Six Online Tools for Tracing IP Addresses

March 9th, 2010

Tracing IP addresses is a fundamental skill for online investigations. Several resources are available on the Internet to assist in this process. Several online resources for doing your basic IP identification include:

ARIN – American Registry of Internet Numbers
ARIN is a Regional Internet Registry (RIR) that provides services related to the technical coordination and management of Internet number resources in its respective service region. The ARIN service region includes Canada, many Caribbean and North Atlantic islands, and the United States.

Use the “Search Whois” function at  https://www.arin.net/index.html  to obtain IP registration information.

Sam Spade
Sam Spade has been in use as a tool for obtaining domain registration information for years. It has a simple Google like interface where you enter an IP address or a domain name.

http://samspade.org/
DNS Stuff
This is another website that has been around for a number of years. This website offers both free and pay for option for assisting in the identification IP addresses and other online information.

http://www.dnsstuff.com/tools/tools/
Network-Tools.com
Another website with a simple user interface to assist in IP tracing.

http://network-tools.com/
Central Ops.net
Central Ops is another website that assists with your IP tracing. One of its features “Domain Dossier” does multiple lookups on an IP address or domain.
http://centralops.net/co/
Internet Investigators Toolbar
All of these websites are easily accessible from our free to the online investigations community Internet Investigators toolbar which can be found on our website at http://veresoftware.com/index.php?page=downloads#toolbar

How important are date/time stamps to online investigations?

February 25th, 2010

Recently I read a listserv posting wherein the poster described his use of the system clock to document the video evidence he was collecting. He described using the computer’s system clock as the source of the verification of the date and time, and recording with the video the system clock to show what the time is when you are recording the video.

Likewise, a WebCase user I spoke with told me that in the past, members of his unit would have to create a folder in which to keep case documents. Again, this used the system’s date/time stamping.

Date/time stamping is one of WebCase’s key features, but these two users bring up an excellent question: what, exactly, is the big deal about date/time stamping? More importantly, how can the defense challenge it in court?

Actually, it’s pretty easy to fudge a computer’s system clock. Not that an ethical investigator ever would, but the defense can introduce reasonable doubt with a simple demonstration. In Windows Vista, all it takes is a right-click on the time in the bottom right-hand corner. Then, select “Adjust Date/Time” and click on “Change date and time…”. System clock changed.

How does using WebCase prove you didn’t do this?

WebCase, when it starts, makes a system call to the National Institute of Science and Technology’s (NIST) atomic clock to obtain the correct time. It then dates and stamps all evidence collected in the current UTC (this stands for Universal Coordinated Time, or what we used to refer to as Greenwich Mean Time) time—not the system clock time.

WebCase automatically verifies the UTC and documents this in the reports users generate. This helps to ensure that any reliance on the system clock is avoided.

On the listserv, the poster went on to describe his collection process using a document program to cut and paste chats into. Again, he used the system date and time as the time stamp for the file.

Not only does WebCase negate the need to use two separate programs—video collection and document—but its date and time stamping, along with its automatic hashing function, guarantees the file integrity of any video recorded.

See it in action: download a free demo!

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Six Internet Tools for Researching Someone

February 13th, 2010

Finding information about someone online can be as simple as searching them in Google. For some more detailed information about people several resources are available on the Internet for identifying people.  Each website returns a limited amount of information on whom you are researching and most are a front end for a pay for service which for a small amount you can get a complete background on the individual. However, searching several of the services, which return different information, you can quickly put together a significant amount of information on your target.

Search Bug  http://www.searchbug.com/

Zabba Search http://www.zabasearch.com/

The Ultimates    http://www.theultimates.com/

Skip Ease  http://www.skipease.com/

Pipl http://www.pipl.com/

Zoom Info http://www.zoominfo.com/

 

Internet Investigators Toolbar

All of these websites are easily accessible from our free, to the online investigations community, Internet Investigators toolbar which can be found on our website at http://veresoftware.com/index.php?page=downloads#toolbar

Cloud computing: Not just for geeks or feds

February 8th, 2010

Think online investigation is just for the high-tech crimes types, the computer forensics geeks or the feds? Not so, says Todd in his interview with Cyber Speak’s Podcast (hosted, ironically, by two former federal agents). The more people are online, the more they’re likely to use cloud services, the more important it is for local law enforcement to be there too.

Todd’s appearance on Cyber Speak came about because of his two-part article on cloud computing, which had appeared in December in DFI News. He and Ovie Carroll discuss:

Impact of cloud computing on first responders

Detectives performing searches can’t simply pull the plug on a running computer anymore (a fact which prosecutors are having to get used to). They need to be able to perform data triage and possibly even volatile data collection.

Why? Because knowing whether a suspect has an online presence is critical to whether an arrest is made—and what happens afterward. Whether users are actively storing files “in the cloud” or simply members of social networking sites, law enforcement officers who don’t find evidence and therefore, do not make an arrest risk that suspect going online and deleting all incriminating information.

Why is this a problem? Because the very nature of cloud storage means investigators may not be able to access a logical hard drive somewhere to recover the evidence. First, the sheer amounts of data stored on servers make this close to impossible. Second, there are jurisdictional issues.

Are you exceeding your authority?

Not only may information be stored outside your jurisdiction, but it may also be stored in another country altogether—one with different criminal and privacy laws. Accessing evidence of a crime in the United States may actually mean committing a crime in another country (Todd relates the story of two FBI agents for whom arrest warrants were issued in Russia).

This is a problem for local law enforcement, which Todd notes has been left largely to its own devices when it comes to online crime. Only Internet Crimes Against Children (ICAC) task forces have clear direction from the federal government on how to proceed.

Hence it’s easy for local police to kick Internet crimes up to regional, state or federal task forces. But as Todd points out, more people coming online means more crimes being committed against people in local jurisdictions both large and small. Law enforcement at every level needs to be able to respond.

Please listen to Todd and Ovie, and then come back and tell us what you think!

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Monitoring Twitter? Try Searchtastic

February 8th, 2010

Twitter is not the pointless what-I’m-having-for-breakfast exercise in narcissism that many people think it is. The Washington Post recently reported that gangs are now using it and rival Facebook to discuss their activities–thereby inadvertently incriminating themselves.

So, it’s a good idea for gang investigators, probation/parole officers, and other law enforcement officers to monitor Twitter to see what’s going on. Best way to do that? Lauri Stevens over at ConnectedCOPS offers Searchtastic:

Try searching Twitter with its own advanced search “feature” and you might come up a bit disappointed. Put in a term or hashtag and it will take you go back only a week and a half or so in time.

With Searchtastic:

1. Search usernames or hashtags
2. You can pull up tweets from weeks and months back.
3. You can search on a particular user and the people he or she follows.
4. Then, click on a word in the search results and it modifies the search by the word. Once a word is in the search results, if you want to take it back out, click on it again.
5. And the clincher: When your search results look like something that might be interesting, export the results to Excel with the click of one button.

It seems like in ten or fifteen minutes, you could design a search, relevant to any investigation you might be working, that’s full of interesting terms and Twitter usernames. Export those results to Excel and cross reference them through your other database engines and maybe connect a few more dots. Useful?

I tried Searchtastic on the hashtag (a way to organize tweet topics) #webcase, which I used in November to live-tweet training from Charlotte, NC. The first run found tweets going back to October, but not my class tweets.

During my second run, without the # symbol, I found about six pages of tweets. Some came from Todd (who tweets as @Webcase); others from people who had “retweeted,” or recommended, WebCase or something we’d said.

As Lauri says, Searchtastic is in beta, so it may not catch 100% of what you are trying to find. As with so much when it comes to online investigations, best is to run the search sooner rather than later. However, Searchtastic does find much more than Twitter Search; it does organize tweets nicely by username; and it does allow for export to Excel.

Find out more on Searchtastic’s About page.

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Todd on CyberCrime 101: Episode 7

February 5th, 2010

Last month while Todd was training in New York City, he had a chance to meet Joe Garcia, a computer crimes detective we connected with on Twitter. Joe has a podcast, CyberCrime 101, about all things computer forensics and information security. After reviewing the WebCase demo, he kindly invited Todd on the show to talk.

Their focus: Todd’s background, WebCase, and being president of the International High Tech Crimes Investigators’ Association (HTCIA). Joe voiced his approval for our tutorial screencasts, as well as our webinars and 2-day training; Todd told us that WebCase now offers 64-bit support, and will soon be released in a new version that has more features.

Thanks for having Todd on the show, Joe!

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

A DFI News double feature

February 5th, 2010

We were pleased and honored in December when Digital Forensics Investigator (DFI) News opted to give two of Todd’s articles top billing on its site.

The articles, a two-part series, addressed whether collection of electronic evidence from the Internet is feasible. Some say no; obviously, we say yes!

In Part I, Todd drew from his 2007 white paper, “Collecting Legally Defensible Online Evidence,” to discuss the need for and development of a standard methodology for Internet evidence collection. In Part II, he addressed the application of that methodology specifically to “cloud” computing.

The cloud does present different challenges to evidence collection than do conventional Internet sources. But that doesn’t mean evidence collection from the cloud is impossible.

Read Part I here and Part II here. And please be sure to come back and tell us what you think. Do you agree? Disagree? Have you encountered the need for Internet evidence collection methodology… or investigative issues specific to the cloud? Comments are open!

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Legal Issues with Online Investigations: Some background

January 15th, 2010

As Executive Director and Senior Counsel of the National Law Center for Children and Families, Richard Whidden is most familiar with laws and precedents related to child pornography—but stresses that investigators of other crimes can take away important information, too. “Much of the case law on electronic evidence comes from child porn cases because those are what prosecutors take on,” Whidden says.

During his webinar, “Legal Issues with Online Investigation,” on Thursday, January 21, Whidden will be discussing a sampling of cases from 2009 that had to do with Internet and computer forensics. One of the primary cases, however, has to do not with child pornography but instead with steroids.

Specifically, U.S. v. Comprehensive Drug Testing, Inc. describes forensic procedures relative to search and seizure of electronically stored evidence. Although it applies to the 9th Circuit Court of Appeals’ jurisdiction, it’s likely that other courts will look to the decision when dealing with their own issues of electronic evidence.

The case also illustrates how the process of e-discovery has evolved over the past 10 years. Typically this is difficult to discuss. As Whidden says, “You could have entire symposiums on how the law has changed over the last 10 years, before you even break out the crystal ball on how it will change over the next 10.”

Notably, law changes according to the technology. “We’ve gone from pornographic images of children, to streaming video of abuse taking place,” says Whidden. “Modes of transmission change. Cell phone technology is much more prevalent now, and will continue to evolve.”

Whidden will cover other legal issues, such as the definition of “possession” of child pornography, procedures related to computer related evidence, search and seizure issues, and the difference between state and federal prosecutions. He will not discuss civil cases, only criminal cases because of the higher burden of proof.

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Some thoughts on Howard Schmidt’s appointment as Cyber Security Coordinator

January 6th, 2010

I first met Howard Schmidt around 1999 at one of the many National Institute of Justice (NIJ) cybercrime programs we eventually served on together. Howard was someone I looked up to and sought advice from when we saw each other. I have always been impressed by his demeanor and his ability to simplify the complex cybercrime problem when he speaks.

So, I thought initially that I should jump out and comment on my friend Howard’s new appointment as the U.S. Cyber Security Coordinator and congratulate him on the appointment.  But, I then I thought I should wait and not be part of the pack.

After the announcement of his appointment, I surfed the Web to see what kind of reaction his appointment would cause in the media and the blogosphere.  What I have seen so far is fairly tame for an Obama appointment. 

For the most part the traditional media have been fairly benign in their response to the announcement. It appears to them it is just another Obama “Czar”. Most seemed interested in his introduction as the new Cyber Security Coordinator through a videotaped presentation on the White House’s website rather than his ability to do the job. 

Indeed, Howard’s overall non-political stances appear to have placed him in the right place at the right time. And his extensive back ground in the cyber crime fighting arena is encouraging for a lot us involved in the cyber crime fight.

But some people are not as encouraged. The attacks on Howard have already started, as evidenced by the comments on Bruce Schneier’s  blog. (Ironic that the very technology he is asked to defend is the same anonymous place used to attack him.)If he was involved as part of the Bush administration, this promises to NOT be an improvement. Others here have correctly observed that it is a position completely set up to fail. Schmidt has never stayed in any one position very long. What has he ever actually accomplished over the years?

By taking this job, Schmidt is able to cash out of eBay without having to pay some taxes on gains he made there.

Howard, like so many in the public eye, takes a beating for being able to stand up and offer themselves to the wolves of criticism.  He is a fine man, a veteran federal and military investigator, an experienced law enforcement officer, and a Chief Security Officer in large corporations.

In other words, he has seen the problems from multiple levels within and from without government. His appointment will give him the opportunity to put a varied background of experience to work on a problem affecting everyone. How many people considered by the Obama administration had a resume to compare? 

So what should Howard focus on and attempt to accomplish? First of all, he could help to define better the understanding in this country of the differences between Cyber-Security and Cyber-Crime. All too often they get melded into the same concept or believed they are the same thing.

Some think that Cyber Security matter are the only issues he has or should deal with. Investigating Cyber Crime is a complex issue with just as many complex, multi-level facets as Cyber Security.  Howard’s clear understanding of the issues related to both give him an advantage. I would just like to see Cyber Crime investigation given the attention it needs and deserves.

Given his background and the infighting amongst the current bureaucrats governing IT security and cybercrime in the United States, Howard has a rough road ahead. Even though he  does seem to want  to remain out of the politics of the job (as evidenced by his release of a videotaped statement rather than a press conference),  many feel the job is all title and no authoritative bite.

With the dissatisfaction of Melissa Hathaway and others that where standing in line or considered for the job this year, I hope the Obama administration gives Howard the latitude and support  to do the work that needs to be done.  Good luck Howard…..

Identity theft online: Some background

December 7th, 2009

Identity theft is one of Detective Kipp Loving’s investigative specialties. Having worked hundreds of ID theft cases in the last decade, Loving has seen the crime evolve along with, and as an integral part of, the Internet. His webinar is based on the 8-hour block he teaches during the 40-hour California Peace Officer Standards & Training course on financial crimes.

Trends in online identity theft

The Internet’s reach often means multiple jurisdictions and sometimes hundreds of victims. In fact, it’s part of at least one of every level of an ID theft case, ranging from how criminals obtain identities to how they use them.

“Information compromise is just one component,” Loving says. “An ID thief doesn’t have to phish; he could as easily go dumpster diving for information, then go online to use it.”

Phishing is now a tool mainly of high-end rings associated with international gangs like the Russian Mafia, or Southeast Asian groups, who hire hackers to compromise databases. Cases involving them are usually federal, and much more sophisticated than most local ID thieves.

More likely for the average investigator to see:

  • “Crankster” (methamphetamine addict) dumpster divers.
  • An employee in a local company, abusing privileged access to private information in the employer’s databases.
  • Family-on-family ID theft.

The last trend has been particularly accelerated. ID theft is still prevalent in elder abuse cases. But in a troubling turn, more parents are stealing their children’s identities.

“The parents don’t get reported until the kids are of age and try to buy a first car or get an apartment,” says Loving. “And they can’t get out from under the liability unless they are willing to prosecute Mom and Dad.”

Case management + presentation

“Most people don’t associate case management with case presentation,” says Loving, “but prosecutors consider ID theft cases to be only a step above real estate fraud cases. When you’re dropping what may be a four-inch-thick case file on their desk, how you managed the case will be critical to how you present it, and therefore how it is received.”

A well-managed case contains several elements. “First, identify the cream that floats to the top,” says Loving. “You can’t manage 300 victims, so find out from the prosecutor how many is enough.” Sometimes the case will “go federal,” so local law enforcement and prosecutors need only do so much.

Second, a detailed timeline is critical to success. “A prosecutor will not read every page of your case, so a start-to-finish timeline on each charge helps them,” Loving says. “You include every incident, the elements of the crimes, dates, and amounts.”

Most important of all, however, is not to simply forward the case to the prosecutor once it is wrapped up. “You have to make an effort to form a relationship, talk to the prosecutor throughout the case,” says Loving, who once worked as a criminal investigator in a DA’s office. “They’ll tell you what they like and don’t like about the investigation.”

That relationship is not about micromanaging—it’s about “selling” the case. “You have to get to the point where you don’t need to sell it; they’re already sold by the time you close the case,” Loving says. “In fact, they’re so sold that they ask when they can have it.”

The need for information sharing

Identity theft investigations can be time-consuming and frustrating because it can span multiple victims and jurisdictions—which, at a time when law enforcement budgets are tight, makes them harder to work.

“You can’t always work with victims face to face, and there are usually many more victims than you know about,” says Loving. “The ones you work with are simply those who noticed and talked enough to assist your investigation.”

The most important thing at that point is for investigators to be involved with groups like the International High-Tech Crimes Investigators’ Association (HTCIA). Loving also runs his own 800+ member listserv, a restricted-access Yahoo! Group where detectives from across the nation can get search warrant language, company contact information, and connect with each other on their cases.

“Cops aren’t always good at information sharing,” he says, “but we need to get better as more of these crimes go into other jurisdictions.”

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.