News from 2008
Asking the Right Questions: Forensic Analysis of Data, or How to Make BlackBerry Data Hearsay
Abstract
Tutored by television crime dramas, many people have come to assume that electronic information is always what it appears to be on its face. This is, in fact, the forensic version of a longstanding tendency that people have to believe anything that comes from the computer, no matter how absurd.
We will consider a brief history of the forensic analysis of data, showing what is and is not possible with various types of electronic information. Drawing from our own practice in high-stakes criminal and civil adjudication, we will illustrate the difference between knowledge and understanding—and how failing to recognize the difference can prove disastrous.
In the second half of this presentation, we focus on the forensic analysis of mobile devices, with particular emphasis on BlackBerry devices. We will present for the first time original research undertaken at Interhack and perform a demonstration showing how standard forensic tools, including Secure View and Paraben, will fail to detect implanted and backdated data in BlackBerry devices.
Appearances
- December 12, 2008—Cleveland, Ohio chapter of Infragard
- This meeting is open to the public.
- February 25, 2009—Central Ohio chapter of Infragard
- This meeting is open to the public. It will be held from 9:00AM-12:00PM at Highlights for Children, 1800 Watermark Drive, Columbus, Ohio 43215. Please RSVP if you would like to attend.
Schedule This Program in Your Organization
Interhack delivers presentations for CLE and CJE credit. If you would like to schedule this or another Interhack presentation in your association or law firm, please us for rates and availability.
About InfraGard
Information about the mission of InfraGard can be found at www.infragard.net.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.
Established in 2000, Interhack Forensic Computing helps in-house counsel, incident response teams, law enforcement agencies, and law firms establish facts that can be used in litigation or criminal prosecution.
Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Using Information to Focus Resources: When, Why and How to Use Computer Experts
Interhack's founder Matt Curtin and Senior Analyst Lee Ayres present Using Information to Focus Resources: When, Why and How to Use Computer Experts at the Columbus Bar Association on December 9, 2008. See the CBA Calendar of Events to register for this session.
Abstract
Major litigation can result in significant cost and can also pose significant risk. The volume of electronic data produced can overwhelm a litigation team, and evidence not in traditional "document" form may remain untapped due to a lack of understanding of how it may be used.
Limited resources need to be deployed where they will be most effective. With ability to examine data in addition to the usual documents and their custodians, computer experts can help litigators understand how to use the resources available to them. How should the information be managed? How can litigators know what's really possible and defensible when a producing party claims that the information cannot be used a particular way? How do producing parties live up to their legal and ethical obligations without giving the keys to the kingdom to requesting parties?
After naming types of data that may be relevant to litigation, the presenters will discuss examples of important cases that included consulting and opinion rendered by a computer expert. These case studies will highlight the value that a computer expert can bring to a litigation team. Finally, they will discuss why, when, and how to retain and make use of a computer expert.
Schedule This Program in Your Organization
Interhack delivers presentations for CLE and CJE credit. If you would like to schedule this or another Interhack presentation in your association or law firm, please contact us for rates and availability.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.
Established in 2000, Interhack Forensic Computing helps in-house counsel, incident response teams, law enforcement agencies, and law firms establish facts that can be used in litigation or criminal prosecution.
Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
e-discovery and public records requests
Interhack founder Matt Curtin will lead a discussion about e-discovery and public records requests on December 5, 2008 at a monthly peer group meeting of CIOs and IT Directors organized by the City of Delaware, Ohio. He will focus on management and preparedness for such large-scale document requests and how to use experts to your advantage before the time comes.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.
Established in 2000, Interhack Forensic Computing helps in-house counsel, incident response teams, law enforcement agencies, and law firms establish facts that can be used in litigation or criminal prosecution.
Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Electronic Evidence in Criminal Defense
Interhack founder Matt Curtin and Specialist Chris Shiflet present Electronic Evidence in Criminal Defense to the Columbus Bar Association on November 20, 2008. See the CBA Calendar of Events to register for this session.
