[PPT] - CSCI E-170 Lecture 02: Physical Security and Information Leakage PowerPoint Presentation

SLIDE 1

CSCI E-170 Lecture 02: Physical Security and Information Leakage Simson L. Garfinkel

Center for Research on Computation and Society Harvard University September 26, 2005

1

SLIDE 2

Today’s Outline:

1. LiveJournal
2. HW1 and HW2
3. Readings
4. Hard drive project.

2

SLIDE 3

LiveJournal Everybody should be signed up by now. Be sure to post in the community. HW#1 is the only home work that will be accepted late! You get full credit just by posting. Question: Do we have too many people for one community?

3

SLIDE 4

Please sign the “Video Release” Without this form, we can’t video the students. What do you think about the ethics of being asked to sign this release? Who owns your image in the street?

HARVARD UNIVERSITY

FACULTY OF ARTS AND SCIENCES

DIVISION OF CONTINUING EDUCATION

Authorization and Release Form for Video and Television

I will be a speaker or a student in [name

f course] during the

semester of 200_ at Harvard University - Division of Continuing Education. I authorize Harvard, and anyone that Harvard may permit, to film, videotape, audio record, and photograph me during my class participation in the course for subsequent broadcast or other dissemination in perpetuity through any media, which includes, without limitation,commercial and public radio and television, cable, and the Internet. I understand that signing this Authorization and Release Form is not a requirement for participating in the class. I further understand that I will not receive a copy of any film, videotape, audio recording, photograph, or computer file that is or may be produced. I hereby acknowledge that I have signed this release voluntarily as an instrument under seal on this day of [month], 200 . Signature Print Name S:dlagreements\authorization00.202

51 BRATTLE STREET CAMBRIDGE, MASSACHUSETTS 02138-3722

4

SLIDE 5

HW2: Disk Forensics Your assignment:

Obtain, image and analyze a device

with more than 32MB of memory.

Write a sanitized report of what you

find. You have two weeks. Start today!

5

SLIDE 6

Readings The readings in the syllabus predates the book. I will attempt to update the readings as we move forwards.

6

SLIDE 7

Today: Information Leakage

M. Blaze. “Cryptology and Physical Security: Rights Amplification in

Master-Keyed Mechanical Locks.” March 2003. IEEE Security and Privacy. March/April 2003.

Kuhn, Markus G., Anderson, Ross, “Soft Tempest: Hidden Data

Transmissions Using Electromagnetic Emanations,” David Aucsmith (Ed.): Information Hiding 1998, LNCS 1525, pp. 124-142, 1998.

Kuhn, Markus, G., “Optical Time-Domain Eavesdropping Risks of CRT

Displays, Proceedings 2002 IEEE Symposium on Security and Privacy, 12-15 May 2002, Berkeley, CA., pp. 3-18.

Garfinkel., S., Shelat, A., “Remembrance of Data Passed: A Study of Disk

Sanitization Practices,” IEEE Security and Privacy, January 2003.

What’s the common theme in these articles?

7

SLIDE 8

Blaze “Rights Amplification.” What’s going on with this article?

8

SLIDE 9

Security issues transcend physical embodiments. “Oracle” Disclosure of security vulnerabilities. Diffusion of vulnerabilities to users. Remember the Kryptonite Lock Fiasco? http://www.engadget.com/entry/7796925370303347/

9

SLIDE 10

Kuhn & Anderson, “Soft Tempest” Why was this research done? What did Kuhn and Anderson learn? What’s the solution? Does anybody use their fonts today? What’s “tempest,” anyway?

10

SLIDE 11

Tempest stuff http://www.pcindus.com/Pages/Tempest/Tempest01.htm

11

SLIDE 12

Kuhn, “Optical Time-Domain Eavesdropping” Did Kuhn “invent” this attack? Is this a practical attack? Who would use this attack?

12

SLIDE 13

Garfinkel & Shelat, “Disk Sanitization.” What’s the point of this article?

13

SLIDE 14

Physical Security Physical security is very important, yet frequently overlooked. Create two plans:

physical security plan: how you protect the physical assets.
disaster recovery plan: how you recover if those assets are

lost or destroyed.

