Proxy Servers

A proxy server is a computer that relays a request for a client to a server computer. This is important to know because a suspect might actually use another user’s computer, or multiple computers, as an intermediary to request information from a server. Therefore, investigators might seize a web server hosting illicit photographs of minors, but the client requests to download pages or images might show the IP addresses of unsuspecting individuals, who had their computers compromised by hackers. Squid is a caching proxy service that can be used to increase performance on a web server, by caching popular requests, and it can also cache DNS, Web, and network lookups. Web cache is of interest to forensics investigators because it can provide invaluable information about Internet activity through requests to a web server. Most proxies are web proxies. All traffic through Port 80, Port 8080, Port 80443, or Port 443 must go through a web proxy.

Web Servers

A web server stores and serves up HTML documents and related media resources in response to client requests. In other words, when you type a URL into your web browser, and then press Enter, a data packet is sent to that web server that includes your IP address. In turn, the webpage (HTML file and associated media files) is sent to your computer and saved in cache. For example, if you visit a friend’s Facebook page, you download the HTML profile page and any photos or videos (media files) embedded on that profile page. A forensics investigator can analyze client user requests from the web server logs.

When reviewing log files on a web server, the following information can be obtained:

• Date and time

• Source IP address

• HTTP source code

• Resource requested

There are several folders on a Linux computer that will be of interest to a forensics investigation, and they are as follows:

• /etc: Contains system configuration files and some other file types.

• /etc/passwd: Configuration file that contains local user information. You can find user login information in this file. The file uses data encryption standard (DES).

• /etc/group: Contains user group information.

• /etc/shadow: You can find user login password hashes here. The file is only readable by the root user.

• /home: Location where all user home directories are created.

• /.bash_history: Logs a history of all commands that have been run in the file.

• /etc/ssh & /.ssh: Holds private and public keys for the host.

• /var/log: Contains logs of several running services. On a web server this may be Apache (a popular open source web server software) or SSH (a cryptographic network protocol for securing network communications).

• /var/www: Apache stores web server files and subdirectories in this folder.

• /var/www/html: Stores the content of a website running Apache.

DHCP Servers

Dynamic Host Configuration Protocol (DHCP) is a standard for allowing a server to dynamically assign IP addresses and configuration to hosts on a network. This dynamic addressing means that a new client can join a network without having to possess a preassigned IP address. The DHCP server assigns a unique IP address, and then after a client leaves the network, that IP address is released and can be used for a new host that enters the network. DHCP means that a network administrator does not need to manually assign IP addresses and keep track of clients using those IP addresses but can have DHCP client software perform those tasks automatically. An Internet service provider (ISP) can use DHCP to allow customers to join its networks. Similarly, on a home network, a broadband router uses DHCP to add clients to its network—these can include a PC, a smart TV, a tablet, or a smartphone. At a minimum, a DHCP server provides an IP address, subnet mask, and default gateway. A subnet mask facilitates the communication between segregated networks. An IP address has two parts: network and host address. A subnet mask separates an IP address into network and host addresses. We will discuss subnetting in more detail later in this chapter. The default gateway is the node on a network that serves as the forwarding host (router) to other networks. For example, on a home network, the default gateway might be the broadband router.

A router maintains an ARP (Address Resolution Protocol) table, which is based on ARP requests and responses. When a packet is sent across the Internet, it is sent to the MAC address of the router interface that is the default gateway. ARP binds a static IP to a MAC address in a device’s ARP table. DHCP, on the other hand, always assigns the same IP address to a device. ARP is used to get the MAC address from an IP address and is primarily used on a LAN (Local Area Network).

The routing table contains the following:

• Destination network IP addresses;

• Destination gateway IP address; and

• Corresponding interface.

When the router receives a packet, it will check for the destination network IP address in the routing table. If the packet is destined for a network that is directly connected to the router, then the destination MAC address will be obtained from the ARP table. MAC addresses (Layer 2 of the OSI Model) are mapped to IP addresses (Layer 3) using ARP. ARP responses are cached on hosts that make up the LAN. The ARP cache can be queried on a Windows system to identify MAC—IP address mappings using the following command:

arp -a

You can view DHCP service activity on your personal computer by launching the Event Viewer application. As you can see in Figure 8.1, an event is created every time DHCP starts and stops.

DHCP is a client/server protocol that provides an IP host with an IP address and other configuration information, e.g. a subnet mask or default gateway. Static IP addresses are assigned to networking equipment, including routers, firewalls, and servers. Host computers, including tablets and smartphones are generally assigned a dynamic IP address.

An examination of DHCP logs will display the MAC addresses of devices that connected to a router. If an organization uses a DHCP server, then the logs, with MAC addresses, may be extensive. DHCP can be handled by a router or a server. You may be able to identify a DHCP server by monitoring traffic on Ports 67 and 68.

There are a number of known DHCP attacks, which includes DHCP poisoning and DHCP starvation. It is therefore important to understand that you might find evidence of this type of spoofing in DHCP logs. Thus, an attacker might impersonate a legitimate user, and therefore the investigator needs to be cognizant of this possibility.

Sometimes you will see the following messages in DHCP logs:

Click here to view code image

   Message         Use
   -------         ---

   DHCPDISCOVER -  Client broadcast to locate available servers.

   DHCPOFFER    -  Server to client in response to DHCPDISCOVER with
                   offer of configuration parameters.

   DHCPREQUEST  -  Client message to servers either (a) requesting
                   offered parameters from one server and implicitly
                   declining offers from all others, (b) confirming
                   correctness of previously allocated address after,
                   e.g., system reboot, or (c) extending the lease on a
                   particular network address.

   DHCPACK      -  Server to client with configuration parameters,
                   including committed network address.

   DHCPNAK      -  Server to client indicating client's notion of network
                   address is incorrect (e.g., client has moved to new
                   subnet) or client's lease as expired

   DHCPDECLINE  -  Client to server indicating network address is already
                   in use.

   DHCPRELEASE  -  Client to server relinquishing network address and
                   cancelling remaining lease.

   DHCPINFORM   -  Client to server, asking only for local configuration
                   parameters; client already has externally configured
                   network address.

Source: https://www.ietf.org/rfc/rfc2131.txt

DHCP Logs

A DHCP server will log the following:

• Startup

• Shutdown

• DHCP leases

• DHCP assignments

• DHCP requests

On a Linux DHCP server, leases are stored in the file dhcpd.leases, which can be found here:

/var/lib/dhcp/dhcpd.leases

The configuration file is dhcpd.conf and can be found in the following directory:

/etc/

The dhcpd.conf file will provide the following information:

• Default lease time

• Maximum lease time

• Syslog* logging

• Range of dynamically allocated addresses

Syslog is used by network devices to send event messages to a logging server.

