Instant Messaging configuration

Instant Messaging is generally configured in a peer-to-network configuration (this is also called client/server model). Peer-to-network configurations require a central server. This central server acts as the connector between users. When a user adds a connection, the central server alerts the user when that connection comes onto the network. This allows the two users to make a connection. The connection is through the central server which forwards the communications between the users. Examples include: AOL Instant Messenger, Yahoo!, ICQ, and Skype.

Instant Messaging can allow for P2P connections but only when transferring files. The P2P connections made through Instant Messaging allow users to connect directly to one another user without relying on a central server. These connections could expose each user’s Internet Protocol (IP) address of the users. Each of the Instant Messaging services have developed their protocols independently. This causes an inability of the messaging services to interoperate. Open-source protocols were eventually developed under the Extensible Messaging and Presence Protocol (XMPP). There are several software programs, such as Pidgin or Trillian, that have brought several of the Instant Messaging protocols together in one application that allow the users to communicate between services.

Instant Messaging works by the user logging into the messaging server, i.e., Yahoo, AOL, or through the user’s software on the local machine. The messaging server acknowledges the user's buddy list and advises which of the contacts are currently logged into the server. The user selects an online contact to chat with and tells the system to connect to the contact. The users then chat with each other by typing their communications back and forth between themselves (Figure 15.2).

Instant messages historically have been sent in plain text with no inherent encryption unless enabled by the user. This can make sessions vulnerable to packet sniffing, especially if the connection is not encrypted. Instant Messaging allows the transfers of files between users. This file transfer method, however, does not allow files to be scanned by antivirus programs as they arrive which creates a real risk for an attack. Instant Messaging differs from IRC as the latter is communication on a one-to-one basis where IRC is one-to-many communication. There are many popular Instant Messaging software applications that have little to no interoperability. Examples: of this include, AOL Instant Messenger, Yahoo! Messenger, ICQ, and Skype.

There are other protocol independent instant messenger programs that allow communication between multiple Instant Messaging services. These can be useful to the investigator that is tracking targets and communicating with persons across multiple Instant Messaging platforms. Several of these cross platform tools are:

Web-based chat

Web-based chat program allows access to IM protocols through a web interface. Social media sites have integrated chat into their services and so have web-based email programs like Gmail. There are several web-based services the investigator can use to further their investigations. These make using Instant Messaging possible without having to install an application. They include:

Connecting to an IRC

The IRC network is a collection of servers linked together using the IRC protocol. Connecting to IRC requires using an IRC application. Users are then connected to an IRC server. The connecting IRC server is determined by the IRC network the user selects. The server knows who is on the network and what channel (room) users are in as they chat. The IRC server feeds the channels and the chatted text to the users connected to the server. The servers pass the user’s chat in the various channels between the servers connected throughout IRC. User's can then chat with anyone in a channel anywhere in the IRC network. Internet latency and speed when using IRC depends on the location of the server in conjunction with the user. It is best to connect to a server geographically close to the user for a faster response. Some channels are open to anyone to access and chat with other channel members. Others are private and only accessible by invitation of the channel owner. Channels have topics set which are generally descriptive by the channel name. Investigators looking for a particular type of room can usually find them by a particular channel title.

Chat language

IRC early on in its existence began to build its own language. To make conversations faster users shortened up the words used by making acronyms out of terms and short sentences. “brb” or Be Right Back is an example of the shortening of the language used in the chatrooms. Over time a significant number of acronyms came into use and lists of the acronyms used were needed to identify what was being said. Table 15.1 contains a few of the more common acronyms developed to facilitate communicating over IRC. You’ll recognize that many of them have come into mainstream use, especially in texting on cell phones.

