[How to] GPG and Signing Data

GNU Privacy Guard (GPG) uses public and private keys to secure communications (public-key cryptography). Many people use it to encrypt their email or other documents. An email encrypted with a user's public key can then only be decrypted with the same user's private key. This provides end-to-end encryption of the message, meaning that it is impractical for anyone that is listening in on the conversation to get the message in transit.

This is, of course, good and bad. For example, Google and other email providers use email text to gain intelligence about the user, sell user information and do better ad targeting. This revenue stream keeps these services free, but users pay for it in terms of 'sold' privacy. Email using end-to-end encryption cannot be analyzed for useful marketing information. Because of this, these providers don't want to make it easy for mass encryption.

On the other hand, criminals also use Cloud-based email services. Making encryption somewhat difficult means that sloppy criminals are less likely to use encryption. If so, they may be easier to detect and catch.

Related Book: Lucas, Michael. PGP & GPG: Email for the Practical Paranoid. No Starch Press. 2006.

Whether you are paranoid and want all your emails encrypted (good luck), or you are trying to implement a personal or business data classification policy, GPG can help with encryption requirements.

Beyond encryption, GPG is useful for signing data. This is not exactly a signature that you would put on a document. Instead it is a signature that verifies that the data is correct. The video below describes how to sign data.

Signing data lets your contacts know that the data has not been modified from the time it left your possession. Signing is NOT encryption. Everyone could see the contents. Singing just allows your contact to know the data came from you, and it is in it's original state.

Read More

[How to] Beginner Introduction to The Sleuth Kit (command line)

Today we will give a beginner-level introduction to The Sleuth Kit from command line. If this video is helpful, I highly recommend reading The Law Enforcement and Forensic Examiner's Introduction to Linux.

Read More

[How to] Installing and updating Linux in Virtualbox

Today we are going to install and update a Debian-based operating system in VirtualBox as a guest operating system.

The first video goes through creating a virtual machine in VirtualBox, and installing an operating system from an ISO disk image.

The next video uses apt-get to update the software in the system, as well as ifconfig and ping to check if the network is working.

The final video shows how to install VirtualBox Guest Additions to allow multiple features inside the guest operating system.

Read More

[How To] Digital Forensic Memory Analysis - Volatility

This week we will begin with a very basic introduction into the memory analysis framework Volatility. We will use volatility to collect information about a memory image, recover the processes that were running in the system at the time of acquisition, and try to find malicious processes within the memory image. We will cover volatility in more depth in a later video.

Read More

[How To] Digital Forensic Memory Analysis - strings, grep and photorec

This week we will show how to use basic data processing tools strings, grep and photorec to start an analysis of a Random Access Memory (RAM) image, even if we currently know nothing about the image. These methods are extremely basic types of analysis, but they are also fast and can produce some interesting results.

Read More

[How To] Forensic Memory Acquisition in Linux - LiME

This week we will be using LiME to acquire a memory image in a suspect Linux system. LiME is a loadable kernel module that needs to be compiled based on the specific arch of the suspect device. We show the basics of compiling, and how to load the kernel object to copy a RAW memory image.

Read More

[How To] Forensic Memory Acquisition in Windows - FTK Imager

This week we will show you have to do a very simple Windows Memory acquisition using AccessData's FTK Imager.

Read More

[How To] Forensic Data Recovery in Linux - tsk_recover

This week we will talk about The Sleuth Kit, and specifically the tool tsk_recover. tsk_recover is a useful tool for allocated and unallocated file recovery. tsk_recover is a good quick solution, but in terms of performance, other tools tend to carve data better. I recommend using this in conjunction with other tools in an automated processing chain.

Read More

[How To] Forensic Data Recovery in Windows - Photorec

This week we will show how to use Photorec to recover data form a suspect disk image. Photorec supports the recovery of many different file types, but we will focus on jpg image recovery. Photorec works in Windows, Mac and Linux and is a useful tool for automating data recovery on suspect disk images.

Read More

[How To] Forensic Acquisition in Windows - FTK Imager

In this video we show how to do a forensic acquisition of a suspect disk using FTK Imager in Windows.

Read More

[How To] Forensic Acquisition in Linux - Guymager

This video shows how to acquire a forensic disk image of a suspect device in Linux using Guymager. Guymager is an extremely fast digital forensic imaging tool (the fastest in our experiments). It allows for the acquisition of many types of devices to RAW and Expert witness formats.

