Upload File

employee data theft case studyto another until the case unravels. perhaps they ran grep. indeed!...

  • Home
  • Documents
  • Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder
34
Employee Data Theft Case Study Jonathan Grier ACSAC 2011

Upload: others

Post on 11-Apr-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Employee Data Theft

Case Study

Jonathan Grier

ACSAC 2011

Page 2: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Concerning

Confidentiality

To preserve client confidentiality, this

case’s circumstantial information

(names, places, dates, and settings) has

been omitted or altered.

The data and techniques presented

have not been altered.

Page 3: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Can you find the data thief?

Page 4: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Harlan Carvey, Windows Forensic Analysis, 2009

Page 5: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Harlan Carvey, Windows Forensic Analysis, 2009

No Artifacts = No Forensics

Page 6: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Harlan Carvey, Windows Forensic Analysis, 2009

No Artifacts = No Forensics ???

Page 7: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder
Page 8: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Access timestamps updates during:

Routine access

Page 9: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder
Page 10: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Access timestamps updates during:

Copying a folder Routine access

Page 11: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Copying Folders Routine Access

Nonselective All subfolders and files accessed

Selective

Temporally continuous Temporally irregular

Recursive Random order

Directory accessed

before its files

Files can be accessed

without directory

Page 12: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

COPIED NOT COPIED

Page 13: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

“slap-your-head-and-say-'doh-wish-I'd-thought-of-

that’” -- an anonymous colleague

No Artifacts Yes Forensics

Page 14: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Not so fast...

1. Timestamps are overwritten very

quickly

2. There are other nonselective,

recursive . activities (besides

copying)

Page 15: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Not so fast...

1. Timestamps are overwritten very

quickly Can we use this method months

later?

On a heavily used system?

Won’t most of the timestamps have

been overwritten?

Page 16: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Not so fast...

1. Timestamps are overwritten very

quickly Can we use this method months

later?

On a heavily used system?

Won’t most of the timestamps have

been overwritten?

YES!

YES!

Not

really!

Page 17: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Two observations:

1. Timestamps values can increase,

but never decrease.

2. A lot of files just collect dust.

Most activity is on a minority of files.

Page 18: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Farmer & Venema, Forensic Discovery, 2005

Page 19: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

At tcopying:

• All files have access_timestamp = tcopying

Page 20: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

At tcopying:

• All files have access_timestamp = tcopying

Several weeks later:

• All files have access_timestamp ≥ tcopying

Page 21: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

At tcopying:

• All files have access_timestamp = tcopying

Several weeks later:

• All files have access_timestamp ≥ tcopying

• Many files still have access_timestamp =

tcopying

Page 22: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

After 300 days of simulated activity

Histogram of access timestamps

Page 23: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Data from investigation:

Jonathan Grier, Detecting Data Theft Using Stochastic Forensics, J. Digital Investigation 2011

Page 24: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder
Page 25: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Copying creates a

cutoff cluster

cutoff – No file has timestamp < tcluster

cluster – Many files have timestamp = tcluster

Page 26: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Aren’t there other recursive access patterns besides

copying?

Affirming the

consequent A ⟶ B doesn’t prove B ⟶ A.

The absence of a cutoff

cluster can disprove

copying, but the existence

can’t prove copying.

Perhaps they ran grep.

Page 27: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Indeed, there are!

vs. Affirming the

consequent A ⟶ B doesn’t prove B ⟶ A.

Abductive reasoning An unusual

observation

supports inferring a

likely cause.

The absence of a cutoff

cluster can disprove

copying, but the existence

can’t prove copying.

Who’s trying to prove

anything?

Investigate! One clue leads

to another until the case

unravels.

Perhaps they ran grep. Indeed! Check if grep is

installed, if they’ve ever

run it before, or after, on

any folder. Check why they were still

in the building at 11 PM.

Page 28: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Implications

for the field of

forensics...

Page 29: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Page 30: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

What do I want

to know about?

What

behavior is

associated?

How does that

behavior affect

the system?

Measure

those effects.

Draw a

(quantifiable)

inference.

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Stochastic

Forensics:

Page 31: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

What do I want

to know about?

What

behavior is

associated?

How does that

behavior affect

the system?

Measure

those effects.

Draw a

(quantifiable)

inference.

Look at the

Surviving Data

Reconstruct

Previous

Data

This previous

data is our

deliverable.

Classical Forensics:

Stochastic

Forensics:

What data can we find?

What did this person do?

