book

Scene of the Cybercrime: Computer Forensics Handbook

Name: Scene of the Cybercrime: Computer Forensics Handbook
Author: Syngress
ISBN: 9780080480787

by Syngress

August 2002

Intermediate to advanced

512 pages

27h 23m

English

Syngress

Read now

Unlock full access

Cover (1/3)
Cover (2/3)
Cover (3/3)
Contents (1/3)
Contents (2/3)
Contents (3/3)
Foreword (1/2)
Foreword (2/2)
Chapter 1 Facing the Cybercrime Problem Head On
Introduction

Quantifying the Crisis
Defining Cybercrime
Moving from the General to the Specific
Understanding the Importance of Jurisdictional Issues
Differentiating Crimes That Use the Net from Crimes That Depend on the Net
Collecting Statistical Data on Cybercrime
Understanding the Crime Reporting SystemCategorizing Crimes for the National Reporting System
Toward a Working Definition of Cybercrime
U.S. Federal and State StatutesInternational Law:The United Nations Definition of Cybercrime
Categorizing Cybercrime
Developing Categories of Cybercrimes (1/3)
Violent or Potentially Violent Cybercrime CategoriesNonviolent Cybercrime Categories
Developing Categories of Cybercrimes (2/3)
Developing Categories of Cybercrimes (3/3)
Prioritizing Cybercrime Enforcement
Fighting Cybercrime
Determining Who Will Fight Cybercrime
Educating Cybercrime Fighters
Educating Legislators and Criminal Justice ProfessionalsEducating Information Technology Professionals
Educating and Engaging the Community
Getting Creative in the Fight Against CybercrimeUsing Peer Pressure to Fight CybercrimeUsing Technology to Fight CybercrimeFinding New Ways to Protect Against Cybercrime
Summary
Frequently Asked Questions
Resources
Chapter 2 Reviewing the History of Cybercrime
Introduction
Exploring Criminality in the Days of Standalone Computers
Sharing More Than Time
The Evolution of a Word
Understanding Early Phreakers, Hackers, and Crackers
Hacking Ma Bell’s Phone NetworkPhamous PhreakersPhreaking on the Other Side of the AtlanticA Box for Every Color Scheme
From Phreaker to Hacker
Living on the LAN: Early Computer Network Hackers
How BBSs Fostered Criminal Behavior
How Online Services Made Cybercrime Easy
Introducing the ARPANet:: the Wild West of Networking
Sputnik Inspires ARPA
ARPA Turns Its Talents to Computer Technology
Network Applications Come into Their Own
The Internetwork Continues to ExpandThe ARPANet of the 1980sThe Internet of the 1990s
The Worm Turns—and Security Becomes a Concern
Watching Crime Rise with the Commercialization of the Internet
Bringing the Cybercrime Story Up to Date
Understanding How New Technologies Create New VulnerabilitiesWhy Cybercriminals Love Broadband
Why Cybercriminals Love Wireless
Why Cybercriminals Love Mobile Computing
Why Cybercriminals Love Sophisticated Web and E-Mail Technologies
Why Cybercriminals Love E-Commerce and Online Banking
Why Cybercriminals Love Instant Messaging
Why Cybercriminals Love New Operating Systems and Applications
Why Cybercriminals Love Standardization
Planning for the Future: How to Thwart Tomorrow’s Cybercriminal
Summary
Frequently Asked Questions
Resources
Chapter 3 Understanding the People on the Scene
Introduction
Understanding Cybercriminals
Profiling Cybercriminals (1/5)
Understanding How Profiling WorksReexamining Myths and Misconceptions About Cybercriminals
Profiling Cybercriminals (2/5)
Profiling Cybercriminals (3/5)
Constructing a Profile of the Typical CybercriminalRecognizing Criminal Motivations
Profiling Cybercriminals (4/5)
Profiling Cybercriminals (5/5)
Recognizing the Limitations of Statistical Analysis
Categorizing Cybercriminals (1/2)Criminals Who Use the Net as a Tool of the Crime
Categorizing Cybercriminals (2/2)
Criminals Who Use the Net Incidentially to the CrimeReal-Life Noncriminals Who Commit Crimes Online
Understanding Cybervictims
Categorizing Victims of Cybercrime (1/2)
Making the Victim Part of the Crime-Fighting Team
Categorizing Victims of Cybercrime (2/2)
Understanding Cyberinvestigators
Recognizing the Characteristics of a Good CyberinvestigatorCategorizing Cyberinvestigators by Skill SetRecruiting and Training Cyberinvestigators
Facilitating Cooperation: CEOs on the Scene
Summary
Frequently Asked Questions
Resources
Chapter 4 Understanding Computer Basics
Introduction
Understanding Computer Hardware
Looking Inside the Machine (1/3)
Components of a Digital ComputerThe Role of the MotherboardThe Roles of the Processor and Memory
Looking Inside the Machine (2/3)
