Brian's Forensic Blog

I just wanted to blast out a few personal views on Encryption and Passwords. Nothing majorly technical, just theories, and personal views.

Firstly encryption of drives or directories with things such as TrueCrypt or Bitlocker. I get it, most people want to keep data private, and it’s a GREAT thing. I use it on my laptops just in case one gets stolen.
Here’s the thing though, We’re humans and love to have that additional feeling of being backed up in life. I know more people than not who print out their Keys, or store them on some type of archval data medium.
We forget that most encrypted drives also need some type of medium such as a TPM, a usb key, or something to that affect. As a forensic guy, the computer is just part of the evidence collected. I would take CD’s, floppies, printouts, USB keys, etc. I’ll be doing a test on one of my Win7 laptops that I added drive encryption to. And also having the Key to it. I’ll see how well a standard password can rip through it outside the Windows enviroment.

Secondly. I feel that since doing much Linux analysis. Passwords are not needed as much as people think. Finding a user password or the Root password isn’t much of an issue. I may recant this statement when dealing with Keyrings later down the road, but for now. I have Never needed to know the root password for any forensic analysis on a linux machine yet. Same goes for windows. Only times passwords would be needed is for getting into compressed files like zips and rars.

Another thing I’d like to mention is password recycling, I did a presentiation at the BLUG about 6 months ago. I was a blast by the way. But… I asked one thing to the group of 30 or so people. “How many of you use the same password for multiple things?”, just about every hand rose out there. So I conclude that if you look too hard at one item’s password, then most likely you are not going to get it. look other places.
I had a zip file with a good 10 character password. It took a few days to break. but think about what passwords are stored in firefox or pidgen or other areas…. If password recycling is used, then I bet it’s somewhere easier to find.

Just my thoughs.

3/17/10 EDIT:
Found this little tidbit when googling around the internet on “mounting Bitlocker volumes”. About halfway down is showing the ability to view contents of an external Bitlocker drive

I took the CFSA test in December. still awaiting the results. I’ll honsetly say that it was one of the most difficult test’s I’ve had to do. BUT….
the scenerio of the practical exam of that test gave me some really good ideas to port over to the Linux side of things. Mostly usage of GoogleGears/apps and using file upload sites.

I also was thinking of the movement of files to /dev/null, and IF there are residuals in it. I kinda think so. during a demo analysis, I came across a ton of orphaned files. have not had the time or the ability to carve them together. BUT, I did see INode pointing to the name of the file I pushed over to null. gives me some thoughts:)

I’m going to be doing a presentation at LinuxFest Northwest this year up in Bellingham, Wa. in April. I’ve started writing up some Credit Card theft demo’s that should be fun to do for the presentation. I’ll also be working on the new KDE interface for additional forensic material. I know….. I’ve been sticking to Gnome so much, trying to change that. the demo machine that I use really hates the Kubuntu 9.10. Did find that I can install amd64 on it though. I’ll give it some more attention.

I’ve also found some neat browser parsers that I can’t wait to show off!
Till LinuxFest comes, I’m going to be a little quiet on what findings I post.
If you are close to Bellingham, do sign up for the presentation.
Link

One of the neatest things I’ve stumbled across is the /home/user/acct file. This has account information for SMB connections. This file is hidden, and deleted once the connection is unmounted.
Take a Look below.

Contents Of File: /1/home/megatron/acct

Starscream:1043:
289dc86f4f7d599e14efbcc05c9817db:8c05f685dae46e1b36050170069fe44b:
DECEPTI:CON:decepticon


I created User Starscream on a Win2K3 server that had it’s own share. Starscreams password was decepticon. which is also in plain text.
There is the 1042 ID which is not much use now. but the next two 32 character strings are. they are NTLM hashes. you can see that DECEPTI and CON are there.
I’m assuming since it’s following the 7 character split rule, that the hashes are as follows:

DECEPTI = 289dc86f4f7d599e14efbcc05c9817db
CON = 8c05f685dae46e1b36050170069fe44b

Pretty awesome there. While this in itself is not worthwhile because we don’t know yet what is the actual SMB server it connected to….. with extra info, we could deduce what server this relates to with nautilus and logs.