Threat Intelligence

12/21/2017
01:00 PM
Paul Shomo
Paul Shomo
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Digital Forensics & the Illusion of Privacy

Forensic examiners don't work for bounties. They do what is required to catch criminals, pedophiles, or corporate embezzlers, and now their important security research is finally being acknowledged.

It is difficult, if not impossible, to keep what we do online or on an electronic device private. Every action creates digital forensic artifacts — residual forensic evidence left behind when users or applications interact with an operating system. Nevertheless, the privacy myth lives on: browsers offer "anonymous modes," users can clear their history, or apps provide guarantees of "disappearing" content. Yet forensic experts have a wide range of tools at their disposal to uncover the various pieces of evidence and piece together what happened. The first attempt to put forensic research in the mainstream of security research will be a shocker to many.

While forensics has historically gone unremarked by the media, Guidance Software (recently acquired by OpenText) on Wednesday announced the winners of its inaugural Forensic Research Awards Program. These researchers include digital detectives who exposed a popular antivirus product that left behind users' long-term Web history, regardless of users' attempts to clear histories or use private browsing modes. Other research revealed IP addresses of anonymous users exposed by peer-to-peer software often deployed for pirating. There was also a major encryption vendor that left keys behind that could be recovered by law enforcement.

Vulnerability versus Forensic Research
Forensic research is a close cousin to vulnerability research. Vulnerabilities typically allow malicious code to execute or security controls to be bypassed. Forensics concentrate on the digital evidence that operating systems and applications leave behind. Both forms of research expose privacy concerns, but forensics shatters the illusion of privacy altogether. Everything leaves forensic residue: running applications, clicking files, accessing data, opening email attachments, and surfing the Internet.

Vulnerability research typically embarrasses software vendors, and gag orders are common. Vendors pay bounties to control the disclosure and patch before vulnerabilities become public. Forensic examiners don't work for bounties. They do what is required to catch criminals, pedophiles, or corporate embezzlers. Their findings are often public record in court cases — but not widely recognized in the media or elsewhere.   

The Forensic Research Awards Program was created to recognize the importance of forensics and reward researchers for their work. Consider the winner of OpenText's top research prize, Justin Bartshe, a longtime forensic examiner and an investigator with the United States Naval Criminal Investigative Service (NCIS). One of Bartshe's cases involved searching all of a user's data, encoded or not, including every system file and every nook and cranny of a user's operating system. Bartshe found URLs related to his case in a SQLite database left behind by a popular open source AV product. Despite the fact that the suspect cleared the browsing history many times, much of the long-term history still existed in the database. The AV product even records most of the browsing done in private or incognito mode.

Privacy & the Future of Forensics
An examiner at NCIS typically needs to present findings in court and defend them. Many people don't know this, but forensics is a science; defense teams often conduct their own forensic analysis to challenge prosecutors as well. Findings must be reproducible or they will be shot down in court. 

Bartshe wasn't attempting to embarrass the AV vendor or collect a bounty. His job required him to reverse engineer the AV platform's previously unknown SQLite DB to prove the conditions where it records browsing. Depending on the case, these findings can go into public record as part of prosecution. In this instance, Bartshe's research was used in a case to protect children from abuse.

Related Content

Paul Shomo is a senior technical manager for third party technologies at OpenText. A veteran of cybersecurity, Paul Shomo has spent more than 15 years as a software engineer with experience working in security and forensics, networking, and storage. Paul has spent several ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15572
PUBLISHED: 2018-08-20
The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.
CVE-2018-15573
PUBLISHED: 2018-08-20
** DISPUTED ** An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf...
CVE-2018-15574
PUBLISHED: 2018-08-20
** DISPUTED ** An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability."
CVE-2018-15570
PUBLISHED: 2018-08-20
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
CVE-2018-15564
PUBLISHED: 2018-08-20
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8.