14

SLIDE 15

Environmental threats to consider

Fire
Smoke
Dust
Earthquakes
Explosions
Extreme temperatures
Bugs (biological)
Electrical noise
Lightning
Vibration
Humidity
Water

15

SLIDE 16

Defending against vandalism and theft. Areas of access:

Raised floors and dropped ceilings
Air ducts
Glass walls
Ventilation holes
Network cables (cutting & eavesdropping)

Strategies:

Locks
Tagging
Active recovery software and services

Don’t forget to secure your backups.

16

SLIDE 17

The disk sanitization problem.

1. Scale of the problem

500 1, 000 1, 500 2, 000 2, 500 Megabytes Data in the file system (level 0) Data not in the file system (level 2 and 3) No Data (blocks cleared)

2. The Traceback Study

17

SLIDE 18

Disk Sanitization Recall some of the goals of computer security:

Availability
Confidentiality
Data Integrity
Control
Audit

18

SLIDE 19

Confidentiality means preventing unauthorized disclosure. Data can be:

In flight
Stored

Most data spends most of its time in storage.

19

SLIDE 20

Data over time: Conceptual

20

SLIDE 21

210 million drives will be retired this year.

50M 100M 150M 200M 250M 300M 350M 400M 1996 1998 2000 2002 2004 2006 Drives Shipped Drives Retired

21

SLIDE 22

“Retire?”

22

SLIDE 23

Deckard (Harrison Ford) retiring a replicant. “Blade Runner” (1982)

23

SLIDE 24

Hard drives pose special problem for computer security

Do not forget data when power is removed. Contain data that is not immediately visible. Today’s computers can read hard drives that are 15 years old!

Electrically compatible (IDE/ATA)
Logically compatible

(FAT16/32 file systems)

Very different from tape systems

24

SLIDE 25

Data over time: Actual

25

SLIDE 26

There is a significant secondary market for used disk drives. Retired drives are:

Re-used within
rganizations
Given to charities
Sold at auction

About 1000 used drives/day sold on eBay.

26

SLIDE 27

Today there are three primary techniques for assuring data confidentiality.

1. Physical security.
2. Logical access controls. (operating system)
3. Cryptography (disk & link)

27

SLIDE 28

When a disk is thrown out or repurposed, most of these techniques don’t work.

1. /

/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / Physical/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / security.

2. /

/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / Logical/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / access/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / controls./ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / (operating/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / system)

3. Cryptography (disk & link)

And most people don’t encrypt their data.

28

SLIDE 29

More bad news. FORMAT C: doesn’t erase the hard drive. FORMAT just writes a new root directory.

29

SLIDE 30

DEL doesn’t delete files DEL simply removes the file’s name from the directory.

30

SLIDE 31

These failings are shared by all modern file systems.

FAT12 – DOS Floppy disks
FAT16, FAT32 – DOS, Windows, USB Drives
NTFS – Windows NT/XP/Longhorn
UFS, FFS, EXT2/3 – Unix
HFS, HFS+ – MacOS
Novell

Compressed and Encrypted file systems complicate recovery of data.

31

SLIDE 32

A typical hard disk

Factory-Fresh Hard disk: All Blank

Each block is 512 bytes A 20G disk has 40M blocks. Disk blocks (not to scale)

32

SLIDE 33

“All Blank”

Each block has 512 ASCII NULs:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

33

SLIDE 34

% format C:*

Writes:

– Boot blocks – Root directory – “File Allocation Table” (FAT) – Backup “superblocks” (UFS/FFS)

May also:

– Validate surface B F F F / * Examples based on FAT32 running under Unix

34

SLIDE 35

% cp bfs1 /mnt/b1 % cp bfs2 /mnt/b2

Writes:

– File Contents – File Directory Entry – Bookkeeping

root directory:

b1______.___ jan 1 2004 block 7 b2______.___ jan 1 2004 block 14

B F F F /b1 /b2 0 Big Secret File #1 Big Secret File #2

35

SLIDE 36

% rm /mnt/b1 % rm /mnt/b2

Writes:

– New root directory – Bookkeeping

new root directory:

?1______.___ jan 1 2004 block 7 ?2______.___ jan 1 2004 block 14

B F F F /?1 /?2 0 Big Secret File #1 Big Secret File #2

36

SLIDE 37

Big Secret File #1

% cp Madonna.mp3 /mnt/mp3

Writes:

– New root directory – madonna.mp3 – Bookkeeping

new root directory:

Madonna_.mp3 jan 2 2004 block 7 ?2______.___ jan 1 2004 block 14

B F F Madonna F

/mp3 /?2 0

Big Secret File #2

37

SLIDE 38

Big Secret File #1

What’s on the disk?

