ZoneAlarm Blog: Information and news about internet security, virus protection, spyware removal, and more...

Forensics: Looking Inside the Stolen VA Laptop

As mentioned in this post, the laptop containing Veteran's Administration data was recovered. While it's good they got the *hardware* back, recovering the laptop itself doesn't mean the data wasn't stolen.

Speaking to this concern, another report stated this:                     

FBI Says Data on VA Laptop Not Accessed

The FBI, in a statement from its Baltimore field office, said:
A preliminary review of the equipment by computer forensic teams determined that the database remains intact and has not been accessed since it was stolen. A thorough forensic examination is underway, and the results will be shared as soon as possible. The investigation is ongoing.

As a former Computer Forensic Specialist, I wanted to explain what's probably going on with this laptop now that the FBI has the system and is forensically examining it. This explanation assumes the data was present on the hard drive (not a CD-Rom or other storage medium).

Physical Examination:
As with any physical evidence, looking for latent fingerprints or material containing DNA is standard procedure. Next, the investigator will attempt to determine if anyone removed the physical hard drive from the computer (looking at the screws, prints on the hard drive casing inside the system). It's possible they even have some exotic voltage measuring tools that can accurately determine how long a capacitor has been without power.

Digital Examination:
The first step is taking a bit-for-bit image of the hard drive. This technique makes an exact copy of the data on the laptop so the forensic examiner is reviewing a copy of the stolen disk, not the actual disk itself. Next, the investigator will want to determine the last date and time the system was powered up and booted. This is fairly simple.

To determine if the Veteran's sensitive information was accessed (as they mentioned in the news article quoted above), there are a couple possible options, with specific drawbacks as well.

Using file system access times (a-times):
The common PC file systems have various properties that can be used to gather forensic evidence. These properties are often called MAC-times (Modify, Access, Change). One of these properties is the "access times" of the files on the system. An access time is updated whenever a file is opened for reading (and various other operations). If you open a previously created document (or even just browse to the directory the file is located), it will update the a-time. Using a search tool to find a specific file on your system could update (erase) all the previous a-times on your system. Since it's so easy to erase or lose the a-time data it is considered highly volatile.

MAC time data looks like this:

2004-03-21 19:20:36|.A.|/SUBJECT/usr/lib/crti.o
2004-03-21 19:20:36|.A.|/SUBJECT/usr/lib/crtn.o
2004-03-21 19:20:36|.A.|/SUBJECT/usr/lib/libgcc.a
2004-03-21 19:20:36|MAC|/SUBJECT/tmp/tsh3ll

Based on the example above, if the investigator found a-time information that was *after* possession of the laptop was lost, that would indicate someone accessed the laptop during the stolen time-period.

The FBI would look at the a-times on the system in question and see if the times coincide with the times and dates the laptop was in possession of the VA employee. If the a-time was after the employee lost possession of the laptop, that would indicate someone other than the VA employee was accessing those files.

How reliable are file system MAC times?
In a paper I co-wrote a long while back, we added this caveat regarding file system MAC times:

Timestamp analysis can provide valuable clues as to what the intruder may have been doing or what files were affected.  However, because timestamps can be altered, their implications must be considered carefully (even cautiously).  Where possible, attempt to gather evidence that independently supports the story that your timestamps are telling you.

There is also this from Dan Farmer in Doctor Dobb's Journal:

And while NTFS is hampered in that atimes are not always updated when a file is accessed (Microsoft, please change this, or at least make it an option for administrators!)...
[there is no indication if the laptop was using NTFS or another file system at this time]

Worst case scenario:
The laptop thieves really know what they are doing. They remove the hard drive from the laptop, and mount it read-only (no modifications to the file system) on another computer, access the sensitive data and re-insert the hard drive into the stolen laptop. This is the same process the forensic examiner would use to prevent the examination from modifying the data contained on the laptop -- and this is why I mentioned what the FBI might look for during the physical examination -- marks on the screws or finger prints on the internal hard drive casing.

I'll post more updates as this investigation continues.

[UPDATE: 6/29]

The VA disclosed two more data breaches and the Chief Security Officer (CSO) has resigned.

