Thursday, July 15, 2010
paul.jpgPaul Craig works at as a forensic investigator.

Forensic investigation: Fact-based investigation - must be reproducible and not based on anything subjective.

If you're going to get hacked, it will start at your web app. Firewalls generally stop all other traffic.

Treat all results as possible legal evidence - could be used for murder etc cases. Evidence could be used to allow police to arrest a suspect.

Most computer crimes in NZ will be tried under property law with a judge and jury.

All evidence may need to be provided to defendant to cast doubt on the evidence. How was it collected or analysed?

Common things customers say:

- Assumptions
- They only compromised one server - assume it has happened more than once
- We already dealt with it - probably destroyed all forensic evidence (could come back to bite in the future)
- It's too hard / not my problem

What to do when there's an incident:

How you act makes all the difference. Smooth engagements and do things as fast as possible.

Need a single point of contact for all security incidents within an organisation.

Appoint an incident response team - includng someone with internal clout, legal support.

Find a forensics supplier in advance. Don't leave it till when there's an incident.

It's a specialised industry, and you shouldn't do it yourself.


Media love a hacking story. This makes things stressful.

You need a bottom draw letter pre-written that you can give to the media. Get it signed by the CEO now.

Technical incident response:

Treat with urgency, gather incident team together in a secure location.

Get incident responder into the system as soon as possible to get current connections, arp caches etc.

- Disable scheduled patches, updates, restarts
- Unplug from internet / firewall it
- Leave the server powered on
- Put a big sign "Do not touch"

Within a day or less if possible.

Police reports:

If you have evidence that a crime has been committed, or something could be committed (e.g. fraud), file an incident report with police. As much evidence as possible.

Will you catch them?

If NZ / AU - likely.

If UN / NATO, possible but involved IPTF task force.

Other country: very slim chance of catching them.

When don't you have to file a report:

No loss of finances, no increase in fraud risk, no chance of repurcussions / fines.

How to do forensics:

Paul then talked about how do forensics testing. Take-away: it's hard, and in order to provide evidence in court you won't actually be able to do it yourself.


Paul gave examples of when they'd be engaged with customers. Problems encountered:

- They knew they had been hacked, but hadn't told each other
- Meeting in insecure places
- Taking too long to figure out what to do
- Companies that don't know how to respond
- Assuming evidence has been destroyed already

Without senior executive support, nothing will happen. Forensic and technical response isn't a technical problem: it is an entire business problem.


Sooner or later, you'll get hacked. When it happens, take it seriously.

Prepare for that incident straight away. Figure out what you'd do?

Stay cool when it happens, follow the game plan.

Never assume anything!


How do you deal with situations where the hacked website needs to be back up in 10 minutes? So you don't have time to do forensics?

- Bring up a DR server if you have a safe backup.
- If it's compromised, you have to take it off immediately if someone is on that server at that time

How do you deal with virtualisation? When you don't have physical access to a machine?

- Can get all active memory and disk onto a disk
- Can take the entire VM snapshot and rebuild into a real computer again

What about if it's a cloud provider?

- Probably have no access to get an image. Comes down to whether we can get that access.

Does a live image impact the integrity of the evidence?

- Hash the evidence as soon as it is taken, so we can prove the image is unaltered.

If hacker uses anonymity services like tor / proxies?

- Often there's one request where they connect back directly.
- Often there's still some fragments of evidence remaining.
- Might be able to find out what they did, but not necessarily who did it.
  - "Your credit cards have not been touched"

Comments are closed.