The Role of Storage Media
Looking Inside the Machine (3/3)
Why This Matters to the Investigator
The Language of the Machine
Wandering Through a World of Numbers
Who’s on Which Base?
Understanding the Binary Numbering System
Converting Between Binary and DecimalConverting Between Binary and HexadecimalConverting Text to Binary
Encoding Nontext Files
Why This Matters to the Investigator
Understanding Computer Operating Systems
Understanding the Role of the Operating System Software
Differentiating Between Multitasking and Multiprocessing Types
MultitaskingMultiprocessing
Differentiating Between Proprietary and Open Source Operating Systems
An Overview of Commonly Used Operating Systems (1/4)
Understanding DOSWindows 1.x Through 3.xWindows 9x (95, 95b, 95c, 98, 98SE, and ME)
An Overview of Commonly Used Operating Systems (2/4)
Windows NTWindows 2000Windows XP
An Overview of Commonly Used Operating Systems (3/4)
Linux/UNIXOther Operating Systems
An Overview of Commonly Used Operating Systems (4/4)
Understanding File Systems
FAT12
FAT16
VFATFAT32
NTFS
Other File Systems
Summary
Frequently Asked Questions
Resources
Chapter 5 Understanding Networking Basics
Introduction
Understanding How Computers Communicate on a Network
Sending Bits and Bytes Across a Network (1/3)
Digital and Analog Signaling MethodsHow Multiplexing WorksDirectional Factors
Sending Bits and Bytes Across a Network (2/3)
Timing FactorsSignal InterferencePackets, Segments, Datagrams, and FramesAccess Control MethodsNetwork Types and Topologies
Sending Bits and Bytes Across a Network (3/3)
Why This Matters to the Investigator
Understanding Networking Models and Standards (1/2)The OSI Networking ModelThe DoD Networking Model
Understanding Networking Models and Standards (2/2)
The Physical/Data Link Layer StandardsWhy This Matters to the Investigator
Understanding Network Hardware (1/2)
The Role of the NICThe Role of the Network MediaThe Roles of Network Connectivity Devices
Understanding Network Hardware (2/2)
Why This Matters to the Investigator
Understanding Network Software (1/2)Understanding Client/Server ComputingServer Software
Understanding Network Software (2/2)
Client SoftwareNetwork File Systems and File Sharing ProtocolsA Matter of (Networking) Protocol
Understanding the TCP/IP Protocols Used on the Internet
The Need for Standardized Protocols
A Brief History of TCP/IP
The Internet Protocol and IP Addressing (1/2)
The Internet Protocol and IP Addressing (2/2)
How Routing Works
The Transport Layer Protocols
The MAC Address
Name Resolution
TCP/IP Utilities (1/2)
TCP/IP Utilities (2/2)
Network Monitoring Tools
Why This Matters to the Investigator
Summary
Frequently Asked Questions
Resources
Chapter 6 Understanding Network Intrusions and Attacks
Introduction
Understanding Network Intrusions and Attacks
Intrusions vs. Attacks
Recognizing Direct vs. Distributed Attacks
Automated Attacks
Accidental “Attacks”
Preventing Intentional Internal Security Breaches
Preventing Unauthorized External Intrusions
Planning for Firewall FailuresExternal Intruders with Internal Access
Recognizing the “Fact of the Attack”
Identifying and Categorizing Attack Types
Recognizing Pre-intrusion/Attack Activities
Port Scans
Address Spoofing
IP SpoofingARP SpoofingDNS Spoofing
Placement of Trojans
Placement of Tracking Devices and Software
Placement of Packet Capture and Protocol Analyzer Software
Prevention and Response
Understanding Password Cracking
Brute Force
Exploitation of Stored Passwords
Interception of Passwords
Password Decryption Software
Social Engineering
Prevention and Response
General Password Protection Measures
Protecting the Network Against Social Engineers
Understanding Technical Exploits
Protocol Exploits (1/2)
DoS Attacks That Exploit TCP/IP
Protocol Exploits (2/2)
Source Routing Attacks
Other Protocol Exploits
Application ExploitsBug ExploitsMail BombsBrowser ExploitsWeb Server ExploitsBuffer Overflows
Operating System Exploits
The WinNuke Out-of-Band AttackWindows Registry AttacksOther Windows ExploitsUNIX ExploitsRouter Exploits
Prevention and Response
Attacking with Trojans,Viruses, and Worms
Trojans
Viruses
Worms
Prevention and Response
Hacking for Nontechies
The Script Kiddie Phenomenon
The “Point and Click” Hacker
Prevention and Response
Summary
Frequently Asked Questions
Resources
Chapter 7 Understanding Cybercrime Prevention
Introduction
Understanding Network Security Concepts
Applying Security Planning Basics
