Mark Morgan has a couple of intrusion discovery cheat sheets over on his blog. He has one for Windows XP Pro, Server 2003 and Vista, along with a separate one for investigating Linux machines. I really appreciate him taking the time to do these and make them available. I always enjoy seeing how people approach their investigations and adapting their methods to my work when possible. Lenny Zeltser also has some great Information Security cheat sheets over on his site.
My good buddy Joe Garcia has a review of Windows Registry Forensics over on the CyberCrime 101 blog. Nice job Joe!
I've been beta testing a new tool called Registry Decoder for Windows Registry parsing and searching. Registry Decoder is being developed by Andrew Case and Vico Marziale over at Digital Forensics Solutions. It's plugin based and has a nice search function as well. It's still in early beta stage and not ready for prime time, but I can definitely see it will be a fine addition to my forensic toolbox.
I've been spending a lot of my off time studying for the Network+ exam and hope to take it in the near future. I've also taken the time lately to set up a couple of Untangle firewall/router machines, one at home and another for my employer. I'll be talking more about all of that later.
That's it for now. Everyone stay safe!
Friday, July 29, 2011
Monday, July 25, 2011
Upcoming Class
I've seen posts by several people as of late talking about digital forensic classes they'll be teaching in which they plan to use Digital Forensics with Open Source Tools for the text book. I mentioned in my review that I thought it would be a good book for introductory digital forensics courses and it seems others felt the same way. I'm happy to say that I'll be teaching a brand new DF course starting in the Spring, 2012 semester at Lincoln Trail College and I'm planning to use DFwOST as my text book as well. When I was first asked to teach this course, I started trying to decide on a good book that beginners and those with some experience would benefit from that I felt would cover all the topics I wanted covered. DFwOST is definitely that book.
On a related note, I'll be teaching Computer Ethics at LTC beginning in the Fall, 2011 semester. This course is required if the student is pursuing the Computer Forensics certificate. I'll be using Ethics for the Information Age by Michael J. Quinn as the text book. I've only had a short time to look at the book, but it looks like it's going to cover the topic very well.
I'm very excited to be teaching for the very first time and hope I will do a good job at it. I've never taught before and was pretty surprised when I was contacted by the college.
On a related note, I'll be teaching Computer Ethics at LTC beginning in the Fall, 2011 semester. This course is required if the student is pursuing the Computer Forensics certificate. I'll be using Ethics for the Information Age by Michael J. Quinn as the text book. I've only had a short time to look at the book, but it looks like it's going to cover the topic very well.
I'm very excited to be teaching for the very first time and hope I will do a good job at it. I've never taught before and was pretty surprised when I was contacted by the college.
Wednesday, June 29, 2011
A few links
Corey Harrell has a review of Digital Forensics with Open Source Tools up on his Journey Into Incident Response blog. He recommends the book, just as I and quite a few others have done as well. If you don't normally read Corey's blog, you should start doing so. He's always got great content there.
Claus has a very interesting and helpful post up on the Grand Stream Dreams blog titled Anti-Malware Tools of Note. This is an excellent write-up about the tools and some of the methods he uses in combating malware infections. This is another excellent blog that is well worth taking the time to read regularly.
Over on the Windows Incident Response blog, Harlan Carvey has a new post titled Meetup, Tools and Other Stuff. In addition to several other topics, he talks about his research into Windows 7 Jump Lists, as well as information on the Master Boot Record. Jump Lists have become a topic of interest lately and deservedly so. Harlan has done a great job researching them and provides a nice write-up of what he's discovered thus far. Kudos to him for sharing this information and to everyone who does research and shares what they find.
Also, the talk about the MBR is quite interesting. Harlan mentions some tools and other resources for further study. I plan to try out the tools he links to and see for myself if they'll do the job I need done.
This topic is quite timely, given this post at the Microsoft Malware Protection Center blog on Technet about the 'bootkit' they call Trojan:Win32/Popureb.E. According the MS, the solution when your system is infected by this particular malware is to "simply" do an MBR repair followed by an operating system reinstall. I plan to do considerably more reading about this in the very near future, as the number of pc's being brought to me for malware cleanup has been increasing greatly as of late. If I learn anything useful, I'll post it here.
I still hope to learn how to reverse engineer malware and bought "Introduction to 80x86 Assembly Language and Computer Architecture" to help me learn that part of the reverse engineering process. I just started reading it, so I'm far from knowing much about the subject now, but hope to be able to put what I learn from it to good use soon.
I'm still catching up on all my favorite blogs, so I'm sure I've left out more than a few posts by others. I'm hoping to get caught up on all my reading in the next day or two and I'll post if I see something of interest.