Hub

A hub is a hardware networking device that broadcasts data packets to all devices on a network regardless of the MAC address. A hub is a Layer 1 (OSI Model) device.

Switch

A network switch is an intelligent hardware device that connects devices on a network. It is also referred to as a switching hub, bridging hub, or MAC bridge. The difference between a hub and a switch is that the latter only forwards packets to the required destination device on a network. A network switch operates at the data link layer (Layer 2 of the OSI Model), although some switches can also operate at the network layer (Layer 3 of the OSI Model). Content Addressable Memory (CAM) is a type of memory used by Cisco switches, and a CAM address table may be available for an investigator to analyze.

SMTP Servers

A Simple Mail Transport Protocol (SMTP) server is used to send email for a client. The email is subsequently routed to another SMTP server or other email server. For example, when you use Microsoft Outlook to send an email, this email application informs an SMTP server of the sender and recipient email addresses, as well as the body of the message. When sending an email to another domain (for instance, an email from Hotmail to Yahoo!), the SMTP server communicates with a DNS server and requests the IP address of the SMTP server. The DNS then responds with the IP address or addresses for SMTP servers that Yahoo! (in this example) operates. SMTP servers communicate with one another using simple commands, like HELO (introduction), MAIL FROM: (specify the sender), RCPT TO: (specify the recipient), QUIT (quit the session), HELP (get help), VRFY (verify the address), and DATA (To, From, Subject, Body of message). Internet Message Access Protocol (IMAP) allows the user to access email from just about any type of Internet-enabled device. With IMAP, the user’s email is stored on an email server, and when an email message is requested, it is only temporarily downloaded to the user’s device. Post Office Protocol (POP) is a different electronic mail standard because the email is stored on the user’s device, not on the server. Some email services, like Gmail, can be set as a POP or IMAP email service by the user.

1) Received: (qmail 29610 invoked by uid 30297); 27 Jul 2013 19:13:41 -0000
2) Received: from unknown (HELO p3plibsmtp01-05.prod.phx3.secureserver.net)
[ic:ccc] ([10.6.12.128])
3) (envelope-sender <[email protected]>)
4) by p3plsmtp10-06.prod.phx3.secureserver.net (qmail-1.03) with SMTP
5) for <[email protected]>; 27 Jul 2013 19:13:41 -0000
6) Received: from co1outboundpool.messaging.microsoft.com ([216.32.180.188])
16) Received: from mail22-co1-R.bigfish.com (10.243.78.243) by
17) CO1EHSOBE025.bigfish.com (10.243.66.88) with Microsoft SMTP Server id
22) X-Forefront-Antispam-Report: CIP:198.105.43.6;KIP:(null);UIP:(null);IPV:NLI;H:
exchnycsmtp1.pace.edu;RD:none;EFVD:NLI
55) MIME-Version: 1.0
58) X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
63) Hello
64) Dr. Sherlock Holmes | [email protected]<mailto:[email protected]> | Dir=
65) Assistant Professor | The Moors | (212) 555-1234=
66) | Fax (212) 555-1234 | Pace University, 163 William Street, New =
67) York, NY 10038
68) Visit Us Online: http://www.pace.edu/pace/seidenberg/
72) <html dir=3D"ltr">
73) <head>
81) 10pt;">Hello<br>
136) </body>
137) </html>

p3plibsmtp01-05.prod.phx3.secureserver.net

DNS Servers

The Domain Name System (DNS) is a naming system for computers and other devices connected to the Internet. One function of DNS is to convert domain names to IP addresses. For example, the IP address for the domain name www.pace.edu is actually 198.105.44.27 (IPv4), but we use letter names because it is easier to remember when surfing the Internet. DNS servers are also referred to as nameservers. A DNS server will point a client to either the company that a domain was registered to or to the company that hosts their Website. Zone files contain the domain’s DNS settings.

DNS maintains different types of records. A primary “A” record is called “@” and this controls what your domain name does when a client visits your website. An “A” record provides the mappings between host names and IPv4 addresses. CNAMEs point your subdomains to a different server. “AAAA” records provide the mappings between host names and IPv6 addresses. “MX” records are mail exchange records, which are used to determine the priority of email servers for a domain. “PTR” records resolve an IP address to a domain name, which is the opposite of a client request to a server (domain name → server).

DNS is sometimes referred to as a query-response protocol. Generally, a client sends a request with a single UDP packet, and then the server responds with a single UDP packet. With larger systems, the server may respond via TCP.

As you can see in Figure 8.2, Windows Event Viewer records DNS resolution services.

The Hosts File

The hosts file is a text file found on Windows that maps hostnames to IP addresses. It is an operating system file. The host name may be mapped to both IPv4 and IPv6 addresses. Thus, the domain name resolution may occur on the host side. Sometimes a systems administrator may modify this file and the IP mappings. Unfortunately, hackers have also been known to compromise this file to redirect client computers. On a Windows PC (Windows XP and up), the file can be found here:

%SystemRoot%System32driversetchosts

On an Apple Macintosh, a similar file can be found here:

/private/etc/hosts

With DNS domains, there is a hierarchical structure. At the top are root nodes. Then we have “top level domain” nodes, e.g. .com, .net, .org. A top-level domain contains “domain nodes”, which are also referred to as “zones”, e.g., google.com. Within each domain there may be “sub-domains”, e.g. accounts.google.com.

DNS servers are referred to as “nameservers” and points a client to the company that controls the DNS settings, which is often the company that the domain name was registered to. Alternatively, the nameserver may be the company that hosts your website. A zone files are files that contains all of your domain’s DNS settings. A record will point your domain or sub-domain name to a specific server. There is always a primary A Record called “@” and controls what actions your domain name performs when a client visits. CNAMEs point your subdomains to a different server.

DNS Protocol

DNS is sometimes referred to as a query-response protocol. The client typically sends a request with a single UDP packet, and the server response generally fits into a single UDP packet. Again, UDP is a Layer 3 protocol. If the server response is too large to fit into a single packet, then the response may be sent via a TCP connection. An example of this is when a request is made for an AXFR record, which is also known as “zone transfer”. This query is basically a client request to send information about a particular domain. However, DNS over TCP Port 53 is often blocked by the administrator to prevent disclosure of DNS information to potential hackers.

Internet Corporation for Assigned Names and Numbers (ICANN)

ICANN is a non-profit organization that is responsible for maintaining databases related to namespaces on the Internet.

Traceroute

Traceroute is a tool used to track the path of IP packets from one system to another. Traceroute can be used to diagnose issues with transmitting IP packets.