Logging onto an IRC server

Fully accessing the IRC requires the investigator use a software application referred to as a client. IRC clients depend on the operating systems used. There are many applications to gain access to IRC. Both Windows and Apple Macintosh systems have software available for accessing IRC. Common on Windows systems is mIRC (http://www.mirc.com/) and on Macintosh is Ircle (http://www.ircle.com/). Both applications give the investigator access to the many features of the IRC protocol and the various servers containing the channels that might be of investigative interest. Two popular IRC server networks are DALnet (www.dal.net) and Undernet (www.undernet.org). The location the investigator actually goes to will ultimately depend on the facts of the case and the channel in use related to the investigation. mIRC has a logging feature that allows the investigator to select automatic logging of the channels and the chat.

Joining a channel (chatroom)

Effective access to IRC requires a desktop application. One of the most popular as mentioned is mIRC. This application allows access to all of the IRC servers. mIRC allows easy access to the IRC system through its user panel.

Channel operators, referred to as the “Bosses” or “ops,” maintain absolute control of the channel. The “Ops” decide who gets to enter the channel, who gets kicked out, and who may talk. The Channel operators will have the “@” in front of their nickname. There are two ways to become a channel operator: (1) create a channel and (2) be made an operator by an existing channel operator. Users in the channel are designated by the “#” sign preceding their channel names. Channel names are not case sensitive.

Hiding in IRC

IRC can be accessed using a proxy server or through the Tor network. Using a proxy allows users to connect to chat servers sending the traffic through the proxy server. The proxy server forwards the chat messages from the user through the proxy server to the IRC server and channel. What is exposed is the IP address of the proxy server on the IRC server. This helps to hide the investigator’s real IP address from others on the IRC channels investigated. Obviously the reverse is possible and the investigator should be aware that IP addresses found on IRC should not be immediately thought of as the target’s actual IP address without significant investigation to determine that the IP is the target’s actual IP address. You can find an updated list of proxy servers intended just for IRC at http://irc-proxies.blogspot.com/. The investigator can also use the list to determine if an IP address identified on IRC is potentially a proxy. You can connect to IRC through a proxy while using mIRC. You can set up a proxy in mIRC’s Proxy settings section of the options dialog box (ALT+O>Connect>Proxy). The investigator needs to be aware that some IRC servers may ban the use of proxies and Tor if found.

Web browser access to IRC

Access to some IRC servers can be done through web interfaces. There are several websites that provide the investigator with access to some IRC servers. The investigator can use these as a quick means of accessing these IRC servers and channels of interest. Some of these websites include:

Tracking criminals in IRC

IP addresses can be identified for users while in IRC. The investigator can use the whois command to gain information about a possible target. Depending on the IRC server, the IP address can appear in the user’s chat messages after their nickname. However, some IRC networks hide the user’s IP address or hostname automatically on connection. For those that don’t the IP address of users is exposed for everyone on the channel to see or query. This is of course if the user is not attempting to hide his address from others on the IRC channel.

When using mIRC as your IRC investigative tool, you can right click on the username and select “who is” or “info.” This will provide the investigator with the IP address of the user, the server in use and channels where they are channel operators. An investigator who can act as a channel operator can monitor habits and methodologies of users which can be extremely useful in investigations. This of course means that the investigator spends enough time on the channel or channels in questions to become a well-respected member of the channel. The investigator has also to spent the time developing an undercover persona and preplanning the operational aspects of the investigation as we have discussed in previous chapters (Figure 15.4).

IRC resources

The following are some general resources that can assist the investigator understand IRC further:

Identifying targets through communication protocols

Identifying targets on the Internet using the various communication protocols is somewhat of an investigative challenge. The investigator has to have an understanding of the communication protocol used and how the investigator’s local machine communicates through that protocol to the target. However, there are opportunities for identification of a target which are discussed below.

Netstat the easy way

There are other tools available for collecting the TCP/IP connections of a local machine and the connections that it makes. Using these tools can make identifying a local machine’s connections easier for the investigator. They each collect the TCP/IP traffic of the local machine and show connections in real time. Additionally, they identify the programs that made them and the current traffic on the local machine. Finally, they also display the returned data in an easier to view graphical user interface. Several of the available tools for this purpose are:

File Sharing Programs

• Bit Torrent Networks: BitTorrent, Inc., http://www.bittorrent.com/, and FrostWire, http://www.frostwire.com/

• eMule, http://www.emule-project.net/home

• Gnutella P2P Networks: Bearshare, http://www.bearshare.com/ and Limeware variations

• Shareaza, http://shareaza.sourceforge.net/: Supports the following P2P networks, Gnutella, Gnutella2, eDonkey, and BitTorrent).