Abstract
As crime goes high-tech, criminal investigation, prosecution, and defense must follow. In 2005, a high school senior was charged with a variety of crimes ranging from a second-degree felony to a first-degree misdemeanor; conviction could have radically changed the honor student's life, sending him to prison instead of the university. Fundamental to the case was what was on his computer and how it got there.
Matt Curtin served as a forensic computer scientist for the defense, making a critical examination of the data in question and of the investigator's analysis and conclusions. Because the case was handled as a juvenile proceeding, identifying details have been withheld but all other details are quite real.
After Curtin's analysis, a deal was reached with prosecutors that resulted in all charges being dropped, allowing the young man to proceed with his education.
This presentation is designed specifically for attorneys with little or no experience with computers. Important technology terms and concepts will be explained and applied. Relevant case law will also be considered, showing how courts have interpreted the application of technology. Although this presentation's legal context is criminal, the discussion of information technology will also apply in principle to civil matters.
Schedule This Program in Your Organization
Interhack delivers presentations for CLE and CJE credit. If you would like to schedule this or another Interhack presentation in your association or law firm, please contact us for rates and availability.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.
Established in 2000, Interhack Forensic Computing helps in-house counsel, incident response teams, law enforcement agencies, and law firms establish facts that can be used in litigation or criminal prosecution.
Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
When to Hire a Computer Expert Witness
Interhack founder Matt Curtin and Specialist Chris Shiflet present When to Hire a Computer Expert Witness in a continuing legal education course for attorneys.
Abstract
Experts are becoming increasingly involved in the litigation process. Beyond traditional expert testimony, expert consultation with litigators has become vital in what were once simple phases of litigation, including those now complicated by advances in technology.
A prime example is the complexity introduced by electronic discovery. Case after case demonstrates that when attorneys fail to cope with the additional technicalities, severe consequences can result, ranging from sanctions to adverse inferences and worse.
This CLE event will explain how experts can be used in litigation, both as consultants and for testimony. It will include interactive examples taken from the practice of a forensic computer scientist, and will help practitioners to understand when an expert can be most effective in furthering a case. It will also explain how discovery rules differ when experts are used in different roles.
Appearances
- November 14, 2008—Columbus Bar Association
- See the CBA Calendar of Events to register for this session.
- January 21, 2009—Warren County Bar Association
Schedule This Program in Your Organization
Interhack delivers presentations for CLE and CJE credit. If you would like to schedule this or another Interhack presentation in your association or law firm, please contact us for rates and availability.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Using a Taxonomy to Analyze Recent Data Losses
Abstract
Malicious hackers tend to steal headlines, but do their stories correlate to the threats that are most prevalent in your industry? Reviewing a selection of publicized security incidents from 2005–2007, Lee proposes a taxonomy of breaches based on the concept of the threat/vulnerability pair. He explores the proportion of incidents of each type in several broadly defined industries, followed by analysis and discussion of effective technical, procedural, and administrative controls. The data and analysis can assist business leaders to make informed decisions about the distribution of limited information security assets.
About the I/S Journal
I/S: A Journal of Law and Policy for the Information Society is an interdisciplinary journal of research and commentary, concentrating on the intersection of law, policy, and information technology. I/S represents a one-of-a-kind partnership between one of America's leading law schools, the Moritz College of Law at The Ohio State University, and the nation's foremost public policy school focused on information technology, Carnegie Mellon University's H.J. Heinz III School of Public Policy and Management.
Subscribe to the I/S Journal or contact Interhack to receive a copy of the paper.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Lee Ayres Presents Breach Taxonomy Paper
Abstract
A firm understanding of the rates at which types of breaches occur, in proportion to one another, helps with the distribution of limited security budgets, by helping guide the expenditure of capital to where it will have the greatest impact. A number of sources have been proposed with a view to helping with this decision making. Unfortunately, such sources sometimes tend towards anecdote, might be part of a marketing campaign, or lack the context needed to make truly informed decisions.
Following up on the creation of a taxonomy for the hierarchical classification of data losses, we explored the proportion of breach types in a subset of data losses accumulated by the Identity Theft Resource Center. Using the 2002 North American Industry Classification System (NAICS), we classified breach events according to the industry sector in which they occurred.
We discovered a statistically significant distinction between the types of breaches that occur in several of the industry sectors. The Health Care and Social Assistance sector reported a larger than average proportion of lost and stolen computing hardware, but reported an unusually low proportion of compromised hosts. Educational Services reported a disproportionally large number of compromised hosts, while insider conduct and lost and stolen hardware were well below the proportion common to the set as a whole. Public Administration's proportion of compromised host reports was below average, but their proportion of processing errors was well above the norm. The Finance and Insurance sector experienced the smallest overall proportion of processing errors, but the highest proportion of insider misconduct. Other sectors showed no statistically significant difference from the average, either due to a true lack of variance, or due to an insignificant number of samples for the statistical tests being used.
About the I/S Journal
I/S: A Journal of Law and Policy for the Information Society is an interdisciplinary journal of research and commentary, concentrating on the intersection of law, policy, and information technology. I/S represents a one-of-a-kind partnership between one of America's leading law schools, the Moritz College of Law at The Ohio State University, and the nation's foremost public policy school focused on information technology, Carnegie Mellon University's H.J. Heinz III School of Public Policy and Management.
Subscribe to the I/S Journal or contact Interhack to receive a copy of the paper.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Interhack Sponsoring Ohio Digital Government Summit
Ohio will host the Ohio Digital Government Summit again this year, adding a second day for the Ohio Privacy and Security Summit. Interhack is pleased to support the program as a sponsor. Look for Interhackers Matt Curtin, Lee Ayres, and Chris Shiflet, who will be on hand to speak to executives about the challenges they are experiencing in information management, whether in security or electronic discovery.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Matt Curtin Demonstrates Expert Witness Technique
Interhack founder Matt Curtin plays the role of expert witness in a mock trial played out at the Advanced Science and Technology Adjudication Resource Center (ASTAR) National Judges Science School event, at The Ohio State University in Columbus Ohio, on September 25, 2008.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.
Established in 2000, Interhack Forensic Computing helps in-house counsel, incident response teams, law enforcement agencies, and law firms establish facts that can be used in litigation or criminal prosecution.
Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Interhack's Forensic Computing Practice Grows
Interhack is pleased to announce that Christopher Shiflet has joined the firm.
Chris Shiflet joins Interhack as a specialist, working primarily in the Forensic Computing practice. Using his background in both computer science and law, his work helps technologists to understand requirements of the law, and lawyers to understand the benefits and limits of technology.
Chris graduated with honors from the William & Mary School of Law with a Juris Doctor in May, 2007, and was sworn in as an attorney by the Supreme Court of Ohio in the Spring of 2008.
In addition, Chris holds a Master of Science degree in computer science from the University of California, Santa Barbara. His Bachelor of Science degree is from Arizona State University, from which he graduated summa cum laude. Chris' undergraduate and graduate theses were both on the topic of mobile and wireless networking.
Chris resides in Hilliard, Ohio.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Building a Successful Organization
Interhack founder Matt Curtin shows how cultivating personal humility helps to build successful organizations in a talk entitled Building a Successful Organization, presented to the Capital Square Rotary Club at Athletic Club of Columbus on July 15, 2008.
Abstract
Creating an organization is difficult; to create an organization that is successful is much harder.
One key to excellence is humility in the wake of past successes. Cultivating and displaying a sense of genuine humility makes seeking and accepting constructive criticism less painful. In turn, application of useful advice from others is a great boon to long-term success.
Humility must be cultivated on an individual level. When applied to our own personal "brands," humility moves us to find ways to help one another, and enables us to find success in all our endeavors.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Forensic Computing 101
On July 14, 2008, Interhack founder Matt Curtin speaks to the Dayton Bar Association in Dayton, Ohio on the topic, Tech 101: What Every Lawyer Should Know About Information Technology and E-Discovery.
Abstract
Paper has endured as information technology for millennia, recording and preserving much of the foundation of our societies, and specifically our legal systems. The legal process has developed methods for making sense of information presented on paper documents. Much of the information we have available today, however, is electronic. Adjudication requires an understanding of the technology used to manage information. How is information stored, processed, and transmitted in the electronic information systems of today? How does the Internet support today's information management? What can be learned from forensic examination of information systems?
After dealing with the fundamentals of electronic information and computing technology, Curtin discusses applications from his own experience as a forensic computer scientist. The case studies serve to solidify the audience's understanding of the critical elements of electronic information, and to develop sound intuition on how to make sense of findings presented by experts and technical fact witnesses.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Electrons Are the New Paper
On May 28, 2008, Interhack founder Matt Curtin speaks to the Lake County Bar Association in Painesville, Ohio, on the topic, Electrons Are the New Paper.
Abstract
Paper has endured as information technology for millennia, recording and preserving much of the foundation of our societies, and specifically our legal systems. The legal process has developed methods for making sense of information presented on paper documents. Much of the information we have available today, however, is electronic. Adjudication requires an understanding of the technology used to manage information. How is information stored, processed, and transmitted in the electronic information systems of today? How does the Internet support today's information management? What can be learned from forensic examination of information systems?
After dealing with the fundamentals of electronic information and computing technology, Curtin discusses applications from his own own experience as a forensic computer scientist. The case studies serve to solidify the audience's understanding of the critical elements of electronic information, and to develop sound intuition on how to make sense of findings presented by experts and technical fact witnesses.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. Interhack is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Interhack returns to the Ohio State Bar Association's annual convention in Columbus, Ohio
Emerging Trends in Fraud Investigation and Prevention conference
Matt Curtin speaks to state appellate judges
Matt Curtin speaks to the Columbus Bar Association in Columbus, Ohio
On April 24, 2008, Interhack founder Matt Curtin speaks to the Columbus Bar Association in Columbus, Ohio, on the topic Paper As Obsolete: What Every Lawyer Should Know About Information Technology and E-Discovery.
Abstract
Paper has endured as information technology for millennia, recording and preserving much of the foundation of our societies, and specifically our legal systems. The legal process has developed methods for making sense of information presented on paper documents. Much of the information we have available today, however, is electronic. Adjudication requires an understanding of the technology used to manage information. How is information stored, processed, and transmitted in the electronic information systems of today? How does the Internet support today's information management? What can be learned from forensic examination of information systems?
After dealing with the fundamentals of electronic information and computing technology, Curtin discusses applications from his own experience as a forensic computer scientist. The case studies serve to solidify the audience's understanding of the critical elements of electronic information, and to develop sound intuition on how to make sense of findings presented by experts and technical fact witnesses.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
Interhack showcases its Forensic Computing
Beyond TableTop: More Hands-On Incident Response Testing
Interhack founder Matt Curtin once again teams up with Keith Fricke of the Cleveland Clinic Health System to teach a hands-on method of incident response drilling to an audience of IT security professionals at the Ohio Information Security Conference (O-ISC) in Dayton on Tuesday, March 18, 2008.
Abstract
Curtin and Fricke demonstrate a process used to create and conduct a simulated security incident using real computers in a real-time setting. Audience members will enjoy the interaction of this presentation, as they are asked questions about what they would do, then compare answers with actions taken by the IR team.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.
A Taxonomy of Recent Data Losses—First Presentation
Interhackers Matt Curtin and Lee Ayres present A Taxonomy of Data Losses and their follow-up research findings A Comparative Analysis of Three Years of Breach Reports by Breach Type and Industry to the Central Ohio ISSA at Platform Lab, 1275 Kinnear Road, Columbus, Ohio, on February 20, 2008.
Abstract
Malicious hackers tend to steal headlines, but do their stories correlate to the threats most prevalent in your industry? Reviewing a selection of publicized security incidents from 2005–2007, Curtin and Ayres propose a taxonomy of breaches based on the threat/vulnerability pair.
Following is analysis of documented incidents of each type in several broadly defined industries. The data and analysis provided will assist business leaders in making informed decisions regarding the distribution of limited information security assets.
About Interhack
Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission. The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.