Posted on

Visual Forensic Analysis

Interesting research in the field of Visual Computer Forensic Analysis has been presented at Black Hat 2009 by Greg Conti and Erik Dean from the United States Military Academy

Their research uses a visualisation tool to “view” files in a system being forensically analysed. In this manner, a file that is considered unknowned from its filename can be identified by the way it looks. A MS Word file will look different to say a JPEG file. To do this traditionally would require the analyst to use two viewers.

The researchers  say, “Visualization has the potential to dramatically change the field of computer forensics. Each time we created a new visualization tool there were always surprising insights. Visualizations create windows on data that hasn’t ever been readily visible, much to the dismay of people trying to hide information in the dark corners of a computer.”

Technorati Tags: , , , , , ,

Source: http://www.law.com/jsp/legaltechnology/pubArticleLT.jsp?id=1202428248638

Posted on

Security company’s customer database hacked by SQL Injection

Kaspersky Lab, a Moscow-based security company, admitted today that a database containing customer information had been exposed for almost 11 days and that it only learned of the breach when Romanian hackers told the firm about it (the hackers in this instance were white hats). No data was actually downloaded or looked at.

The hackers (presumed from Romania), went public in a blog post. They claimed that after launching a SQL injection attack on Kaspersky’s U.S. support site, they were able to access a customer database that included e-mail addresses and software activation codes.

Roel Schouwenberg,  a Kaspersky senior antivirus researcher,  confirmed that the database was hacked via a SQL injection attack, but he reiterated that only the database’s table labels had been accessed by the hackers, not the data itself. “A more advanced hacker could have gotten access to the information,”  Schouwenberg acknowledged, “including activation codes for the product and e-mail addresses. But that didn’t happen.”

A combination of vulnerable code crafted by an unnamed third-party vendor and poor code review by Kaspersky was to blame, thus an Application Security issue.

Kaspersky has hired Next Generation Security Software Ltd.’s David Litchfield, one of the world’s experts on SQL injection attacks and database security, to do an independent audit of the company’s systems.  Considering that if Kapersky had been using Rational Appscan to look after their site, they would have been notified during a scan of the vulnerability and other issues without having to extend to external “experts” in SQL injection.

SQL Injection seems to be the major choice by hackers to compromise applications through the web frontend. Rational Appscan can test and identify SQL Injection vulnerabilities in a given system being tested.

Technorati Tags: , , , , , ,

Source: www.computerworld.com

Posted on

Forensic Lab Accredited

Yet another forensic lab has received accreditation in the US. The Northwest Regional Computer Forensics Laboratory in Portland, Oregon, handles computer and electronic forensic analysis. FBI Officials were present when the lab was officially accredited by the region’s law enforcement agencies.

There are less than 40 labs around the world which have been accredited for this purpose by their local law enforcement agencies. It seems in Australia, we need such labs to allow our law enforcement agencies to delegate forensic analysis to trusted experts.

Technorati Tags: , , , ,

Source:  http://seattlepi.nwsource.com/local/6420ap_or_forensics_lab.html

Posted on

Compromised VOIP Racks Huge Bill

Hackers have compromised the VOIP communications of a company in WA. The hackers racked up a bill of  AU$120,000 when they used it to make 11,000 international calls in just 46 hours.  WA Police Technology Crime Investigations detectives have warned that hackers are targeting VOIP based iPBX systems. The Call-Forward functions are being used to make international calls.

Technorati Tags: , , , ,

Source: http://www.news.com.au/story/0,,24939188-2,00.html