Pro Digital Forensic Consulting: Infosec

Tuesday, October 13, 2015

What Social Media Activity Tells a Trained Forensic Examiner

October 13, 2015

What Social Media Activity Tells a Trained Forensic Examiner

For better or for worse, social media has become a driving force in many aspects of our lives. It helps individuals stay in touch with friends, relatives, former classmates and other acquaintances. It also helps business drive users to websites, advertise and (hopefully) generate revenue. Heck, even this little ole blog gets posted across multiple social media platforms to help generate "buzz" for a startup digital forensic consulting business. But what value does that social media activity have when conducting investigations? What can the social media data tell a trained digital forensic examiner?

This subject is yet another where I'll emphasize the value of possessing honed investigative skills in addition to being a practicing, competent, trained forensic examiner. The basis of how to conduct investigations involving social media, web activity or other electronically stored information (ESI) or even simply basic online investigations, comes through training and experience. Through the Internet Crimes Against Children (ICAC) Task Force, I was trained how to effectively track down people and gather intelligence online, mostly without their knowledge. This served me quite well in law enforcement and now serves me well in private investigations. But taking that training a step further into the findings of a digital forensic examination, we can incorporate that training and experience to dig even deeper to find out what the user(s) may be doing online.

As an example, we'll use the current “flagship” of social media, Facebook. Facebook has revolutionized how people stay in touch and they are constantly evolving the offerings they put forth. What was once an online yearbook for college students has now become a multi-billion dollar mega online conglomerate of services. Over time, users have gained the ability to search for other users, chat with other users, send links, videos, pictures and now even voice messages. And the best part is, most or all of this data is available to us when we get ahold of your computer and/or mobile device. Because Facebook is so ubiquitous across the user spectrum, almost everyone has an account, which means there's social media evidence almost everywhere.

And the great thing about social media is, it's tailor-made for us by us. We choose who we want to be "friends" with. We decide who to communicate with and for what purpose(s). We seek out and "follow" or "like" different social causes, businesses, political candidates, entertainers... the number and scope of what we can tell the social media world about ourselves is virtually boundless. Most social media users don't give much thought to the fact that they are sacrificing personal information security when they follow these things, too.

So when we conduct a digital forensic investigation, we’re looking for clues about all of these things. If the case involves a subject suspected of infidelity, perhaps they were using Facebook messenger to send messages to their paramour instead of regular text or email. And even if they were somewhat clever and never became "friends" with the other party on Facebook, the account information for the other user is recoverable and will lead right back to that person almost instantly. In the case of a law enforcement agent investigating someone suspected of having terrorist ties, perhaps they "liked" or followed anarchist, hate or radical religious groups. With tools that specialize in extracting and reporting this information like Magnet Forensics Internet Evidence Finder, the forensic evidence in these cases becomes vital to painting the picture of the truth. The best thing for us in the digital age is, if there's any digital evidence of it, we'll probably find it.

And while Facebook is a good example, the potential for valuable evidence doesn't end there. Twitter, Tindr, Snap Chat, Linked In... they all provide valuable pieces of information by way of personal and/or professional interests, potential romantic relationships, life events and random online rants (which happen more often than you might think). One final point that should not be overlooked is the responsibility of the investigator and/or examiner to stay abreast of the changes in social media. Like with most things in the digital age, social media is ever-changing. It’s a competitive market and their challenge is to gain new users while still maintaining a certain level of service and user expectation, lest they become MySpace. But the investigators and forensic examiners have to stay up with these changes to be able to consistently deliver quality service. Is it time-consuming? You bet! But it’s also extremely important to successful, accurate investigations.

Regardless of the platform, social media really does intertwine into all of our lives. Because of that, it becomes a virtual mountain of valuable personal information that a digital forensic examiner and investigator can use to help find the truth. Now go search for it!

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history. A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email: ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Thursday, May 21, 2015

The INconvenience of INfosec

May 21, 2015

The INconvenience of INfosec in the Digital Age

I often get requests from civic groups, consumer groups and the media to speak about information security (infosec) practices, trends, etc. Although infosec is not our primary role at Pro Digital, it does seem as if there is a vacuum of individuals willing to tell folks what they should do with regard to protecting their data, even if it is just the simple things. What I constantly try to drive home is the notion of personal responsibility with regard to your information security. YOU are responsible for the strength of your passwords and how often you change them. YOU are responsible for the data you put out on social media. YOU are responsible for making sure your mobile device isn’t left unattended in a public place. YOU are responsible for not leaving your desktop up and accessible when not at your desk. All of these concepts (and more) really drive the point home that infosec is everyone’s responsibility.