Laptop with data on veterans found! Miracles happen

The news just broke that the laptop containing data on 26.5 million veterans has been found.

Could it possibly be the $50,000 reward that did it?

This is a relief. Hopefully the silver lining of this episode will be the awareness raised of how easily our critical personal information can fall into the wrong hands.

PAYMENT REPRESENTATIVE NEEDED!

You've seen the email subject lines:

PAYMENT REPRESENTATIVE NEEDED!
JOB ALERT!
CONGRATULATION FROM: THE TREASURYLINE BOARD

These are spammed emails claiming someone has discovered unclaimed money, found you a job, or needs someone in the US to receive a $10 Million dollar bank transfer. These are usually called 419 Scams or Advance Fee Fraud. Sometimes skilled social engineers will attempt to start a dialoge with these people, hoping to have them divulge certain information or disclose who they really are -- this is called: Nigerian Scam Baiting.

At one point, a scammer was even baited into being caught on tape (or rather webcam) by setting up a transaction and having the camera on the drop spot. Not to be outdone, today we have someone who convinced the 419 scammers into actually recreating a Commodore 64 out of wood! The pictures have to be seen to be believed -- very skilled work, seems like the scammer might be able to find work working wood rather than scamming people.

Another Identity Theft - This time for the "Odd News" category

The Associated Press reports that

"The government agency charged with fighting identity theft said Thursday it had lost two government laptops containing sensitive personal data...Many of the people whose data were compromised were being investigated for possible fraud and identity theft."

Did you need to re-read this to fully comprehend the irony, as I did? See the full story.

Yet Another Vishing (phone phishing) Incident

Hello, you've reached _______ Bank:

• If you would like to check your balance, press 1.
• To be connected to an operator, press 2.
• To compromise your banking account, enter your 16 digit card number followed by the expiration date.

No, I didn't make up the name for this new type of phone phishing recently labeled Vishing. Yes, Vishing is probably not the best name but it was the first offered, so it will probably stick.

As mentioned in previous posts, this new type of phishing using phone/voicemail is becoming more common. The most recent incident involves Santa Barbara Bank & Trust.

The MO is the same, spam people with fraudlent email asking them to call their bank and confirm their account details, the customer calls what they believe is their bank and ends up disclosing their account details to the automated phone system (and thereby the phishers). Websense grabbed the voicemail recording so you can hear the message and understand how it actually works.

The Phishing Incident Reporting and Termination (PIRT) Squad is updating the status of this phish.

How can you protect yourself? Use caution and refer to the company's website to confirm their officially listed phone number to avoid falling victim in cases like this.

Explanation about the recent ZoneAlarm / McAfee problem

It's usually not what you think - the 6.5 release error with McAfee

I'm one of the long-timers at Zone Labs, here since the first release of ZoneAlarm Pro.  I've stuck with Zone Labs mostly because of the people - quality people who are sincerely out to make a good product.

So one of the frustrating yet inevitable issues I've faced over the years is trying to explain our innocence to our customers when we mess up in a world where customers are (rightfully) suspicious of a company's every move.  It was just a mistake!

The 6.5 McAfee Issue 

And this brings me to the latest incarnation of this issue: the recent 6.5 release.  No, we really weren't trying to usurp McAfee antivirus by making customers uninstall McAfee before they could install their ZoneAlarm update.  It wasn't a lame marketing program (yes, we've been guilty of one or two of those over the years).

It was...just an error. 

It happened quite simply: An incompatibility was discovered with a particular McAfee product in an overseas market, beyond the usual antivirus-to-antivirus incompatibility. A bug was logged.  The problem was discussed.  And a solution was decided upon: Create an install gate for ZoneAlarm antivirus products and for this particular overseas market only - a rare use case - until we can work with McAfee to fix it.  Software companies deal with stuff like this all of the time, so it was no big deal.  But like a great game of telephone, we ended up restricting the installation for *all* ZoneAlarm products (not just antivirus products) and for *all* markets (overseas and US). 