Madonna.mp3
Madonna.mp3’s directory

entry

All of B2
Most of B2’s directory

entry

Part of B1

B F F Madonna F

/mp3 /?2 0

Big Secret File #2

38

SLIDE 39

Taxonomy of hard disk data

Overwritten data Level 5 Data accessible by vendor commands Level 4 Partially over-written files Level 3 Recoverable deleted files Level 2 Temp files (/tmp, /windows/tmp, etc) Level 1 Files in file system Level 0

39

SLIDE 40

✁

✂ ✄ ☎ ✆ ✝ ✞ ✆ ✟ ✠ ✂ ✡ ✆ ☛ ☞ ✁ ✠ ✠ ✌ ✍ ✎ ✏ ✑ ✑ ✍ ✠ ✒ ✓ ✔ ✕ ✖ ✗ ✘

✁

✂ ✄ ☎ ✆ ✝ ✞ ✆ ✟ ✠ ✂ ✡ ✆ ☛ ✘ ✁

✙

✂ ✚ ✛ ✜ ☎

✎

✏ ✑ ✢ ✣ ✤ ✥ ✦ ✧ ★ ✩ ✪ ✫ ✬ ✤ ✭ ✮ ✥ ✯ ✥ ✬ ✩ ✰ ✱ ✫ ✲ ✳ ✴ ✧ ✵ ✦ ✪ ✩ ✮ ✤ ✧ ✭ ✥

40

SLIDE 41

Level 5: Overwritten Data

Disk Drives are

analog devices

41

SLIDE 42

Level 5: Overwritten Data

Disk Drives are

analog devices

Overwritten data

doesn’t just die…

42

SLIDE 43

Level 5: Overwritten Data

Disk Drives are

analog devices

Overwritten data

doesn’t just die…

Read data should

be a function of all previous data values…

43

SLIDE 44

Level 5: What to do?

DOD 5220.22-M

– “Degauss with a Type I degausser” – “Degauss with a Type II degausser” – “Overwrite all locations with a character, it’s complement, then a random character and verify” – Destroy, Disintegrate, incinerate, pulverize, shred, or melt

44

SLIDE 45

Type 1 Degausser

Model HD-2000
73 seconds cycle time
260 lbs
$13,995
Monthly rental $1,400
Note:

– Your hard disk won’t work after it’s been degaussed (why not?)

http://www.datadev.com/v90.html

45

SLIDE 46

Drive Slagging

Melting down the

drives works just fine

http://driveslag.eecue.com/

46

SLIDE 47

Drive Slagging Cont…

47

SLIDE 48

Drive Slagging

“Good luck removing data from this.”

48

SLIDE 49

Punching a hole also works. The bad news: Most people aren’t using these techniques.

49

SLIDE 50

Purchased used from a computer store in August 1998:

50

SLIDE 51

Computer #1: 486-class machine with 32MB of RAM A law firm’s file server... ...with client documents! Computers #2 through #10 had:

Mental health records
Home finances
Draft of a novel...

Was this a chance accident or common occurrence?

51

SLIDE 52

Between January 1999 and April 2002, I acquired 236 hard drives on the secondary market.

52

SLIDE 53

Drives arrived by UPS

53

SLIDE 54

Data on drives “imaged” using FreeBSD dd if=/dev/ad0 of=file.img bs=65536 conv=noerror,sync

54

SLIDE 55

Images stored on a RAID

55

SLIDE 56

For every drive, I cataloged:

Disk SN, date of manufacture, etc.
Every readable sector on the drive..
All visible files.
MD5 of every file.
MD5 of the image.

