Customer Archives – SCIAT AFRICA

Understanding Anti-Forensic Techniques

Onyonka Maeri — Tue, 08 May 2018 04:09:50 +0000

Anti-forensics is a term that encompasses actions taken to manipulate or alter evidence, aiming to hinder the effectiveness of forensic investigations in criminal cases. In the context of cyber breaches, anti-forensics typically serves the following objectives:

Evading detection and obstructing the collection of crucial information.
Prolonging the analysis time required by digital forensic experts.
Disrupting or rendering digital forensic tools ineffective.
Preventing, circumventing, or erasing logs to conceal traces of unauthorized access or tool execution.

1. Timestamps

In the world of digital forensics, timestamps play a pivotal role in tracking and analyzing activities on a computer system. However, threat actors often employ anti-forensic techniques to tamper with these timestamps in a bid to cover their tracks and evade detection. This article, brought to you by SCIAT AFRICA, delves into the realm of timestamp manipulation and explores the methods employed by attackers to subvert forensic investigations. Understanding Timestamps in NTFS In the NTFS (New Technology File System) used by Windows operating systems, various timestamps are associated with files and folders. These timestamps provide valuable information about when a file was created, accessed, modified, and when its Master File Table (MFT) registry was last updated. The four key timestamps are:

Modification Time (M-time): Indicates when a file’s content was last modified.
Access Time (A-time): Records the last time a file was accessed or opened.
Creation Time (C-time): Marks the moment a file was originally created.
MFT Registry Modification Time (MACE or MACB): Reflects the time when changes were made to the file’s Master File Table entry.

Anti-Forensic Tools and Techniques

TimeStomp:
- TimeStomp is an anti-forensic tool that focuses on modifying timestamp information inside the $STANDARD_INFORMATION attribute of a file.
- It should be noted that TimeStomp does not alter the timestamp information within the $FILE_NAME attribute, which can be used to identify suspicious activity.
USN Journal Analysis:
- The USN Journal (Update Sequence Number Journal) is a feature within NTFS that maintains a record of changes made to the file system.
- Anti-forensic practitioners can examine the USN Journal to identify modifications made to files and folders.

$LogFile Inspection:
- All metadata changes within an NTFS file system are logged in a file named $LogFile.
- Tools can be used to parse this log and identify alterations to timestamps, including:
  - CTIME (File’s creation time)
  - ATIME (File’s modification time)
  - MTIME (File’s MFT registry modification time)
  - RTIME (File’s access time)

$STANDARD_INFORMATION and $FILE_NAME Comparison:
- One method for uncovering suspiciously modified files involves comparing timestamps between the $STANDARD_INFORMATION and $FILE_NAME attributes, looking for inconsistencies.
Nanoseconds Precision:
- NTFS timestamps possess a remarkable precision of 100 nanoseconds. Any files with timestamps like ‘2010-10-10 10:10:00.000:0000’ raise suspicions due to this precision.
SetMace:
- SetMace is an anti-forensic tool capable of modifying both the $STANDARD_INFORMATION and $FILE_NAME attributes. However, on Windows Vista and later versions, a live OS is typically required to perform such modifications.
Data Hiding in Slack Space:
- NTFS allocates data in clusters, potentially leaving unused slack space within a file.
- Tools like ‘slacker’ enable data to be hidden in this otherwise unutilized space.
- Recovery tools like FTK Imager can be employed to retrieve the hidden data, which may be obfuscated or encrypted.

These techniques represent the attacker’s arsenal when it comes to tampering with timestamps in an effort to thwart digital forensics investigations. As forensic experts continue to refine their methods, it remains a constant challenge for cybercriminals to cover their tracks effectively.

2. Data Hiding

In the world of digital forensics, uncovering the truth is often a matter of deciphering hidden data. Threat actors employ a variety of techniques to obscure crucial information, making the investigator’s job more challenging. In this comprehensive blog, we delve into the realm of data hiding, exploring various methods employed by cybercriminals to conceal their tracks.

Understanding Data Hiding

In the digital realm, data hiding refers to the art of concealing information to make its detection difficult. There are several key techniques used for data hiding, including data obfuscation, encryption, steganography, and hiding data in non-allocated areas. **1. Data Hiding in Non-Allocated Space

NTFS (New Technology File System) allocates data in clusters, leaving unused slack space within a file. When a file occupies less than a whole cluster, the remaining space remains unutilized until the file is deleted. Cybercriminals can exploit this unused space to hide data effectively.
Tools like ‘slacker’ provide the means to hide data in this ‘hidden’ space, making it challenging for investigators to discover.
It’s important to note that while data can be hidden in slack space, an analysis of system logs such as the $logfile and $usnjrnl can reveal the addition of data, raising suspicions.

2. Encryption as a Data Hiding Technique

Encryption serves as a powerful method for data hiding. The Lazarus group, for instance, utilized encryption in their operations.
They divided their malware into three parts: the loader, encrypted PE files, and encrypted configuration files.
The loader decrypts encrypted PE files and loads them into memory. These encrypted PE files run in memory, decrypting configuration files to communicate with a Command and Control (C2) address.
Encrypted configuration files contain vital C2 information.
To evade detection, the Lazarus group transmitted both the configuration file and the PE file in encrypted forms. These files operate after decryption in memory by the loader, enabling them to receive additional files from the C2 and carry out malicious actions.

Additional Forms of Data Hiding

The Lazarus group employed various tactics to hide their malware effectively. Some of these methods include: 1. Using System Folders for Concealment

Cybercriminals often use system folders as a hiding place for their malware. Default system folders, which are hidden by default, become prime locations for concealing malicious code.
The Lazarus group created folders with names similar to default folders or disguised their malware as normal files within hidden system folders.
Key system folders used for concealment include:
- C:\ProgramData\
- C:\ProgramData\Microsoft\
- C:\Windows\System32\
The C:\ProgramData folder, for instance, is a default system folder hidden by default. Cybercriminals would either create a similar folder within this directory or disguise malware as a normal file inside a default hidden folder.

Unveiling the Hidden Truth

In the world of digital forensics, uncovering hidden data is a constant challenge. Cybercriminals employ sophisticated techniques, including data hiding in non-allocated space and encryption, to evade detection. As forensic experts continue to refine their methods, the cat-and-mouse game between investigators and threat actors remains ongoing. Understanding these data hiding techniques is a critical step towards staying one step ahead in the battle against cybercrime.

3. Unmasking USBKill

USBKill is a formidable tool in the arsenal of cyber adversaries. Designed to disable a computer upon detecting any change in the USB ports, its potential impact on an investigation is significant. Detecting this threat involves a meticulous examination of running processes and a thorough review of active Python scripts. By staying vigilant and monitoring USB activities, investigators can preemptively defend against this potential disruption.

4. Living on the Edge: Live Linux Distributions

The rise of Live Linux Distributions poses a unique challenge. These distributions operate exclusively within RAM memory, rendering traditional detection methods ineffective. However, a critical vulnerability arises when the NTFS file system is mounted with write permissions. Without this crucial access, identifying an intrusion becomes an elusive endeavor.

5. The Art of Secure Deletion

In the pursuit of obscuring digital footprints, threat actors often resort to secure deletion methods. This tactic aims to eradicate traces of malicious activities. By employing tools such as cipher /w:C, investigators can systematically remove residual data from unused disk space within the C drive. This proactive measure mitigates the risk of vital evidence being erased or obfuscated.

6. Windows Configuration: Fortifying the Bastion

The Windows operating system provides a plethora of configuration options that can be leveraged to bolster digital forensic investigations. Here are some key strategies:

Disable Timestamps – UserAssist: This registry key maintains a log of dates and hours when each executable was run. Disabling UserAssist involves a two-step process. Registry keys HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled must both be set to zero, signaling the intent to disable UserAssist. Additionally, clearing registry subtrees under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\ is essential to complete the process.
Disable Timestamps – Prefetch: While Prefetch aims to enhance system performance by saving information about executed applications, it can also be leveraged in forensics. To disable it, launch the Registry Editor (regedit.exe), navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters, and right-click to modify EnablePrefetcher and EnableSuperfetch values from 1 (or 3) to 0. A system restart will finalize the configuration.
Disable Timestamps – Last Access Time: On heavily utilized NTFS volumes, the last access time stamp can impact performance. This can be addressed by adding a DWORD value NtfsDisableLastAccessUpdate under `HKEY_LOCAL_MACHINE\SYSTEM\Current

Partnering with IT provider helps erie manufacturing company thrive in 21st century