"They're trying to usurp McAfee!  They did this on purpose. They'll never admit it."  Our userbase doesn't use our software for nothing.  They're smart, savvy, and they demand respect and privacy. At the slightest essence of something that could possibly be construed as slyness or scheming on our part, they call us on it.  And with the stunts companies out there are pulling, we don't blame them.  So we do the only thing we really can do: be open and honest, explain what happened, apologize, make it right, and leave the rest in our customers' hands.

And nearly always, our customers (you) reward us by giving us the benefit of the doubt, often times even going up to bat for us in user forums. We appreciate it.

Oh...sorry for the inconvenience.  We sincerely apologize.

Details on the fix:

The McAfee issue described above has been fixed and is available in a new version that is being released to all customers as I write this. Expect an update notification soon if you’ve not received one already.   

Marketplace Report on ID Theft Laws

I heard this on the radio during my commute home today.

Marketplace reports on new federal legislation that would *reduce* consumers ability to control their credit information and place blocks on who can use that data:

Congress is considering a bill that would roll back consumers' ability to freeze their own credit — a move critics say would make it harder for consumers to protect themselves from identity thieves.

Instead of allowing a consumer the ability to lock their credit report and control who has access as many states provide now, this bill would instead reduce that control -- allowing a consumer to only place a "fraud alert" on their account, something that is not nearly as strong.

You can listen or read the full story here.

Phishing by Phone

Back in April, fellow blogger Matt was theorizing about a new type of phishing where the phish used a phone system to obtain your information rather than stealing it through a website. Well, it looks like that theory has become reality.

Recently a phishing email was detected that didn't ask you to view a certain spoofed website, rather, it asked you to call Chase Bank at a phone number and input your information through their system. Problem is, it isn't Chase. The phone number in the email was actually controled by the phishers as was the automated touch-tone system that requested your SSN, Account Number, etc.

Here is a copy of the email phish:

Dear Customer,  We've noticed that you experienced trouble logging into Chase Online Banking.  After three unsuccessful attempts to access your account, your Chase Online Profile has been locked. This has been done to secure your accounts and to protect your private information. Chase is committed to make sure that your online transactions are secure.  To verify your account and your identity please call our Account Maintenance Department at *(888) 555-3406* 24 hours / 7 days a week. 

Sincerely,

Chase
Online Customer Service

In Corporate IT security, there is a lot of talk about end-user education -- in effect, teaching the employees how to be safe and secure with corporate data. I think this phone phishing example is a case where end-user education is one of the only options. In this case, how do you know who you are calling and how can you confirm it? The 6.5 version of ZoneAlarm goes a long way to protecting you in the offline realm, but I can't see how any software, credit opt-out, monitoring or detection can protect someone from picking up the phone and dialing a phony number -- end-user education and caution may be the only option in this case.

Maybe the best suggestion is to use caution and refer to the company's website to call their officially listed phone number to avoid falling victim in cases like this.

Man Sentenced for Multiple Instances of Identity Fraud

A news story today reported that an identity thief who created multiple false identities for himself received a 5 year jail sentence.

"Using the names, dates of birth, and Social Security numbers of these deceased persons, JIMENEZ applied for, and fraudulently obtained, a U.S. passport, Massachusetts' Driver's License, bank accounts at Citizens Bank and TD Banknorth, and telephone service from Verizon."

This story perfectly exemplifies why it's important to monitor what's shown in public records, such as utilities and the DMV.  A fraud monitoring service, such as the one from our partner Identity Guard,  can compile data that appears in these public records - which you don't get by monitoring credit reports.

You could potentially check on the public records yourself, but that would take a lot of work. If you've undertaken investigating public records on your own please tell us what your experience was like and any tips.

Identity theft victim heal thyself!

This morning I had my wallet out to make some online purchases (of course with my ZoneAlarm fired up to protect me). Yet for some reason, despite my constant thoughts of identity theft, I left my wallet sitting out for hours. Well part of this is my cubicle is kind of hidden. I ASSumed that since people don't walk by it would be ok.

But still. Stolen wallets and the like result in most identity theft. So I need to heal myself and break my careless habits! Make sure to do the same!

(No that's not a credit card. It's a frequent coffee buyer card.)