56

SLIDE 57

Example: Disk #70: IBM-DALA-3540/81B70E32 Purchased for $5 from a Mass retail store on eBay Copied the data off: 541MB Initial analysis: Total disk sectors: 1,057,392 Total non-zero sectors: 989,514 Total files: 3 The files: drwxrwxrwx 0 root 0 Dec 31 1979 ./

r-xr-xr-x

0 root 222390 May 11 1998 IO.SYS

r-xr-xr-x

0 root 9 May 11 1998 MSDOS.SYS

rwxrwxrwx

0 root 93880 May 11 1998 COMMAND.COM

57

SLIDE 58

Clearly, this disk had been FORMATed... Windows FORMAT doesn’t erase the disk... FORMAT just writes a new root directory.

58

SLIDE 59

UNIX “strings” reveals the disk’s previous contents... Insert diskette for drive and press any key when ready Your program caused a divide overflow error. If the problem persists, contact your program vendor. Windows has disabled direct disk access to protect your long To override this protection, see the LOCK /? command for more The system has been halted. Press Ctrl+Alt+Del to restart You started your computer with a version of MS-DOS incompatible version of Windows. Insert a Startup diskette matching this OEMString = "NCR 14 inch Analog Color Display Enchanced SVGA, Graphics Mode: 640 x 480 at 72Hz vertical refresh. XResolution = 640 YResolution = 480 VerticalRefresh = 72

59

SLIDE 60

70.img con’t... ling the Trial Edition

IBM AntiVirus Trial Edition is a full-function but time-limited

evaluation version of the IBM AntiVirus Desktop Edition product. may have received the Trial Edition on a promotional CD-ROM single-file installation program over a network. The Trial is available in seven national languages, and each language provided on a separate CC-ROM or as a separa EAS.STCm EET.STC ELR.STCq ELS.STC

60

SLIDE 61

70.img con’t... MAB-DEDUCTIBLE MAB-MOOP MAB-MOOP-DED METHIMAZOLE INSULIN (HUMAN) COUMARIN ANTICOAGULANTS CARBAMATE DERIVATIVES AMANTADINE MANNITOL MAPROTILINE CARBAMAZEPINE CHLORPHENESIN CARBAMATE ETHINAMATE FORMALDEHYDE MAFENIDE ACETATE

61

SLIDE 62

[Garfinkel & Shelat 03] established the scale of the problem. We found:

Thousands of credit card

numbers (many disks)

Financial records
Medical information
Trade secrets
Highly personal

information We did not determine why the data had been left behind.

62

SLIDE 63

There are roughly a dozen documented cases of people purchasing old PCs and finding sensitive data.

A woman in Pahrump, NV bought a

used PC with pharmacy records [Markoff 97]

Pennsylvania sold PCs with

“thousands of files” on state employees [Villano 02]

Paul McCartney’s bank records sold

by his bank [Leyden 04]

O&O Software GmbH – 200 drives.

None of these cases are scientifically rigorous.

63

SLIDE 64

Why don’t we hear more stories? Hypothesis #1: Disclosure of “data passed” is exceedingly rare because most systems are properly cleared. Hypothesis #2: Disclosures are so common that they are not newsworthy. Hypothesis #3: Systems aren’t properly cleared, but few people notice the data.

64

SLIDE 65

I think that data left behind on hard drives is a serious social problem. Large numbers of drives are being sold and given away. Many of them appear to have hidden confidential information. We are morally obligated to solve this problem!

65

SLIDE 66

[Garfinkel ’05] presents five distinct patterns for addressing the sanitization problem

User Audit

Visibility



Users

  

Sanitization

  

Document Files, Applications, and Media



Users Complete Delete

Delayed Unrecoverable Action

Reset to Installation Explicit Item Delete

http://www.simson.net/thesis/

66

SLIDE 67

To be effective, a solution must address the root cause Usability Problem:

Effective audit of information

present on drives.

Make DEL and FORMAT

actually remove data. [Bauer & Priyantha 01]

Provide alternative strategies for

data recovery.

Education Problem:

Add training to the interface.

[Whitten 04]

Regulatory requirements.

[FTC 05, SEC 05]

Legal liability.

To find that cause, I looked on the drives and contacted the data subjects.

67

SLIDE 68

Data on a hard drive is arranged in sectors.

usr bin ls cp mv tmp slg / b a mail junk beth

The white sectors indicate directories and files that are visible to the user.

68

SLIDE 69

Data on a hard drive is arranged in sectors.

usr bin ls cp mv tmp slg / b a mail junk beth x5 x4 x3 x2 x1 x6 x7 x8

The brown sectors indicate files that were deleted.

