Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 31 guests and 1 member online
EH-Net Donations

Enter Amount:
$

Google Ads
ChicagoCon 2008f
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow "New" tool
Ethical Hacker Community Forums
September 05, 2008, 02:34:28 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Registration Now Open for ChicagoCon 2008f Oct 27 - Nov 2! Visit www.chicagocon.com.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: "New" tool  (Read 4171 times)
0 Members and 1 Guest are viewing this topic.
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 204

Klaatu, Borada,Necktie?


View Profile
« on: April 29, 2008, 03:04:10 PM »

Quote from: vnunet.com
Microsoft has built a USB thumb drive for the police that scans computer hard drives.

The Computer Online Forensic Evidence Extractor can be used in police raids to map hard drives and decrypt passwords without shutting the computer down and losing evidence.

The device was shown off at a three-day security conference for 350 law enforcement officials in Redmond, Washington.

"These are things in which we invest substantial resources, but not from the perspective of making money," Microsoft general counsel Brad Smith told the Seattle Times. "We're doing this to help ensure that the internet stays safe."

The thumb drive has 150 commands and can log hard drive activity, check on surfing history and decrypt some passwords.

Microsoft has distributed the device for free since last year, and claims that it is in use by over 2,000 officers in 15 countries.

However, Smith acknowledged that there is a financial upside for Microsoft in giving away the device, since it makes money selling ancillary software and services.

Microsoft has been holding law enforcement meetings since 2006 in an effort to educate police about cyber-crime.

Story
« Last Edit: April 29, 2008, 03:05:55 PM by oneeyedcarmen » Logged

MCP, Security+, Associate (ISC)2
Bogwitch
Newbie
*
Offline Offline

Posts: 48

Senno Ekto Gamat


View Profile
« Reply #1 on: April 29, 2008, 05:03:19 PM »

Wouldn't the introduction of a USB device potentially modify some data that will later be used as evidence? I'm thinking file access timestamps, etc. not to mention the possibility of information in the swap file being overwritten.
It would certainly give a lawyer the possibility to suggest that the filesystem had been modified by LEO and at worst, could suggest LEO planted the evidence...
Logged

CISSP, C|EH, C|HFI
SynJunkie
Newbie
*
Offline Offline

Posts: 15


View Profile WWW
« Reply #2 on: April 29, 2008, 05:51:53 PM »

wouldn't it depend on how the USB drive was set up. Surely if the partition with the tools on was set up like the CD partition (read only) on the Hacksaw (U3) for example , and the other partition was to log the results of running the tools. It wouldn't be that dissimilar to running tools from a CD.

I know a registry key would be created for the USB device but the first responder  or LEO would be documenting the process and tools in use anyway so that would explain that.
Logged

----------------------------------
http://synjunkie.blogspot.com
RoleReversal
Sr. Member
****
Offline Offline

Posts: 397


View Profile WWW
« Reply #3 on: April 30, 2008, 03:44:19 AM »

I'll leave the modification aspect of this tool to the forensics people, my first thought when I read this story yesterday was:
how long will it take for this 'tool' to hit the underground/mainstream?
Logged

A little bit of sanity:
http://www.infosanity.co.uk
SynJunkie
Newbie
*
Offline Offline

Posts: 15


View Profile WWW
« Reply #4 on: April 30, 2008, 05:30:26 AM »

From the description of the tool it doesn't sound very different from what it's possible to acheive with the U3 switchblade or hacksaw (see hak.5 forums).  obviously the tools within those kits are aimed at the attackers and are already available and in use.  The forensic tools can easily be ported over from a incident response toolkit that is also available.

I would suggest that this tool is nothing new and once again the defenders are playing catchup.
Logged

----------------------------------
http://synjunkie.blogspot.com
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 204

Klaatu, Borada,Necktie?


View Profile
« Reply #5 on: April 30, 2008, 08:43:31 AM »

Quote from: SynJunkie
I would suggest that this tool is nothing new and once again the defenders are playing catchup.

Hence the quotation marks in the title of the thread...

 Grin
Logged

MCP, Security+, Associate (ISC)2
SynJunkie
Newbie
*
Offline Offline

Posts: 15


View Profile WWW
« Reply #6 on: April 30, 2008, 06:12:05 PM »

Right. Missed those.

I need to read more carefully before posting I guess.
Logged

----------------------------------
http://synjunkie.blogspot.com
oleDB
Full Member
***
Offline Offline

Posts: 218



View Profile WWW
« Reply #7 on: April 30, 2008, 06:52:30 PM »

What exactly do they mean by "map hard drives"?
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.047 seconds with 23 queries.
 
Polls
Best for daily desktop use:
 
Support EH-Net
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.