The Future of Digital Forensics

Royal Holloway Information Security Thesis Series | The future of digital forensics The future of digital forensics Investigators have three avenues of attack to use when tackling the complexities of full disk encryption by Nia Catlin, MSc in information security (Royal Holloway) and Lorenzo Cavallaro, ISG, Royal Holloway THINKSTOCK Royal Holloway Information Security Thesis Series | The future of digital forensics The future of digital forensics in the era of full disk encryption Full disk encryption presents a theoretically insurmountable challenge for digital forensics, but authorities still have three avenues of attack for attempting to analyse protected devices. Anti-forensic countermeasures pose a developing challenge, however by Nia Catlin and Lorenzo Cavallaro In the past, forensics relied on artifacts left behind on a suspect’s computer, an intimate knowledge of all the nooks and crannies in which incriminating evidence may be hidden, the tendency of criminals to fail even to attempt to assume they will not be caught, and the failure of criminals to cover their tracks. Unfortunately for digital forensic investigators, their work constitutes a physical security breach, and the use of full disk encryption can be as effective at preventing them carrying out that work as it is at preventing a laptop thief from stealing passwords. The severe consequences of the exposure of corporate and customer data have led to the development of user-friendly and very secure full disk encryption. Moreover, the fear of device theft has led to its widening adoption. Most of the encryption algorithms – when used correctly – are considered unbroken for practical purposes, so authorities trying to analyse such a protected device are left with three avenues of attack: key search, live forensic acquisition and forced key disclosure. This article considers methods for defeating those avenues. The three avenues of attack Key search As security managers are no doubt aware, end-users are notoriously unreliable at choosing and remembering secure passwords. If the decryption keys are not found written down, then brute force and dictionary-based password guessing will often yield results. This can be performed either by a suitably equipped forensic laboratory or outsourced, for example, to the Forensic Computing Team of the National Technical Assistance Centre, which is a division of GCHQ dedicated to helping UK law enforcement agencies access protected data. Limitations: This attack can be thwarted simply by using strong encryption passwords or uncommon phrases. The facility offered by some encryption software to require both a pass-phrase and a keyfile can easily put password Avenues of attack recovery beyond the limits of the most powerful key search apparatus. Authorities have three avenues of Live forensic acquisition attack for attempting to analyse a device protected by full disk Although data encrypted with a strong key can be impenetrable at rest, it encryption: remains much more vulnerable on a live system when the decryption keys or n Key search the data itself are often easily accessible in system memory. A small industry of n Live forensic acquisition lock and door destroying devices enables authorities to seize running computers n Forced key disclosure before a (usually sleeping) suspect can interfere with evidence-gathering. -2- Royal Holloway Information Security Thesis Series | The future of digital forensics Limitations: Apart from not being applicable to devices seized while powered off, there is a potential for anti-forensic software to taint the evidence gathered Forcing users to by analysts, providing false data or rendering evidence inadmissible in court. choose and Forced key disclosure memorise a strong When technical avenues of key recovery are exhausted, the only option is to and unique legally compel the suspect to divulge the decryption keys. This legal power pass-phrase is is provided by UK authorities in section III of the Regulation of Investigatory Powers Act 2000, and allows prison sentences of up to five years for anyone far from simple still refusing to disclose their decryption keys or decrypt the target data. Limitations: Data-hiding techniques can be used either to prevent analysts from being able to find encrypted data (steganography), or to allow data to be decrypted in a way that satisfies the key disclosure demand but does not reveal incriminating evidence (deniable encryption). Building an anti-forensic computer system If a system to protect effectively against the three usual forensics attacks were made accessible and user-friendly, it could allow individuals to deny courts access to digital forensic evidence on a large scale. Defeating key search Although apparently being the most straightforward requirement, forcing users to choose and memorise a strong and unique pass-phrase is far from simple, and the deniable encryption solution can require the usage of multiple such keys. Unfortunately, this problem is rarely addressed by consumer encryption software. An algorithm that attempts to