Incident Handling and Digital Forensic

Transcript

1. Muchammad Sholeh, S.Kom, M.Kom, CEH, ISMS Auditor, CCENT Muchammad.sholeh@netviasky.com Hotel Mirah, 8 September 2014 Bogor
2. Digital Forensic “The application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possible expert presentation.” Conclusion : salah satu cabang ilmu komputer dan sebuah prosedur investigasi dalam tujuan menindaklanjuti ke dalam ranah hukum dimana harus melibatkan bukti digital yang sah, validasi secara matematis, pelacakan, tools yang valid dalam mengolah evidence, pelaporan serta menjadi saksi ahli pada pengadilan hukum nantinya
3. Computer Forensic “Computer forensics, also called cyberforensics, is the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computer and who was responsible for it.” Conclusion : komputer forensic disebut juga cyberforensics, prosedur investigasi dalam melibatkan pengumpulan bukti yang kuat utk di pengadilan hukum dengan cara melakukan penyelidikan terstruktur, dokumentasi bukti serta mencari tahu apa yang terjadi pada komputer dan siapa yang bertanggungjawab atas perbuatan yang merugikan tersebut
5. Objective of Computer Forensic
6. Stages of Forensic Investigation in Tracking Cyber Criminals
7. List of Computer Forensic Tools
8. Computer Forensic Investigation Process
9. Open Source Software Digital Forensic  Digital Forensic Framework (DFF)  CAINE  SANS Investigated Forensic Toolkit (SIFT)  Backtrack Linux  Kali Linux  DEFT Linux  FTK Imaging (commercial)  Encase (commercial)
10. The Six Step of Incident Handling
11. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
12. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
13. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
14. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
15. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
16. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
17. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
18. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
19. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
20. Preparation  Top management support (budget, policy & procedure, legal review) Standard operation procedures (SoP)  CERT/CSIRT/IH team setup  Standard operation procedures (SoP)  Infrastructure readiness & physical resources
21. Preparation (Cont’d)  Training and familiarization with tools/software/procedures
22. – Hardware and Software • Forensic workstations • Backup devices • Spare workstations and network equipment – Used to try out malicious code – Restore backups • Blank media (cd-r, dvd-r, usb memory sticks) • Portable printer • Packet sniffers / Protocol analyzers • Forensic software • CDs, usb, and floppies with trusted applications • Evidence gathering accessories – Notebooks – Cameras – Audio recorders – Chain of custody forms – Evidence tags
23. Detection  Determine whether the incidents really occur or not  Measures to be taken if an incident is detected  Confirm the indications with various detection methods (IDS/ logs/ etc)  Take the appropriate initial actions & reactions  Open ticketing incident response  Estimate the scope of incident  Report the incident to appropriate authorities
25. Detection Analysis • Detection – Software Alerts • IDS • Antivirus • File Integrity • 3rd party monitoring – probe various services to make sure they are up – Logs • OS • Application • Network device – Publicly available info • Info on new vulnerabilities • Info of incidents at related organizations – People • Internal users • Outside users
26. • Analysis – Understand Normal behavior – Centralized logging • Have devices and software send their logs to a central location or server – Log Retention policy • How long do we keep logs? Archive them? – Event correlation • Events can be caught on several logs • Extract log entries across multiple logs can provide valuable info about the event – Clock synchronization • Logs are almost impossible to correlate if there are different times stamps – Use ntp
27. Containment  Limit the extent of possible attack & its loss  To minimize the damages or disruption  Disconnect/ isolate from the network  Block or blacklist bad external IP (C&C, attacker, etc)  Disable or delete login account that have been compromised  Disable network services like FTP  Increase monitoring level
28.  Containment Strategy  Method  Shut down  Disconnect from the network (wired or wireless)  Segment the network  Disable functions  Block hosts or ports at the perimeter  Rebuild or clean
