Zero day methodology

Why do we need to wait until something happens to us or until someone else reports a problem in order to react?  It is a bad methodology to teach for the next generation of cybersecurity professionals.  Critical thinking is essential in battling the unknown.  There is really no unknown methods of compromising systems, only lack of interest to find out how legitimate methods can be used against us.

For example, we need to deploy the old Art of War methodology of knowing ourselves and knowing our enemy.  Our enemy is the youtube generation that gets its education from watching someone else and only learning what that presenter wants them to learn.  In the evolution of a cybersecurity professional, there are three phases:

1. Awareness: What    --  This is the phase that every one knows from the news and some intrigued enough to start learning about it.

2. Training: How   --  In this phase is where the youtube generation start getting the idea on how to do things, but do not understand enough to be valuable, only dangerous.

3. Education: Why  --  This is the phase where an interested and trained person can become very valuable if educated enough and asked enough why question along the way.

Let me give you an example:

What is a trained incident responder or forensic investigator taught to do in a case of an incident?  Preserve evidence by collecting volatile data.  The better trained might also remember what the OOV stands for and not just run a script that was given to him/her 5 minutes before.  ( Order Of Volatility ) So, that might include the opening of the terminal or CMD.EXE.  Some might even learn about the concept of BYOC ( Bring Your Own Code ) because we should not trust anything on the compromised system.  We might also know that Microsoft protects CMD.EXE and it is harder these days to replace it with a malicious version.  But only those that are educated in this field would dig further into what can be done with CMD.EXE.  Can a malicious user do something while the incident responders trying to collect and preserve evidence?  Have you ever looked at the help of CMD.EXE?

Short example from the CMD.EXE help:
If /D was NOT specified on the command line, then when CMD.EXE starts, it looks for the following REG_SZ/REG_EXPAND_SZ registry variables, and if either or both are present, they are executed first.

    HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
        and/or
    HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun

Some thirteen year old might read this one night and might ask the question about how to use this and what is possible with this value.  Go ahead and create this value and assign notepad.exe to it.  Notepad.exe will run every time you launch CMD.EXE.  That means that someone can write a short script to delete or modify any relevant data area that might contain valuable artifacts for investigations.

So, now what if someone would create a simple script file with the following entries and would modify the registry to launch when CMD.EXE is executed?

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths /f
reg delete "HKCU\Software\Microsoft\Internet Explorer\TypedURLs" /f

This would not be a malware detectable by protection mechanisms in place, it is a settings that might be set by the network administrator as part of the policy.  This could be a simple AutoIt script received in email or on a thumb drive.  The main point is, the very act of opening CMD.EXE would eliminate artifacts by the first responder action that might be interpreted by the analyst as a intentional data elimination by the suspect. Identifying false positives and eliminating false negatives can only be done by a well educated professional and not by a "bootcamp junky" or a paper certificate holder.

Those in the cybersecurity field are forced to learn every day not just by reading published documents, but thinking like their adversary.  The best education one can receive is the methodology development that enables the person to monitor, evaluate, and analyze systems without help from an outside source.  This can be achieved by knowing the basics - reading and thinking.

I was once ( CEIC 2008 ) lucky to listen to astronaut James A. Lovell when he was talking about his ordeal aboard Apollo 13.  He was in a sophisticated machinery that was nothing without electricity and his education of the basics like constellations and star positions allowed him to steer the not so smart machinery back toward earth.  That was not luck or training or awareness, that was his education in action!  That was his and might be the world's first zero day incident response.

PowerShell performance testing

We all remember LogParser as an amazing little tool that "could" and after Vista, it could not.  So, what other alternatives we have these days?  That question triggered me to look into "wevtutil" since its documentation talks about the possibilities of running queries, exporting, archiving, and clearing logs.  

We can clear a single log by wevtutil cl Security, but we have many logs on systems to manage.  It is also possible in an event of system compromise to clear all the logs by the intruder.  So, how would one clear all logs in a simple and easy step?  Use ProwerShell most likely or a DOS for loop might suffice.

I wanted to look at PowerShell and its capability to do this task.  It can actually do this very easily by a single line of command:

wevtutil el | Foreach-Object {wevtutil cl "$_"}

The el parameter enumerates all logs on the system, so that output can be used to send each log name to wevtutil to clear each log.  

It is nice, but I also wanted to know how many of these logs I have on my system.  So, PowerShell was the natural choice for this task.  A few minutes of search on the Internet revealed that there are many ways to count objects in PowerShell.  This is where the true investigator gene triggered in my head and wanted to find out their differences.  