Routers

A router is hardware that connects a network to one or more other networks and directs data packets from one node to another. The router inspects each packet, and then directs that packet based on the IP address contained in each packet. DHCP is a client/server protocol that provides an IP host with an IP address and other configuration information, e.g. a subnet mask or default gateway. Static IP addresses are assigned to networking equipment, like routers, firewalls, and servers. Host computers, including tablets and smartphones are generally assigned a dynamic IP address.

Pretty Good Privacy (PGP) Encryption

PGP is an encryption program that is used for the secure transmission of email and encryption of files, directories, and volumes (disks). PGP is the most widely used email encryption program in the world. In 1991, Phil Zimmermann created the PGP program and made it freely available to the public. It also became popular outside of the USA. Given that PGP uses an RSA encryption algorithm, RSA Data Security sued Pretty Good Privacy for patent infringement in a licensing dispute (https://cryptome.org/jya/rsavpgp.htm). Interestingly, the United States Customs Service then initiated a criminal investigation against Zimmermann for violating the Arms Export Control Act and termed cryptographic software as “munitions”. Thus, Zimmermann was suspected of “arms trafficking” and arrested at Washington’s Dulles Airport by U.S. Customs agents. Fortunately for him, he was arriving into the USA. If he had been leaving the USA, with PGP encrypted files, then he could have been arrested on federal charges for exporting weapons without a license. Charges against Zimmermann were later dropped, and he was never indicted. Zimmermann later went on to work for Silent Circle, the company that created the Blackphone (encrypted smartphone).

How Does PGP Work?

PGP combines symmetric key encryption and public key encryption. The message is first encrypted with symmetric key encryption. The symmetric key is a one-time-only session key that is sent to the receiver during transmission, and the message is also encrypted with the receiver’s public key. The receiver can only decrypt the symmetric (session) key with their private key. PGP also uses a digital signature, using either RSA or DSA algorithms to ensure message authentication. PGP also supports integrity checking to ensure that the message was not altered during transmission; if the message was altered, then the receiver will not be able to decrypt the message.

PGP and the Dark Web

PGP is of particular interest to investigators because it is widely used for secure email communication between Dark Web marketplace vendors and their customers; PGP is used to prevent eavesdropping by law enforcement. These vendors have made their PGP public key available on Dark Web marketplaces, like Hansa, Honest Cocaine, and AlphaBay. Kleopatra is a tool, which is available from OpenPGP, that can extract the email address used to generate a PGP key, using the public PGP key.

What Does a PGP Key Look Like?

Figure 8.3 shows an example from a Dark Web marketplace vendor:

OpenPGP

Patent issues associated with using RSA encryption licensing issues have continued to be a concern. Thus, PGP Inc. approached the IETF and proposed a new standard called OpenPGP. There is now an OpenPGP Working Group, which is administered by the IETF.

IPv4

Currently, most traffic on the Internet uses IPv4. Internet Protocol version 4 (IPv4) is the fourth version protocol for connectionless data transmission on packet-switched internetworks. A packet is a block of data transmitted across a network. On the Internet, these packets are transmitted in sequence, and each packet is uniform in size and structure. An IP packet (block of data sent across the Internet) contains a header section and a data section. An IPv4 header has 14 fields, as outlined in Figure 8.4.

• Version: The version (a value of 4 bits shows that it is IPv4).

• Internet Header Length (IHL): The length of the header.

• Differentiated Services Code Point (DSCP): Differentiated Services (DiffServ) code for real-time data streaming.

• Explicit Congestion Notification (ECN): An optional feature that allows for notification of network congestion.

• Total Length: A 16-bit field that denotes the size of the packet (header and data).

• Identification: A unique identifier.

• Flags: A unique identifier used to identify fragments.

• Fragment Offset: A 13-bit value used to specify the offset of a fragment.

• Time To Live (TTL): The time that a datagram may live. A router decrements this number and discards the packet when it reaches 0.

• Protocol: The protocol used in the data part of the IP datagram, as defined by IANA.

• Header Checksum: Used for error checking by the router.

• Source IP Address: The sender’s IP address.

• Destination IP Address: The recipient’s IP address.

• Options: Infrequently used but can hold data from the IHL.

IPv4 uses 32-bit addresses, which are usually represented in four octets of dotted decimal notation—see the previous example for www.pace.edu, where 198.105.44.27 is an IPv4 address.

IPv4 uses 32-bit addresses, which are usually represented in four octets of dotted decimal notation, like the example above for www.pace.edu where 198.105.44.27 is an IPv4 address. An IPv4 address is broken into two parts: (1) Network and (2) Host. The host refers to a specific device on a network. For example, a device could be a computer, fax machine or printer. IANA (Internet Assigned Numbers Authority) is the organization responsible for assigning IP addresses (iana.org). IANA assigns blocks of IP addresses to Regional Internet Registries (RIRs), which in turn allocate IP addresses within their region:

• AfriNic (Africa)

• APNIC (Asia Pacific)

• ARIN (North America)

• LACNIC (Latin America & Caribbean)

• RIPE (Europe)

Subnet Mask

Subnetting allows an administrator to create multiple (logical) networks within a Class A, B, C network. The subnet mask is used by TCP/IP to locate a specific host on a subnet. Ultimately, the purpose of the subnet mask is to determine where the network part of an address ends and where the individual device address begins. An IP address is comprised of 32 binary bits. These 32 bits can be divided into four octets (1 octet = 8 bits). The value of each octet ranges from 0 to 255 decimal, i.e. 00000000 – 11111111 (binary).

In the first example below, we convert an octet when all bits are set to 1.

1	1	1	1	1	1	1	1
27	26	25	24	23	22	21	20
128	64	32	16	8	4	2	1
128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255

Here is another example where all bits are not set to 1. As you can see, we use the same formula and multiply the binary value (top row) by the value in the third row (128, 64, …)

0	1	0	0	0	0	1	0
27	26	25	24	23	22	21	20
128	64	32	16	8	4	2	1
64 + 2 = 66

Class A Network

For a Class A network, which has a major network address range of 1.0.0.0 - 127.255.255.255, the first octet is for the network. Octets 2, 3, and 4 (24 bits) are for the network manager to divide into subnets and hosts.

Class A network addresses have more than 65,536 hosts.

Class B Network

For a Class B network, which has a major network address range of 128.0.0.0 - 191.255.255.255, the first two octets are for the network. Therefore, octets 3 and 4 (16 bits) are for the network manager to divide into subnets and hosts.

Class B network addresses have between 256 and 65,534 hosts.

Class C Network

For a Class C network, which has a major network address range of 192.0.0.0 - 223.255.255.255, the first three octets are for the network. Therefore, octet 4 (8 bits) is for the network manager to divide into subnets and hosts.

Class C networks addresses have less than 254 hosts.

