Pro Digital Forensic Consulting: Security

Showing posts with label Security. Show all posts

Wednesday, July 22, 2015

Never Use P2P

July 22, 2015

Why You Should Never Use Peer-to-Peer

For those of you who don’t already know, peer-to-peer file sharing is a big deal, not only for “legitimate” purposes (i.e., trading of non-contraband files), but also for more nefarious purposes such as trading in illicit images and videos. This has become big business for law enforcement because the growing use of peer-to-peer (p2p) networks has made the searching for, downloading, collecting and trading of child exploitation images much easier and more prolific than it ever was before these networks existed. But that’s not all they’re used for. Arguably, the majority of traffic across p2p networks is for bootlegged music, movies, TV shows, etc. This slightly more “legitimate” use of p2p services is not quite as damaging (or grotesque), but still opens users up to a myriad of potential problems.

What is Peer-to-Peer (p2p)?

Simply put, p2p is an internet-based service that allows other users (peers) to trade files across an open global network. For example, if you’re a big fan of Beyonce, you can download one of several p2p software utilities (Shareaza, Limewire, Ares, etc.), which are generally free of charge and, once it’s installed, simply connect to the internet and search for “Beyonce” and voila! You will immediately receive hundreds of hits from other users all over the world sharing files with the title bearing the name “Beyonce”. This sounds great, right? Easy, fast and free. Almost sounds too good to be true!

The Good

So the good things about p2p are that it’s free, fast and easy. That’s about it. And while that may be enough to convince you that you’ll log on right now and download a p2p utility and start your library exploding exponentially, please keep reading… Because free, fast and easy usually comes with a price. This is true in p2p and in life.

The Bad

So what’s so bad about p2p? We’ll get into the REALLY bad parts in the next section, but here’s some pretty bad side-effects for starters:

1) You don’t know where your files are coming from

While you may be able to see an IP address and/or a country of origin of the files you’re downloading, that’s about it. And unless you have subpoena power (and even that won’t help you in a foreign country), you have absolutely no idea where your files are coming from. In fact, they could be coming from one of several different sources. This is a common default setting in p2p software to speed up the downloads.

2) You don’t know what you’re downloading

I’ll talk about this a little bit more later, but best-case scenario is you may be downloading files that contain malware, viruses, spyware, or any other of a number of digital “bugs” that could slowly (or quickly) destroy your computer system. The fact is, these files aren’t verified and they aren’t authentic much of the time, so just because the file name says “Beyonce” doesn’t mean that’s what you’re getting. Even if it is what you’re getting, the potential for some malicious code to be inserted that will log all of your keystrokes or save and send all of your passwords is fairly high. Why take the risk for a free song or movie?

3) You’re allowing others on the internet an open door into your computer system

As you may have been able to figure out by now, p2p isn’t all about getting files from others. In order to get more downloads quicker, you have to share your files too. Think about all the valuable information that may be on your computer – Banking records, website history, important documents… do you want all of that available to a savvy user of p2p in China? Plus, sharing is turned on by default upon installation of these programs and these default settings sometimes go as far as naming what types of files will be shared on your system. Again, more on sharing later.

The Ugly

So here’s why you really don’t want to ever use p2p software: Most of the content that you’ll find on p2p networks is illegal. Sure, people sometimes share a PowerPoint deck they created or a story they wrote, but those are the exception. More often, p2p users are sharing bootlegged copies of TV shows, music and movies. You can download entire seasons of TV shows with one click. Problem is, all of that material is copyrighted and therefore illegal to obtain for free.

The other thing that p2p is routinely used for is pornography in all of it’s forms. As former police detective who investigated the trafficking of illegal images, I’ll just tell you to think of some of the worst, most disgusting images you can imagine and go about 10 levels higher and that’s what is trafficked on p2p. Sure, there’s “normal” pornography on there, too, but anyone can get that from any number of websites. Those who are interested in truly dark niche images turn to the p2p networks to download it because legitimate websites won’t post that material.