Digital Forensics is partially a field of inductive reasoning where each step of the reasoning needs to be reliable and scientifically tested in order to come to a reliable conclusion.  It will never be as reliable as deductive logic, but well tested methodologies can make it as reliable as the latest knowledge allows us.  


One benefit of education is the ability to test tools and make heuristic decisions when using them.  In some cases, we might even determine a suspect education level and sophistication of attacks that we might be facing if we could capture and analyze the code he/she uses in reconnaissance.  After all, we need to connect a human to a technical action in order to call this field a science.

But that is enough.

I decided to test three methods of counting.  I needed a large set of objects to iterate through in order to see a trend.  I decided to count the number directory entries on my system drive.  That should be large enough to see any emerging trend.  I have stopped all unnecessary services on my system to create  stable environment and to establish a baseline.  I will be monitoring one process, but wanted to make sure nothing interferes with my system while testing.  I ran PowerShell as an administrator and ran each command three times with a little pause in between each command.  

I was not surprised about the similarity of the I/O operations since in each case the directory objects needed to be accessed, but the memory utilization did surprise me in the third case.  It seems like the third method gathers all file objects before counting them at the end.  The first two methods seem to pick up an object increment a counter and then drop the object while the third method picks up all objects and hangs on to them before determine their count.

The commands I tested:

I.   Get-ChildItem -recurse -EA SilentlyContinue|measure

II.  Get-ChildItem -recurse -EA SilentlyContinue|foreach-object { $count++}

III. (Get-ChildItem -recurse -EA SilentlyContinue).count

      $count

Note: the -EA SilentlyContinue parameter was used to suppress error messages since there are some directories that not even an administrator can access.  I first ran a few tests without this parameter, but the errors were annoying, so I decided to add the parameter later on.  It is the part of the scientific method to evaluate and to adjust procedures along the way.

It might never be interesting in an actual investigation, but in order to develop a pattern recognition skill, this type of exercises can develop investigators that are not just logical thinkers, but problem solvers who will not just pick up the first tool he/she finds and treat it like an IT person would just to get the job done, but ensures the best and most reliable methods in investigations.  By the way, all three tools did find the same amount of directory entries and they did compete the task in the same amount of time.  

References:
http://technet.microsoft.com/en-us/library/cc732848.aspx
http://technet.microsoft.com/en-us/library/ee176841.aspx

Malware analysis basics

Malware can be complicated and hard to analyze without years of experience and a computer science degree.  Not all malware created equal and the best way to learn about malware is to look at some easy malware deployment methods to develop pattern recognition and critical thinking. 

Old methods die hard and this example explores the way malware still uses hosts file hijacking that's been around since the dawn of the Internet.  This example also explores basic registry modification malware can perform in order to make the hosts file and the infestation consistent on the local system.

Analysis is logic and not magic!!!

http://youtu.be/suG8NafYI3E

GPS Tracking

The news item "MH370: FBI investigators to examine flight simulator used by pilot" triggered this video to show how Google Earth, metadata, and GPS coordinates can be used to create a very visual trace of "indirect" suspect actions.

http://youtu.be/cddm4e9YClA

Daylight Savings Time Exploration

Daylight savings time change and operating system adoption to the change as well as file system and application logs can "eat your lunch" if you are not prepared for in case analysis.  User actions are the artifacts that you are supposed to reveal, but being off an hour in your analysis can be devastating to the case.  So, don't just read and understand registry keys and the concept of time change, but be able to verify the way the changes will take effect before you are faced with a case with this issue.

Monitor the changes over night as they happen

March and November are the months that gives you the opportunity to test the effects of daylight savings time changes in real time.  A day before the change, you can create a simple batch file to create files on your system one minute at a time.  It will create the files as the time rolls over and the daylight savings time takes effect. 

Create the following batch file and schedule it to run from 11PM to 4AM

REM schedule with
REM C:\Windows\system32>schtasks /create /TN daylight_change /SC MINUTE /MO 1 /TR c:
\monitor.bat /SD 03/08/2014 /ED 03/09/2014 /ST 23:00 /ET 04:00
REM if not using /K to terminate the task, then you can manually remove it
REM schtasks /delete /TN daylight_change /f
REM you can schedule tasks in GUI by running
REM control schedtasks
REM or
REM taskschd.msc
@echo OFF
for /f "tokens=2-4 delims=/ " %%a in ('date /T') do set month=%%a
for /f "tokens=2-4 delims=/ " %%a in ('date /T') do set day=%%b
for /f "tokens=2-4 delims=/ " %%a in ('date /T') do set year=%%c
for /f "tokens=1-3 delims=:/ " %%a in ('time /T') do set hour=%%a
for /f "tokens=1-3 delims=:/ " %%a in ('time /T') do set minute=%%b
for /f "tokens=1-3 delims=:/ " %%a in ('time /T') do set tod=%%c
set time=%month%%day%%year%%hour%%minute%%tod%
dir c:\ > c:\temp\file_%time%.txt

