Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

C702 Forensics and Network Intrusion > Defeating Anti-forensics Techniques > Flashcards

Defeating Anti-forensics Techniques Flashcards

1
Q

Anti-forensics

A

also known as counter forensics, is a set of techniques that attackers use in order to sidetrack the forensic investigation process. These techniques are designed to negatively impact the quantity and quality of evidence gathered from a crime scene.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What happens when you delete a file out of a FAT file system

A

The OS replaces the first letter of a deleted file name with a hex byte code: E5h (E5h is a special tag that indicates that the file has been deleted)
The corresponding cluster of that file in FAT is marked as unused, although it will continue to contain the information until it is overwritten

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What happens when you delete a file out of a NTFS file system

A

When a user deletes a file, the OS marks the file as deleted in the master file table (MFT)
The clusters allocated to the deleted file are marked as free in the $BitMap ($BitMap file is a record of all used and unused clusters)
The computer now notices those empty clusters and avails that space for storing a new file
The deleted file can be recovered if the space is not allocated to any other file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Deleted files in older FAT file system (Windows 98 and prior) are stored in?

A

Drive:\RECYCLED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Deleted files for NTFS file system (Windows 2000, XP, NT) these are stored in?

A

Drive:\RECYCLER folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Deleted Files for Windows Vista and newer systems?

A

C:$Recycle.Bin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the Recycle bin limit for Win Vista and later?

A

No Limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the Recycling bin limit for systems prior to Win Vista?

A

3.99 GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does Windows Vista and later OS’s rename the files stored in the Recycle Bin?

A

$Ry.ext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What do systems prior to Windows Vista rename the files stored in the Recycle Bin?

A

Dxy.ext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the x and y represent for the renaming of files in the recycle bin?

A

In this naming process, “x” represents the drive name, “y” a sequential number starting from 0, and “.ext” being the original file’s extension such as .doc,
.docx, .pdf, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where does the OS store details about deleted files?

A

Infor or Info2 hidden folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What do you do if the Recycle bin stops working?

A

If the Recycle Bin is not working or damaged, then delete the hidden INFO file from the Recycled folder and restart Windows to re-create the INFO file; this will enable you to access the deleted files in the Recycle Bin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MAC OS X File Recovery

A
  1. Files move to trash folder if you delete them.
  2. If Shift+delete is used, you bypass trash, but files can still be recovered using local or forensic tools such as TIMEMACHINE or REMO Recover or MacKeeper
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Linux File Recovery

A
  1. Files deleted using /bin/rm remain on the disk, and are recoverable.
  2. If an executable is deleted, its contents can be retrieved from
    /proc memory image; the command “cp /proc/$PID/exe
    /tmp/file”
    This creates a copy of a file in /tmp
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What do you do when a HD partition is deleted?

A
  1. When a hard drive partition is deleted, what really happens is that the parameters that specify how the partition is setup are deleted, but the data stays intact and is waiting on you to recover it!!
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Partition Recovery in Windows

A
  1. Recovery console through the install media
  2. Remove HD from source machine, mount it as a slave in another machine
  3. Use third-party recovery software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 3 password types?

A
  1. Cleartext
  2. Obfuscated
  3. Hashed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Password Attack Categories

A
  1. Passive on-line
    a. Wire sniffing
    b. Man-in-the-Middle (MitM)
    c. Replay
  2. Active on-line
    a. Guessing
    b. Malware
    c. Hash Injection
  3. Offline
    a. Pre-computed/Rainbow Tables - http://projectrainbowcrack.com/table.htm
    b. Distributed Network (grids !!)
  4. Non-electronic
    a. Shoulder surfing
    b. Dumpster diving
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How are Hashed Passwords Stored in the Windows SAM file?

A

The SAM file is stored at %SystemRoot%/system32/config/SAM in Windows systems, and Windows mounts it in the registry under the HKLM/SAM registry hive. It stores LM or NTLM hashed passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Steganography?

A

Steganography is a technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain confidentiality of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Substitution Steganography

A

substitutes redundant part of the cover object with a secret message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Transform Steganography

A

embed secret message in a transform space of the signal (e.g. in the frequency domain)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Statistical Steganography

A

embed messages by altering statistical properties of the cover objects and use hypothesis methods for extraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Distortion Steganography

A

Store information by signal distortion and in the extraction step measure the deviation from the original cover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Cover Generation Steganography

A

Encode information that ensures creation of cover for secret communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Technical Steganography

A

use of physical or chemical means to hide information

28
Q

Linguistic Steganography

A

use of natural language to hide message in non-obvious ways

29
Q

Image Steganography

A

replaces redundant bits of image data with message

30
Q

Least Significant Bit Insertion Image Steganography

A

The right most bit of a pixel is called the Least Significant Bit (LSB). The binary data of the hidden message is broken up and inserted into the LSB of each pixel in the image file in a deterministic sequence. Modifying the LSB does not result in a noticeable difference

31
Q

Masking & Filtering Image Steganography

A

Mostly used on 24 bit and grayscale images. The masking technique hides data using a method similar to watermarks on actual paper, and it can be done by modifying the luminance of parts of the image. Masking techniques hide information in such a way that the hidden message is inside the visible part of the image.

32
Q

Algorithms & Transformation Image Steganography

A 
The data is embedded in the cover image by changing the coefficients of a transform of an image
Types of techniques:
1. Fast fourier
2. Discrete cosine
3. Wavelet
33
Q

What are the three types of Image Steganography?