Network Masks

The default masks are as follows:

Class A: 255.0.0.0 (or 11111111.00000000.00000000.00000000 in binary)

Class B: 255.255.0.0

Class C: 255.255.255.0

An example of a Class A network that has no subnet is 8.20.15.1 255.0.0.0:

8.20.15.1 = 00001000.00010100.00001111.00000001

255.0.0.0 = 11111111.00000000.00000000.00000000

The network id (8) is in bold, and the remaining octets represent the host id (20.15.1), which is in italics.

In Table 8.1, the first column indicates the class of network, while the second column shows the IP address range. For example, an IP address that looks like 101.x.x.x is a Class A address. We will discuss the “Mask” in column three shortly, but basically it means that a Class A network may assign many more hosts/IPs on a network than a Class B or Class C network.

Column four shows the possible number of hosts for each class of IP address. Therefore, in a Class C network, only the last octet can be used for the host address.

Class	IP Range	Mask	Addresses in Each Network
A	1–127	N.H.H.H	16,777,216
B	128–191	N.N.H.H	65,536
C	192–223	N.N.N.H	256
D	224–239	Multicasting
E	240–255	Experimental
N = Network, H = Host

Given that IANA has run out of IP addresses to assign, it is important to use a system called NAT. Network Address Translation (NAT) allows multiple network devices on a network to share a single IP address (see RFC 1631). Thus, a device, like a router, can use that one IP address, which may represent a plethora of network devices. A computer that is on an internal network can use private IP addresses in the range of 10.0.0.0–10.255.255.255 and some other ranges. Using the NAT process, the router will change the private IP address to a public IP address. The router also generates a source port number. NAT is used to overcome the shortage of IP addresses associated with IPv4. A NAT operates in a similar fashion as someone calling the main telephone number of a business, asking for a specific employee, and then being transferred to that employee.

Originally, IP addresses were allocated disproportionately because some companies were assigned Class A and Class B network IP addresses, which are not being utilized to their full potential. Class A network IP addresses were assigned in the 1990s to organizations that include General Electric (GE), IBM, Apple, Ford Motor Company, and the Department of Defense (DoD). Thus, does Ford really need more than 16 million unique addresses for their network? Probably not.

Reserved IP Addresses

There are some IP addresses that cannot be used to identify computers on a network, e.g., 127.x.x.x, e.g., 127.0.0.1 = localhost. Also, any IP address where the host portion is all 1s in binary, e.g. 255.255.255.255 (broadcast addresses). Similarly, any IP address when the network part is all 0s in binary cannot be used, e.g., 0.0.0.0.

There are also some private IP addresses that cannot be used on the Internet and these ranges are as follows:

• 10.0.0.0–10.255.255.255

• 172.16.0.0–172.31.255.255

• 192.168.0.0–192.168.255.255

• 169.254.0.0–169.254.255.255

These IP addresses are not routable but can be used on an internal network. The third category of IP addresses is used by business and home networks and can be used when a DHCP server is unavailable. The fourth category is used by different companies, including Microsoft, Apple, and Linux, who all have their own different schemes for using the IP addresses. APIPA (Automatic Private IP Addressing) is the scheme used by Microsoft Windows and allows DHCP to self-configure to an IP address and subnet mask when a DHCP server is unavailable.

Calculate an IP Subnet Mask

Let us take some time to determine the class of network for an IPv4 address.

1. Determine the network class (A, B or C)

   1. Class A: IP Address begins with 1-126

      1.0.0.0 - 127.255.255.255

   2. Class B: IP Address begins with 128-191

      128.0.0.0 - 191.255.255.255

   3. Class C: IP Address begins with 192-223

      192.0.0.0 - 223.255.255.255

2. Let’s use Ireland.com as an example. Using mxtoolbox.com we can determine that the IP address is 193.120.44.197. We can tell that it is a Class C IP Address (begins with “193”).

3. The subnet mask in a binary format is as follows:

   11111111111111111111111100000000

4. To make it more readable we separate the binary string into groups of 8 bits:

   11111111.11111111.11111111.00000000

5. The binary number 11111111 = 255

6. The binary number 00000000 = 0

   Thus 11111111.11111111.11111111.00000000 can be represented as:

   255.255.255.0

7. For a Class C IP address, the standard subnet mask will be 255.255.255.0 (see above).

How to Find the Subnet Mask on a Windows Computer

1. Go to the Run box (Windows Key + R).

2. Type cmd to open the Command Prompt.

3. Type the command ipconfig /all and press the Enter key.

MAC (Media Access Control) Addresses

A MAC address is a unique identifier (48-bit (6 byte) number) for network-enabled devices. These devices operate at the Data Link Layer (Layer 2). These network hardware devices can include the following:

• Router

• PC

• Smartphone

• Printer

How do I find the MAC address for a device?

Usually it is printed on the back or bottom of the device.

What does a MAC address look like?

BC:9E:EF:88:6E:0F

How do I find the MAC address on a PC?

For Windows 10:

1. Click the Start button.

2. In the taskbar Search box, type cmd and select the Command Prompt App. This will open the command window.

3. At the command prompt, type ipconfig/all.

4. Copy down the “physical address” (aka the MAC address) from the “Wireless LAN Adapter Local Area Connection” section (see Figure 8.5).

5. Close the Command Prompt window.

How do I find the MAC address on an Apple Macintosh?

1. From the Apple menu, select System Preferences.

2. In System Preferences, from the View menu, select Network.

3. In the left of the “Network” window that opens, click the name of your connection (e.g. Wi-Fi, AirPort, Ethernet, Built-in Ethernet).

4. Click Advanced, and in the sheet that appears, click the Hardware, Ethernet, or AirPort tab.

The address is the string of letters and numbers next to “MAC Address:”, “Ethernet ID:”, or “AirPort ID:”

How do I find the MAC address on an iPhone?

1. Click Settings.

2. Click General.

3. Click About.

4. View the “Wi-Fi Address”, i.e. the MAC address.

Notice that the Bluetooth address is only one letter off the Wi-Fi MAC address. Thus, if you have one, you can determine the other.

IDS

An intrusion detection system (IDS) is hardware or software used to monitor network traffic for malicious activity. An IDS can provide alerts when suspicious activity occurs and provide detailed logging information with professional reporting capabilities. An IDS is generally a sophisticated system, in that these systems can alert the network administrator to anomalies on the network relative to normal activity instead of simply being preprogrammed. An IDS can work either heuristically or with predetermined signatures. This is important because anomalies differ from network to network. For example, data being transmitted from a government facility in the United States to China may trigger an alert, whereas Internet traffic between a U.S. university and Beijing may be an everyday occurrence. The IDS monitors both inbound and outbound network traffic.

