Michigan State Police Cyber Computer Crimes Unit (CCU) & Michigan Cyber Command Center (MC3) Luke Thelen Ron Kraus, CFCE

Transcription

1 Michigan State Police Cyber Computer Crimes Unit (CCU) & Michigan Cyber Command Center (MC3) Luke Thelen Ron Kraus, CFCE

2 Topics To Be Covered MSP Cyber Section Internet Crimes Against Children Task Force (ICAC) Investigations Forensic Exams Cyber Security

3 MSP Cyber CCU formed in 2000 MC3 formed in 2013 Assisting unit for state, county, & local law enforcement agencies Oversees ICAC Task Force Assist in investigations Perform forensic exams

4 MSP Cyber First offices in Lansing & Livonia Added Rockford, Flint, Traverse City, Coldwater & Marquette Oversees ICAC Task Force Assist in investigations Perform forensic exams Facilitates training other agencies

5 ICAC Task Force Protecting Kids online Internet Safety Presentations Awareness Programs MichiganICAC.com Facilitates training other agencies

6 ICAC Task Force NCMEC Cybertips clearing house Online Investigations Peer to Peer Investigations Perform forensic exams Affiliates

7

8 ICAC Task Force Affiliates Clinton CSD, Bellaire CSD, East Grand Rapids PD, Grand Traverse CSD, FBI, Fruitport PD, ICE, Ingham CSD, Kalkaska CSD, Kent CSD, Kentwood PD, Lansing Community College PD, Livingston CSD, Livonia PD, MACE, MDOC, Monroe PD, Muskegon PD, Muskegon Twp PD, New Baltimore PD, Ottawa CSD, Troy PD, US Postal Inspectors, US Secret Service, West Bloomfield PD, and many more

9 Investigations Assisting Unit Search Warrants for ISP Investigative Web Sites Credit Card Fraud Point of Sale Tracing

10 Investigative Web Sites Lookup registered administrators of domains and systems

11 IP Location Finder

12 Investigative Web Sites ISP Contact Information

13 Investigative Web Sites Training and Investigative Support

14 Investigative Web Sites Used to lookup personal address, phone number, and

15 Investigative Web Sites ICCC s mission is to address fraud committed over the internet

16

17 Credit Card Skimmer

18 Headers Reveal complete header and read from the bottom up Use header information to trace to originating servers IP address Subpoena or search warrant to obtain user s contact information Information provided by subscriber maybe false

19 Headers ISP s may provide tracking information Information maybe TIME SENSITIVE Must contact ISP quickly to retain evidence Most providers will freeze or preserve if notified of impending subpoena or search warrant

20 Basic Header

21 Full Header

22 Forensic Examinations Forms of Digital Evidence Acquiring Digital Evidence System Operability Analyzing Data

23 Forensic Examinations Forms of Digital Evidence Desktops Laptops External Drives Thumb Drives Game Consoles Mobile Devices Portable Navigation Devices Pocket Drives Media Memory Cards Apple idevices Android Devices Etc

24 Forensic Examinations Acquiring Digital Evidence Write Block Evidence (Digital Media) Hardware Devices Software Solutions Validate Process

25 Forensic Examinations Acquiring Digital Evidence Create Image of Digital Media FTK Imager (E01 & DD files) Validate Process

26 Forensic Examinations Acquiring Digital Evidence Generate MD5 Hash of Digital Media 32 digit Hexadecimal Number Base-16 (0-9 and a-f for 10-15) Verify MD5 Hash MD5: b a664d780de733f71b71cedc9

27 AccessData FTK Imager

28 AccessData FTK Imager

29 Forensic Examinations System Operability Does Computer boot Check CMOS settings Internal connections

30 Forensic Examinations Analyzing Data Allocated & Unallocated Space Audio, Graphic, & Video Files Text, Word, HTML, Excel, etc... Docs Internet History (IE, Firefox)

31 Forensic Examinations Analyzing Data Instant Messaging MS Windows OS Artifacts Other Installed Applications EXIF Data & Geo Tags

32 Forensic Examinations Data Volume Examples Empire State Building - New York City 1,250 ft (15 GB) (x 8 for 100GB) Willis Tower - Chicago 1,450 ft (17 GB) (x 30 for 500GB) Burj Khalifa - Dubai 2,717 ft (33 GB) (x 30 for 1TB)

33 Guidance Software EnCase Forensic Forensic Examinations Acquiring Digital Evidence System Operability Analyzing Data

34 Cyber Security Passwords Roses are Red Violets are Blue You thought you had a strong password Now I hacked you

35 Cyber Security You tell me Roses are Red Violets are Blue You thought you had a strong password Now I hacked you

36 Cyber Security Passphrase Spaces I really love lasagna. (no number, 22 characters long, easy to remember) No Spaces Ireallylovelasagna. (no number, 19 characters, still easy to remember)

37 Cyber Security My Password is STRONG! (I think ) Google: Haystack password

38 Questions