good afternoon everybody how are you
it's cold here in Santander but oh well
let's see what we can do this afternoon
I've already been introduced my name is
emmanuel la guerra I now work for the
technological central investigation unit
further police Spanish police force we
in our unit are in charge of pursuing
persecuting all sort of criminal
activities carried out through new
technologies while selling children's
pornography through the internet fraud
in general for instance fraudulent sales
of houses for instance cars and also
computer attacks and hacking and in
piracy so all these crimes are the ones
that are investigated by our unit but
more specifically I work in a department
called the technical section and we
don't carry out normal sort of
investigations we provide a forensic
analysis support in the case of crime I
always repeat this because right
nowadays any crime present in the
Spanish criminal code includes some
technological component for instance a
drug-dealing crime is there's nothing
digital to it theoretically speaking
somebody is selling their drugs but
there is a cellphone involved
between the dealer and whoever buys the
drug this is digital evidence that needs
to be processed in order to get all the
information maybe that may be useful in
a trial and this cannot be done just any
way it has to be done through a
procedure through a protocol a murder
where there's been a camera involved and
where evidence is stored and this is
what we deal with mainly but going back
in time and going to the past if we
think of a situation 10-15 years ago
for instance when we went into a house
and searched a house maybe we just found
a cellphone but know what's up no
Facebook or even computers than 15 years
ago
you must think was sort of computers you
had 10 or 15 years ago in your house the
your lucky view had one and pendrives
maybe 500 Megas capacity
nobody has such poor capacity pendrives
and the same applies to companies what
happened 10 15 years ago in companies
when winter companies that have been
involved in money laundering for
instance what did we find
when searching his paper paper the only
technology we could find in a company or
an office was the coffee machine now
when we go into a house what do we
normally find when at least we find five
or six cell phones mother's phone
father's phone father
second phone his wife doesn't know about
so lots of evidence lots of evidence
that needs to be checked and processed
when we get to a house the bad guy will
never say yes look in that cupboard and
see what you find so we need to look
into all these devices and gadgets in
order to find evidence and then other
technology things for instance of rather
in order to go into the Internet
when there's a Wi-Fi and this is just a
mini computer that manages the internet
with Wi-Fi it may store MAC addresses or
an ass 10-15 years ago you didn't think
that somebody would have high capacity
storage system at home and right now
having this in the house is more or less
normal I mean it's not something that we
are surprised with and now come all the
gadgets for instance smart some sort of
SmartWatch that can be connected your
iPhone or Android wherever you want to
know your heart beats rate who does have
a SmartWatch raise your hands so
SmartWatch is a digital evidence let's
imagine that all of a sudden a there's a
you see a dead person lying on the floor
with a smut watch wearing a SmartWatch
you can tell when this person died
because if this person was wearing a
SmartWatch obviously when his
stopped beating this would be reflected
than the SmartWatch so you can get lots
of information from a watch and also
Smart TVs sitting at home and I can go
in the net and this mode TV probably has
a webcam and maybe somebody is attacted
and has activated it remotely and has
recorded me on a Saturday night at home
lying on my couch and perhaps I don't
want anybody of you to know what I was
doing lying on a couch in front of a TV
on a Saturday night and so we need to
know who breached my privacy the
refrigerator fridge I'm at home I drink
milk and all of a sudden I run out of
milk and the fridge can purchase or buy
carton of milk and have the milk
delivered in my house the next morning
because knows what my credit card number
is and of course a hacker somebody can
go into my fridge or find out what my
credit card number is of course like
intelligent or smart mirrors of course
anybody would like to get up in the
morning and sitting in front of the
mirror and have the mirror say - you
look wonderful
today so the designer decided to have
SSH without any security or weather
default sort of a cute add mint one two
three four or something very easy so
that somebody could
connected to the bathroom mirror imagine
what could happen if somebody does so
your bathroom so imagine how complex
things and must can become so any sort
of devices got to have this
technological component so we work in
for instance
searches in houses or companies or
offices to get information when it is
fresh information what information want
information so what do we need to do
when we first arrive in the city in the
house of somebody it was the first thing
one must do what's the first thing what
do you think is the first thing we must
do when break into a house now before
cloning what's the first thing we must
do well you must not knock on the door