So let’s say you’re not into any of that stuff and you just want to download bootleg movies. I said before that you never know what you’re getting, right? Well when you search for files on a p2p network, the search hits are returned by file name. Problem is, anyone can name a file anything they want, regardless of the actual content. So if you’re looking for a movie starring Denzel Washington, you may get some legitimate hits, but you may also get hits from files that have people in them that look like Denzel Washington and someone inserted his name into the file name and threw it up on the p2p network and it happens to contain illegal images. Guess what, you just broke more than copyright law!

The other problem has more to do with the underlying motive for even using p2p in the first place: laziness. In many cases that I’ve worked, the target or client claims that they just performed a search for “normal” porn using the key word of “teen” (because they’re allegedly interested in 18 and 19 year-olds). They get several dozen hits, click the top hit, scroll to the bottom and hit SHIFT + click and download the entire list. This also happens with bit torrent files (google it). Now they’ve just grabbed an entire library of potentially illegal material, whether it was intentional or not. They do this because it’s quick, free, easy and they’re lazy.

Finally, the sharing comes into play. It’s one crime to possess illegal images, it’s wholly another to distribute them. The way the criminal justice system views it is that the victims in those illegal images are being victimized all over again every time someone views them, so to distribute them is much worse. But as I said before, sharing is turned on by default and law enforcement targets those who are sharing illegal files. It’s also quite possible to download an illegal file and be sharing it before you’ve even had a chance to view it and determine it’s something you really don’t want on your system. Next thing you know, the police are knocking on your door. That’s a bad day.

Advice is free and it’s always up to the receiver to take or leave it. But speaking as one who has seen many, many cases come before the courts and many defenses attempted and failed, I’m forced to ask ‘why would anyone use peer-to-peer?’ It’s a bad idea, even if your motives are mostly legitimate. The internet is the wild west -- it’s not regulated and seldom policed. But my advice is don’t put yourself in the potential position to get caught up in something that could wind you up in prison. When the digital media evolution happened, I decided that it’s worth the $1.00 or so you pay Apple or Google for a song. It’s worth it to rent or buy movies legitimately from legitimate, verified sources. It’s not worth it getting caught up in something you don’t ever want to be a part of… Trust me on this one.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history. A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email: ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Wednesday, March 11, 2015

Ethical Sensitive Data Handling

March 11, 2015

Ethical Sensitive Data Handling

Current events with regard to public and private officials handling sensitive data have given rise to the larger question, beyond legal requirements, what is the right thing to do when it comes to handling sensitive data? Indeed, data handlers in both the public and private sectors have a responsibility to handle that data with integrity and keeping in mind who they are serving while handling the data. We’ll explore some of the different considerations here:

Sensitive Data Handling in the Private Sector

There’s no doubt that data security and the threats posed from both internal and external data breach perpetrators has become a very hot topic in recent months. External hacking attacks upon the systems at eBay, Home Depot, Staples, Google and Anthem are just a few of the high-profile examples of the external threats that exist with regard to data security. But what ethical obligation do those companies have with regard to handling your sensitive data? I would suggest that the base-level of ethical responsibility is the same across the board, no matter the industry. Whether the company is handling your credit card number or your healthcare records, they all have a basic ethical responsibility to treat the trust their customers place in them with the highest regard. As consumers, we all have a choice of who earns and keeps our business. The waters get a little muddier when the data handler is an employer-sponsored insurance company, but the fact remains that you still have a choice. Fortunately, it appears that most companies do understand this ethical obligation, even if only after a breach has occurred and when “prosecuted” in the court of public opinion.

Beyond credit card numbers, email address & other personal information, certain industries have an even higher ethical responsibility to handle your data securely. The obvious recent example is the data breach at Anthem, an extremely large health insurance company which warehouses the healthcare information for millions of customers. There are several reasons why the doctor-patient legal privilege exists, not the least of which is the sensitivity of the information shared between patients and their healthcare providers. Regulations and laws such as HIPAA are in place to try and force healthcare providers and their associated industries (i.e., insurance companies) to do the right things insofar as patient privacy, but we still see outdated, insecure practices like pen-and-paper sign-in clipboards in doctor’s offices and examining room doors being left open while awaiting treatment or while under treatment. These violations are minor in comparison to a large data breach, but they signal a larger systemic problem in healthcare data security, HIPAA compliance and patient privacy – the oneness for patient confidentiality is ultimately on the healthcare provider and carelessness or complacency is no excuse to sacrifice patient information security.