Claus has a very interesting and helpful post up on the Grand Stream Dreams blog titled Anti-Malware Tools of Note. This is an excellent write-up about the tools and some of the methods he uses in combating malware infections. This is another excellent blog that is well worth taking the time to read regularly.
Over on the Windows Incident Response blog, Harlan Carvey has a new post titled Meetup, Tools and Other Stuff. In addition to several other topics, he talks about his research into Windows 7 Jump Lists, as well as information on the Master Boot Record. Jump Lists have become a topic of interest lately and deservedly so. Harlan has done a great job researching them and provides a nice write-up of what he's discovered thus far. Kudos to him for sharing this information and to everyone who does research and shares what they find.
Also, the talk about the MBR is quite interesting. Harlan mentions some tools and other resources for further study. I plan to try out the tools he links to and see for myself if they'll do the job I need done.
This topic is quite timely, given this post at the Microsoft Malware Protection Center blog on Technet about the 'bootkit' they call Trojan:Win32/Popureb.E. According the MS, the solution when your system is infected by this particular malware is to "simply" do an MBR repair followed by an operating system reinstall. I plan to do considerably more reading about this in the very near future, as the number of pc's being brought to me for malware cleanup has been increasing greatly as of late. If I learn anything useful, I'll post it here.
I still hope to learn how to reverse engineer malware and bought "Introduction to 80x86 Assembly Language and Computer Architecture" to help me learn that part of the reverse engineering process. I just started reading it, so I'm far from knowing much about the subject now, but hope to be able to put what I learn from it to good use soon.
I'm still catching up on all my favorite blogs, so I'm sure I've left out more than a few posts by others. I'm hoping to get caught up on all my reading in the next day or two and I'll post if I see something of interest.
Wednesday, June 22, 2011
Quick Post
Wanted to do a quick post here to say my review of Digital Forensics with Open Source Tools is now up on the SANS Computer Forensics Blog. As a frequent user of open source forensic tools, I found this book an excellent addition to my library. I think most forensic examiners will benefit from it in some way, while I think it could be essential reading for newcomers to the field.
On another subject, it's not often I give props to Microsoft, but today will be one of those rare moments. I think it's great that they've released their Microsoft Safety Scanner for both 32 bit and 64 bit versions of Windows. This tool will create either a bootable cd, usb flash drive or an .iso image for later burning. Just this morning I used it on an infected system brought to me and was impressed with the ease of use. Basically, it's a stand alone version of their Microsoft Security Essentials antivirus and it seems to work very well. It's nice to get new tools from vendors to help clean up the messes created by the various malware people find accidentally every day. You can download the tool from Microsoft Safety Scanner webpage.
Speaking of malware, I've been seeing a lot of infections by yet another fake security application. Most recently I've been receiving quite a few machines for clean up that are infected with variants called XP Recovery, Windows Vista Repair and so on. This one sets the hidden attribute on most every file and folder on the system and then does a fake scan claiming all sorts of terrible problems exist on your system and encourages you topay the ransom register the program so it can fix your problems and get your files back. It doesn't seem to do any serious damage at first, but the one I'm repairing now did get the extra gift of a rootkit patch to the C:\Windows\System32\drivers\volsnap.sys file. It would be really nice if those responsible for creating this fake security programs would find new jobs as speed bumps for trains.
An excellent resource for information on fake security app and other malware is the S!RI.URZ blog. The information there has been helpful to me on quite a few occasions.
That's all for now.
On another subject, it's not often I give props to Microsoft, but today will be one of those rare moments. I think it's great that they've released their Microsoft Safety Scanner for both 32 bit and 64 bit versions of Windows. This tool will create either a bootable cd, usb flash drive or an .iso image for later burning. Just this morning I used it on an infected system brought to me and was impressed with the ease of use. Basically, it's a stand alone version of their Microsoft Security Essentials antivirus and it seems to work very well. It's nice to get new tools from vendors to help clean up the messes created by the various malware people find accidentally every day. You can download the tool from Microsoft Safety Scanner webpage.
Speaking of malware, I've been seeing a lot of infections by yet another fake security application. Most recently I've been receiving quite a few machines for clean up that are infected with variants called XP Recovery, Windows Vista Repair and so on. This one sets the hidden attribute on most every file and folder on the system and then does a fake scan claiming all sorts of terrible problems exist on your system and encourages you to
An excellent resource for information on fake security app and other malware is the S!RI.URZ blog. The information there has been helpful to me on quite a few occasions.
That's all for now.