Note: Windows XP does not support /ET and /ST must be in HH:MM:SS format i.e. 23:00:00

Code it to Learn It
Create code and understand the SYSTEMTIME structure that Microsoft uses that might be helpful in other structure analysis later as you investigate new artifacts.  Understanding structures helps you develop pattern recognition for closed source systems where low level analysis is needed.  Structures are the easier to understand for new to programming if you run some code that uses structures.  The TimeZoneInformation registry key can give you a good example of SYSTEMTIME usage and you can use the values to verify your understanding of structures as they are stored.  Pay attention to data types especially the size of WORD.  You can compile the following code in Visual Studio that should be free to download for students from DreamSpark ( https://www.dreamspark.com/ ) or use a free compiler like Dev-C++ ( http://sourceforge.net/projects/orwelldevcpp/ )

 Always use reliable resource as you form your opinion on how data structures work by reading the vendor or developer's documentation and not someone else's interpretation.

http://msdn.microsoft.com/en-us/library/ms724950(v=VS.85).aspx

/*
Read time zone information from registry
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation
Value 2
  Name:            StandardStart
  Type:            REG_BINARY
  Data:           
00000000   00 00 0b 00 01 00 02 00 - 00 00 00 00 00 00 00 00
Value 6
  Name:            DaylightStart
  Type:            REG_BINARY
  Data:           
00000000   00 00 03 00 02 00 02 00 - 00 00 00 00 00 00 00 00
Understand the SYSTEMTIME structure
          typedef struct _SYSTEMTIME {
                WORD wYear;                // 1601 - 30827 
                WORD wMonth;               // Jan(1) - Dec(12)
                WORD wDayOfWeek;           // Sun(0) - Sat(6)
                WORD wDay;                 // 1 - 31
                WORD wHour;                // 0 - 23
                WORD wMinute;              // 0 - 59
                WORD wSecond;              // 0 - 59
                WORD wMilliseconds;        // 0 - 999
         } SYSTEMTIME, *PSYSTEMTIME;
*/
//Experiment with time values
#include <windows.h>  // GetSystemTime, GetLocalTime, SYSTEMTIME
#include<iostream>    //cin , cout, endl
//#include <stdio.h>  //printf
#include <fstream>    // ifstream, ofstream - file stream handling
#include <ctime>      //time_t, time(), localtime()
#include<iomanip>     //setw(), setfill()
using namespace std;
int main()
{
    ofstream outFile;
    //log the file times into c:\temp\time_output.txt by appending the values
 outFile.open("c:\\temp\\time_output.txt",ios::app);
 SYSTEMTIME st, lt;
   
    GetSystemTime(&st);
    GetLocalTime(&lt);
   
    //printf("The system time is: %02d:%02d\n", st.wHour, st.wMinute);
    //printf(" The local time is: %02d:%02d\n", lt.wHour, lt.wMinute);
   
    cout<<"The system time is: "<<setw(5)<<st.wHour<<":"<<st.wMinute<<endl;
    cout<<" The local time is: "<<setw(5)<<lt.wHour<<":"<<lt.wMinute<<endl<<endl;
   
    outFile<<"The system time is: "<<setw(5)<<st.wHour<<":"<<st.wMinute<<endl;
    outFile<<" The local time is: "<<setw(5)<<lt.wHour<<":"<<lt.wMinute<<endl;
   
    outFile.close();
/*  
   struct tm {
  int tm_sec;   // seconds of minutes from 0 to 61
  int tm_min;   // minutes of hour from 0 to 59
  int tm_hour;  // hours of day from 0 to 24
  int tm_mday;  // day of month from 1 to 31
  int tm_mon;   // month of year from 0 to 11
  int tm_year;  // year since 1900
  int tm_wday;  // days since sunday
  int tm_yday;  // days since January 1st
  int tm_isdst; // hours of daylight savings time
}
*/

   // current date/time based on current system
   time_t now = time(0);
   cout << "Number of seconds since January 1, 1970: " << now << endl<<endl;
   tm *ltm = localtime(&now);
  
      // print various components of tm structure.
   cout << " Year: "<<setw(11)<< 1900 + ltm->tm_year << endl;
   cout << "Month: "<< setw(11)<<1 + ltm->tm_mon<< endl;
   cout << "  Day: "<<setw(11)<<  ltm->tm_mday << endl;
   cout << " Time: "<<setw(5)<< 1 + ltm->tm_hour << ":";
   cout << 1 + ltm->tm_min << ":";
   cout << 1 + ltm->tm_sec << endl;
  
    return 0;
}

Note: Newer compilers will not allow to use deprecated function localtime().  Use localtime_s() instead.
struct tm timeinfo;
localtime_s(&timeinfo, &now); 
        cout << " Year: " << setw(11) << 1900 + timeinfo.tm_year << endl;


UTC time stamps provide a more consistent view of file metadata.

Filename	Size (bytes)	Created	Modified	Accessed
file03092014-01_54_AM.txt	102262	2014-Mar-09 07:54:00.171875 UTC	2014-Mar-09 07:54:00.203125 UTC	2014-Mar-09 07:54:00.203125 UTC
file03092014-01_55_AM.txt	102262	2014-Mar-09 07:55:00.156250 UTC	2014-Mar-09 07:55:00.187500 UTC	2014-Mar-09 07:55:00.187500 UTC
file03092014-01_56_AM.txt	102262	2014-Mar-09 07:56:00.156250 UTC	2014-Mar-09 07:56:00.187500 UTC	2014-Mar-09 07:56:00.187500 UTC
file03092014-01_57_AM.txt	102262	2014-Mar-09 07:57:00.156250 UTC	2014-Mar-09 07:57:00.187500 UTC	2014-Mar-09 07:57:00.187500 UTC
file03092014-01_58_AM.txt	102262	2014-Mar-09 07:58:00.156250 UTC	2014-Mar-09 07:58:00.187500 UTC	2014-Mar-09 07:58:00.187500 UTC
file03092014-01_59_AM.txt	102262	2014-Mar-09 07:59:00.156250 UTC	2014-Mar-09 07:59:00.187500 UTC	2014-Mar-09 07:59:00.187500 UTC
file03092014-03_00_AM.txt	102262	2014-Mar-09 08:00:00.156250 UTC	2014-Mar-09 08:00:00.187500 UTC	2014-Mar-09 08:00:00.187500 UTC
file03092014-03_01_AM.txt	102262	2014-Mar-09 08:01:00.156250 UTC	2014-Mar-09 08:01:00.187500 UTC	2014-Mar-09 08:01:00.187500 UTC
file03092014-03_02_AM.txt	102262	2014-Mar-09 08:02:00.265625 UTC	2014-Mar-09 08:02:00.328125 UTC	2014-Mar-09 08:02:00.328125 UTC
file03092014-03_03_AM.txt	102262	2014-Mar-09 08:03:00.156250 UTC	2014-Mar-09 08:03:00.187500 UTC	2014-Mar-09 08:03:00.187500 UTC
file03092014-03_04_AM.txt	102262	2014-Mar-09 08:04:00.156250 UTC	2014-Mar-09 08:04:00.187500 UTC	2014-Mar-09 08:04:00.187500 UTC

Windows 8.1 Volume Shadow Copies and File History

Volume shadow copy analysis is not new to investigations, but the new feature of tracking file changes away from volume shadow copies in Windows 8.1 can lead to a new evidence collection methodology.  Files on the systems drive are still protected by the process of creating a restore point, but file history can also create another copy of files from the system partition.  Turning on the system protection does not give an option anymore to create just a system restore point or one that also includes files.  Clicking "Create..." will only allow you to name the manual restore point.

File history is a service that is new to Windows and it is not enabled by default, most likely, since a dedicated drive needs to be selected to host the history of files.

The service is created to "Protects user files from accidental loss by copying them to a backup location".

It creates a folder structure resembling the actual hierarchical structure of the original file location including the name of the machine where it came from.

T:\>tree FileHistory

Folder PATH listing for volume VOLUME_NAME

Volume serial number is ####-####

T:\FILEHISTORY

└───<UID>

      └───<MACHINE_NAME>

           ├───Configuration

           └───Data

                 └───C

                       └───Users

                            └───<UID>

                                  ├───Contacts

                                  ├───Desktop

                                  ├───Documents

                                  ├───Favorites

                                  │     └───Dell

                                  ├───Music

                                  ├───Pictures

                                  └───Videos

By default, libraries, desktop, contacts, and favorites are backed up.  The configuration settings can be examined for the configured drive and follow the traditional mounted device analysis to locate the actual drive.