Onyonka Maeri — Tue, 08 May 2018 03:50:53 +0000

Berman Bedding, Inc. has been in business since 1912. But when this mattress manufacturer started producing medical pads in the 1950s, it realized the need for efficient technology solutions to keep its factories humming. Operations have changed drastically in the last 60 years, and when Berman President Robert Unger realized he couldn’t be the company’s IT guy anymore, he called CMIT Solutions

With so much at stake, they turned to NanoSoft Solutions to handle their IT needs. NanoSoft not only created detailed plan to upgrade MCMS systems, but when an old modem died over a weekend, putting in jeopardy the MCMS e-mail capabilities, it was NanoSoft who came to the rescue. As Christopher Bell from MCMS says:

“I called CMIT when I was no longer good enough to be the IT guy for the company”

It’s that 24 hour/7 day a week support and commitment to service that keeps the MCMS from worrying anymore about their IT.

Via: cmitsolutions.com

Urgent Cybersecurity Alert: Microsoft Uncovers Critical Office Vulnerabilities

Onyonka Maeri — Tue, 08 May 2018 02:24:19 +0000

Introduction:

In recent times, the cybersecurity realm has been facing an unprecedented surge in malicious activities, with threat actors exploiting vulnerabilities in widely-used software products. In a groundbreaking disclosure, Microsoft has shed light on a series of severe remote code execution vulnerabilities that are posing a significant threat to both Windows and Office users. This blog delves deep into the gravity of the situation, exploring the potential consequences for businesses, and the measures required to safeguard against such threats. Furthermore, it emphasizes the need for proactive security measures and prompt patch updates to prevent any potential data breaches or system compromises.

Details of CVE-2023-36884:

The focal point of this alarming situation is the vulnerability labeled CVE-2023-36884. Microsoft’s vigilant cybersecurity team is currently investigating this critical flaw, which has the potential to enable cyber attackers to execute malicious code remotely within the victim’s system. Exploiting this vulnerability necessitates luring victims into opening a meticulously crafted Microsoft Office document, emphasizing the pressing need for enhanced user vigilance.

Phishing Campaign Targeting Defense and Government Entities:

As the investigation unfolds, Microsoft’s threat intelligence team has stumbled upon a sophisticated phishing campaign aimed at defense and government entities across Europe and North America. The cybercriminals behind this nefarious campaign have exploited the CVE-2023-36884 vulnerability by deploying Microsoft Word documents that leverage lures related to the Ukrainian World Congress. This disclosure not only underscores the severity of the situation but also serves as a stern reminder to organizations to fortify their cybersecurity defenses to thwart potential attacks.

The Imminent Patch Tuesday Challenge:

The upcoming Patch Tuesday looms large, with Microsoft preparing to release a massive set of over 130 documented security fixes for the Windows ecosystem. Among these vulnerabilities, nine have been classified as ‘critical,’ signifying the highest level of severity. Industry experts sound the alarm, highlighting that some of these bugs are already being actively exploited. Such a record-breaking number of security patches raises concerns about businesses’ ability to keep pace with the rapidly evolving threat landscape.

Adobe’s Swift Response:

Adobe, a prominent software manufacturer, is also grappling with a surge in cyber threats. Consequently, they have issued critical patches to address security flaws within their InDesign and ColdFusion product lines. By addressing a code execution flaw and multiple memory safety bugs in InDesign, Adobe aims to mitigate potential memory leak issues and enhance the software’s overall security. Additionally, Adobe has acted promptly to resolve three security defects in ColdFusion versions 2023, 2021, and 2018, reiterating the significance of timely updates to safeguard against potential vulnerabilities.

Conclusion:

As the cybersecurity landscape continues to witness an unprecedented surge in critical vulnerabilities, it becomes imperative for organizations to adopt a proactive approach to protect their sensitive data and systems. Microsoft’s disclosure of the CVE-2023-36884 Office vulnerability serves as a wake-up call for businesses to fortify their defenses and stay vigilant against emerging cyber threats. Timely application of security patches remains paramount to mitigating potential risks and ensuring a safer digital environment for everyone. The swift response by Adobe in addressing their own security flaws highlights the significance of continuous efforts by industry leaders to safeguard their software products.

In the face of relentless cyber attacks and exploitation of vulnerabilities, staying informed, proactive, and committed to cybersecurity measures is not just a matter of good practice but an essential duty for organizations worldwide. By fostering a robust cybersecurity culture and embracing cutting-edge security technologies, businesses can effectively fortify their defenses, protect their valuable assets, and ensure a safer digital future for all.