Advantages And Disadvantages Of Malware

Chapter 4 in the textbook contains links to several web sites which are important to understanding computer investigations. In this section, list the web sites discussed in the chapter and include their Internet links along with a brief description of what is contained at each of these sites.

Where can we find evidence in the network? In chapter 12 of our textbook it tells us how to find evidence on the netbook. There are different types of network, where you can find evidence. “The type of evidence that can be retrieved from networks includes full contact data (i.e., the entire contents of packets) and session data (i.e., traffic data.)” Some of these items can be…

By performing the tasks required in this lab, many other attributes, references, and system information was gleaned that will benefit forensic efforts in the future. For this lab, the time zone of the computer has been isolated to China Standard Time, which in itself is suspicious. BHOs and add-ins were also located using registry values. Among this, there was only a reference to Bing Bar, which was identified in an earlier lab as a download performed on Jane’s computer. Moreover, this lab uncovered startup applications (UPnP.exe and SCVHhost.exe) that were identified as potentially suspicious in previous labs. Lastly, this lab allowed the student to locate USB storage devices that were connected to Jane’s system as well as the times associated with the connection and removal of the device in the system’s

This week’s lab objective is for the student to examine a memory dump from Jane’s computer (BlackSuit Case from week 1) to answer the following: Ascertain Jane’s IP address at the time of the memory acquisition; Determine if there are any active connections and report on their legitimacy; Identify listening ports, and report any suspicious activity. To accomplish this goal, the student is given the memory dump collected by a first responder in the investigation as well as access to two tools contained within the provided EnCase VM; RedLine and Volatility to complete their investigation with.

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

Bashir, Khan, and Bhutto (2015) propose a framework for forensic triage clustering techniques that compare the case evidence against a database of blacklisted information containing information over prior malicious attacks. The framework consists of five phases: (1) identification and isolation of the machine under investigation; (2) data imaging, memory dump, log files, and other system activities; (3) extraction of potential evidence files; (4) triage comparison against the blacklist database; and (5) reporting. The blacklist database contains the history of previous malicious malware or cyber-attacks and allows investigators the ability to use clustering to single out any files matching known attack information. Testing successfully showed a reduction in files needing analysis and provided efficiently accessible information on

The OS provides digital forensic investigators with the primary application where the files, folders, and logs of every event that has occurred involving the suspect’s information system can be located. Furthermore, this information can be utilized by the investigator’s to understand how incidents like network intrusion, malware installation, and insider file deletions have occurred. As a result, OS’s is the location where relevant information on incidents or unlawful activities can be discovered with the proper collection and examination

Containment: During this phase of the process our goal is to first stop the incident from continuing (i.e. A machine on the network has been compromised.) At this time is when we make an image of the file system and memory. First we can use a tool called DumpIt which performs a raw memory dump of the system. **Note this is only performed once the Date, time, and time-zone have been recorded. Then for the image of the file system we use AccessData

Dissect document frameworks and memory pictures to figure out whether any bizarre records, forms or suspicious system associations exist.

The investigation after an incident allows the organization to identify the attacker, tools used in the attack, the vulnerability that was exploited, and the damage caused by the attack. This post-mortem

In 1997 the National Security Agency (NSA) tested the Pentagon’s cyber security in an exercise named “Eligible Receiver”. Within two days of the exercise, the NSA team had penetrated the classified command network and was in complete control of network. Two years later, the United States Air Force experienced a computer breach in which huge amounts of data were being exfiltrated from research files located on airbases. “Gigantic amounts of data were being shipped out from a lot of computers in the Defense Network and from many data systems in the national nuclear laboratories of the Energy Department.” (Clarke, p. 111) File case named “Moonlight Maze”, by the FBI day-lighted two important aspects of information security. Computer specialist

Computer viruses are minute program which is “embedded inside an application or within a data file which can copy itself into another program“(Adams et al, 2008 ) for the sole determination of meddling with normal computer operations. The consequences may range from corruption and deletion of data; propagation of virus on to network and deployment through attachments through emails in order to further creating havoc to all associated computing devices.

The goal of this case study is to follow a packet capture file to investigate the fictitious character Ann Dercover. Examining the file will show how she uses network tunneling to cover her tracks, but more importantly, it will help develop skills that can be applied to network forensics. The challenge is to determine if the DNS traffic is truly suspicious, determine the purpose of the DNS traffic, recover all possible information on the local and remote systems involved, and the risk associated with the data leaking from the organization.

To understand the business of malware, one must understand how malware has evolved in the past twenty-five years. Malware, which includes all kinds of malicious software, was originally created to show the weaknesses of computers. The first type of malware, created in 1986, was a virus called “Brain.A. Brain.A was developed in Pakistan, by two brothers - Basit and Amjad. They wanted to prove that PC is not secure platform, so they created virus that was replicating using floppy disks” (Milošević). Even today malware is still used to check the security of machines.

Cybercrime we have when a computer is the object of the crime like hacking, phishing, spamming or is used as a tool to commit an offense like the child pornography, hate crimes etc.