Naturally, the IDS, with its logs and reports, is one of the first items a network forensics examiner analyzes. The efficacy of an IDS or an intrusion prevention system (IPS) is diminished by encryption because of the system’s inability to inspect these packets. In these cases, logs from network monitoring tools can be invaluable. FireEye provides one of these tools that checks for malware. Unfortunately, in the case of Target Stores, alerts from FireEye were largely ignored, and the data theft of millions of customers continued after the company was notified.

Many different types of IDS exist, and they all work in very different ways:

• Network intrusion detection system (NIDS)

• Network node intrusion system (NNIDS)

• Host-based intrusion detection system (HIDS)

• Intrusion prevention system (IPS)

Firewalls

A firewall is a software or hardware mechanism used to inspect data packets on a network and determine, based on its set of rules, whether each packet should be allowed through. The network administrator can set these rules. For example, an administrator might prohibit inbound/outbound traffic from IP addresses from China. Chinese hackers have been known to get around this by using Google Groups and other U.S. IP addresses for command and control so that they can access a network without being flagged by the firewall. The network administrator should add known malware sites to the firewall as blocked websites. These malware sites are published on websites, like www.malwaredomainlist.com, and are also available from federal law enforcement.

A firewall can perform detailed inspection at Layer 4 (TCP and ICMP), while other firewalls can inspect Layer 7 data, including FTP and DNS requests. A firewall is sometimes used to implement a Virtual Private Network (VPN).

One of the first things that a hacker may try to do is to change the firewall settings so that they can send and receive data without interruption. A network forensics examiner will check to see if the firewall rules have been changed. A firewall can be built into an operating system or could be a part of a network router.

There are different types of firewalls:

• Proxy firewalls

• Stateful inspection firewalls

• Unified threat management (UTM)

• Next-generation firewalls (NGFW)

A proxy firewall is a server and acts as an intermediary between a user and an Internet connection. Stateless firewalls monitor traffic and unblock packets based on the source and destination addresses or other predetermined values. A stateless firewall filter is often referred to as an access control list. A stateful firewall monitors traffic streams in an end-to-end fashion. These firewalls can support IP security or IPsec functions, which includes encryption and tunnels. Stateful firewalls are generally better at flagging unauthorized communications. Unified threat management (UTM) provides multiple layers of security, and its functionality includes content filtering, Web filtering, and antivirus. UTM devices are marketed as network security appliances, which can be a network hardware appliance, virtual appliance, or cloud service. Unified threat management can include intrusion detection and intrusion prevention technologies. For example, they may detect an attack, based on malware signatures or other anomalies. UTM also supports virtual private network (VPN) functionality. In terms of Web filtering for content, some UTMs can scan websites for security vulnerabilities that may be harmful to the requesting computer. Next-generation firewalls (NGFW) are third generation firewalls, which are a mix of a traditional firewall, while incorporating other security applications. This includes deep packet inspection, which is an intrusion prevention system (IPS). An NGFW goes beyond the capabilities of a stateful firewall. A next generation firewall has the ability to block high-risk applications. Thus, an NGFW may detect and block network attacks, based on protocol, port, and application levels. An NGFW can perform full packet inspection by checking both the signatures and payload of packets to detect anomalies or even malware.

Ports

A port is a communication channel that is specific to a running process or application on a computer. Ports are extremely important for network forensics investigators because ports that are typically not used by a system but have been active can indicate a compromise. The number of the port in system logs also indicates the type of application that was running on a computer. A total of 65,535 ports exist. The following is a list of commonly used ports:

• 20 and 21: File Transfer Protocol (FTP)

• 22: Secure Shell (SSH)

• 23: Telnet remote login service

• 25: Simple Mail Transfer Protocol (SMTP)

• 53: Domain Name System (DNS) service

• 80: Hypertext Transfer Protocol (HTTP), used on the World Wide Web

• 110: Post Office Protocol (POP3)

• 143: Internet Message Access Protocol (IMAP)

• 443: HTTP Secure (HTTPS)

Port 80 is often used the most by clients because it is associated with a user’s Internet activity. Most webmail today uses SSL and Port 443.

The Physical Layer

The Physical Layer (Layer 1) defines the hardware or medium through which data is transmitted and the power required for transmission. That power often is in the form of electrical impulses defined by 0s and 1s (binary). Physical hardware can include the following:

• Coaxial cable

• Fiber optic

• Ethernet cable

• Network Interface Card (NIC)

The Data Link Layer

Address Resolution Protocol (ARP) is a method by which the Network Layer (Layer 3) of the OSI is linked to the Data Link Layer (Layer 2). In other words, when you are using the Internet on your home network, the request is sent with an IP address for your home network. When the web server responds and sends a message back to that IP address, the router needs to route that message to the appropriate device on that network using ARP (that is, routing the message to the appropriate MAC address for the specific device that requested the information).

Two addresses are used on a LAN, a MAC address and an IP address. At the Data Link Layer, MAC addresses are used to find a destination computer listed in a table called the ARP cache. A MAC address is stored in the network card. Applications use an IP address to find a destination computer.

A router maintains an ARP table, which is based on ARP requests and responses. When a packet is sent across the Internet, it is sent to the MAC address of the router interface that is the default gateway. ARP binds a static IP to a MAC address in a device’s ARP table. DHCP on the other hand always assigns the same IP address to a device. ARP is used to get the MAC address from an IP address and is primarily used on a LAN (local area network).

The routing table contains the following:

• Destination network IP addresses;

• Destination gateway IP address; and

• Corresponding interface.

When the router receives a packet, it will check for the destination network IP address in the routing table. If the packet is destined for a network that is directly connected to the router, then the destination MAC address will be obtained from the ARP table. MAC addresses from Layer 2 are mapped to Layer 3 IP addresses using ARP. ARP responses are cached on hosts that make up the LAN. The ARP cache can be queried on a Windows system, to identify MAC to IP address mappings using the arp –a command.

The Network Layer

The Network Layer defines communications between networks or operation of the subnet and makes decisions about the physical path through which transmission should occur. At the Network Layer, logical addresses are translated to physical addresses. At this layer, routing frames between networks and frame fragmentation decisions are made.

Routers operate at this layer. A router is a hardware device with a motherboard, a central processing unit (CPU), and input/output ports. Routers also have memory, which contains startup configurations, operating system, and routing tables. A routing table contains information about the network and provides the most effective method of directing packets across that network.

The Transport Layer

Transmission Control Protocol (TCP) is a communication standard that is used in conjunction with the Internet. It is found in the Transport Layer (Layer 4) and is used for the reliable delivery of data over a network connection. Services like the World Wide Web (WWW), email, and FTP use this communication protocol. Applications that require faster communication, and can compromise on error checking, use User Datagram Protocol (UDP). VoIP and video often use UDP because of its speed and because it is no big deal if a data packet is sent out of order or is dropped. TCP, on the other hand, is more orderly and provides error checking to ensure that all data packets are sent in the correct sequence.