Defining SecurityThe Importance of Multilayered SecurityThe Intrusion TriangleRemoving Intrusion Opportunities
Talking the Talk: Security Terminology
Importance of Physical Security (1/2)
Protecting the ServersKeeping Workstations SecureProtecting Network Devices
Importance of Physical Security (2/2)
Understanding Basic Cryptography Concepts
Understanding the Purposes of Cryptographic SecurityAuthenticating Identity
Providing Confidentiality of Data
Ensuring Data Integrity
Basic Cryptography Concepts (1/3)
Scrambling Text with Codes and CiphersWhat Is Encryption?
Basic Cryptography Concepts (2/3)
Securing Data with Cryptographic AlgorithmsHow Encryption Is Used in Information Security
Basic Cryptography Concepts (3/3)
What Is Steganography?Modern Decryption MethodsCybercriminals’ Use of Encryption and Steganography
Making the Most of Hardware and Software Security
Implementing Hardware-Based SecurityHardware-Based FirewallsAuthentication Devices
Implementing Software-Based Security
Cryptographic SoftwareDigital CertificatesThe Public Key InfrastructureSoftware-Based Firewalls
Understanding Firewalls
How Firewalls Use Layered Filtering
Packet FilteringCircuit FilteringApplication Filtering
Integrated Intrusion Detection
Forming an Incident Response Team
Designing and Implementing Security Policies
Understanding Policy-Based SecurityWhat Is a Security Policy?Why This Matters to the Investigator
Evaluating Security Needs (1/3)
Components of an Organizational Security PlanDefining Areas of ResponsibilityAnalyzing Risk FactorsAssessing Threats and Threat Levels
Evaluating Security Needs (2/3)
Analyzing Organizational and Network VulnerabilitiesAnalyzing Organizational FactorsConsidering Legal FactorsAnalyzing Cost Factors
Evaluating Security Needs (3/3)
Assessing Security Solutions
Complying with Security Standards
Government Security RatingsUtilizing Model Policies
Defining Policy Areas
Password PoliciesOther Common Policy Areas
Developing the Policy Document
Establishing Scope and PrioritiesPolicy Development GuidelinesPolicy Document Organization
Educating Network Users on Security Issues
Policy EnforcementPolicy DisseminationOngoing Assessment and Policy Update
Summary
Frequently Asked Questions
Resources
Chapter 8 Implementing System Security
Introduction
How Can Systems Be Secured?
The Security Mentality
Elements of System Security
Implementing Broadband Security Measures
Broadband Security Issues
Deploying Antivirus Software
Defining Strong User Passwords
Setting Access Permissions
Disabling File and Print Sharing
Using NAT
Deploying a Firewall
Disabling Unneeded Services
Configuring System Auditing
Implementing Browser and E-Mail Security
Types of Dangerous Code
JavaScriptActiveXJava
Making Browsers and E-Mail Clients More Secure
Restricting Programming LanguagesKeep Security Patches CurrentCookie Awareness
Securing Web Browser Software
Securing Microsoft Internet Explorer
Securing Netscape Navigator
Securing Opera
Implementing Web Server Security
DMZ vs. Stronghold
Isolating the Web Server
Web Server Lockdown
Managing Access ControlHandling Directory and Data StructuresScripting Vulnerabilities
Logging Activity
BackupsMaintaining Integrity
Rogue Web Servers
Understanding Security and Microsoft Operating Systems
General Microsoft Security Issues
NetBIOSWidespread Automated FunctionalityIRDP VulnerabilityNIC Bindings
Securing Windows 9x Computers (1/2)
Securing a Windows NT 4.0 Network
Securing Windows 9x Computers (2/2)
Securing a Windows 2000 Network
Windows .NET:The Future of Windows Security
Understanding Security and UNIX/Linux Operating Systems
Understanding Security and Macintosh Operating Systems
Understanding Mainframe Security
Understanding Wireless Security
Summary
Frequently Asked Questions
Resources
Chapter 9 Implementing Cybercrime Detection Techniques
Introduction
Security Auditing and Log Files
Auditing for Windows Platforms
Auditing for UNIX and Linux Platforms
Firewall Logs, Reports, Alarms, and Alerts (1/2)
Firewall Logs, Reports, Alarms, and Alerts (2/2)
Understanding E-Mail Headers (1/2)
Understanding E-Mail Headers (2/2)
Tracing a Domain Name or IP Address
Commercial Intrusion Detection Systems
Characterizing Intrusion Detection Systems
Commercial IDS Players
IP Spoofing and Other Antidetection Tactics
Honeypots, Honeynets, and Other “Cyberstings”
Summary
Frequently Asked Questions
Resources
Chapter 10 Collecting and Preserving Digital Evidence
