Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Jul 21, 2003

Sandy constantly struggled with her PC. Working for a small repair company was a lot of fun, but dealing with the constant loss of network connectivity, software crashes and freezes was just too much.

“Bob, this is Sandy” she said into her cellphone. “Can you come up here and look at my PC again? It’s frozen!”

“Um, did you CTRL-ALT-DEL a few times? Maybe try recycling the power? Ya know, reboot?” Bob responded in his best I-hate-being-the-admin-of-this-small-company-network voice.

“Nevermind Bob!” Sandy responded as she slammed her cellphone shut. She often wondered what the point was of paying a sysadmin that didn’t administer any systems, her workstation included….After her PC boot, Sandy logged back into the network only to find that her primary application, Quicken, was nowhere to be found on her desktop or in her program directory.

“DARNIT! How did that happen? Well, I guess I had better reinstall - of course I’ll need to visit Bob now and get the CD. Lucky me!” Sandy told herself.

Sandy decide to wait until lunch time - a time when she knew Bob would be out of the office. Bob was known to take two hour lunch breaks, so she had plenty of time to get the CD, perform the install and return the CD before he returned to the office.

A quick jog downstairs and some creative pathfinding found Sandy in Bob’s small, poorly-lit and extremely warm office.

“How does he survive down here?” Sandy thought.

Sandy rummaged through all the file cabinets, Bob’s desk drawers, the supply cabinets…. the Quicken CD was no where to be found.

As a matter of fact, Sandy couldn’t find ANY software CD’s.

Sandy noticed a large gym bag under Bob’s desk. Upon closer inspection, Sandy found that it contained Bob’s workout clothes and some balled-up papers.

“EWWWWW!” Sandy exclaimed as she dropped a stained pair of socks. Before she could zip the bag up, a familiar logo on one of the balled-up papers caught her eye.

It was the eBay logo - and Sandy had a feedback count of 312. She was an eBay expert.

Unwrapping the paper, Sandy was surprised to find that the paper was a printout of a successful auction.

“Maybe Bob is selling his car on eBay?” Sandy wondered. As she examined the paper closely, she noticed that Bob was the seller… his ID was a dead give-away… “BobWeaverAZ”.

But what really caught her eye was the item being sold.

A piece of software in the box, including CD, manuals, and the EULA (end user license agreement).

It was a copy of Quicken.

[Continued in Part II]

Source: archived original

Part II · Jul 22, 2003

“No flavored creamer? What the hell?” I thought as I ravaged the company coffee stand. This cup of pure Peruvian Organic delight was going to taste rather bland without some hazelnut goodness added. Oh well. I had to remember that this was a small company and people pretty much brought whatever they wanted to drink with them from home.

“Hey Chief, you made it!” a familiar voice yelled my direction. It was Sandy, a former coworker of mine from way back. Sandy had called me to her new digs, a small electronics repair company, to investigate some missing software. “Some software SHOULD go missing” I mused to myself, remembering Microsoft Bob. shudder

“Come into my office, we have a lot to talk about.” Sandy said as she bounced around the corner into her office. “I need some professional help.”

“I’ve been telling you that for years.” I sassed back, wedging myself into a strange metal chair that just needed a power source and some wires for a lively game of capital punishment…“Here’s the scoop.” Sandy began. “Our Sysadmin, Bob, is the resident… oh what did you used to call them?”

“BOFH?” I replied. “Bastard Operator From Hell?”

“Yes! That’s him. He can’t stand to be bothered when we need help, we’re not quite sure what he does on the servers, and he never seems to be ‘around’ when you need him. "

“Tell me something new Sandy.” I said matter-o-factly. “BOFH’s have been around a long time. They’re like luggage, and just as hard to get rid of sometimes.”

“Well, we think we’ve found a way. The president of the company and I suspect that Bob is selling company assets on eBay.” Sandy said with a scowl. “I found these printouts of auctions in his gym bag under his desk. You’ll notice that he is the seller on all the auctions, and the items in the pictures we’ve traced as being assets. Look at the serial numbers of the software in the pictures! We’re registered to the serial number! Unreal!”

“Fascinating.” I blurted out in the middle of examining the papers. “Have you confronted Bob about this yet? "

“Yes, this morning.” Sandy said. “However, he claims that someone used his ID to sell the items on eBay. He was upset, so we let him go home for the rest of the day. It’s not like we’re not used to seeing his chair empty in his office.”

“Has he been back into his office since you sent him home?” I asked.

“No.” she responded.

“Does he have remote access to the network from home?” I asked her, raising an eyebrow.

“No. At least I don’t think so.” Sandy replied in a hushed voice.

I rose from my chair, and made a bee-line for Bob’s office.

“Where are you going?” Sandy yelled from behind her desk.

“To catch a thief.” I replied.

I only hoped I wasn’t too late.