The Session Layer

As its name suggests, the Session Layer (Layer 5) is responsible for initiating, maintaining, and terminating processes on different systems.

The Presentation Layer

The Presentation Layer (Layer 6) prepares data for the Application Layer and is responsible for data conversion, compression, and encryption.

The Application Layer

The Application Layer (Layer 7) can be viewed as the closest to the end user and interacts with applications. Functionality at this layer includes email (SMTP), remote file access, remote printer access, File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP), and network management.

Tools are available to help an investigator understand more about wireless access points in an area. For example, Net Analyzer, which is available for the iPhone, can identify the closest access points, and the investigator can quickly determine how many devices are connected to that access point. Net Analyzer provides not only the MAC address of the device but will also provide the name assigned to that device and the manufacturer. In this case, the device may be a laptop, a Samsung Galaxy S20, an Xbox One, a Roku, or an IP camera—basically, any Wi-Fi-enabled device. This type of Wi-Fi analysis should be performed before executing a warrant, which did not happen in the case study just detailed.

If an open wireless signal is found, the investigators must account for it. Even if a wireless network is open, there is still probable cause to believe that evidence of the crime is located within the network equipment at the location. Some criminals even leave their wireless networks open intentionally to maintain some plausible deniability. The bottom line is that just because an IP address is traced back to a location, that is not sole proof that a person at the location is responsible for the incident.

Voice over Internet Protocol (VoIP)

Voice over Internet Protocol (VoIP) is a protocol that takes analog audio signals, e.g. voice, and converts those signals to digital data that can be transmitted across the Internet. A traditional landline telephone uses an analog signal. VoIP, however, allows a user with broadband Internet access to use VoIP. VoIP calls are facilitated via a VoIP-enabled telephone or via a computer (desktop/laptop/smartphone). If your call ends up on a traditional telephone, then the signal will be converted back to an analog signal.

VoIP is an alternative to the traditional PSTN (Public Switched Telephone Network). VoIP includes open standards, like SIP, but also includes proprietary applications, like Skype and Google Talk.

Disadvantages of VoIP

Not all VoIP services connect directly with emergency services and locating the caller can be a challenge. VoIP will not work during a power outage unless you have a battery backup. Caller ID can be easily spoofed with VoIP, and the protocol has enabled the emergence of “robocalls”. The Federal Trade Commission (FTC) in the United States has initiated more than 100 lawsuits against more than 600 companies that have been responsible for billions of robocalls. The FTC has also conducted many competitions to detect and block robocalls.

PBX (Private Branch Exchange)

A PBX (Private Branch Exchange) is the telephone system within an organization that switches calls between users in that organization on local telephone lines, while enabling users to share a limited number of external telephone lines. The primary reason for using a PBX is the cost savings associated with sharing telephone lines, rather than paying for one telephone line for each employee. The PBX is owned and managed by the enterprise.

There are different types of PBX. For example, there is a traditional PBX with copper cables for telephone landlines attached to it. This type of PBX will accommodate a mixture of analog and digital signal transmissions. There is also a cloud-based PBX system that can be used by the enterprise.

An IP-PBX is an Internet Protocol PBX that uses digital telephone signals, rather than analog landlines, to facilitate calls. Ethernet cables connect telephones rather than traditional phone lines.

Session Initiation Protocol (SIP)

Session Initiation Protocol (SIP) is a peer-to-peer, multimedia signaling protocol developed by the Internet Engineering Task Force (IETF). The IETF develops and promotes voluntary Internet standards. SIP uses existing IP protocols, like DNS, and SDP (Static Dial Plan), and operates at the application layer control protocol. SIP is used to establish, modify and terminate multimedia sessions, i.e., voice, video, instant messaging over the Internet. SIP generally utilizes UDP or TCP.

STUN (Simple Traversal of UDP Through NATs (Network Address Translation))

STUN allows devices behind a NAT firewall or router to make telephone calls to VoIP provider hosts outside of their local network.

APT10

As previously mentioned, APT10 was a cyber espionage attack, perpetrated by hackers in China, on managed service providers (MSPs). It is understandable why MSPs would be the target of an attack, given the vast amounts of intellectual property managed by cloud service providers. According to a report by PwC UK, in collaboration with BAE Systems, APT10 attacks began as early as 2014 and continued for a number of years. During those years, APT10 used a series of malware types, from Poison Ivy to PlugX to RedLeaves to QuasarRAT. APT10 used hundreds of domains for command and control of their compromised network hosts, thereby making it difficult to blacklist certain IP addresses from communicating with a network.

As with all APT attacks, it is difficult to identify when the network was initially compromised. Moreover, it is a challenge to contain the infection of the malware since these attackers move laterally throughout the network, and it becomes even more problematic if a large number of credentials have been compromised since successful logins do not raise flags like unsuccessful logins do. Finally, it is problematic to determine what data has been compromised since the attacker may encrypt the data that is being exfiltrated from the network and will use techniques, like timestomping, to thwart the work of forensics investigators. Timestomping is an anti-forensics technique used to manipulate the timestamps of a file.

Cyber Kill Chain

The whitepaper “Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains” details the six stages in an advanced attack on a computer network. This Intrusion Kill Chain explains what happens during a sophisticated attack on a network, usually an attack so advanced that it is government sponsored. Figure 8.7 shows how this chain of events occurs and then gives a detailed description of each phase.

YARA

YARA is an open source tool that is used to classify and identify malware variants. An examiner can also copy the MD5 hash for a file and search on VirusTotal to see whether the file has been previously identified as malware (see Figure 8.8).

Indicators of Compromise (IOC)

The problem with APTs is that they are so advanced that many traditional security mechanisms, like firewalls, IDS, antivirus, etc., are ineffective. However, certain hallmarks of an APT attack, or indicators of compromise (IOCs), are known and can include the following:

• Registry keys: Windows configuration files.

• DLL files: Dynamic Link Library (DLL) files are Windows system files that contain procedures and drivers that are executed by a program. Multiple programs can access these shared system files. Changes might have occurred. If so, they can be identified by matching version numbers of the DLL files with the version of Windows.

• ServiceDLL: If the service.dll file is found on a personal computer, the machine could be infected with the Trojan infostealer.msnbancos.

• svchost.eve: This is a system process that hosts multiple Windows services. If the file svchost.exe is located outside the System32 directory, there has been a compromise.

• Email: The email SMTP IP address does not match the domain name.

• Ports: Regularly unused computer ports that are now used. Internet Relay Chat (IRC) is an Internet protocol for live chat. It utilizes port 6667. IRC is also used for command and control of compromised computers that are controlled by hackers.

• $USN_Journal: This is the Update Sequence Number Journal, which is a feature of NTFS, and keeps track of changes on a volume. This is also referred to as the Change Journal. This file should be examined by an incident responder.

