91.580.203ComputerNetworkForensics.docxVIP

91.580.203 Computer Network Forensics Computer Physical Security Xinwen Fu Laws of Physical Security Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. Law #5: Weak passwords trump strong security Law #10:Technology is not a panacea Security is only as strong as the weakest link. /technet/archive/community/columns/security/essays/10imlaws.mspx Dr. Xinwen Fu 2 Dr. Xinwen Fu 3 Scenarios You are a crime investigator and have a suspect’s computer How can you get access to the data on the hard disk? How can you get her password on this computer? You are a secret agent, and have 10 minutes of access to an opponent General’s computer How can you get access to the data on the hard disk? How can you get her password on this computer? Dr. Xinwen Fu 4 Simple Approach to Access Hard Disk Recall you have the physical access to somebody’s computer Tools you need to break into an unsecured PC: A Phillips-head screwdriver USB Thumb drive Bootable Linux CD Bootable Linux Floppy Hard drive mounting kit Dr. Xinwen Fu 5 What if the machine has a BIOS password? BIOS password can be bypassed Remove the machine’s hard drive and put it in another machine Reset the BIOS password via jumpers on the motherboard Simply remove the CMOS battery to reset /encyclopedia/articles/cmosreplace.asp Dr. Xinwen Fu 6 Laptop CMOS Battery A little bit work Dr. Xinwen Fu 7 Mounting CD under Linux Once accomplished, boot off CD or floppy. The hard disk will be automatically mounted to the Linux on CD or floppy If not, use Linux command and mount it What is the next step? Copy Delete Change What else? Disk Encryption Disk encryption doesn’t work. Keys are stored in memory. Physical access can reveal the keys Memory can be preserved between boots. Canned air increases time to 10 minutes. Liquid nitrogen increase time by 1 hour. /?p=1257 Dr. Xinwen Fu 8 CIS414 Dr. Xinwen Fu 9 Resetting Admin PasswordsApproach one - Use Windo