Source: archived original

Part III · Jul 23, 2003

“What a mess!” I thought to myself, pouring over the contents of Bob’s “desk”. Desk would be a misnomer - more like “place to throw all my stuff, food wrappers, empty soda cans and used tissues”. I haven’t been this nauseated since the time I accidentally watched the Rosie O’Donnell show… or was that Oprah.

A folder in one of the desk drawers contained a network diagram that had actually been updated in the past year. I was impressed.

Glancing over the document, it appeared that the office had a single outside network connection. It was a fractional T-1 connected via a large national provider. There appeared to be a firewall in place between the internal network and the border router.

A wireless scan for rogue access points produced nothing. Hmmm.

“Sandy - do you have any POTS lines into this building?” I yelled down the hall. My voice trailed off as I noticed a phone cord running behind the bookcase to my left and heading towards the PC computer on the floor….“Why does he have a phone cord plugged into his PC?” Sandy asked me. “I thought we only had one POTS line - and that went to the fax machine in the next room.”

“Looks like he split the line” I said. “Sandy, I’m going to need to do a forensic analysis of his workstation to prove anything. Has anyone touched his machine since he left?”

“No - are you kidding? Nobody WANTS to come in here. It’s like a sauna!” Sandy joked.

Twenty minutes later I had retrieved “Roscoe” from the trunk of my car. Roscoe is a portable forensic analysis workstation that I carry with me for just this type of occasion. “All I need now is a laptop named Enos” I mused.

I took several pictures of Bob’s workstation, showing it’s location, cords, serial number and asset tag number. I then unplugged the power cord from the back of the PC, and heard the workstation die in protest.

“Chief, what are you doing? Doesn’t that hurt the computer?” Sandy exclaimed.

“It’s the best way to preserve the state of the machine, especially since it’s running a Windows operating system.” I responded. I continued to amuse Sandy with tales of how the Windows swap file is a treasure trove of information, and I didn’t want to take the chance of modifying anything on the drive.

I proceeded to take pictures of the inside of the machine, noting serial numbers, brands of equipment, etc.

Instead of removing the hard drive from it’s restraining bracket, I simply placed the ’leech’ IDE cable from Roscoe onto the drive with a write-blocker in place. I powered up Roscoe and proceeded to make an image of the disk drive using Encase, my tool of choice.

“Time to find a good sandwich shop” I announced to Sandy. The drive copy was going to take about an hour to complete.

“What are expecting to find on the drive, Chief?” Sandy kept asking me.

“Fingerprints” I responded.

Source: archived original

Part IV · Jul 25, 2003

“I sure am glad this guy only had a 9GB harddrive in this machine.” I thought to myself while watching my forensic toolkit application load the captured image of Bob’s workstation into memory. The thought of having to look through another 100GB image of files was a recent painful memory from another case I had worked on.

Beep!

The image had finished loading. Now was the time to start scanning through the contents of the drive…. (quick aside) I like to make lots of notes during a forensic analysis - that way I can always backtrack to a certain file should the need arise.

One of the first notes I had made for this casefile was that Bob’s PC has a system clock that was off by 10 minutes. Apparently Bob never paid attention to what time it was, or he liked to be late to everything. Developing a time delta is important, because it’s typically your best reference point in reconstructing events between the PC and the world. (/quick aside)

“Need some coffee Chief?” Sandy asked about 10 seconds before she appeared at the doorway to Bob’s office.

“Yes please - and find some flavored creamer, will ya?” I rattled back.

I was making great time going through hundreds of web page fragments that I had found in cache files, temp files, swap space and slack space on the drive.

“I guess he likes Russian women and viagra.” I joked to myself as I made some notes on Bob’s internet usage habits.

“Here ya go!” Sandy proudliy announced as she placed a hot mug of joe on the desk in front of me.

“Sandy, do you know who your company attorney is? I asked as I burned my upper lip on the fresh coffee.

“Sure - Peter Nelson. Why?” Sandy asked - obviously puzzled by my request.

Doing a quick stretch of my arms in an effort to release the building tension on my shoulders, I slipped the glasses off my nose and placed them on the desk.

“Get him on the phone. This is way beyond eBay.”

Source: archived original

Part V · Jul 29, 2003

To the common Joe, cigar smoke is categorized into two flavors. The first is “full-bodied, rich and melodic” - the second being “oh my God! Someone is smoking a cigar! Oh I’m going to puke!”.

Peter Nelson’s office was like stepping into a humidor in a fine cigar shop. Cool, humid and reeking of tobacco leaves. Sixty seconds after walking in the door I was addicted to nicotine.

“So this is the great Gatsby! What does Sandy call you… Chief?” Peter bellowed behind his large mahogony desk.

“I’ve been called worse.” I thought, remembering an angry ex. “I have a picture show for you Peter, and you may want to add a scotch to go with that Cigar.”

The befuddled look on Peter’s face amused me in a strange, primal way. Almost like I had called his mother an ambulance-chaser.