Read More

[How To] Forensic Acquisition in Linux - DCFLDD

This video shows how to use DCFLDD to acquire a disk image from a suspect device in the Linux command line. DCFLDD is an expanded version of 'dd' that supports additional features that are useful for digital forensic acquisitions.

Read More

[How To] Forensic Data Acquisition - Hardware Write Blockers

In this video we will show external write-blockers and describe how they are used to prevent writing data to suspect devices. We will talk about bottlenecks in the connection and how to make sure your acquisition is as fast as possible.

Read More

[How To] Copy a disk image to a physical hard drive using DD

In this video we show how to copy a disk image to a physical hard drive using DD in Linux. This is useful for working with live disk images (Linux live CDs), or potentially copying suspect data to an external disk for testing.

Read More

[How to] Create and verify a mutli-part disk image with FTK Imager

This video shows how to make a disk image using FTK Imager on a Windows system.

FTK Imager is an easy to use tool for copying data from suspect disks, and has other functions such as verification features and a hex view. It is a simple, stable tool that is a useful part of the beginning of an investigation.

Read More

[How-to] Load a multi-part disk image into FTK Imager

When working with multi-part disk images, it can be confusing to see if your tool has loaded all of the image or just a part. Below is one way to determine if all of your disk image has been loaded, or only the first part in FTK Imager.

Verifying your disk image

When working with your disk image, verification of the data should always be included in your workflow. In the case of a multi-part image, we should have at least two hashes:

• A hash for the total disk image
• A hash for each part of the disk image

This is especially true for raw disk images, since they have no built-in checksum like expert witness format.

A hash for the total disk image is normally created by your acquisition tool, and can be found in the acquisition report. FTK Imager does not create a hash for each part of a multi-part image.

In this case, we may need to generate our own hashes using FTK, or another tool.

Why do I need hashes for each part?

If you have a hash value for the overall disk image, then - in terms of court - you will be able to show that the suspect data has not changed from the time that the disk was first acquired. However, having hashes of each part of the image can help in one major way.

The Expert Witness Format that EnCase uses has checksums every 32KB that enables verification of parts of a disk image. If one part of a disk image changes, we can potentially still use the other parts of the image that can be verified with their checksum, even if the overall hash can not be verified.

With a multi-part RAW image, we can get similar functionality by hashing each part. Each part can then be verified, along with the overall hash. If the overall hash is not valid, hashes of each part can be used to determine what part has changed. Other parts that can be verified may still be used.

Loading a multi-part image

When many tools load a multi-part image, they may only show the filename of the first part of the image. If the tool is made 'for forensics', then the tool will likely load the entire image under the first filename. In this case, verify that the tool can:

1. Detect the full size of the original disk image
2. Can generate the correct hash value for the original image

Read More

How to print a double-side PDF booklet with a single-side printer

I only very rarely need to print something. However, printing things like grade reports and student schedules can come in handy. Since we don't have a community printer, I bought a simple single-side, black and white laserjet from Samsung (pictured). Most of the features for connecting to it, I turned off. Google cloud print, however, is surprisingly useful for printing from my phone or outside the office.

Beyond printing schedules every now and then, I would like to print research articles (PDFs) from journals and read them on the train. My Galaxy Note II makes reading PDFs possible, but not great. eBooks are much better... when will journals provide ebooks?

So the goal is, with a single-sided printer, print booklets from PDFs.

By booklets, I mean a taking a normal A4 sheet of paper, holding in landscape, and folding it in half to form a book with the 'spine' where the fold is. There are 2 pages on one sheet of paper, and we want to print on both sides, so 4 pages for 1 sheet of paper. See the picture below. The trick is page ordering.

Some software has 'booklet' mode when printing. In LibreOffice if you click on 'File-> Print' and select the "Page Layout" tab, there will be a "Brochure" option. This option will automatically order pages into a small booklet style. If you have a double-sided printer, congrats, you are done. If you have a single-sided printer, select "Page Sides->Include Front Sides / Right Pages". Then print, and put the paper back in the printer. For my printer, the paper prints on the top so I should keep the pages in the same rotation, and put the blank sides up.

"Booklet" options are easy to use if you are creating your own documents, but I want to print already created PDFs. I heard that Adobe Reader has a booklet mode, but I am on Linux and don't use Adobe Reader.

My default reader is "Document Viewer - Evince", and it does not have a booklet feature.