A

Least Significant Bit Insertion
Masking & Filtering
Algorithms & Transformation

34
Q

Audio Steganography

A

refers to hiding secret information in audio files. Information can be hidden in an audio file by using LSB or by using frequencies that are inaudible to the human ear (>20,000 Hz)

35
Q

Echo Data Hiding Audio Steganography

A

the secret message is embedded into a cover audio signal as an echo. The parameters of the echo, amplitude, decay rate and offset from the original signal, are varied to represent an encoded secret binary message

36
Q

Spread Spectrum Audio Steganography

A

encodes data as a binary sequence that sounds like noise but can be recognized by a receiver with the correct key

37
Q

What are the five approaches used in spread spectrum Audio Steganography?

A 
Direct Sequence Spread Spectrum (DSSS) 
Frequency Hopping Spread Spectrum (FHSS) 
LSB Coding
Tone Insertion
Phase Decoding
38
Q

what are two types of Audio Steganography?

A

Echo Data Hiding

Spread Spectrum

39
Q

What Is Direct Sequence Spread Spectrum (DSSS)?

A

A secret message is spread out by chip rate (constant) and then modulated with a pseudo-random signal that is then interleaved with the cover signal

40
Q

What is Frequency Hopping Spread Spectrum (FSSS)?

A

audio file’s frequency spectrum is altered so that it hops rapidly between frequencies

41
Q

What is LSB Coding?

A

replaces the LSB of information in each sampling point with a coded binary string

42
Q

What is Tone Insertion?

A

depends on the inaudibility of low power tones in the presence of significantly higher spectral components

43
Q

What is Phase Decoding?

A

It encodes the secret message bits as phase shifts in the phase spectrum of a digital signal, achieving a soft encoding in terms of signal-to-noise ratio

44
Q

Video Steganography

A

hiding secret information or any kind of files with any extension into a carrier video file. Discrete Cosine Transform (DCT) manipulation is used to add secret data.

45
Q

Issues to consider with Steganography?

A
  1. Levels of visibility - embedding cannot distort cover image to point that it is noticeable
  2. File format dependence - image and sound files are either lossless or lossy.
    a. Lossy compression reduces file size by permanently eliminating certain information, especially redundant information (even though the user may not notice it). JPEG is an example of a format using lossy compression. Does not maintain data integrity. Vector Quantization is used.
    b. Lossless compression retains raster values during compression and file size is also reduced. For example, LZ77 is a lossless compression file type. Maintains data integrity. Huffman Coding algorithm & Lempel-Ziv Coding algorithm are used.
  3. The conversion of lossless information to compressed lossy information destroys the hidden information in the cover.
46
Q

What is Stegoanalysis?

A

the art of discovering and rendering covert messages using steganography

47
Q

Steganography Attacks

A 
Stego-only
Known-Stego
Known-message
Known-cover
Chosen-message
Chosen-Stego
48
Q

What is a Stego-only attack?

A

You only have access to the stego-medium or stego-object. In this attack, the staganalyst needs to try all possible steganography algorithms and related attacks to recover the hidden information.

49
Q

What is a Known-stego Attack?

A

You know the steganographic algorithm as well as original and stego-object. You can extract the hidden information with the information at hand.

50
Q

What is a known-message attack?

A

Presumes that the message and the stego-medium are available. Using this attack, one can detect the technique used to hide the message.

51
Q

What is a known-cover attack?

A

Attackers have knowledge of both the stego-object and the original cover-medium. This will enable a comparison between both the mediums in order to detect the changes in the format of the medium and find the hidden message.

52
Q

What is a chosen-message attack?

A

The steganalyst uses known message to generate a stego-object by using some steganography tool in order to find the steganography algorithm used to hide the information. The goal in this attack is to determine patterns in the stego-object that may point to the use of specific steganography tools or algorithms.

53
Q

What is a chosen-stego attack?

A

takes place when the steganalyst knows both the stego- object and steganographic tool or algorithm used to hide the message.

54
Q

Pixel

A

A single point in an image

55
Q

Bit Depth

A

Number of colors available for each pixel

56
Q

Resolution

A

Sharpness and clarity of an image

57
Q

File Formats

A

Particular ways to encode information

58
Q

Image file size

A

measured in bytes

59
Q

Compression

A

the method used to make an image smaller

60
Q

Vector Images

A

use geometrical primitives such as points, lines, curves, and polygons, which are all based upon mathematical equations to represent images in the computer

61
Q

Raster Images

A

a data file or structure representing a generally rectangular grid of pixels, or points of color, on a computer monitor. A colored raster image has pixels with eight bits of information for each of the red, green, and blue components. Quality of a raster image is determined by the total number of pixels and the amount of information in each pixel

62
Q

Standard Image File Formats

A
  1. Joint Photographic Experts Group (JPEG) - .jpg
  2. JPEG 2000 - .jp2
  3. Graphics Interchange Format (GIF) - .gif
  4. Tagged Image File Format (TIFF) - .tif
  5. Windows Bitmap - .bmp
  6. Portable Network Graphics (PNG) - .png
63
Q

Rootkit detection techniques:

A
  1. signature based
  2. heuristic / behaviour based
  3. integrity based
  4. runtime execution path profiling
  5. cross-view based - function by assuming that the attackers have disrupted the OS in some way. This detection technique relies upon the fact that the API hooking or manipulation of kernel data structure taints the data returned by the OS APIs, with the low-level mechanisms used to output the same information free from DKOM or hook manipulation.
64
Q

Userland Execve Technique

A

lets programs on the victim computer load and run without using the Unix execve() kernel call, thereby letting the attacker overcome kernel-based security systems that might deny access to execve().

65
Q

Syscall proxying

A

Rather than uploading the entire exploit program, the attacker can upload a system call proxy to accept the remote procedure calls from the attacker’s machine. The victim’s machine executes the requested system call and sends the result back to the attacker.

C702 Forensics and Network Intrusion (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions