cost $350+ per hour. Copyright 2015 by Golden G. Richard III (@nolaforensix) 28 Proposed solution from [1]: "Establish defendant's computer expertise" We'll let this slide for now, and as the talk progresses, try to imagine how much expertise would be required to fend off modern malware. Copyright 2015 by Golden G. Richard III (@nolaforensix) 29 Proposed solution from [1]: "Negate the factual foundation of the defense" Means: illustrate that no malware is present This might, or might not, be a fun time. Copyright 2015 by Golden G. Richard III (@nolaforensix) 30 "Negate the Factual…" State of the Art • Run antivirus
Load more

Recommended publications
  • Protecting the Children: Challenges That Result In, and Consequences Resulting From, Inconsistent Prosecution of Child Pornography Cases in a Technical World, 16 Rich
    Richmond Journal of Law and Technology Volume 16 | Issue 3 Article 5 2010 Protecting The hiC ldren: Challenges That Result In, And Consequences Resulting From, Inconsistent Prosecution Of Child Pornography Cases In A Technical World Francis S. Monterosso Follow this and additional works at: http://scholarship.richmond.edu/jolt Part of the Computer Law Commons, and the Internet Law Commons Recommended Citation Francis S. Monterosso, Protecting The Children: Challenges That Result In, And Consequences Resulting From, Inconsistent Prosecution Of Child Pornography Cases In A Technical World, 16 Rich. J.L. & Tech 11 (2010). Available at: http://scholarship.richmond.edu/jolt/vol16/iss3/5 This Article is brought to you for free and open access by UR Scholarship Repository. It has been accepted for inclusion in Richmond Journal of Law and Technology by an authorized administrator of UR Scholarship Repository. For more information, please contact [email protected]. Richmond Journal of Law & Technology Volume XVI, Issue 3 PROTECTING THE CHILDREN : CHALLENGES THAT RESULT IN, AND CONSEQUENCES RESULTING FROM , INCONSISTENT PROSECUTION OF CHILD PORNOGRAPHY CASES IN A TECHNICAL WORLD By Francis S. Monterosso * Cite as: Francis S. Monterosso, Note: Protecting the Children: Challenges that Result In, and Consequences Resulting From, Inconsistent Prosecution of Child Pornography Cases in a Technical World , XVI Rich. J.L. & Tech. 11 (2010), http://jolt.richmond.edu/v16i3/ article11.pdf. INTRODUCTION Of all the sinister things that Internet viruses do, this might be the worst: They can make you an unsuspecting collector of child pornography. Heinous pictures and videos can be deposited on computers by viruses—the malicious programs better known for swiping your credit card numbers.
    [Show full text]
  • Ethical Hacking
    Ethical Hacking Alana Maurushat University of Ottawa Press ETHICAL HACKING ETHICAL HACKING Alana Maurushat University of Ottawa Press 2019 The University of Ottawa Press (UOP) is proud to be the oldest of the francophone university presses in Canada and the only bilingual university publisher in North America. Since 1936, UOP has been “enriching intellectual and cultural discourse” by producing peer-reviewed and award-winning books in the humanities and social sciences, in French or in English. Library and Archives Canada Cataloguing in Publication Title: Ethical hacking / Alana Maurushat. Names: Maurushat, Alana, author. Description: Includes bibliographical references. Identifiers: Canadiana (print) 20190087447 | Canadiana (ebook) 2019008748X | ISBN 9780776627915 (softcover) | ISBN 9780776627922 (PDF) | ISBN 9780776627939 (EPUB) | ISBN 9780776627946 (Kindle) Subjects: LCSH: Hacking—Moral and ethical aspects—Case studies. | LCGFT: Case studies. Classification: LCC HV6773 .M38 2019 | DDC 364.16/8—dc23 Legal Deposit: First Quarter 2019 Library and Archives Canada © Alana Maurushat, 2019, under Creative Commons License Attribution— NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) https://creativecommons.org/licenses/by-nc-sa/4.0/ Printed and bound in Canada by Gauvin Press Copy editing Robbie McCaw Proofreading Robert Ferguson Typesetting CS Cover design Édiscript enr. and Elizabeth Schwaiger Cover image Fragmented Memory by Phillip David Stearns, n.d., Personal Data, Software, Jacquard Woven Cotton. Image © Phillip David Stearns, reproduced with kind permission from the artist. The University of Ottawa Press gratefully acknowledges the support extended to its publishing list by Canadian Heritage through the Canada Book Fund, by the Canada Council for the Arts, by the Ontario Arts Council, by the Federation for the Humanities and Social Sciences through the Awards to Scholarly Publications Program, and by the University of Ottawa.
