Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Virtual Forensics Lab Steve Kim (Client) Marilyn Silva Rajeswari Ian Anu Nagpal Anthony Glover 1 Overview CASE STUDY An actual NYPD criminal case helped motivate this work. A person, let's say Sam, was contacted on a Social Network, and decided to go to meet this other person. The other person's intent was to rob Sam. In attempt to escape, Sam ran into the street and killed by on-coming traffic. This then became a homicide case. SOLUTION Developed security software tools, which can be used within Social Networks, to help in tracking down criminals. OBJECTIVES Retrieve user’s non-personal-identifiable data, during users Contact via the following Virtual environments: Social Network Sites Chat Sessions E-mail Website (Developed in Java) Virtual Forensics 2 Topics Technology Used Chart Social Network Site Data Retrieval using - PHP Scripting Detecting Device Type Detecting Mobile Device Model IM Chat Session E-mail MAC Address Retrieval – Using Java Applet Future Enhancements Virtual Forensics 3 Technology Chart Data Retrieval Virtual Environment Virtual Environment Examples Technology/ Techniques Social Network Site MySpace FaceBook Hidden PHP scripts into Social Network Page API. SQL for Database storage IM Chat Session MSN chat session Yahoo chat session E-mail Hotmail email Yahoo email View emailed messages’ source code, to see IP address information. Website Custom developed Java Website, used as an early project phase work-around. Java Virtual Forensics Real-time MS-DOS prompt NetStat (Network Statistics) commands. Java Applets 4 Social Network Site Data Retrieval PHP Scripted Web Site: http://www.virtualforensics.net/track.php Tracks the visitors to website Can be integrated for use in tracking Social Network Site visitors. Captures information of visited users Stores retrieved user data to database Appends retrieved user data to website for on-screen view Social Network Tracking – SETUP PROCESS Place the data retrieval PHP web link, into an image source tag syntax <img src="http://www.virtualforensics.net/track.php" border="0" style="visibility:hidden;" /> Place above source tag into “Headline” section of your MySpace or FaceBook: Virtual Forensics 5 Social Network Site (cont.) Data Retrieval The captured user data is stored to a database, and appended to list of visitors already in database. All tracked visitor information is then retrieved from the database logs, and displayed to following link for on-screen viewing: http://www.virtualforensics.net/ Listing of Social Network Site user’s retrieved data: Visitor entry from database, for viewing on web Virtual Forensics 6 Social Network Site Detection of Device Type PHP Scripted Web Site: http://www.virtualforensics.net/mobiledetect/detect.php Detects the type of device used to login (PC, Mobile, etc) Virtual Forensics 7 Social Network Site (cont.) Detection of Mobile Device Model PHP Scripted Web Site: http://www.virtualforensics.net/mobiledetect/detectmobile.php Detects the Mobile Model (Blackberry, I-Phone, etc) Virtual Forensics 8 Java Applet MAC Address Retrieval MAC address If assigned by the manufacturer, a MAC address (Media Access Control address ) encodes the manufacturer's registered identification number Display of retrieved user’s MAC address retrieved Virtual Forensics 9 IM Chat Session Data Retrieval NetStat Is a command which retrieves other person’s IP address & MAC address of person you are chatting with. MS-DOS prompt type the following command and press enter: NetStat –n 3 IP address of Local Machine and Foreign Machine Virtual Forensics 10 IM Chat Session (cont.) Data Retrieval IP address on the left hand side, 172.22.45.77 (see Figure 1) represents your IP address. The IP address on the right hand side, 172.22.47.248 (see Figure 1) represents the IP address of foreign machine. The 4 digit value following each IP address represents the port to which it is connected to. You can connect to the foreign IP address by typing the following command. From the MS-DOS prompt type the following command: C:\>nbtstat -A 172.22.47.248 the output Virtual Forensics 11 IM Chat Session (cont.) Data Retrieval On figure from previous slide (slide 10), the 172.22.47.248 represents the foreign machine’s IP address. This entered command will output the values of: o Node o IP address o NetBIOS o Remote Machine Table o MAC address of Foreign Machine Virtual Forensics 12 E-Mail Data Retrieval Retrieve email sender’s IP address, by following below steps. Within a yahoo email account do as follows: Go to inbox Open your email Click the drop down for Standard Header (see figure 3) Click Full Header from the Standard Header’s drop down (figure 3 on next slide) Dialog box with the IP information appears RESULTS: The sender’s IP address will appear in dialogue box. (Continued on next slide to view) Virtual Forensics 13 E-Mail (cont.) Data Retrieval Virtual Forensics 14 E-Mail (cont.) Data Retrieval IP address is 198.105.45.132 Virtual Forensics 15 Future Enhancements Assigning the Java applet used to identify the Mac address of the client to the website Retrieving the User Name of other user accessing the monitored Social Network page Expand on fields to be retrieved during email communication. Virtual Forensics 16 The End Thank you! Virtual Forensics 17