8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 1/37

Encrypting Technologies for

the Forensic InvestigatorPresented at Techno Security

Presented by James Wiebe, VP R&D CRU-WiebeTech

 james@wiebetech.com

www.CRUwww.CRU--DataPort.comDataPort.com

www.wiebetech.comwww.wiebetech.com

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 2/37

CRU-WiebeTech

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 3/37

What are we learning today?

PART 1 – BACKGROUND on Encryption, or what the badguys know (and you should know, too!)

• What is it?• Who uses it?

• Where is it found? – Bitlocker (Vista)

 – Whole Disk Encryption – Hardware based Encryption

 – Software based Encryption

• How does it work?

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 4/37

What are we learning today?

PART 2 – DEFEATING Encryption

• A clue to defeating encryption

• Surprise seizure• Key Recovery

• Password Attack via memory

• Keystroke Logging

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 5/37

Encryption – what is it?

• In cryptography, encryption is the process oftransforming information (referred to as plaintext) usingan algorithm (called cipher) to make it unreadable toanyone except those possessing special knowledge,

usually referred to as a key. The result of the process isencrypted information (in cryptography, referred to asciphertext). In many contexts, the word encryption alsoimplicitly refers to the reverse process, decryption (e.g.

“software for encryption” can typically also performdecryption), to make the encrypted information readableagain (i.e. to make it unencrypted).

-- from Wikipedia

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 6/37

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 7/37

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 8/37

Bitlocker

• Required at startup, or anytime afterscreen savers, sleep or ‘hibernation’modes have been engaged, BitLocker will

effectively stop the forensic acquisition ofhard drive data. If the investigator has nottaken precautions in advance, and if theuser has appropriately set up and invoked their encryption, it’s most likely hopeless.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 9/37

Bitlocker within Vista

• Forensic investigators must deal withissues associated with encryption andpassword protection. Bitlocker is presentin several types of Windows Vista.Bitlocker has several variations within

Vista.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 10/37

Bitlocker technology

• Vista features BitLocker. BitLocker is acollection of technologies and tools thatallows users to encrypt any hard drive

volume plugged into their Vista-poweredcomputer system. Vista utilizes a powerfulAES variant. (Microsoft is in the process of

having BitLocker certified as being FIPS140-2 compliant, an extremely tough USdata security / cryptographic standard)

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 11/37

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 12/37

Whole Disk Encryption – from Seagate; Hitachi

• Strong, transparent, hardware-based data protection to prevent unauthorized

access to data on lost or stolen systems

• Key Features and Benefits – Full disk encryption, all the time—every time

 – Convenient and easy to use—minimal configuration is required.

 – Investment protection—stolen or out-of-service drives can be repurposed and remain fullyprotected.

 – Instant encryption performance matches the throughput of the drive interface. – Supports trusted platform modules (TPM)

• Key Specifications

 – AES encryption

 – 5400-RPM performance – 2.5-inch form factor

 – SATA 1.5Gb/s with Native Command Queuing

 – 8-MB cache

• Momentus ® 5400 FDE.2• Best-in-class security for data at rest

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 13/37

Seagate’s comments on WDE

Applications• Laptop PCs• Tablet PCs• Ultra-light laptops• Performance laptops

Seagate Secure™ technology exploits drive’s closedenvironment• Transparent AES 128-bit hardware-based

• encryption• Pre-boot authentication required• CryptoErase provides fast, thorough erasing• Hashed passwords maintained on the drive• Emergency password recovery file kept on a separate device 

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 14/37

Encrypting Storage Enclosures

• In this case, an encryption engine isplaced between the host computer and the

hard drive, most likely in the bridge devicewhich resides inside the storageenclosure. This enclosure may be

external (looks exactly like a desktopdrive) or internal (looks like a removabletray system).

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 15/37

Software based Encryption

• I Googled “Software based encryption”,and I received 26,100 hits.

