Incident response & computer forensics

625 Pages·2014·40.711 MB·English

by  Luttgens, Jason T.;Pepe, Mathew

Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
Blind Folio: i
Incident Response &
Computer Forensics,
Third Edition
Jason T. Luttgens
Matthew Pepe
New York Chicago San Francisco
Athens London Madrid Mexico City
Milan New Delhi Singapore Sydney Toronto
00-FM.indd 1 24/06/14 3:45 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4
Copyright © 2014 by McGraw-Hill Education (Publisher). All rights reserved. Printed in the United States of America. Except
as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any
means, or stored in a database or retrieval system, without the prior written permission of Publisher, with the exception that the
program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.
ISBN: 978-0-07-179869-3
MHID: 0-07-179869-2
e-Book conversion by Cenveo® Publisher Services
Version 1.0
The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-179868-6,
MHID: 0-07-179868-4.
McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use
in corporate training programs. To contact a representative, please visit the Contact Us pages at www.mhprofessional.com.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a
trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of
infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.
Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of the
possibility of human or mechanical error by our sources, McGraw-Hill Education, or others, McGraw-Hill Education does not
guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the
results obtained from the use of such information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education (“McGraw Hill”) and its licensors reserve all rights in and to the work.
Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve
one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based
upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior
consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited.
Your right to use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR
WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED
FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA
HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. McGraw-Hill and its licensors do not warrant or guarantee that the functions contained in the work will meet your
requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you
or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom.
McGraw-Hill has no responsibility for the content of any information accessed through the work. Under no circumstances shall
McGraw-Hill and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that
result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This
limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or
otherwise.
eBook_868-4 CR.indd 1 26/06/14 2:36 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
Blind Folio: iii
For Mom and Dad, who bought me my first computer when I was
thirteen years old—a Tandy 1000 SX—in 1988.
—Jason
For Christina.
—Matt
00-FM.indd 3 24/06/14 3:45 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
Blind Folio: iv
About the Authors
Jason T. Luttgens, who has worked in information security for nearly 20 years, is a
former Technical Director for the security consulting firm Mandiant. While at
Mandiant, Jason led dozens of sensitive investigations around the globe involving
industrial espionage, cardholder data theft, and other crimes within environments as
large as 250,000 computer systems. Along with Jed Mitten, he created the log file
analysis and visualization tool Highlighter.
Prior to Mandiant, he served in NASA’s Office of Inspector General, Computer
Crimes Division, as a Technical Investigator. While at NASA, Jason’s duties included
computer forensics, incident response, research and development of forensics solutions,
forensics software and hardware testing, and training. During this time, he also
contributed to significant national-level investigations, including the 9/11 investigations.
Jason is a veteran of the United States Air Force who served in the Office of Special
Investigations (OSI) for four years. He was stationed at the Department of Defense’s
Computer Forensics Laboratory in Linthicum, Maryland, and his duties included
research and development of computer crime investigative technologies. As a Team Chief
for a four-person forensic analysis team, he personally performed computer forensic
examinations, incident response, and provided expert courtroom testimony. Prior to his
assignment with the Computer Forensics Laboratory, Jason was stationed at the 18th
Communications Squadron, Kadena Air Base, Okinawa, Japan. While at the Kadena Air
Base, he performed computer operations and systems analysis, network applications
support, network administration, engineering, security, and training functions.
Jason holds a B.S. degree in computer science from George Mason University.
Matthew Pepe has worked in the digital forensics field since 1995, when a couple of
AFOSI agents saved him from being assigned to the Pentagon. He is currently a Senior
Technical Director and founder at Mandiant. At Mandiant, he has led numerous
investigations, served as a subject matter expert on the odd and unique facets of
Mandiant’s Incident Response program, and developed the forensic capabilities that
are in place today.
Prior to Mandiant, Matt was a technical investigator and forensic examiner at
Foundstone, Trident Data Systems, Sytex, and the United States Air Force Office of
Special Investigations (AFOSI). It was during these initial years at AFOSI that he was
given the opportunity to develop analytical skills and appreciate the process by which
investigative hypotheses are developed and tested. He also learned to love active
termination of differential SCSI.
Matt holds a Bachelor of Science degree in computer engineering from The George
Washington University.
Kevin Mandia is the Senior Vice President and Chief Operating Officer of FireEye.
He founded Mandiant in 2004 and had served as the Chief Executive Officer. Prior to
Mandiant, Kevin served as the Director of Computer Forensics at Foundstone. From
1993 to 1998, Kevin was an officer in the United States Air Force, where he served in
various capacities, including as a computer security officer in the 7th Communications
Group at the Pentagon, and later as a Special Agent in the Air Force Office of Special
Investigations (AFOSI). In 2011, Kevin was named Ernst & Young Entrepreneur of the
Year for the Greater Washington area. He holds a Bachelor of Science in computer
science from Lafayette College and earned a Master’s of Science in forensic science
from The George Washington University.
00-FM.indd 4 24/06/14 3:45 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
Blind Folio: v
About the Contributors
Marshall Heilman has more than 14 years of experience in computer and information
security; more than seven of those years have been at Mandiant. He is currently a
Managing Director at Mandiant, responsible for incident response and security
assessment work. His areas of expertise include enterprise-wide incident response,
high-tech crime investigations, penetration testing, and secure network architecture
and design. He has worked many of the most damaging and public incidents
companies have experienced over the last seven years. He previously served as a Staff
Sergeant in the United States Marine Corps, where he also focused on computer and
information security.
Ryan Kazanciyan is a Technical Director with Mandiant and has 11 years of
experience in incident response, forensic analysis, and penetration testing. Since
joining Mandiant in 2009, he has led incident response and remediation efforts for
dozens of Fortune 500 organizations, focusing on targeted attacks, industrial
espionage, and financial crime. He has also helped develop Mandiant’s investigative
methodologies, forensic analysis techniques, and technologies to address the
challenges posed by skilled intruders in complex environments. As a lead instructor
for Mandiant’s incident response training, Ryan also regularly teaches classes for
corporate security teams, federal law enforcement, and at industry conferences. Prior
to his work in incident response, Ryan led and executed penetration tests for both
private- and public-sector clients. His background included red-team operations in
Windows and Unix environments, web application security assessments, and social
engineering. Ryan holds a Bachelor’s degree in computer science and a minor in
economics from Duke University.
About the Technical Editor
Curtis W. Rose is the President and founder of Curtis W. Rose & Associates LLC, a
specialized services company in Columbia, Maryland that provides computer
forensics, expert testimony, litigation support, computer intrusion response, and
training to commercial and government clients. Curtis is an industry-recognized
expert with over 20 years of experience in investigations, computer forensics, and
information security.
Curtis was a coauthor of Real Digital Forensics: Computer Security and Incident
Response, and was a contributing author or technical editor for many popular
information security books, including Handbook of Digital Forensics and Investigations,
Malware Forensics Field Guide for Windows Systems, Malware Forensics Field Guide for
Linux Systems, Malware Forensics: Investigating and Analyzing Malicious Code, SQL Server
Forensic Analysis, Anti-Hacker Toolkit, First Edition, Network Security: The Complete
Reference, and Incident Response and Computer Forensics, Second Edition.
00-FM.indd 5 24/06/14 3:45 PM
This page has been intentionally left blank
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
CONTENTS
Foreword ........................................................ xv
Acknowledgments ................................................ xvii
Introduction ...................................................... xix
Part I Preparing for the Inevitable Incident
1 Real-World Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
What Constitutes an Incident? ...................................... 4
What Is Incident Response? ........................................ 5
Where We Are Now ............................................... 6
Why Should You Care About Incident Response? ..................... 8
Case Studies ..................................................... 8
Case Study #1: Show Me the Money ........................... 9
Case Study #2: Certificate of Authenticity ...................... 15
Concept of the Attack Lifecycle ..................................... 19
So What? ........................................................ 22
Questions ........................................................ 22
2 IR Management Handbook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
What Is a Computer Security Incident? ............................... 24
What Are the Goals of Incident Response? ............................ 25
Who Is Involved in the IR Process? .................................. 26
Finding IR Talent ........................................... 28
The Incident Response Process ...................................... 31
Initial Response ............................................. 31
Investigation ............................................... 32
Remediation ............................................... 39
Tracking of Significant Investigative Information ................ 40
Reporting .................................................. 42
So What? ........................................................ 43
Questions ........................................................ 43
vii
00-FM.indd 7 24/06/14 3:45 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
viii
Incident Response & Computer Forensics
3 Pre-Incident Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Preparing the Organization for Incident Response ..................... 46
Identifying Risk ............................................ 47
Policies That Promote a Successful IR .......................... 47
Working with Outsourced IT ................................. 48
Thoughts on Global Infrastructure Issues ...................... 49
Educating Users on Host-Based Security ....................... 49
Preparing the IR Team ............................................. 50
Defining the Mission ........................................ 50
Communication Procedures .................................. 51
Deliverables ................................................ 53
Resources for the IR Team ...................................... 54
Preparing the Infrastructure for Incident Response .................... 61
Computing Device Configuration ............................. 61
Network Configuration ...................................... 68
So What? ........................................................ 77
Questions ........................................................ 77
Part II Incident Detection and Characterization
4 Getting the Investigation Started on the Right Foot . . . . . . . . . . . . . 81
Collecting Initial Facts ............................................. 82
Checklists .................................................. 83
Maintenance of Case Notes ......................................... 90
Building an Attack Timeline .................................. 90
Understanding Investigative Priorities ............................... 91
What Are Elements of Proof? ................................. 91
Setting Expectations with Management ........................ 92
So What? ........................................................ 93
Questions ........................................................ 93
5 Initial Development of Leads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Defining Leads of Value ........................................... 96
Acting on Leads .................................................. 97
Turning Leads into Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
The Lifecycle of Indicator Generation .......................... 98
Resolving Internal Leads ..................................... 113
Resolving External Leads .................................... 113
So What? ........................................................ 116
Questions ........................................................ 116
00-FM.indd 8 24/06/14 3:45 PM
Incident Response / Incident Response & Computer Forensics / Luttgens & Pepe / 179868-4 / FM
ix
Contents
6 Discovering the Scope of the Incident . . . . . . . . . . . . . . . . . . . . . . . 117
What Should I Do? ................................................ 119
Examining Initial Data ....................................... 119
Gathering and Reviewing Preliminary Evidence ................ 120
Determining a Course of Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Customer Data Loss Scenario ....................................... 122
Customer Data Loss—Scoping Gone Wrong .................... 126
Automated Clearing House (ACH) Fraud Scenario .................... 127
ACH Fraud—Scoping Gone Wrong ........................... 130
So What? ........................................................ 130
Questions ........................................................ 131
Part III Data Collection
7 Live Data Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
When to Perform a Live Response ................................... 136
Selecting a Live Response Tool ...................................... 137
What to Collect ................................................... 139
Collection Best Practices ........................................... 141
Live Data Collection on Microsoft Windows Systems .................. 145
Prebuilt Toolkits ............................................ 145
Do It Yourself .............................................. 148
Memory Collection .......................................... 150
Live Data Collection on Unix-Based Systems ......................... 155
Live Response Toolkits ...................................... 155
Memory Collection .......................................... 158
So What? ........................................................ 163
Questions ........................................................ 163
8 Forensic Duplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Forensic Image Formats ............................................ 167
Complete Disk Image ....................................... 168
Partition Image ............................................. 170
Logical Image .............................................. 170
Image Integrity ............................................. 171
Traditional Duplication ............................................ 173
Hardware Write Blockers .................................... 173
Image Creation Tools ........................................ 175
Live System Duplication ........................................... 179
Duplication of Enterprise Assets .................................... 181
Duplication of Virtual Machines .............................. 181
So What? ........................................................ 182
Questions ........................................................ 182
00-FM.indd 9 24/06/14 3:45 PM