29. Eradiction  Eliminate to cause of incidents and footprints/ ‘left- over’  Some of incidents footprints  Newly created accounts  Planted Trojans backdoor  Modified Registry  Common Steps  Clean reinstall  Apply patches  Change all account passwords
30. Incident Life Cycle – Containment, Eradication and Recovery  Volatile Evidence (in order of volatility)  Memory  Plug in media with trusted software (usb, cd, network share)  Execute shell from trusted media (cmd.exe, bash, etc)  Dump memory to a file (not on the suspected equipment!)  Unix: cat /dev/memory > file  Windows: mdd –o file  Mantech Physical Memory Dump  http://sourceforge.net/projects/mdd/  Windows Forensic Toolkit  www.accessdata.com  Eject media, hash the extracted file, copy the file to write once media (cd), hash copy and compare.  Copy again, hash compare.  Enter first copy into evidence (recording hash on the evidence tag)
31. Incident Life Cycle – Containment, Eradication and Recovery  Volatile Evidence (in order of volatility)  Hard Drive  Consider  Volume of storage  Drive configuration  Is the machine mission critical  Do a graceful shutdown  Remove hard drive, connect to a work station with a write blocker  Hash original  Duplicate  Hardware duplication is best  www.ics-iq.com  Software  Linux: dd  Encase: www.guidancesoftware.com  Windows: Forensic Toolkit
32. Incident Life Cycle – Containment, Eradication and Recovery  Volatile Evidence (in order of volatility)  Hard Drive  Duplicate  Or reboot the compromised system with helix linux (www.e- fense.com/products.php). Good when the system uses software RAID or LVM  Rehash the original to verify nothing was changed  Hash duplicate and compare to verify that the copy is the same  Enter the original and hash into evidence
33. Incident Life Cycle – Containment, Eradication and Recovery  Volatile Evidence (in order of volatility)  Data Analysis  Verify Hash  Undelete or recover files  Index identifiable words into a database and search  Strings  Hash individual files  NIST has a database of hashes of compromised files  www.nsrl.nist.gov  File signature analysis  Is the file what the extension say it is?  Key word search  Pwdump –outputs hashes of windows passwords  Sysinternals  Dameware: www.dameware.com
34. Incident Life Cycle – Containment, Eradication and Recovery  Volatile Evidence (in order of volatility)  Data Analysis  AV Scan  Multiple AV software brands  www.virustotal.com/  Method  Find a bad file  Search for other files with the same date and time  Look in the same directory  Check event logs for that date/time  Search registry for file name  Repeat with any new files found
35. Symptoms
36. Common symptoms of an incident
37. Memory Volatile Data  Memory volatile adalah memori yang datanya dapat ditulis atau dihapus, dan data akan hilang ketika tidak mendapat power / daya. Memory jenis ini hanya untuk penyimpanan data sementara saja, bukan untuk jangka waktu yang lama. Contoh dari memory volatile adalah RAM (Random Access Memory) digunakan sebagai memori utama untuk menyimpan program- program atau data-data yang sedang digunakan atau diperlukan oleh CPU saat dibutuhkan saja (sementara).
39. Memory Non Volatile Data  Memory Non-Volatile adalah memory yang datanya dapat ditulis dan dihapus, akan tetapi datanya tidak hilang ketika tidak mendapat daya. Memory jenis ini banyak digunakan untuk menyimpan data dalam jangka waktu yang lama. Contoh memory non-volatile adalah Hardisk, Flashdisk, SD Card, dll. Hardisk pun ada 2 jenis, yaitu internal dan external
41. Manage Security Services (MSS)
42. Proactive & reactive Manage Security Service (MSS) with: 24x7x365 monitoring Team of experts
43.  Proactive Services  To minimize cyber threats by carefully detecting and vigilantly identifying information weaknesses  Reactive Services  To diligently monitor and professionally respond to security events and incidents  Defensive Services  To provide tools and system that can control any security events detected
46. Kesimpulan :  Penerapan Security Operation Center untuk mendeteksi lebih dini ancaman (threat) terhadap seluruh asset domain maupun sub domain milik kementerian komunikasi dan informatika  Vulnerability Assesment dan Penetration Testing secara berkala terhadap seluruh asset kominfo  Security Awareness  Database contact PIC masing-masing pemilik asset kominfo utk mempercepat incident response jika terjadi serangan (attack)