Peer to Peer

P2P technology is one that uses multiple computers to share the data. Data is transferred between the participating users. Each of the users participates as a sharing partner in the system. The networked system depends on the participation of the user’s computers to process and forwards data among the network. This process is handled by the user’s downloaded application which is installed to gain access to the network. P2P is used by many people on the Internet for legitimate purposes. File transferring is one of the most popular uses on the Internet for P2P technology. P2P technology became famous in 2001 when the then music file sharing company Napster was sued for violating the copyrights of records companies by allowing users to access the copyrighted music from Napster’s servers (A&M Records Inc. v. Napster, Inc., 239F.3d 1004 (9th Cir. 2001)). What this did for the P2P sharing community was to move the use of P2P technology from one that had centralized servers to a network technology that was decentralized. No longer could you stop illegal activity simply by taking out a master server with an index of data and users.

This presents an issue now for the investigator of P2P networks as no one person or server is responsible for the content being shared over the network. The data is spread over the network and not stored in one location. There are different P2P network variations in use today. The most popular is the Gnutella and Ares networks. Other P2P networks have appeared over the last decade and have been investigated, including Limewire, FastTrack, BitTorrent, eDonkey, and GigaTribe. Skype which is probably one of the most popular messaging programs on the Internet also uses P2P techniques for sharing of its user’s communications. This technology changes all the time and applications come and go. Investigating P2P networks has become a mainstay of child pornography investigators. These investigations initially were a very tightly held investigative technique. Law enforcement early on identified that the P2P sharing concept was a protocol that could be successfully investigated. The use of the Peer Spectre software came to public knowledge after Flint Waters, then a Special Agent for the State of Wyoming, testified before Congress in 2007 about law enforcements investigations into the P2P networks. The use of P2P investigative software began in 2005 under the name Operation Fairplay. Waters (2007) stated in his testimony regarding law enforcement investigations into the trading of child pornography that the numbers of identified traders included:

There have been 1,519,791 unique IP addresses identified in the United States. If the breakdown were constant with the results in Wyoming that would indicate 504,947 individuals identified throughout the United States in the last 3 years. This is a rough estimate but again, it only pertains to one of many P2P systems and does not include other methods of trading child sexual abuse material.

• Auction sites

• Newsgroups

• Usenet.

USENET newsgroups or bulletin boards

The traditional bulletin board protocol is USENET, which USENET uses the NNTP as its communication standard. These newsgroups are public discussion groups that generally require a client software to access the newsgroup feeds. There is a variety of newsgroup readers that the investigator can use to access newsgroups. The group discussion is in a hierarchical setup. The user subscribes to a group they are interested in and can then post and retrieve messages and attachments from the discussion board. The boards allow users to post a message and this permits every reader in that specific group to read the message and download any attachments. The topics range from computer certifications, newborn babies to very bazaar sexual related topics. Most ISPs have access to tens of thousands of different newsgroups. Each newsgroup can hold thousands of postings, which can contain just text, images, and other files. Anyone accessing a public newsgroup can view the postings and/or post their own responses. Private newsgroups can be created between users and require an invitation to gain access. These newsgroups can be moderated or unmoderated. Most are unmoderated with no control over what is said or posted.

Understanding USENET as an investigative tool

Prior to going onto newsgroups, investigators should thoroughly research their protocol. Choose a category and then select a topic. Be aware that “ALT,” standing for alternative is where the nonstandard material is, i.e., “bad stuff”, or in the investigator's case the most interesting. Users have no requirement or approval methods for forming a group. You will see variously named groups based on their content. Moderators name the group something attractive to get users into their rooms. This is much like an old-time carnival barker trying to attract patrons to a sideshow. These groups are unorganized, huge, and not suitable for minors (the Wild West of Usenet). For simple research on newsgroups, the investigator can go to Google Groups (http://groups.google.com/) to locate and review basic groups and information. However, Google Groups may not have all of the “Alt” content that may be required in your investigation. A serious investigation would require a USENET client to access all of the available sites possibly having the information the investigator is looking for as evidence. Generally, your ISP will have a news or NNTP server so you can access and investigate newsgroups.

