Computer Image Verification and Authentication

1. Special Needs of Evidential Authentication *****

During an investigation, it is decided that evidence may reside on a computer system. It may be possible to seize or impound the computer system, but this risks violating the basic principle of innocent until proven guilty, by depriving an innocent party of the use of his or her system. It should be perfectly possible to copy all the information from the computer system in a manner that leaves the original system untouched and yet makes all contents available for forensic analysis. The courts may rightly insist that the copied evidence is protected from either accidental or deliberate modification and that the investigating authority should prove that this has been done. Thus, it is not the content that needs protection, but its integrity. This protection takes two forms: A secure method of determining that the data has not been altered by even a single bit since the copy was taken. A secure method of determining that the copy is genuinely the one taken at the time and on the computer in question. These elements are collectively referred as the Digital Image Verification and Authentication Protocol.

DIGITAL IDS AND AUTHENTICATION TECHNOLOGY

Without an assurance of the softwares integrity, and without knowing who published the software, its difficult for customers to know how much to trust software. Its difficult to make the choice of downloading the software from the Internet. For example (when using Microsoft Authenticode coupled with Digital IDs from VeriSign), through the use of digital signatures, software developers are able to include information about themselves and their code with their programs. When customers download software signed with Authenticode and verified by VeriSign, they should be assured of content source, indicating that the software really comes from the publisher who signed it, and content integrity, indicating that the software has not been altered or corrupted since it was signed.

Computer Forensics

Unit III Part II

Authenticode
Microsoft Authenticode allows developers to include information about themselves and their code with their programs through the use of digital signatures. Through Authenticode, the user is informed: 1. Of the true identity of the publisher 2. Of a place to find out more about the control 3. The authenticity of the preceding information Users can choose to trust all subsequent downloads of software from the same publisher and all software published by commercial publishers that has been verified by VeriSign.

Public Key Cryptography

In public key cryptographic systems, every entity has two complementary keys (a public key and private key) that function only when they are held together. Public keys are widely distributed to users, whereas private keys are kept safe and only used by their owner. Any code digitally signed with the publishers private key can only be successfully verified using the complementary public key. Code that successfully verified using the publishers public key, could only have been digitally signed using the publishers private key, and has not been tampered with.

Certificate Authorities
Certification Authorities such as VeriSign are organizations that issue digital certificates to applicants whose identity they are willing to vouch for. Each certificate is linked to the certificate of the CA that signed it. VeriSign has the following responsibilities: 1. Publishing the criteria for granting, revoking, and managing certificates 2. Granting certificates to applications who meet the published criteria 3. Managing certificates 4. Storing VeriSigns root keys in an exceptionally secure manner 5. Verifying evidence submitted by applicants 6. Providing tools for enrollment 7. Accepting the liability associated with these responsibilities
Computer Forensics Unit III Part II

8. Time-stamping digital signatures

Digital ID
A Digital ID/Certificate is a form of electronic credentials for the Internet. A Digital ID is issued by a trusted third party to establish the identity of the ID holder. The third party who issues certificates is known as a Certificate Authority (CA). Digital ID technology is based on the theory of public key cryptography. The purpose of a Digital ID is to reliably link a public/private key pair with its owner. When a CA such as VeriSign issues a Digital IDs, it verifies that the owner is not claiming a false identity. When a CA issues you a digital certificate, it puts its name behind the statement that you are the rightful owner of your public/private key pair.

How Authenticode works with VeriSign Digital IDs?

Authenticode: VeriSign Digital ID process

1. Publisher obtains a Software Developer Digital ID from VeriSign 2. Publisher creates code 3. Using the SIGNCODE.EXE utility, the publisher o Creates a hash of the code, using an algorithm such as MD5 or SHA o Encrypts the has using his/her private key o Creates a package containing the code, the encrypted hash, and the publishers certificate

Computer Forensics

Unit III Part II

4. The end user encounters the package 5. The end users browser examines the publishers Digital ID. Using the VeriSign root Public Key, which is already embedded in Authenticode enabled applications, the end user browser verifies the authenticity of Software Developer Digital ID (which is itself signed by the VeriSign root Private Key) 6. Using the publishers public key contained within the publishers Digital ID, the end user browser decrypts the signed hash. 7. The end browser runs the code through the same hashing algorithm as the publisher, creating a new hash. 8. The end user browser compares the two hashes. If they are identical, the browser messages that the content has been verified by VeriSign, and the end user has the confidence that the code was signed by the publisher identified in the Digital ID, and the code hasnt been altered since it was signed. Time Stamping: Because key pairs are based on mathematical relationships that can theoretically be cracked with a great deal of time and effort, it is a well-established security principle that digital certificates should expire.

2. Practical Consideration*
It is useful to present some fundamental requirements of a forensic data collection system before considering how these can be securely protected. Other forensic experts may argue against some or all of them: 1. Forensic data collection should be complete and non-software specific, thus avoiding software traps and hidden partitioning. 2. In operation, it should be as quick and as simple as possible to avoid error or delay. 3. It should be possible for anyone to use a forensic data collection system with the minimum amount of training. 4. Necessary costs and resources should be kept to a minimum. To meet the conditions specified in items 2, 3, and 4, the digital integrity verification and authentication protocol must be tailored to suit. Only investigators issued with a valid digital signature would be able to complete copies.

Computer Forensics

Unit III Part II

3. Practical Implementation****
A minimum amount of reliance is placed on the technical ability of the operator/investigator. It must be understood that during the copying process, procedures are implemented to trap and handle hardware errors, mapping exceptions where necessary. It must also be understood that procedures are implemented to verify that information is copied correctly. This information is stored on each cartridge within a copy series. Also stored on each cartridge is a reference area containing copy-specific information such as CPU type and speed, hardware equipment indicators, copying drive serial number, cartridge sequence number, exhibit details and reference comments, operator name together with a unique password, and the real date and time as entered by the operator. The cartridge is divided into blocks of an arbitrary chosen size. Blocks may contain reference, ROM, CMOS, or disk data depending on their location on the cartridge. Each cartridge contains the information copied from the suspect drive on a sector by sector basis.

Safe Boxes and the Vault

As each block is copied and verified, a hash value is generated such that a single bit change anywhere within the block would produce a different hash. The result is stored in the relevant safe box and copying to the next block. Once all the blocks relevant to a particular cartridge have been copied and treated in this way, the whole group of safe boxes, collectively referred to as the vault, are treated as an individual block and a vault hash value is generated and stored in the final safe box. The vault is then copied to another area of the cartridge and this second copy is encrypted. The vault hash value for each cartridge is stored in a separate area in memory and the operator is prompted to insert a new cartridge until the copy is completed. The final cartridge will contain similar information to the others in the series and in addition will have the accumulated vault hash values from all other cartridges in the series. Once the final cartridge has been copied, the operator is prompted to insert a preformatted floppy disk into the drive used to start the DIBS process. All of the accumulated vault hash values are then written to a floppy disk together with the reference details of the whole copy procedure. At least two identical floppy disks are created in this manner.

The floppy disks are then sealed in numbered, tamperproof bags and both numbers are
written on both envelops. The computer owner is given his or her chosen floppy and the other is placed in secure storage.
Computer Forensics Unit III Part II

Security Considerations
Computer forensics investigators are constantly discovering new vulnerabilities in old image verification and authentication products. As a result CIOs (Chief information Officers) are devoting more money and time to image verification and authentication security. Staff-members are the ones who make sure viruses dont come in and holes arent created in the firewall. They have to understand that most business is built on trust, and their role in maintaining trust is crucial. Its difficult, perhaps impossible, to measure the return on investment in security. You have to protect your data. It only takes one time ---one hacker getting in and hacking all your financial data. It would be irresponsible on CIOs part not have the toughest image verification and authentication security possible.

Source:

COMPUTER FORENSICS: COMPUTER CRIME SCENE INVESTIGATION, JOHN VACCA

Send your feedback to kranthi@kranthi.co.in

Computer Forensics

Unit III Part II