Threat Bulletin

executive summary

In this worlds of digitalization when everything is online. We do business online, we make money online, we meet our friends and families online and hence we all understand and appreciate importance of website. Now a day, no matter how small a business, everyone has got a website. Even we are searching for laundry or saloons online before visiting them. We even finalize our dine by checking the restaurant’s website online.

With this enhancements, need of security for these websites are increasing. Most of the times there is a myth that, why someone will hack my site as I don’t have anything important or classified on my website. But one important point that should be considered that customers are finalizing their plans just be     seeing their websites and if the site is compromised, it’s just directly impacting their businesses and hence this is why security of website is important.

The same scenario with almost all sectors, from IT companies, MNCs, restaurants, hospitals, schools, colleges and just for everyone.

wordpress in-secure

WordPress is most common and easiest way to develop website. Anyone with basic knowledge and internet technology can make their site or online application and bring it live and running within several hours. WordPress is completely open source and code is available to download for anyone, and for hackers too. Most of users do not care to configure it properly and harden its security and that’s the main reason why WordPress sites are compromised and servers are used for spamming and mass mailing. In 2015, we believe that with increment in WordPress sites, there will be a huge increment in hacking of these sites. Here are some of the most common  reasons why WordPress sites will be hacked in 2015, you can use these as checklists for securing your WordPress based sites and  applications –

Outdated WordPress version – We create site, update the content of sites but do not update the core WordPress as most of the time site is broken if they are updated as the plugins and themes doesn’t always support the latest version of version of WordPress. Using outdated version of WordPress open doors for hackers to a world of vulnerabilities. WordPress team keep of researching to find these vulnerabilities and releases security updates frequently. So consider changing your priority from broken WordPress to updating the core WordPress. Subscribe to mailing list of WordPress so that you can receive each and every update and bug fixes.

WordPress Version – WordPress version can be revealed from default installation files like readme.html, license.html and in    generator metatag. If these information are revealed then any  attacker can search for available exploits over exploit-db and get the exploit targeting that particular version.

WordPress database table prefixes – While creating table during insallation process of WordPress, the default prefix is ‘wp_’ . If      attacker manage to find SQL injection in your application then it will be very easy for him to get access of your databases too. So next time when you create a table in WorPress, make sure that you are not using default table prefix ‘wp_’.

WordPress Admin wp-admin lockdown - Most of the developers leave the wp-admin folder in without locking i.e. http://example.com/wp-admin. Finding this URL is very easy for any      attacker to launch bruteforce based password cracking         technique to get your login credentials. Consider changing your admin URL to http://example.com/red-plasma.

Database Permission – Most of the time when the WordPress      applications is compromised, the first thing hacker does is either to install backdoor or tamper with database. Instead of assigning FULL permission to any WordPress user; only five permission should be given INSERT, CREATE, ALTER, UPDATE and SELECT to any   WordPress user.

Insecure WordPress theme – Your WordPress core installation might be secure from most basic attacks like SQL injections but not your theme. Most of the themes don’t sanitize the input given by users on different fields and URLs and that lead to SQL injections. So no matter how much secure your WordPress installation is, if the theme isn’t secure then your site is also not secure.

Default WordPress Login – Most of the default WordPress login are vulnerable form bruteforce based password attacks. So if you are using username as admin then you are vulnerable and it’s possible that your password can be stolen. In many these, the name of the user who posted a particular post is revealed, so avoid using those themes and make sure your username isn’t revealed anywhere anyhow.

These are the most common vulnerabilities that attackers are     exploiting on WordPress sites, so if you are a WordPress user then stay alert as these types of vulnerabilities will be trend in 2015.

software piracy

Software piracy doesn’t only hurts the economic growth rates of companies but also directly hurts the users using pirated  software. Hackers are spreading malicious files like backdoors & Trojans to users on the name of free software. In an internal     research conducted at CCFIS labs we found that of the pirated software are binded with some malicious code. The users installing these pirated software,    watching pirated movies, listening pirated software are victim of cyber-attacks and in most of the cases, their systems are used to launch mass attacks as a part of botnet. In 2015, we predict that hackers will pirate more software and movies in order to increase their botnets.