I came across the program "pdfbook" which basically rearranges PDF pages for you so you can print booklets. If you use pdfbook like so:

pdfbook journal-paper.pdf

It will output a pdf with 1 pages per sheet, but some of the pages are flipped over. I think this is intended for a double-sided printer. To be able to print with a single sided printer, we need to use the option '--short-edge'.

pdfbook --short-edge journal-paper.pdf

This will rearrange the pages with 2 pages per sheet, and all are facing upwards. There is just one more thing to do to print the booklet.

When printing, go to 'Print -> Page Setup Tab' and choose 'Only Print -> Even Sheets'.  Make sure that your printer says 1 page per sheet. If you print 2 pages per sheet, you will have 4 'pages' on one side of the paper.

After printing the even sheets, take the paper out of the printer. If you put the printed pages back in the printer in the order they are now, the first page will be on the bottom. We need to reverse the current order.

With the printed side facing you, put the first sheet on the table. Now put the next sheet on top of the first sheet with the printed side still facing you. Continue will the remaining sheets.

Once the sheets have been reordered, put the paper back in your printer with the printed side facing down (might be different on your printer). Now go to 'Print -> Page Setup Tab' and choose 'Only Print -> Odd Sheets'.

You will need to determine how to feed the paper into your printer, but this is the method that works for mine.

If someone were printing a lot, I may recommend getting a double-sided printer, but since I am printing less than one paper per month, this method works for me. It makes a nice little - but not too little -booklet, and saves toner and trees.

Read More

[How-To] Installing thc Hydra in Ubuntu

The steps below are how to easily install thc Hydra in Ubuntu with the majority of required libraries for common tasks. Hydra is a pretty well-known remote authentication service brute force cracker. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more. I usually use it to test web forms on apps I'm making.

Please note: The main thc-Hydra website as malicious. Do not visit there on your main system. All of the links on this page go straight to the source at github.

First you need to install git and tools to build the code. We will use this to get the source for thc-Hydra, and to update it from time to time.

sudo apt-get install git build-essential

Next, we need to get the source for thc-Hydra from github:

cd /opt/
git clone https://github.com/vanhauser-thc/thc-hydra.git
sudo chown -R [your username] thc-hydra
sudo chmod -R 755 thc-hydra

Now you should have the source code, but most likely if you install now it will be missing a lot of the libraries it needs. Install some of the most common libraries from the packages below:

sudo apt-get install zlib1g-dev libssl-dev libidn11-dev libcurses-ocaml-dev libpcre3-dev libpq-dev libsvn-dev libafpclient-dev libssh-dev

Now try to build hydra

./configure

Check the output and see if you can find any missing libraries.

./configure
make -jX
sudo make install

Here "make -jX" where X is the number of processors your system has.

Now hydra should be installed. Type which hydra to see the install location. You can test ssh with a password list with the following command:

/usr/local/bin/hydra -l root -P PW.list -f -s 22 -t 4 -e ns  127.0.0.1 ssh

Read More

[How-To] Using GnuPG to verify data using detached signatures

Many software downloads come with a signature file. You normally need to download this signature file separately. Signatures are a great way to let people know that you are the person / company that is making the software available, and that no one else has changed the data since its release.

Fig 1: Tails ISO and signature file download

We are going to use Tails Linux as an example. On their download page, you will find a link to download the Tails ISO image. This is the data we are interested in running. Think of it like the main program that we want to install / use.

Next, we are given a link to the "Tails 1.4 signature". This is signature file that the distributor created. With this signature we can verify that the Tails ISO Image has not been modified by anyone else.

Tails also provides a "SHA256 Checksum". This is a less-rigorous way than signatures to verify the data has not changed.

First, download the ISO file AND the signature file. The signature file will almost always end with ".sig". Make sure both files are in the same directory.

Once you had both files, open the command line / terminal and navigate to that directory. Next we need to use gpg to verify the signature. If we try to verify now, we may get the following results:

gpg2 --verify tails-i386-1.4.iso.sig gpg: assuming signed data in 'tails-i386-1.4.iso'
gpg: Signature made Tue 12 May 2015 02:56:27 AM KST using RSA key ID 752A3DB6
gpg: Can't check signature: No public key

In this case, we also need to get the public key of the person that created the signature. From the tails website, I find the ID of their signing key, so now we need to import.

gpg2 --recv-keys A490D0F4D311A4153E2BB7CADBB802B258ACD84F
gpg: key 58ACD84F: public key "Tails developers (offline long-term identity key) " imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: next trustdb check due at 2017-01-09
gpg: Total number processed: 1
gpg:               imported: 1

