Malware Forensics - Investigating & Analyzing Malicious Code.pdf - Computer Security Enthusiast Ebook Collection - Stefan_68

In Memory of Our Fathers

James A. Aquilina

1940 –2003

James Malin

1926–2002

Acknowledgements

James warmly thanks and honors trusted conidants, friends, and co-authors Cameron and Eoghan…what

a ride. For Obi Jolles and my loving family, who always support and cherish me, thank you, I love you,

you all mean the world to me. I am ever humbled by the tremendous talent of my LA staff and appreci-

ate the input of Stroz Friedberg colleagues Steve Kim, Jenny Martin, Beryl Howell, and Paul Luehr on

this project. I am grateful for the enduring loyalty and friendship of Ali Mayorkas, Alicia Villarreal, Jeff

Isaacs, Alka Sagar, and my other friends and colleagues at the U.S. Attorney’s Ofice in Los Angeles, from

whom I have learned so much. For FBI Cyber Squad Supervisor Ramyar Tabatabian, U.S. Marshal Adam

Torres, and all of the talented federal law enforcement agents I have come to know and work with, keep

ighting the good ight. To Curtis Rose, our dedicated and tireless technical editor, we could not have

pulled this off without you. And for my father, my rock, I miss you terribly.

Eoghan would primarily like to thank Cameron Malin for coming up with the idea for this book

and bringing it to fruition, and James Aquilina for his continued friendship. I am indebted to Cory

Altheide, Harlan Carvey and Aaron Walters for sharing their knowledge, responding to my questions

with such promptness and patience, and providing technical feedback on material in this book. I am

grateful to Curtis Rose for his thorough and insightful technical editing. Many thanks to Andy

Johnston and Thorsten Holz for sharing malware samples used to develop ideas and scenarios for this

book. Thanks also to Seth Leone, Terrance Maguire, Marissa McGann, Steve Mead, Anthony

Pangilinan, Ryan Pittman, Ryan Sommers, Gerasimos Stellatos, and my other friends from Stroz

Friedberg for their support of this project. Finally, my love to Gen and Roisin for enriching my

existence, and enabling the many late nights and weekend work that made this book possible.

Cameron would like to thank the following people for their support on this project: Eoghan and

James—I am grateful for having the opportunity and privilege of working with you both. Thank you

for your dedication and hard work on this project. My deepest gratitude to Curtis Rose for tackling

this Herculean task and making it look easy; your insightful and methodical technical editing is

greatly appreciated. Many thanks to the talented Special Agents of the FBI Cyber program in Los

Angeles and across the FBI for the honor of working and sharing ideas with you. Also, special thanks

to the folks in the FBI who made this project possible. To my mother, father and sister for inspiring

me to always pursue my goals and dreams and to never give up in the face of adversity. Although Dad

is no longer with us, his legacy and lessons are very much alive and well. To my grandmother, who

always stressed the important of education and faith. Finally, to my beautiful soul mate Adrienne; your

patience, support and sacriice made this book possible. I love you.

Authors

James M. Aquilina is an Executive Managing Director and Deputy General

Counsel of Stroz Friedberg, a technical services and consulting irm specializ-

ing in digital computer forensics; electronic data preservation, analysis, and

production; computer fraud and abuse response; and computer security.

Mr. Aquilina contributes to the management of the irm and the handling of

its legal affairs, in addition to having overall responsibility for the Los Angeles

ofice. He supervises numerous digital forensic and electronic discovery

assignments for government agencies, major law irms, and corporate manage-

ment and information systems departments in criminal, civil, regulatory and

internal corporate matters, including matters involving e-forgery, wiping, mass

deletion and other forms of spoliation, leaks of conidential information,

computer-enabled theft of trade secrets, and illegal electronic surveillance. He

has served as a neutral expert and has supervised the court-appointed forensic

examination of digital evidence. Mr. Aquilina also has led the development of

the irm’s online fraud and abuse practice, regularly consulting on the technical

and strategic aspects of initiatives to protect computer networks from spyware

and other invasive software, malware and malicious code, online fraud, and

other forms of illicit Internet activity. His deep knowledge of botnets, distrib-

uted denial of service attacks, and other automated cyber-intrusions enables

him to provide companies with advice and solutions to tackle incidents of

computer fraud and abuse and bolster their infrastructure protection.

Prior to joining Stroz Friedberg, Mr. Aquilina was an Assistant U.S.

