Hacking Exposed Computer Forensics Blog

• A $200 Amazon Gift Card

Considering this case may involve litigation, I would stress collecting good case notes and following proven processes throughout the investigation.

To initially narrow the search of suspects, I would first check physical access badge logs to determine if anyone was in the office at 9pm.  If employees can access the Internet via this firewall when connected via VPN, I would check VPN access logs as well.

On the network side, I would begin by looking at the perimeter firewall traffic logs for mail connections to Google/gmail, specifically on ports 993/TCP (IMAP), 995/TCP (POP3), and 25/TCP or 587/TCP (SMTP) which would be used by Thunderbird.  Google may switch services between various IP ranges, but as of right now it appears most mail related addresses resolve within the 173.194.0.0/16 subnet.  It is probably a safe assumption to say Google won't move their mail services outside of this network/port range in the foreseeable future.  Once I have identified an internal IP address as communicating to Google over these ports during the window the email was received, I would look for DHCP logs or an asset inventory system to determine which internal system had the IP address at that time.

Once I have identified a suspect internal system, I would proceed with host level forensics to find the user with that account's information in his/her Thunderbird profile (assuming Win7):

- First, I would take an image of the system for investigation and evidence purposes.  I would also duplicate it for a working copy.

- I would sweep the system for directories matching "C:\Users\\AppData\Roaming\Thunderbird\Profiles\", to see which Windows logon accounts use Thunderbird.

- At this point, I would perform a raw text search of the entire contents of this directory (including "ImapMail" and "Mail") for the specific source email address in question.  If hits were found, I would focus the remainder of my investigation on this profile.

- If no hits were found, I may have to extract the usernames from all Thunderbird profiles on this system.  Considering both usernames and passwords can be decrypted with this method, I would NOT do this on a large number of potentially unrelated profiles due to privacy concerns.  Instead I would revisit my case notes to see if I can pinpoint the suspected user via other means (event log records and other filesystem activity within the same time period for example).

- Once I've identified a profile with hits, I would extract the profile folder from the disk for further investigation.  Mozilla stores the usernames and passwords encrypted in the "moz_logins" table of the "signons.sqlite" sqlite db and the encryption keys in the "key3.db" file.

- I would use a tool such as "ThunderbirdPassDecryptor" to decrypt the username/password from this profile using these files.  At that point, the source email address (and password) should be known, and the owner of the Windows profile can be considered the source.

• A $200 Amazon Gift Card

8:00am Session - Ira Winkler ' The Cyber Jungle'

10:00am session Python for web application security testing

10:30am Session - Me!

11:30am Session - Jake Williams IaaS forensics

1:30pm Session - Memory forensics with Chad Tilbury

2:30pm Session - Recovering your costs in ediscovery

1. Which system burned them

If you figured out at what time the CD’s were burned (see answer 3), check the system eventlog for event id 133, this indicates that files were burned to CD using Windows Explorer. If so, in the registry under key ”HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo”, there are keys indicating where files were staged before they were burned to the CD. You can use file system forensics to investigate what was in the folder to try to match them to the disc. You can also check the timestamp of the registry key to see at what time it was written to search more specifically.

If another tool was used, there are clues on which tool this was on the CD (see step 2). Look for indications in the prefetch, RunMRU and user assist to see if the tool has run on the system. If the tool is or used to be present, look for the temp folders or log files it produces to see if you can match it to the CD.

2. What software created the CDs

If it’s ISO9660, usually the name of the application that has created the CD is in the session start section, somewhere just after 0x8000.

3. When they were burned

If it’s ISO9660, there are a couple of timestamps indicating the time of burn in the session start section. If you have figured out on which system the discs were created, check eventlog to see if there are any events (event id 1) that indicate that the system time was changed prior to burning the disc.

4. If there were other CDs burned

If the CD’s have been burned with Windows explorer, there will be events with id 133 in the eventlog. In the registry key described in step 1 will be entries for staging folders. Examine these forensically to see if there are residues of files there.

Other burning applications also usually have a temp or staging folder for burning CD’s. You can check these folders for residues indicating that files have been burned to a CD.

5. Which user burned the CDs

In most cases, the location of the log or staging files in the users AppData folder will indicate which user created the CD’s.

If not, use the time that the CD was created to check the security event log for audit events that indicate which user was logged on to the system at the time of the creation of the CD’s. To burn a disk, a user usually needs to logon physically to the system, so look for logons of types 2 and 7 prior to burning the disc.