Page 32: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

Lesson Learned:

Forensics doesn’t really

matter...

Col. John Boyd

Military Strategist

Author, Patterns of

Conflict

Page 33: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

For more information:

• Read my paper

Detecting Data Theft

Using Stochastic Forensics http://www.grierforensics.com/datatheft/Detecting_Data_Theft_Using_Stochastic_Forensics.

pdf

• These slides will be available at http://www.grierforensics.com/datatheft/Employee_Data_Theft_Case_Study_ACSAC.pdf

• Ask me!

See next slide for my contact info

Page 34: Employee Data Theft Case Studyto another until the case unravels. Perhaps they ran grep. Indeed! Check if grep is installed, if they’ve ever run it before, or after, on any folder

I’m very interested in hearing

your

feedback, ideas, and questions.

Please share them with me

here at ACSAC.

Or, if we miss each other: Jonathan Grier

443.501.4044 x1

jdgrier at grierforensics.com


Lec 2 Grep Sed Intro

1.2.2.1.1 Perl’s sort/grep/map

Unix grep Utility CS465. The grep utility grep stands for globally search for a regular expression and print the results It is one of the most used Unix

Illumination MERTON MATHS STUDENT UNRAVELS THE …

Clustering Lecture 8: MapReduce - csce.uark.eduxintaowu/BDAM/mapreduce.pdf · Distributed Grep . Very big data . Split data Split data Split data Split data . grep grep grep grep

A Comprehensive tRNA Deletion Library Unravels the Genetic

(English) Back to the Future - Argentina Unravels

STRATEGY EXECUTION Why Strategy Execution Unravels—and ... · STRATEGY EXECUTION Why Strategy Execution Unravels—and What to Do About It by Donald Sull, Rebecca Homkes, and Charles

Flies as Ship Captains? Digital Evolution Unravels ...adamilab.msu.edu/wp-content/uploads/Tehranietal2016.pdf · Flies as Ship Captains? Digital Evolution Unravels Selective Pressures

Grep Samples

MUSE unravels the ionisation and origin of metal enriched

GREP Q1 2013 Newsletter

GREP en InDesign

gnu Grep: Print Lines Matching A Pattern - Del Maracademy.delmar.edu/Courses/ITSC1358/eBooks/Linux(grep).pdf · GNU Grep: Print lines matching a pattern ... Print the version number

Beyond accessibility: ATAC-seq footprinting unravels ... · 1 1 Beyond accessibility: ATAC-seq footprinting unravels kinetics 2 of transcription factor binding during zygotic genome

Linux and Unix Grep Command

Girls’ Right to Education Programme (GREP) in Pakistan · Girls’ Right to Education Programme (GREP) in Pakistan The Way GREP Operates In February 2014, the Government of Pakistan

GREP Q2 2013 Newsletter

Grep and Sed Commands

Doctor Demo - wiki.opnfv.orgJul 30, 2015  · 30 July 2015 Doctor demo, Santa Clara 37 tipica@d718:~$ ps aux | grep instance-00000001 | grep -v grep | sed -e 's/-smbios.*$//' libvirt+

Grep y scripts en indesign

Parathyroid-Specific Deletion of Klotho Unravels a Novel

multi-line record grep

Regular Expressions grep and egrep

Cellulose - the structure slowly unravels

GREP. Whats Grep? Grep is a popular unix program that supports a special programming language for doing regular expressions The grammar in use for software

Grep and UNIX

A deep resistivity Full Waver survey unravels the 3D

The Thai Ethnocracy Unravels

CS 471 Operating Systems Yue Chengyuecheng/teaching/materials/lec-08... · MapReduce Grep 63 Very big data Split data Split data Split data Split data grep grep grep grep matches

STRATEGY EXECUTION Why Strategy Execution Unravels—and …collierandcompany.com/.../2015/04/Strategy-Execution1.pdf · 2017-03-14 · STRATEGY EXECUTION Why Strategy Execution Unravels—and

Studyto Establish Ride Comfort Criteria for High Speed

MicroRNome Analysis Unravels the Molecular Basis of SARS ... · MicroRNome Analysis Unravels the Molecular Basis of SARS Infection in Bronchoalveolar Stem Cells Bibekanand Mallick1.,

Cell type-specific expression profiling unravels the development … · 2018. 9. 27. · RESEARCH ARTICLE Open Access Cell type-specific expression profiling unravels the development

A dynamic model for sodium intoxication unravels salt