generate strong but memorable pass-phrases combined with another source of authentication (such as a USB key or a thumb-print) are helpful, but preventing users from shooting themselves in the foot remains an open problem. Defeating live analysis A forensic analyst who gains access to a running PC with an encrypted volume in use can generally assume they will be able to access the data in that volume. Current anti-forensic solutions such as the TAILS operating system or TrueCrypt encryption software offer no solution to this, and they simply demand that the user press a panic button or turn off the system before an attacker can reach it. Anti-forensic techniques n Attacking the data: Hide, erase or encrypt incriminating files. n Attacking the analysts: Seed the system with false or conflicting evidence to make it difficult to build a picture of what actually happened. Creating an overwhelming amount of evidence to sift though can lead to low priority investigations being dropped entirely. n Attacking the forensic tools: An increasing reliance on a small market of forensic analysis software maximises the impact of techniques which causes them to fail or generate false results. Live-forensic software is particularly vulnerable if used on a suspect’s running computer when it is seized. -3- Royal Holloway Information Security Thesis Series | The future of digital forensics Like key search, this is also a usability issue. Powering the system on and off and re-entering passwords every time the user leaves the computer is a very Deniable encryption strong barrier to compliance with an anti-forensic protocol. As the time and allows multiple method of entry used by law enforcement is specifically designed to make it difficult for targets to make their systems inaccessible to forensic analysts, a sets of data to be running system left unattended is a total breach of such a protocol. encrypted together One solution to this problem is a program developed by the author, called Lockwatcher. This allows a user to leave their system running unattended while still protecting encrypted data and its decryption keys, requiring only that the user lock the screen when leaving. The software attempts to detect signs of forensic acquisition, removing any decryption keys from memory and shutting the system down to prevent any further access. While physical attacks come in a wide variety of forms, a policy of performing an anti-forensic shutdown on the detection of ANY access to the computer while the screen is locked (apart from the act of typing in the password to unlock the screen) is assumed to fulfil this role. Live forensic acquisition techniques include: n Insertion of a USB key or CD ROM loaded with data-gathering software. The insertion of such media can be detected by Lockwatcher and reacted to before the data-gathering is successful. n Loading of memory capture software after performing a reset of the system. Assuming the analyst performs this step first without triggering countermeasures in any other way, this is the most difficult problem for software to guard against. Using a Bios that erases memory on reboot and prevents an attacker from loading software without the correct password can help mitigate this attack. Methods of storing decryption keys in encrypted RAM or entirely outside of RAM are in development, but none supports the usage of deniable encryption. n Physically removing memory modules from the system to recover decryption keys. This can be prevented by using a motion detection camera to trigger countermeasures when the computer case is moved or opened, or even when an unauthorised person enters the room. Defeating forced key disclosure UK law only requires that a person be believed to have had access to a decryption key in the past for investigators to demand that the key be turned over to them, on penalty of imprisonment. If that person is no longer able to decrypt the data (for example, by forgetting the password) then they must provide evidence to support that claim – no easy feat. This is where deniable encryption comes in. It allows multiple sets of data to be encrypted together in a way that makes it impossible to tell that the different sets exist. When a decryption key is demanded, the key to a benign set of data is produced in the hope of satisfying the investigators while keeping the incriminating data out of reach. Although this is a clever solution, if there is enough evidence to seize a computer, then it is not easy for end-users to implement it without forensic analysts and prosecutors smelling a rat. Little case law exists for investigators demanding hidden keys when a working decryption key has already been provided, but it is likely to be a hot issue in the future. The main problem with protecting hidden data from forensic investigators is -4- Royal Holloway Information Security Thesis Series | The future of digital forensics A candidate anti-forensic system that accessing and using it leaves a plethora of evidence in system logs and operating system files which are readily detected by forensic disk analysis.

Load more