or ring the bell yes
first we need to get in how can we do
this if we haven't walked into the house
to begin with so if you're if we're
dressed as a policeman and knock on the
door maybe the Uglies will destroy
everything they have in the house all
the evidence where this doesn't always
happen but depending on how nasty the
guy is or how smart maybe he or she will
destroy the evidence so we need to go in
quickly all of the fireworks and
everything but since we are legal police
the government provides us with a series
of elements that allows us to break into
a house in an easy manner such as we
have a master key we have a master key
and this is compatible with most locks
that you see in
houses so this allows us to walk into a
house even if a person inside doesn't
open the door and this is what this
master key looks like hemp weighs 20
kilos of reinforced concrete and it's a
compatible with any luck whatsoever you
may find in this country I'm going to
run a short video clip yes cloning and
hash and this and that and but have you
gone to a house if you don't break into
your house properly you won't be able to
do anything so I'm going to show you
this small video clip now this wasn't it
just a second
allow me
yeah well the master key they trying to
open the door
of course people inside him when I
opened the doors my colleague needs to
break in through the terrace
well the halberd a gun everything a lot
of weights this is a real thing you know
this is a drug-dealing bust what was
happening then well in the house all the
drugs were hidden and every time they'd
hit the door with a master key
they had burnt all the drugs inside
every minute went by there were
destroying drugs so our job has to do
with preventing this from happening
this happens with drug dealing that is
analodjica sort of crimes no digital
component to begin with or in theory
just a chunk or a hashish or whatever
but what happens what's happening
nowadays that is when we break into a
house we found a hard disk inside the
fireplace and for perhaps it's the month
of July and in July there's not that
cold
really imageries why should a fireplace
be going
sim that was happening with drugs and
now they do it with a hard disks simply
burned them at CD you know a hard disk
and of course it was a charge with cell
phones mobile phones this is all wore
with a hole ventilation and they threw
the mobile phone the this ventilation
this is the first thing we need to do in
order to analyze evidence we need to
find it to begin with or else there's no
investigating the evidence we need to
find it there is no evidence there's
nothing
maybe with machine learning we'll get
there but not yet so now that we broke
in we've been able to look at that
evidence that cell phone that pendrive
the hard disk now what now what
obviously we need to process it right
way in order to try and bring this
information before to a judge and that
are a job to bring this evidence to a
judge mobile telephony mobile phones
analyzing mobile phones whatever the
model is it doesn't matter the first
thing is first thing is to get the phone
and by getting the acquiring the phone
I'm not referring to purchasing or
buying the phone or acquiring the hard
disk
people think that we buy the hard disk
from the thieves or the criminals not by
acquiring evidence we refer to capturing
it and we use automated devices such as
the one you see on the screen this is
Kelowna or a cloning device the others
we used to have a hard disk cloning
machines and right now we have this for
mobile phones we connect the cell phone
and it produces an image or replicates
an image of that
a mirror of the mirrors whatever's
inside the phone so these are machines
that somebody's programmed for given aim
so if we want to get information from
the cell phone and if the machine hasn't
been appropriate for this so if the
machine doesn't include the action or
whatever it is we wanted to do
then nothing so this is where the work
of the forensic analysts comes in place
obviously we are this is like
craftsmanship it's not like a piece of
furniture you have at home that's been
done in a factory this is different from
a piece of furniture has been done by
somebody who works would a craftsman
obviously it's not the same to do
automated data extraction from a machine
then if we do it by hand I'm going to
show you an example give you an example
in order to illustrate this and I'm
going to be using the example of what's
up this is data base viewer or reader a
mystery story Punto Devane there was up
this is all the messages we sent via
whatsapp stored in a database that is
called energy as something stored and MS
GSS store so these data are taken out in
order for the analyst to check them but
what if we need to find something that
the automatic machine can't find then we
need to pull it out of the database
and for instance of the there was the
example of mobile phone had been sending
what's up and the person manipulating it
wasn't touching or didn't have the cell
phone in his hand it's like if you have
this phone over on sitting on the table
and on the table and nobody's touching
it but it's sending out what's up
automatically so some weeks ago some
weeks before we investigated this
whatsapp web had just come out a few
weeks before so somebody was sending
what's ups from a computer if you see
this and this on this column right here
detail there's the thing I'm
highlighting in green if we select it
you see that these three cells this one
and the one underneath they all begin
with three eb0
so what's up inserted this 3 eb 0 code
every time somebody sent a watch shop
through whatsapp web unlike regular
what's up but if i send it with whatsapp
web link to the telephone it will insert
this clue this key fine when what's up
web nobody knew so we had to do all this
reverse engineering in order to see what
sort of password this what's up
web carried whether in this case is is 3
EB zero saying you may tell me what you
said perhaps the conversation could have
been manipulated somebody people asked
us this yes manipulating database
circulate is not easy so I need a series
of conditions need to be the
manipulating conversations such as the
one you can see here will leave traces
leave a trail and this does you can tell
whether database has been manipulated or
not for instance when I was a kid I was
in school I was given a netbook a paper
notebook and the teacher would write
down a number on each a page from one to
a hundred why where because maybe when
they started throwing pieces of chalk or
playing around with other kids
the teacher would write a note for my
parents on my notebook saying that I
hadn't behaved so this is why they were
numbered because I could I could have
ripped out a page of the notebook and
the same thing here if we go to this
little bar here we see that the rule
numbered 1 2 3 4 5 6 maybe we could
manipulate the contents of a message but
we cannot inject or put in a
conversation that never took place
and this is extremely complex because
there are many variables at play so it's
not easy to manipulate a what's up
conversations not easy at all
so if you want to know what's up what's
up what's up work next Saturday I will
be given a two hour workshop on what's
up autopsy if you're forensic analysts I
recommend you to attend because I'll
tell you how what's up works and about
all these tricks we're going back to the
beginning of a talk there's a whole set
of mobile devices so what do we do with
all these things let's go to PCs when we
need to extract get information from PC
we see multimedia videos Word documents
we don't do an analysis to see if
there's been some sort of a malware or
how many times has been on or off so
when filtering filtering these data is
enough this sounds silly very simple
that many forensic analysis can be done
simply by filtering documents by
extension but when things become
complicated we study information coming
from the system instance all the
different sites or hits to given a site
but doing analysis of artifacts of a
regular normal computer could take us
here to for instance eighty-nine
thousand items in just one computer
eighty-nine thousand computers or
documents or items that somebody has to
analyze and this is where
the difficult thing is the problem is to
analyze all this information and to tell
the weak from the shed the problem is to
analyze all this information oh there's
another problem and the first forensic
analysis in the cloud you may think that
I may have a confidential information in
my laptop but have you taken away and
you try and analyze that perhaps you'll
find that there's nothing in it
why because everything's in the cloud in
Drive and Gmail whatever Facebook
Twitter or the pictures everything but
in the computer there's nothing the
operating system etc and more and more
we find computers like these it's a
basic computer engine etc etc
everything's in the cloud and accessing
the cloud is a very difficult thing
because series are very complex tasks
must be carried out in order to be able
to go and we have to face every day and
then companies companies what I said at
the beginning that 10 years ago if you
broke into a company or what is your
company there were piles of paper right
now their servers CPD's large data
centers and that's not paper it's a
whole bunch of boxes with many LEDs
lights that make noise so if we need to
break and to
get some servers you put some tape
around the door and nobody walks in
looks very nice for the picture it looks
so great but a server in data processing
center doesn't matter every seal if you
put all this tape around the door
because anybody can break in remotely do
we need to do so obviously we need to
determine what sort of network topology
we are speaking of what I mean by this
we need to know where every why is a hot
tip you see a yellow the top orange and
this is what we normally find this is
what we have to face it is looking like
this this is reality the other thing was
a pretty picture we need to know where
the router is the cetera whoever set it
up it is extremely difficult to go in
using the master key I showed you before
we can actually violate a security door
of this CPD but the logical security is
more complicated if it has firewalls or
encoded systems etc then the hypervisors
that they can use in the past each
server had one OS H now they are all
almost virtual sigh tricks is not the
same as hyper-v or any other brand they
don't work the same way and we need to
know how each of them works in order to
extract the information we need we
cannot lose all the information that we
virtually have just because someone
pushed a button
the W a and the Internet it is risk to
leave things connected to the Internet
but to disconnect is also a risk
something we need to take into account
what about the backup systems sometimes
people say you have everything you want
everything you ask for is in this backup
tape now there is no human way possible
to read it because nobody's touched it
for 20 years that is impossible that is
unfeasible this is the kind of thing
that we cannot accept today you cannot
bring us a backup tape that is
unreadable nowadays so all these
complications together make things very
hard and then there is a famous red
button who's heard of the red button
before please raise your hand who's ever
seen a red button in reality have you
ever seen a red button in reality ever
in your life in either I've never seen
such a button we hear about it from the
media that the bad guys have a red
button when they push it the hell is
coming fire flames everywhere I've never
seen it but what I've seen many times is
remote administration systems in a data
center the administrator is not in front
of the server with the scorching heat if
you've ever been into a data center you
will know that is not pleasant to be
there the administrator is sitting in
his wonderful chair with five different
screen wonderful keyboard and a coffee
machine next to him a comfortable place
and they connect to the server remotely
in whichever way has been enabled that's
what we need it doesn't matter if we go
to the data center we tape it all around
if the administrator is five floors
above us and is constantly deleting
files this
kind of details need to be considered so
there are no red buttons but there are
security measures in data centers what
is weird in this picture you rabbits
please don't speak you know but the rest
what Josep you not entitled to speak
here but what do you see here what is
weird about this picture the box yeah
what is in the box don't stay there what
is that box but black well you cannot
see it but this black thing on the left
is a 12 volt battery that is inside this
white box inside the white box a
pressure switch this was covered by a
plate
when this plate is uncovered the circuit
places the pushes goes off and twelve
bolts of power go to the hard-disk and
what happens in this case
well the hard-disk won't go faster at
least that what happens is more similar
to fireworks so we have a top-notch
security and Technology a device which
is a piece of rope that we would use to
manipulate and avoid this trap from
happening so this is what it was all
about when someone would remove the
plate this is what happened
these look like small things but these
small things can ruin an entire
operation this is what I was saying
before the law is with us and I'm
serious now
the Spanish criminal law says that
system administrators in a company are
forced to collaborate with judges or
police forces in order to provide
information regarding the system network
topology and all the things I
talked about and when I talk about the
system administrator I mean the person
who is actually working in house I'm not
talking about researchers so this is
what we usually call an administrator a
system administrator well the system
administrator can refuse to speak then
we arrest him
but we don't have the password so we
cannot go in so there are other more
traditional ways in order to obtain
passwords for vaults for lockers etc
this is very very secret but take a look
it is about going beyond maybe we are
burning our brains here trying to obtain
a password and sometimes it's just
sticked on the screen this is no secret
and I'm sure this is no news to you
anyway and to wrap up what is the goal
of our interventions well we try to turn
data into digital evidence and this will
happen when the treatment is correct how
do we enable that correct treatment we
provide data with concrete
characteristics first integrity this
means that it hasn't been manipulated it
hasn't been tampered with if here you
see JJA JJA is what I take to the judge
that is what we call integrity
traceability know where it has gone
through today it's in my hands and
tomorrow it will be in somebody else's
hand and then into somebody else's and
that's the traceability and the
individuality that is to mark each
evidence in a singular way
Sacco isn't if we seize bag full of 50
mobile phones without any numbering or
anything there is no personalization or
singular ization whatsoever so these are
the three characteristics we need to
turn data into digital evidence with
true custody chain if we add a digital
signature md5 sha-1 we are expanding
that custody chain this may sound
strange it's not compulsory to have a
digital signature for every evidence I
will explain it later on what I wanted
to say here the point I wanted to make
was to explain the theory of the
poisoned tree what is the theory about
if I have an evidence and if I have
obtained more information out of that
evidence but if the first evidence was
obtained irregularly or illegally or
inadequately that evidence and all the
information I can take from that
evidence evidence will be invalidated
that's why we need to treat digital
evidence in an adequate manner from the
very beginning if we've made any mistake
at the moment of seizing it we are we
are wasting our time because the custody
chain is broken
the tree is poisoned so how do we avoid
this with the custody chain the pen
drive needs to be safeguarded in a bag
with a tag so that it is traceable and
we have to identify the custodians of
the time it's as simple as that
and of course the labeling of digital
evidence needs to be perfect here you
can see a black computer a pair of
sneakers and many other objects do you
think they are correctly labeled do you
think that these digital evidence are
correctly labeled please raise your
hands if you think this is correct
nobody thinks it's correct who believes
this is incorrect incorrectly labeled
this is a mess and the ones who don't
raise their hands is because it comes
from Galicia
as myself well then they are right
because the right answer is it depends
it depends on the kind of crime we are
investigated for example if these
evidence come from a car hijack or a car
theft that beer can the tobacco packs
etcetera if these objects were stolen
from a car these are these are solid
merchandize they are no digital evidence
and we don't need to guarantee the
custody chain of the data they have the
data belong to the person who's been
stolen so we need to label these objects
but not as digital evidence that's like
for example burgled at home and they
still my TV set from home or if my car
is stolen it depends on the crime that
we are investigating if it's a normal
evidence not a digital one we don't have
to label it necessarily I understand
it's I know that it's difficult to
understand but it's not that complicated
so it depends on the kind of evidence it
is a sensei and here is my portable
phone it is connected to 3G 4G or
whatever and imagine I made
and my police fellows arrest me and they
take my phone from me put it into a bag
they tape it it is signed by five
different people and they do many things
do you believe that this has been
correctly labeled no because the phone
is on and it's covered so it's useless
to have it inside a sealed bag if
somebody from the outside can connect to
it and delete all the contents inside
this will be nothing but a seized stone
so we need to take care of these tiny
details so we can use the aircraft mode
on the phone in order to avoid
manipulations on the evidence and any
procedures that we perform on the phone
shall be registered in writing for
example this phone went into the phone
mode this day and at this time then the
bag that we use has metallic thread so
any device that goes inside the back
loses its coverage because radio
frequency is inhibited so the mobile
phone is without coverage there is a
problem if I use one of these bags the
mobile doesn't have a coverage but
Mobile's are designed to be covered at
all times so they would use their
antennas at their maximum you know that
you gain that coverage that way they
will use more and more electricity and
with made things worse because the more
while would have gone off in five hours
say and now it's going to go off in 40
minutes
so what we do is use an external battery
to avoid that this is the thing that we
have to bear in mind if we don't keep
that in mind we may see as a portable
phone and it may be shut down what about
the pen droids these flash drives if I
have a flash drive and I well this is a
digital evidence by the way so if I hook
it up to a laptop or a desktop computer
windows it's going to write on the USB
unit if Windows writes on that unit we
are slightly altering that unity the
theory of the poison tree I talked about
the evidence is useless if we need to
analyze a flash drive we need to do it
correctly how when the flash drive is
connected to the computer the computer
needs to be configured in read-only mode
this is something that we can do with
software or with the modification of
keys so from that moment on every device
we use will work and read only mode only
so if we try to rename a file or do
anything on the unit we want to be able
to because we are in read-only mode it's
true that the forensic analysis systems
are configured this way and if on a
later stage we want to do something
about that there's that flash drive we
can do it but we don't have to rush
because sometimes if we stick that flash
drive in our computer and it's not in
read-only mode we are in trouble in
Windows usually when we run a programmer
software in order to avoid overriding
the antivirus
sometimes blocks that software and when
we believe that that we are covered we
aren't because the autorun feature
popped up how do we avoid this with
Hardware blockers this is just a device
that acts as a bridge between the
computer and the units we want to
connect and it's all protected against
writing no matter how our computer is
set up it is impossible to manipulate
that evidence I've used the yellow one
because it's the most noticeable one
they have some sort of switch that can
change from read-only to writable modes
they have this pin as I said just buried
and mine so to wrap up if we've
adequately treated all the digital
evidence as we have said we can go to
the judge and provide evidence that is
totally valid for a trial that can be
considered by the judge in order to
dictate sentence based on evidence that
have been taken correctly and this is
our purpose
Ari Gold provide evidence and data
objectively and validly so if we go that
far we've really walked a long way this
was on my part I hope I wasn't too
boring it's been a real pleasure to tell
you a little bit about our work our
difficulties and how we overcome them so
my pleasure thank you very much
you