• Where to start? Nearly Impossible tosay! PGP, Symantec, McAfee,

thousands more.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 16/37

Encryption Software, Cont’d, from the WWW:

• “CipherWizard provides a fast, easy, affordable way to encrypt your

data”

• “Manage USB devices & encrypt sensitive files on USB drives”

• “The most secure and cost effective disk encryption solution

available.”• “Unbeatable Data Encryption Software Buy DriveCrypt Online Now!”

• “Flexible, Robust Award Winning Software Encryption. Free SDK!”

• “Automatic Data Encryption With No User Involvement. See FreeDemo!”

• “Protect Your Reputation With The Industry's Most CompleteSolution.”

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 17/37

Encryption – How does it work?

• A common misunderstanding of encryption is thatthe presentation of the encrypting key provides‘permission’ for the encrypting hardware to passdata from the storage media to the user. In other

words, encryption acts as a key based gatekeeperto data. This is a broken and useless analogy! Theusefulness of encryption is that the user’s key is, infact a vital part of the encrypting and decrypting

algorithm. In the absence of the key, the algorithmis mathematically incapable of operating, and willonly product chaotic binary noise.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 18/37

Encryption – How does it work?

• Wrong Explanation:

• Plain Text is ‘hiding’ behind a pass key. In fact,there is no plain text anywhere in the encrypted file.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 19/37

Encryption – How does it work, cont’d.

• Better Explanation:

• Plain Text in: JamesWiebe

• Key is: +1

• Encrypted out: KbnftXjfcf

• EXCEPT!!! The key affects every bit, and there are

128 of them (or 256, or 1K…) and the math issomewhat complicated

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 20/37

Encryption – How does it work, cont’d.

• This helps us understand how we can ‘attack’ anencrypted file – keep trying keys until plain text popsup.

• Ah, but what about the dreaded massively distributed cracking brute force method forattacking something like 128 bit RC5 encryption? There are massive zombie farms

of infected computers throughout the world and some may have gotten as big as 1million infected computers. What if that entire army was unleashed upon thecommonly used 128 bit RC5 encryption? Surprisingly, the answer is not much. Forthe sake of argument, let’s say we unleash 4.3 billion computers for the purpose of

distributed cracking. This means that it would be 4.3 billion or 2 to the 32 times fasterthan a single computer. This means we could simply take 2 to the 128 combinationsfor 128-bit encryption and divide it by 2 to the 32 which means that 2 to the 96 bitsare left. With 96 bits left, it’s still 4.3 billion times stronger than 64 bit encryption. 64bit encryption happens to be the world record for the biggest RC5 bit key cracked in

2002 which took nearly 5 years to achieve for a massive distributed attack.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 21/37

Encryption – How does it work, cont’d.

• Now that we know that the distributed attacks will only shave off a few bits, what about Moore’slaw which historically meant that computers roughly doubled in speed every 18 months? Thatmeans in 48 years we can shave another 32 bits off the encryption armor which means 5 trillion

future computers might get lucky in 5 years to find the key for RC5 128-bit encryption. But with

256-bit AES encryption, that moves the date out another 192 years before computers arepredicted to be fast enough to even attempt a massively distributed attack. To give you an idea

how big 256 bits is, it’s roughly equal to the number of atoms in the universe!

• Once some of these basic facts on encryption become clear, "is encryption crackable" isn’t the

right question because the real question is "when can it be cracked and will it matter then". This is

 just like Bank safes which are rated by the time it takes an attacker to crack it open and never soldas "uncrackable". Encryption strength and the number of bits used are selected based on how

many decades the data needs to be kept safe. For a secure E-Commerce transaction, the databeing transmitted is moot after a few decades which is why 128-bit encryption is perfectly suitable

since it’s considered unbreakable for the next few decades. For top secret classified data thatneeds to remain secret for the next 100 years, the Government uses NIST certified 256-bit AES

encryption. So the next time someone tells you that encryption is crackable, ask him if he’ll bearound on this earth to see it demonstrated. -- GEORGE OU, ZDNET

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 22/37

Encryption – a clue to defeat

• Standards and cryptographic software andhardware to perform encryption are widelyavailable, but successfully using encryption to

ensure security may be a challenging problem.A single slip-up in system design or executioncan allow successful attacks. Sometimes an 

adversary can obtain unencrypted information without directly undoing the encryption .

