Patrick Leahy Center for Digital Investigation (LCDI) Router Marshal Written & Research by Maegan Katz 175 Lakeside Ave, Room 300A Phone: 802/865-5744 Fax: 802/865-6446 http://www.lcdi.champlin.edu July 2013 Page 1 of 10 Patrick Leahy Center for Digital Investigation (LCDI) Disclaimer: This document contains information based on research that has been gathered by employee(s) of The Senator Patrick Leahy Center for Digital Investigation (LCDI). The data contained in this project is submitted voluntarily and is unaudited. Every effort has been made by LCDI to assure the accuracy and reliability of the data contained in this report. However, LCDI nor any of our employees make no representation, warranty or guarantee in connection with this report and hereby expressly disclaims any liability or responsibility for loss or damage resulting from use of this data. Information in this report can be downloaded and redistributed by any person or persons. Any redistribution must maintain the LCDI logo and any references from this report must be properly annotated. Contents 1 Introduction .................................................................................................................................................................... 3 1.1 Background ............................................................................................................................................................. 3 1.2 Terminology ............................................................................................................................................................ 3 1.3 Research Questions ................................................................................................................................................. 4 1.4 Prior Work ............................................................................................................................................................... 4 2 Methodology and Methods ............................................................................................................................................ 4 2.1.1 Equipment Used .............................................................................................................................................. 4 2.1.2 Device Selection .............................................................................................................................................. 5 2.2 Router 1 - TP-Link .................................................................................................................................................... 6 2.3 Router 2 - NETGEAR ................................................................................................................................................ 6 2.3.1 Testing ............................................................................................................................................................. 6 2.4 Analysis ................................................................................................................................................................... 6 2.4.1 Attached Devices ............................................................................................................................................. 7 2.4.2 Router Log ....................................................................................................................................................... 7 2.4.3 Basic Internet Settings .................................................................................................................................... 7 2.4.4 Acquired Information for Router 2 ................................................................................................................. 8 3 Results ............................................................................................................................................................................. 8 4 Conclusion ....................................................................................................................................................................... 9 5 Further Work ................................................................................................................................................................... 9 6 References ...................................................................................................................................................................... 9 Page 2 of 10 Patrick Leahy Center for Digital Investigation (LCDI) 1 Introduction Routers connect all of the local devices together in a local network, making them crucial to investigations. A growing number of homes and business have some type of router or wireless access point, and in 2012, twenty- five percent of households worldwide had Wi-Fi.1 This research project will explore the forensic data that can be retrieved from home routers using Router Marshal, a program used to acquire data from routers and wireless access points. The software currently supports Linksys WRT54G/GC/GL/GS/G2, AG241, and WRT160N; NETGEAR RP114, WGR614, WNR1000, and WNR2000; D-Link TM-G5240 and WBR-2310; DD-WRT; Tomato firmware; and Cisco IOS routers. 1.1 Background Router Marshal is a digital forensic tool developed by ATC-NY that is used to “automatically acquire digital forensic evidence from network devices such as routers and wireless access points. An investigator can use the Router Marshal software in the field to identify a network device, automatically acquire volatile forensic evidence from the device, and view and interpret this evidence.”2 The software also maintains detailed logs of all activities and communications it performs with a target device. 1.2 Terminology Dynamic Domain Name System (DDNS): A protocol or method that updates a name server in the DNS. Dynamic Host Configuration Protocol (DHCP): A protocol that assigns IP addresses to new users. Internet Protocol (IP) Address: A unique string of numbers assigned to a device attached to a computer network and the Internet. It is an identifier of networked devices. Local Area Network (LAN): The networking of computers in close proximity to each other. An example is a school or office building. Nmap: A security scanning tool that is necessary for Router Marshal to run properly. Power Over Ethernet (POE) Connection: The method of passing electrical power and data through Ethernet cabling. Port Triggering: A way to automate port forwarding by allowing certain routers to automatically allow a host machine to forward a port back to itself. Router: A small physical device that joins multiple networks together; forwards data from one network to another. It allows communication between a local network and the Internet. Universal Plug and Play (UPnP): Internet protocols that allow for computers and handheld devices to communicate. 1 Callaham, J. (2012, April 05). Study: 25 Percent of All Households Use WiFi. Neowin. Retrieved July 15, 2013, from http://www.neowin.net/news/study-25-percent- of-all-households-use-wifi 2 Router Marshal™ Digital Forensic Software. (2010, December 22). Router Marshal™ Digital Forensic Software. Retrieved from http://routermarshal.com/ Page 3 of 10 Patrick Leahy Center for Digital Investigation (LCDI) Wide Area Network (WAN): The networking of computers in a large geographical area. This could include a number of LANs connected together. WinPcap: A packet capture and filtering engine application used in many networking tools. It is a necessary tool for Router Marshal to run properly. 1.3 Research Questions 1) What types of information are stored on a router? 2) What information can Router Marshal retrieve from a router? 3) Can network traffic data and connected device data be acquired from a router using Router Marshal? 1.4 Prior Work To our knowledge, there has been no prior work done with Router Marshal. There has been research done with similar programs such as Wireshark and Cain and Able, which are able to gather network traffic rather than acquiring the data from the router. 2 Methodology and Methods 2.1.1 Equipment Used Item Identifier Size/Specifications LCDI PC 1 Research-5 Running Router Marshal Version 1.0.1 Specs – Desktop, Intel Core i7-3770K CPU @ 3.50GHz, 16GB Memory, Windows 7 Enterprise SP1 MAC Address: BC:5F:F4:A3:4F:23 LCDI Laptop 1 HDLOADNER-04-2 Running Router Marshal Version 1.0.1 Specs – Laptop, Genuine Intel CPU T2400 @ 1.83GHz, 1GB Memory, Windows 7 Enterprise SP1 Test Computer 1 LCDI Testing Computer 3 Specs – Desktop, Pentium Dual-Core CPU E6500 @ 2.93GHz, 4GB Memory, Windows 7 Enterprise SP1 MAC Address: 6C:62:6D:B1:5D:1A IE, Firefox, and Chrome installed and used for generating data Test Tablet 1 Forensics 0028 iPad Version 6.1.2 Model # MC705LL/A MAC Address: 64:20:0C:6F:00:A4 Default web browser used for generating data Router 1 LCDI-EA-001 TP-Link 300Mbps Wireless N Router Model # TL-WR841N Router 2 LCDI-EA-002 NETGEAR G54 Wireless Router Model # WGR614v10 Page 4 of 10 Patrick Leahy Center for Digital Investigation (LCDI) Our first action was to download and install Router Marshal on Research-5, which is Host Computer 1 (2.1.1). In order for Router Marshal to function properly, according to the manual, we also had to download and install Nmap (http://nmap.org/) and WinPcap, which comes with the Nmap download. We connected LCDI PC 1, with Router Marshal installed, and Test Computer 1 to Router 1. Router 1 is connected to the Student network. Our first attempt at