Make sure we have the right key:

gpg2 --list-keys
pub   rsa4096/58ACD84F 2015-01-18 [expires: 2016-01-11]
uid       [ unknown] Tails developers (offline long-term identity key) 
sub   rsa4096/752A3DB6 2015-01-18 [expires: 2016-01-11]
sub   rsa4096/2F699C56 2015-01-18 [expires: 2016-01-11]

Now verify the signature again:

gpg2 --verify tails-i386-1.4.iso.sig gpg: assuming signed data in 'tails-i386-1.4.iso'
gpg: Signature made Tue 12 May 2015 02:56:27 AM KST using RSA key ID 752A3DB6
gpg: Good signature from "Tails developers (offline long-term identity key) " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
     Subkey fingerprint: BA2C 222F 44AC 00ED 9899  3893 98FE C6BC 752A 3DB6

Here we can see when the signature was made, and the ID of that key. Next we see "Good signature" which means that the signature does verify the data.

Remember, we were given the SHA256 value of the ISO file. Get the SHA256 hash with the following command (linux):

sha256sum tails-i386-1.4.iso
339c8712768c831e59c4b1523002b83ccb98a4fe62f6a221fee3a15e779ca65d  tails-i386-1.4.iso

Now can can compare this hash value to the one on the website, and we see that they are the same.

If I can just check the hash value, why verify with a signature?

Hash values do allow you to make sure that the data has not changed, however, there are a number of weaknesses. For example, someone intercepting your network traffic could deliver the web page to you with an altered ISO link AND an altered hash value on the page. This means that the hash value will be valid, but the source of the information cannot be trusted.

Signatures help this in a number of ways. Because the signature is generated by a developer's private key, and we are verifying it with their public key, it is nearly impossible for someone to pretend to be the developer. Also, since we did not download the public key from the webpage, but looked it up on a different server, it is slightly more difficult for someone to trick us into download the wrong key. Further, we can try to use the Web of Trust to make sure we are getting the right key. In our case, we can see who has signed this key by going to a keyserver checking.

Read More

Clearing USB disk read cache for testing and forensics in Linux

When copying data from USB devices in Linux (Debian / Ubuntu), you may have noticed that reading data from the disk the first time takes a while, and reading the second time takes only a few seconds.

For example:

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 2m58.620s
user 0m7.032s
sys 0m1.429s

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 0m3.467s
user 0m3.285s
sys 0m0.181s

Here the first read took 2 minutes 58 seconds, while the second took only 3 seconds.This is because all data on the disk is cached to memory when read the first time. In cases where the disk may change between reads, caching may return results that are not consistent with the current state of the disk (like a hash).

When looking how to disable read cache, I found a lot of information about disabling write cache, but not a lot about disabling read.

To disable write cache (if supported) for the current session that the device is plugged in:

sudo hdparm -W 0 /dev/[device]

But this does not solve our read cache problems. Unfortunately, I could not find a way to completely disable read cache, but we can clear the cache buffer.

First, determine the path to echo with

which echo

Then we want to tell the kernel to drop caches. To do this, we need to echo a value to /proc/sys/vm/drop_caches.

To free pagecache:
 echo 1 > /proc/sys/vm/drop_caches
To free reclaimable slab objects (includes dentries and inodes):
 echo 2 > /proc/sys/vm/drop_caches
To free slab objects and pagecache:
 echo 3 > /proc/sys/vm/drop_caches

So our echo command to clear all caches should look like:

sudo sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches"

Note: You probably cannot echo directly to drop_caches with sudo - you should be root. The work-around to that is wrap the whole command in sudo. Make sure you are putting the full path to echo on your system.

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 3m18.294s
user 0m6.389s
sys 0m1.390s

joshua@Apollo /media/joshua/ucdntfs $ sudo sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches"

joshua@Apollo /media/joshua/ucdntfs $ time sudo md5sum /dev/sdf1
3a698f0c3155e494274e5e7829f4d246  /dev/sdf1

real 3m18.344s
user 0m6.545s
sys 0m1.438s

If you use it a lot, like me, you might want to make an alias:

alias clearusbcache="sudo sh -c '/bin/echo 3 > /proc/sys/vm/drop_caches'"

If you want to clear the cache in the background while running experiments, you can try this script:

#!/bin/bash
while true; do
   /bin/echo 3 > /proc/sys/vm/drop_caches
   sleep 1
done

Read More