The lits dimmed, the LCD on my linux laptop released a glowing shower of illuminating pixels, and I slammed the last of my flavored coffee down….“Your company is harboring illegal activity.” I announced.

Peter fidgeted in his seat. “Excuse me?” Peter asked.

I switched to a different slide in OpenOffice’s Impress (powerpoint for all you Windows folk) and began the tale.

“Your system administrator, Bob, has been selling company assets such as software licenses, software media and hardware on eBay and a number of other online marketplaces.” I said.

“Yes, I’m aware of THAT!” Peter snapped back. “So we scare him, let him go, hire somebody else. Big deal. What is this illegal activity crap?”

“Peter, do you understand the term ‘minimum necessary access’? " I asked.

“Hey, I wasn’t born yesterday! Yes - employees only have access to information that is required of their job description - any good attorney nowadays has heard of it.” Peter replied.

“Well, Bob has access to everything witin this company - including e-mail, financial data, payroll, your website, your databases…”

“YES! Ok, but he’s the only one that knows how to access the systems. We’re not that big of a company and it’s normal for him to access all of that stuff.” Bob said, clearly becoming agitated with me. “He makes sure the orders get into the database via the website, updates the website pages with data from our files, blah blah blah.”

“Or his files?” I inquired.

click

The next slide appeared on the laptop.

Peter was stone faced. So much so that I was tempted to check his vitals for any sign of life.

“What… the… what the hell is that?” Peter stammered, pointing at the slide.

“It’s an eight-year old girl.” I replied.

(final installment of this case is tomorrow!)

Source: archived original

Part VI · Jul 30, 2003

You could hear a pin drop. The boardroom of the company was cold and stocked to the hilt in mahogony furniture.

“If only I were a termite!” I thought.

My attention was diverted to the CEO as he spoke to the other members at the table: the CFO, Peter, Sandy, and the human resources manager.

“We’ve all sat through the Chief’s presentation, and we’re aware of what one of our employees has been doing over the past year. I’d like for the Chief to walk us through how he found this information and what we should do next.” said the CEO in his best “oh my God we’re all doomed if this gets out to the public” voice.

Coffee in hand, I walked to the front of the boardroom, hooked my linux laptop to the LCD projector and began discussing the notes of my investigation…(aside) As you’ve probably noticed, a good part of my time is spent giving presentations and discussing procedures and facts. This is the hard part - explaining forensic evidence to people who are not necessarily technical folks, and not losing them in legal jargon or FUD [fear, uncertainy & doubt]. (/aside)

“Ladies and Gentleman, you’ve read my prepared case notes surrounding this incident, and I’d like to elaborate on several points.

I was called to investigate the apparent theft of company property by Bob.

I surmised through a forensic investigation of Bob’s workstation that he was, in fact, advertising for sale company assets, collecting funds for the assets via Paypal and shipping the items using the company fedex account.

During the course of this investigation, I discovered traces of images on Bob’s workstation that were clearly nude pictures of children. The pictures were downloaded using Internet Explorer, and were part of several webpages - webpages that originated from this company’s web server.

I discovered traces of IRC and ICQ conversations between Bob and other people regarding the acquisition, trading, storage and distribution of these types of images.

A snippet of one conversation detailed Bob’s plans to allocate 5GB of drive space on the company’s web server for the safe distribution of these images. The directory structure of the site was well hidden under a virtual directory called ’test’. Below this directory were web pages that contained thumb-nail galleries of the pictures.

I also recovered FTP logs on Bob’s workstation and the web server that clearly show when and where the images were put. Examination of these logs showed that the time the images were uploaded from the workstation and received by the server were off by exactly 10 minutes. Bob’s workstation is 10 minutes off from the webserver’s clock which is sync’d like the rest of the network using an NTP (Network Time Protocol) device.

According to the webserver logs, there have been over 30000 hits to this protected directory from approximately 400 different hosts around the world in the past year alone. " I said, pausing to drink some coffee.

“I have prepared a formal report which has been provided to you in hardcopy and electronic format. I have given Peter a forensically-sterile copy of all of the electronic evidence I have collected, along with the chain-of-custody documents. It is my understanding that Peter will be contacting the Crimes Against Children task force of the FBI. Correct Peter?”

“Yes. The board has voted to hand over all evidence to the FBI. This is not something we want to brush under the rug, so to speak.” Peter responded.

I closed my laptop, threw my styro coffee cup in the garbage and headed out of the boardroom to the elevator.

I wondered to myself how many companies (especially large companies) brush this stuff ‘under the rug’? How many of these crimes go unpunished? How may of these types of crimes are not investigated using proper procedures and are torn apart in court?

As I pressed the ’lobby’ button on the elevator, I thought about the kids in those pictures. I wondered to myself “who is THEIR voice in all of this? Who fights for the children?”

I approached the glass door of the lobby, bumping it with my laptop bag. I caught a reflection of myself as I opened the door.

“Oh yeah” I thought.

I fight for them.

Source: archived original