Introduction
Understanding the Role of Evidence in a Criminal Case
Defining Evidence
Admissibility of Evidence
Forensic Examination Standards
Collecting Digital Evidence
The Role of First Responders
The Role of Investigators
The Role of Crime Scene Technicians
Preserving Digital Evidence
Preserving Volatile Data
Disk Imaging
A History of Disk ImagingImaging Software
Standalone Imaging Tools
Role of Imaging in Computer Forensics“Snapshot”Tools and File Copying
Special Considerations
Environmental FactorsRetaining Time and DatestampsPreserving Data on PDAs and Handheld Computers
Recovering Digital Evidence
Recovering “Deleted” and “Erased” Data
Decrypting Encrypted Data
Finding Hidden DataWhere Data HidesDetecting Steganographic DataAlternate DatastreamsMethods for Hiding Files
The Recycle Bin
Locating Forgotten EvidenceWeb Caches and URL HistoriesTemp FilesSwap and Page Files
Recovering Data from Backups
Defeating Data Recovery Techniques
Overwriting the DiskDegaussing or DemagnetizingPhysically Destroying the Disk
Documenting Evidence
Evidence Tagging and MarkingEvidence Logs
Documenting Evidence Analysis
Documenting the Chain of Custody
Computer Forensics Resources
Computer Forensics Training and Certification
Computer Forensics Equipment and SoftwareComputer Forensics Services
Computer Forensics Information
Understanding Legal Issues
Searching and Seizing Digital Evidence (1/2)
U.S. Constitutional IssuesSearch Warrant Requirements
Searching and Seizing Digital Evidence (2/2)
Search Without WarrantSeizure of Digital Evidence
Forfeiture Laws
Privacy Laws
The Effects of the U.S. Patriot Act
Summary
Frequently Asked Questions
Resources
Chapter 11 Building the Cybercrime Case
Introduction
Major Factors Complicating Prosecution
Difficulty of Defining the CrimeBodies of Law
Types of Law
Levels of Law
Basic Criminal Justice Theory
Elements of the Offense
Level and Burden of Proof
Jurisdictional Issues (1/2)
Defining JurisdictionStatutory Law Pertaining to JurisdictionCase Law Pertaining to Jurisdiction
Jurisdictional Issues (2/2)
International ComplicationsPractical Considerations
The Nature of the Evidence
Human Factors
Law Enforcement “Attitude”The High-Tech LifestyleNatural-Born Adversaries?
Overcoming Obstacles to Effective Prosecution
The Investigative Process
Investigative Tools (1/3)
Investigative Tools (2/3)
Steps in an Investigation
Investigative Tools (3/3)
Defining Areas of Responsibility
Testifying in a Cybercrime Case
The Trial Process
Testifying as an Evidentiary WitnessTestifying as an Expert WitnessGiving Direct TestimonyCross-Examination TacticsUsing Notes and Visual Aids
Summary
Frequently Asked Questions
Resources
Afterword
Appendix: Fighting Cybercrime on a Global Scale (1/8)
Appendix: Fighting Cybercrime on a Global Scale (2/8)
Appendix: Fighting Cybercrime on a Global Scale (3/8)
Appendix: Fighting Cybercrime on a Global Scale (4/8)
Appendix: Fighting Cybercrime on a Global Scale (5/8)
Appendix: Fighting Cybercrime on a Global Scale (6/8)
Appendix: Fighting Cybercrime on a Global Scale (7/8)
Appendix: Fighting Cybercrime on a Global Scale (8/8)
Index (1/4)
Index (2/4)
Index (3/4)
Index (4/4)
Related Titles

Content preview from Scene of the Cybercrime: Computer Forensics Handbook

522 Chapter 9 • Implementing Cybercrime Detection Techniques

Tracing a Domain Name or IP Address

The Domain Name System (DNS) is responsible for maintaining domain name

to IP address mappings on the Internet. Numerous boundary devices, such as

ﬁrewalls and screening routers, can perform reverse DNS lookups to make sure

that reported domain names match actual IP destination addresses in inbound

trafﬁc.When these do not match up properly—that is, when looking up the

domain name produces an IP address that is different from the one in the desti-

nation address—there’s the probability that the sender is attempting to spoof a

domain name without making sure ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Handbook of Digital Forensics and Investigation

Publisher Resources

ISBN: 9781931836654

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Scene of the Cybercrime: Computer Forensics Handbook

by Syngress

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Handbook of Digital Forensics and Investigation

Computer Forensics InfoSec Pro Guide

The Basics of Digital Forensics

A Practical Guide to Computer Forensics Investigations

Publisher Resources