69

SLIDE 70

Data on a hard drive is arranged in sectors.

usr bin ls cp mv tmp slg / b a mail junk beth x5 x4 x3 x2 x1 x6 x7 x8

The green sectors indicate sectors that were never used (or that were wiped clean).

70

SLIDE 71

Stack the disk sectors:

OS, Apps, user files, and lots of MP3s! Recoverable Data Training failure Usability failure

78

SLIDE 79

The drives are dominated by failed sanitization attempts...

500 1, 000 1, 500 2, 000 2, 500 Megabytes Data in the file system (level 0) Data not in the file system (level 2 and 3) No Data (blocks cleared)

..but training failures are also important.

79

SLIDE 80

Overall numbers Drives Acquired: 236 Drives DOA: 60 Drives Images: 176 Drives Zeroed: 11 Drives “Clean Formatted:” 22 Total files: 168,459 Total data: 125G

80

SLIDE 81

Only 33 out of 176 working drives were properly cleared!

1 from Driveguys — but 2 others had lots of data.
18 from pcjunkyard — but 7 others had data.
1 from a VA reseller — 1 DOA; 3 dirty formats.
1 from an unknown source — 1 DOA, 1 dirty format.
1 from Mr. M. who sold his 2GB drive on eBay.

81

SLIDE 82

MD5 hashing allows the identification of files. Interestingly, few unique files that had not been deleted: File type Unique Files Microsoft Word files: 783 Microsoft Excel files: 184 Microsoft PowerPoint files: 30 Outlook PST files: 11 audio files: 977 Conclusion: most users DELeted their files before discarding their drives.

82

SLIDE 83

But what really happened?

?

I needed to contact the original drive owners.

83

SLIDE 84

The Remembrance of Data Passed Traceback Study. [Garfinkel 05]

1. Find data on hard drive
2. Determine the owner
3. Get contact information

for organization

4. Find the right person

inside the organization

5. Set up interviews
6. Follow guidelines for

human subjects work

06/19/1999 /:dir216/Four H Resume.doc 03/31/1999 /:dir216/U.M. Markets & Society.doc 08/27/1999 /:dir270/Resume-Deb.doc 03/31/1999 /:dir270/Deb-Marymount Letter.doc 03/31/1999 /:dir270/Links App. Ltr..doc 08/27/1999 /:dir270/Resume=Marymount U..doc 03/31/1999 /:dir270/NCR App. Ltr..doc 03/31/1999 /:dir270/Admissions counselor, NCR.doc 08/27/1999 /:dir270/Resume, Deb.doc 03/31/1999 /:dir270/UMUC App. Ltr..doc 03/31/1999 /:dir270/Ed. Coordinator Ltr..doc 03/31/1999 /:dir270/American College ...doc 04/01/1999 /:dir270/Am. U. Admin. Dir..doc 04/05/1999 /:dir270/IR Unknown Lab.doc 04/06/1999 /:dir270/Admit Slip for Modernism.doc 04/07/1999 /:dir270/Your Honor.doc

This was a lot harder than I thought it would be.

84

SLIDE 85

Ultimately, I contacted 20 organizations between April 2003 and April 2005.

85

SLIDE 86

The leading cause: betrayed trust. Trust Failure: 5 cases

✔ Home computer; woman’s son took to “PC Recycle” ✔ Community college; no procedures in place ✔ Church in South Dakota; administrator “kind of crazy” ✔ Auto dealership; consultant sold drives he “upgraded” ✔ Home computer, financial records; same consultant

This specific failure wasn’t considered in [GS 03]; it was the most common failure.

86

SLIDE 87

Second leading cause: Poor training and supervision Trust Failure: 5 cases Lack of Training: 3 cases

✔ California electronic manufacturer ✔ Supermarket credit-card processing terminal ✔ ATM machine from a Chicago bank

Alignment between the interface and the underlying representation would overcome this problem.

87

SLIDE 88

Sometimes the data custodians just don’t care. Trust Failure: 5 cases Lack of Training: 3 cases Lack of Concern: 2 cases

✔ Bankrupt Internet software developer ✔ Layoffs at a computer magazine

Regulation on resellers might have prevented these cases.