• Prefetch files: New prefetch files might refer to new drivers or new downloaded files. Prefetch is a folder in the Windows system folder that contains files used in the boot process and regularly opened by other programs. The purpose of prefetch is to boot up a machine or start a program faster by keeping track of commonly used files.

• System32: Contains Windows system files and other program files, which are critical to the Windows operating system. The directory can be found in C:WindowsSystem32 or C:Winntsystem32. The System32 folder may also contain malicious files installed by a hacker and be an indicator of compromise. DNS and DHCP logs can also be found in the System32 directory.

• Master File Table (MFT): Contains an entry for every file that is stored on an NTFS volume and includes metadata about the file, including the size, date created, date modified, last accessed date and permissions. The MFT is a critical resource for incident responders as well as for traditional forensic examiners. This is because if anti-forensics techniques were attempted with a system, such as timestomping, or an attempt was made to delete files, then the MFT can be used to identify whether a hacker or a suspect did manipulate files. Most dates can be manipulated by an attacker except for the “FN Info Creation Date”.

  The MFT can be parsed with most licensed forensics tools and there are free tools, such as Eric Zimmerman’s MFTECmd parser tool. The MFT is located here in Windows: %systemroot%$MFT.

  The investigator should be very specific with search dates with an MFT parsing tool because the MFT contains a huge amount of entries. Figure 8.9 shows some sample MFT data.

• Event Logs: were introduced in Chapter 2 as an important source of evidence for investigators. They are also important for IR. One example in incident response (IR) are Event IDs related to successful login attempts. Event ID 4624 indicates that a successful login occurred. However, this Event ID also provides a Logon Type. If the Event ID 4624 Logon Type is 2 (Interactive: logon at keyboard and screen of system), then we might not be concerned. However, a Logon Type of 10 (Terminal Services, Remote Desktop or Remote Assistance) could be an indicator of compromise, as sophisticated hackers will often use Remote Desktop to remotely connect to other hosts on a network, as they move laterally. This particular Event ID (4624) will also provide information about the host that successfully remotely logged onto another host. Important Event IDs, associated with Remote Desktop (RDP), are Event ID 21/22 (RDP/Citrix authentications), Event ID 23/24 (RDP/Citrix logoffs), Event ID 1158 (RDP from an IP address), and Event ID 1149 (successful RDP authentication). Other important Event IDs are 7045, 7036 and 4697 to identify installed services on an infected host machine.

• At the time of writing, the website ultimatewindowssecurity.com provides a comprehensive list of Event IDs. Figure 8.10 shows a tremendous resource for searching for Event IDs of interest.

• MRU (most recently used) lists: are also a potential artifact of interest for an incident responder. These are a listing of applications and files recently used by a user. This file can be found in Windows Registry here: HKCUSoftwareMicrosoftWindows CurrentVersion ExplorerRunMRU.

• PsExec: is a Windows command-line tool that allows a user to remotely execute processes on a computer without having to install client software. As you can imagine, it could be a tool of choice for an attacker. Ironically, PsExec is also used by Windows administrators and incident responders. Event ID 540 will show a PsExec login.

• UserAssist: contains a list of programs that have been executed on a Windows computer, including the run count and last execution date and time. Didier Stevens has produced a tool to parse these entries. The file containing these entries is located here: HCUSoftwareMicrosoftWindowsCurrentVersion ExplorerUserAssist

• An IR team will typically circulate a list of IOCs for team members to search for—some of which are out highlighted above. IOCs on that list may also include IP address(es) of interest, malware name(s) and MD5 hash(es) of known malware, and a list of keywords that can be used to search through an imaged drive. A keyword list may include names of malware, IP addresses, and other search terms of interest.

Random Access Memory (RAM)

An important indicator of compromise (IOC) is RAM. Of course, a forensic analysis of RAM requires a system to be powered on and requires special RAM live forensics tools.

AmCache

As discussed in Chapter 2, an analysis of the AmCache.hve, introduced with Windows 8, can be used to determine what applications were run by a malicious actor. Eric Zimmerman’s AmcacheParser, which is a free open source tool, will parse out the contents of the AmCache.hve, which includes installation date and time, execution date and time, the Program ID (application), and the path from which the application was run. Figure 8.11 shows output from an Amcache.hve file.

ShimCache

In Chapter 2, we spoke in depth about the importance of ShimCache in investigations. As previously noted, ShimCache can potentially provide information about applications that were executed by a hacker on a system. ShimCache Parser is one of a number of tools that can be used to parse Shim-Cache. AppCompatCacheParser is another tool that can be downloaded for free to analyze ShimCache.

ShellBags

As previously noted in Chapter 2, ShellBags are valuable in identifying folders that were accessed by hackers or other users. ShellBags are located in several locations, including the following:

Click here to view code image

HKEY_USERS<USERID>SoftwareMicrosoftWindowsShell
HKEY_USERS<USERID>SoftwareMicrosoftWindowsShellNoRoam

Volume Shadow Copy

Volume Shadow Copy (VSC) Service was introduced in Chapter 2 and we discussed how a comparison of copies, between different dates, can provide investigators with an idea of what changed in the system. With an APT, the attacker may have replaced Windows DLL (service files) with malicious files, for example, and an examination of VSCs may provide some insight into small changes made by a sophisticated attacker to a system. Many tools, like BlackLight, natively support of comparison of VSCs. There are also some free, open source tools, like libvshadow 4; libvshadow was created by Joachim Metz and can perform VSC comparisons.

Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) is a tool for monitoring threats on network hosts and then automatically responding to certain types of attacks. The power of EDR lies in its tremendous logging capabilities, which certainly make the life of an incident responder much easier. Carbon Black is one of the most well-known EDR tools, with comprehensive logging capabilities. However, the cost of EDR can be prohibitively expensive for most companies.

Kibana

Kibana is a free, open source, data visualization tool, which can be used for log analysis and application monitoring. The tool integrates with Elasticsearch, which is a powerful analytical search engine. Kibana uses a variety of histograms, heat maps, line graphs, and other data visualization tools, to visually identify what occurred during a specific timeframe. This is easier than scanning through thousands of logs. When using Kibana, we can identify if there was a lot of activity during a time when an employee would not normally be at work. This could indicate that a hacker in Asia has been remotely active on a host computer at 2:00 am, local time, in New York, which is during daytime hours in Asia. Kibana can also display unusual connections to IP addresses in other countries that would not be expected. It should however be noted that with APT attacks, the hackers have used proxy computers in other countries to obfuscate their identities, i.e. their true Domain Name Server and IP address. An incident responder would also search for large amounts of data being transferred out of the targeted company – an indication of data exfiltration. Kibana also has the ability to quickly search for specific Event IDs for specific hosts on a network. For example, Event ID 4624 with a logon type of 10 would be of particular interest.