However, we as the “consumers” of health care need to also educate ourselves to the best practices of patient privacy and hold our healthcare providers to those standards.

It bears noting that healthcare is only one example of this ethical responsibility. Other industries that bear an ethical and often times legal responsibility for client information security are legal practitioners, financial institutions and the government.

Ethical Data Handling in the Public Sector

The “pink elephant in the room” example with this particular subject is the recent story of Hillary Clinton and her handling (or rather mishandling) of potentially vital emails through use of a personal email address for official U.S. State Department business. While the media pundits and critics from both sides of the political spectrum will debate her actions as legal or illegal, the more poignant question is, was it ethical? I submit the answer is a resounding “NO!”

Political ideology aside, let’s explore the common-sense side of data storage that is potentially vital to our national security on a private email server. The first consideration is accountability. It was reported today that Clinton may have “deleted” upwards of 30,000 emails from this personal server, and by her own admission used the personal email for official business, but it was legal because there’s no law against it. This would seem to be an obvious example of an instance where the law has not yet caught up with technology, which is a repeated theme in the legislature and court decisions. Public officials are placed in positions of public trust. The higher the position, the more the public has implied trust in the person holding that position. But trust is backed up by verification, or in this case, transparency. Unfortunately, transparency is out the window because Clinton allegedly deleted half of the emails lying on the server. Does that mean our trust should be out the window too?

The other notable area with regard to ethical data handling by public officials is the security of that data. The Federal Government has regulations, standards & practices in place for secure data handling. If a public official handles his or her data privately, they are not necessarily subject to those standards, presenting a very convenient loophole. Even if they are subject to data security standards, the government may have trouble compelling an employee to turn over personal data, even when mixed with official communications. However, those data security standards are in place because there are other nations that would be very interested in any and all data from the public sector they can get their hands upon to exploit. I recently saw a tweet from an information security professional that read: “Maybe the American People didn’t know Hillary had a private email server, but the enemies of our State sure did!” No truer words have been spoken. If Clinton was handling official business on a private email server, as she has admitted, what security measures were in place to handle the data? What server logging, monitoring, incident response or data encryption was in place? If we take Clinton at her word, she used one email and one device “for convenience”. Is it possible none of these security measures were put in place because of the same convenience mindset?

Was anyone really over her shoulder looking? (Picture credit: ABC News)

While Hillary Clinton’s mishandling of sensitive data has provided a great example here, the responsibility for ethical data handling is not limited to the Federal Government or officials in high-ranking positions. Federal, State & Local officials at every level bear the same responsibility. Local and State Departments of Social Services not only warehouse client information, but may also have healthcare-related and highly sensitive and confidential information about their clients. Local and State public safety agencies warehouse data for every ambulance call, police report, traffic stop and personal encounter with virtually everyone they come into contact with, including those involved in a personal health crisis. While these incidents may be exempt from HIPAA, that doesn’t mean the data any less sensitive. These examples are just two of many that illustrate the need and responsibility for ethical data handling at all levels of the government.

Conclusions

High-profile cases have certainly created an increased awareness of data security, but the practice and implementation of real data security measures is still reactionary at best. To be sure, virtually everyone in every industry (including digital forensic consultants & bloggers) is responsible for some sort of sensitive data and bears responsibility for ethical data handling that goes beyond simple legal requirements. The Golden Rule applies across the board, no matter your industry and can be applied to data handling as well – Handle other’s data as you would handle your own.

In the end, ethics and integrity go hand-in-hand. Integrity means doing the right thing, even if no one is watching. So let’s all start taking the proactive measures required to handle sensitive data not just to the legal standard, but to high ethical standards worthy of the trust of our clients, customers and the public at-large.