88

SLIDE 89

In seven cases, no cause could be determined. Trust Failure: 5 cases Lack of Training: 3 cases Lack of Concern: 2 cases Unknown Reason: 7 cases

✘ Bankrupt biotech startup ✘ Another major electronics manufacturer ✘ Primary school principal’s office ✘ Mail order pharmacy ✘ Major telecommunications provider ✘ Minnesota food company ✘ State Corporation Commission

Regulation might have helped here, too.

89

SLIDE 90

I have identified five distinct patterns for addressing the sanitization problem.

User Audit

Visibility



92

SLIDE 93

Two ways to delete information. #1: Explicit Item Delete

Sanitization

   

Document Files, Applications, and Media



Users

Delayed Unrecoverable Action

Complete Delete Explicit Item Delete

“Provide a means for deleting information where the information is displayed.”

93

SLIDE 94

Reset to Installation: Get rid of everything

Sanitization

   

Document Files, Applications, and Media



Users

Delayed Unrecoverable Action

Complete Delete Reset to Installation Explicit Item Delete

Reset/reinstall functionality is common (Windows; PalmOS; etc.). This pattern framework clarifies Reset’s security property.

94

SLIDE 95

User Audit: If the information is present, make it visible.

User Audit

Visibility



Users

  

usr bin ls cp mv tmp slg / b a mail junk beth

With files, this happens automatically when the Complete Delete pattern is implemented.

95

SLIDE 96

The power of these patterns is that they apply equally well to

ther sanitization problems.
Document Files

many of these sources, their credibility was difficult to assess and was often left to the foreign government services to judge. Intelligence Community HUMINT efforts against a closed society like Iraq prior to Operation Iraqi Freedom were hobbled by the Intelligence Community's dependence on having an official U.S. presence in-country to mount clandestine HUMINT collection efforts. (U) When UN inspectors departed Iraq, the placement of HUMINT agents and the development of unilateral sources inside Iraq were not top priorities for the Intelligence

Community. The Intelligence Community did not have a single HUMINT source collecting

against Iraq's weapons of mass destruction programs in Iraq after 1998. The Intelligence Community appears to have decided that the difficulty and risks inherent in developing sources

r inserting operations officers into Iraq outweighed the potential benefits. The Committee

found no evidence that a lack of resources significantly prevented the Intelligence Community from developing sources or inserting operations officers into Iraq. When Committee staff asked why the CIA had not considered placing a CIA officer in Iraq years before Operation Iraqi Freedom to investigate Iraq's weapons

f mass destruction programs, a CIA officer said, "because it's very hard to sustain ... it takes a

rare officer who can go in ... and survive scrutiny | ^ | [ m | | | for a long time." The Committee agrees that such operations are difficult and dangerous, but they should be within the norm of the CIA's activities and capabilities. Senior CIA officials have repeatedly told the Committee that a significant increase in funding and personnel will be required to enable to the CIA to penetrate difficult HUMINT targets similar to prewar Iraq. The Committee believes, however, that if an officer willing and able to take such an assignment really is "rare" at the CIA, the problem is less a question of resources than a need for dramatic changes in a risk averse corporate culture. (U) Problems with the Intelligence Community's HUMINT efforts were also evident in the Intelligence Community's handling of Iraq's alleged efforts to acquire uranium from Niger. The Committee does not fault the CIA for exploiting the access enjoyed by the spouse of a CIA employee traveling to Niger. The Committee believes, however, that it is unfortunate, considering the significant resources available to the CIA, that this was the only option available. Given the nature of rapidly evolving global threats such as terrorism and the proliferation of weapons and weapons technology, the Intelligence Community must develop means to quickly respond to fleeting collection opportunities outside the Community's established operating areas. The Committee also found other problems with the Intelligence Community's follow-up on the

2 5 -
Web Browsers

96

SLIDE 97

Information is left in document files.