Being a former cop and investigator, I know there are evil people in the world. There are just plain bad people who, if they worked as hard as they do at trying to exploit the innocent, hard-working people at a REAL job, they might actually be successful in life. Sadly, this is not reality. It’s because of this that I generally keep my head on a swivel, both proverbially and physically. Even in my own home, I generally lock my desktop when I walk out of my office. I have decent security on my smart phone and tablet. At Pro Digital, we also make it part of our mission statement to secure our client’s data. We take all of these measures because 1) it’s vitally important to maintaining confidentiality and 2) someone else would love to get ahold of this data and exploit it. But is it inconvenient? You bet!

Unfortunately, human nature is often to take the path of least resistance, which is in direct conflict to good personal information security practices. It’s a pain in the butt to change your password every 60 days. Encrypting your data takes time and can even slow down the speed of access of your data. It’s hard to keep track of multiple passwords, especially if you take the recommended precaution of using non-dictionary-based words, numbers and symbols. Multi-level verification with security words, passwords and biometrics makes logging on a longer, tedious process. Mix all of these factors together and the fact is most people won’t do it (if they have a choice). But as this chart illustrates, there’s a huge reason why you should do it:

Thanks to the recent Sony hack, everyone thinks our cyber-enemies are in foreign countries. The fact of the matter is, we have plenty of cybercrime happening right here at home. And it’s up to YOU to protect yourself. The government won’t do it, your bank won’t do it, your company won’t do it. Sure, they’ll put some measures in place to push you along to decent infosec practices, but when it’s all said and done, it’s up to you to make sure all of your passwords aren’t the same. It’s up to you to put those optional security measures on your mobile device in place. Here’s another reason:

What’s more important than your money? You work hard for it, you save, you invest, you make savvy purchases. Good infosec practices take less time than clipping coupons and will save you much more money in the long run. Make sure you always know where your mobile device is. Make sure it’s locked-down and, if it’s lost or stolen, you can wipe the data remotely. Even though you may want to, don’t use the “quick log-on” option. This will only increase the likelihood that someone will guess your PIN and access your account(s).

We all love convenience and indeed, convenience is one big reason why we all love our mobile devices. But what’s more inconvenient than having your identity stolen or your credit score destroyed by someone opening accounts in your name because you didn’t protect your personal information well enough? I sometimes use clichés in this blog and this is another one of those times: An ounce of prevention is worth a pound of cure!

So what else should you do? Take the time to come up with new passwords. Change them often, at least several times a year (perhaps when you change the batteries in your smoke detector). Don’t ever, EVER use the same password for all of your accounts. Embrace and use multi-level authentication because it will protect you. Don’t use common words or words that can be found in a dictionary for your passwords and make sure you mix up symbols, numbers and letters. Need an example? Let’s say your favorite color is purple and your mother’s birthday is September 25. Instead of making your password Purple0925, try Purp13#0925. Sometimes, it’s just that simple.

Free wi-fi is great and it’s everywhere. Unfortunately, you should never use open wireless networks like those found in coffee shops, restaurants and hotels. Yes, I know this means you’ll be using up more of your cellular data on your mobile device, but trust me, open networks are fodder for hackers and quite easy to compromise. Think of how a packed Starbucks or a crowded hotel is a target-rich environment for someone who knows what they’re doing. At home, make sure your wireless network is secure and using a password scheme similar to what is mentioned above to connect. Hide and don’t broadcast your network so anyone connecting to it needs to know the specific name and password to log on to the network. If someone sitting outside your home can access your network, in theory they can access every single device connected to the network including mobile devices, laptops, desktops and gaming systems.

When making purchases online, use a credit card with ID theft protection. Don’t make purchases from websites that are from countries that may have opposing interests with the US or western ideologies. Most internet browsers offer a very definitive symbol to let you know they’re using good security, so pay attention before you input and send your credit card information, it should be easy to tell when you look in the browser bar. On mobile devices, only make purchases through verified, trusted apps. This is generally less of a problem on Apple devices than on Android devices because Apple vets all of the apps on the App Store and holds developers to a standard. Android apps can be open-source which means they can be made and posted by virtually anyone.

Good infosec is everyone’s responsibility, but first and foremost, it’s yours. Larger companies and banks have armies of data security experts on their side to help you, but even they sometimes get beat. And no one wants to be a victim, so let’s all agree to do whatever we can do to prevent it, right here and now. The encroachment of digital devices for every aspect of our lives is only going to increase. Make the decision now to be a responsible user of the technology