Attorney in the Criminal Division of the U.S. Attorney’s Ofice for the

Central District of California, where he most recently served as a Computer

and Telecommunications Coordinator in the Cyber and Intellectual Property

Crimes Section. He also served as a member of the Los Angeles Electronic

Crimes Task Force and as chair of the Computer Intrusion Working

Group, an inter-agency cyber-crime response organization. As an Assistant,

Mr. Aquilina conducted and supervised investigations and prosecutions of

computer intrusions, extortionate denial of service attacks, computer and

Internet fraud, criminal copyright infringement, theft of trade secrets, and

other abuses involving the theft and use of personal identity. Among his

notable cyber cases, Mr. Aquilina brought the irst U.S. prosecution of

malicious botnet activity for proit against a proliic member of the “botmaster

underground” who sold his armies of infected computers for the purpose of

launching attacks and spamming, and used his botnets to generate income

from the surreptitious installation of adware; tried to jury conviction the irst

criminal copyright infringement case involving the use of digital camcording

equipment; supervised the government’s continuing prosecution of Operation

Cyberslam, an international intrusion investigation involving the use of hired

hackers to launch computer attacks against online business competitors; and

oversaw the collection and analysis of electronic evidence relating to the

prosecution of a local terrorist cell operating in Los Angeles.

During his tenure at the U.S. Attorney’s Ofice, Mr. Aquilina also served

in the Major Frauds and Terrorism/Organized Crime Sections where he

investigated and tried numerous complex cases, including a major corrup-

tion trial against an IRS Revenue Oficer and public accountants; a fraud

prosecution against the French bank Credit Lyonnais in connection with the

rehabilitation and liquidation of the now defunct insurer Executive Life; and

an extortion and kidnapping trial against an Armenian organized crime ring.

In the wake of the September 11, 2001 attacks, Mr. Aquilina helped establish

and run the Legal Section of the FBI’s Emergency Operations Center.

Before public service, Mr. Aquilina was an associate at the law irm

Richards, Spears, Kibbe & Orbe in New York, where he focused on white

collar work in federal and state criminal and regulatory matters.

Mr. Aquilina served as a law clerk to the Honorable Irma E. Gonzalez,

U.S. District Judge, Southern District of California. He received his

B.A. magna cum laude from Georgetown University, and his J.D. from the

University of California, Berkeley, School of Law, where he was a Richard

Erskine Academic Fellow and served as an Articles Editor and Executive

Committee Member of the California Law Review.

He currently serves as an Honorary Council Member on cyber law issues

for the International Council of E-Commerce Consultants (EC-Council),

the organization that provides the CEH (Certiied Ethical Hacker) and CHFI

(Certiied Hacking Forensic Investigator) certiications to leading security

industry professionals worldwide.

Eoghan Casey Eoghan Casey is an Incident Response and Digital

Forensic Analyst, responding to security breaches and analyzing digital

evidence in a wide range of investigations, including network intrusions

with international scope. He has extensive experience using digital forensics

in response to security breaches to determine the origin, nature and extent

of computer intrusions, and has utilized forensic and security techniques to

secure compromised networks. He has performed hundreds of forensic

acquisitions and examinations, including e-mail and ile servers, handheld

devices, backup tapes, database systems, and network logs.

Mr. Casey is a leading authority in his areas of expertise and has

written and lectured extensively both in the United States and abroad,

including at conferences sponsored by the Digital Forensics Research

Workshop, High Tech Crime Investigators Association, SEARCH,

SecureIT, and Infragard. He is the author of the widely used textbook

Digital Evidence and Computer Crime: Forensic Science, Computers and

the Internet (Academic Press, 2004). He is also editor of the Handbook

of Computer Crime Investigation, and coauthor of Investigating Child

Exploitation and Pornography. Mr. Casey is editor-in-chief of Elsevier’s

international journal of Digital Investigation, which publishes articles on

digital forensics and incident response on a quarterly basis.

As a Director of Digital Forensics and Investigations at Stroz Friedberg,

he co-managed the irm’s technical operations in the areas of computer

forensics, cyber-crime response, incident handling, and electronic discovery.

In addition, he maintained an active docket of cases himself, testiied in

civil and criminal cases, and submitted expert reports and prepared trial

and grand jury exhibits for computer forensic and cyber-crime cases.

Mr. Casey also spearheaded Stroz Friedberg’s external and in-house forensic

training programs as Director of Training.

Before working at Stroz Friedberg, Mr. Casey assisted law enforcement

as a consultant in numerous criminal investigations involving on-line criminal

activity and digital evidence relevant to homicides, child exploitation and

other types of cases. As an Information Security Oficer at Yale University,

from 1999 to 2002, and in subsequent consulting work, he has performed

vulnerability assessments, handled critical security breaches and policy

violations, deployed and maintained intrusion detection systems, irewalls

Malware Forensics - Investigating & Analyzing Malicious Code.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: