Professional Documents
Culture Documents
Cloud Forensics
Cloud Forensics
in/
By : Anupam Tiwari
If Ramayana can get over in one SHLOK..y cant I complete covering CLOUD FORENSICS in 40 Min
Khatamm!!!!
Service Models
Deployment Models
Essential Services
On-demand self service Broad network access Resource pooling Rapid elasticity Measured service
Even if data belonging to a particular suspect is identified, separating it from other users data is difficult. Other than the CSP, there is usually no evidence that links a given data file to a particular suspect.
To investigate this case, the forensics examiner needs a bit-for-bit duplication of the data to prove the existence of contraband images and video
First, he needs to issue a search warrant to the cloud provider. However, there are some problems with the search warrant in respect of cloud environment.
For example, warrant must specify a location, but in cloud the data may not be located at a precise location or a particular storage server.
Furthermore, the data can not be seized by confiscating the storage server in a cloud, as the same disk can contain data from many unrelated users.
To identify the criminal, he needs to know whether the virtual machine has a static IP.
Almost in all aspects, it depends on the transparency and cooperation of the cloud provider.
Volatile data cannot sustain without power. When we turn off a Virtual Machine (VM), all the data will be lost if we do not have the image of the instance. If we restart or turn off a VM instance in IaaS (e.g., in Amazon EC2), we will lose all the data. Registry entries or temporary internet files, that reside or be stored within the virtual environment will be lost when the user exits the system.
Though with extra payment customers can get persistent storage, this is not common for small or medium scale business organizations. A malicious user can exploit this vulnerability.
Some owner of a cloud instance can fraudulently claim that her instance was compromised by someone else and had launched a malicious activity. Later, it will be difficult to prove her claim as false by a forensic investigation .
Persistence in computer science refers to the characteristic of state that outlives the process that created it. Without this capability, state would only exist in RAM, and would be lost when this RAM loses power, such as a computer shutdown
After issuing a search warrant, the examiner needs a technician of the cloud provider to collect data. However, the employee of the cloud provider who collects data is most likely not a licensed forensics investigator and it is not possible to guarantee his integrity in a court of law . The date and timestamps of the data are also questionable if it comes from multiple systems. One of the shortcomings they found is that it is not possible to verify the integrity of the forensic disk image in Amazons EC2 cloud because Amazon does not provide checksums of volumes, as they exist in EC2.
The on-demand characteristic of cloud computing will have vital role in increasing the digital evidence in near future. In traditional forensic investigation, we collect the evidence from the suspects computer hard disk.
In cloud computing, multiple VM can share the same physical infrastructure, i.e., data for multiple customers may be co-located. This nature of clouds is different from the traditional single owner computer system.
How to prove that data were not comingled with other users data ?
First,
Secondly, How to preserve
SIDE-CHANNEL ATTACKS
Using the Amazon EC2 service as a case study, we show that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target. We explore how such placement can then be used to mount cross-VM side-channel attacks to extract information from a target VM on the same machine.
Source : http://cloudsecurity.org/blog/2009/08/31/cloud-cartography-sidechannel-attacks.html
Analyzing logs from different processes plays a vital role in digital forensic investigation. Process logs, network logs, and application logs are really useful to identify a malicious user. Not as simple as it is in privately owned computer system, Sometimes even impossible.
Challenges :
Decentralization. Volatility of Logs. Multiple Tiers and Layers. Accessibility of Logs. Dependence on the CSP. Absence of Critical Information in Logs.
Due to the distributed and elastic characteristic of cloud computing, the available forensic tools cannot cope up with this environment. Tools and procedures are yet to be developed for investigations in virtualized environment, especially on hypervisor level. Need of FORENSICAWARE tools for the CSP and the clients to collect forensic data.
Physical hardware
Network
INTEGRITY PRESERVATION
Generating a digital signature on the collected evidence and then checking the signature later is one way to validate the integrity. As data is distributed among multiple servers, this procedure is not simple, rather quite complicated.
A distributed SIGNATURE DETECTION FRAMEWORK that will facilitate the forensic investigation in Cloud environment.
LOGGING
Proposed is a log management solution, which can solve several challenges of logging. In the first step of the logging solution, logging must be enabled on all infrastructure components to collect logs. The next step is for establishing a synchronized, reliable, bandwidth efficient, and encrypted transport layer to transfer log from the source to a central log collector. The final step deals with ensuring the presence of the desired information in the logs.
Only problem with this solution is that, it requires an extra level of trust trust in the management plane.
To overcome the cross border legislation challenges, It is proposed that an international unity for introducing an international legislation for cloud forensics investigation
CONTINUOUS SYNCHRONIZATION
To overcome the problem of volatile data, explore possibility of continuous synchronization of the volatile data with a persistent storage Two possible ways of continuous synchronization. CSPs can provide a continuous synchronization API to customers. Using this API, customers can preserve the synchronized data to any cloud storage e.g., Amazon S3, or to their local storage. However, if the adversary is the owner of a VM!!!!then what?
Moving a suspicious instance from one node to another node may result in possible loss of evidence.
To protect evidence, we can move other instances reside in the same node.
Provenance in Clouds
Cloud provenance can be
Data provenance: Who created, modified, deleted data stored in a cloud (external entities change data) Process provenance: What happened to data once it was inside the cloud (internal entities change data)
Cloud provenance should give a record of who accessed the data at different times Auditors should be able to trace an entry (and associated modification) back to the creator
Cybercrime and Cloud Forensics: Applications for Investigation Processes, IGI Global, 2013 (edited book) Cloud Forensic Reference Architecture (CFRA) Cloud Forensic Maturity Model (CFMM) UCD CCI: Cloud Forensic Capability and Requirement Study for EU Law Enforcement NIST Cloud Computing Forensic Science Working Group CSA Cloud Forensics and Incident Management Working Group
The key to avoiding much of this pain is being prepared before an incident occurs. Once you become a customer, you have lost much of your leverage..
The provider will allow you to access to the servers or system so you can self-collect.
Determine what type of data the provider collects, how long the provider holds it, and if the provider will store this data for you for a longer period of time.
Determine wherein what state, states, or countryyour data will be stored so you can determine which laws may apply.
Encase Accessdata FTK Fast Dump from HBGary Memorysze from Mandiant
Three experiments and data collected from three different layers and got success in all the experiments. In the first experiment, they collected forensic data remotely from the guest OS layer of cloud. Encase Servlets and FTK Agents are the remote programs, which were used to communicate and collect data. For the second experiment, they prepared an Eucalyptus cloud platform and collected data from the virtualization layer. In the third experiment, they tested the acquisition at the host operating system layer by Amazons export feature.
Source : Acquiring Forensic Evidence from Infrastructure-as-a-Service Cloud Computing: Exploring and Evaluating Tools, Trust, and Techniques
- Cloud computing can reduce the time for data acquisition, data copying, transferring and data cryptanalysis. - Forensic image verification time reduced if cloud application generates cryptographic hash. - Cost effectiveness - Data abundance - Overall robustness - Scalability - Flexibility - Standards and Policies
He pays for his cloud services with a pre-paid credit card purchased with cash. Polly encrypts his data in cloud storage, and he reverts his virtual webserver to a clean state daily. Law enforcement is tipped off to the website and wishes both to terminate the service and prosecute the criminal.
- IaaS assumed - In this service model, the provider has responsibility and access to only the physical hardware, storage, servers and network components. - In the public interest, law enforcement first contacts the cloud provider with a temporary restraining order to suspend the offending service and account, and a preservation letter to preserve evidence pending a warrant. - Tracking down the user is the more difficult task. The onus in this case is on the forensic examiner to piece together a circumstantial case based on the data available.
- The examiner has no way to image the virtual machine remotely since the cloud provider does not expose that functionality - and in doing so would alter the state of the machine anyway. - Deploying a remote forensic agent, such as EnCase Enterprise, would require the suspect's credentials, and functionality of this remote technique within the cloud is unknown. -Simply viewing the target website is enough to confirm that the content is illegal, but it tells us nothing about who put it there.
Consider other possible sources of digital evidence in this case: Credit card payment information Cloud subscriber information Cloud provider access logs Cloud provider NetFlow logs, Virtual machine Cloud storage data.
Law enforcement can issue a search warrant to the cloud provider, which is adequate to compel the provider to provide any of this information that they possess. The warrant specifies that the data returned be an exact duplicate, ie bit by bit!!!!!(But How?) A technician at the provider executes the search order from his or her workstation, copying data from the provider's infrastructure and verifying data integrity with hashes of the files. Though the prosecution may call the technician to testify, we have no implicit guarantees of trust in the technician to collect the complete data, in the cloud infrastructure to produce the true data, nor in the technician's computer or tools used to collect the information correctly. Nonetheless, the provider completes the request, and delivers the data to law enforcement.
Let us say that Polly had two terabytes of stored data. To transfer that quantity of data, the provider saves it to an external hard drive and delivers it to law enforcement by mail. In addition, the provider is able to produce - Account information - 10MB of access logs - 100MB of NetFlow records - 20GB virtual machine snapshot. After validating the integrity of the data, the forensic examiner is now charged with Analysis. We would expect the forensic expert to identify the following that would aid in prosecution: - Understand how the web service works, especially how it encrypts/decrypts data from storage - Find keys to decrypt storage data, and use them to decrypt the data - Confirm the presence of child pornography
AccessData found that their Forensic Toolkit (FTK) product took 5.5 hours to process a 120GB hard drive fully on a top-of-the-line workstationand as long as 38.25 hours on a low-end workstation .
At that rate, 2TB of data could take 85 hours of processing time. The provider may have returned individual files or large files containing blobs of binary data. In either case, it will become quickly evident that the data are encrypted. Tools like EnCase and Forensic Toolkit can analyze VMware data files but not snapshots which include suspended memory. We were already aware of illegal content, but not aware of the data owner. Timestamps or file metadata may prove useful, provided they are available and accurate. Evidence of the owner may be gleaned from NetFlow, timestamp, and potentially in the coding style of the website. We can safely assume that an IP can be found that points to Polly. All of the forensic analysis is documented and presented to counsel.
- Since raw bit-for-bit copies of hard drives were not provided, how do we know that the cloud provider provided a complete and authentic forensic copy of the data? - Can the authenticity and integrity of the data be trusted? - Can the cloud technician, his/her workstation and tools be verifiably trusted? - Were the data located on one drive, or distributed over many? Where were the drives containing the data physically located? -Who had access to the data, and how was access control enforced? -Were the data co-mingled with other users' data? - If data came from multiple systems, are the timestamps of these systems internally consistent? Can the date and time stamps be trusted, and compared with confidence?
Microsoft and Amazon declined to comment about their compliance abilities in this situation
REFERENCE MATERIAL Whites reference : Josiah Dykstra & Alan T Sherman At [email protected] [email protected]
I am at
[email protected]
And blog at www.anupriti.blogspot.com