- js reader version
- view hidden posts
- tags and related articles
Friday, May. 25, 2007 at 7:59 AM
I spent today dressed up in my monkey incognito suit at the 2007 ISSA Symposium in Phoenix. There were lots of great presentations and interesting security folks to exchange information with.
One presentation was particularly informative and a bit humorous for me.
The information was presented by an FBI Special Agent on the basics of forensics. It was a very good summary - however the best part was the questions asked afterward. This is the part that made me chuckle (those of you that know how I feel about encountering encryption during an investigation know why I'm laughing).
This is a paraphrase of the conversation from my memory and the notes that I made on a drink napkin (that will teach me to not bring my laptop).
Attendee: "How do you deal with encrypted media and information during an investigation?"
Special Agent: *grimaces*
Special Agent: "For the most part encryption is a dead end for us, unless the evidence deals with a matter of National Security / Terrorism."
Attendee: "So what do you do if it involves National Security?"
Special Agent: "We don't work on it. We send it to a sister agency *cough* NSA *cough* that takes care of that for us. They have no problem dealing with such things."
Let me put this into perspective for you all based on the SA's other comments:
1) If an attacker breaks into your systems and encrypts all of your data and the damage is greater than 0k, they'll investigate but they won't recover your data. You are $%@! out of luck.
2) If you're a warez kiddy, KP connoisseur, or gang member and you encrypt your stuff and don't leave the passphrase in an easily recoverable place (and they don't recover the passphrase via social engineering or interviewing techniques), they aren't going to attempt to break your encryption.
3) If you're a terrorist, or threatening the President, or building a dirty bomb... your encrypted data will be put on a special plane and flown to the NSA in a matter of hours. It will be broken. You will be prosecuted/tortured/shot/mysteriously disappear. :-)~
Some other comments that were interesting:
The FBI still has their "mega contract" with Microsoft. They have infinite Microsoft resources to help them figure out how to get to your stuff if you've used a Microsoft encryption solution.
The FBI has particular trouble with Apple's Filevault encryption if the passphrase is of "excellent" quality. That tells me they have thousands of monkeys doing brute-force attempts on filevault sparseimage files. Interesting.
These comments made me feel better.
It would appear that I'm not the only one that gets rather pissed off when I find an encrypted file or filesystem during a forensic investigation - but I drink much better coffee.
* * * * *
Report this post as:
LATEST COMMENTS ABOUT THIS ARTICLE
Listed below are the 10 latest comments of 2 posted about this article.
These comments are anonymously submitted by the website visitors.
|does not compute
||Friday, May. 25, 2007 at 3:07 PM
||you need proof?
||Friday, May. 25, 2007 at 3:36 PM
More Pix: "Families Belong Together," Pasadena
"Families Belong Together" March, Pasadena
Short Report on the Families Belong Together Protest in Los Angeles
Summer 2018 National Immigrant Solidarity Network News Alert!
Watch the Debate: Excluded Candidates for Governor of California
Change Links June 2018 posted
The Montrose Peace Vigil at 12 Years
Unity Archive Project
Dianne Feinstein's Promotion of War, Secret Animal Abuse, Military Profiteering, Censorshi
CA Senate Bill 1303 would require an independent coroner rather than being part of police
Three years after OC snitch scandal, no charges filed against sheriffs deputies
California police agencies violate Brown Act (open meetings)
Insane Company Wants To Send Nuke Plant Waste To New Mexico
Change Links May 2018
Worker-Owned Car Wash on Vermont Closed
GUIDE TO REBEL CITY LOS ANGELES AVAILABLE
lausd whistle blower
Help KCET and UCLA identify 60s-70s Chicano images
UCLA Luskin: Casting Youth Justice in a Different Light
Change Links April 2018
Nuclear Shutdown News March 2018
Join The Protest Rally in Glendale on April 10, 2018!
Spring 2018 National Immigrant Solidarity Network News Alert!
Anti-Eviction Mapping Project Shows Shocking Eviction Trends in L.A.
Steve Mnuchin video at UCLA released
Actress and Philanthropist Tanna Frederick Hosts Project Save Our Surf Beach Clean Ups
After Being Told He's 'Full of Sh*t' at School Event, Mnuchin Demands UCLA Suppress Video
More Local News...
Paraphysique de martyrologie
[NEW HOT] World Soccer King Hack Coins and Gems
Asian Countries:Cambodia, Vietnam, N. Korea do not permit unlawful immigration
Children Incorporated Earns 4-Star Rating on Charity Navigator
Democratic Socialists of America
Leonard Peltier Non Violent Native American Political Prisoner since 1970's
Paraphysique miscellanées de l'aggiornamento
Actress and Philanthropist Tanna Frederick Hosts Project Save Our Surf Beach Cleanup
FBI Investigated LA County Sheriff Baca,Why Not Hank Skinner's Persecution?
Updated Partial List Of Famous Vegetarians, Vegans, & Fruitarians
The Shortwave Report 07136/18 Listen Globally!
Social Policy as Social Infrastructure
Vol I: 84 Varieties Of GOP Election Fraud
Texas Can Call it An Execution,But It is A State Sponsored Murder of Hank Skinner..
June 2018 Honduras coup update
Maria Estrada doubles down on racist support
New York Women in Film & Television Announces 2018 NYWIFT Ha Phuong Scholarship Recipients
Trapps de la domination, trapps de l'aliénation
Please Work For The Defeat Of Brett Kavanaugh And Why
Change Links 2018 July posted
Transinhumanisme ( transe inhumanisme )
Google, World's Biggest Censor, Was Founded By The CIA
For a World Free of Nuclear Risks
Corrupt CDC Ignores Meat Fish Recalls
The (Temporary) End of Globalization
Aternatives to Abortions such as Plan B the pill, condoms and IUD
U.S Congressional Legal Minds Know Better Than Allowing Texas To Murder Hank Skinner
ACLU in many US states defends in court KKK and American Nazis Sometimes for Money
More Breaking News...