    [Show full text]
  • Investigating and Prosecuting Cyber Crime: Forensic Dependencies and Barriers to Justice
    International Journal of Cyber Criminology Vol 9 Issue 1 January – June 2015 Copyright © 2015 International Journal of Cyber Criminology (IJCC) – Publisher & Editor-in-Chief – K. Jaishankar ISSN: 0973-5089 - January – June 2015. Vol. 9 (1): 55–119. DOI: 10.5281/zenodo.22387 This is an Open Access article distributed under the terms of the Creative Commons Attribution-NonCommercial-ShareAlikeHTU 4.0 International (CC-BY-NC-SA 4.0) License,UTH whichT permits unrestricted non-commercial use,T distribution, and reproduction in any medium, provided the original work is properly cited. ThisT license does not permit commercial exploitation or the creation of derivative works without specific permission. Investigating and Prosecuting Cyber Crime: Forensic Dependencies and Barriers to Justice Cameron S. D. Brown1 Australian National University, Australia Abstract The primary goal of this paper is to raise awareness regarding legal loopholes and enabling technologies, which facilitate acts of cyber crime. In perusing these avenues of inquiry, the author seeks to identify systemic impediments which obstruct police investigations, prosecutions, and digital forensics interrogations. Existing academic research on this topic has tended to highlight theoretical perspectives when attempting to explain technology aided crime, rather than presenting practical insights from those actually tasked with working cyber crime cases. The author offers a grounded, pragmatic approach based on the in-depth experience gained serving with police task-forces, government agencies, private sector, and international organizations. The secondary objective of this research encourages policy makers to reevaluate strategies for combating the ubiquitous and evolving threat posed by cyber- criminality. Research in this paper has been guided by the firsthand global accounts (via the author’s core involvement in the preparation of the Comprehensive Study on Cybercrime (United Nations Office on Drugs and Crime, 2013) and is keenly focused on core issues of concern, as voiced by the international community.
    [Show full text]
  • The Trojan Horse Defense in Cybercrime Cases, 21 Santa Clara High Tech
    Santa Clara High Technology Law Journal Volume 21 | Issue 1 Article 1 2004 The rT ojan Horse Defense in Cybercrime Cases Susan W. Brenner Brian Carrier Jef Henninger Follow this and additional works at: http://digitalcommons.law.scu.edu/chtlj Part of the Law Commons Recommended Citation Susan W. Brenner, Brian Carrier, and Jef Henninger, The Trojan Horse Defense in Cybercrime Cases, 21 Santa Clara High Tech. L.J. 1 (2004). Available at: http://digitalcommons.law.scu.edu/chtlj/vol21/iss1/1 This Article is brought to you for free and open access by the Journals at Santa Clara Law Digital Commons. It has been accepted for inclusion in Santa Clara High Technology Law Journal by an authorized administrator of Santa Clara Law Digital Commons. For more information, please contact [email protected]. ARTICLES THE TROJAN HORSE DEFENSE IN CYBERCRIME CASES Susan W. Brennert & Brian Carrier with Jef Henninger* TABLE OF CONTENTS I. INTRODUCTION ............................................................. 3 II. LEGAL ISSUES ............................................................ 14 A. How the Trojan Horse Defense Is Used ...................... 16 1. Raise Reasonable Doubt ............................................ 16 2. Negate Mens Rea ..................................................... 18 3. Establishing the Defense .......................................... 18 B. How Can the Prosecution Respond? ............. .......... 21 1. Establish Defendant's Computer Expertise .............. 22 2. "Character" Evidence ..............................................
