Hackers Brew Self-Destruct Code to Counter Police Forensics

Hackers have released an application designed to thwart a Microsoft-packaged forensic toolkit used by law enforcement agencies to examine a suspect’s hard drive during a raid.

The hacker tool, dubbed DECAF, is designed to counteract the Computer Online Forensic Evidence Extractor, aka COFEE. The latter is a suite of 150 bundled, off-the-shelf forensic tools that run from a script. Microsoft combined the programs into a portable tool that can be used by law enforcement agents in the field before they bring a computer back to their forensic lab. The script runs on a USB stick that agents plug into the machine.

The tools scan files and gather information about activities performed on the machine, such as where the user surfed on the internet or what files were downloaded.

Someone submitted the COFEE suite to the whistleblower site Cryptome last month, prompting Microsoft lawyers to issue a take-down notice to the site. The tool was also being distributed through the Bit Torrent file sharing network.

This week two unnamed hackers released DECAF, an application that monitors a computer for any signs that COFEE is operating on the machine.
According to the Register, the program deletes temporary files or processes associated with COFEE, erases all COFEE logs, disables USB drives, and contaminates or spoofs a variety of MAC addresses to muddy forensic tracks.

The hackers say that later releases of the program will allow computer owners to remotely lock down their machine once they detect that it has fallen into law enforcement hands. The hackers, however, have not released source code for the program, which would make it easy for anyone to see if the program contains malware that might also harm a computer or allow the attackers to take control of it.

By Kim Zetter

Pirates get a taste of Microsoft COFEE

Microsoft's Computer Online Forensic Evidence Extractor (COFEE) software, which helps law enforcement officials grab data from password protected or encrypted sources, has leaked.

Microsoft's Computer Online Forensic Evidence Extractor (COFEE) has made it into the hands of pirates, and their virtual ships are distributing it quickly for everyone to get a taste. The COFEE application uses common digital forensics tools to help law enforcement officials at the scene of a crime gather volatile evidence of live computer activity that would otherwise be lost in a traditional offline forensic analysis. In other words, it lets officers grab data from password-protected or encrypted sources. That means you can now break the law twice over: download the software and then use it to steal information from other people's computers.

Chances are you won't have any use for the tool, but pirates get a thrill from having something they shouldn't, and a forensics tool only distributed to police departments around the world is pretty high up on the list of things you shouldn't have on your computer. The forensics tool is approximately 15MB in size and works best with Windows XP. Microsoft is working on a new version of COFEE for next year that fully supports Windows Vista and Windows 7. Here's the official description of COFEE:

With COFEE, law enforcement agencies without on-the-scene computer forensics capabilities can now more easily, reliably, and cost-effectively collect volatile live evidence. An officer with even minimal computer experience can be tutored—in less than 10 minutes—to use a pre-configured COFEE device. This enables the officer to take advantage of the same common digital forensics tools used by experts to gather important volatile evidence, while doing little more than simply inserting a USB device into the computer.

The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation.

Microsoft first revealed the tool back in April 2008, so we have to say that the software giant did quite a good job keeping it away from pirates for over two years (that has to be some kind of record for Redmond). In April 2009, Microsoft announced that it will aid global law enforcement in fighting cybercrime by providing its COFEE tool free of charge to International Criminal Police Organization's (Interpol) Global Security Initiative (GSI), a project that addresses international security challenges, and the participating 187 countries. Now though, the valuable tool is available to more than just government crime fighting bodies, and we can't say we're comfortable with the possible implications.

New Nmap version detects the Conficker worm

The Conficker worm is receiving a lot of attention because of its vast scale (millions of machines infected) and advanced update mechanisms. Thanks to research by Tillmann Werner and Felix Leder of The Honeynet Project and implementation work by Ron Bowes, David Fifield, Brandon Enright, and Fyodor, a new Nmap release is here which can remotely scan for and detect infected machines.

To scan for Conficker, use a command such as:
nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [targetnetworks]

A clean machine should report at the bottom: “Conficker: Likely CLEAN”, while likely infected machines say: “Conficker: Likely INFECTED”. For more advice, see this nmap-dev post by Brandon Enright. Dan Kaminsky broke the story on Doxpara.com.

