Digital

The Quarterly Magazine for Digital Forensics Practitioners Issue 43 • Q2 2020

ForensicS
Magazine

Virus
Tracking
Apps
Brian Cusack investigates
Contact Tracing issues

PLUS
Memory Forensics
Enabling Intelligent Cities 43

The History of Cryptography 9 772042 061004

Regular Features: News, Legal & Much More! Issue 43 / £14.99 TR Media

DFM43_OFC_Cover - Online.indd 1 13/08/2020 16:34

DFM43_IFC_Ad - WMG.indd 2 13/08/2020 18:06
 EDITORIAL

Digital Forensics Magazine is a quarterly magazine,

published by TR Media Ltd, registered in the UK.
It can be viewed online at:
www.digitalforensicsmagazine.com

Editorial
Editorial Board
Roy Isbell, Alastair Clement, Scott Zimmerman,
Angus Marshall & Tim Watson

Acquisitions
Roy Isbell, Prof. Tim Watson & Scott Zimmerman

Editorial
Roy Isbell

News Desk
Matthew Isbell

Sales & Marketing

Safia Halaq

H
Production and Design
ello Everyone. I trust that you are all staying as Matt Dettmar
www.freelancemagazinedesign.co.uk
safe as you are able in this new environment
we find ourselves in. Just like the rest of the Contributing Authors
Hugh Boyes, Brian Cusack, Gareth Davies,
world here at DFMag we are working hard Peter Eden, Roy Isbell, Angus Marshall, Roy Isbell,
to deal with the impacts of the Covid-19 Andrew Jenkinson, Rick Leinecker, Angela Mison
& Scott C. Zimmerman
Coronavirus pandemic. We found ourselves in March and
April suddenly cut off from a significant number of our revenue generating Technical Reviewers
Prof. Tim Watson, Scott Zimmerman,
activities as the whole world went into lockdown and all events around Roy Isbell & Angus Marshall
the world were cancelled. Our priority was therefore one of survival,
Website
whilst preserving as much of the magazine as is possible. Designed by BluCreative.co.uk
We had to make some difficult decisions and changes in order to reduce
our outlay based on the remaining income generated from the subscription Contact
base that we have. We have, therefore, decided to stop all print copies of the
Editorial
magazine indefinitely. There is more about this in a small feature on page XX Contributions to the magazine are always
of the magazine. We also had to trim staff to core volunteer staff, and this welcome; if you are interested in writing for
Digital Forensics Magazine or would like to be
put a significant burden on our volunteers. However, I am pleased to say that on our technical review panel, please email us:
they all rallied around and here is Issue 43; somewhat later than planned, [email protected]
Alternatively, you could telephone us on:
in reduced format, but published all the same. +44 (0) 8445 717 318
Our authors and volunteer staff have all been terrific, and my thanks goes
News
out to them all for sticking with us during these times. It is heart-warming to If you have an interesting news items that
know that they fully support what we are trying to do with the magazine, you’d like us to cover, please contact us on:
[email protected]
and to provide for the industry.
So, what can you expect going forward? Well, the magazine will certainly Advertising
If you are interested in advertising in
be leaner in terms of physical pages, as much of the advertising that we Digital Forensics Magazine or would like a copy
had has no longer materialised (but some might say this is a good thing!). of our media kit, contact the marketing team on:
[email protected]
It is important to note that the print version was heavily subsidised, as the
cost of print these days is not insignificant and, as such, unsustainable Subscriptions
For all subscription enquiries, please visit our
in the new world that we are faced with. The number of pages allotted to website at www.digitalforensicsmagazines.com
articles remains consistent as before, so much of the content that the and click on subscriptions.
For institutional subscriptions please
magazine provides for our subscriber base is not impacted. In actual fact, contact our marketing department on
we find that we have more topics to consider, now that we are all working [email protected]

from home or in a distributed scenario. What does that mean for Corporate Feedback
Digital Investigations? Feedback or letters to the editor should be sent
to [email protected]
So, thank you all for staying with us as we rebuild the magazine and enjoy
the many and varied articles in Issue 43 of DFM. Copyright and Trademarks
Trademarked names may appear in this magazine.
As ever, we would love to hear your views if you feel you have a comment, Rather than use a trademark symbol with every
occurrence of a trademarked name, we use the
of if you have an article or paper that you would like to get published, then
names only in an editorial fashion and to the
please do get in touch. Enjoy this quarter’s selection of articles in this issue benefit of the trademark owner, with no intention
of infringement of the trademark.
and, as ever, your comments and thoughts are welcome; just send them to
[email protected] Digital Edition Provider
Digital Forensics Magazine uses ZMags for its
Digital Editions, allowing the creation of carbon
Roy Isbell neutral publications.

DFM43_003_Editorial.indd 3 13/08/2020 18:06

DFM43_004_Ad - Layer 8.indd 4 13/08/2020 18:08
 CONTENTS

Contents
FEATURES
Digital
The Quarterly Magazine for Digital Forensics Practitioners Issue 43 • Q2 2020

8
The History of Cryptography
and the Modern Enigma of ForensicS
Magazine
Digital Certificates
Andy Jenkinson asks, how many
enterprises know where all
their certificates are?
Virus
Security of Pandemic Tracking
8 Apps
14
Surveillance Apps
Bryan Cusack investigates Brian Cusack investigates
Contact Tracing issues

Contact Monitoring issues.

30
Memory Forensics PLUS
Memory Forensics
Rick Leinecker discusses the Enabling Intelligent Cities
The History of Cryptography 9 772042 061004
43

Regular Features: News, Legal & Much More!

valuable information that can be
Issue 43 / £14.99 TR Media

obtained from memory analysis

DFM43_OFC_Cover - Online.indd 1 13/08/2020 16:34

REGULARS
36
Enabling Intelligent Cities News 6
Hugh Boyes looks at security Legal Editorial 21
of Building Information and Systems. Legal News 26
Subscriptions 27
The Future of Cybercrime Get Involved 42

14
44
Gareth Davies provides a Next Issue 43
rationale for a review of Digital 360 52
Investigation specialist education. IRQ 54

LEGAL FEATURE
Pandemic, Planning
and Proper Preparation 22
Scott Zimmerman explains how
effective forensics programs must
address the daily operation of the
systems.

SUBSCRIPTIONS
30 42 CHANGES UPDATE
See Page 27
5

DFM43_005_Contents.indd 5 13/08/2020 19:02

 NEWS

News
Russia Report Shows Threat is Significant which is now over 30 years old is no longer fit CJEU Judgment on International Data
and Here to Stay for purpose against this form of activity. It will Transfers from Europe to USA as Unlawful
Commenting on the Intelligence and Security be interesting to see whether the Government In a landmark judgment, the Court of Justice
Committee’s report of Russian activity in the heed the calls from senior intelligence officials of the European Union (‘CJEU’) ruled that
UK, Dr. Duncan Hodges, Senior Lecturer in who clearly believe they do not have the the Privacy Shield scheme for transfers of
Cyberspace Operations at Cranfield University, legislative tools to do the job. personal data from the EU to the United States
said: “Russia’s end goal is not necessarily to is unlawful, but it has upheld the validity of
“This is a forceful report and while it influence election results, and the report the Standard Contractual Clauses scheme,
has no major surprises in the detail, it does highlighted that the UK Government had not thereby providing a safety net for transatlantic
clearly frame the Russian threat to the UK. seen or indeed sought evidence of successful business.
It demonstrates that the threat from Russia interference. One of Russia’s key goals is The Privacy Shield was negotiated with the
is significant and here to stay”. “Russia has to further deepen divides in the population, US Department of Commerce between 2015 and
learnt that cyber is a powerful tool for their whether that is with Brexit in the UK or with 2016 to remedy the collapse of its predecessor,
approach to international relations using it gun control or BLM in the US. For them it is the Safe Harbour agreement, in 2015.
alongside more traditional statecraft. This little effort, so any gain is beneficial and helps Behind the legal challenge to Privacy Shield
cyber capability is used indiscriminately weaken the West, EU and NATO, this not only and Safe Harbour was the spectre of Edward
and recklessly by a state with a significant structurally benefits Russia but is important for Snowden's 2013 disclosures about mass
risk appetite. Where Russia are particular the domestic population at home in Russia. surveillance by national security and law
effective is by using all means at their disposal, "The report also highlights the UK’s lead in enforcement agencies in the United States.
including criminal actions, to pursue their attributing and ‘calling-out’ malicious cyber The core argument in both cases was that
goals effectively linking their cyber activities, activity, whilst important for international companies such as Facebook Ireland cannot
their financial and political influence and their consensus building, it’s not clear that this ensure adequate privacy protections for users
traditional intelligence activities. This has put is a deterrent to future activity." in Europe with respect to their personal data
Russia ahead of the game and is, partly, why sent to Facebook Inc in the United States,
their actions have been so effective.
“The report is critical of how fragmented
It will be interesting due to the different nature of the US legal
system's rules on national security, privacy
the UK approach has historically been, with to see whether the and data protection.
the responsibility for cyber resting in multiple
departments. Responsibility for managing and
Government heed The collapse of the Privacy Shield it likely
to have massive implications for transatlantic
countering the threat from Russia seems to rest the calls from senior relationships, but the CJEU upheld the
not in one place, more concerningly was the intelligence officials Standard Contractual Clauses framework
lack of appetite to counter disinformation and
political influence with the report describing it
who clearly believe for international transfers, meaning that a
workaround exists for organisations to ensure
as a ‘hot potato’. they do not have the their data flows to the United States are lawful.
“The calls from the UK intelligence
community for new legislation are striking and
legislative tools to do The Standard Contractual Clauses can also
be used to maintain data flows with other
it is not surprising that the Official Secrets Act the job. countries outside of Europe.

6 Digital Forensics Magazine

DFM43_006-007_News.indd 6 13/08/2020 16:20

 Stewart Room, Global Head of Data can be more creative, inclusive and tailored for Finance Teams Targeted
Protection and Cyber Security at DWF, said: people with ADHD (Attention Deficit Hyperactivity Two out of three UK companies suffered
"This judgment is the second major blow Disorder), Autism, Dyslexia and Dyspraxia and brute force attacks against Microsoft 365
delivered to the US privacy and data protection how the workplace environment and culture accounts during the past three months –
legal framework by the EU Court of Justice can be fashioned and improved for neurodiverse up from 48% in the first quarter, according
relating to the Snowden disclosures and in people. With an estimated 10% of the UK
to bluedog Security Monitoring. It reports
today's climate of unstable transatlantic political population being neurodiverse in some form,
that around 8% of all companies suffered
relationships, it is unlikely to meet with approval employers are missing out on a great deal of
breaches in the second quarter as a result
in the US. However, this is not just a US problem. talent, as well as giving people opportunities
of the attacks. bluedog has also seen a
Twice now the European Commission has tried which have often been unobtainable in the past.
22% rise in phishing attacks targeting the
to reach an agreement with the US on data A link between certain neurological conditions
creation of apps within Azure. It believes
protection, only to have its efforts ruled unlawful. and high performance in technical rolls has long
every company is now being targeted at
There needs to be a different mindset to how been acknowledged but the report stresses that
the challenges of international transfers to the having a ‘neurodiversity strategy’ should not be least once a week by this type of attack
US are met, because failed schemes like this a one-size-fits-all initiative and businesses need and in some cases, five or six times a
have significant impacts for individuals and for to listening to people about their needs and how day. Tim Thurlings, CTO of bluedog, says
businesses. Fortunately, there are workarounds they prefer to operate. the fraudsters are in particular targeting
to maintain data flows to the US, which include “As a society we’ve put great emphasis on accounts, finance departments and credit
the Standard Contractual Clauses. This means literacy, numeracy, concentration and social collections teams. “The phishing attacks
that adjustments can be made where necessary, interaction in terms of fundamental skills for the trick users into going to the legitimate
to keep data flows to the US alive. However, workplace, but the tide is turning as employers Microsoft login page and giving permission
businesses will be asking themselves 'what recognise they cannot afford to ignore large to create an app that allows access to
is next'? There are other countries that pose and previously untapped reservoirs of talent,” files, emails and mailbox settings. They
challenges to privacy rights and data protection said Ian Glover, president of CREST. “Embracing can then set up a ‘forward and delete’ rule.
and they raise obvious questions about the a workplace that offers different thinking
Any emails the employee sends out are
potential for other legal action." styles and approaches to problem solving,
automatically forwarded to the hacker who
and innovation can thrive simply makes good
can then amend the bank account number
Businesses Need to Harness Neurodiversity business sense.” The cyber security industry
or insert a request to change the payment
in Workplace to Fill Skills Gap has already recognised that people on the
details before sending on to the victim.
Businesses need to do more to attract and Autistic spectrum can provide invaluable skills
The original email is then deleted from the
increase the number of neurodiverse people in and are often the best performers in technical
the workspace to help fill the shortage in cyber roles. For example, GCHQ is one of the biggest sender’s mailbox. This attack pattern can

security, according to a new report published employers of Autistic people in the UK, while the be mitigated by regulating the access of
by CREST, the not-for-profit accreditation and National Crime Agency (NCA) has revealed that third-party integrated apps. It is also vital to
certification body for the technical security some teenage hackers have been found to be on enable the use of multi-factor authentication
industry. In particular, the report explores how the Autistic spectrum and are being targeted for on all M365 accounts as this will help stop
the careers advice and recruitment processes recruitment by criminals. • brute force attacks.”

DFM43_006-007_News.indd 7 13/08/2020 16:20

 FEATURE INTERMEDIATE

The History of
CRYPTOGRAPHY
and the Modern Enigma
of DIGITAL
CERTIFICATES
Andy Jenkinson asks, how many enterprises know where all their certificates are?

T
he history of cryptography, public key harder to crack. The cryptoanalysis work on those receiving communications, instructions,
infrastructure and the implications the Lorenz machine was led by William (Bill) payments and so on. A PKI can use stronger,
for cyber security are not always Tutte and Tommy Flowers. Tutte played a more complex digital certificates and keys
realised, but they are critical and similar role to Turing and Flowers was a former depending on the requirement all the way to
profound. Let’s briefly look at the GPO (communications) worker with a Heath post-quantum computing. Equally, certificates
history of cryptography. Cryptology was used as Robinson mentality who was tasked to build a are deprecated when found to be too weak
far back as 1900 BC by the Egyptians for passing machine to automate the work. and must be replaced and upgraded to
secret messages to one another. However, it was The two men were later acknowledged as ensure security.
in World War II where modern-day cryptography heroes of Bletchley Park. The machine Flowers Unlike the Enigma and Lorenz machines,
became widely used for communications and built was named Colossus and two Colossus our computers do not need to be completely
made a massive difference. Cracking the German machines were built and effectively re wrote changed, their security can be simply managed
Enigma machine and then the Lorenz machine is history by breaking the Lorenz machine code by upgrading the digital certificates. You’ll be
said to have ultimately resulted in considerably and creating the world’s first computerised familiar with ‘patch Tuesday’, the numerous
shortening the war and saving hundreds of code breaking machine. CVE’s issued and the Certificate Revocation
thousands of lives at a time when some 10 List (CRL) which is a list of certificates found
million lives a year were being lost. Digital Cryptography and Encryption to have been used for nefarious purposes and
In simple terms cryptography is the use In the mid 1990s with the continued explosion of requiring replacing and upgrading.
of codes and ciphers to protect secret personal computers, Public Key Infrastructure Everything was going swimmingly
communications and the task of breaking these (PKI) was globally adopted. PKI was made from the start of PKI in the mid 1990s
is called cryptoanalysis – the breaking of codes up of digital certificates issued by Certificate until, unfortunately, in the early 2000s
and ciphers. Authorities (CA’s) and encryption keys. These certain governments developed insatiable
At Bletchley Park, Alan Turing and his team certificates and keys are electronic credentials appetites to gain visibility, particularly post
first cracked Enigma and built the Bombe to that provide authentication and validation of 9/11, to eavesdrop on suspected terrorists.
automate the code. However, Enigma was every user and every device, they also play a This program (Stellarwind among several
already dated and had been superseded by vital part in encryption and decryption. others) was rolled out with the assistance
the Lorenz machine. Lorenz was used by high Think of a certificate as an electronic of numerous, incentivised tech giants and
commanding officers including Hitler. Far more passport. Digital certificates can be simply global telecommunication companies. The
complex and much more capable, Lorenz updated enabling stronger ciphers (codes) and program was simple and allowed clandestine
had 1.6 billion permutations and was much provide encryption for those transmitting and back doors to be planted here, there and

8 Digital Forensics Magazine

DFM43_008-012_Cryptography.indd 8 13/08/2020 18:07

 everywhere in all companies, organisations, megawatts for the National Grid plant and was
governments and in all regions. A particular blown up simply by using code to speed up
favourite was back doors using compromised and slow it down causing the machine and the
digital certificates providing full access harmonics to fail. This effectively destroyed the
without the knowledge, or consent of machine and became the basis for Flame, Duqu
the organisation. and then Stuxnet.
Put simply, who would know if an enterprise Cryptography over the years has ultimately
containing millions of certificates contained a failed due to the fact if a person can create
few rogue certificates. it, it’s only a matter of time before someone
The CIA took this another step further by else can break it. The situation is massively
buying the Swiss company Crypto AG who expedited due to PKI compromises globally,
provided cryptography machines in no less no longer does an adversary need to decrypt
than 120 countries, of course with certain the code, they simply need to look like they
back doors built in. are part of the internal PKI and gain access via
These campaigns received government stolen, fake and compromised certificates and
consent initially by Bush, then Obama under encrypted keys. These are often found literally
the auspices of defending the US and wider lying around and are readily available on the
world against terrorism. It was not too long dark web.
before the temptation to use digital certificates Pandora’s box was open to the ease of
was too much, not just to eavesdrop for gaining full insight and even taking over
intelligence but to also use the same method command and control, whilst everything
for offensive purposes. looked normal. It was simply a matter of
There is a fine line between defensive and time before adversaries managed to gain
offensive. Shortly thereafter project Aurora the same capability. 
was undertaken and was the first use of bytes
for offensive purposes in 2007. Code was Our adversaries can use a scatter gun
injected and overrode the control system of
a huge diesel machine’s normal running cycle.
approach and find the weakest link and,
This machine would usually be found providing more often than not, it is at PK.
9

DFM43_008-012_Cryptography.indd 9 13/08/2020 18:07

 FEATURE INTERMEDIATE

The US Elections and Critical Infrastructure

In May 2020 our research team, led by our
CTO, was asked to run passive scans on a
number of US and Canadian government and
country domains. This included State-run
internet-facing sites and servers. These sites
are also used for emergency Covid-19 funding
and electronic voting, they also keep Personal
Identifiable Information (PII). If the site is “Not
Secure”, such information, with the right tools
and expertise, is accessible.
There are a number of regulatory bodies,
the National Institute of Standards and
Technology (NIST), International Organisation
for Standardization (ISO) and several
other governing bodies whose minimum
recommendations are simply not being
met and these are government domains.
The German Government in March and
In simple terms, what was discovered at April 2020 were stung in a cyber-squatting
several sites clearly evidenced systemic issues
that if left unchecked and not remediated,
campaign and over a two-week period paid
could enable infiltration, traversing and lateral out 100 million euros to Covid-19 funding
movement across these and other connected
domains. Exfiltration of data and ultimately
support for individuals.
taking over control and command by changing to make Covid-19 payments to those people Remember the house above, doors left
passwords and locking the users out. Think of that required it they did not exercise enough open, keys and possessions on the table,
it like this, you’ve left your house wide open for diligence or caution. They paid the money, but zero resistance. These domains are the path
weeks, months even years. The keys and all instead of paying the legitimate claimants, they of least resistance and will enable, through
treasured possessions left on the table and a paid the cyber criminals who had stolen the traversing, digital trust and privileges, allow
thief comes in, starts taking up residence and credentials and used these stolen identities on traversing around this site and associated
changes all the locks. an industrial scale for just two weeks. It was sites. Full digital trust would enable this
These sites tell a tale of up to a only when the complaints were amassing that easily with little to no resistance.
decade non-compliant, poor management checks were made. Alaska was one of those we were asked
and negligence with root SHA-1 certificates A similar situation is possible here, if not to scan. The Alaska division of Elections
that were deprecated as far back as 2011. already taking place. A US IRS scheme is still website declares: “Our mission is to ensure
SHA-1 certificates were deprecated back paying out to the wrong people years after the public confidence in the electoral process by
in 2011 due to ease of being successfully event due to a similar situation. administering voter registration and elections
attacked and broken. Ironically the NSA were So, what does this mean to the government, with the highest level of professional standards,
hacked in 2012 by a SHA-1 certificate. Don’t the digital electoral system and PII they collect? integrity, security, accuracy and fairness.” On
forget, if, as in this case, a root certificate is Put simply, it makes all of the above the 29th May 2020, we discovered, through
untrusted, in simple terms the access and incredibly vulnerable and susceptible to routine intelligence that the website and web
lateral movement by an adversary enables breaches and data theft leaving the state server hosting the site for the Alaska Division
all PII to be easily accessed and used. That exposed for GDPR-type fines and losses. The of Elections was vulnerable to cyber-attacks
information includes; names, addresses, electoral data can unequivocally be tampered which could result in the Alaskan State losing
driving licence, social information, ages, with, the information can be used, sold and command and control of their electoral system,
in short, everything. manipulated by other ‘interested parties’ exposing personally identifiable information
The German Government in March and including nation states. The government would and bringing the total Security of the US voting
April 2020 were stung in a cyber-squatting clearly fall foul of all regulator regulations on system into question.
campaign and over a two-week period paid out privacy, in short it would be a complete mess. The domain clearly showed that it was
100 million euros to Covid-19 funding support Furthermore, if one thought like an attacker not “Not Secure”. There were some 23 major
for individuals. The problem was it was paid an upstanding citizen just for a moment and vulnerabilities and many Common Vulnerabilities
to cyber criminals incorrectly through using wanted to gain access to critical information and Exposures (CVE) dating back to 2010, these
PII information gathered simply by cyber- including critical infrastructure, electoral voting should be changed immediately but have been
squatting. The criminals had gathered the sites or even the IRS site, what route would they left for a decade.
right PII information and seemingly had the take? Clearly the route of least resistance and There are very serious implications to such
right credentials. In the government’s rush those simple routes are everywhere. findings as it recently happened to ARCHER –

10 Digital Forensics Magazine

DFM43_008-012_Cryptography.indd 10 13/08/2020 18:07

 the UK’s supercomputer in Edinburgh. On the Add joiners, leavers, movers and the number Aurora
very same day the 12th May, ARCHER had a of devices is constantly changing. On average, Aurora was the first kinetic attack on a
certificate expire and become NOT SECURE a gold standard laptop has around 250,000 machine using malicious code in 2007 by
only to be breached the very same day. The certificate instances, in addition to this key the NSA. Stellarwind was the name given to
work all other clinical research universities stores, binaries and third-party software all use a warrantless mass surveillance program
and pharmaceutical organisations had spent and have, deep in the system digital certificates in 2004 by George W Bush following the 9/11
$billions on was exfiltrated with the yet to and keys. attack. The rationale was initially for foreign
be proven theft by the Chinese due to the On the PoC of the CNI scanning just 30 communication capture, however rolled out to
invaluable research including on Covid-19. The devices yielded the following results. Fifteen mass surveillance globally and included the
total cost of this research runs into $billions. As million plus certificate instances, 14,000 CIA’s ownership of the Swiss cryptography
John F Kennedy said: “There are risks and costs revoked certificates (Code Red), untrusted root company Crypto AG that provided encryption
to action. But they are far less than the long- certificates (Code Red/Chinese), Keys stores services to 120 countries, with the
range risks of comfortable inaction.” using default credentials, thousands of SHA-1 appropriate backdoors installed.
Alaska is just one of several US states we and self-signed certificates and so on, you get
investigated, and many have similar issues that the picture. Digital Certificates
urgently require attention. This PoC is across a tiny percentage of the A digital certificate can be thought of
The research work, passive scanning and entire enterprise yet is already overwhelming as a digital passport that validates and
experiences we have briefly touched upon here and simply impossible, until now to remediate. authenticates users and devices. Since the
shows that either through a lack of knowledge, The size of the challenge is a mammoth task inception of PKI in the 1990’s, governments
assumptions, inability, ignorance or gross and what’s more, a constantly moving target. and agencies have sought ways to
negligence, these sites and many more are like It is easy to see how a few certificates could manipulate PKI and plant certificates to gain
Swiss cheese, full of holes. None of these, and be covertly placed without being seen as this access and provide digital eavesdropping.
there are many more, government, state-run and every organisation across the entire world Unfortunately, nearly a decade ago, post
financially critical and digital voting sites can have no idea what their PKI looks like let alone Stuxnet, the world’s first ever Digital Weapon,
provide the assurances to the public on privacy have any control and management of the digital this capability and manipulation was
and are in contravention of all guidelines certificates and keys within. replicated by real adversaries to devastating
and rules governing such data collection Hold on a minute, this is a CNI effect. Today Ransomware, service outages,
and management. The challenge is systemic organisation and they have Chinese cyber-attacks, DDoS, Man in the Middle
and will undermine all elections and local untrusted root certificates? That’s correct, and inadequate security on a systemic and
infrastructure, privacy and security. whoever has control of those certificates can global scale can be put down to inadequate
In today’s modern world we rely upon change passwords, change access and lock PKI controls and management. Throw in
computers for everything. A refrigerator is others out. They can Command and Control all the Certificate Authorities issuing illegal
a computer that keeps food cold, a car is a the systems and this particular organisation certificates and being breached and web
computer on wheels and an IoT device is, well runs nuclear power, supplies defence for the hosts and CDN’s ‘working both sides of the
nothing more than a computer listening and government and is a trusted, we will come street’ and it is easy to understand if you
sharing information. back to that word later, by all of its government do not have full control, someone else most
We live and consume everything and are clientele. Sounds dangerous and fragile doesn’t probably does.
influenced by a computer in one way or another. it and it certainly is. So much so that GCHQ are
Talk of back doors in hardware by the Chinese, investigating now.
the Russians or North Koreans and so on may Let us consider areas that PKI directly
well be true and has been proven many times, influences and further consider the critical
however the underlying insecurity at PKI level importance of digital certificates and keys. In or
is the one that is simple to manipulate and can around 1995 RSA produced the first certificates
ultimately provide full command and control of and over the past 25 years billions upon billions
a system or enterprise. How is this possible? of certificates have been issued. There are
around 180 root certificates trusted by the
The Size and Scale of the Problem major Internet providers however the top ten
To give you some idea of the sheer magnitude CA’s have by far market share and account for
and scale of the issue, we recently undertook the vast majority of organisation’s needs.
a proof of concept (PoC) for a UK-based critical The challenge however goes deeper than
national infrastructure organisation with tens the inability to gain visibility of one’s own
of thousands of staff, multiply by 3.7-4.2 per enterprise, it is compounded by the fact CA’s
person (Gartner & Forrester) to ascertain themselves struggle to revoke, identify and
number of devices per person, phones, laptops, manage the certificates they themselves issue.
PC’s and so on and you’ll get something around That has been the case over the past 25 years
100,000 devices. and continues, it is simply getting worse. 

11

DFM43_008-012_Cryptography.indd 11 13/08/2020 18:07

 FEATURE INTERMEDIATE

Just a few weeks ago Let’s Encrypt had to platform as indicated above, the task is near and management in place, enable full control
recall 3,000,000 certificates and are still trying impossible no matter what you spend or how and security of an enterprise. One thing is a
to find them. A single certificate can cause a many experts you have. certainty, if you have adequate PKI controls
simple and annoying service outage as virtually The same situation applies to expiring and management your security has a great
every organisation globally experiences. It can certificates. In the CNI example above, some chance, if you do not, your security has
mask malicious code with nefarious intent and 20,000-plus certificates from the total of 37,000 no chance.
enable infiltration and exfiltration of IP and data unique certificates (60%) had expired with a PKI was designed in the 1990s, abused
as we have witnessed on numerous occasions. further 90 expiring this month and a further 500 in the 2000s by government and security
expiring in the next 90 days. Guess what, no agencies and still is today. That abuse,
SHA-1 Certificates Still Exist one actually knows what these certificates are misuse and the lessons learnt by the world’s
SHA-1 certificates were among the first related to and what services might cease due to first digital weapon, Stuxnet and the use of
cipher class of certificates issued in the mid the certificate expiring. Also, please remember, stolen and compromised digital certificates
to late 1990s. They were subsequently broken this is a tiny fraction of the enterprise, so the is now being used by our adversaries for
(remember what is encrypted will be broken and problem will be significantly larger. criminal and cyber activity. The cyber war
decrypted sooner or later) around 2005. SHA-1 We only have to look at Equifax and Marriott is being lost and that is before we consider
certificates were deprecated officially in 2010 for examples of this occurring where expired the massive explosion of IoT and the
by NIST and the NSA. The NSA were themselves certificates ceased data flow monitoring to devastation that quantum computing
rather embarrassingly breached in 2012, you enable exfiltration of data for months and in the will have on inadequate PKI.
guessed it, via a SHA-1 certificate. Several years case of Marriott acquiring Starwood, a breach Digital trust can only ever be really achieved
later CA’s were no longer allowed to issue SHA-1 went undetected for four years due to expired if robust public key infrastructure is achieved.
certificates. To recap, our findings on the CNI certificates and provided the PII data of some There is a way to reinstate digital trust and
we found thousands of SHA-1 certificates, this half a million clients with many being from that is to have adequate PKI controls and
is very common for every organisation globally security agencies and the government. The management. This is exactly what PKI was
as they do not have visibility, they simply do not costs, including fines, have reached $billions designed for in the first place and would, with
know in the vast majority of cases so cannot and continue. Marriott were breached again visibility, controls and management in place,
address until the situation causes an issue. recently. you can then have full control and security of
In a recent program at a Tier 1 bank, the Unfortunately, the vast majority of cyber an enterprise. One thing is a certainty, if you
program commenced by others, was to finally security experts do not really understand that have adequate PKI controls and management
rid the bank of its SHA-1 certificates. The bank a single, rogue certificate can undermine their your security has a great chance, if you do not,
employed a crack squad of 40 PKI experts to entire cyber security perimeter and posture. your security has no chance. •
hunt down all of the SHA-1 certificates with the
sole intention to finally remove the vulnerability Conclusion
and the ticking time bomb before they caused Ignoring such issues and leaving them to
further damage. people in dark rooms expecting miracles
The team spent over 20 weeks at a cost of is commercial suicide. In turn, boards have
nearly £1million and found a whopping 46,000 virtually no idea of any digital certificate’s
SHA-1 certificates. Don’t forget these were existence let alone the critical role they play
deprecated a decade ago clearly showing that a) even when managed correctly. This is where
they had them there for some time and certainly the major disconnect is and the reason digital
against industry recommendations on terms for trust is compromised everywhere and within
certificates and b) they had for a decade ignored every company, government and agency.
the deprecated issue and carried on regardless What was once used, misused and abused
of the vulnerability and danger. by agencies and governments to enable a digital Andy Jenkinson is a
Imagine their surprise when, in a 20-minute fly on the wall, has become a wall covered with seasoned business leader
controlled environment, we showed them the digital flies and no one knows who’s who and no with 25 years’ experience
46,000 plus an additional 22,000 they knew one has controls or management in place. The as a hands on CEO/COS
nothing about. They had spent nearly £1million, difference being is simple, we need to defend coach and leader. A 'big deal'
over 20 weeks with 40 experts to actually do a everything with a focus and precision, our maker and business builder involved in many
very poor job. adversaries can use a scatter gun approach transactions over £100M. Advised business
A really important note on this, it will rarely and find the weakest link and, more often than owners and created his own businesses within
be the certificates you know about that cause not, it is at PKI. the technical, risk and compliance management
issues, in this case, one of the 22,000 that As the examples above clearly show, there markets. A thought provoking, challenging
nothing was known about will. SHA-1 migration is a way to reinstate digital trust and that is to consummate professional and natural leader
to SHA-2 and beyond should be undertaken have adequate PKI controls and management. whose drive, energy and enthusiasm is not only
by every organisation with immediate effect, This is exactly what PKI was designed for in infectious but inspirational ensuring everyone
however unless you have the right technical the first place and would, with proper controls climbs the ‘ladder of success’ as a group.

12 Digital Forensics Magazine

DFM43_008-012_Cryptography.indd 12 13/08/2020 18:07

DFM43_013_Ad - AUT.indd 13 13/08/2020 18:09
 MAIN FEATURE INTERMEDIATE

Security of
Pandemic
Surveillance
Apps
Bryan Cusack investigates
Contact Monitoring issues.

T
he most recent global pandemic sufficient information and capability, will track, enrolment of all participants and the effective
has sponsored a rush to generate trace, and communicate to users imminent information management for communication,
applications for mobile phones that dangers to health. To be effective the user usually from a centralised control unit. The
can track contacts and communicate must respond to the information, change their Smart Phone has to be active and the control
vital health management information. behaviour by seeking protection, relocating unit will relay proximity warnings when the
The Covid-19 pandemic has accelerated or implementing social distancing, and by user is too close to an active case, or if the
application development for the express purpose maintaining an alert posture for new information. user is an active case, too close to another
of implementing health and safety management The ideal scenario fairly distributes humans user. The control unit also collects and
requirements. These applications have push at safe distances from each other allowing retains all environmental information for a
and pull features that allow communication to the virus threat to be neutralised. However, in specified period of time (usually double an
the user, and for the user to supply real time practice many issues arise that mitigate the incubation period). With such a theoretically
data to health authorities. The benefit is for virus impact of the strategy, and challenge the design comprehensive surveillance network, mobility
control through the real time changing of human of such a mobile phone application. restrictions can be eased, and people freed
behaviour. The objective is to halt and to disrupt The objective of tracking and tracing to go about their daily work. In a perfect
the spread of disease using the Covid-19 virus active Covid-19 virus cases is challenged world, this is a compelling solution to the
vulnerability, isolation. The virus requires human- by the availability of the technology and the restraints of a lock down and the fear factor of
to-human transmission and if humans who have distribution of technologies in general across contamination. However, in the real world, many
the virus are sufficiently segregated from those any population. The ideal scenario is that of the assumptions the model is based on are
who do not, then the infection chain is broken. each citizen has a Smart Phone that can mitigated and at best, it gives only a partial
An assumption is also made that recovery download a specified application, and that solution. The solution has to be implemented
from infection means no further potential for the smart phone has a Bluetooth (or similar) with other compensatory features. In the first
transmission. In theory a mobile phone with sensor network to scan the surrounding instance, many citizens do not have or carry a
proximity sensors, and an application that has environment. The architecture also requires Smart Phone. Smart Phones also have a limited

14 Digital Forensics Magazine

DFM43_014-019_Virus Apps.indd 14 13/08/2020 18:09

 QR Codes
Quick response (QR) codes are a two-
dimensional bar-coding system that allows
user coding and deployment. These QR codes
contain more information than a Bar Code
and can be readily implemented from down
loadable applications and made functional
with a mobile phone or a similar device. In
practice, this means that access controls
can be maintained in a unit-by-unit mesh
for the tracing of participants and access
control of physical spaces. In a University, for
example, access control can be maintained
efficiently for thousands of people per hour
in a cost-effective way. Unique QR codes
are distributed and printed to digital screens
or paper very cheaply and quickly. Each
authorized member of the organization has
to register their mobile phone to gain access
to only authorized areas. They must scan the
QR code for access to each required area,
and any unauthorized SSID in an area can
be quickly identified for physical intervention.
In addition, with Bluetooth tracking social
distancing is disclosed and the authorized
SSIDs in any space recorded for future
forensic investigation. QR codes are not the
only way to achieve adequate surveillance of
human health and safety in social contexts,
but they are a cost effective solution in
many environments.

EXPERT TIP:
battery life that when loaded with continuous they must be part of a media saturated All Charts Require Interpretation
Bluetooth surveillance, becomes shorter. The environment where comprehensive information The presentation of pandemic statistics on
control unit is also confronted with a big data and coverage are available for human decision- a global scale is fraught with distortion from
problem. If one user in a large city is monitored making. The use of mobile technologies extends mediating variables and the methodological
continuously for 24 hours per day, the data coverage into all contexts where for example, systems employed. At best the statistical
volume is huge. If one or twenty million people a person may be going shopping or walking in systems used to report charts are simply
are continuously monitored in the same city, open spaces, and in business premises, where statistics or in other words samples of a
the data volume becomes unworkable for the all humans must be identified, tracked, and population that are computed to predict or
safe management of all participants. There is social distancing measured. Such benefits show a population parameter. The statistic
also push back on enrolling for such networks allow for greater freedoms for social behaviour may be the number of new cases on one
from potential users who are concerned at the and relaxation of isolation counter measures. day, but how was it arrived at? It is not
unintended use of their proximity data and the Surveillance and monitoring are critical in each possible to count each case for an entire
security of any data in mobile networks. of the pandemic phases of detection, keep population even when the population may
The surveillance for pandemic threats takes it out, stamp it out, and manage it. No single be small. What was the sample? The criteria
numerous phases and each with specified surveillance system or information source can for a case identification? The time base?
responses. The utilisation of technologies provide all the information needed for pandemic The problem of comparing one jurisdiction
assists surveillance and response, when the preparedness, control and management. In this data with another, and showing the result,
health authorities attempt to assert control article, a review of surveillance applications for is even more difficult when the criteria may
over the transfer of illness. A virus only requires Smart Phones is made, and the security issues vary and the interpretation of criteria differ.
human contact to be effective and the role of identified. The proposals around the world to There are also other mediating variables
technology is to create spatial segregation, implement Smart Phone based surveillance such as politics, economic interests, and so
awareness, and healthy habits in the users. systems to manage Covit-19 risks has both on. All charts require investigation and the
For mobile phone applications to be effective, merit and liabilities.  information interpretation for validity.

15

DFM43_014-019_Virus Apps.indd 15 13/08/2020 18:09

 MAIN FEATURE INTERMEDIATE

Smart Phone Surveillance Applications child monitoring and so on. The scope of features TOP FACT: Bluetooth Use
Many applications are already available includes some, such as Camera functions, that Bluetooth is a wireless communication
for surveillance as Smart Phone download may or may not be useful for virus tracking. In capability that many mobile and static
applications. There are also many health the ideal situation with unlimited Smart Phone devices use for connectivity. A common
related applications for download onto resources, visual surveillance could be helpful in example is the computer mouse or keyboard
Smart Phones. These dock with sensors and locating members of a social network who may that has no physical wires but communicates
other devices to monitor health, and provide be carrying an unregistered or a different SSID. to a device through a wireless signal. There
reference and continuous feedback data sets. Also in the situation where physical surfaces are are many different versions of Bluetooth
The redeployment of these applications for critical for sanitisation, identification can occur protocol that started with 1.0 and today
use in the management of Covid-19 responses remotely. However, the value of SMS chats and (2020) 5.2. Each protocol version brings
is theoretically a small step. However, it is Internet browsing logs would only be helpful in enhancements to the previous. For example,
difficult gaining consensus and co-operation deep forensic searching for probable contacts version 1.0 had an operational range of under
from decision-makers to decide which that may or may not be in physical proximity. 9 meters but version 5.2 has an operational
ones are acceptable, and then to solve the For example, a remote communication may only range of 40-400 meters depending on
challenges of deployment into a very large have content value whereas immediate proximity the environment and the equipment used.
social environment. The scale of the required signals communicate immediate risk. Questions Bluetooth has proved itself useful for
deployment also demands applications to work also arise as to the extent of surveillance implementing personal area networks (PANs)
easily over a multiplicity of different Smart required for health and safety benefits. Evidence that span in and around the personal use
Phones, and for the application to be non- collected under warrant for a criminal case has a of devices for communication. This includes
intrusive. The ideal use is that the application different weighting than circumstantial evidence industrial application in health, logistics,
is to function continuously in the background collected to modify human behaviour. Each type and many other environments that require
and to allow the usual Smart Phone use to has liability and the possibility of use for the sensor and human feedback. Mobile (smart)
proceed unobstructed. The requirement is a other. As a result, limitations have to be put on phones have also adopted the technology
big ask when many Smart Phones lack high- the scope of features. In table 2 the features to close the last yard for push and pull
end specifications, and most already have of five spywares readily available to purchase interconnectivity. As a consequence the
congested processor and memory space. off the web are listed to highlight the options ready availability of sensor applications
The use of continuous Bluetooth environment promoted. The specific objectives required for a using Bluetooth present a working solution to
scanning requires significant energy and Covid-19 tracking application are tracking and tracking and tracing identified Covid-19 cases,
processing resources, which will influence tracing. The extent each is implemented has and for health management communications.
the Smart Phone performance. Consequently, to be balanced by the costs, the demands of a
the features for time and alert management general distribution, and perceptions around
require design and customisation for optimal personal information protection. The limited
use. The sensor network function can be linked selection of core features can be extended
to a motion detector trigger, a time-based cycle, by customised developments that may add
or manually controlled by a user. This allows features by subscription or on a user option
the Smart Phone sensor unit to rest passively basis. In this way, not all of the applications may
until the user enters a new social environment deliver many of the periphery features but a core
or other people come within the set proximity. set of features to achieve sufficient reach and
Similarly, the user can be put in control of the usefulness. Our selection of core features is: GPS
sensor network to switch it on or off as the Tracking, Undetectable, Real time tracking (and
perception of danger shifts. Of course, such feedback), and Monitor application. The other
actions compromise the health security net features listed are helpful but not necessary to
and the effectiveness of the control objective achieve a maximum use of the application.
but does leave a measure of protection
otherwise not available. Security Issues in Mobile Applications
The urgency of the current pandemic has The literature documents many security
sponsored development and customisation of vulnerabilities for the information stored and
specific applications. The market already has transacted by Smart Phones. In addition, the
many examples of “spyware” for Smart Phones applications downloaded to provide services
that is purchased and downloaded online. In our also often generate information vulnerability.
research, we evaluated thirty such examples An application for tracking and tracing Covid-19
and then tested five for suitability. Many of the cases will experience similar risks. The highest
available features are unnecessary for a simple risk is to sensitive data about a user health
tracking and tracing application. Spyware status, but also to their social networks,
for Smart Phones is marketed for legitimate locations and daily habits. All of the data may be
surveillance activities such as buddy tracking, necessary to provide protection from a greater

16 Digital Forensics Magazine

DFM43_014-019_Virus Apps.indd 16 13/08/2020 18:09

 Spyware Features Surveillance and Intelligence
A pandemic is a threat at any time and
SPYWARE FEATURES BARK HOVERWATCH SPYFONE NEXSPY APPMIA
requires monitoring through structured
SMS Chats ✗ ✓ ✓ ✓ ✓ information networks. Surveillance is the key
intelligence function performed by health
GPS Tracking ✗ ✓ ✓ ✓ ✓
and other agencies before and during a
Record calls ✗ ✗ ✗ ✓ ✓ pandemic. Pandemic surveillance involves
Internet activities ✓ ✓ ✓ ✓ ✓ the ongoing, systematic collection, analysis,
interpretation and dissemination of data
Keylogger ✗ ✓ ✓ ✓ ✓
to inform planning and response activities.
Undetectable ✗ ✓ ✓ ✓ ✓ Modelling is an important element in making
sense of surveillance data, and building
Free trail ✗ ✓ ✓ ✓ ✓
the intelligence for informed decision-
Real time tracking ✗ ✗ ✓ ✗ ✓ making. There are many models in use but
all track critical metrics, such as infection
Stealth camera ✗ ✓ ✓ ✓ ✓
rates, reproduction rates, and so on. The
Email ✗ ✗ ✓ ✓ ✓ objectives for public health surveillance and
Remote uninstall ✗ ✗ ✗ ✗ ✗ the surveillance methods used change as
a pandemic develops and spreads through
Lock target phone ✗ ✗ ✗ ✗ ✗
a jurisdiction. Clearly more information
Monitor application ✗ ✗ ✓ ✗ ✓ that better represents a population can
lead to a more effective response and less
Cost (per month) $14.99 $ 24.95 $ 90 $ 39 $16
information an inadequate response. The
Table 1. Spyware examples utilisation of mobile phone applications to
track and trace live cases in general social
The urgency of the current pandemic has settings is a variation of method that allows

sponsored development and customisation real time and distributed information to be

transacted. It requires a large participation
of specific applications. rate and efficient modelling to be effective.

harm but humans also have a sense of personal the data leaks. Most of the leaked information
privacy that requires securing. The managed was going to marketing companies and their
health environment may protect a user from resellers. The comprehensive and general
harm but the disclosure of the information to distribution of Covid-19 applications extends
achieve protection can leave a life not worth the reach for information and offers a lucrative
living. Trust is also extended to the control unit target for resellers.
for information management that the health Our research at the packet level on an
information is protected, used for the intended Android Smart Phone showed the destination
purpose, and erased (not just deleted) at the and the re-users of leaked information. In many
agreed time. The various Covid-19 proposed instances, the user would have unknowingly
tracking and tracing applications can be robust given permission for the data sharing when
and secure in design but they are entering an they agreed to the terms of service. The
environment with many vulnerabilities. The analysis showed multi-layered distribution
potential for misuse, disclosure, re-use, and of information to marketing and business
many other unplanned uses of information modelling companies. The distribution of
is high. There are software and hardware personal information that included location,
backdoors in most mobile systems that make use data, stored data, and transacted data
vulnerable any information. This includes the on the device, was distributed in five ways.
release of sensitive information, behavioural The application software first delivered the
patterns, locations, identity information and intended service but also distributed the
general communications. Our research has information to an information management
deconstructed the information system of a company. The information management
Smart Phone to identify the multiple layers of company then distributed the information to a
services, the communications, and their security research company who sent elements of it to a
provisions. It uncovered numerous sources for leading brand marketing group who study and
data leakage, and the agencies benefitting from report internet trends and user behaviour. 

17

DFM43_014-019_Virus Apps.indd 17 13/08/2020 18:09

 MAIN FEATURE INTERMEDIATE

The research company shared information with a crisis context where public preferences FURTHER READING
a stakeholder organisation that specialized in are neither uniformly held nor stable, so in Zhou, L. et al. (2019). "Barriers to and
data analytics and impact optimisation. The practice solutions are politicised and the Facilitators of the Use of Mobile Health Apps
fifth group was a larger cluster of affiliates subject of ongoing collective deliberation. For From a Security Perspective: Mixed-Methods
termed ‘partners’ who use information to application developers, this is a pre-rational Study". Advances in Digital Health Research,
create new business models and advertising context in which technical requirements 7(4), e11223.
campaigns for their clients. Our research hold little traction. Hence, loose propositions This article identifies and discusses key
covered one instance on one Smart Phone, are generated for debate. In practice, the issues in relation to the use of mobile phone
and with a standard set of downloadable operational Covid-19 tracking and tracing applications for medical management.
applications. In general, each Smart Phone in applications establish a proof of concept and Principally, it cannot be assumed a mobile
use has many of these applications functioning contribute partial solutions for the processes phone application will be used the way
and automatically sharing information to many of incremental change. it is designed by an end user, and the
re-users. A Covid-19 application coming into this Current Covid-19 tracking and tracing highest level of motivation for regular use
environment has many risks. A developer has applications promoted in Norway, Singapore is self-interest. In the Covid-19 situation,
to implement segregation policies while making and Australia have significant user uptake. The a high uptake (as cited in the Australian
the application to blend seamlessly into the success has been in the voluntary nature of the public uptake) is driven by fear and self-
context. Again, this is a big ask and the rush to promotional offer. As with all applications, the preservation. It is in the end user interest
implement solutions may neglect some of the user provides consent to terms and conditions to have live information to avoid contact
more complex security challenges. for the use, and the use of any information with active cases and this driver over rides
transacted by the application. Matters such concerns regarding data leakage, reuse,
Problem Solution as limits on information use and record and privacy.
The best solution to an overwhelming deletion are covered. Independent security
problem with many issues is to formulate testing of the applications is reported, and Mutchler, P. et al. (2015). “A Large-Scale
partial solutions and to apply these in a piece weaknesses and vulnerabilities noted. Reports Study of Mobile Web App Security”.
meal fashion. In the Covid-19 situation, this suggest some concerns have been fixed in https://www.researchgate.net/
is what is happening from a global scale in new versions of the applications but that publication/278724743_A_Large-Scale_
many different jurisdictions. Tracking and other matters are an acceptable risk. Proof of Study_of_Mobile_Web_App_Security .
tracing applications are being built and concept models were tested in pilot studies and This a typical paper that reviews the risk
tested by many different organisations. Each performance improvements made. It is noted of data leakage and malicious attacks
application has a limited number of features that centralised information management is on mobile applications. The strength of
designed to address key issues in the tension not required but that centralising the command the research is the large-scale survey of
between comprehensive surveillance, and and control infrastructures allows more rapid the problem and the identification of key
implementation challenges. Policy makers and targeted responses to urgent matters. vulnerabilities common to all applications.
are aware of technology limitations but Centralised processing of information can The warning is to those who provide
astute to the agenda steerage technology be more efficient and an overview of status assurances for data protection and the
proposals provide. The concept of Mobile Phone focused on responses such as the prompt issues around privacy concerns. Any
applications has broad appeal and applications path tracking for secondary transmission. The medical management tracking and tracing
have potential to relieve pressure on unpopular formation of patterns can become obvious for application must mitigate the risk of data
social and business constraints. This allows intervention where more close contacts occur leakage and assure an application fitness
breathing space for other solutions to be in spaces such as public transport, schools for purpose.
found in, for example, vaccine development. or sport matches. The applications were also
Partial solutions provide small advances designed to be responsive to changes in public Ward, P. et al. (2005). “Oseltamivir
in ambiguous situations that leverage and policies. Variables such as emergency levels, (Tamifluw) and its potential for use in the
create space for other incremental activities. proximity levels, and so on can all be updated event of an influenza pandemic”. Journal
They transform things to a greater or lesser automatically. The value of live social feedback of Antimicrobial Chemotherapy, 55,
degree but they do not usually eliminate the was also utilised to assess the effectiveness Supplement S1, i5–i21doi:10.1093/jac/dki018.
problems altogether. Accepting partial solutions of the overall pandemic response and to supply Global pandemics are not new and regularly
is normal in public management where the evidence to justify strategy and intervention adversely affect human populations. This
intelligence of democracy lies in the treatment retargeting. Users have been driven by urgency paper is a blast from the past but it reviews
of complex problems by multiple solutions. to download the applications, but the ongoing and documents recovery. The context
All solutions are continually revisited in the build and maintenance of user trust will of pandemics is reviewed and then the
light of new opportunities and circumstances. generate the best use value. challenges for the development of vaccines
Muddling through is a term often used to The application technologies for tracking documented. It is encouraging to see
describe political leadership in times of and tracing Covid-19 active cases are functional human resilience in the face of devastation,
crisis. The proposals for tracking and tracing and available for use. The debate over privacy and to read the rationale for pandemic
applications for Covid-19 active cases confront and rights remains a debate that vacillates management strategy.

18 Digital Forensics Magazine

DFM43_014-019_Virus Apps.indd 18 13/08/2020 18:09

 REFERENCES
Baker, M. (2020). “New Zealand’s elimination
strategy for the COVID-19 pandemic and what is
required to make it work”. New Zealand Medical
Journal, 133 (1512). https://www.nzma.org.nz/
journal-articles/new-zealands-elimination-
strategy-for-the-covid-19-pandemic-and-
what-is-required-to-make-it-work
Belanger, F, and Crossier, (2011). “Privacy in the
digital age: a review of information privacy research
in information systems”. MIS Quarterly, 35 (4),
pp. 1017–1042.
Grint, K. (2020). “Leadership, Management
and Command in the time of the Coronavirus”.
Leadership, doi.org/10.1177/1742715020922445.
Howah, K., & Chugh, R. (2019). “Do we trust the
internet? Ignorance and overconfidence in
downloading and installing potentially spyware-
infected software”. Journal of Global Information
Management, 27(3), 87-100. https://doi.org/10.4018/
JGIM.2019070105
Hurlbut, J. (2017). “A science that knows no
country: Pandemic preparedness, global risk,
sovereign science”. Big Data & Society, doi.
org/10.1177/2053951717742417.
Mente, R. (2017). “Android Application Security”.
Advances in Computational Sciences and
Technology, 10, (5), pp. 1207-1210.
Jani, A. (2020). “Preparing for COVID-19’s aftermath:
simple steps to address social determinants of
health”. Journal of the Royal Society of Medicine,
doi.org/10.1177/0141076820921655.

between the protection of information and the Conclusion

use of information. The former concerns the One of the overriding concerns in the rush to
user assertion of information control for their develop Covid-19 applications for Smart Phones
own interest and the later the use of information is the potential for a false sense of security and
for a public good. Location data, for example, unjustified health risks to be taken by users.
can compromise client and customer contacts The trade-off between health authorities’
that are beneficial to a user for their business requirement for personalised location data and
interest but also the same data can benefit the application user motivation for safety will
the public good for tracking and tracing active drive forward the adoption of tracing and tracking
disease cases and allow the risk treatment. The applications. Attention to mitigating the security
trade-off of personal harm and personal benefit, issues raised in this paper also contribute to the
with public good, is a decision a user must take. uptake and the wider distribution of the proposed
Many view information technology systems applications. However, the issue of application
to be untrustworthy, unregulated, and out of capability scope can be lost in the media hype,
control. Disclosure backsliding is a common the demand for immediate solutions to a crisis,
term used to express doubt at information and a belief that technology has all the answers.
protection and use in practice. The strongest These matters promote a false sense of certainty
case that can be made for Covid-19 tracking when in reality no application can deliver to all
and tracing applications is demonstration in the expectations. The gap between promises
practice. If significant economic and health based on theoretical ideal cases and what is
benefits can be demonstrated, and causally achieved in practice, exposes a material risk for
linked to the application use, many potential health and safety failure. Smart Phone tracking
users will accept the worth. This has yet to be and tracing applications for halting the spread of
demonstrated, but then no one has yet enrolled Covid-19 are a partial solution to a much bigger Dr Brian Cusack comes from
a full population. problem of community and social health. A a background of academic
multi-pronged and multi-faceted approach has research in IS Security and
A multi-pronged to be adopted for effective management and IT Forensics. He currently

and multi-faceted the utilisation of multiple resources and layers

of control applied for the strongest mitigation.
directs the Cyber Forensic
Research Centre NZ and is Adjunct Professor
approach has to be The review of security and implementation to the ECU Security Research Institute; and

adopted for effective challenges defines limitations and clarifies

the roles information technology is suited in
Professor at the Graduate Research Institute.
He has been an International Standards
management. a pandemic. • Negotiator for over 15 years.

19

DFM43_014-019_Virus Apps.indd 19 13/08/2020 18:09

DFM43_020_Ad - ICDIP.indd 20 13/08/2020 18:09
 LEGAL EDITORIAL

LEGAL Editorial
F
irst and foremost, DFM readers, I hope The Zoom policy (https://zoom.us/privacy) The crux seems to be the distinction between
you and yours are all safe and healthy. categorizes data into two different types: data “customer content” and metadata such as
There is a quite a lot of information the customer provides to Zoom, and data Zoom IP address, operating system (OS), etc. Zoom
about the pandemic flying around, gathers from customers. We can look at these defines “customer content” as “information you
some helpful, some less so, but one categories as ‘push’ and ‘pull’, respectively. or others upload, provide, or create while using
point that is generally agreed is people need to Specifically, the policy says this: “Zoom Zoom”. Going back to our earlier descriptions,
stay home as much as they possibly can. (Many does not monitor or use customer content for this definition appears to apply to the information
of us are technology people: not to put too fine a any reason other than as part of providing our which customers push to Zoom and not to data
point on it, but some of us may already be adept services. Zoom does not sell customer content to which Zoom pulls from the customer. “Customer
at social distancing.) With that in mind, we will anyone or use it for any advertising purposes.” content” then will include what is said and
take a look at an issue which may fall under the However, if we scroll down the page we see that presented in the Zoom meetings, particularly
heading of ‘unintended consequences’. Zoom mentions this: “Data collected through the when customers request text transcripts of their
As a result of the various warnings, orders, use of cookies and pixels”. Cookie policies are meetings. One of Searls’ concerns was that
requests, to remain indoors, many people around generally straightforward, particularly since the potentially sensitive information, such as that
the world find themselves working from home launch of GDPR. The pixels, on other hand, are communicated between a doctor and a patient,
(WFH). This has already resulted in a certain level in your author’s opinion a fairly sneaky way to would be used to inform advertising for both
of amusement as the inexperienced among us gather data. Generally, these are 1-pixel by 1-pixel parties later. That does not seem to be the case,
forget to turn off cameras and mute microphones, images that are embedded in a web page. They at least in the current iteration of the policy.
but there is another potential issue at hand: are not visible to the naked eye, but the act of As mentioned above, the revision to the
privacy of user data. loading them is what provides information to the Zoom privacy policy may or may not have been
Many people who needed to immediately start site owner. For example, if the image has a file the result of the publicized analysis. In either
WFH signed up with a service called Zoom. On 28 name of MarketingCampaign2020.jpg” and the case, however, it is helpful for organizations to
March, the former editor-in-chief of Linux Journal, web server logs show that the image was loaded be transparent about their intentions and their
one Doc Searls, wrote a fairly scathing review 10,394 times by 8,742 unique IP addresses, policies regarding the collection and use of
of the 18 March 2020 version of Zoom’s privacy then Zoom has metrics to see how many people customer data.
policy. Searls’ position was that Zoom is not really clicked on a link to visit a specific page.
in the communications business: “What they're As we saw above, Mr. Searls expressed Looking Forward
also saying here is that Zoom is in the advertising his opinion that Zoom is “in the advertising Let’s go back to the WFH movement for a
business, and in the worst end of it: the one that business”, a claim which appears to have been moment. Over the years I have encountered a
lives off harvested personal data. What makes based on the next bit in the Zoom privacy policy: number of organizations who insisted that all of
this extra creepy is that Zoom is in a position to “Data collected from tools such as Google their contractors and employees work on-site
gather plenty of personal data, some of it very Analytics and Google Ads”. Zoom further at all times. This is colloquially referred to as
intimate (for example with a shrink talking to indicates that they use the 1x1 images to, “[backsides] in seats”; we shall call it AIS. In my
a patient) without anyone in the conversation among other things, “Evaluate the success of observations, the larger proponents of AIS tended
knowing about it. (Unless, of course, they see an our Marketing campaigns [and] Send you tailored to be organizations that made physical products,
ad somewhere that looks like it was informed by a Zoom advertising when you are on other sites.” so their reluctance to embrace WFH made some
private conversation on Zoom.)”. This appears to be the clause which raised the ire sense. However, what we have seen recently is
If true, this is probably not what the recent crop of Searls. To expand on what I believe is his point, a mass migration from AIS to WFH in companies
of new Zoom users wanted to hear. It may have what is the valid business reason for Zoom to be that had never considered such a thing and may
also gotten Zoom’s attention: the current privacy gathering advert-related data and providing ads have previously claimed that WFH was simply
policy posted on Zoom’s web site is dated 29 to users when they “are on other sites”? impossible for one or more reasons. There is
March. One should not assume that the updated In my opinion, Mr. Searls’ assessment of a new reality afoot, and workers may be more
policy was the direct result of Searls’ analysis, Zoom being primarily an advertiser is rather inclined to insist on WFH from now on. Companies
there is no evidence to support that conclusion, off the mark. The primary purpose of Zoom that embrace remote working (where practical, of
but the timing of the revision is interesting. I seems to be to facilitate remote voice and video course) can save money on facilities and utilities,
have not read Searls’ annotated analysis of the communications; the advertising piece appears e.g. leasing only one floor of a building instead
previous version. Instead, I want to take a look to be a rather small overall percentage of what of four. Defining “the new normal” is a subject
at the new version to see if it contains anything they do, which in no way makes it right if they of much speculation, and I believe it will include
unusual and/or potentially alarming. are doing something inappropriate. more WFH options in more industries. •

21

DFM43_021_Legal Editorial.indd 21 13/08/2020 18:10

 LEGAL FEATURE

Pandemic,
Planning
and Proper
Preparation
Scott Zimmerman explains how effective forensics programs must
address the daily operation of the systems.

I
t is not an exaggeration to say that the the control of the planner. However, as we are 2 outages/year X 3 days/outage X 10,000
global pandemic has affected nearly every seeing daily, there are significant events which pounds/day = 60,000 pounds lost
aspect of many peoples’ lives. At the time are outside the control of most of us. How does
of this writing we appear to be rather far one go about planning for such a thing? (Readers may recall from their maths classes
from establishing what many are calling the In the world of Information Security the process for cancelling out units between
“new normal”. People who rely on science and (INFOSEC), where your author has spent numerators and denominators.)
evidence, i.e. reasonable people, are locked in almost twenty-five years, there is a concept However, each variable can change. Let
an uphill struggle against those who are loudly called Annualized Loss Expectancy, or ALE. us suppose that the utility company has an
offering opinions based on anything but science (Regrettably there is no commonly-used excellent record and experiences only one
and evidence. This vigorous debate results abbreviation of LAGER, although on the network two-day outage every two years: one outage in
in a variety of actions and inactions, ranging side we do have Classless Inter-Domain two years is, for our hypothetical and modelling
from helpful to actively detrimental. We will not Routing, or CIDR.) In this context, the ALE is purposes, the same as (1/2), or .5, power
engage in that sort of argument here; instead, a way to project the organization’s losses outages in one year. We can still calculate the
we will look at the nature of planning and draw due to specific types of events for a given ALE but the figures will look a bit different:
parallels with digital forensics investigations. year. Typically, this is done by multiplying the
By definition, “planning” refers to working out likelihood of a particular event by the number of 0.5 outages/year X 2 days/outage X 10,000
in advance how to achieve some sort of goal. times the event is expected to occur times the pounds/day = 10,000 pounds lost
Normally your author would turn to Black’s Law amount of loss (usually financial) each event
Dictionary for an authoritative definition of a would cause. Let us further suppose that the company
term, but in this case, it appears that English For example, given the history of the local has deployed a large diesel-powered backup
and Legalese intersect sufficiently that there utility, a company may expect to have two generator that can fully sustain all operations for
is no law-oriented result for the word ‘plan’, multi-day power outages per year. If each day up to four days. Unless something at the local
which was frankly a bit of a surprise. On the of power outage costs the company 10,000 utility goes much more wrong than it historically
surface, of course, it is likely that most people UK pounds in lost production, and if each has done, the generator will be able to replace
understand planning: someone going on holiday outage lasts three days, the company can the local utility while they put themselves right.
will book flights, a hotel, possibly a car, will expect to lose 60,000 pounds each year. (We What happens to the equation then?
make a list of necessary items to pack, etc. are assuming here that the company operates
This is arguably the easiest sort of planning: seven days a week, so weekends will not be a 0 outages/year X 2 days/outage X 10,000
the process and the results are largely under factor.) The equation would look like this: pounds/day = 0 pounds lost

22 Digital Forensics Magazine

DFM43_022-025_Legal Feature.indd 22 13/08/2020 18:56

 By thinking about the possibility of power However, this is where things can get a the system offline, install a fresh operating
outages in advance, the company can make bit tricky. In the examples above, the ALE system, and restore data from backups”.
a reasonable and educated guess regarding calculations were simplified for purposes of Forensic examination of hard drives was a
how much they might lose; they can then demonstration. The real world, as we have seen, comparatively rare occurrence and usually did
plan and deploy preventive measures as tends to be rather messy and complicated; how not happen except in the most serious cases,
appropriate. If we look at the original scenario can one reasonably address ALE? Consider especially if such an investigation would require
in which the company loses 60,000 quid the equations above where we manipulated the hiring of a third-party organization.
per year due to power outages, one might the likelihood variable and ALE results changed In order to address this post-event focus,
expect the organization to investigate their fairly dramatically. We restricted our scenarios I wrote a paper titled ‘Proactive Computer
options for stemming or eliminating the loss, to the local utility, but a power outage is an event Forensics: Meeting Evidentiary Requirements
e.g. by installing the backup generator. There that can happen almost anywhere and for a in Daily Operations’. The idea had started a few
is a caveat to this: the cost of the preventive wide variety of reasons: an inattentive backhoe years earlier as the basis for a book manuscript
measures should be favorable when compared operator may dig into a cable, a vehicle may crash but was condensed into a paper in 2005 for an
to the cost of the outages. If the organization into an electrical transformer, a storm may bring academic program. In turn, the paper and the
in question can install the generator to meet down trees and power lines, etc. The upshot of all manuscript pieces together formed the basis
all applicable requirements, wired properly, this: when considering losses due to an event or of a series of articles for a fledgling publication
fueled, tested, done in accordance with all condition, one must consider the range of causes called Digital Forensics Magazine. Roy Isbell,
safety standards, etc. for 12,000 quid, that which may lead to that event or condition, even if DFM’s Editor in Chief, and I discussed a plan,
would represent good value for money when some of those causes have not yet occurred. and the Proactive materials began to appear in
compared to the 60,000-pound ALE. Looking Issue 2. So, because the paper is now fifteen
at it from another and slightly contrary angle, You Said Something About years old, and because it deals specifically with
a massive dual-generator installation which Digital Forensics Investigations? planning for an investigation, the descriptive and
could power the company site for three full Indeed. Back in 2000-2001, your author was broadly-applicable portions will be reproduced
weeks at a cost of 115,000 pounds may not doing Incident Response research and realized here. Please note that the paper predated the idea
appear to provide value for money: according that nearly all of the available guidance focused of Big Data by quite a few years; it even predated
to the utility’s history, there is no need to cover on recovery after the fact; very little attention the market niche of Security Information & Event
such a lengthy outage and so the massive was being paid to planning and preparing Management (SIEM), so do not be surprised
capacity and failover capability would very for incidents. Even at that time, much of the if some of the references are a bit quaint.
likely never be used. recovery advice could be summed up as “take The principles remain sound. 

23

DFM43_022-025_Legal Feature.indd 23 13/08/2020 18:56

 LEGAL FEATURE

Proactive Computer Forensics (2005)

Currently the most commonly referenced
aspect of computer forensics involves
magnetic remanence: recovering deleted files
or otherwise gaining information from a hard
drive that has been removed from a suspect’s
or victim’s computer. While this is a crucial part
of any investigation, a recovered hard drive
may not contain enough information to recreate
a situation with sufficient accuracy. There
are two primary shortcomings of traditional
computer forensics investigations:

• The traditional investigation occurs only

after an incident has occurred; operational
information describing the normal state of
the system can be ephemeral and easily lost
• The postmortem (so to speak) investigation
of a hard drive can represent only a single
point on the timeline of events: the information • Identify information gathering methods The process of storing information as evidence
therein shows only the state of the drive at the available on the host. differs materially from the process of storing
time it was recovered. Information describing • Decide which methods are most useful, information purely for internal use. Even without
the events leading up to the recovery may i.e. generate higher levels of desirable extensive documentation, the integrity of logs and
be lost, particularly if the intruder attempted information based on the priorities of the other files may be verified to the satisfaction of
to cover his tracks, and any events that organization. in-house personnel. However, the requirements
happened after the seizure will of course • Configure these facilities to gather detailed of the judicial system dictate that evidence must
not be recorded on the drive. and relevant information; this may require possess a verifiably high level of integrity and a
additional hardware or software. documented chain of custody before those items
This paper will describe a methodology • Ensure that the information is stored can be accepted as evidence in court.
and a set of requirements for capturing this appropriately given evidentiary requirements An organization that follows rigorous
ephemeral information as a standard part of and the sensitivity of the data. procedures for gathering evidence will be
daily system operations. This information, able to recover handily after an intrusion; an
coupled with the postmortem examination This framework should give the reader a organization that maintains information strictly
described above, can help investigators rough overview of the continuous forensic for internal use may not be prepared to prosecute
recreate events more easily and effectively. process as implemented on a single mission- an intruder. In order to build a solid case, the
critical machine. organization must gather all information in
Forensics as a Part of Daily Operations accordance with standard rules of evidence.
As mentioned above, examining the state of a Preservation of Evidence
computer system at a single point in time may The preservation of evidence can be a fairly Chain of Custody
not provide useful information about previous labour-intensive process. The procedures The chain of custody describes in detail
states. Gathering information in a consistent require time and resources, such as hardware what happens to any piece of evidence as it
and thorough fashion through multiple and software, above and beyond those needed is collected and stored. For example, a hard
operating states will provide a more detailed for normal system administration duties. disk containing valuable log information is
picture of events. Additional personnel may be required to handle removed from a suspect’s system and is
From the time a computer is powered on, the increased workload. Detailed planning is subsequently placed in a safe. In order to
parts of the boot process and other actions are crucial, as is complete management support. demonstrate a verifiable chain of custody for
recorded, or logged, to some form of storage For these reasons, one point in particular must this piece of evidence, the organization must
such as a hard drive. How can a system be made clear at the outset: maintain an uninterrupted account of the item’s
administrator achieve consistent and thorough The organization should establish its policy whereabouts and condition from the time of the
logging? Functionally the answer will depend regarding prosecution of computer crime and intrusion until the item is presented in court.
on the platform in question, but conceptually preservation of evidence BEFORE deploying the A suitable guideline for creating this record
the answer is straightforward: procedures described in [here]. is to use what the media call “The 5 Ws”: Who,
What, When, Where, and Why. Using “The 5 Ws”

An effective forensics program must address in conjunction with the Rules of Evidence, we
can create a list of questions that should be
the daily operation of the systems. answered for the hard drive in the example:

24 Digital Forensics Magazine

DFM43_022-025_Legal Feature.indd 24 13/08/2020 18:56

 • What exactly is the item in question? • The vulnerability that allowed the intruder would the impacts be if one or more of the
• Who removed the drive from the system to gain access is still present. critical items were interrupted? Using the
and when? A simple reinstallation of the operating principle of the ALE, how likely is it that a
• Was the drive functional at the time system, without changes to the configuration, given interruption will happen? Calculating
it was removed? will solve only the most immediate problem the likelihood of a pandemic is for your
• Was the drive removed from the system in of getting the system back online. Without author so far afield it is not even a speck on
the location where the system was found? patches or other modifications, the machine is the horizon. However, the concept can be
If not, at what location (address, room still vulnerable and will likely be compromised broadened to include identified as well as
number, etc.) was it removed? Why? again in the future. unidentified circumstances. What if transport
• Was anyone else present? Why or why not? • No one learns anything. became unavailable? What if there were
• Where and how was the drive stored? How How exactly did the intruder gain access? shortages of critical items in the shops?
many people had access to this location? Did a user account have an easily-guessed What if utilities such as water and electricity
• How was the drive transported to this location? password? Was there a buffer overflow broke down?
• Was the drive subsequently relocated? Why? exploit in the mail server application? To be fair, those are all daunting possibilities;
• Who was the primary custodian of this item? What must be done to close the security let us start on a more manageable scale.
hole? Without reliable logging and auditing Many cars include spare tires in case one of the
While this list of questions is not meant to be information, these questions will be difficult primary tires goes flat. The auto manufacturers
all-inclusive, it does elicit numerous important to answer with any certainty. realized that flat tires happen, and they crafted
details about the handling of the hard drive. • Data can be lost. an answer in advance to address that problem;
Each piece of evidence should be handled and Any changes made to the system or to user however, the automobile owner still must do
tracked in a similar manner, so the chain of data since the last backup was taken may be his bit and ensure the spare and the tools
custody remains unbroken. An unbroken chain lost. If the system in question is a static web remain in serviceable condition in case of
of custody is a strong indicator the integrity of server, the loss may not be too vexing. If the emergency. I would encourage readers to
the item remains intact. system contains a mission-critical internal consider how they go about their daily lives
database, however, the consequences may and think about how they could plan for
On Evidentiary Requirements be slightly more alarming, particularly if the unexpected changes.
Evidence that is collected for a criminal trial most recent backup was taken several days Please be safe, remain calm, and, as ever,
must meet the highest standards for integrity prior to the incident. look for reliable evidence. •
and for the chain of custody. Evidence used in
an in-house investigation, on the other hand, Summary
may only need to meet the standards of the An effective forensics program must address
security staff. However, what if a preliminary the daily operation of the systems: traditional
investigation leads to the arrest of an employee examination of iron oxide media will not result
on the suspicion that he committed a crime? in a complete assessment of the system as
The purely internal investigation has suddenly it changes over time. An integrated approach
become a criminal proceeding. Will the evidence containing an Intrusion Detection System
in hand hold up in court? Perhaps it will, but it (IDS), a File Integrity capability, effective
is likely that the exacting standards mentioned and efficient backups, and a robust logging
earlier have not been met. To cover instances like component will provide extensive information to
these, an organization that intends to prosecute support forensic investigation. These concepts
offending individuals should gather and preserve allow requisite personnel to gather relevant
all evidence consistently and completely in information consistently, efficiently, and in
accordance with Federal requirements. compliance with evidentiary requirements.

The Growing Need for Forensic Procedures Prior Planning Potentially Prevents
From the first extensive use of computer Poor Performance
networks in the 1980s through the early 1990s, The ideas behind the proactive sections are
incident response and investigation procedures these: think about events that may happen; Scott Zimmerman, CISSP has
were fairly limited. If an intrusion was suspected, identify what might be needed to remediate been an Information Security
the standard response was to wipe the system those situations; work out a sustainable way practitioner, consultant,
drives, re-install the operating system from to obtain the necessary items; and store presenter, and trusted
original vendor-supplied media, and restore them appropriately. Readers are encouraged advisor for twenty years. He
user and application data from the most recent to consider their own environments, both has been researching legal issues in computer
backup tape. While this approach can get the inside and outside of work. (Many have been forensics part-time for over ten years, and is
compromised system back online in a known doing this already, one would suspect.) What working to bridge the gap between law and
state, it is flawed in a number of important areas. processes or capabilities are critical? What technology in this area.

25

DFM43_022-025_Legal Feature.indd 25 13/08/2020 18:56

 LEGAL NEWS

LEGAL
News
Marriott's Public Relations the end of February”. No further details were Weibo Data for Sale on the Dark Web
Challenges Continue available but that statement brings up a few Weibo is a popular social networking site
Regular readers of DFM may recall hearing questions. Is the spokesperson’s statement in China. An unnamed individual going
about the Marriott hotel chain user database accurate? If so, why was the breach not by the alias of @weibo claims to have
being breached in 2018: personally-identifiable detected for so long? February is a slightly compromised the site’s user database in
mid-2019 and exfiltrated most of the data.
information (PII) belonging to 383 million users shorter month than the rest; even during this
The database is thought to have contained
went missing, along with an impressive number leap year, we can think of it as four full weeks.
information on approximately 538 million
of credit cards. Going back as far as 2014, some All of February plus some part of January most
users. (For comparison, this is over eight
may also recall Marriott being taken to task for likely equals more than a typical month. What
times as many people currently residing in
blocking customers’ wi-fi in their conference happened at the one-month mark to cause the entire UK.) The data tranche has been
centres, forcing attendees to pay for pricy the breach to be noticed? On the other end, if made available for purchase on the dark
on-site connections. Their record of missteps we assume the incident occurred during the web for the princely sum of $250US. It is
continues with another data breach. Frankly first week of January and was discovered on worth noting that the data dump is priced
it seems like a small incident compared to the February 29th, that is a span of approximately so low because it does not contain any
Weibo breach (see side panel), affecting as it eight weeks from incident to discovery. user passwords. What it does contain, on
does about 1% as many people, but 5.2 million Also according to a statement from Marriott, the other hand, are the users’ real names,
is still a lot of stolen records. We should note “We identified that an unexpected amount of their Weibo usernames, their locations,
and, in the case of over 170 million users,
that these customer records contained the guest information may have been accessed
their phone numbers. The sheer volume of
following information: names, birthdays, email using the login credentials of two employees
affected users is staggering. Worryingly,
addresses, physical addresses, and possibly at a franchise property”. Okay, that gives us
there are conflicting reports surrounding
links to other loyalty programs like those of a bit more information. One might reasonably
the breach and the methodology allegedly
airlines and, one suspects, other hotels. speculate that the owners of the compromised employed by the intruder. @weibo claims
This is a non-trivial event in a series of accounts were successfully phished; this he compromised a SQL database owned
same for Marriott. One might think that could be corroborated through review of web by the social media firm to get the data.
they would have taken some lessons from proxy logs, e.g. if two machines reached out to Weibo’s press release stated that the
the earlier events and made substantial the same known-to-be-malicious web server. phone numbers came from a different
improvements to their IT security operations, The suspicious activity may also have been compromise that took place in 2018, and
including their investigatory and reporting identified via access logs of successful logins that someone must have passed those
capabilities. Regrettably it seems they have from unusual locations. We do not yet know the phone numbers to the Weibo Application
Programming Interface (API), trying to
not: in an article on The Register, a Marriott nature of the attack(s) nor of the evidence used
match phone numbers with individual user
spokesperson indicated that the breach is by Marriott to identify the breach. Irrespective
records. Some local security practitioners
thought to have started at some point during of methodology, their customers may ask that
(and possibly users of Weibo) refuted the
January 2020 and that it was detected “at Marriott act more quickly next time. • press statement, stating that passing
phone numbers to the API would not have

The breach is thought to have started returned such detailed info to the attacker
and that @weibo’s account of events was
at some point during January 2020. more plausible.

26 Digital Forensics Magazine

DFM43_026_Legal News.indd 26 13/08/2020 18:11

 SUBSCRIPTION CHANGES

SUBSCRIPTION
Changes

W
e are making changes to our subscriptions as a result of
the changes Digital Forensics Magazine has had to make
resulting from the impact of the Covid-19 Coronavirus
pandemic. These changes have already started to be
implemented and you are only affected if you have a
print subscription to the magazine. If you have a digital subscription
nothing changes with regard to your access to the magazine.
In order to maintain the viability of the magazine we have decided to
cease provision of any form of print version of the magazine. This will be
effective immediately following Issue 42 and will continue indefinitely. It
is unlikely that we will return to print other than any special issues as the
cost of print in small quantities is just not cost effective. Fortunately, this
only effects a small number of individual subscribers and we are working
hard to refund any portion of the balance between the print subscription
and the digital subscription that may be due. We would ask that you bear
with us whilst we work through the subscription database. Those of you
who have had renewals recently will have seen that we have already
refunded the non-digital portion of the subscription.
We have maintained the cost of the magazine at it current levels for
some time now, however this cannot be maintained indefinitely, and we
retain the right to increase the annual digital subscription in the future
should circumstances dictate that this is prudent.
This leaves only those who have corporate print subscriptions
to be converted to digital only subscriptions. We will be simplifying
the digital subscription for corporates to allow multiple users to access
the digital copies concurrently, we will also be increasing our technology
and monitoring of subscription usage to ensure that subscribers are taking
out the correct subscriptions. More on this will be published as the systems
come online. We will be contacting the corporate subscribers individually
to transfer them where required to the new subscription, again please bear
with us as we work through the database.
Lastly, for the collectors out there, we do have a number of printed back
issues that we have in our store and these are available to purchase through
the website, or by contacting us directly to see if certain issues are still
available. Stocks of some issues are very limited, so first come first served
and book early to avoid disappointment.
If anyone has any question or concern over their subscription, they should
raise a support ticket via the website. •

27

DFM43_027_Subscriptions.indd 27 14/08/2020 11:56

 ADVERTORIAL UNIVERSITY OF WARWICK

CYBER S ECURITY,
ACADEMIA & INDUSTRY
C
yber security is a rapidly evolving sponsored research, and is one of the rare cyber security solutions in business – often at
discipline which carries with it a university departments which can genuinely very senior levels in prestigious companies.
series of challenges, many of which claim to embed industry at the heart of The CSC’s research areas of focus include
are unique and require continuous academic education and research. cyber-physical systems, vehicle cyber security,
engagement between academia Very few academic institutions have smart cities, digital forensics, advanced
and industry. However, there are often criticisms the breadth, depth or calibre of industrial network defence, and counterfeit protection. Its
on both sides, with academics complaining collaboration that has been a defining approach is a multi-disciplinary one, combining
that industry does not talk to them and industry characteristic of WMG over the past 34 academics, government and industry experts
arguing that academics are focusing their years. Within WMG, the Cyber Security and from a variety of disciplines who bring together
energies within the confines of their ivory towers. Management MSc has been designed with the technical and behavioural aspects needed
So who is not talking to whom, and how can extensive industry consultation, and the course for effective cyber security research.
academia and industry work better together? is delivered by tutors from the WMG Cyber It is vital for industry and academia to work
WMG is an academic department of the Security Centre (CSC) who have considerable together. WMG provides a template for how this
University of Warwick, pioneering in industry experience of determining and implementing collaboration can flourish. •

The course is delivered by tutors from the WMG Cyber Security

Centre (CSC) who have considerable experience of determining
and implementing cyber security solutions in business.

For more info

Visit www.wmg.warwick.ac.uk

28 Digital Forensics Magazine

DFM43_028-029_Ad - University of Warwick.indd 28 13/08/2020 18:40

 29

DFM43_028-029_Ad - University of Warwick.indd 29 13/08/2020 18:40

 FEATURE INTERMEDIATE

MEMORY
FORENSICS
Rick Leinecker discusses the valuable information
that can be obtained from memory analysis.

M
emory forensics is the process should be taken to dump the memory while
of capturing and analyzing the system is still live, while minimizing the
the data available in a target impact to the existing state of the system and
device’s RAM. To clarify, RAM is its memory. Although this does represent some
a type of short-term memory additional effort, the value of the data available
into which data is loaded when it is in active in memory makes the process worthwhile.
use. As a result, whenever an action is taken There are really two broad categories of
on the system, the associated data will be investigation for which specific types of
loaded into this location. However, RAM is also memory artifacts can be extremely valuable.
a volatile form of memory; it overwrites old data Firstly, employee and criminal investigations
automatically when it fills up, and when the typically involve the task of determining the
system shuts down, the RAM is wiped. While user’s activities on the system as thoroughly as
it may be possible to retrieve automatically- possible. In this case, the fact that all actions
generated copies of some or all of its contents, pass through memory becomes very useful.
such as in the form of hibernation files,
crashdump files, or page files, in general,
this volatility means that the use of memory There are really two broad categories of
forensics requires investigators to alter the
traditional pull-the plug and image strategy of
investigation for which specific types of
traditional disk-based forensics. Instead, care memory artifacts can be extremely valuable.
30 Digital Forensics Magazine

DFM43_030-035_ Memory Forensics.indd 30 13/08/2020 18:40

 Artifacts of particular interest may include account passwords. All of this data and
network packets in the buffer, registry keys more can be derived from memory and prove
and values, whole viewed files, clipboard data, invaluable to this type of investigation.
terminal commands, and encryption keys. Secondly, memory artifacts can also
In particular, encryption is becoming an be extremely valuable in investigations of
increasingly serious problem for forensic possible cybercrime and malware infection. A
investigators since strong encryption is particularly relevant situation is infection by
becoming more mainstream and cannot be memory-resident malware; certain types of
decrypted without access to the correct key. As sophisticated malware are now able to avoid
a result, extraction of encryption keys from the leaving artifacts on the disk and instead exist
memory can be the only way to read encrypted entirely on a system’s RAM. This technique FTK Imager
files or volumes from the disk. Similarly, the makes the malware particularly resilient FTK® Imager is a data preview and imaging
viewed files that may persist in memory could against traditional antivirus solutions, and tool used to acquire data (evidence) in a
be encrypted or fully deleted on the disk, which it also means that the infection will not be forensically sound manner by creating copies
may make memory the only viable retrieval detected by traditional disk-based forensic of data without making changes to the
method for that data. In addition, registry analysis. However, the infection will leave original evidence. After you create an image
information could be used to dump usernames artifacts in memory that can allow for of the data, use Forensic Toolkit® (FTK®) to
and hashed passwords, the packet buffer could detection. These include hidden processes, perform a thorough forensic examination and
contain connections to suspicious websites, suspicious network connections, and the create a report of your findings.
and clipboard data could contain additional actual executables themselves.  (Source: Access Data)

31

DFM43_030-035_ Memory Forensics.indd 31 13/08/2020 18:40

 FEATURE INTERMEDIATE

Such artifacts not only point to the existence Another common tool for memory capture is NotMyFault
of malware, but they can also provide important Winpmem, which is part of the open-source Rekall NotMyFault is a free tool to crash,
insights into its functionality much more memory forensic suite. This tool is terminal- hang, and cause kernel memory leaks
quickly and easily than reverse-engineering based, and it can also be run from a USB drive. to learn how to diagnose different device
the full executable by producing a record of In addition, while its overall capabilities are and hardware problems on Windows
its actual activities on a live system, including lesser than those of FTK Imager, it also leaves a systems. The zip file contains portable
information like processes and dlls that it may smaller footprint on the system. Winpmem can 32-Bit and 64-Bit versions. Extract the
have utilized, IP addresses to which it may have capture the full contents of memory as well as the files to wherever you like and then
connected, and files that it may have accessed. contents of drivers, and its associated commands double-click on notmyfault.exe for
In short, memory forensics can both detect are relatively straightforward. 32-Bit or notmyfault64.exe for 64-Bit.
even highly sophisticated forms of malware The main alternative to capturing memory Note that the other two files,
and subsequently allow for additional analysis from a USB drive is to capture over a network notmyfaultc.exe and notmyfaultc64.exe
opportunities of the malware using the data connection. The superior method of capture will are the command-line versions.
generated by the existing infection. be dependent on circumstances, particularly (Source: majorgeeks.com)
the types of artifacts that are expected to be
How to Capture Memory of most relevance. Capturing over a network It is possible that a malicious actor could
Perhaps the most straightforward way to capture can allow the investigator to avoid leaving a take precautions in order to hijack the capture
memory is by running some form of acquisition footprint in certain areas, such as USB artifacts, process and ensure that certain crucial
software on the local, live machine. This process but it can also produce a significantly increased details are not included in the capture file.
is typically conducted from a USB drive, since footprint in other areas, such as by overwriting In particular, malware can be developed to
installing additional software on the suspect the packet buffer. Network acquisition may evade memory capture, and proof-of-concept
device would unnecessarily produce additional also be more appropriate if a large number of examples have been developed. For example,
artifacts. Various types of software are available machines are involved or if only remote access Dementia was one such example created
that can successfully capture memory from is available. There are a variety of different in 2012. It acted as a filter for content as it
a Windows device. One popular option is FTK ways in which to produce a remote memory was written to the target file during memory
Imager, which is available as freeware. It can be capture, and the most common solutions seem acquisition by intercepting NtWriteFile() calls.
loaded onto a USB drive, launched on the live to consist of proprietary software such as In short, it could gain total control over what
system with a GUI interface, and used to retrieve F-Response. It also would be possible to perform data would be written to the memory capture
a full or partial memory capture. Interestingly, remote acquisition by using a tool like PsExec file, and as a result, it could do anything from
the tool provides the option to also copy the for remote command execution of acquisition simply producing an entirely blank capture
pagefile.sys file, which is used to store additional tools like Winpmem, but this technique would file to selectively scrubbing references to any
data when the physical capacity of the RAM is typically result in an increased footprint since malicious activities. In general, a wide variety
reached and thus can include additional data it tends to require that the imaging software be of options may be available to malware if it is
relevant to memory analysis. copied to the target machine. able to detect the presence of an acquisition

In general, a wide
variety of options
may be available to
malware if it is able to
detect the presence
of an acquisition tool,
and it can potentially
corrupt the contents
of the acquisition
file so as to make
analysis impossible.
Figure 1. Using FTK Imager to Capture Memory from a USB Drive

Figure 2. Using Winpmem to Capture Memory from a USB Drive

32 Digital Forensics Magazine

DFM43_030-035_ Memory Forensics.indd 32 13/08/2020 18:40

 tool, and it can potentially corrupt the contents Hollowfind
of the acquisition file so as to make analysis Hollowfind is a Volatility plugin
impossible or simply delete the most valuable to detect different types of process
evidence from the capture without the hollowing techniques used in the wild
investigator’s knowledge. to bypass, confuse, deflect and divert
One of the main ways in which to avoid these the forensic analysis techniques. The
types of evasion techniques is by generating plugin detects such attacks by finding
a crashdump file, which involves intentionally discrepancy in the VAD and PEB, it also
crashing the system. When a system crashes, disassembles the address of entry point
the contents of memory are typically written to detect any redirection attempts and
to a page file called the crashdump file, also reports any suspicious memory
which is intended to allow for diagnostics regions which should help in detecting
and can be analyzed much like a traditional any injected code.
memory capture file. A system crash almost (Source: cysinfo.com)
instantaneously ends higher-level operations,
and the dump itself is performed by low-level Figure 3. The Settings to Produce a Full Crashdump which contains certain metadata about the
kernel operations. The evasion techniques process itself. All of the EPROCESS structures
discussed above will not work under these are stored within a doubly-linked list, in which
conditions since their processes will probably each entry contains a reference pointer, or
be suspended and their functioning relies memory address, for the next structure in
on some higher-level operations, so this the list as well as the previous structure. As a
strategy should work even in cases of highly result, analysis software can locate the first
sophisticated malware infection. Analysis EPROCESS entry, which can be found using
of crashdump files may also be necessary the PsActiveProcessHead pointer, then simply
if the system was actually shut down, but a follow each subsequent pointer to find all of
crashdump file persists on the disk. the remaining entries and, by extension, their
In a situation in which a crash must be corresponding processes. This is unsurprisingly
generated deliberately, a few tools are available one of the fastest and easiest ways to list out
that can reliably perform the operation. In the running processes from a memory dump,
particular, NotMyFault from SysInternals is a and it can thus be a useful tool in deriving the
good way to produce a crash manually. The programs that were running at the time that the
type of crashdump file that it produces will memory was acquired.
depend on the configuration of the Advanced Of course, many types of malware would
System settings; the current default behavior of Figure 4. Manually Invoking a Crash with NotMyFault like to hide their running processes in order to
Windows 10 is to produce what is effectively a make themselves less vulnerable to detection.
kernel memory dump, which will leave out a lot Walking the Process List A common strategy is to alter the pointers of
of data and is not supported by many analysis A process is the execution of a program that surrounding EPROCESS entries such that the
suites. As a result, it may be worth the extra allows for that program to perform intended forward pointer of the preceding entry now
footprint to change that setting to a complete tasks. In a Windows system, each process points to the entry ahead of the malicious
memory dump, which will be more readily running on the system has a corresponding process, and the backward pointer of the entry
analyzed and include the full contents of RAM. EPROCESS data structure within the kernel, ahead of malicious process now points to the
entry before it. In such a manner, no pointers
reveal the location of the malicious process
in memory, and it will not be detected in a
traditional list-walking process.
In the above situation, it is still very
possible to locate the hidden processes
with memory forensic techniques, typically
Figure 5. Illustration of a Doubly-Linked EPROCESS List by using data carving techniques. To this
end, kernel memory is divided into a series
of memory pools, each of which begins
with a pool header to provide metadata on
the contents of that pool. The pool header
contains a four-byte pool tag, which works
as a sort of magic number for EPROCESS
identification. The pool tag of “Proc” 
Figure 6. Illustration of an EPROCESS List from Which a Malicious Process Has Been Edited Out

33

DFM43_030-035_ Memory Forensics.indd 33 13/08/2020 18:40

 FEATURE INTERMEDIATE

corresponds with an EPROCESS structure, so To illustrate these tools, some examples after hitting the 16-character limit. In a full
typically, analysis tools will scan the memory are provided of enumerated processes from investigation, each would warrant further
for instances of those four characters, then the publicly-available Moyix’s Fuzzy Hidden examination, such as by dumping the contents
perform integrity checks on the surrounding Process Sample. Firstly, pslist is run on the to examine the executables themselves or by
memory in order to validate that this a sample using both Rekall and Volatility. There is searching for correlations with other artifacts
legitimate structure rather than a random a difference in the way that the programs order like network connections.
false positive. In this manner, an investigator the results; Volatility arranges by start time,
can find not only examples of processes while Rekall orders entries by PID. However, Antiforensics for Memory Analysis
that have been deliberately edited out of the both ultimately produce the same set of results. A memory forensics investigation can
doubly-linked list, but also processes that may Then, the pstree, psscan, and psxview be thrown off by a number of different
have been terminated and removed from the plug-ins are used with the tool Volatility. It antiforensics techniques. These typically
list and thereby gain additional understanding should be noted that psscan and psxview do work by silently altering memory dumps,
of historical activities on the system. indicate the existence of hidden processes, subverting acquisition tools, or modifying
To implement the process-viewing techniques including various iterations of cmd.exe, memory in such a way as to thwart analysis
discussed above, and investigator should use svchost.exe, services.exe, and “network_ techniques. This process can lead not only
a memory analysis suite like Volatility or Rekall. listene”, which is most likely cropped to the concealment of information from an
Both of these products are open-source, modular
frameworks that support a variety of plug-ins for
specific analysis tasks. Volatility is essentially
the original memory analysis tool; Rekall was
originally a fork of Volatility that re-worked a
lot of the code and added significant additional
functionality such as live analysis capabilities
and built-in memory acquisition tools. Both are
well-equipped to examine processes, although
differences in implementation mean that even
plug-ins with identical names, such as pslist,
may have slightly different outputs when used
in each framework.
Each framework contains the process-
viewing plug-ins of pslist, pstree, psscan, and
psxview. Pslist is the most straightforward; it
will walk through the doubly-linked list in order Figure 7. Results of pslist with Rekall
to create a list of each process found there.
Each entry includes the virtual offset of the
process, the first 16 characters of the process,
the process ID (PID), parent process ID (PPID),
number of threads (Thds), number of handles
(Hnds), start time of the process, and more. The
pstree plug-in provides the same information
but arranged in a manner to visually clarify
parent-child relationships between processes.
Psscan uses the technique of scanning for pool
tags to show hidden and terminated processes,
although it should be noted that since data Figure 8. Results of pslist with Volatility
carving is used to derive the results, the offsets
available in this list are physical, not virtual.
Finally, psxview simultaneously runs pslist,
psscan, and other types of process-identifying
plug-ins to create a table showing which
processes were picked up by which scanning
technique. This can be a very convenient way
to pick up that a process is not showing up on
pslist but is appearing on psscan, which could
be a sign of malicious activity that warrants
further investigation.
Figure 9. Results of pstree with Volatility

34 Digital Forensics Magazine

DFM43_030-035_ Memory Forensics.indd 34 13/08/2020 18:40

 investigator, but much more importantly, it can
cast doubt on the integrity of any discovered
artifacts as legitimate. As such, it is important
to understand the common anti-forensics
techniques involved in memory-based
investigations.
Firstly, there are a number of anti-
forensics tools that fundamentally alter the
memory shown to a memory acquisition
tool, as discussed earlier in the article. Such
techniques typically include intercepting
system calls that attempt to read blocks of
memory and then altering what the acquisition
tool receives. Additionally, the majority of these
strategies work silently, so that they will not be
detected by the acquisition process. By using Figure 10. Results of psscan with Volatility
live analysis techniques that detect rootkits, it
may be possible to determine that such an anti-
forensics measure is in place, but the success
of this measure is not guaranteed. After all, any
program that can fool memory acquisition tools
can likely fool other forensic tools as well.
To bypass this issue, it is important to avoid
software-based solutions for obtaining memory
dumps when a malicious actor could have had
complete administrator access to a machine.
As such, it is advised to use hardware-based
acquisition tools when possible. If this is not
possible, crash dumps are also a potential
option, since they cause the majority of
the system to shut down too quickly for the
malware to react and the underlying operating
system is far more difficult to compromise. Figure 11. Results of psxview with Volatility
There are also a number of different ways
in which a malicious process can attempt to manners. However, there are a number of
subvert an investigator’s analysis by altering volatility plugins for detecting specific forms
the contents of memory. Techniques such as of anti-forensics. These include “hollowfind”,
process hollowing can be used, in which a which finds hollowed processes, “timers”,
legitimate process is begun and then has its which finds all timers on a Windows system,
executable code altered so as to contain the and “gargoyle”, which specifically detects the
malicious process. The malicious process could gargoyle anti-forensics technique. However, as
also store structures in memory designed to a whole, perhaps the best strategy is for the
mimic commonly searched for structures such investigator to perform sanity checks instead of
as network connections, opened files, or running just running a handful of scanners and deciding
processes. One especially notable example that the job is done. If the parent of one process
of a process that alters memory is Gargoyle, is almost always a certain other process,
which is a tool that fools analysis by hiding it should be regarded with suspicion if that
malicious executable code in a non-executable process is started by something else. Similarly, Rick Leinecker is professor
area of memory. The program will set itself if a process appears on a scanner but is not in of computer science at
as executable, run, set a timer to repeat the the operating system’s main process list, it is University of Central Florida.
process, and then set itself as non-executable, possible that it is a forged or garbage structure. He also performs Digital
which will effectively hide its presence from any Specific techniques will vary, but ultimately Forensics investigations,
analysis tool looking for executables in memory through identification of strange results, cross- and is ISFCE certified. One of his favourite
as is common in analysis suites. referencing, and verification, it is possible to hobbies is writing software for forensics
There is no foolproof way to detect every identify most anti-forensics measures that investigations. You can contact him via
single form of tool that alters memory in such operate in this fashion. • his website at www.RickLeinecker.com

35

DFM43_030-035_ Memory Forensics.indd 35 13/08/2020 18:40

 FEATURE ENTRY

Enabling
Intelligent
Cities
Hugh Boyes looks at Cyber Security
of Building Information and Systems.

C
ities face a number of serious transportation and logistics services, producing enable a timely response to accommodation
challenges that affect their food and supporting the removal, recycling or needs of a growing population.
competitiveness, sustainability disposal of domestic and business waste. This article examines some challenges
and the safety and security of In the built environment, the adoption of to be addressed if we are to understand and
their inhabitants. The challenges building information modelling (BIM) is seen as a manage the potential future impacts of these
arise from a variety of sources including the means of improving asset management across developments on the cyber security of the
complexity of the engineering infrastructure a building’s lifecycle. Adoption of collaborative future cities. We start by considering some of
supporting the city; the need to manage energy digital models in the design and construction the issues that affect the engineering of the
and water use; the need for efficient transport phase has led to significant cost savings [2] and future city as an intelligent platform. We then
systems; and the impact that severe weather it is suggested that even greater savings will be examine the security context and the need
events or natural disasters can have on densely made during building occupation through more for cyber security in the future intelligent city.
packed urban areas. efficient facilities and asset management. In Lastly, we discuss some of the challenges
Future cities are being talked about as smart the future city, use of BIM to speed design and facing city authorities in their management
or intelligent cities, where complex interactions support more agile construction techniques may of city data and systems.
between cyber–physical systems aim to improve
the quality of life of citizens and to proactively
manage demand for scarce or costly resources.
The landlord’s IP network may support a
These interactions will require increased use of diverse range of functionality including:
information and communications technologies access control, CCTV, building management
to connect and manage the complex cyber–
physical systems that will support and sustain
systems (HVAC), intruder alarms, escalator
the city. The systems include those delivering and elevator management systems, lighting
energy (electricity, oil and gas), managing water
(including fresh water distribution, wastewater,
control, telephony, energy metering and
sewerage, and flood alleviation), providing management.
36 Digital Forensics Magazine

DFM43_036-041_ Future Cities.indd 36 13/08/2020 18:44

 The Future City as an Intelligent Platform of cyber–physical systems involve feedback Dubai
There are a number of definitions of cyber– loops, allowing data about their environment This real estate project will not only
physical systems [4, 5, 6, 7]. Features and physical processes to be collected and include the biggest mall in the world,
they have in common effectively describe computed. Decisions may be made automatically but it will be part of a larger real estate
control systems, which may be networked or as to whether to change the state of an actuator venture, Dubai Square, an air-conditioned
distributed (i.e. employing a networking and/ or to alert a human operator. city equal to 10 football pitches. Dubai
or communications capability), incorporate a Critical infrastructure systems are Square will spread across 48 million sq.
degree of intelligence (either being adaptive predominantly cyber–physical systems, ft. to host 100 hotels, a theme park, and
or predictive), and work in real time to whose design generally includes safety critical theatres and will be developed by Dubai
influence outcomes in the real world. These functions. Their failure would have significant Holdings for approximately $6.8 billion.
definitions also point to the very diverse economic or social impact. Society expects From the architectural masterminds
nature of cyber–physical systems, which will these systems will operate in a safe, secure behind Burj Khalifa and The Dubai Mall,
be found in transportation, utilities, buildings, and consistent manner [8]. This becomes Dubai Square will present unprecedented
infrastructure, manufacturing, and health care. increasingly important with the growth of mega luxury and extravagance in a
These are all components of an intelligent city. cities and increasing population densities in technologically advanced environment.
Although cyber–physical systems have many existing cities. In response to environmental, Visitors to Dubai Square will not just
similarities with traditional data processing demographic and societal pressures, cities shop and dine; they will mix, socialise
systems, for example, their networked or can no longer conduct business as usual. and witness the new era of digital and
distributed nature and a degree of automation, Traditional city models developed during experiential retail, complete with a futuristic
it is the real-time nature of their interactions and since the Industrial Revolution are no amphitheatre, art district, Luxury Avenue,
with the physical world that is a significant longer appropriate, the transport and utility waterpark, Ice Adventure, VR Park, and
difference. The interactions with the physical infrastructures are becoming unsustainable much more in the way of fun for all ages
world are made by using sensors to detect and and require major investment [9]. (Source: Copperstones Properties https://
measure physical parameters, and actuators to Expectations of the populace are www.copperstones.com/dubai-is-building-
control physical processes. Control functions encouraging city leaders to improve their  the-largest-mall-in-the-world/)

37

DFM43_036-041_ Future Cities.indd 37 13/08/2020 18:44

 FEATURE ENTRY

Seven Dimensions of Cyber

Human: The human dimension of a future city needs to be considered, both from the aspect of how the human is impacted and influenced by the city platform, to how
the human impacts and influences the design and evolving nature of the city platform. Clarity is also required about who will need access to the city data and systems
and what access controls will be required (e.g. can an individual create, read, update or delete the data, and what level of control does an individual have).

Awareness and Understanding: As humans are often the weakest link in many complex systems, the level of security and privacy awareness and understanding
required by individuals who are associated with the creation, use and maintenance of city data throughout its lifecycle needs to be established, so that appropriate
policy, processes, procedures and training can be implemented.

Information and Data: For security and resilience purposes the information and data, especially sensor data, required for the city’s cyber–physical systems to function
should be understood, including the means by which it is encoded, processed and stored. The ownership and permitted uses of data, and the consequences of any data
losses, spillage or breaches needs to be understood.

Spectrum: There will be a need to understand what channels, technologies and parts of the overall spectrum, including electro-magnetic spectrum, are used to
communicate and share city data between city systems and with any users who need to access or use it.

Systems: The totality of city systems involved in creation, use, maintenance, storage and transmission of city data needs to be understood, documented and maintained to
reflect configuration changes. A consideration for both security and resilience is the extent to which the systems dedicated to a specific city or shared with other cities.

Infrastructure: Given the integrated and distributed nature of the totality of future city systems, clarity will be required of what physical and electronic infrastructure
is used to create, access, process and store city data. It is also important that any dependencies the infrastructure has on other critical services or infrastructure are
documented and understood.

Environment: There will be a need to understand the Societal, Technological, Economic, Environmental, Political, Legal, Ethical and Demographic (STEEPLED)
considerations associated with the creation, use, management and exploitation of city data, and the operation of the city’s systems.

city infrastructures. In response, some cities are to understand their network of functions, this context information [17]. To establish the
embracing the concept of the city as a platform, relationships and interdependencies. A study of resilience and cyber security requirements for a
this is a hyper-connected urban environment critical infrastructure interdependencies [16] led future city’s cyber–physical systems, the seven
that harnesses the network effects, openness, to the identification of six dimensions, which can dimensions of cyber [18], that effectively define
and agility of the real-time web [10]. To date, the be used to examine cyber–physical systems and the city’s operating environment, need to be
focus of most activity regarding the city as a the infrastructures that support them: analysed and the context understood. By using
platform has been on access to data, leading to these seven dimensions in a systematic way, a
development of smartphone apps and portals to • Type of interdependency, e.g. cyber, physical, coherent analysis methodology can be followed
allow citizens to connect with city services and logical or geographic; for any future city, in whole or in part, to properly
its institutions [11, 12]. • Environment, e.g. business, economic, public assess its safety and security needs.
These developments are not without serious policy, legal, regulatory, security, technical,
privacy and civil liberty concerns. If the city health/safety, or social/political; Cyber Security for The Future City
services are accessed via a smartphone, the • Coupling and response behaviour, The future city will be a complex environment
user may be located or tracked using either e.g. adaptive, inflexible, loose/tight or comprising a variety of technologies, existing
GPS or other location tracking functionality on linear/complex; and emerging. The cyber security approach
the device. Even if this functionality is disabled, • Infrastructure characteristics, e.g. spatial, adopted may vary considerably, depending on
anonymity is difficult to assure when the user operational, organisational or temporal; factors such as asset and systems complexity,
accesses the Internet via Wi-Fi or can be tracked • Type of failure, e.g. common cause, ownership and use. It may also be affected
due to the set-up of their browser [13]. escalating or cascading; by the supply chain supporting design,
To understand cyber security requirements for • State of operation, e.g. normal, stressed/ construction operation and occupation of
the city, we need to understand the proliferation disrupted, restoration or repair. individual assets or systems. It is thought that
of functions in this hyper-connected world [15]. applying current information security practice
Where functions in individual cyber–physical Understanding the Security Context to deliver cyber security of the city as a platform
systems interact, they will often create new A smart environment must be able to both detect will be extremely complex if not impossible. The
functions, and these will proliferate over time. the current state or context in the environment fragmented ownership of individual components
To protect these complex systems, we need and determine what actions to take based on within the platform, diverse interfaces and

38 Digital Forensics Magazine

DFM43_036-041_ Future Cities.indd 38 13/08/2020 18:44

 Parkerian Hexad
Prevent unauthorised access by individuals or systems and comply with data
Confidentiality protection legislation (or regulations).

Possession and/or Prevent unauthorised data manipulation or interference with the operation of any
Control design, manufacturing, maintenance of city systems.

Prevent unauthorised changes to city data and systems, ensure they are whole, Applying the CIA
Integrity sound and consistent with the intended state.
triad…. which is
Authenticity
Ensure authenticity of city data can be verified, including its source and change
history.
heavily used by the
information security
Availability
Ensure city systems and data are consistently accessible in an appropriate and
timely manner. community, does not
Maintain city data in a useful state throughout its lifecycle, supported by
adequately address
Utility appropriate metadata.
the safety and control
Safety
Creation and use of city data and systems shall not harm the health and safety of
individuals or the environment.
aspects of cyber–
physical systems.

constant change will all limit the effectiveness the term city data has been used, where this of the planning process a desktop utility record
of traditional control measures. term should be taken to encompass, any data, search may be conducted. The search process
Cyber security of cyber–physical systems information, models and processes that are typically involves a printed or printable report
is complicated by the real-time nature of the associated with the ownership, design and from specialist contractors in the form of a site or
systems and potential safety critical elements operation of a city asset or system. The term city location map annotated with information on the
of their functionality. Applying the CIA triad [19], systems relate to those systems used to manage presence of any third-party assets in the vicinity
i.e. Confidentiality, Integrity and Availability, or control the cyber–physical systems in a city. of the planned works, as illustrated in Figure 1. If
which is heavily used by the information Use of the seven dimensions described in the any third-party assets are identified, a more detail
security community, does not adequately previous section provides the context for any investigation of the asset locations is required, for
address the safety and control aspects of cyber security risk assessment and ongoing example through site reconnaissance, detection
cyber– physical systems. An alternative situational awareness activities. The security and/or inspection [24]. With increasing use of
approach that combines engineering good attributes identified above may then be used digital building modelling, there will be pressure
practice with information security may be as part of the coherent analysis methodology for the third-party asset data to be made more
achieved by adapting the Parkerian Hexad to examine cyber security risks and determine widely available in digital form, thus enabling it to
[20] with the addition of safety as a seventh suitable controls or countermeasures. be directly accessed by building modelling tools.
element [21]. The explicit presence of the The current approach is relatively low
possession/control, authenticity and utility Managing City Data resolution and merely indicates the presence
elements in the Parkerian Hexad address key A challenge in any city is the management of of a third-party asset, but in moving to a
topics from a control systems perspective that street works, so as to ensure safety, minimise digital representation there are a number of
may be ignored when applying the CIA triad. inconvenience and reduce risk of damage to cyber security considerations. The integrity,
To provide flexibility and accommodate underground structures (for example, third authenticity and availability of third-party asset
change, this approach addresses a set of party assets such as cables, ducts and pipes). data varies considerably. Where errors in existing
security attributes, thus allowing appropriate In the UK, legislation [22] and a supporting data sets are found during street works these
solutions to be adopted, based on the nature code of practice [23] govern the activities of are fed back, but there is a time lag between
of the cyber–physical systems and potential organisations planning and undertaking works in errors being discovered and/or new assets being
vulnerabilities. In describing the attributes, the highway. For all non-emergency work, as part installed, and this information appearing in the 

39

DFM43_036-041_ Future Cities.indd 39 13/08/2020 18:44

 FEATURE ENTRY

REFERENCES
1. Doytsher, Y., et al. (2010) "Rapid urbanization
and mega cities: The need for spatial information
manage – ment." Research study by FIG
Commission. FIG Publication No 48.
2. Zghari, A. (2013) "The cost saving benefits of
BIM". Available: http://www.thenbs.com/topics/
BIM/articles/costSaving BenefitsOfBIM.asp. Last
accessed: 30 June 2014
3. World Economic Forum (2014), "Risk and
Responsibility in a Hyperconnected World",
Geneva, Switzerland.
4. CHESS. (2013). "CHESS: Centre for Hybrid and
Embedded Software Systems". Available: http://chess.
eecs.berkeley.edu/. Last accessed: 17 April 2014.
5. Baheti, R., Gill, H. (2011). "Cyber–physical systems".
In: Samad, T. and Annaswamy, A.M. The Impact of
Control Technology. New York: IEEE Control Systems
Society. 161-166. Available: http://ieeecss.org/main/
IoCT-report. Last accessed: 17th April 2014.
6. Poovendran, R. (2010). "Cyber–physical systems:
Close encounters between two parallel worlds".
Proceedings of the IEEE. 98 (8), 1363-1366.
7. Shafi, Q. (2012). "Cyber Physical Systems
Security: A Brief Survey". In Computational Science
and Its Applications (ICCSA), 2012 12th International
Figure 1. Example of a Desktop Survey (Source: Technics Geospatial Surveyors) Conference on (pp. 146-150). IEEE.

master records. Given the poor quality of much When implementing systems to create and Managing City Systems
of the legacy data, notifiable safety incidents use city data, we need to consider the context The sophistication of building systems
regularly occur, so reliance cannot be placed on by understanding how the dimensions affect has been steadily increasing as suppliers
historical records alone. Further investigation the data and systems. Once the context is move from bespoke electronic solutions to
of third-party asset locations is prudent before understood the cyber security requirements IP networked systems that make extensive
electronic records are incorporated into a for city data and systems can be addressed use of commercial off-the-shelf hardware
building model. There are also concerns about using the attributes. For example, the users of and software. For example, the landlord’s
the confidentiality of this data, for prevention of city data need to be aware of and understand IP network may support a diverse range of
crime (for example, cable theft [25]) and attacks the limitations of the data in terms of its functionality including: access control, CCTV,
on critical infrastructure. completeness and accuracy. They need to be building management systems (HVAC), intruder
The move to the use of digital records also cognisant of data ownership issues and any alarms, escalator and elevator management
creates a risk of over reliance on what is shown legal or regulatory constraints regarding its systems, lighting control, telephony, energy
on the screen. In existing cities, the third-party creation, maintenance and use. For specific metering and management, telephony, video
asset information may be seriously incomplete. data sets there may be sensitivity regarding and data services. With this convergence,
For example, in March 2013 an auger from a access, for example the routing of critical innovations are occurring such as the use of
piling rig penetrated the roof of a Network power and communications infrastructure. CCTV security cameras as sensors for energy
Rail tunnel near Old Street station in Hackney, Policies, processes and procedures will be management purposes. The intelligent city is
London. The auger was being used to install required to manage data integrity so that likely to see a further evolution of this, with
piles for a mixed-use development on a site 13m data quality is maintained and improved systems delivering functionality and services
above the tunnel. The developer was unaware over time. There will be data utility issues to across the city. Dubai Holdings constructed one
of the tunnel as its alignment was not shown address where legacy information is being of the world’s largest malls occupying 8 million
on the site plan, or on any map available to the transferred from paper or electronic form sq. ft. connected to 100 hotels and serviced
design team, developer or the local planning into new systems. For example, concerns apartments buildings and a temperature-
authority. Subsequent investigation determined regarding granularity and precision of data controlled covered retail street network [27].
that about half of the 39 proposed piles would being converted into digital form from paper This complex could be the first real
have penetrated the tunnel. or microfilm records. intelligent city.

40 Digital Forensics Magazine

DFM43_036-041_ Future Cities.indd 40 13/08/2020 18:44

 8. Boyes, H.A. (2013) "Trustworthy cyber–physical 14. CERT-UK. (2014) "Heartbleed bug". Available: https:// 22. HM Government (1991) "New Roads and Street
systems – A review". System Safety Conference www.cert.gov.uk/resources/advisories/heartbleed – Works Act". Available: http://www.legislation.gov.uk/
incorporating the Cyber Security Conference 2013, bug/. Last accessed: 23 April 2014. ukpga/1991/22/contents. Last accessed: 7 July 2014
8th IET International, pp.1,8, 16-17 Oct. 2013. doi:10.1049/ 15. World Economic Forum. (2013). "Perspectives on a 23. DfT (2012). "Code of Practice for the Co-ordination
cp.2013.1707. Hyperconnected World". Available: http://www.weforum. of Street Works and Works for Road Purposes and
9. Institution of Civil Engineers. (2010). "The state of the org/reports/perspectives – hyperconnected-world. Last Related Matters", Fourth Ed., Department for Transport,
nation – Infrastructure 2010", London: Institution of Civil accessed: 11th July 2013.
Lon – don.
Engineers. Available: 16. Rinaldi, S.M.; Peerenboom, J.P.; Kelly, T.K., "Identifying,
http://www.ice.org.uk/Information resources/ understanding, and analysing critical infrastructure 24. BSI (2014) PAS 128:2014. "Specification for under –
Document-Library/State-of-the-Nation– interdependencies". Control Systems, IEEE, vol.21, no.6, ground utility detection, verification and location". Lon
Infrastructure-2010. Last accessed: 17 April 2014. pp.11-25, Dec 2001. doi: 10.1109/37.969131. – don. British Standards Institution.
10. Davis, P.M. (2012) "How to Rebuild the City as a 17. Dey, A.K., Abowd, G.D., and Salber, D. (2000). "A 25. Lee, D. (2013) "Dramatic drop in cop – per cable
Platform". Available: http://www.shareable.net/blog/ context-based infrastructure for smart environments." theft across the UK". Available: http://www.bbc.co.uk/
rebuilding-cities-as-platforms. Last accessed: Managing Interactions in Smart Environments. Springer news/technology-21229762. Last accessed:
17 April 2014. London. 114-128. 7 July 2014
11. Coleman, E. (2014) "The City as a Platform – Stripping 18. Isbell, R., Boyes, H., and Watson, T. (2014). "De 26. RAIB (2014) "Penetration and obstruction of a
out complexity and Making Things Happen", Available: – constructing Cyber: The Seven Dimensions of tunnel between Old Street and Essex Road stations,
http://www.emercoleman.com/2/post/2014/02/the-city Cyberspace". In preparation. London 8 March 2013". Rail Accident Investigation
– as-a-platform-stripping-out-complexity-and-making 19. Bishop, M. (2004) "Introduction to Computer Branch, Department for Transport, Derby, UK.
– things-happen.html. Last accessed: 23 April 2014. Security". Addison-Wesley Longman, Amsterdam/
.27. Dubai Holding. (2014) "Mohammed Bin Rashid
12. The Bartlett Centre for Advanced Spatial Analysis. 20. Parker, D.B. (2002) "Toward a new framework for in
(2014) "CityDashboard: London". Available: http:// – formation security." In: Bosworth, S., Kabay, M. (eds.) launches Mall of the World, a temperature –
citydashboard.org/london/. Last accessed: 23 April 2014. Computer Security Handbook, ch. 5, 4th edn. John controlled pedestrian city in Dubai". Available: http://
13. Boyes, H.A. (2013). "The Internet of Things: Data Wi – ley & Sons. www.dubaiholding.com/media-centre/press –
collection and its impact on your privacy". Journal 21. Boyes, H. A. (2014) "Cyber security attributes for releases/2014/407-mohammed-bin-rashid-launches
of Information Technology Management, Cutter critical infrastructure systems", Cyber Security Review, – mall-of-the-world-a-temperature-controlled-
Consortium. Arlington, MA, USA. Summer 2014, pp 47-51, Delta Business Media, Lon – don. pedestrian-city-in-dubai. Last accessed: 7 July 2014

A temperature-controlled development on this Conclusions

scale will require sophisticated control systems Given the direction of current technology
with a high degree of resilience. Cyber security developments and the need to achieve
will be a critical issue for this development, competitiveness, future cities are going
the failure or compromise of the environmental to be complex intelligent environments. The
management systems during the summer could increased collection and use of city data to
be catastrophic for the thousands of visitors and enable automation of support functions is
workers that could be inside in the heat of the not without issues given the state of the
day. This proposed world mall is intended to be data on legacy systems and infrastructure.
a major tourist attraction, serving both the Gulf This will have a significant impact on those
region and the wider international community, who are required to investigate criminal or
making it a significant target for both criminals safety related crimes. Digital Forensics in this
and terrorists. context will require skills and knowledge not Hugh Boyes is a Chartered
Again, by understanding the context, the yet fully understood. Engineer, a Fellow of the
nature of the risks and potential vulnerabilities Addressing the cyber security of the Institution of Engineering
can be assessed. In this case there are likely intelligent city infrastructure is not just about and Technology (IET)
to be significant systems and spectrum issues imposing access control. It is potentially an and holds the Certified
that will need to be addressed. Assuming that enabling and supporting activity that concerns Information Systems Security Professional
this is potentially an entirely new development, the design, implementation and operation of (CISSP) credential. He divides his time between
the ’city’ infrastructure may be designed from both systems and their associated processes. working as a Principal Engineer at the University
scratch and may operate as a fully integrated By understanding the context of city systems of Warwick and undertaking cyber security
platform. However, there will be a significant and then considering the seven aspects, consultancy assignments as a leading industry
issue regarding the rate at which some system owners, designers and operators get expert on cyber threats in the built environment.
elements will become technically obsolescent a comprehensive and systematic view of the He is the author of a number of BSI PAS
and therefore require replacement to maintain requirements that a system and any associated security-related documents covering the built
systems integrity. processes must fulfil. • environment, smart cities and manufacturing.

41

DFM43_036-041_ Future Cities.indd 41 13/08/2020 18:44

 GET INVOLVED

GET Involved
Calling all Book Reviewers, Product Reviewers, Bloggers and Evangelists!

MORE THAN A MAG Book Reviewers Forensic researchers, investigators or even

Digital Forensics Magazine is always As we see the increasing and innovative those with just an interest in the subject to join
on the look out for new talent and content use of technology, the need to secure and our growing band of regular contributors to the
and as the number one magazine for all investigate said technology is increasing. blog site to provide interesting and stimulating
matters Digital Forensics we are looking As a result we see an increasing number of content. The content can be wacky as well as
to expand our list of contributors. books being published that require review and serious, however it must be related in some
If you feel that you have something to comment. Working with the leading publishers way to Digital Forensics and will be checked
contribute to the magazine in one of Digital Forensics Magazine obtains these and edited prior to publication. If you would like
the following categories, contact us via books to allow us to review and comment to become a regular contributor to the Digital
[email protected] on. These reviews are then covered in the Forensics Magazine blog then contact us at
and join the ever-growing team of magazine and carried on the DFM Blog. [email protected]
international contributors who are Once selected you will be sent a list of
leading the discussions. books available for review, you then Evangelists
choose a title that you like and we will Digital Forensics Magazine is a global
Authors send you the book. You read the book and publication printed in English and distributed
If you have an idea for an article, which you then fill out a review form to be sent back to over 40 countries including those in South
would like to discuss, or if you want to become to DFM. If you would like to become a book Africa, South America, Australasia, Eastern
a regular contributor, we want to hear from you. reviewer for Digital Forensics Magazine contact Europe as well as in the UK and USA. The cost
The field of Digital Forensics is vast and with the us at [email protected] of promotion to such a large audience in all
ever-increasing use of technology in so many with a CV to demonstrate that you have the of these geographical areas is beyond the
aspects of daily life, not previously envisaged, required knowledge and experience to be a budgets of the magazine, so we are on the
the need for the Digital Forensic investigator book reviewer. look out for evangelists; those people who
to go beyond the hard disk and the mobile believe passionately about Digital Forensics
phone requires new tools and techniques. Product Reviewers and are active in their own communities.
If you are involved in Digital Forensics or Digital Forensics Magazine regularly carries DFM Evangelists receive discount vouchers to
related research, developing new tools to articles on various supporting investigative pass onto their communities as well as having
solve a particular problem (especially new technologies and we have a number of direct access to the marketing team at DFM
technology), a learning experience from a companies that have asked us if we would who will help them promote Digital Forensics
case study or just want to share your ideas consider reviewing their products. This is related conferences, events and activities in
and thoughts we would like to hear from you. not a rubber stamping exercise, this is an their region. If you are interested in becoming a
It does not matter if you have not written in-depth review looking at aspects such as Digital Forensics Magazine Evangelist contact
before; we will work with you to craft your idea ease of installation, ease of use, information us at [email protected].
into a publishable article using our team of gained, usefulness of the product, supporting Digital Forensics Magazine prides itself
experienced authors and editors. Email us documentation etc. To become a product on not just being a magazine, but also for
at [email protected] or reviewer you will need to be a suitably being a source of quality, valuable, and useful
submit your article idea via the website: qualified Digital Forensics Investigator who information for the Digital Forensics Profession.
www.digitalforensicsmagazine.com has knowledge of the disciplines in which Our goal is to bridge the gap between the
In future issues we will be tackling issues the technology operates. Send your CV to academic journal and the traditional magazine.
such as wearable technology, prosthetics, [email protected] and tell We want to hear from you on what is good or
forensics of the DarkNet, Analysis of Operating us why you believe you have the credentials bad as well as what you would like us to include
Systems, Analysing the unusual tablets, to become a product reviewer. so please provide your comments to us via
Cloud Forensics, Real Time Operating System [email protected] and if you
Forensics, Modern Game Console Analysis Bloggers want to get involved in one of the activities
along with training and certification; so if you The Digital Forensics Magazine blog is an outlined we would welcome you to the growing
have an idea for an article; Get Involved and outlet for news, commentary, ideas and even band of professionals who contribute to the
contact Digital Forensics Magazine. the occasional rant. We are looking for Digital growth of the magazine.

42 Digital Forensics Magazine

DFM43_042_Get Involved.indd 42 13/08/2020 18:44

 NEXT ISSUE

NEXT Issue
Continuing our aim of bringing you new and interesting articles from the world of Digital Forensics,
Issue 44 is shaping up to be another good mix of research and practical advice, so here is a taste
of some of the articles being considered.

With or Without Consent: Is Digital Forensics in The Cloud a Crime?

This paper attempts to answer this urgent question, as the 43 Police Forces
of England and Wales have expressed their uncertainty over the legality of
some of their actions which can result in the potential criminal liability of
digital forensics investigators.

Forensic Readiness
An increasing number of criminal actions are inflicting financial and
brand damage to organizations around the globe. A large number of such
cases do not reach the courts, mainly because of organizations' inefficiency
to produce robust digital evidences that are acceptable in the courts of law.

Using Error-Patterns for Attribution

Corpus Linguistics within Second Language Acquisition has developed models
of error patterns made by defined groups of second language learners. This
knowledge base can be leveraged by a knowledgeable analyst to attribute
content to a subset of authors.

Fraudulent Use of Digital Images and Detection Survey

This article looks at the basic concepts related to image forgery; the types,
detection procedure algorithms and all possible techniques to detect
malicious signatures, including a comparative analysis based on forgery
types and detection techniques.

Recovery of Forensic Artefacts from Deleted Jump-List in Windows 10

Jump-Lists have been widely discussed in the digital forensics’ community
since the release of Windows 7 and are having more capabilities to reveal
forensics artefacts in Windows 10. The records maintained by Jump-Lists
have the potential to provide the forensic investigator a rich source of
evidences about a user’s historic activity.

Together We Are Better

This feature article is all about how technology has transformed the way
investigations are conducted today, including the unique challenges that
are now faced by experts in both the public and private sectors.

IoT Crime Scenes

IoT and SmartHome devices are in nearly every private household. These
devices interact with the surrounding digital and real world. For forensic
units it is important to identify those devices in order to save and acquire
any evidence. This article builds a new model for the IoT-Crime-scene and
discusses a device for first-responders.

Note: We may change the planned content of future issues without notice;
inclusion here does not guarantee publication in the subsequent issue.

43

DFM43_043_Next Issue.indd 43 13/08/2020 18:45

 FEATURE ENTRY

The Future Direction

of CYBERCRIME
and the Difficulties
of DIGITAL
INVESTIGATIONS
Gareth Davies provides a rationale for a review of Digital Investigation specialist education.

T
he Context for this article is the law to the demonstrable professionalisation of the acceptance that services, applications
of England and Wales. Historically, digital forensics investigation, and by digital and storage are virtual, potentially limitless,
admissibility of evidence resulting forensics investigators, knowledge that potential remote from the individual user's location,
from digital forensics has been seen jurisdictional, international law and Conflicts of ready to be accessed on tap, has contributed
as a major element in the failure of law, issues permeate all investigations. to an increasing need for a new type of digital
successful prosecution of cybercrimes and The article questions if current training offers investigators, forensic or otherwise, as
computer enabled crimes (UNODC, 2016). Having suitable approaches for the training of future organised crime groups, criminal individuals,
identified the common law relating to improperly digital forensics investigators. The hypothesis nation states and terrorists follow, and in some
obtained evidence and its admissibility, the is that specialist education must change to cases lead, the trend. These investigations
search for the real reasons for such failures keep pace with developments and usage may be exacerbated for digital investigators by
revealed that the struggle between individual as exemplified by the rapid growth in digital devices syncing with IoT devices on a seemingly
right to privacy – v – investigatory access to service provision. random basis; the information an investigator is
digital information, jurisdiction, standardisation The nature of crime and terrorism in looking for may be held anywhere.
of methods, reproducibility, reliability of findings cyberspace, the methods of investigation of The hypothesis presented is that it is
of digital forensics investigators and the lack of same, and intelligence gathering are changing possible to divide the class of investigator
awareness among digital forensic practitioners radically. The provision of digital services needed for a particular crime according to the
of their place and responsibilities in the criminal has fuelled a mass movement away from ‘business’ operational characteristics of the
justice system have major interlocking roles. the localisation of data held and processed perpetrators. Naturally, there may be hybrid
As such, when examining data traces in the in desktop computers and laptops with ever operations, thus exposure to a number of crime
Cloud, consideration must be given to the way increasing capacity hard drives. The provision classes becomes necessary during education,
the Cloud is owned, controlled, and regulated and availability of high broadband speeds, the permitting the investigator to specialise in the
by companies and governments, by judges, norm of app usage, identity obfuscators, and latter part of the course.

44 Digital Forensics Magazine

DFM43_044-051_ Future of Cybercrime.indd 44 13/08/2020 18:42

 Digital investigations in the real world with one police force representative, it transpired The investigator skill set required for
The characteristics of information systems that, although in nearly every crime there was traditional crime includes an understanding
and devices are dictated by the way business an associated digital device which was required of how the crime might be carried out.
is affected. The Locard exchange principle to be investigated, 85% of investigators’ time The investigational aspect involves an
indicating that one cannot be in a place without was spent on investigating indecent images of understanding of the operational model and
leaving a trace, and that place will also leave children (IIOC), where the investigative imperative discovering the matching artefacts to support
its own trace, underpins forensic science. was to identify the victims and stop the abuse; it, without being so directed that exculpatory
This is even more relevant in the time of the the emphasis was not on prosecution. evidence was missed, and that bias or
Internet of Things (IoT). Technologically, traditional crime is preconceptions obscures other possibilities.
usually a fairly static operation, involving There is a danger that such individual
Traditional crime use of the Cloud, often without the knowledge entrepreneurs may become enmeshed with
Not all digital crime is cybercrime. Computer- or consideration of the user, deriving from the organised crime groups who are looking to
enabled crime is an instance where economies use of apps. The rewards to the individual may outsource aspects of their business. It is arguable
of scale can be achieved by means of digital vary from low to extremely high, depending that the County Lines drug operation, in which
technology. Taking the England and Wales on the product, service, market demand or children are trafficked to sell drugs throughout the
police forces as an example, they are tasked energy of the entrepreneur, but the identifying country, may be a subcontract operational model
with investigating traditional, volume crimes characteristic is the organisational and of a larger group looking to distance themselves
of murder, vehicle crimes, and theft. operational base. from a distribution network. 
Seemingly networking is ubiquitous, and the
general population may not be as in control of
their digital devices as they believe. Prioritisation
The general population may not be as in
of investigation must take place. In discussion control of their digital devices as they believe.
45

DFM43_044-051_ Future of Cybercrime.indd 45 13/08/2020 18:42

 FEATURE ENTRY

Some ‘sub-contractors’ can lose their disruptors to other business lines, the future What is Cybercrime?
independence as operators and become for OCG is not as certain as it once was. There Cybercrime is broken down by the Home
coerced or compelled into continuing action. is discussion of partnerships being formed Office into two forms: ‘pure cybercrime’ and
Examples of individuals becoming enmeshed between establishment OCG and 3rd world. ‘cyber enabled’.
with organised crime may be represented by (Burbank, 2018).
wittingly or unwittingly in a supply chain, e.g. OCG investigation entails international • Pure cybercrime: These are crimes where
distribution of fake pharmaceuticals or hiring cooperation (Eurojust, 2019). The imperative a digital system is targeted by means
of a small haulage business or individual driver in this type of crime is to 'follow the money'. of a criminal attack. These attacks are
for movement of a cargo for a single leg of a Organised crime groups are long term designed to disrupt IT infrastructure,
journey. Having become involved once, it may investors in established businesses. The aim remove data and/or compromise the
not be possible to refuse further contracts. of investigators may be limited to inflicting integrity of data. An example of this could
There may not be continuing criminal economic damage on a part of their business. be having your Facebook or online banking
intention. A compelled sub-contractor may (Eurojust, 2018) (FBI, n.d.). account hacked for malicious means.
remain silent through fear, and if willing to Cloud usage is anticipated to be private with • Cyber enabled: Existing crimes are
provide any information, may give rise to a hosting of associated groupings as necessary. perpetrated through the use of the
substantial protection cost. The lack of a The IT structure is that of a typical large-scale internet. An example of this could be
willingness to bear a protection cost will business. The OCG will use experts in their someone being emailed a cyber scam
negate trust in law enforcement. fields, effect risk assessments and business asking for money.
continuity plan and employ encryption as a
Organised Crime Groups norm. The infrastructure may be fairly static (Source: Nottinghamshire Police – https://
Organised Crime Groups (OCG) present as a and thus traceable. With the development of www.nottinghamshire.police.uk/faqs/what-
comparatively known quantity and mode of technology, mobility of systems is a reality and cyber-crime)
operation; they are multinational organisations, identification of the location is imperative.
availing themselves of IT personnel and Much of the type of training required for the
sophisticated technology in the manner of any investigation of OCGs is found among Forensic
of the Fortune 500. Their mode of investigation Accountants as evidenced by investigation of
is well established having both a financial and a money laundering and tax evasion programs.
communications aspect. Investigations by Her Majesty’s Revenue and
The communication across groups, as Customs (HMRC) date back in style to Al Capone.
revealed by societal networking research, They may also involve the investigation of the
is rare at other than the top of the hierarchy creation and use of tax avoidance schemes and
where it is high value and uncommon, and at shell companies. These complex investigations
the bottom where the group interacts with require knowledge of: international law, tax
the market for its services, and there is a treaties, company formation tracking of data
degree of acceptable expendability. Middle location, identification of societal networks,
level members of the OCG rarely have business data science and analytics techniques.
communications traversing the boundaries
of the organization and thus, as enabling
functionaries, they have a high level of
protection.
It is worth noting the scale of operation
of Organised Crime Group which in 2018 was
estimated globally to be $600 billion or 0.8%
GDP. This is up from the 2014 figures of $328
billion and 0.5% of GDP. The top 20 to 30 OCG
act on a nation state level. (McAfee LLC, 2018)
The annual revenues of the five largest crime
groups in the world as at 2014 were $27.4 billion
(Matthews, 2014) whilst total law enforcement
spend for Interpol, Europol, FBI, England and
Wales was $17.375 billion (Interpol, 2014),
(Europol, 2014), (Full Fact, 2014), (US Dept
of Justice, 2014)
Legalisation of some drugs represents
a diminution in OCG business and with the
rise of Crime as a Service, groups acting as

46 Digital Forensics Magazine

DFM43_044-051_ Future of Cybercrime.indd 46 13/08/2020 18:42

 Characteristic OCG CraaS

Comparative Model Standing Army Guerrilla Army

Strategic view Long Term Short term

Flexibility/Speed of change Static Dynamic

Hierarchy Structured Entrepreneurial – flat

Employee base Large Small

Technology use Traditional Innovative

Disruptor Borders Amazon

Business Vertically integrated supply chain Data driven (Exploitation of technology requiring initial malware)

Table 1. Comparison of the characteristics of OCG v CraaS

Domestic law cannot legitimise an

investigator’s transgressions in a foreign
jurisdiction; neither can it compel a third
party in a foreign jurisdiction to break his
domestic law or breach his Constitution.
OCG v Crime as a Service CraaS is likely to present as an unknown
Cybercrime as a Service (CraaS) is a disruptor and potentially unique investigation in every
to OCG. For a disruptor, consider traditional case. On examination there may be a common
retailers who failed to innovate and lost market mode of operation for a particular series of
share to out of town big box stores, who in their crime, indicating a successful sales campaign
turn failed to innovate from bricks and mortar to by the CraaS group to multiple other criminal
the on-line environment and failed to consider groups.
pop-up stores. A disruptor in any market can
cause surprising and catastrophic failures Crime as a Service
among established regimes. Traditional organised crime groups may
The original model for CraaS was that of lose business to CraaS disruptors, or they
a prime contractor, where a business is set may choose to innovate, a survival tactic,
up for a specific task or contract, typically in particular areas or outsource the relevant
by a small, cohesive, anarchic, technically crimes, currently perceived as mainly
sophisticated group with complementary skills. financially motivated and based, to CraaS as
The prime contractor/entrepreneur/group of a partner/prime contractor. The ability of OCGs
entrepreneurs outsourced or employed the skill to enforce CraaS contracts and agreements
sets they needed on a quasi-contractual, short may be limited due to the structure and
term basis, to do specific tasks. organisation of the CraaS groups. The very
In the manner of terrorist cells, skill set, anonymity and transience of the
pseudonymous contractors, may never meet CraaS grouping are likely to be their protection.
or connect to anyone other than the hiring The identification of the characteristics of
function, which is often from the dark web. CraaS or entrepreneurial crime groups are
The contractor is unaware of the context of determined from the way they carry out their
the task. The gig economy has arrived in the business. Modes of operation were determined
dark web. from the examination of eDedix, Avalanche
As an evolution of the prime contractor and GozNym crimes, it should be noted that
model, current CraaS is the development of a reports of these are public domain, thus the
method for execution of a crime which, rather current mode of operation may have evolved
than being executed by the developers, is sold further. The model for CraaS has similarities
as a product. The sale model may be absolute, with cyberwarfare and terrorism. Future serious
commissioned, franchised or licence based, cybercrime is likely to be based on an initial
and hence as a Service. hacking event. 

47

DFM43_044-051_ Future of Cybercrime.indd 47 13/08/2020 18:42

 FEATURE ENTRY

Cybercrime, The Need for International brought in Georgia, Moldova Ukraine and the DECAMP
Cooperation and Specialist Investigatory United States. (Bank Info Security, 2019) (Europol, DECAMP stands for Open Distributed
Teams 2019). The mindsets of digital investigators and European Virtual CAMPus and has been set
The emergence of cybercrime as a major force digital forensic investigators are demonstrably up for the purpose of delivering specialist
has caused Law Enforcement Agencies such different in this example. courses focused on ICT Security. DECAMP is
as the FBI to acknowledge that they must rely 'Avalanche', the hosting service used by the a unique and unprecedented international
increasingly on international collaboration, GozNym was itself a specialist criminal hosting strategic partnership between six EU IT
bi-lateral treaties, informal agreements, and company, reputedly bullet proof, operated by faculties of well-known universities in
the private sector. Including the statement: a key group comprising of 5 people, utilising Finland, Germany, Italy, Romania, Spain and
approximately 39 servers. It also specialised the UK. DECAMP has been specially created
Eurojust states: in the deployment of botnets, malware and for you. Tuition-free with 6 recognized ECTS!
The very nature of cyberspace means ransomware. It was taken down during 2016. The aims of this strategic international
that cybercrime is borderless. Consequently, (Eurojust, 2016) DECAMP partnership are:
international measures are required to address
the current challenges. (Eurojust, 2019) What is The Cloud and Who Owns It? • to enhance the quality and relevance of
The Cloud is, now, too specific a term that the learning offer in ICT security in our six
Cybercrime often requires an active initial should be expanded to Digital Service Providers EU strategic partner universities,
event by the perpetrators which establishes (DSP). Statistics show that there has been a • to increase EU student’s ICT security skills
a forward base for subsequent actions. technological revolution resulting in the move and cross-border collaboration by virtual
Tracing the source is an imperative. For digital from traditional models of computing to Cloud “green mobility”,
investigators, the potential mobility of users based computing, apps and IoT. Currently, • to foster each, DECAMP partner’s
and their data across multiple digital service investigation of the Cloud is taught, and internationalisation strategy.
providers on a rotating basis, renders time of forward-thinking Course Leaders already have
the essence in acquisition of location and included later technological developments in (Source: https://mydecamp.eu/)
data for examination. their teaching. The very nature of DSP presents
The skill set required for the investigation investigatory problems to digital investigators.
of cybercrime is primarily based around When speed is of the essence, unknown
identification of the crime, locating the digital structures and responsibilities are like
original source, the executing source, and a brick wall. Such is the Cloud. Discovery, or
incident response rather than digital forensic application for information, rejection, and
investigation per se. Only when the primary lengthy fulfilment times delay the onset of
servers are located can any traditional digital the investigation proper. In cases where there
investigation take place, other than on a is risk to life, it is not surprising that digital
victim’s device. It would appear that there is a investigators sometimes act prematurely, thus
great overlap between training of penetration commit crimes in the race to assist a victim. For
testers/hackers, and the exponents of CraaS, the criminal, the Cloud can represent a dense
an understanding of whose psychology layer of obfuscation which provides the luxury
is required as much as the traditional of time.
investigative training. Rarely are the organisations and
infrastructure underpinning the Cloud and
Recent-ish Examples service offerings documented sufficiently
If the example of GozNym is taken, the nature to permit a speedy, legally appropriate
of law enforcement and investigation in application, in the right jurisdiction, and to
cyberspace becomes apparent. Arguably, the the right organisation which has access
digital expertise required needs to reside in the to the information required. That the Cloud
investigatory team. infrastructure may be comprised of additional
GozNym, an operation created by 10 people, sub-contractors, who themselves sub-contract
resulted in $100m theft from banks. The CraaS is not discernible from the service offering
organisation behaved as a prime contractor, documentation. Unless there is experience of
buying in the services it needed: running a particular service offering, the starting point
money mule networks, spammers, coders, can be guesswork, along the lines of ‘who owns
and organisational and technical support. The it?’, ‘where are they located?’, ‘where do they
investigation involved international cooperation operate?’, ‘what information do they hold?’,
from six Law Enforcement Agencies, Europol, ‘who do I need to contact?’, ‘what paperwork
and Eurojust. Searches were made in Bulgaria, do I need to put in place?, and ‘who needs to
Georgia, Moldova and Ukraine, and prosecutions sign the paperwork?’.

48 Digital Forensics Magazine

DFM43_044-051_ Future of Cybercrime.indd 48 13/08/2020 18:42

 Legal Education for Digital Investigators Evidence – v – Intelligence Consent: The Legal Definition
Much more legal education for digital To define the distinction between evidence To get a better understanding of consent
investigators is required. The need for and intelligence, it is necessary to consider the under the GDPR, let’s first look at the
legal education applies equally to digital different modes of operation between the digital definition laid out in Article 4:
investigators and digital forensic investigators. investigator and the digital forensic investigator
The bounds of what is technically possible far and to recognise their differing imperatives. With “‘consent’ of the data subject (user)
outstrip the bounds of what is legal. an increase in cybercrime and CraaS, it is likely means any freely given, specific, informed
that intelligence will be the output of on-going and unambiguous indication of the data
Lawful Authority digital investigatory teams. That intelligence subject’s wishes by which he or she, by a
In England and Wales, the police operate would act as circumstantial evidence to inform statement or by a clear affirmative action,
according to the doctrine of ultra vires. Simply other, traditional investigators. signifies agreement to the processing of
put, if there is not a piece of legislation which personal data relating to him or her”
permits what they are doing, legally, they The Digital Investigator
cannot do it. Having lawful authority, the police A digital investigator may act under the (Source: Termly – https://termly.io/resources/
may authorize digital investigators. If the police pressure of time and not adhere to such rigour articles/gdpr-consent-examples/)
do not have lawful authority an investigator as is demanded by the criminal justice system
following through on a received instruction for formal presentation of his findings in Court.
commits a criminal offence under the Computer Much of what is found may be circumstantial.
Misuse Act 1990 (HMG, 1990). The difficulty of attribution of activity to a
specific end user remains. For the purposes of
Jurisdiction the investigation, attribution may be assumed.
Most of what an investigator will be instructed Much of a digital investigator’s talent may
to effect will carry lawful authority and be legal, be employed in international investigations. In
domestically in England and Wales, but where consideration of that, it is well to consider the
apps and the Cloud are involved, transborder job specifications and requirements applicable
issues arise and international cooperation must to potential colleagues, as although they
be sought and obtained. It is irrelevant what may have the same job title in translation,
domestic legislation purports to permit and empowerments may vary.
render legal. No statute, by itself, can authorize
illegal actions in a foreign jurisdiction. A digital The Digital Forensic Investigator
investigator may become criminally liable As with the digital investigator, additional
before even being aware of the transborder concerns arise in an international investigation.
nature of his investigation. Not only may empowerment be different, but
There is current discussion that processes and Standard Operating Procedures
investigation may be legal when limited may be regulated by International Standards
to local data on a device at hand. That which it is intended enable free transfer of
examination may be legal. Consideration of evidence without the need for re-examination to
syncing devices, without the express consent comply with domestic jurisdiction requirements.
of the owners of the device and account This compliance may not be achieved by the
holders, may represent a criminal action in a use of Standard Operating Procedures carried
foreign jurisdiction. It is well to note that many out against different International Standards in
countries consider access without consent a different jurisdiction, even though such rigour
of the device owner or account holder to be may render outputs admissible as evidence in
unauthorised and thus a criminal act. the domestic jurisdiction. 

Evidence
Statistically, the greatest reason for failure of Most of what an investigator will be
any investigation into any digital crime rests instructed to effect will carry lawful
with inadmissibility of evidence, followed by
difficulties in confirmation of attribution. These
authority and be legal, domestically in
are areas that would benefit from greater England and Wales, but where apps and
emphasis in Digital Investigation courses. It is
possible that there is some reluctance within
the Cloud are involved, transborder issues
the criminal justice system to recognize the arise and international cooperation must
professionalism of investigators practicing
what is perceived to be an arcane art form.
be sought and obtained.

49

DFM43_044-051_ Future of Cybercrime.indd 49 13/08/2020 18:42

 FEATURE ENTRY

Law Enforcement v Privacy Digital investigators must be self-monitoring,

People frequently give their personal data able to distinguish their permissible technical
freely to unknown organisations on the internet. capabilities up to the boundaries of the legal
Those organisations should have privacy and recognise their potential for criminal
policies, but these important documents which liability. Such boundaries may be stretched but
advise what the organisation can and may should never be compromised in the search for
do with that information go largely unread as international cybercriminals or cyber terrorists
the user ticks a box to obtain the functionality if there is to be a successful prosecution.
required. After much consideration, the Data Investigators are bound by rules which do not
Protection Act 2018 (DPA, 2018), based on constrain the behaviour or actions of criminals.
the principles of informed consent, sought Although cybercrime is largely a product of
to control what organisations could do with OCG and CraaS, the two need very different
personal information and the penalties for its approaches and mind sets. Cyberterrorism
misuse and abuse. would seem closely related to CraaS.
From the law enforcement perspective, The OCG investigatory approach is a serious
the Data Protection Act (ibid) applies equally. fraud/money laundering approach which identified in the majority of those committing
Additional statutes also apply to items and can be lengthy, structured, and demonstrate juvenile computer abuse offences.
data under investigation. a requires concentration of knowledge on Outreach programmes, talent spotting school
anti-forensics and the high level of security children is underway. Tarian, the Southern
The effects of Human Rights Articles on employed by perpetrators. Wales Regional Organised Crime Unit, operate a
Forced Consent The CraaS investigatory approach owes more Prevent programme, through which they hope
In England and Wales, legislation has to hacking, can be short term, has sometimes, to prevent juvenile criminal offending by those
attempted to simplify gaining access to devices scant regard for territorial boundaries, and with over-enthusiastic curiosity about what is
and systems during a criminal investigation. an imaginative approach to tracking down possible with a computer, turning that curiosity
Unfortunately, the law of unintended perpetrators. The investigators may become to good purpose.
consequences applies. adept at recognising signatures, thus There is, however, a continuing problem
Criminal law is vested in the presumption attribution of CraaS to particular groupings. in the digital investigation sphere. It is a time
of innocence. Failure to provide information in Final year degree courses may present a sensitive, results-based profession. Some UK
response to a production order or disclosure range of options related to the specialisms graduates have identified difficulty in gaining
requirement finds, without requirement for required, which in themselves may change their first employment without experience.
proof, the person who is being questioned, to over time. Degree and/or other apprenticeships The investigation system tends to cycle its
be guilty of a second and unconnected offence. could be considered. employees almost as a closed user group rather
The action of demanding answers With the potential increase in international than increase its pool from an available, qualified
under threat of automatic conviction of cooperation, courses may be designed which but semi-trained population. Organisations
an unconnected offence may amount to operate in the manner of International MBAs. must accept an element of in-service training.
oppression by the State, akin to the description This elite may be taught from a virtual campus In demanding qualifications and specific
in Article 3 Human Rights Act 1998 (HRA, 1998). via collaborating and cooperating experts in experience from applicants, the industry is its
The person provides the information under their fields, drawn from several universities, an own worst enemy in the maintenance of skills
duress. This is not a purely academic argument. example of which is Decamp – Open Distributed shortages, and one must ask whether it is not
There is precedent (Emmerson & Ashworth A, European Campus (Decamp, 2018), initially part- from economic self-interest.
2001) 15-92 citing Heaney and McGuiness v funded by the EU Erasmus+ programme. On-
Ireland. Injudicious use of the forced disclosure going professional development and research Conclusion
clauses may render international cooperation are required to ensure that investigators remain There are numerous choke points, a collection
problematic. current in their skills and knowledge. of interlocking factors related to the acquisition
Those with lesser academic ambitions, but of data that include: the specific creation of
Where Should Digital Investigation demonstrable skills should not be discouraged offences complete with considered lawful
Education Go? from participation. It should be recognised authority clauses, legislation granting powers
Digital investigation has become a discipline that some students who have the appropriate of investigation, location of the crime, location
wherein technically aware problem solvers aptitude or mind set may not wish to undertake of the consequences of the crime, identification
who, having received an investigatory examinations. Having completed the practical of relevant criminal legislation, identification of
instruction, promptly attempt to find what courses necessary and demonstrated their perpetrators, location of perpetrators, location of
has been asked of them and present their capability and competence they could, if any infrastructure, determination of jurisdiction,
findings coherently, are highly prized. Such mentored, exhibit the same professionalism international cooperation, contention between an
capability and competence are rare talents as their examined colleagues. Among these investigator's needs and a user’s privacy, Human
in an occupation with a currently high and students may be a cadre of those who exhibit Rights Conventions, foreign jurisdictions’ laws
increasing demand for its skills. autistic-like syndromes which researchers have and/or Constitutions….. Many are bureaucratic,

50 Digital Forensics Magazine

DFM43_044-051_ Future of Cybercrime.indd 50 13/08/2020 18:42

 REFERENCES
1. Bank Info Security, 2019. FBI and Europol Disrupt
GozNym Malware Attack Network. [Online]
Available at: ttps://www.bankinfosecurity.com/
fbi-europol-disrupt-goznym-malware-attack-
network-a-12493 [Accessed 10 August 2019].
2. Burbank, J., 2018. The World's top five
mob bosses. [Online] Available at: https://
themobmuseum.org/blog/worlds-top-five-mob-
bosses/ [Accessed 11 August 2019].
3. CMA, 1990. Computer Misuse Act. London:
Her Majesty's Government.
4. Decamp, 2018. Decamp. [Online] Available at:
mydecamp.eu/partner-universities/
[Accessed 12 February 2020].
5. DPA, 2018. Data Protection Act. London:
Her Majesty's Government.
6. Emmerson, B. Q. & Ashworth A, Q., 2001.
Human Rights and Criminal Justice. 1st ed.
London: Sweet and Maxwell.
7. Eurojust, 2016. 'Avalanche' dismantled in
international cyber operation. [Online]
Available at: http://www.eurojust.europa.eu/press/
PressReleases/Pages/2016/2016-12-01.aspx
[Accessed 10 August 2019].

Networking across
but nonetheless, necessary to ensure both the 8. Eurojust, 2018. Coordinated Crackdown on
'Ndanghetta Mafia in Europe. [Online]
avoidance of criminal liability for the investigator Available at: http://eurojust.europa.eu/press/
and ultimately the admissibility of evidence. borders should be PressReleases/Pages/2018/2018-12-05b.aspx
[Accessed 10 August 2019].

encouraged and
9. Eurojust, 2019. Euto 24 Million cryptocurrency
In seeking international cooperation, there theft unravelled with Eurojust support. [Online]
are issues concerning the conflict of laws, Available at: http://eurojust.europa.eu/press/

knowledge of international law, local law periods of time PressReleases/Pages/2019/2019-07-05.aspx

[Accessed 10 August 2019].
and constitutional law of relevant within a
in international 10. Eurojust, 2019. Setting the scene on cybercrime:
trends and new challenges. [Online]
Available at: http://www.eurojust.europa.eu/press/
organisations,
foreign jurisdiction. A particular issue relates
PressReleases/Pages/2019/2019-07-05.aspx
to the structure and location of the elements [Accessed 10 August 2019].
which underpin a digital service provision. such as Interpol and 11. uropol, 2014. [Online]
Available at: https://www.europol.europa.eu/
publications-documents/europol-budge..t
Much time may be spent requesting, from
the wrong entity, information they do not hold.
Europol, supported. [Accessed 29 November 2019].
12. Europol, 2019. GozNym malware:Cybercriminal
network dismantled in international operation. [Online]
A detailed knowledge of the DSP would enable Available at: https://www.europol.europa.eu/
the consideration of applications to be made in newsroom/news/goznym-malware-cybercriminal-
network-dismantled-in-international-operation
more cooperative jurisdictions. [Accessed 25 July 2019].
13. FAS, 2000. Chapter V Future of International
Domestic law cannot legitimise an Crime [Online] Available at: https://fas.org/irp/threat/
pub45270chap5.html [Accessed 10 Auguest 2019].
investigator’s transgressions in a foreign 14. Full Fact, 2014. Police funding in England and
jurisdiction; neither can it compel a third party in Wales. [Online] Available at: https://fullfact.org/
crime/police-funding-england-and-wales/
a foreign jurisdiction to break his domestic law [Accessed 29 November 2019].
15. HRA, 1998. Human Rights Act. London:
or breach his Constitution. An appreciation of Her Majesty's Government.
this is particularly relevant with respect to digital 16. Interpol, 2014. Our Funding. [Online]
Available at: https://www.interpol.int/Who-we-are/
service providers, many of whom are based in Our-funding [Accessed 29 November 2019].
17. Matthews, C., 2014. Fortune 5: Biggest organised
the United States, and who have both legal and crime groups in the world. [Online]
Constitutional constraints on their actions. Available at: https://fortune.com/2014/09/14/
biggest-organized-crime-groups-in-the-world/
With a necessary increase in international [Accessed 11 August 2019].
18. McAfee LLC, 2018. The economic impact
cooperative investigations, cultural sensitivities of cybercrime – no slowing down. [Online]
should be respected, and lessons learned. Available at: https://www.mcafee.com/enterprise/
en-us/assets/executive-summaries/es-economic-
Networking across borders should be impact-cybercrime.pdf [Accessed 12 February 2020].
19. UNODC, 2014. Five Largest Organised Crime
encouraged and periods of time in international Gareth Davies is registered Groups. [Online]
organisations, such as Interpol and Europol, as an expert in forensic data Available at: http://fortune.com/2014/09/14/biggest-
organized-crime-groups-in-the-world/
supported. Common International standards recovery on the National [Accessed 17 December 2018].
20. UNODC, 2016. Lessons learned UK. [Online]
for the transfer of information and evidence Crime Agency expert Available at: https://sherloc.unodc.org/cld/lessons-
learned/gbr/most_common_legal_and_practical_
should be developed to avoid the repetition of database and specialises in obstacles_to_the_successful_prosecution_of_
investigation in order to comply with domestic advanced data recovery and bespoke system cybercrime_acts.html?&tmpl=cyb
[Accessed 7 July 2019].
forensic requirements. forensics. As Chairman of The First Forensic 21. US Dept of Justice, 2014. Budget Fact Sheets.
[Online]
There is a requirement to revise and develop Forum (F3), Gareth has organised international Available at: https://www.justice.gov/about/fy17-
specialisms within the education of digital conferences and workshops to demonstrate budget-fact-sheets
[Accessed 29 November 2019].
investigators. The final thought is left that the new research to the law enforcement 22. US Dept of Justice, 2016. Justice News 7 Dec
2016. [Online]
best investigator or teacher may possibly be a community. Gareth is also a committee member Available at: https://www.justice.gov/opa/speech/
poacher turned gamekeeper, with or without a of the Association of Digital Forensics, Security asssistant-attorney-general-leslie-r-caldwell-
delivers-remarks-highlighting-cybercrime
criminal record. • and Law (ADFSL) based in the USA.. [Accessed 25 July 2019].

51

DFM43_044-051_ Future of Cybercrime.indd 51 13/08/2020 18:42

 360

36
Letters, emails, tweets, connections and more!

HELLO TO OUR READERS LETTERS & EMAILS managing your browsing experience, rather than
Hello to all our readers. Despite the current We get regular feedback from our readers accepting everything that the web throws at you.
impact that’s Covid-19 is having on us and and are keen to maintain the dialogue, so if If you do receive this error, one of the following is
the world of business globally, DFMag is you have anything you would like to comment the likely reason for you having done so:
continuing to grow in terms of its readership. on or share, please do not hesitate to drop us
The loss of partnerships worldwide that were a line at [email protected]. 1. You are not logged in via the Digital Forensics
planned for 2020 has had, and will continue We also get readers who want to share Magazine Website with a valid subscription.
to have, an impact for some time. Despite this, noteworthy news about what they are 2. You are logged in via the Digital Forensics
we have insightful news and articles which doing, we encourage this so do please Magazine Website with a valid subscription
are continuously being posted on our blog get in touch! Last quarter we received several but have some security settings that are
and shared on our Twitter page. Our monthly communications for library level subscriptions blocking access to the subscription checker.
newsletter continues to evolve, consisting which are available. Further to this, we are
of significant blog posts from the month and always on the lookout for new authors including If you believe that you have a valid
information on all things Digital Forensics. articles from University students. As stated subscription, are logged in and are still
before, we are committed to helping those receiving the error, then you need to do
DFM ACROSS THE GLOBE who will shape the future of our industry in the following:
DFMag has been endlessly busy addition to those who are defining it now. 1. Whitelist the Digital Forensics Magazine
with sponsoring a growing number of We do still get the occasional email website with all of your security plugins.
international events, with many events about “you need to be logged in to view 2. Whitelist the ZMags eReader website with
being held in different parts of Europe. the magazine”. As mentioned in the past, all of your security plugins.
There has also been an increasing number this is a common issue that results from 3. Allow cookies for both the Digital Forensics
of sponsored events further afield, in the some of the security features that browsers Magazine and ZMags websites.
USA and the Middle East, as well as various are now implementing. Please follow the 4. Ensure that NoScript or NotScript are
other locations around the world. If you instructions below to ensure ease of disabled for both the Digital Forensics
are interested in either getting your event access to the magazine: Magazine and ZMags websites.
sponsored by us or sharing your event details We welcome the additional security features 5. Restart your browser once you have enabled
via our various social media channels, then being included by the browser developers, the websites through your security to flush
please do get in touch with us. however it does require you to be proactive in the caches.

If you are interested in either getting your This should resolve your access issues,

event sponsored by us or sharing your however if you are still having issues, please
do raise a support ticket and our support staff
event details, then please do get in touch. will respond and help you resolve your issue.

52 Digital Forensics Magazine

DFM43_052-053_360.indd 52 13/08/2020 18:42

 FACEBOOK LINKEDIN SUPPORT
At present we have a Facebook The DFM LinkedIn Our dedicated Support Ticketing System
group, which is by invitation only. Group is maintaining its steady growth and available via the DFM website is where users
Candidly we have not had a lot of requests has over 3,000 unique members. Just search can raise a trouble ticket if they are having
via this channel yet and we are looking to for “digitalforensicsmagazine” and send us issues logging in or problems viewing the
ramp this up. The goal is to have only those a request to add you. As it is a private group, online version of the magazine, or just want
specifically in the industry as Facebook it is a good place to make new connections to point out anything related to our website.
members. If you would like to be invited to this and share thoughts and ideas. We are still If you think you can contribute in
group, please send us a request first via email working to ensure moderation of this list and any way to the magazine or to any of
to [email protected] with restrict automated postings. As mentioned the discussions taking place via social
the subject line “Facebook invitation request.” before, we are happy to create sub-groups for media, please make sure that you join the
Please do send it from a work email address discussions and postings related to such topics groups and follow us as appropriate or just
or ensure that you provide your affiliation and as education, mobile device forensics, network send an email to myself Safia Hallaq at
designation within the industry. forensics, cloud forensics etc. If you would like [email protected]
to be part of a group, then just drop us a line
TWITTER at [email protected]. In the

Digital
We are regularly tweeting tools, last quarter, we had several postings and we The Quarterly Magazine for Digital Forensics Practitioners Issue 43 • Q2 2020

ForensicS
tips and news articles from our encourage our members to keep it up. These
blog along with the best retweets, from our articles range from in-depth technical malware
followers, which have now increased to over analysis to tips and techniques from the latest
13,882 — an increase of 700 since our last digital forensics tools.
Magazine
issue! We are also part of several various cyber
security and digital forensics lists. You can find BLOG
us on @DFMag and we welcome comments,
as well as DM’s. As practitioners, we know
Since the celebration of our 10th anniversary,
the blog readership and traffic are growing with
Virus
that in the process of doing the day job, finding visitors from all over the world. Postings here Tracking
the time to develop the odd script or a quick include topics covering E-Discovery, digital Apps
problem solver is difficult. Therefore, we do look forensics and the latest news on cybercrime, Brian Cusack investigates
Contact Tracing issues

out for various relevant tools, techniques or hacks and breaches that make the headlines
journal papers that can help and share them. If and some interesting ones that do not! If you
you need support please use the support ticket would like to become a regular contributor PLUS
Memory Forensics
system; we are not able to respond to or review to the blog, please drop me a line via news@ Enabling Intelligent Cities
The History of Cryptography 9 772042 061004
43

Regular Features: News, Legal & Much More! Issue 43 / £14.99 TR Media

your support query via twitter as quickly. digitalforenicsmagazine.com

DFM43_OFC_Cover - Online.indd 1 13/08/2020 16:34

53

DFM43_052-053_360.indd 53 13/08/2020 18:42

 IRQ

IRQThe standards explosion.

O
h dear! There are more projects
to create standards for forensic
deliberate act being the explanation for the
presence of illegal material on a machine? We
My fear is that
science, and digital forensics simply don't have the "ground truth" databases they will create a
in particular.
You know my views on standards!
that we would need to be able to comply.
And then there's the mobile device crowd.
superficial standard
I think they're a good thing, but that people don't Again, they've been telling me for years that that allows them
implement them properly. The current ISO/IEC 17025 doesn't work but haven't been able
to give the impress
of compliance,
17025 regime has often been criticised as not to tell me why. Every time I dig into it, I either
being applicable to digital, but I still reckon that's hit a roadblock because of "commercial
because people are looking for easy answers. confidentiality", or simply get the "it just without actually
They want someone to tell them how to do it; in
other words, they want a prescriptive standard.
doesn't work" line repeated. So, now, they've
approached CEN via the ForMobile project to
having to disclose
The 27037, 27041, 27042 and 27043 family are create their own standard. This is sponsored any evidence of it, or
often mentioned as being more applicable to
digital, which puzzles me. We wrote them to be
by some of the bigger names in the mobile
forensics market, but they've never been
subject themselves
compatible with 17205, but to use examples and able to play nicely together before, so to scrutiny.
language which was more familiar to the digital what's going to be different this time?
community. They still don't, however, tell you how My fear is that they will create a superficial BUT it requires co-operation and more
to do anything, that's a choice that's left open to standard that allows them to give the impress openness than most vendors are willing to
the user. of compliance, without actually having engage in. Not of the "just hand over all your
Now we have ISO 21043 parts 1 through 5 to disclose any evidence of it, or subject test data and devices" type, but of the "let
looming, and these are going to cause even themselves to scrutiny, the two things that someone act as an honest broker to confirm
more problems if they're adopted. Parts 1 and 2, have hampered every effort I've made to you're right" type.Until we solve that problem,
helpfully, declare that they don't cover digital develop a model for them. we're probably just going to keep writing
and direct the reader to the 270xx family again, FWIW, my model is simple; let a trusted standards and increasing the confusion. •
but they only deal with definitions, terminology third party inspect your development and
and initial evidence handling and transportation. testing processes. Let them certify it as Angus Marshall is an
Parts 3,4 and 5, however, cover examination, reliable and then publish a proper set of independent digital forensics
analysis, interpretation and reporting, and don't requirements that end-users can map against practitioner, author and
exempt digital. Having looked at the drafts, their methods. Where there is congruence researcher, currently working
I can see some real beartraps looming for between the published requirements and the on the ‘fitness for purpose’
digital practitioners if these become the new method requirements, there is no need to retest challenge. In a past life he was an academic
international requirement. They'll be a far more because the TTP has said that adequate testing course leader in Digital Forensics and Forensic
prescriptive that what we currently have and has been done. That reduces validation to Computing and still retains strong links with
will force digital examiners to do things we just mostly being a test that you can use the tool academia, professional bodies and regulators.
can't do. For example, how do you construct correctly, and also eliminates the need for He can be contacted through his company,
a Bayesian likelihood ratio for malware vs. more testing after every single upgrade. n-gate ltd. (http://www.n-gate.net).

54 Digital Forensics Magazine

DFM43_054_IRQ.indd 54 13/08/2020 18:41

DFM43_IBC_Ad - Infosec Skills.indd 55 13/08/2020 18:41
DFM43_OBC_Ad - Cyber Scheme.indd 56 13/08/2020 18:41