    [Show full text]
  • Resource Materials on Technology-Enabled Crime
    Resource materials on technology-enabled crime Gregor Urbas Kim-Kwang Raymond Choo Technical and Background Paper No. 28 © Australian Institute of Criminology 2008 ISSN 1445-7261 ISBN 978 1 921185 70 0 Apart from any fair dealing for the purpose of private study, research, criticism or review, as permitted under the Copyright Act 1968 (Cth), no part of this publication may in any form or by any means (electronic, mechanical, microcopying, photocopying, recording or otherwise) be reproduced, stored in a retrieval system or transmitted without prior written permission. Inquiries should be addressed to the publisher. Project no. 0074a Published by the Australian Institute of Criminology GPO Box 2944 Canberra ACT 2601 Tel: (02) 6260 9272 Fax: (02) 6260 9299 Email: [email protected] Website: http://www.aic.gov.au Please note: minor revisions are occasionally made to publications after release. The online versions available on this website will always include any revisions. Disclaimer: The views expressed do not necessarily represent the policies of the Australian Government or AHTCC. Edited and typeset by the Australian Institute of Criminology Resource materials on technology-enabled crime Gregor Urbas Kim-Kwang Raymond Choo Technical and Background Paper No. 28 Contents Foreword and acknowledgements v Introduction 1 Background 2 Terminology and definitions 2 Brief historical background 3 Main types of technology-enabled crime 5 Future trends 6 Prevalence and costs of technology-enabled crime 6 Issues for law enforcement agencies, prosecutors
    [Show full text]
  • Analysis of the Use of XOR As an Obfuscation Technique in a Real Data Corpus Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak
    Analysis of the Use of XOR as an Obfuscation Technique in a Real Data Corpus Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak To cite this version: Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras, Kyle Gorak. Analysis of theUse of XOR as an Obfuscation Technique in a Real Data Corpus. 10th IFIP International Conference on Digital Forensics (DF), Jan 2014, Vienna, Austria. pp.117-132, 10.1007/978-3-662-44952-3_9. hal-01393766 HAL Id: hal-01393766 https://hal.inria.fr/hal-01393766 Submitted on 8 Nov 2016 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Distributed under a Creative Commons Attribution| 4.0 International License Chapter 9 ANALYSIS OF THE USE OF XOR AS AN OBFUSCATION TECHNIQUE IN AREALDATACORPUS Carolina Zarate, Simson Garfinkel, Aubin Heffernan, Scott Horras and Kyle Gorak Abstract The only digital forensic tools known to provide an automated approach for evaluating XOR obfuscated data are DCCI Carver and DC3 Carver, two general-purpose carvingtools developed by the Defense Cyber Crime Center (DC3). In order to determine the use of XOR as an obfuscation technique and the need to adapt additional tools, we analyzed 2,411 drive images from devices acquired from countries around the world.
    [Show full text]
  • Prismvol. 7, No. 2 | 2017
    PRISMVOL. 7, NO. 2 | 2017 THE FIFTH DOMAIN PRISM VOL. 7, NO. 2 NO. VOL. 7, | 2017 cco.ndu.edu A JOURNAL OF THE CENTER FOR COMPLEX OPER ATIONS PRISM ABOUT VOL. 7, NO.2 2017 PRISM, a quarterly journal published by the Center for Complex Operations (CCO) at National Defense University, aims to illuminate and provoke debate on whole-of- government efforts to conduct reconstruction, stabilization, counterinsurgency, and EDITOR NDU’S CENTER FOR COMPLEX OPERATIONS irregular warfare operations. Since its inaugural issue in 2010, PRISM’s readership Mr. Michael Miklaucic has expanded to include more than 10,000 officials, servicemen and women, and The United States Congress in 2009 authorized the establishment of a Center for practitioners from across the diplomatic, defense, and development communities in Complex Operations (CCO) in response to a widely perceived need for interagency interoperability in analysis of, planning for, and intervening in complex operations DEPUTY EDITOR more than 88 countries. worldwide. These include reconstruction, stabilization, counterinsurgency, and Ms. Patricia Clough irregular warfare—operations that demand support from all elements of national COMMUNICATIONS power to succeed. WEBMASTER PRISM encourages authors to aggressively seek out and identify problems that should Created within DOD as a collaborative initiative with support from the Department be addressed irrespective of prevailing U.S. Government policy or current military of State and the U.S. Agency for International Development, the aim of CCO is to: Ms. Rebecca Harper doctrine. We welcome unsolicited manusscripts from policymakers, practitioners, and scholars, particularly those that present emerging thought, best practices, or ■ enable more effective networking, coordination, and synchronization of DESIGN training and education innovations.
