Paul Lukach, Executive Director of the Crime Victim Center of Erie County, is the first to admit it: he and his employees don’t pride themselves on being technology savvy.
Anti-forensics is a term that encompasses actions taken to manipulate or alter evidence, aiming to hinder the effectiveness of forensic investigations in criminal cases. In the context of cyber breaches, anti-forensics typically serves the following objectives:
Evading detection and obstructing the collection of crucial information.
Prolonging the analysis time required by digital forensic experts.
Disrupting or rendering digital forensic tools ineffective.
Preventing, circumventing, or erasing logs to conceal traces of unauthorized access or tool execution.
1. Timestamps
In the world of digital forensics, timestamps play a pivotal role in tracking and analyzing activities on a computer system. However, threat actors often employ anti-forensic techniques to tamper with these timestamps in a bid to cover their tracks and evade detection. This article, brought to you by SCIAT AFRICA, delves into the realm of timestamp manipulation and explores the methods employed by attackers to subvert forensic investigations.
Understanding Timestamps in NTFS
In the NTFS (New Technology File System) used by Windows operating systems, various timestamps are associated with files and folders. These timestamps provide valuable information about when a file was created, accessed, modified, and when its Master File Table (MFT) registry was last updated. The four key timestamps are:
Modification Time (M-time): Indicates when a file’s content was last modified.
Access Time (A-time): Records the last time a file was accessed or opened.
Creation Time (C-time): Marks the moment a file was originally created.
MFT Registry Modification Time (MACE or MACB): Reflects the time when changes were made to the file’s Master File Table entry.
Anti-Forensic Tools and Techniques
TimeStomp:
TimeStomp is an anti-forensic tool that focuses on modifying timestamp information inside the $STANDARD_INFORMATION attribute of a file.
It should be noted that TimeStomp does not alter the timestamp information within the $FILE_NAME attribute, which can be used to identify suspicious activity.
USN Journal Analysis:
The USN Journal (Update Sequence Number Journal) is a feature within NTFS that maintains a record of changes made to the file system.
Anti-forensic practitioners can examine the USN Journal to identify modifications made to files and folders.
$LogFile Inspection:
All metadata changes within an NTFS file system are logged in a file named $LogFile.
Tools can be used to parse this log and identify alterations to timestamps, including:
CTIME (File’s creation time)
ATIME (File’s modification time)
MTIME (File’s MFT registry modification time)
RTIME (File’s access time)
$STANDARD_INFORMATION and $FILE_NAME Comparison:
One method for uncovering suspiciously modified files involves comparing timestamps between the $STANDARD_INFORMATION and $FILE_NAME attributes, looking for inconsistencies.
Nanoseconds Precision:
NTFS timestamps possess a remarkable precision of 100 nanoseconds. Any files with timestamps like ‘2010-10-10 10:10:00.000:0000’ raise suspicions due to this precision.
SetMace:
SetMace is an anti-forensic tool capable of modifying both the $STANDARD_INFORMATION and $FILE_NAME attributes. However, on Windows Vista and later versions, a live OS is typically required to perform such modifications.
Data Hiding in Slack Space:
NTFS allocates data in clusters, potentially leaving unused slack space within a file.
Tools like ‘slacker’ enable data to be hidden in this otherwise unutilized space.
Recovery tools like FTK Imager can be employed to retrieve the hidden data, which may be obfuscated or encrypted.
These techniques represent the attacker’s arsenal when it comes to tampering with timestamps in an effort to thwart digital forensics investigations. As forensic experts continue to refine their methods, it remains a constant challenge for cybercriminals to cover their tracks effectively.
2. Data Hiding
In the world of digital forensics, uncovering the truth is often a matter of deciphering hidden data. Threat actors employ a variety of techniques to obscure crucial information, making the investigator’s job more challenging. In this comprehensive blog, we delve into the realm of data hiding, exploring various methods employed by cybercriminals to conceal their tracks.
Understanding Data Hiding
In the digital realm, data hiding refers to the art of concealing information to make its detection difficult. There are several key techniques used for data hiding, including data obfuscation, encryption, steganography, and hiding data in non-allocated areas.
**1. Data Hiding in Non-Allocated Space
NTFS (New Technology File System) allocates data in clusters, leaving unused slack space within a file. When a file occupies less than a whole cluster, the remaining space remains unutilized until the file is deleted. Cybercriminals can exploit this unused space to hide data effectively.
Tools like ‘slacker’ provide the means to hide data in this ‘hidden’ space, making it challenging for investigators to discover.
It’s important to note that while data can be hidden in slack space, an analysis of system logs such as the $logfile and $usnjrnl can reveal the addition of data, raising suspicions.
2. Encryption as a Data Hiding Technique
Encryption serves as a powerful method for data hiding. The Lazarus group, for instance, utilized encryption in their operations.
They divided their malware into three parts: the loader, encrypted PE files, and encrypted configuration files.
The loader decrypts encrypted PE files and loads them into memory. These encrypted PE files run in memory, decrypting configuration files to communicate with a Command and Control (C2) address.
To evade detection, the Lazarus group transmitted both the configuration file and the PE file in encrypted forms. These files operate after decryption in memory by the loader, enabling them to receive additional files from the C2 and carry out malicious actions.
Additional Forms of Data Hiding
The Lazarus group employed various tactics to hide their malware effectively. Some of these methods include:
1. Using System Folders for Concealment
Cybercriminals often use system folders as a hiding place for their malware. Default system folders, which are hidden by default, become prime locations for concealing malicious code.
The Lazarus group created folders with names similar to default folders or disguised their malware as normal files within hidden system folders.
Key system folders used for concealment include:
C:\ProgramData\
C:\ProgramData\Microsoft\
C:\Windows\System32\
The C:\ProgramData folder, for instance, is a default system folder hidden by default. Cybercriminals would either create a similar folder within this directory or disguise malware as a normal file inside a default hidden folder.
Unveiling the Hidden Truth
In the world of digital forensics, uncovering hidden data is a constant challenge. Cybercriminals employ sophisticated techniques, including data hiding in non-allocated space and encryption, to evade detection. As forensic experts continue to refine their methods, the cat-and-mouse game between investigators and threat actors remains ongoing. Understanding these data hiding techniques is a critical step towards staying one step ahead in the battle against cybercrime.
3. Unmasking USBKill
USBKill is a formidable tool in the arsenal of cyber adversaries. Designed to disable a computer upon detecting any change in the USB ports, its potential impact on an investigation is significant. Detecting this threat involves a meticulous examination of running processes and a thorough review of active Python scripts. By staying vigilant and monitoring USB activities, investigators can preemptively defend against this potential disruption.
4. Living on the Edge: Live Linux Distributions
The rise of Live Linux Distributions poses a unique challenge. These distributions operate exclusively within RAM memory, rendering traditional detection methods ineffective. However, a critical vulnerability arises when the NTFS file system is mounted with write permissions. Without this crucial access, identifying an intrusion becomes an elusive endeavor.
5. The Art of Secure Deletion
In the pursuit of obscuring digital footprints, threat actors often resort to secure deletion methods. This tactic aims to eradicate traces of malicious activities. By employing tools such as cipher /w:C, investigators can systematically remove residual data from unused disk space within the C drive. This proactive measure mitigates the risk of vital evidence being erased or obfuscated.
6. Windows Configuration: Fortifying the Bastion
The Windows operating system provides a plethora of configuration options that can be leveraged to bolster digital forensic investigations. Here are some key strategies:
Disable Timestamps – UserAssist: This registry key maintains a log of dates and hours when each executable was run. Disabling UserAssist involves a two-step process.
Registry keysHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled must both be set to zero, signaling the intent to disable UserAssist.
Additionally, clearing registry subtrees under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\<hash> is essential to complete the process.
Disable Timestamps – Prefetch: While Prefetch aims to enhance system performance by saving information about executed applications, it can also be leveraged in forensics.
To disable it, launch the Registry Editor (regedit.exe), navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters, and right-click to modify EnablePrefetcher and EnableSuperfetch values from 1 (or 3) to 0.
A system restart will finalize the configuration.
Disable Timestamps – Last Access Time: On heavily utilized NTFS volumes, the last access time stamp can impact performance.
This can be addressed by adding a DWORD value NtfsDisableLastAccessUpdate under `HKEY_LOCAL_MACHINE\SYSTEM\Current