The New York Times published a PDF file

containing the names of Iranians who helped with the 1953 coup. [Young 00]

US DoJ published a PDF file “diversity

report” containing embarrassing redacted

information. [Poulsen 03]
SCO gave a Microsoft Word file to

journalists that revealed its Linux legal

strategy. [Shankland 04]
Multinational Force-Iraq report

UNCLASSIFIED TABLE OF CONTENTS

I. (U) BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
A. (U) Administrative Matters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1. (U) Appointing Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2. (U) Brief Description of the Incident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
B. (U) Constraints and Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
C. (U) Format of the Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
II. (U) ATMOSPHERICS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
A. (U) Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
B. (U) Local Security Situation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1. (U) Iraq . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. (U) Baghdad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. (U) Route Irish . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
C. (U) Known Insurgent Tactics, Techniques, and Procedures . . . . . . . . . . . . . . 5
1. (U) Methods of Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2. (U) Insurgent TTPs for IEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3. (U) Insurgent TTPs for VBIEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4. (U) Effectiveness of Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
D. (U) Recent Incidents in the Vicinity of Checkpoint 541 . . . . . . . . . . . . . . . . . . 8
E. (U) Unit Experience in the Baghdad Area of Responsibility . . . . . . . . . . . . . . . 8
1. (U) Third Infantry Division . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2. (U) Second Brigade, 10th Mountain Division . . . . . . . . . . . . . . . . . . . . . . . . . 9
3. (U) 1-69 Infantry Battalion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4. (U) 1-76 Field Artillery Battalion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
F. (U) Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
III. (U) TRAFFIC CONTROL POINTS, BLOCKING POSITIONS,

AND TRAINING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 i UNCLASSIFIED

97

SLIDE 98

The information leaked because two patterns were not implemented.

User Audit

Visibility



Users

  

Sanitization

   

Document Files, Applications, and Media



Users

Delayed Unrecoverable Action

Complete Delete Reset to Installation Explicit Item Delete

98

SLIDE 99

The Senate Foreign Intelligence Committee accomplished this goal by scanning the redacted report on pre-war Iraq intelligence to create the PDF that it distributed.

99

SLIDE 100

Microsoft has tried to solve this problem with “Remove Hidden Data” tool. RHD doesn’t integrate into the flow of document

preparation. The patterns-based analysis predicts that RHD

will fail in many cases.

100

SLIDE 101

Information is left behind in web browsers.

Browser History Cookies Browser Cache

➀ ➁ ➂ ➃

Two key problems: ➀ Deleted files; ➁ The cache

101

SLIDE 102

In fact, a lot of information is left behind in web browsers. MIT Humanities Library, April 25, 2005

102

SLIDE 103

4 out of 4 computers inspected had significant quantities of personal email in their browser caches. The American Library Association recommends software that automatically purges caches on a daily basis.[ALA 05] (It would be better to purge after each use.)

103

SLIDE 104

Legislative reactions to this research: “Fair and Accurate Credit Transactions Act of 2003” (US)

Introduced in July 2003. Signed December 2003.
Regulations adopted in 2004, effective June 2005.
Amends the FCRA to standardize consumer reports.
Requires destruction of paper or electronic “consumer

records.” Testimony: http://tinyurl.com/cd2my

104

SLIDE 105

Technical reactions to this research: “Secure Empty Trash” in MacOS 10.3.

105

SLIDE 106

Unfortunately, “Secure Empty Trash” is incomplete.

Implemented in Finder

(inconsistently)

Locks trash can
Can’t change your mind

106

SLIDE 107

MacOS 10.4 “Erase Free Space” makes a big file.

107

SLIDE 108

MacOS “File Vault” gives users an encrypted file system.

108

SLIDE 109

Future Work: Deploying Compete Delete

Make FORMAT actually erase the disk.
Make “Empty Trash” actually overwrite data.
Integrate this functionality with web browsers, word

processors, operating systems.

Address usability dangers of clean delete.
Analysis of “one big file” technique.

Let’s put this in Linux!

109

SLIDE 110

Future Work: 2500 Drive Corpus

Automated construction of stop-lists.
Detailed analysis of false positives/negatives in CCN test.
Explore identifiers other than CCNs.
Support for languages other than English.

More than 500 drives are standing by...

110

SLIDE 111

Future Work: Toolkit

Easy-to-use, reliable, disk imaging software.
New file format for disk images.
Web-based database of hash codes.

Initial version is available for download.

111

SLIDE 112

Future Work: Economics and Society

Who is buying used hard drives and why?
Hard drive honeypot.
Compliance with FACT-A

This is a lot of work...

112

SLIDE 113

Future Work: Summary

Improved cross-drive forensics
2500 Drive Corpus
Open-Source Toolkits
Economics and Society

Questions?

113