This week's edition of Case Leads features updates to a popular network scanning tool and another application which may be useful in gaining access to encrypted documents. We also have an article detailing a recent attack against a website and a couple of papers that look at attack trends. There's news that hard drives could approach 60TB and a report that a popular paste site will change its approach in how it manages sensitive content.
As always, if you have an item you'd like to contribute to Digital Forensics Case Leads, please send it to caseleads@sans.org.
Tools:
- Nmap 6 has been released. In addition to improvements in web scanning, overall scanning speed and the scripting engine, this popular scanner now fully supports IPv6.
- Passware released Passware Kit Forensic 11.7 which includes memory capture and analysis for recovering various types of encryption keys. The software acquires the memory image over the Firewire port and focuses on identifying artifacts which enables the decryption of numerous types of files and storage.
Good Reads:
- Dissecting a Hacktivist Attack. Imperva has a write up that explains the compromise of militarysingles.com through the use of RFI (Remote File Inclusion.)
- Email attack trends for Q1 2012. Based on data collected by FireEye for the first quarter of 2012, an organization is more likely to be attacked during the middle of the week than on weekends.
- Advances in technology could push hard drive capacities to 30 - 60TB in a few years. By 2016, technology such as Heat Assisted Magnetic Recording (HAMR) should help double the areal density of drives making it possible to produce 3.5-inch drives up to 60TB and laptop drives in the 10 - 20TB range.
News:
- Pastebin plans to filter posts related to hacking. Pastebin is a popular site used by hacktivists and those who monitor hacktivist's activities.
- Dutch Military takes an interest in cyber warfare and espionage. They also released an annual report (in Dutch) on their findings.
Levity:
- Photoshop fail - "floating" government inspectors.
- Incident response and diapers (video) have things in common.
Coming Events:
- Techno Security 2012 Myrtle Beach, SC - June 03 - 06, 2012
- Mobile Forensics Conference - Myrtle Beach, SC - June 03 - 06, 2012
- 27th IFIP International Information Security and Privacy Conference - Heraklion, Crete, Greece - June 04 - 06, 2012
- Audio Engineering Society Audio Forensics - Denver, CO - June 14 - 16, 2012
- 24th Annual FIRST Conference - Malta - June 17 - 22, 2012
- Sans Forensics and Incident Response Summit - Austin, TX - June 20 - 27, 2012
- SANS Canberra 2012 - Canberra, Australia - July 2 - 10, 2012
- SANSFIRE 2012 - Washington, DC - July 6 - 15, 2012
- Symposium On Usable Privacy and Security (SOUPS 2012) - Washington, DC - July 11 - 13, 2012
- BLackhat USA - Las Vegas, NV - July 21 - 26, 2012
- DEF CON 20 - Las Vegas, NV - July 26 - 29, 2012
- Sans San Francisco 2012 - San Francisco, CA - July 30 - Aug 06, 2012
- DFRWS 2012 Conference - Washington, DC - Aug 05 - 08, 2012
- SANS Boston 2012 - Boston, MA - Aug 06 - 11, 2012
- USENIX Security '12 - Bellevue, WA - Aug 06 - 10, 2012
- 7th USENIX Workshop on Hot Topics in Security (HOTSEC '12) - Bellevue, WA - Aug 07, 2012
- 2012 Malware Technical Exchange Meeting (Security Clearance Required) - El Segundo, CA - Aug 14 - 16, 2012
- 7th ARES conference (ARES 2012) - Prague, Czech Republic - Aug 20 - 24, 2012
- First International Workshop on Security Ontologies and Taxonomies (SecOnT 2012) - University of Economics, Prague, Czech Republic - Aug 20 - 24, 2012
- SANS Virginia Beach - Virginia Beach, VA - Aug 20 - 31, 2012
- SANS Crystal City - Arlington, VA - Sep 06 - 11, 2012
- European Symposium on Research in Computer Security - Pisa, Italy - Sep 10 - 12, 2012
- 15th International Symposium on Research in Attacks, Intrusions and Defenses - Vrije Universiteit, Amsterdam, The Netherlands - Sep 12 - 14, 2012
- HTCIA International Conference & Training Expo - Hershey, PA - Sep 16 - 19, 2012
- SANS Network Security 2012 - Las Vegas, NV - Sep 16 - 24, 2012
- VirusBulletin 2012 - Dallas, TX - Sep 26 - 28, 2012
- GrrCon - Grand Rapids, MI - Sep 27 - 28, 2012
Call For Papers:
- DEF CON 20 - Due May 28, 2012
- First International Workshop on Cyber Crime - Due May 31, 2012
- Grrcon - Due June 01, 2012
- Applied Computer Security Applications Conference - Due Jun 01, 2012
- 4th International Conference on Digital Forensics & Cyber Crime - Due Jun 01, 2012
- 2012 International Workshop on Computational Forensics Due Jun 08, 2012
- Third ICST International Conference on Digital Forensics and Cyber Crime - Due Jun 12, 2012
- The Evidence Conference - Due Jun 15, 2011
- IEEE International Workshop on Information Security and Forensics - Due Jun 24, 2012
- International Computer Science and Engineering Conference - Due Jun 30, 2012
- DoD Cybercrime Conference 2013 - Due July 6, 2012
- 7th International Conference on Legal, Security and Privacy Issues in IT Law - Due Aug 25 , 2012
- 2012 secau Security Congress - Due Sep 30, 2012
Digital Forensics Case Leads is a (mostly) weekly publication of the week's news and events relating to digital forensics. If you have an item you'd like to share, please send it to caseleads@sans.org.
Digital Forensics Case Leads for 20120525 was compiled by Ray Strubinger. Ray regularly leads digital forensics and incident response efforts and when the incidents permit, he is involved in aspects of information security ranging from Data Loss Prevention to Risk Analysis.