Full Disclosure mailing list archives
Re: Help put a stop to incompetent computer forensics
From: James Tucker <jftucker () gmail com>
Date: Wed, 10 Aug 2005 10:55:23 +0100
On 8/10/05, Jason Coombs <jasonc () science org> wrote:
"An experienced computer forensics person could tell you whether it was because of [a Trojan virus] or not." -- Marcus Lawson.
As you know, typical.
This quote and article citation below concerning "computer forensics" is typical of the opinion of "computer forensics" professionals. We know it's a big fat lie told by self-important people who don't know anything about information security
I understand your upset with regard to this sort of stupid comment, but I think you'd find you get a much more serious response if you simply dump sentences like that. Insults aren't necessary - people that know will already be sufficiently aware of it.
and have never written software in their lives, but I'm asking anyone who reads this, who has ideas about how to put a stop to this "computer forensics" absurdity where people who don't know how software is written and don't understand infosec are allowed to be the voice of "computer forensics" expertise in court, to please contact me.
Simple - create a program which distributes random programs and data accross the internet and picks data/applications to execute at random.
From then on, one can make absolutely no solid judgement about ANY
information found on the machine, except by physcial inspection of that data and it's paths, which is predictive and circumstantial anyway due to a lack of support under law in most countries.
In addition, anyone who has any information about computer forensics professional Marcus Lawson please contact me immediately.
Why dig up dirt, just explain professionally why his actions are incorrect. If you wanted you may be able to approach him under a lawful banner with regard to submitting false testement or evidence.
The fact that malware authors aren't cooperating with the computer forensics industry by making sure that it's easy to distinguish between the actions of malware and the actions of a human computer user, combined with uninformed expert opinions like those shown below, is resulting in innocent people being put behind bars, and people like Marcus Lawson who think they know what they're doing but clearly do not are helping to get innocent people convicted by spewing nonsense.
Innocence is always subject to bias, as is everything else. Whilst Lawsons statement above, in the general sense is very much incorrect, the specific circumstances may allow for such a statement to be made. There are many malware which simply do not perform complex or confusing operations and can therefore be very easily analysed to be (mostly) sure that the malware was not responsible for the data in question. Logs may indicate a users physical presence which will increase again the circumstantial evidence. It is and always will be hard to make an accurate judgement for a court in such a scenario. As an industry we should be providing statistical figures to back up any claims which need to be made. If a user has booted a machine and started printing fake bank notes out of the printer five minutes later, having edited the images with some large image manipulation program, it's really unlikely that the multitude of malware on the machine could have contributed to his crime. Nevertheless if the malware has touched any of the files on the local system, a computer scientist may claim that we have no way of proving the user was responsible - that is until the CCTV camera footage is presented. In this field more than others, one must take circumstance with a pinch of salt, and be very clear about what you DONT know.
This undermines the ability of the criminal court system to convict those who are truly guilty, and keep them convicted on appeal.
Bring on physical data analysis, thats all I have to say about that.
Somehow we need to fix this broken system and insist that all computer forensics be performed with the help of a competent information security professional, at the very least.
Infosec is now such a large industry that as with most of the rest of the computer industry, no one man can cover even a few percentiles of the total spread of technologies. This makes qualification very difficult. The best solution (and one which is becoming more common worldwide) is to use highly practiced and well trained police officers as forensics staff.
Any other suggestions?
Yeah, next time lets claim it was the FBI's trojan, and they're starting a big conspiracy trying to frame us all.
Sincerely, Jason Coombs jasonc () science org http://edition.cnn.com/2003/LAW/08/12/ctv.trojan/ Though it raises new and important issues, say industry sources, the Trojan Horse problem won't likely mint a new defense strategy: It's just a riff on the standard "not me" defense. "There are a lot of child porn defendants who say, well, somebody else might have done it," said the EFF's Tien. "But it doesn't fare very well, for obvious reasons." In the end, experienced computer forensics investigators should be able to tell whether the computer's owner, or a Trojan Horse, spawned the material in question. "You wouldn't want to just throw that out there as your defense," said Marcus Lawson, a computer forensic analyst who testified in the trial of convicted child rapist and murderer David Westerfield. "An experienced computer forensics person could tell you whether it was because of [a Trojan virus] or not." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Help put a stop to incompetent computer forensics Jason Coombs (Aug 09)
- RE: Help put a stop to incompetent computer forensics Christopher Day (Aug 09)
- Re: Help put a stop to incompetent computer forensics Technica Forensis (Aug 10)
- Re: Help put a stop to incompetent computer forensics James Tucker (Aug 10)
- Re: Help put a stop to incompetent computer forensics trains (Aug 10)
- Re: Help put a stop to incompetent computerforensics Greg (Aug 10)
- RE: Help put a stop to incompetent computer forensics Christopher Day (Aug 09)