While Conficker gets all the attention, 4.85BETA5 also has many other great improvements:

* Ndiff now includes service (version detection) and OS detection differences.
* [Ncat] The --exec and --sh-exec options now work in UDP mode like they do in TCP mode: the server handles multiple concurrent clients and doesn't have to be restarted after each one.
* [Ncat] The -v option (used alone) no longer floods the screen with debugging messages. With just -v, we now only print the most important status messages such as "Connected to ...", a startup banner, and error messages. At -vv, minor debugging messages are enabled, such as what command is being executed by --sh-exec. With -vvv you get detailed debugging messages.
* [Ncat] Chat mode now lets other participants know when someone connects or disconnects, and it also broadcasts a current list of participants at such times.
* [Ncat] Fixed a socket handling bug which could occur when you redirect Ncat stdin, such as "ncat -l --chat < /dev/null". The next user to connect would end up with file descriptor 0 (which is normally stdin) and thus confuse Ncat.
* [Zenmap] The "Scan Output" expanders in the diff window now behave more naturally. Some strange behavior on Windows was noted by Jah.
* The following OS detection tests are no longer included in OS fingerprints: U1.RUL, U1.TOS, IE.DLI, IE.SI, and IE.TOSI. URL, DLI, and SI were found not be helpful in distinguishing operating systems because they didn't vary. TOS and TOSI were disabled in 4.85BETA1 but now they are not included in prints at all.
* The compile-time Nmap ASCII dragon is now more ferocious thanks to better teeth alignment.
* Version 4.85BETA4 had a bug in the implementation of the new SEQ.CI test that could cause a closed-port IP ID to be written into the array for the SEQ.TI test and cause erroneous results.
* Nbase has grown routines for calculating Adler32 and CRC32C checksums. This is needed for future SCTP support.
* [Zenmap] Zenmap no longer shows an error message when running Nmap with options that cause a zero-length XML file to be produced (like --iflist).
* Fixed an off-by-one error in printableSize() which could cause Nmap to crash while reporting NSE results. Also, NmapOutputTable's memory allocation strategy was improved to conserve memory.
* [Zenmap] We now give the --force option to setup.py for installation to ensure that it replaces all files.
* Nmap's --packet-trace, --version-trace, and --script-trace now use an Nsock trace level of 2 rather than 5. This removes some superfluous lines which can flood the screen.
* [Zenmap] Fixed a crash which could occur when loading the help URL if the path contains multibyte characters.
* [Ncat] The version number is now matched to the Nmap release it came with rather than always being 0.2.
* Fixed a strtok issue between load_exclude and TargetGroup::parse_expr that caused only the first exclude on a line to be loaded as well as an invalid read into free()'d memory in load_exclude().
* NSE's garbage collection system (for cleaning up sockets from completed threads, etc.) has been improved.

Presentation:The Volatility Framework: Volatile memory artifact extraction utility framework

Overview
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The Volatility Framework demonstrates our committment to and belief in the importance of open source digital investigation tools . Volatile Systems is committed to the belief that the technical procedures used to extract digital evidence should be open to peer analysis and review. We also believe this is in the best interest of the digital investigation community, as it helps increase the communal knowledge about systems we are forced to investigate. Similarly, we do not believe the availability of these tools should be restricted and therefore encourage people to modify, extend, and make derivative works, as permitted by the GPL.

Capabilities
The Volatility Framework currently provides the following extraction capabilities for memory samples

* Image date and time
* Running processes
* Open network sockets
* Open network connections
* DLLs loaded for each process
* Open files for each process
* Open registry handles for each process
* A process' addressable memory
* OS kernel modules
* Mapping physical offsets to virtual addresses (strings to process)
* Virtual Address Descriptor information
* Scanning examples: processes, threads, sockets, connections,modules
* Extract executables from memory samples
* Transparently supports a variety of sample formats (ie, Crash dump, Hibernation, DD)
* Automated conversion between formats

Supported Platforms
The Volatility framework should run on any platform where Python is supported. Volatility has been test on the following platforms:

* Linux
* Cygwin
* Windows
* OSX 10.5 (Thanks: sam f. stover)


Download
Volatility-1.3_Beta
Volatility-1.1.2

VISIT:https://www.volatilesystems.com

EnCase Computer Forensics Demo

WiebeTech HotPlug lets cops move desktops without shutting them down

We've seen some interesting computer forensics gear from WiebeTech before, like the Mouse Jiggler USB key that prevents a system from locking the screen or going to sleep by subtly shaking the mouse cursor, and the company's latest addition to the investigator's toolkit, the HotPlug LT, solves an equally basic problem: how to move a desktop without powering it down. The HotPlug allows cops to seize machines without powering them down by switching power to a UPS, using some interesting power-management voodoo. The investigator simply plugs the HotPlug into the computer's powerstrip, and then unplugs the strip and plugs it into the UPS -- and takes the whole system away. If the machine is plugged directly into the wall, WiebeTech also has options for directly piercing the power cable or hijacking the outlet itself. Bottom line: the Man's getting your machine, like it or not. Peep a vid of the HotPlug in action after the break.



by Nilay Patel, posted Nov 6th 2007 at 1:19PM