-- from Wikipedia

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 23/37

Defeating Encryption

• There are several ways to defeatencryption. They can be categorized intofour main groups:

- Intelligence Gathering (not discussed today)

- Surprise Seizure via Hotplug

- Key Recovery (includes suspect cooperation)

- Password Attack

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 24/37

Defeating Encryption using Surprise Seizure

• Prevent the system from sleeping, bymoving the mouse or using a mouse

 jiggler.• Image the computer in the clear, beforeencryption is invoked.

• Transport the computer, while turned on,to a lab for further investigation.

• Search the RAM for keys.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 25/37

Surprise Seizure with removal: WiebeTech’s HotPlug

• Currently in use in federal law enforcementagencies and at other law enforcement agencies

• “Lets Cops move desktops without shutting themdown.”

• Doesn’t prevent sleeping – Mouse Jiggler is alsoneeded (but included).

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 26/37

Key Recovery

• Ask the suspect to give you the key. Worth atry, right?

• Gather *everything* in the room – USB keys,

USB drives, paper, etc. The backup recoverykey is probably there somewhere.

• Follow forensic procedures for Bitlocker and

other devices.

Reference:http://www.forensickb.com/2008/01/incident

-response-recovering-bitlocker.html

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 27/37

Password (key) Attack – Ed Felten

• Today eight colleagues and I are releasing a significant newresearch result. We show that disk encryption, the standardapproach to protecting sensitive data on laptops, can be defeated byrelatively simple methods. We demonstrate our methods by usingthem to defeat three popular disk encryption products: BitLocker,which comes with Windows Vista; FileVault, which comes with

MacOS X; and dm-crypt, which is used with Linux. The researchteam includes J. Alex Halderman, Seth D. Schoen, Nadia Heninger,William Clarkson, William Paul, Joseph A. Calandrino, Ariel J.Feldman, Jacob Appelbaum, and Edward W. Felten.

- Posted Feb. 21, 2008 at http://freedom-to-tinker.com/blog/felten/new-research-result-cold-boot-attacks-disk-encryption

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 28/37

Keystroke Logging

• Software-based keyloggers

• Hardware-based keyloggers

• Wireless keyboard sniffers• Keyboard overlays

• Acoustic keyloggers

• Electromagnetic emissions (egTempest)

• Optical surveillance

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 29/37

Encryption Recap, what we know

• Encryption is widespread

• Encryption is (not) bullet proof

• Properly done, it does work well

• OS Encryption is often achieved via Bitlocker,especially in a corporate environment

• WDE via Seagate, Hitachi and others, especiallyin laptops

• Enclosure / Bay Encryption via CRU-Dataportand other competitors

• Software Encryption, via PGP and 26,099 other

companies

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 30/37

Encryption Recap, what we know

• Encryption is nearly impossible to crack viaattack

• It’s not plaintext hiding behind a passkey

• It is mathematical and well designed.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 31/37

Encryption Recap, what we know

• Plan ahead – anticipate encryption and performintelligence gathering.

• Use element of surprise – examine the computer while it

is unlocked, and keep it unlocked until imaging complete

• Look for the key, everywhere. Ask the suspect. Use“social engineering”. This is your best option.

• Keystroke Logging – many methods.

• Use a key recovery attack. Methodologies are evolving.

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 32/37

HotPlug

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 33/37

Encrypting Drive Bay from CRU-DataPort

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 34/37

Forensic RTX

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 35/37

RTX 400QR

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 36/37

Inline USB WriteBlocker(Enter to win at our booth)

8/14/2019 En Crypt Ing Technologies for the Forensic Investigator

http://slidepdf.com/reader/full/en-crypt-ing-technologies-for-the-forensic-investigator 37/37

Encrypting Technologies forthe Forensic Investigator

Presented by James Wiebe, VP R&D CRU-WiebeTech

 james@wiebetech.com

www.CRUwww.CRU--DataPort.comDataPort.com

www.wiebetech.comwww.wiebetech.com

Thanks for listening.

Your questions and comments areinvited.