    [Show full text]
  • Trusted Computing and the Digital Crime Scene
    ARTICLE: TRUSTED COMPUTING AND THE DIGITAL By Yianna Danidou and CRIME SCENE Burkhard Schafer This paper analyses the future of digital company that patrolled the house regularly and forensics in an environment where control is checked all rooms and storage facilities for increasingly taken away from PC users and intruders or explosive devices. The company had remotely managed by trusted third parties, outsourced several of its activities to other typically to improve internet security. Trusted partner companies, making copies of the key available to them as needed. Their records Computing (TC) is used as the most developed confirm without doubt that nobody but the owner example to illustrate some of the possible legal and employees or agents of the company entered issues that arise. the room between the time of the murder and the police search that seized the knife. Introduction Consider the following physical world crime scene What can we say in these four scenarios about the scenarios: evidential value of the knife? Intuitively, it seems clear that the owner of the house in scenario 1 has some 1. The house of a suspect in a murder inquiry is explaining to do. Objects found in his possession can searched. In a locked room, and a locked chest be clearly attributed to him, and there is no obvious within that room, a bloodied knife is found that explanation for the knife other than that he hid it has the DNA of a murder victim on its blade. The there. Equally, it seems intuitively clear that the room and the chest were securely locked, the situation is considerably different in scenario 2.
    [Show full text]
  • Download Download
    ARTICLE: DIGITAL FORENSICS INSTITUTE IN MALAYSIA: THE WAY FORWARD THE TROJAN HORSE DEFENCE – a modern PROBLEM OF DIGITAL EVIDENCE By Miha Šepec The Trojan horse defence is an important aspect He asserts that somebody else must have committed of the investigation of crimes involving digital the crime using malicious software, or placed it in his evidence. In raising this defence, the accused claims computer system. The prosecutor must prove that the that they are not responsible for some or all of the crime was not committed by malicious software or some digital evidence that forms the offence, but by someone other perpetrator using this software, which can be else who has abused their computer system with a difficult. The purpose of this defence is often to create Trojan horse or other malicious code. The prosecution doubt in the minds of the jury and the judge. The defence must refute such claims with certainty, otherwise will be hard to refute and will often suffice for an acquittal the court (or the jury) will have to find the defendant on the basis of reasonable doubt. innocent of the crime. At first glance it is obvious that this is an extremely difficult issue that requires the cooperation of various To avoid the Trojan horse defence, law enforcement experts – criminal lawyers that know the legal system, but agents will also, in addition to presenting digital evidence are restricted in terms of technical know-how; and digital (which must not only prove the existence of a crime, but evidence specialists, who have technical and expert also the absence of malicious codes and other offenders knowledge, but often lack knowledge of the legal system.
    [Show full text]
  • The Trojan Horse Defense Revisited
    Journal of Digital Forensics, Security and Law Volume 9 Number 4 Article 4 2014 Technical Soddi Defenses: The Trojan Horse Defense Revisited Chad M. Steel Steel George Mason University Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer Engineering Commons, Computer Law Commons, Electrical and Computer Engineering Commons, Forensic Science and Technology Commons, and the Information Security Commons Recommended Citation Steel, Chad M. (2014) "Technical Soddi Defenses: The Trojan Horse Defense Revisited," Journal of Digital Forensics, Security and Law: Vol. 9 : No. 4 , Article 4. DOI: https://doi.org/10.15394/jdfsl.2014.1192 Available at: https://commons.erau.edu/jdfsl/vol9/iss4/4 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Technical SODDI Defenses: The Trojan Horse Defense Revisited JDFSL V9N4 This work is licensed under a Creative Commons Attribution 4.0 International License. TECHNICAL SODDI DEFENSES: THE TROJAN HORSE DEFENSE REVISITED Chad M. S. Steel George Mason University MS 2B5 Fairfax, VA 22030 [email protected] ABSTRACT In 2004, the Trojan horse defense was at a crossroads, having been successfully employed in two child pornography cases in the United Kingdom, resulting in acquittals. Despite the early successes, the Trojan horse defense has failed to become a regularly employed strategy. The original Trojan horse defense has now become part of the more general technical SODDI (Some Other Dude Did It) defense, which includes the possibility of unknown actors using unsecured Wi-Fi connections or having physical access to a computer to perform criminal acts.