C:\Users\<UID>\AppData\Local\Microsoft\Windows\FileHistory\Configuration\Config#.xml 
Excerpt from the configuration file shows drive details where the file history will be located
<Target>
    <TargetName>ThawSpace0</TargetName>
    <TargetUrl>T:\</TargetUrl>
    <TargetVolumePath>\\?\Volume{8c66088c-9e66-11e3-8252-806e6f6e6963}\</TargetVolumePath>

System log file
C:\Windows\System32\winevt\Logs\Microsoft-Windows-FileHistory-Core%4WHC.evtx

The documents and their changes are saved in the corresponding directory marked with UTC time stamps.

T:\FileHistory\<UID>\<MACINE_NAME>\Data\C\Users\<UID>\Documents>dir

Volume in drive T is VOLUME_NAME

Volume Serial Number is F4A8-C897

Directory of T:\FileHistory\<UID>\<MACHINE_NAME>\Data\C\Users\<UID>\Documents

03/02/2014 09:29 PM 15,544 Report Template (2014_03_03 03_45_37 UTC).odt

02/26/2014 08:49 AM 83,619 Report Template (2014_03_03 03_45_37 UTC).ott

03/02/2014 09:48 PM 14,450 Report Template (2014_03_03 04_09_19 UTC).odt

02/26/2014 08:49 AM 83,610 Report Template (2014_03_03 05_04_56 UTC).odt

The default settings would suggest a long term forensic value of these files since they will be kept "forever" and backed up every hour.  Even though, I could see multiple instances of backed up files, the File History event log did not show any activity.  This process will need further investigation to learn if the default values will trigger as they are set by default and if the event log will be generated by these events.

Some people might miss the Previous Version tab in the file properties, but there is a simple way around this change in Windows 8.1, just look at the file's property using a null session.

\\localhost\c$\Users\<UID>\Documents

The above syntax will work on any drive and the file property will show the Previous Version tab, but populating it with values will also need further investigation since just creating restore points did not populate it all.

Thus, it seems like there is no backup of the file at all looking at it this way.  The old fashioned looking at the shadow volumes still works like it did in Windows 7.

vssadmin list shadows /for=c:|findstr Contained

Contained 1 shadow copies at creation time: 2/25/2014 3:15:33 PM

Contained 1 shadow copies at creation time: 2/26/2014 9:43:36 PM

Contained 1 shadow copies at creation time: 2/28/2014 2:16:11 PM

Contained 1 shadow copies at creation time: 3/2/2014 11:08:45 PM

So, the restore points exist, but the question was if the restore points contained the changes of the files or not.  To test it, I have deleted a couple of files ( Report Template.odt and .ott ) and removed them from the recycle bin.  The files were gone.

Since the shadow volumes existed, I used the Shadow Explorer to drill down into the file structure with that tool.

Sure enough, the files were still there waiting to be restored.  The time stamp was not accurate besides the oldest time stamp,  but the command line method captured them more accurately.

The command line method also allowed to access and copy the deleted files out of the volume shadow.  

C:\Windows\system32>vssadmin list shadows /for=c:|findstr GLOBALROOT

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4

Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4

C:\Windows\system32>mklink /d c:\shadow_copy3 \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\

symbolic link created for c:\shadow_copy3 <<===>> \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\

C:\Windows\system32>cd c:\shadow_copy3\Users\<UID>\Documents

c:\shadow_copy3\Users\<UID>\Documents>dir

Volume in drive C is OS

Volume Serial Number is E828-D083

Directory of c:\shadow_copy3\Users\<UID>\Documents

02/26/2014 08:49 AM 83,610 Report Template.odt

02/26/2014 08:49 AM 83,619 Report Template.ott

Conclusion

Volume shadow copies will be accessible in cases on the secondary storage devices like before, but it will be more important to also collect removable storage devices and look for File History based evidence not just as a single source, but also to validate volume shadow copy based located evidence to show human interaction with the digital data.  The long history of file changes might reveal human intention as related to digital data manipulation.  As always, understanding the process is IT, but interpreting the relevant artifacts and connecting those artifacts to human interaction is what forensic investigations are all about.  

PCI DSS Poster

This poster is a simplified version of consequences related to not being compliant with PCI DSS requirements and fine structure by credit card provider.

PCI DSS Cost of not being compliant poster