Veteran forensic
investigator Paul Henry, who works for a vendor called Secure
Computing, says, “We’ve got ourselves in a bit of a
fix. From a purely forensic standpoint, it’s real ugly
out there.” Vincent Liu, partner at Stach & Liu, has
developed antiforensic tools. But he stopped because “the
evidence exists that we can’t rely on forensic tools
anymore. It was no longer necessary to drive the point home.
There was no point rubbing salt in the wound,” he
says.
The investigator in the aquarium case says,
“Antiforensics are part of my everyday life now.”
As this article is being written, details of the TJX breach—called the biggest data
heist in history, with more than 45 million credit card records
compromised—strongly suggest that the criminals used
antiforensics to maintain undetected access to the systems for
months or years and capture data in real time. In fact, the TJX
case, from the sparse details made public, sounds remarkably
like the aquarium case on a massive scale. Several experts said
it would be surprising if antiforensics weren’t used.
“Who knows how many databases containing how many
millions of identities are out there being compromised?”
asks the investigator. “That is the unspoken
nightmare.”
Data Mule infiltrates hard disk drives’ normally
off-limits reserved space.
“You’ve got 128 megs
of RAM in network printers that are never shut off!”
exclaims Michael Davis, CEO of incident response company Savid
Technologies and a veteran security researcher who worked on
the Honeynet Project. “It’s an old technique, but a
common one.”
a good portion of the antiforensic tools in circulation come
from noncriminal sources, like Grugq and Liu and plain old
commercial product vendors. It’s fair to ask them, as the
overwhelmed cop in London did, why develop and distribute
software that’s so effective for criminals?
Grugq’s answer: “If I didn’t, someone else
would. I am at least pretty clean in that I don’t work
for criminals, and I don’t break into computers. So when
I create something, it only benefits me to get publicity. I
release it, and that should encourage the forensics community
to get better. I am thinking, Let’s fix it, because I
know that other people will work this out who aren’t as
nice as me. Only, it doesn’t work that way. The forensics
community is unresponsive for whatever reason. As far as that
forensic officer [in London] was concerned, my talk began and
ended with the problem.”
For any case that relies on digital forensic evidence, Liu
says, “It would be a cakewalk to come in and blow the
case up. I can take any machine and make it look guilty, or not
guilty. Whatever I want.”
Liu’s goal is no less than to upend a legal precedent
called the presumption of reliability. In a paper that appeared
in the Journal of Digital Forensic Practice, Liu and coauthor
Eric Van Buskirk flout the U.S. courts’ faith in digital
forensic evidence. Liu and Van Buskirk cite a litany of cases
that established, as one judge put it, computer records’
“prima facie aura of reliability.” One decision
even said computer records were “uniquely reliable in
that they were computer-generated rather than the result of
human entries.” Liu and Van Buskirk take exception. The
“unfortunate truth” they conclude, is that the
presumption of reliability is “unjustified” and the
justice system is “not sufficiently skeptical of that
which is offered up as proof.”
Computer forensics in some ways is storytelling. After
cordoning off the crime scene by imaging the hard drive, the
investigator strings together circumstantial evidence left at
the scene, and shapes it into a convincing story about who
likely accessed and modified files and where and when they
probably did it. Antiforensics, Liu argues, unravels that
narrative. Evidence becomes so circumstantial, so difficult to
have confidence in, that it’s useless. “The classic
problem already with electronic crimes has been, How do you put
the person you think committed a crime behind the guilty
machine they used to commit the crime?” says Brian
Carrier, another forensic researcher, who has worked for the
Cerias infosecurity research program at Purdue University.
Upending the presumption of reliability, he says, presents a
more basic problem: How do you prove that machine is really
guilty in the first place? “I’m surprised it
hasn’t happened yet,” says Liu. “But it
will.”
Henry of Secure Computing has
been giving a presentation called “Anti-Forensics:
Considering a Career in Computer Forensics? Don’t Quit
Your Day Job.”
Indeed, if one looks back on some of the major computer
crimes in which suspects were caught, one will notice that
rarely was it the digital evidence that led to their capture.
In the case of the Russian botnet operators who had
extorted millions from gaming sites, it was an undercover
operation in which a “white hat” hacker befriended
the criminals. In the United Kingdom, says Grugq, the police
are using social modeling to try to penetrate antiforensics
used on mobile phones for drug dealing.
“Every successful forensics case I’ve worked on
turned into a physical security investigation,” says Bill
Pennington, a researcher at White Hat Security