Some of major disadvantages of using pirate software are – illegal use, no update or bug fixes, no technical support but the major disadvantage is being a part of any cyber-attack. Typically a cyber-attacked is launched in phase wise –

1. Hacker buys original software

2. Reverse engineer it and create crack or keygen

3. Bind its malicious code (backdoor/rootkit/trojan)

4. Spread thee software or movie via torrent

5. Use the system of users who install these software for launching mass cyber-attacks or for spamming.

Another smart way and easier way which is most common and  famous now a days is movie piracy. This involved below steps –

1. Hacker buy original HD print of any latest movie.

2. Bind it with exploit code of any most common media player, in most cases its either VLC or MX Player.

3. Upload it on torrent and start spreading

4. Once the user download and play it, the malicious code exploit the media player and as the media player have some access like System access of the system and hence this malicious code gets all the access that media player have i.e. System access.

5. Now attacker use the compromised system to perform           malicious activity like brute-forcing, DDoS, spamming, etc.

To mitigate this, one should must understand that ‘Nothing is Free’ except open-source. If you are using pirated software, watching movies, listening pirated songs then you are not only promoting  piracy but you are affecting yourself and pivoting cyber-attacks.

security practice failures

Most of us still believe that following standard security practices, policies, standardization and protocols saves the   network from attacks. These   assumptions are completely wrong as the security policies are structures, made by experts and follow a set of rules or we can say some protocols. But hackers who try to bypass these    policies are unstructured and have no policies or standard        protocols to follow to compromise your network. This is the major reason of failure of security policies. Simple – building have its rule but breaking doesn’t.

The truth is that most of the security appliances, products and techniques doesn’t work the way they are advertised and even few cases we have found that these devices who are there to protect are have vulnerabilities that allows attacks to gain access of network very easily. In 2015, we believe that no matter what policies we are following, hackers will find a way around to break it. Following are some of the standard policies which we are following and how hackers can bypass these standard policies –

Antivirus will safeguard my users – No, an antivirus can’t save your users completely and it never will. Hackers are releasing millions of malware every month which is more than even the number of computer users worldwide. While developing the malware, the first

 aim is to define its functionality and the second aim is antivirus evasion in which hackers write malicious code to bypass most    famous antivirus sites. The way we use sites like VirusTotal to scan a suspicious file for malicious code, even hackers follow the same approach while developing the malware. The malware is never   released until and unless it bypass all antiviruses. The time that the     antivirus vendors take to realize, analyze and release update for that particular malware, the malware had infected millions of users and the hacker is ready with another malware which is still undetected by most antivirus companies.

Firewall protects my network – Believing this the one of the biggest   mistake done by network administrators and security planners. In past we have seen that malware uses non-famous port to connect back to it command & control center. For example – a hacker developed a malware and coded it to connect with port number 8888 and then hosted it on his website or spread it wild on internet. Now how the hacker will come to know that how many PCs he have infected or how many PCs are part of his botnet. Simply, he will run a port scan and he will find all the systems with port 8888 open and he will find all the systems infected with his malware. This attack scenario has been mitigated by today’s firewall as if configured properly they only allow connection only on port no 80 or 443. The malware that are being    developed today are not establishing connection on ports like 80 and 443 and hence are not blocked by most of the firewalls. Previous    generation of malware were waiting for hacker to connect back but malware that are wild now a days send reverse connection and information automatically once the user is infected or compromised.

Password Policy will work – Policies says create strong password, one that is more than 8 characters, includes capitalization, number and special characters.

But think why this policy was made, because policy makers came to knew that password can be broken and hence the only way to      safeguard their breaking is to make the password more complex to make hacker’s task more difficult. This only make the hacker’s task    difficult to break the password not impossible. Let’s take a standard password with upper case, lower case, digit, symbol and of 8          character (Tx9@eLsP) and see how much time it takes hackers to break that password.

So the password of this complexity can be broke in 1.12 minutes.      Obviously breaking this password will need a lot of processing power and hackers have already found a way for that. By compromising   systems across the globe and adding them in their botnet and using the resource of those systems to break the password. Through these  almost every password can be broken.

Intrusion detection systems can find intent of traffic – IDS are good and in some scenarios it can be trustworthy. One can define malicious    signatures and if it that signature is detected then it alerts you or do the defined task of blocking or whatever the network admin defined. But like the most of the technologies, it doesn’t work the way we       expect it to work. The major bug in this system is that no vendor can put all the malicious signature into it. For example if a hacker is coding a script to launch a attacks and he launches the attack, then how this IDS will identify the signature of malicious attack or traffic, there isn’t any way until the vendor’s technical team have analyzed the attack and released signature for the same. Another scenario is how an IDS will identify the difference of between traffic of a CEO trying to get some documents from internal network from outside the network and an attacker using the CEO’s machine to enter the network to steal documents.

This doesn’t mean that all security policies are redundant and not of any worthwhile security your network. The most important way to       secure your network is to think like hacker, be innovative, taking risks, thinking out of box.

mobile devices

With increase in mobile devise and it users, mobile applications are also increasing. But this rapid increase in use of mobile technology has made tasks of hackers quite easy. According to research conducted at our CCFIS labs we have found that it’s easier to compromise any server with mobile application as compared to web application.

Most of the developer only focuses in securing their web  application so that any malicious or unauthorized requests are not send and processed on server but they don’t notice that their  mobile applications are also sending requests on their server and even malicious requests can also be send using mobile apps.Almost all functionality of web applications are present in their mobile apps.

In 2015, we predict that three major issues will raise in mobile security.First issue is of secure connection. Developers are implementing SSL to encrypt the communication between web applications and server but not using any strong mechanisms for encrypting communication between mobile applications and server.Second issue will be of  database. Till date hacker were using SQL injection in web applications to get access of all database files. But now    mobile applications are also communicating with database and hence any unexpected query can cause database   error and that may lead to SQL injection.

Third major issue that will raise in coming future is of reverse  engineering. Most of the mobile based operating systems are open source, except iOS and hence their applications are also open source which are vulnerable to reverse engineering. Hacker can steal  credentials that are stored in mobile application to authenticate with server and other databases.

These upcoming treats may bring any service or business down in  minute. We recommend developers to take care of these vulnerabilities while developing their applications. First issue can be   resolved simply by encrypting the connection using combination of several algorithms. For second issue we recommend to use sanitization. There isn’t any fail proof technique for stopping reverse engineering but best practices of secure coding will help users secure their applications and from reverse engineering.

hacking human healthcare equipment

With enhancement in smart technology from smart phones to smart house, now healthcare is also entering into making smart healthcare equipment for better healthcare. This saves life of many and provide medical support which wasn’t really possible decade also but also bring cyber threats that can allow a hacker to manipulate these devices and directly impact the health of any patient. In 2015, we predict that hackers will start developing exploits for these devices.

The drug infusion systems that are used for delivering morphine drips, chemotherapy and antibiotics are controlled remotely as these devices are installed in every room of patient and its easier, convenient and more efficient than manual doses. As these devices are controlled remotely and an attacker can also manipulate this systems to change the dosage. Many other     Bluetooth operated devices that are used for defibrillation to deliver shock to patient’s hearts can be manipulated. There are many other IP based devices which ae connected to the network can be compromised if attacker digs into the internal network of hospital.

Now a day’s many hospitals provided WiFi internet to families of patients and hence anyone can connect to the internal network of hospital network.Once a hacker is connected to the network, he can manipulate with the settings and inputs of these devices may lead to direct loss of life.

This domain still need a lot of research to identify exact vulnerability and loopholes that lies in these medical equipment’s and the system to mitigate this attacks. In 2015, along with security researchers, hackers will also perform attack on these devices to identify vulnerabilities.

   

  

  

Threat Bulletin

executive summary

Dynamic changes in technology opening new ways of doing business. Increase use of Smart Mobile devices, Social Media and Cloud platform offers attractive opportunities. However at the same time, they also pose a plethora of information security risk. We have to find new ways to tackle this new age  sophisticated cyber-crimes. Our dependency on technology is increasing and so the new breed of tech savvy fraudsters is coming out with new and innovative ways of carrying out Cyber Attacks. CCFIS is a research organization with a mission to secure the Nation’s IT infrastructure through our extensive and continuous Research. Our research reveals many key emerging trends in Cyber-Crime for year-2015.

In this digital world where everything is connected to itself and to our self, we at CCFIS question that how secure this connection is? In 2015, with enhancement of technology there will be increase in cyber threats. At CCFIS labs we conduct extensive continuous research and that has made us capable of predicting upcoming cyber threats and hacker’s psychology. Through this bulletin we are predicting some common threats that may raise in year 2015.

surveillance data privacy

Our banks, travel agencies, Adhar Card, PAN Cards, Email Hosting, Hospitals etc. stores very critical data about us. These data contains sensitive information like profile, financial information, email records, phone call details, pictures, travel &  location information and almost everything one need to know about anyone. These data helps LEAs in investigating crime and allows intelligence agencies to predict and mitigate threats to  nation and its citizens.

Unfortunately exactly the same information is required by any hacker to defame anyone or to perform any targeted attack. These critical data are stored in state of art data centers. These data are like golden pot for any hacker. Hackers and state    sponsored hacktivist groups are targeting these data of other    nations.

 In 2015, attacks will be more to compromise the data center rather than targeting users individually. No matter how much  secure one data center is, there isn’t any solution to targeted     attacks, especially when the attack is zero day.

We have two recommendations to minimize these attacks -

· One is by creating a complete local network of sensitive data and keep it accessibility limited only to close group & LEAs.    Data center should be hosted in a network and all users requesting some data should be in local network only and should not be connected to internet anyhow.

· Implementation of device authentication by access control lists will be addition layer of security. Another solution to minimize these attacks should be by installing honeypots. As when attackers will try to compromise the network, they will see two options, one will be original network and another will be fake network. The fake network will be easier to compromise and will have fake data to lure and confuse hackers.

internet of things

When we talk about Internet of Things, every time we hear about most famous word ‘Connected’. But the question raises, how secure this connection is? These connected devices control our home, offices, electrical appliance and what not. Most of these devices are guarding our homes. These devices are mostly based on ARM technology with boards like Arduino, Raspberry Pi, Intel Galileo, CubieTruck and custom based low powered devices. These devices aren’t that much powerful to be configured securely. Most of these boards are open source and their firmware are available over internet for anyone to download and tinker with.

Hacker will be interested in Internet of Things and Connected devices, following are some of the threats that we can predict for 2015 –

· Most of the IoT devices uses open source boards and their firmware can be reverse engineered to find vulnerabilities and various devices can be exploited.

· ‘Connected’ means these devices will be connected to internet or your mobile device or to any central server to process requests. But the connection between these devices can be vulnerable.

· The way you can access your home’s electrical appliances via internet, hackers can also access these devices via internet and exploit.

· Central servers that acts control and command server can also be a major target from hackers. As once they have compromise this server, they can control all the devices connected to this server. For example if a company A has          manufactured a home security system, this home security system is installed in 1000s of houses and is connected to central server of company A via internet. Users login to web portal of company A to access their devices using their credentials. Now instead of attacking and compromising every device, hackers can target the central server of Company A through which they can control all the home security systems that company has manufactured.

We recommend manufacturers and makers to go for custom boards rather than using open source boards if they are going for commercialization and mass production of their appliance. Manufacturers need to perform proper and timely VAPT of customer appliances and their internal server to stay a step ahead from hackers. Also the connection between appliance to server and server to user should must be encrypted. For users we recommend to buy appliances in which there are options to define access control, so that they can define that will access the appliances. These are some of the best practices that can reduce threat but cannot mitigate it completely.

biometric data from social media & internet

As per BBC News, hackers have found way to clone fingerprints just picture taken from any standard camera. Hackers also claimed that they have cloned thumbprint of German Politician and also they cloned finger print of defense minister Ursua von der Leyen. 

This time hackers did it with some commercial image processing software and it’s just a matter of time that someone will develop an open-source tool for the same and will be shipped bundled with Kali-Linux. However the technique hasn’t been made available to public yet.

Most critical assets and systems of any countries are secured using biometric technologies, generally with fingerprint or retina scans of our leaders. Photographs, videos, fan pages of our leaders are available online and that too in high definition. If a hacker needs to break into any system which is controlled by country’s leader then instead of exploiting that system, he will download some photograph of leader and can find his fingerprints to bypass security. The eyeball in pictures of these leaders can be used to create duplicate eyeballs using 3D printer which is available in less than 100$.

The threat is not only limited to our   national security but we as common men are also vulnerable to these. Most of laptops are equipped with   biometric sensors (especially corporate laptops) and we all have our social media account in which we have posted some photos that reveal palm and hence fingerprint. Hackers can take advantage of this and can enter our  personal or business laptops.

There isn’t any counter measures to these types of attacks as the attack prototype hasn’t been released yet by hackers. But we  recommend our leaders to use gloves while attending public or press conferences. We as common men should take sufficient care to hide our palm as much as possible (especially fingerprints) to avoid such   attacks. Banks in 2015 are about to install fingerprint authentication in their ATMs.

hacking airlines

Flight controller software that is used to control each and every action of flight runs on an operating system and most of the time its Linux. After missing of Malaysian MH370, many researcher claimed that it’s a result of cyberattack.The flight controller software of MH300 was compromised and then its direction and coordinates were changed. But sending malicious codes to flight controller can only be done through base station and hence there must be someone insider involved in this attack.

In 2015, we predict that hackers will find out ways to compromise these flight controller software remotely without even help of any insider, and this will become scenario extremely worse as the result may cause loss in human life. In 2015, hackers will also try to find out technique to compromise flight controller software of fight airplane by hacking the systems of base stations which are connected to internet and are easier targets as they run on  operating systems like Windows and Linux which are publically available and if not properly configured or updated then are vulnerable to cyber threats.Even the hackers can create certain antennas using open source technology to communicate with flying airplanes and can also intercept the communication. We have already seen the example in 2014, same or more sophisticated attacks can be tried again in 2015 by hackers or by state sponsored hacktivist groups.

Researchers and airport authorities’ needs to work very cohesively and try to find out possible loopholes in airplanes and any system directly or indirectly connected to these airplanes. Even airport authorities should plan for international conference and invite    researchers across the globe to understand and mitigate their findings.

printer & camera as bitcoin miner

We have already seen in 2015 that how hackers compromise user systems via pirated games,  applications to perform Bitcoin mining. In 2015, hackers will be interested in making more and more money though any device connected to internet.

Now a days we have cloud printers, IP cameras and many other devices. We can control any of these devices from anywhere across the globe using internet. This enhancement in technology has made our life and business easy but have also enabled many threats. Using search engines likes Shodan HQ, hackers can search and find any online devices ranging from printer or IP cameras or anything.

In 2015, we predict that hackers will try to compromise these online devices for bitcoin mining. Obviously the mining speed will be very slow and it will be a very complex process to compromise these devices but once the exploit will be developed, thousands or millions of online devices will be at threat and will be used for Bitcoin mining. Even hackers can target the manufacturing plans of these appliances and embed the Bitcoin miner in the firmware itself by compromising the internal systems. If a hacker can generate 0.05 BTC from one device in one complete month and if he compromise 1,000 such devices then he can generate around 50 BTC and hence making an amount of Rs. 10,00,000 per month.

 The Bitcoin mining is completely untraceable when it comes to mining from printers or IP cameras as there isn’t any task manager to monitor running processes or any antiviruses to safeguard these devices.

Manufactures needs to make their firmware more secure and stop    distributing the firmware to anyone on the name of offline update. Manufacturers should not only focus on functionality and features of these devices but should must  focus on security of these devices.

Periodic testing and vulnerability assessment should must be carried out from manufacturer side and update should be released and owners should be informed about this via mail. Most of the manufactures releases the updates and but do not care to inform the owner that why they released this update, and why this is important for you to update your device. The relationship between owner and manufacturer should must be crystal and manufacturers should must inform owners about the vulnerabilities they have found, what patch they are releasing, how and why this is important for you to install.

  

  

  

Forensic Bulletin Advanced

executive summary

Any Organization – big or small, can be target of any  Cyber-attack. Password only protection are weak   authentications and are too risky. Also, with the adoption of Cloud based IT Infrastructure, Organizations are expected to   secure what they don’t own, manage or control. Users want the complete freedom to browse on web, not only when and how but also with the devices of their own choice. Cyber criminals are taking advantage of today’s “any-to-any” world where individuals are using any device. The threats targets are across domains without discriminating by Industry, Businesses, size or Country. Cyber criminals are constantly evolving new techniques to bypass security. “Forensic Bulletin” is special CCFIS monthly Series Bulletin based on advancements and upcoming trends in digital forensics as per research work done by CCFIS Team, who is constantly watching vigilantly all new advanced techniques and cyberspace threats.

As per recent survey by one of reputed Research Center, 50% of Organizations had experienced at least one occurrence of  economic crime in last 1 year. Instances of such frauds losing   billions of dollars. Those, who commit frauds have become   craftier and are launching more complex plan. However, only few of the Organizations are responding to growing threats by tightening up their controls and investing in fraud detection and prevention as per professionals/expert opinion.  

The “any-to any” evolution already involves billions of internet connected devices and is expected to grow many folds in next few years.

hiding data like a ninja

A cyber-espionage case study

We all have some data either related to our business or personal that we don't want to share with anyone. These data may be your trade secrets, financial documents, patent files or whatever that matters to your business and hence your life. To achieve this, we use diffeent of encryption software, folder locks and what not but due to increase in responsible disclosures we have came to know that no matter what you do, your data is not secure at all. Encrypting data isn't a good option, as the most trusted encryption utility 'truecrypt' announced that 'WARNING:  Using TrueCrypt is not secure as it may contain unfixed security issues'. Now most of us are not left with any options to rely upon for security of our data. Data theft can not be curbed completely but it can be minimized.

First of all torn out the label pasted on your HDD that tells about its specification like size, RPM, brand, model no etc. Now create the size of HDD to 250 GB with just one partition having OS installed on it. To understand it more, let us explain the basic structure of internals of an HDD.As shown in the pictograph, inside a HDD there are two platters and two heads to perform read/write functions on them, data    exists on both the platters.

Now behold the genius of the plan: What if you stores the confidential data on the second platter and disables its head and    configures HDD such it only works with one head and reads data off only one platter?

This method is effective as its known to very few of us. The head count of the HDD will show Two (2) heads in total but the   engaged head count will show only one (1) head in total.

Now store your confidential data on that hidden drive. Later on when you want to access it back, reconfiguring the HDD, enable the disengaged head of the Hard Disk and you will get your  hidden partition. For better security, you can encrypt this drive too.  So now you can make a 500 GB HDD into 250 GB HDD with 250 GB as your hidden ninja storage.

Note : - For technical specifications, drop a mail at info@ccfis.net.

man in the ‘email’ attack

Email Scam Alert in Indian Small & Medium Enterprises

In last one year CCFIS has been asked to give expert advisory in cases related to email spoofing from various LEAs and  private companies. This particular email scam can be called as ‘Man-in-the-E-mail’ attack. Following are two most prominent email scams using ‘Man-in-the-E-mail’ attack technique:

The modus operandi of this particular email scam victimizing businesses         nationwide starts with compromising the email accounts of businesses, studying the email correspondence of active business deals which involves a substantial amount of money transfer. The perpetrator then identifies the target company’s e-mail domain and creates a similar domain by altering one or two letter in the email address. To an unsuspecting eye it is easily deceptive and passes as the original email address. The perpetrator then starts acting as a relay point between both the parties passing on either party’s email message to the other. Thus gaining control over the communication, editing & forwarding the content of email messages to his benefit. In other cases, the perpetrator identifies when the company executives are travelling from the information gathered from social media sites like  Facebook/twitter or compromised the executive’s e-mail account. 

When the executives are out-of-town, the subject sends an e-mail to an individual in the company who is authorized for wire transfers and bill payments. The e-mail usually appears to come from the company’s CFO requesting the wire-transfers on behalf of the CEO. To make the request appear legitimate, the e-mail contains a fraudulent e-mail chain started by the CEO requesting the transfer. The email              consistently asks for money to quickly be wired to a specified account and usually states that the wire transfer should be coded to  “Misc.    Expense-executive” or “Admin-Expense.” The success of these email spoofing scams largely depends on the awareness of the employee. A normal employee fails to identify the differences between a spoofed email and a genuine email. Lack of cyber security training is must for small and medium enterprises of our country to prevent such loses in the future.

CCFIS advises that while reporting similar incidents to the authorities, victim organizations should maintain the e-mails with the original extended headers and any attachments such as .PDF files that provide directions for the money transfers as these can proved to be crucial  evidences.

chip-off forensics

As digital forensic professionals we are accustomed to face  challenges. How do we obtain a full forensic image from embedded flash memory chips if physical extraction is not supported, what if the device is itself physically broken &  damaged beyond repair? In such cases we perform chip-off forensic analysis, defined as the extraction and analysis of data stored on flash memory chips.

Few chip-off scenarios we encountered at CCFIS:

A phone broken in two pieces – with its connecting ports  damaged there is no way to access the data or image the data stored inside. We need to take of the chip and perform recovery procedures on it.

Pen drive shot by an AK 47 bullet – The pen drive was broken  and the connecting port was melted by the heat of the bullet. A    chip-off analysis is now required to access the data inside.

Also, the chip-off process makes it possible for water damaged devices and items lacking connection ports to be acquired or analyzed. A chip-off requires a different setup than a normal   computer forensics lab has. An ideal chip-off workbench has  electrical rework equipment and chip programmers.

The rework equipment is used to remove, clean, and prepare memory chips prior to data acquisition. The chip programmers are used to actually interface with the memory chip and download the stored data to a raw image file.

The ultimate goal of a chip-off project is to capture and analyze the raw data saved on a target device's flash memory chip on the printed circuit board (PCB). In order to accomplish this, A    typical chip-off project progresses through three distinct          phases - Assessment, Acquisition and Analysis.

The Assessment Phase - The assessment phase involves researching the target device to make sure it is a good chip-off candidate and to confirm no other    full-physical memory extraction possibilities exists then only preparing it for the extraction.

The Acquisition Phase - The acquisition phase involves the actual chip removal and capture of data. This is when the rubber meets the road and actual chip-off happens. This is accomplished by disordering the chip from PCB, utmost care is to be taken.

The Analysis Phase – The analysis phase involves the recovery and interpretation of the acquired data. Once the raw data has been extracted, analysis can begin. The data examination is often the most challenging aspect of a chip off project. In addition to vast differences in device operating systems, file systems, and data storage structures, the examiner must understand and account for the low-level characteristics of flash memory.

The process can be daunting and may require development of custom programs or scripts for a particular device. In addition to vast differences in device operating systems, file systems, and   data storage structures, the examiner must understand and  account for the low-level characteristics of flash memory. The   process can be daunting and may require development of  custom programs or scripts for a particular device.

The common issues & problems faced by the examiner is to    identify the target memory chip and virtually built the controller of the chip. In these cases, the examiner will need to communicate with the various programmer manufacturers and request support be added for the new chip model. The removal process does  carry some risk of damage to the memory chip and loss of data when the chips are exposed to high-temperature profiles which are required to melt lead-free solder.

The chip-off process is definitely an advanced technique and can be utilized in majority of devices as flash memory is utilized in all sorts of other devices.

Certainly, the vast majority of chip-off projects we work involve mobile phones, but nearly any device that contains embedded permanent storage capabilities can be extracted these include tablet, GPS units, voice recorders, printers/ scanners, music players, cameras ,video game consoles, vehicles, industrial machines, medical testing equipment, network devices and security systems.

byod forensics

Extracting a full bit-stream image from devices containing embedded flash memory

The concept of BYOD is not new, the oldest example of BYOD would be carrying personal USB thumb drives to work. Since then technology grew so did the BYOD trend, statistics indicate that the medium by which most people access the internet wirelessly is using a portable device like a smartphone or a tablet.

As mobile devices continues to evolve and expand their availability, utility and versatility increases. Corporations and law firms face increasing pressure from employees and consultants to permit the use of personal devices on the organization's network. With BYOD policies implemented employees shows improved productivity, ease of mobility, and a more satisfying end-user     experience.

But this trend of BYOD, poses serious challenges and risks for organization’s data and its network security. There is the significant risk that permitting such connectivity might introduce viruses,   malware and other forms of trouble into the organization's file  servers, email systems and mission critical infrastructure. Second, there is the increased likelihood of data breaches, theft of proprietary information and trade secrets, and loss of intellectual property.

Just a month ago we came to know about  serious data theft in a company who lost a million rupee tender by a thin    margin. Company officials were baffled on how could their rival company come so near to their bid. They suspected someone from their company leaked those confidential bidding    documents. Later on it was revealed that one of their employee used her iPod to copy those documents by accessing the USB port of the computer system on the name of charging it.

In a similar case, an IT company had to face serious repercussions after its software code was stolen. On investigation it was  established an android smartphone opened in USB Mass Storage Mode was used to copy the source code.

So how can organizations reach a compromise betweenappropriate and adequate security while implementing an effective BYOD policies which fulfils the technology wants and needs of their internal client base?

Through proper planning, appropriate policy, and periodic review and assessment, organizations can successfully permit employees' use of personal devices, without sacrificing information security.

Android Malware Investigation

As smart phones are increasing, so does the mobile malware

In fast few years we have seen that companies hire competitor’s employees to perform better. Now competitors hack into each other’s email accounts, servers to get data relevant to their business. Now a days competitor are now targeting mobile devices which are now equally powerful as desktop pc holding more confidential data. Sophistication of mobile hacking has  increased to such a level that the victim never realizes that he was ever comprised.

Our internal research shows that these types of attacks has increased exponentially and mostly in IT industry. We everyday hear about incidence of e-mail security breach and email  stealing of a top level official of an IT Company due to which    confidential files, client details, their account numbers and financial information are compromised. When these incidence happens, most of us are in  suspicion that email server or the  personal/official computer might have been compromised by a malware. But we rarely notice that we also accesses emails through our Android based smart phone. Most of android  malware are detected by security software but targeted malware are always dormant and smart enough to perform their tasks  without leaving any suspicion. 

It can be analyzed by acquiring dumps of physical, logical and memory of the smartphone. From the physically acquired dumps of the mobile phone, every application executable file can be   extracted along with metadata like installation date and time.

The extracted android executable (.apk) can be then installed and executed in android emulator (a virtual phone that runs on computer) for further analysis. Out of all installed applications,  you may find some application behaving suspiciously. Further analysis can be done of these suspicious executable (.apk) like reverse  engineered to know the permissions given to the application, source code of the application and associated JAR files ( java   executable). For in-depth analysis one can also connect mobile phone in a sandboxed environment and capture all data packets for several hours to analyze its behavior.

 If your device is compromised that very soon you will get IPs  to which your device is communicating. Close all applications and run only selected suspicious applications, you will see a lot of data packets are exchanged between your device and detected IP.

If you run a business then there are possibilities that the IP can be of your competitor.

The internet is full of these types of malicious android apps that can compromise your android device in minutes using 0-day exploits.