Journal of Digital Forensics, Security and Law

21-34

Authors: Yui Sakurai, Yuki Ashino, Tetsutaro Uehara, Hiroshi Yoshiura, Ryoichi Sasaki

These days, most data is digitized and processed in various ways by computers. In the past, computer owners were free to process data as desired and to observe the inputted data as well as the interim results. However, the unrestricted processing of data and accessing of interim results even by computer users is associated with an increasing number of adverse events. These adverse events often occur when sensitive data such as personal or confidential business information must be handled by two or more parties, such as in the case of e-Discovery, used in legal proceedings, or epidemiologic studies. To solve this problem, providers encrypt data, and the owner of the computer performs decoding in the memory for encrypted data. The computer owner can be limited to performing only certain processing of data and to observing only the final results. As an implementation that uses existing technology to realize this solution, the processing of data contained in a smart card was considered, but such an implementation would not be practical due to issues related to computer capacity and processing speed. Accordingly, the authors present the concept of PC-based High Grade Anti-Tamper Equipment (HiGATE), which allows data to be handled without revealing the data content to administrators or users. To verify this concept, an e-Discovery application on a prototype was executed and the results are reported here.

45-62

Authors: Luciana Duranti, Barbara Endicott-Popovsky

This paper introduces the Digital Records Forensics project, a research endeavour located at the University of British Columbia in Canada and aimed at the development of a new science resulting from the integration of digital forensics with diplomatics, archival science, information science and the law of evidence, and of an interdisciplinary graduate degree program, called Digital Records Forensics Studies, directed to professionals working for law enforcement agencies, legal firms, courts, and all kind of institutions and business that require their services. The program anticipates the need for organizations to become “forensically ready,” defined by John Tan as “maximizing the ability of an environment to collect credible digital evidence while minimizing the cost of an incident response (Tan, 2001).” The paper argues the need for such a program, describes its nature and content, and proposes ways of delivering it.

85-88

Authors: Gary Kessler

Cohen, F. (2010). Digital Forensic Evidence Examination (2nd ed.). Livermore, CA: ASP Press. 452 pages, ISBN: 978-1-878109-45-3, US$79. Reviewed by Gary C. Kessler, Gary Kessler Associates & Edith Cowan University (gck@garykessler.net) On the day that I sat down to start to write this review, the following e-mail came across on one of my lists: Person A and Person B write back and forth and create an email thread. Person A then forwards the email to Person C, but changes some wording in the email exchange between A & B. What is the easiest way (and is it even possible) to find out when that earlier email message was altered before sent to Person C? Before you try to answer these questions, read Fred Cohen's Digital Forensic Evidence Examination. His book won't actually tell you how to answer these questions but it will help you understand the difficulty in even trying to answer them with any level of certainty.

21-48

Authors: Chun Wei, Alan Sprague, Gary Warner, Anthony Skjellum

Spam related cyber crimes have become a serious threat to society. Current spam research mainly aims to detect spam more effectively. We believe the prosecution of spammers is a more effective way of stopping spam emails than filtering, therefore more research is needed to help forensic investigators to collect useful evidence. This research proposes an algorithm for clustering spam domains extracted from spam emails based on the hosting IP addresses and tracing the domains over a period of time. The results reveal several facts that merit law enforcement attention: many seemingly unrelated spam campaigns are actually related; spammers have a sophisticated mechanism for combating URL blacklisting by registering many new domain names every day and flushing out old domains; the domains are hosted at different IP addresses across several networks, mostly in China where legislation is not as tight as in US; old IP addresses are replaced by new ones from time to time, but still show strong correlation among them. These facts lead to the conclusion that spam-related cyber crimes are operated by well-organized criminal syndicates that have sufficient manpower to distribute a huge volume of spam through bots, purchase a large number of domain names and hosting servers and maintain websites to sell counterfeit products online. Traditional law enforcements technology has not scaled well in cases involving millions of data elements. This paper demonstrates an effective use of data mining to respond to this challenge.

43-50

Authors: Francis S Cronjé

Privacy International made the following statement regarding South Africa’s financial sector in its 2005 world survey: “South Africa has a well-developed financial system and banking infrastructure. Despite the sophistication of the financial sector, the privacy of financial information is weakly regulated by a code of conduct for banks issued by the Banking Council.” This extract highlights some of the problems South Africa are experiencing with its current status on privacy as viewed from an International perspective. In recent years the International society has stepped up its efforts in creating a global village wherein the individual could be assured of having his/her privacy protected. Various conventions and guidelines have previously laid the foundation for privacy but it was not until the European Union’s (EU) launch of its Directive on Data Protection in 1995 that we have seen a real coerced shift in the focus of such protection. Cross border data transfers from the EU became something of the past unless third countries (those countries outside the EU) could prove the existence of adequate data protection provisions. It seemed to a big extend that international trade would be hampered and some of its biggest trading partners, such as the US, suddenly felt the impact due to its lagging protection measures. In order to curtail such inadequacies, a Safe Harbor Agreement was entered into between the EU and US whereby cross border data flow would be allowed under certain prerequisites. This Agreement however, does not cover Financial Institutions.

73-94

Authors: Z. Ntozintle Jobodwana

The liberalisation of the telecommunication industry in Africa, and the further development of the region’s physical infrastructure was accompanied by the further development of Africa’s information, communication and technology infrastructure. Competition within the industry stimulated heavy economic investment in other sectors of the economy. The outcome of liberalisation also included the establishment of community-based structures that continue to enable communities to manage their own development and gain access to information and communication technologies (ICTs) in an unprecedented manner. The telecommunication infrastructure further stimulated the fast development of other related services, for example, e-commerce and mobile commerce (m-commerce), e-government, internet banking, mobile banking etcetera. Latest reports and statistics disclose that in Africa m-commerce is set to even overtake the development of e-commerce, through the popular use and penetration of mobile telephony whilst e-commerce development is constrained by difficulties in rolling out speedily fixed telephone lines. These new methods of communication have so intensified that there is hope that further penetration of mobile telephony would leap-frog economic growth and development in Africa, especially in rural communities. Therefore, innovations and investment in ICT’s are changing the world in a number of ways, resulting in a globally connected digital economy. However, there are regulatory challenges that need to be addressed as a matter of urgency. Certain sections of the continent’s population, especially those in rural areas, have very limited access to ICT’s. This prevents them from exploiting opportunities offered by ICT’s. The main barriers to ICT access relate to inadequate regimes and their supporting legal frameworks, high cost of internet access, connectivity problems, the lack of technical skills to support maintenance and low number of computers with internet connectivity at schools, libraries and other public places. In this paper such challenges are identified and further reforms suggested. The ultimate recommendation is the one that states that a SADC telecommunication independent regulatory agency be established, independent of any government ministry, though consulting with a SADC Ministerial Council. Already, some countries in West Africa have developed a harmonized regulatory framework designed to integrate the Acts covering ICT markets in the sub-region and to keep policy and regulatory frameworks in line with the constant evolution of technologies, applications and services.

17-34

Authors: Andy Luse, Brian Mennecke, Anthony M. Townsend

The paperwork associated with evidentiary collection and analysis is a highly repetitive and time-consuming process which often involves duplication of work and can frequently result in documentary errors. Electronic entry of evidence related information can facilitate greater accuracy and less time spent on data entry. This manuscript describes a general framework for the implementation of an electronic tablet-based system for evidentiary processing. This framework is then utilized in the design and implementation of an electronic tablet-based evidentiary input prototype system developed for use by forensic laboratories which serves as a verification of the proposed framework. The manuscript concludes with a discussion of implications and recommendations for the implementation and use of tablet-based computing for evidence analysis.

57-60

Authors: Gary Kessler

Knapp, K.J. (Ed.) (2009). Cyber Security and Global Information Assurance: Threat Analysis and Response Solutions. Hershey, NY: Information Science Reference. 434 + xxii pages, ISBN: 978-1-60566-326-5, US$195. Reviewed by Gary C. Kessler (gck@garykessler.net) I freely admit that this book was sent to me by the publisher for the expressed purpose of my writing a review and that I know several of the chapter authors. With that disclosure out of the way, let me say that the book is well worth the review (and I get to keep my review copy). The preface to the book cites the 2003 publication of The National Strategy to Secure Cyberspace by the White House, and the acknowledgement by the U.S. government that our economy and national security were fully dependent upon computers, networks, and the telecommunications infrastructure. This may have come as news to the general population but it was a long overdue public statement to those of us in the industry. The FBI's InfraGard program and the formation of the National Infrastructure Protection Center (NIPC) pre-dated this report by at least a half-dozen years, so the report was hardly earth shattering. And the fact that the bulk of the telecom infrastructure is owned by the private sector is a less advertized fact. Nonetheless, reminding the community of these facts is always a Good Thing and provides the raison d’être of this book.

27-38

Authors: Craig Valli

This research in progress paper explores the use of Graphviz and Afterglow for the analysis of data emanating from a honeypot system. Honeypot systems gather a wide range of data that is often difficult to readily search for patterns and trends using conventional log file analysis techniques. The data from the honeypots has been statically extracted and processed through Afterglow scripts to produce inputs suitable for use by the DOT graph based tools contained within Graphviz. This paper explores some of the benefits and drawbacks of currently using this type of approach.

57-72

Authors: Dennis Browning, Gary C. Kessler

This paper describes a student project examining mechanisms with which to attack Bluetooth-enabled devices. The paper briefly describes the protocol architecture of Bluetooth and the Java interface that programmers can use to connect to Bluetooth communication services. Several types of attacks are described, along with a detailed example of two attack tools, Bloover II and BT Info.