Posts Tagged ‘Todd Shipley’

New Book Investigating Internet Crimes Released

Saturday, February 15th, 2014
41wMbTIcmVL._SY300_

Investigating Internet Crimes

Investigating Internet Crimes:
An Introduction to Solving Crimes in Cyberspace

You can find the new book by Todd G. Shipley and Art Bowker on Amazon books and you can  also follow the authors on their blog. What’s being said about the book:

Neal Ysart, Director First August Ltd, likes Investigating Internet Crime by Shipley and Bowker

“At last….. Informed, pragmatic guidance from two highly experienced professionals who  have actually spent time on the front line, not just the classroom.  This book is relevant for  practitioners working in both law enforcement and within business – every aspiring cyber  investigator should have a copy.” Neal Ysart, Director First August Ltd, Information and  Corporate Risk Services

Google Analytics Update

Wednesday, August 29th, 2012

Last year I wrote about taking apart a MySpace cookie.  Included in that posting was some discussion on Google analytics tools found within the cookie.  It was interesting and I got some good feedback about the blog entry.  I was contacted by Jim Meyer of the DoD Cyber Crime Center about some further research they had done on the Google analytics within cookies and a presentation they were preparing at the time for the 2012 DoD Cybercrime conference (if you saw the presentation at DoD let me know how it went).

They were able to determine more information about the specific pieces of the Google analytics cookie placed on a user’s computer when they go to a webpage that contains Google Analytics.

The Google Analytics Cookie collects stores and reports certain information about a user’s contact with a webpage that has the embedded Google analytics java code. This includes:

  • Data that can determine if a user is a new or returning user
  • When that user last visited the website
  • How long the user stayed on the website
  • How often the user comes to the site, and
  • Whether the user came directly to the website,
    •  Whether the user was referred to the site via another link
    • Or, whether the user located the site through the use of keywords.

Jim Meyer and his team used Googles open source code page to help define several pieces of the code and what exactly it was doing when downloaded. Here is some of what they were able to determine (The examples are the ones I used in my last posting with a little more explanation about what everything means. I explained how I translated the dates and times in my last posting). For a complete review of their findings contact Jim at the DoD Cyber Crime Center.  

Example

Cookie:            __utma

102911388.576917061.1287093264.1287098574.1287177795.3

__utma This records information about the site visited and is updated each time you visit the site.
102911388 This is a hash of the domain you are coming from
576917061 This is a randomly generated number from the Google cookie server
1287093264 This is the actual time of the first visit to the server
576917061.1287093264 These two together make up the unique ID for Google track users. Reportedly Google not track by person information or specific browser information.
1287098574 This is the time of the previous visit to the server
1287177795 This is the time last visited the server
3 This the number of times the site was been visited

 Example

Cookie:            __utmz

102911388.1287093264.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) 

__utmz This cookie stores how you got to this site.
102911388  Domain hash
1287093264 Timestamp of when the cookie was last set
1 # of sessions at this time
1 # of different sources visitor has used to get to the site.
utmcsr Last website used to access the current website
=(direct) This means I went direct to the website, “Organic” would be from a google search, “Referring link” may show link coming from Search terms may.
|utmccn=(direct)  Adword campaign words can be found here
|utmcmd=(none) Search terms used to get to site may be in cookie here.

 Example

Cookie:            __utmb

102911388.0.10.1287177795 

__utmb This is the session cookie which is only good for 30 minutes.
102911388 This is a hash of the domain you are coming from
0 Number of pages viewed
10 meaning unknown
1287177795 The last time the page was visited

Remember though all of this can be different if the system deletes the cookies or the user runs an application that cleans the cookies out.  Also, it is all relative and depends on system and user behavior and when and how many times they have visited a particular site.

You can also go to find out more about the description of the cookies http://code.google.com/apis/analytics/docs/concepts/gaConceptsCookies.html#cookiesSet

Google Analytics can set four main cookies on the users machine:      

__utma Unique Visitors
__utmb Session Tracking
__utmc Session Tracking
__utmz Traffic Sources

Optional cookies set by Google Analytics:

__utmv Custom Value
__utmx Website Optimizer

Google Analytics creates varying expiration times for its cookies: 

__utma The information on unique user detection expire after 2 years
__utmz The information on tracking expire until 6 months).
__utmv The information on “Custom Tracking” will expire after 2 years
__utmx The information on the “Website Optimizer” will expire after 2 years
  The information about a current visit (visits) will expire after 30 minutes after the last pageview on the domain.

The original code schema written by Urchin was called UTM (Urchin Traffic Monitor) JavaScript code. It was designed to be compatible existing cookie usage and all the UTM cookie names begin with “_utm” to prevent any naming conflicts. 

Tracking the Urchin- from an investigative point of view

Okay so for some additional new stuff on Google analytics when examining the source code of a webpage. What is the Urchin? Google purchased a company called Urchin who had a technology to do traffic analysis. The technology is still referred in the cookies Urchin’s original names.

When examining a live webpage that contains Google analytics code embedded in the website you will come across code that looks similar to this:

<script type=”text/javascript”><!–var gaJsHost = ((”https:” == document.location.protocol) ? “https://ssl.” : “http://www.”);document.write(unescape(”%3Cscript src=’” + gaJsHost + “google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E”));// –></script><script type=”text/javascript”><!–try {

var pageTracker = _gat._getTracker(”UA-9689708-5″);

pageTracker._trackPageview();

} catch(err) {}

// –></script> 

Search the source code for “getTracker” and you will find the following line: var pageTracker = _gat._getTracker(”UA-9689708-5″); which contains the websites assigned Google analytics account number “UA-9689708-5”. So what does this mean and how can it be of value to me when I am investigating a website? Let’s identify what the assigned number means: 

UA Stands for “Urchin Analytics” (the name of the company Google purchased to obtain the technology)
9689708 Google Analytics account number assigned by Google
5 Website profile number

How can I use this Google analytics number in an investigation? First you can go to http://www.ewhois.com/ to run the UA # and identify the company/person assigned the number.

The reponse you will get is something similar to this:

google analytics

Then run the Google Analytics number through Reverseinternet.com:

urchin

This is a little more of investigative use in that it is showing domains that use the same Google analytics Id, the Internet Protocol addresses assigned to the domains and the DNS servers used by the domains.

Using Reverseinternet.com allows you to identify any webpage where this Google Analytics Id has been embedded in the source code.  This can be of investigative value if the target has used the same Id on more than one webpage they control or monitor. Why would this occur? Google allows the user to monitor data from multiple sites from a single control panel.

So how does Google analytics work?

Google is probably a better place to find this out. You can go to http://code.google.com/apis/analytics/docs/concepts/gaConceptsOverview.html for a complete overview of how it works.

In short Google Analytics java code embedded in the webpage you visit collects information from the following sources when you connect to a webpage:

  • The HTTP request of the visitors browser
  • Browser/system information from the visitor
  • And it sends a cookie to the visiting system

All of this gives the webpage owner the ability to track persons going to their webpage. From an investigative point of view there is a certain amount of exposure due to the browser tracking that occurs and the fact that a cookie is placed on your investigative system. But there is the possibility from examining the page source code to tie the website through the Google Analytics Id to other webpages of interest.

How the bad guys use social media: An interview with Todd Shipley

Monday, February 28th, 2011

Hardly a day goes by when the news isn’t reporting criminal use of social media to find and groom victims, start and fuel gang wars, or exploit other weaknesses. Todd Shipley joined Spark CBC host Nora Young last week to talk about some of these issues, along with how police can use social media to find the activity.

Listen to the 20-minute interview now to find out:

  • How criminals exploit their victims’ weaknesses, along with their own need for social connections
  • The importance of looking beyond the physical crime scene to its virtual extension
  • The social and technical skills police need to document online and other digital evidence before it gets to detectives
  • How online or cloud investigation is similar to network forensics (and unlike computer forensics)
  • What legal requirements police need to abide by when they go online

Got questions about Todd’s interview? Leave us a comment!

DragNet? In what form?

Wednesday, May 5th, 2010

In February, CNet reported that police are looking for a “back door” to private data, in the form of “a national Web interface linking police computers with those of Internet and e-mail providers so requests can be sent and received electronically.”

This was followed up in April by a revelation that the Department of Justice had requested Yahoo emails without a warrant—because the emails were older than 180 days and stored on Yahoo servers rather than on a local machine.

Civil libertarians, of course, regard these stories as evidence of Big Brother manifesting all his totalitarian glory. But the original concept of a national network, says its originator, has been misrepresented.

More efficient, not more invasive

Sgt. Frank Kardasz is director of the Phoenix (Arizona) area Internet Crimes Against Children task force and, in a report to the Commerce Department’s Online Safety and Technology Working Group, wrote about the need for Internet service providers (ISPs) at least to maintain records for longer than the few weeks they currently do—up to a year or longer.

“The trouble with real life policing is that there are reporting delays from victims, overwhelming caseloads for detectives, forensics analysts and prosecutors, time delays or no response from Internet service providers and many other systemic issues that impede the rapid completion of our work,” he wrote in his report, “Internet Crimes Against Children and Internet Service Providers: Investigators Request Improved Data Retention and Response.”

Similar problems exist among government agencies, which is why Los Angeles County instituted the Electronic Suspected Child Abuse Report System. The Web-based system links public agencies together, replacing outdated forms of communication like faxes and postal mail, and reducing the likelihood that charges will be dropped or reduced due to missing evidence.

Not a direct link from law enforcement to private records, it doesn’t carry quite the same implications for privacy. It does, however, solve very similar problems, and as the first of its kind in the country, could easily serve as a model for other efforts.

Logistical concerns

The need for a strong model is particularly important when it comes to security. Many companies have hesitated over moving to “the cloud,” fearful of what might happen if a malware-infected PC accessed cloud-based private information. (Many of these issues are discussed in our white paper, “Basic Digital Officer Safety.”)

However, the U.S. Army is now using “milBook”, a secure Facebook-like interface restricted to its own personnel. Connecting people with each other as well as with defense-related topics, milBook facilitates the sharing of a broad range of information. Fundamentally, it might be compared to the Regional Information Sharing System, though more socially oriented.

Whether this would be as easy to set up is debatable, however. The Army, after all, has the DoD to administer its private network. For the DOJ to set up and maintain a public-private information exchange would not, to put it lightly, sit well with groups like the Electronic Frontier Foundation.

More likely may be for the DOJ to require ISPs to set up their own networks. Some already do, as CNet pointed out. The networks would have to comply with certain requirements regarding data storage and speed of retrieval, but the companies would retain control of user information.

The need for better ISP support

Kardasz noted, based on a 2009 survey of 100 investigators:

  • 61% reported ISP delays and limited time periods for storage detrimentally affected their investigations.
  • 47% reported they had to end investigations because the ISP didn’t retain the data they needed to make a case.
  • 89% wanted to see a national network established to make legal process requests more efficient.

“Investigators recognize that the subject of data preservation is controversial,” Kardasz wrote. “I think investigators respect the Constitution, support the rights of Commerce and simultaneously want to protect citizens from cybercrime. They seem to be asking for a system that is more efficient, not more invasive, a system that favors the crime-fighters instead of the criminals.”

What law enforcement can do

In last month’s issue of Law Enforcement Technology, Vere president and CEO Todd Shipley was quoted as saying, “It’s not just a federal problem. It’s a state and local problem too because the victims are citizens of the local community.”

So while ISPs can improve their processes, so can law enforcement. Todd’s recommendations: Know how to take reports on cyber crimes. Collect information the cybercrime experts need. Know how to share information and with whom. These pieces, the building blocks of professional police response, must be in place so that whatever ISPs institute to help law enforcement, it will be supported rather than criticized.

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and digital forensics and can be reached at christa at christammiller dot com.