Thursday, June 16, 2011
And..... it's over
Over, as in my two weeks of conferences are now complete. Last time, I talked about my plans to attend both the SANS 2011 Digital Forensics and Incident Response Summit in Austin, Tx followed the next week by the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference in McLean, Va. Those two events are now history and I'm happy to say I enjoyed both very much. As seems to always happen, I looked so forward to them and then once it was time for them they just flew by. Ah well, perhaps I'll have the good fortune to attend one or both of them again next year.
One of the truly great things these conferences were good for, aside from the excellent presentations, were the tremendous opportunities to network with others in the field. I have been so happy to find that the "superstars" of this field are just like the rest of us, except way smarter ;-) Seriously, they're really good people and I was glad to meet and greet with them. Both conferences provided multiple opportunities to interact with the other attendees and speakers. Both were very well run and well attended as well, which is understandable given the quality of the speakers and the topics they were presenting.
Without a doubt, the best part of the two conferences for me was finally getting the chance to meet some of the people I've "known" online for several years but never met in person. Finally putting a face with the name for people I'd never even seen before was really cool. I talked with several of them over the two conferences about how we all have considered each other as friends, despite the lack of actually ever actually meeting in person. In most cases, we've managed to connect via Twitter and some of us have forged very close friendships with other "tweeps" who share our job interests and duties. There are many social media websites and services, but I would find it hard to believe any have a greater ability to unite people in the digital forensics and security fields than Twitter.
Each conference was great overall, with each only having one presentation I was a little disappointed in, though for different reasons. In fact, I wouldn't even say I was disappointed in the second one I'll talk about, but it was the one I got the least out of for reasons I'll explain.
I really enjoyed every speaker at SANS but one, even though some talked about subjects pretty far over my head. Unfortunately, one speaker seemed far more interested in promoting his product and showing his arrogance than conveying information. That seemed to be the general consensus of most everyone in the room from what I was able to tell and that's a shame, as the talk could have been very good. As he went on, it got better and more informative, but by that time he'd already lost most of the crowd. I read more than a few tweets by other attendees and heard many whispered comments complaining about this speaker while he was still talking.
At the open source conference, all speakers were likable and informative. Unfortunately, one spoke only very broken English, making it hard to really follow what he was talking about. He was aware of that and started off his talk by apologizing for his poor English. Just the same, he did his best and completed his talk. The information he provided was interesting and the slides he used were helpful, so I really hesitate to say I was "disappointed" exactly. The subject of his talk was something I was really interested in, but it was hard to come away with anything useful.
Overall, these two conferences where chock full of great information, both in the talks and in the informal meet-ups. I truly hope I can attend one or both next year, as they were both great learning experiences. Thanks to Rob Lee and Brian Carrier for all their hard work in getting these conferences up and running each year.
One of the truly great things these conferences were good for, aside from the excellent presentations, were the tremendous opportunities to network with others in the field. I have been so happy to find that the "superstars" of this field are just like the rest of us, except way smarter ;-) Seriously, they're really good people and I was glad to meet and greet with them. Both conferences provided multiple opportunities to interact with the other attendees and speakers. Both were very well run and well attended as well, which is understandable given the quality of the speakers and the topics they were presenting.
Without a doubt, the best part of the two conferences for me was finally getting the chance to meet some of the people I've "known" online for several years but never met in person. Finally putting a face with the name for people I'd never even seen before was really cool. I talked with several of them over the two conferences about how we all have considered each other as friends, despite the lack of actually ever actually meeting in person. In most cases, we've managed to connect via Twitter and some of us have forged very close friendships with other "tweeps" who share our job interests and duties. There are many social media websites and services, but I would find it hard to believe any have a greater ability to unite people in the digital forensics and security fields than Twitter.
Each conference was great overall, with each only having one presentation I was a little disappointed in, though for different reasons. In fact, I wouldn't even say I was disappointed in the second one I'll talk about, but it was the one I got the least out of for reasons I'll explain.
I really enjoyed every speaker at SANS but one, even though some talked about subjects pretty far over my head. Unfortunately, one speaker seemed far more interested in promoting his product and showing his arrogance than conveying information. That seemed to be the general consensus of most everyone in the room from what I was able to tell and that's a shame, as the talk could have been very good. As he went on, it got better and more informative, but by that time he'd already lost most of the crowd. I read more than a few tweets by other attendees and heard many whispered comments complaining about this speaker while he was still talking.
At the open source conference, all speakers were likable and informative. Unfortunately, one spoke only very broken English, making it hard to really follow what he was talking about. He was aware of that and started off his talk by apologizing for his poor English. Just the same, he did his best and completed his talk. The information he provided was interesting and the slides he used were helpful, so I really hesitate to say I was "disappointed" exactly. The subject of his talk was something I was really interested in, but it was hard to come away with anything useful.
Overall, these two conferences where chock full of great information, both in the talks and in the informal meet-ups. I truly hope I can attend one or both next year, as they were both great learning experiences. Thanks to Rob Lee and Brian Carrier for all their hard work in getting these conferences up and running each year.
Tuesday, May 17, 2011
Huge Month of June is Almost Here!
This may be the most I've ever looked forward to the month of June. The first couple weeks of the month are going to be absolutely filled with forensic geeky goodness.
First comes the 2011 Digital Forensics and Incident Response Summit in Austin, TX, which I'll be attending this year. I was presented with "an offer I couldn't refuse" and am very excited to say I'll be there. A look at the agenda shows what is bound to be a fantastic learning experience. The lineup of speakers and topics is top notch and I can't wait to get there. Besides, I'm gonna get to hang out with my good buddy Joe Garcia, host of the Cybercrime 101 podcast. Joe and talk several times a week and I know he's as excited as I am to head to Austin.
I'm also excited because one of my posts on the SANS Computer Forensics Blog, entitled "I'm Here, Now What?" has been nominated for a Forensic 4Cast Award. The awards will be presented at the Summit. I have to admit, my post wasn't as good as the posts by Rob Lee, entitled "Digital Forensic SIFTing: SUPER Timeline Analysis and Creation" and Matt Churchill, entitled "Free Digital Forensics Triage Tool" and I think either one of them could easily be the right one to vote for. Still, I'm more than a little honored to be nominated and will enjoy myself, regardless of the outcome.
The following week, I'll be driving eastward to McLean, VA with good friend Brad Garnett for the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference. This is going to be an excellent conference with presentations by some of my forensics heroes, such as Cory Altheide, Harlan Carvey, Simson Garfinkle and Brian Carrier. We'll be attending one of the pre-conference workshops as well.
There are several people I "know" online that I hope to meet at both conferences. Some of them I already have established friendships with in the online world and there's no doubt I'll enjoy meeting them in person. I'll be writing recaps of my travels here once they're over with. I may post some from the conferences if time and circumstances allow.
First comes the 2011 Digital Forensics and Incident Response Summit in Austin, TX, which I'll be attending this year. I was presented with "an offer I couldn't refuse" and am very excited to say I'll be there. A look at the agenda shows what is bound to be a fantastic learning experience. The lineup of speakers and topics is top notch and I can't wait to get there. Besides, I'm gonna get to hang out with my good buddy Joe Garcia, host of the Cybercrime 101 podcast. Joe and talk several times a week and I know he's as excited as I am to head to Austin.
I'm also excited because one of my posts on the SANS Computer Forensics Blog, entitled "I'm Here, Now What?" has been nominated for a Forensic 4Cast Award. The awards will be presented at the Summit. I have to admit, my post wasn't as good as the posts by Rob Lee, entitled "Digital Forensic SIFTing: SUPER Timeline Analysis and Creation" and Matt Churchill, entitled "Free Digital Forensics Triage Tool" and I think either one of them could easily be the right one to vote for. Still, I'm more than a little honored to be nominated and will enjoy myself, regardless of the outcome.
The following week, I'll be driving eastward to McLean, VA with good friend Brad Garnett for the 2nd Annual Sleuth Kit and Open Source Digital Forensics Conference. This is going to be an excellent conference with presentations by some of my forensics heroes, such as Cory Altheide, Harlan Carvey, Simson Garfinkle and Brian Carrier. We'll be attending one of the pre-conference workshops as well.
There are several people I "know" online that I hope to meet at both conferences. Some of them I already have established friendships with in the online world and there's no doubt I'll enjoy meeting them in person. I'll be writing recaps of my travels here once they're over with. I may post some from the conferences if time and circumstances allow.
Monday, May 9, 2011
It has ARRIVED!
Open source tools hold a special place in my heart. Like so many of us, I got my first real start in forensics using the Sleuth Kit, Autopsy, RegRipper and so on. Without these free, open source tools I would probably not be doing forensics today. Fortunately, they were there for me and, honestly, I enjoy using them. Even though I now have a few closed source, "payware" tools, I still use open source tools like those I mentioned, all the time.
I look forward to starting the book tonight when I get home from work. I'll be writing a review of it soon after I finish it and post it here.
Sleuth Kit and Open Source Digital Forensics Conference
Speaking of open source tools, I am happy to report I will attending this years Sleuth Kit and Open Source Digital Forensics Conference in McLean, VA. I will be submitting my registration tonight. Barring some catastrophe keeping me from getting there, I hope to attend and meet old friends and those I only know through their work. It's sure to be a great learning experience, as well as a great chance to network and do a lot of geek speak.
Subscribe to:
Posts (Atom)