Investigate all newsgroups and chatrooms carefully before subscribing. Are you investigating a particular user or just trolling for crime? There are advantages and disadvantages with the exploring of Usenet. The investigator can quickly connect to a global network of individuals with similar interests. It can be a springboard for ideas and facts. Users can say nearly anything (very little you can’t). Moderated groups could boot a user if the content was not appropriate. The disadvantages are that it is a global group. This can sometimes put the targets well out of the investigator’s jurisdiction. It can also be very difficult to ascertain the quality of the information posted in a site. Anything goes and that includes telling the truth or not. USENET postings and users can easily be abusive in their posts. On unmoderated sites there is little in the way of repercussions for misconduct. The groups are complex and loosely organized. They also have had an ongoing frustration level with bots and spammers filling up groups with nothing.

Newsgroup had a lot to do with the origination of the terms “Netiquette” or “network etiquette.” They are the unofficial rules defining the proper Internet behavior, e.g., sending spam and unwanted emails is bad netiquette. A “Flame” is an insult or derogatory message sent via email, USENET, or mailing lists to a person or group. Emoticons (smileys), “emotion icons,” are used to represent human facial expressions and convey an emotion on the Internet. They are created from typing certain characters on your keyboard, e.g., “:-)” is a smile. Acronyms and abbreviation or Internet slang was first defined on USENET and is now in use as common parlance amongst many in the real world.

With the advent of instant messaging, AOL and Yahoo groups, blogs and other social networking, USENET isn’t used by much of the Internet population. In fact many ISPs don’t support USENET any longer. This is partly due to the fact that there are no controls and denying access USENET gave them a sense of control over the bad content. Accessing newsgroups now is usually done through one of the pay services, which is probably the best option for the investigator. These services provide better access to the newsgroups and most of them have browser interfaces. Below are a few such pay services:

Google Groups

Google Groups might look like it has the USENET all in one place, but it doesn’t. It is a small subset of the data that passes through the USENET each day. It can be useful for some purposes and may contain the investigative data you are looking for but don’t bet on it. Searching Google Groups does not require a login. Making your own group does, however, require the user to login using a Gmail account. Simply go to www.google.com, click on “More” drop down, access the Google products page and select “Groups.” Google Groups have a search function that will provide a list of search term matches similar to their normal search engine (Figure 15.8).

Locating free Usenet servers

Free Usenet/News servers are still available. They are slow and may not be there tomorrow when you go back. Most of these servers are located outside of the United States and accessible from anywhere in the world. The following sites have been around for a significant amount of time and provide the investigator with a resource for finding USENET servers that can be accessed without a fee.

Investigative tools for USENET

Investigative accessing the USENET can be done using any of the freely available tools on the Internet. However, they all have a variety of user interfaces and your personal preference will drive what you use. Forte Agent News Reader (http://www.forteinc.com/) (Figure 15.9), Newsbin Pro (http://www.newsbin.com/), and Thunderbird Mail (http://www.mozilla.org/en-US/thunderbird/) are a few of the available news readers that can be employed by the investigator. USENET is an anonymous service and posts containing information such as the user’s name and email can be false. Users can also access the newsgroup services through anonymization tools and Virtual Private Networks to hide their information and true IP addresses. In the USENET message is a header similar to an email header. The information has the email like received line and a line with the IP address of the poster at “NNTP-Posting Host.” There is the user's email address which is self-reported (Figure 15.10).

• CraigsList Notifier, http://craigslistnotifier.net/

• CraigsList Search, http://www.craigslistsearch.org/

• List-Alert, http://www.list-alert.com/

• TinkOmatic, http://www.tinkomatic.com/.