Sans publica consenso sobre novas tendências de Resposta a Incidentes e Forense

sasO Sans Institute divulgou uma interessante lista de novas tendências das áreas de "Incident Response (I.R.)" e "Computer Forensics":

• Aumento das Investigações de Vazamentos de Dados;
• As empresas que precisam de IR/Forensics não fizeram a preparação adequada
• Necessidade clara de qualificação adequada para execução de Forensics
• Sub-setor de E-Discovery com grande crescimento devido às Federal Rules of Civil Procedure
• Muitos dados para executar Forensics / necessidade de rever processos tradicionais
• Forense para dispositivos móveis (Ipods, PDAs, ...)
• Coleta e Análise de Dados Voláteis têm sido críticos para resolução de casos.

Os especialistas consultados foram:

• Jim Butterworth (Guidance Software)
• Harlan Carvey (IBM ISS)
• Art Ehuan (Forward Discovery)
• Rob Lee (Mandiant)
• Monty McDougal (Raytheon)
• Bret Padres (Stroz Friedberg LLC)
• Jeffrey Palatt (IBM ISS)
• Ed Skoudis (Intelguardians)
• Aaron Walters (Volatile Systems)

Helix3 2.0 lançado

A E-Fense lançou ontem a versão 2.0 do seu Live CD Helix3 - uma ótima alternativa open-source para resposta a incidentes e forense computacional "live"..

Nesta versão, o Linux utilizado como base foi o Ubuntu, o que certamente facilitará no processo de atualização das várias ferramentas que compõem a distribuição - listadas abaixo:

Ferramentas Gráficas:

• Adepto & Air - GUI front-ends to dd/dcfldd/sdd
• linen: EnCase Image Acquisition Tool
• Retriever: (picture/video) capturing utility for “quick peeks”, and general searches
  
• Autopsy Forensic Browser - graphical interface to the command line digital investigation analysis tools in The Sleuth Kit
• pyFlag - simplify the process of log file analysis and forensic investigations
• RegViewer - *Nix viewer / navigator for windows registry file
• xhfs - graphical front-end for browsing and copying files on HFS-formatted
  volumes
• Ethereal - allow you to interactively browse network traffic
• ClamAV and F-Prot Anti Virus Scanners
  

Command Line:

• 2hash: MD5 & SHA1 parallel hashing.
• bmap: Detect & Recover data in used slackspace
  
• ChaosReader: Trace tcpdump files and extract data
  
• chkrootkit: Look for rootkits.
• chntpw: Change Windows passwords.
• dcfldd: dd replacement from the DCFL.
• e2recover: Recover deleted files in ext2 file systems.
• f-prot: F-Prot Anti Virus Scanner.
• fatback: Analyze and recover deleted FAT files.
• faust.pl: Analyze elf binaries and bash scripts.
• fenris: debugging, tracing, decompiling.
• foremost: Carve files based on header and footer.
• ftimes: A toolset for forensic data acquisition.
• galleta: Cookie analyzer for Internet Explorer.
• glimpse: Indexing and query system.
• grepmail: Grep through mailboxes.
• logfinder.py: EFF logfinder utility.
• logsh: Log your terminal session
• lshw: Hardware Lister.
• mac-robber: TCT's graverobber written in C.
• md5deep: Recursive md5sum with db lookups.
• outguess : Steganography detection suite.
• pasco: Forensic tool for Internet Explorer Analysis.
• rifiuti: "Recycle BIN" analyzer.
• rkhunter: Rootkit hunter.
• scalpel: Fast File Carver
• sdd: Specialized dd w/better performance.
• sha1deep: Recursive sha1sum with db lookups.
• sha256eep: Recursive sha1sum with db lookups.
• stegdetect: Steganography detection suite.
• wipe: Secure file deletion.

Várias organizações utilizam o Helix como base para treinamentos :

e-fense: Helix Live Forensics

NW3C: Linux Forensics

SANS Track 508: System Forensics, Investigation & Response

InfoSec Institute: Computer Forensics Training

SEARCH: Basic Investigators Training

Apresentação sobre logs para resposta a incidentes e forense

Anton Chuvakin (LogLogic) disponibilizou uma interessante apresentação sobre a utilização de logs nos processos de resposta a incidentes e forense computacional que ele preparou para o Simpósio "GOVCERT 2008", na Holanda. Vale a pena conferir.

Iphone Forensics Book & Video

Update: Iphone Forensics Video:

http://security4all.blogspot.com/2008/09/iphone-forensics-video-online-and-some.html

Iphone Forensics Book

"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!" -Andrew Sheldon, Director of Evidence Talks, computer forensics experts With iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze, and securely destroy sensitive data. iPhone Forensics supplies the knowledge necessary to conduct complete and highly specialized forensic analysis of the iPhone, iPhone 3G, and iPod Touch. This book helps you:

Determine what type of data is stored on the device Break v1.x and v2.x passcode-protected iPhones to gain access to the device Build a custom recovery toolkit for the iPhone Interrupt iPhone 3G's "secure wipe" process Conduct data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and recover the entire raw user disk partition Recover deleted voicemail, images, email, and other personal data, using data carving techniques Recover geotagged metadata from camera photos Discover Google map lookups, typing cache, and other data stored on the live file system Extract contact information from the iPhone's database Use different recovery strategies based on case needs

And more. iPhone Forensics includes techniques used by more than 200 law enforcement agencies worldwide, and is a must-have for any corporate compliance and disaster recovery plan. This book is still in progress, but you can get going with this vital information right away through the Rough Cuts edition, whichgives you access to the manuscript as it evolves, either online or via PDF."