Log2Timeline/Plaso

Log2Timeline is an important tool for incident responders as it takes log files and parses different types of logs, from a variety of Registry files, and creates a timeline of system logs. The tool is typically used on an infected computer once the security team has narrowed down some potential dates of compromise for a host on a network. Given the thousands of system logs that can be generated by a host each day, it is important to narrow the scope of time when an attack occurred as quickly as possible. You may want to consider adding the following files to Log2Timeline for further analysis:

• WindowsAppCompatProgramsAmcache.hve

• Windowssystem32configSAM

• Windowssystem32configSECURITY

• Windowssystem32configSOFTWARE

• Windowssystem32configwinevt

SANS SIFT Workstation

The SIFT is a free suite of forensics tools, which are available from SANS Institute (www.sans.org). The tool integrates with VMWare Player, which is also a free download. The SIFT can be used to mount images and then perform different types of analysis, using the many tools included, in a virtual box, i.e., each session of the SIFT will have no impact on your personal computer. Figure 8.12 shows the SANS SIFT user interface. Learning to use virtual machines is an important skill to obtain in digital forensics and cybersecurity positions, especially when working with a system potentially infected with malware.

The SIFT supports the following file systems:

• NTFS (NTFS)

• iso9660 (ISO9660 CD)

• hfs (HFS+)

• raw (raw data)

• swap (swap space)

• memory (RAM data)

• fat12 (FAT12)

• fat16 (FAT16)

• fat32 (FAT32)

• ext2 (EXT2)

• ext3 (EXT3)

• ext4 (EXT4)

• ufs1 (UFS1)

• ufs2 (UFS2)

• vmdk

The SIFT Workstation includes the following open source tools:

• Log2timeline (Timeline Generation Tool)

• Rekall Framework (Memory Analysis)

• Volatility Framework (Memory Analysis)

• autopsy

• dc3dd

• libevt

• libevtx

• libvshadow

• lightgrep

• log2timeline

• RegRipper and plug-ins

• Sleuth Kit

A basic knowledge of Linux is required since the Workstation does use a line command interface.

Windows Registry

In Chapter 2, we introduced Windows Registry and learned that the registries contain changes to a computer’s configuration. Generally, all 32-bit and 64-bit Windows programs store configuration and preference data in the Registry. As discussed earlier, the Registry also stores information about Plug and Play hardware configuration. For example, information about USB devices that were connected to a system are stored in HKLMSYSTEMControlSet00xEnumUSBSTOR

The Registry can also provide us with detailed information about what a hacker was doing. This is different from other investigations where the user-created files, like photos or Office documents, are of importance. A sophisticated attacker may access a host on your network, copy data and then use anti-forensics techniques. Anti-forensics is a concerted effort to manipulate files on a system to cover up a hacker’s activity. For example, a hacker may try to change the system clock on a host or change a file extension or mimic the activity of a regular user. However, a seasoned network examiner can use Windows Registry and Windows Event Viewer to identify when an intrusion occurred and gain some insight into what the hacker sought to do. We could write an entire book on the registries but in this section, we will focus on some of the most important hives and files related to incident response. Figure 8.13 shows the Registry hives.

RegRipper is a free, open source tool that can be used to parse different registry files for a personal computer. After the investigator/responder forensically images a computer, e.g. with FTK Imager, the SYSTEM, SOFTWARE, SAM and SECURITY hives (Registry) can be copied from the image copy, copied and pasted into the folder, where you installed RegRipper and then parsed out by the tool. RegRipper is a Windows, command-line tool. Knowledge of some basic Linux commands is required to process the Registry files. We shall now discuss some important hives in more detail.

HKEY_LOCAL_MACHINESOFTWAREMicrosoftActiveSetupInstalledComponents

Classroom Discussions

1. How is the job of a network forensics examiner different from that of a traditional computer forensics examiner?

2. What difficulties are associated with investigating APTs?

3. Discuss indicators of compromise (IOCs) that an investor should look for in a network intrusion investigation.

Multiple-Choice Questions

1. Which of the following best describes malware that is disguised as a legitimate application or program?

1. Worm

2. Virus

3. Trojan

4. Logic bomb

2. Which of the following has a primary function of serving up HTML documents?

1. Web server

2. Proxy server

3. SMTP server

4. Virtual server

3. What is the name of the folder in the Windows system folder that contains files used in the boot process and regularly opened by other programs?

1. User

2. Journal

3. svchost

4. Prefetch

4. Which layer of the OSI Model can be viewed as closest to the user view?

1. Session Layer

2. Application Layer

3. Presentation Layer

4. Transport Layer

5. Which layer of the OSI Model defines the wires that electrical impulses flow through that are involved in Internet communication?

1. Transport Layer

2. Session Layer

3. Data Link Layer

4. Physical Layer

6. Which of the following is a protocol for connectionless data transmission on packet-switched internetworks? Its header has 14 fields. This protocol uses 32-bit addresses, which are usually represented in four octets of dotted decimal notation.

1. IPv2

2. IPv4

3. IPv6

4. IPv8

7. Which of the following enables a NIC to listen to communications broadcast on a network, regardless of the intended recipient?

1. Proprietary mode

2. Passive mode

3. Promiscuous mode

4. Active mode

8. Which of the following defines the standard format for electronic mail?

1. IRC

2. ICMP

3. SMTP

4. HTTP

9. Within the OSI Model, this layer is responsible for initiating, maintaining, and terminating processes on different systems.

1. Transport Layer

2. Session Layer

3. Data Link Layer

4. Physical Layer

10. Which of the following organizations is responsible for the allocation of IP addresses globally?

1. ISO

2. IEEE

3. IANA

4. NIST

Fill in the Blanks

1. A(n) __________ is a block of data used in communications across the Internet.

2. Transmission __________ Protocol is a communication standard that is used in conjunction with the Internet.

3. A(n) __________ detection system is hardware or software used to monitor network traffic for malicious activity.

4. User __________ Protocol is a connectionless communication protocol that has limited packet recovery functionality and operates at the Transport Layer.

5. Address __________ Protocol is a method by which the Network Layer (Layer 3) of the OSI Model is linked to the Data Link Layer (Layer 2).

6. A(n) __________ Help Object is used to add functionality to a web browser. The object starts every time the user opens the browser.

7. Dynamic __________ Library files are Windows system files that contain procedures and drivers that are executed by a program.

8. An advanced __________ threat is a sophisticated, relentless, coordinated attack on a computer network, with the goal of stealing intellectual property.

9. Packet __________ are used to capture data packets on a wireless or wired network.

10. HyperText __________ Protocol is a standard for requests and responses between a client and a server.

Projects