    [Show full text]
  • To Download Notes on Unit 5 Notes Trojan Horse
    LNCT GROUP OF COLLEGES Name of Faculty: Shubha Mishra Designation: Assistant Professor Department: Information Technology Subject & Subject Code: WMC & IT-602 Unit: V Topic: Trojan Horse Defense LNCT GROUP OF COLLEGES Trojan Horse A Trojan horse or Trojan is a kind of malware that frequently changed as authentic software. Unlike computer worms and viruses, Trojans are not able to self-replicate. Hackers and cyber-thieves who try to gain access to a user’s system use Trojans. Users fall for some form of social engineering and accidentally load and execute Trojans onto their systems. After the activation process, Trojans allow cybercriminals to spy on the users, steal their personal data, and gain backdoor access to their system. Top 5 Actions of Trojan Horse Virus These actions can include: . Blocking data . Deleting data . Copying data . Modifying data . Disrupting the performance of computer networks or computers Types of Trojan Viruses Some of the key Trojan varieties include: . Trojan-Banker This Trojan has been designed for stealing account data for online banking systems, debit and credit cards. Rootkit This is a sophisticated type of Trojan capable of providing remote control of a victim’s device to the cybercriminal. These Trojans allow the victim’s device to be used as part of a botnet. Trojan-FakeAV This Trojan horse program misrepresents the security status of a computer. These programs convince the user to purchase software in order to remove non-existent malware or security risks from the computer. They continually prompt users to pay for the software using their credit cards. Some programs make use of strategies designed to disrupt or irritate the activities of the user until the software is purchased.
    [Show full text]
  • Using Social Media Evidence in the Criminal Procedure ______
    Alma Mater Studiorum – Università di Bologna In collaborazione con LAST-JD consortium: Università degli studi di Torino Universitat Autonoma de Barcelona Mykolas Romeris University Tilburg University DOTTORATO DI RICERCA IN Erasmus Mundus Joint International Doctoral Degree in Law, Science and Technology Ciclo 29 – A.Y. 2013/2014 Settore Concorsuale di afferenza: 12H3 Settore Scientifico disciplinare: IUS20 TITOLO TESI Knowledge Production from Social Network Sites - Using Social Media Evidence in the Criminal Procedure _______________________________ Presentata da: Chih-Ping Chang Coordinatore Relatore Prof. Giovanni Sartor Prof. Dr. Alberto Artosi CIRSFID, University of Bologna, Italy Co- Relatore Prof. Dr. Giovanni Ziccardi University of Milan, Italy Esame finale anno 2018 Alma Mater Studiorum – Università di Bologna in partnership with LAST-JD Consoritum Università degli studi di Torino Universitat Autonoma de Barcelona Mykolas Romeris University Tilburg University PhD Programme in Erasmus Mundus Joint International Doctoral Degree in Law, Science and Technology Cycle 29 – a.y. 2013/14 Settore Concorsuale di afferenza: 12H3 Settore Scientifico disciplinare: IUS20 (Title of the Thesis) Knowledge Production from Social Network Sites - Using Social Media Evidence in the Criminal Procedure Submitted by: Chih-Ping Chang The PhD Programme Coordinator Supervisor (s) Prof. Giovanni Sartor Prof. Dr. Alberto Artosi CIRSFID, University of Bologna, Italy Prof. Dr. Giovanni Ziccardi University of Milan, Italy Year 2018 Abstract This thesis focuses
    [Show full text]