Forensic Question
Hey Guys,
I have a quick question that I hope somebody can answer.
Background:
Small real estate firm with WHS server ( less than 10 brokers), permissions set on folders to restrict access. Principal has a master password with access to every single folder
Event:
Person quits and there is a great suspicion that he copied entire server. Later I've learned that my boss shared his password, giving him unlimited access ( but no administrative privilages). They guys is not that smart, i think he just pluged in a flashdrive and copied.
Question:
How can I see if he did copy something? Any software etc?
Best,
Arv
I have a quick question that I hope somebody can answer.
Background:
Small real estate firm with WHS server ( less than 10 brokers), permissions set on folders to restrict access. Principal has a master password with access to every single folder
Event:
Person quits and there is a great suspicion that he copied entire server. Later I've learned that my boss shared his password, giving him unlimited access ( but no administrative privilages). They guys is not that smart, i think he just pluged in a flashdrive and copied.
Question:
How can I see if he did copy something? Any software etc?
Best,
Arv
No trees were killed in the posting of this message. However a large number of electrons were terribly inconvenienced.
Comments
-
Arvean
Member Posts: 87 ■■□□□□□□□□
No trees were killed in the posting of this message. However a large number of electrons were terribly inconvenienced. -
unsupported
Member Posts: 192
Doesn't it do it automatically?
Not by default. This is why many companies are left scratching their heads after they discover a data breach. You may be able to search the registry for artifacts relating to the existence of a USB drive. Here is a thread with some more details about where you can find the information on EH-Net, The Ethical Hacker Network - Scenerio.-un
“We build our computer (systems) the way we build our cities: over time, without a plan, on top of ruins” - Ellen Ullman -
tiersten
Member Posts: 4,505
Enabling auditing for any OS incurs a big performance penalty. That is why it isn't on by default.Doesn't it do it automatically? -
JDMurray
Admin Posts: 13,074 Admin
Adding/removing a plug-n-play device (like a USB drive) will appear in the Windows Security event log as object creation/deletion events, but only if the system is configured to specifically audit for those events--which Windows isn't by default.
If the suspect had sufficient access to make a full backup then he may have also had the access required to delete logs and disable/circumvent other system monitoring and safeguard software. If network operations isn't initially configured for the possibility of an insider attack then it can be very difficult to detect and almost impossible to prevent. -
Arvean
Member Posts: 87 ■■□□□□□□□□
Adding/removing a plug-n-play device (like a USB drive) will appear in the Windows Security event log as object creation/deletion events, but only if the system is configured to specifically audit for those events--which Windows isn't by default.
If the suspect had sufficient access to make a full backup then he may have also had the access required to delete logs and disable/circumvent other system monitoring and safeguard software. If network operations isn't initially configured for the possibility of an insider attack then it can be very difficult to detect and almost impossible to prevent.
Thanks so much for your feedback guys. I'm really upset about the whole thing because after spending so much time to give appropriate permissions and access to folders, I learned it's all wasted because my boss shared his password....
This person was not a hacker, nor an experienced user. He was a "Mac-boy" having real difficulties to work on PCs. What I think happened he logged in my bosses computer, plugged the drive and copied the whole shared directory.... So there's no software to see that,huh?No trees were killed in the posting of this message. However a large number of electrons were terribly inconvenienced. -
tiersten
Member Posts: 4,505
If auditing isn't on then no...What I think happened he logged in my bosses computer, plugged the drive and copied the whole shared directory.... So there's no software to see that,huh? -
cbigbrick
Member Posts: 284
USBDeview - View all installed/connected USB devices on your system
Looks pretty cool. I've been playing with it in the lab.And in conclusion your point was.....???
Don't get so upset...it's just ones and zeros. -
LarryDaMan
Member Posts: 797
Interesting thread and scenario, inside attacks have the potential to be real dangerous.
Off topic a little, but the more I read about the C|EH from the pen testing "community", the less I want to take the exam. Talk about no respect. It might as well be Hacker+ from CompTIA.
There are many many examples of this, but here is one that I just read today.
"We all know that ISC2 and GIAC aren’t going anywhere. As to the others, I think we will see some of them stay around where others such as EC Council’s will disappear." Kevin Johnson, GCIA GCIH GCFA GWAS CISSP CEH IBM CSE Inet+
Granted the guy teaches for SANS, so he may be biased, but there doesn't seem to be a lot of love for the C|EH out there in general.
Full Interview of Kevin Johnson
The Ethical Hacker Network - Interview: Kevin Johnson of SANS, InGuardians -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
What I think happened he logged in my bosses computer, plugged the drive and copied the whole shared directory.... So there's no software to see that,huh?
If that was the case, and even if you were auditing, it would just look like your boss copied the files himself. The sharing of the password undermined everything. -
Arvean
Member Posts: 87 ■■□□□□□□□□
USBDeview - View all installed/connected USB devices on your system
Looks pretty cool. I've been playing with it in the lab.
YOU ARE THE MAN!!!
This is exactly what I need. We have a policy in the office that nobody can use flash drives ( except for me, and I have only 2). I'll scan the office for any "hostile" flashdrives tomorrow...
Sounds like Friday Fun... I really want to get that guy... Don't you just hate when somebody messes with your system in such a rude way?
You guys are the best, thank you so much for all your feedback...No trees were killed in the posting of this message. However a large number of electrons were terribly inconvenienced. -
shednik
Member Posts: 2,005
LarryDaMan wrote: »Interesting thread and scenario, inside attacks have the potential to be real dangerous.
Off topic a little, but the more I read about the C|EH from the pen testing "community", the less I want to take the exam. Talk about no respect. It might as well be Hacker+ from CompTIA. There are many many examples of this, but here is one that I just read today.
"We all know that ISC2 and GIAC aren’t going anywhere. As to the others, I think we will see some of them stay around where others such as EC Council’s will disappear." Kevin Johnson, GCIA GCIH GCFA GWAS CISSP CEH IBM CSE Inet+
Granted the guy teaches for SANS, so he may be biased, but there doesn't seem to be a lot of love for the C|EH out there in general.
Full Interview of Kevin Johnson
The Ethical Hacker Network - Interview: Kevin Johnson of SANS, InGuardians
Go for the OSCP instead...more fun and more of a challenge! -
LarryDaMan
Member Posts: 797
Go for the OSCP instead...more fun and more of a challenge!
It does look good, the course and certification are relatively cheap ($550-$700), and I can earn 40 CPEs towards CISSP recertification.
"The OSCP is one of very few certifications which actually proves practical ethical hacking skills."
Hmm... -
tiersten
Member Posts: 4,505
All it proves is that somebody plugged one in. It doesn't say who it was or what they did with the drive.This is exactly what I need. We have a policy in the office that nobody can use flash drives ( except for me, and I have only 2). I'll scan the office for any "hostile" flashdrives tomorrow... -
Arvean
Member Posts: 87 ■■□□□□□□□□
All it proves is that somebody plugged one in. It doesn't say who it was or what they did with the drive.
True, but that's more than enough to know if something actually happened. We're a small office, nobody uses flash drives..
No trees were killed in the posting of this message. However a large number of electrons were terribly inconvenienced. -
dynamik
Banned Posts: 12,312 ■■■■■■■■■□
LarryDaMan wrote: »It does look good, the course and certification are relatively cheap ($550-$700), and I can earn 40 CPEs towards CISSP recertification.
"The OSCP is one of very few certifications which actually proves practical ethical hacking skills."
Hmm...
Yea, then you can do GPEN after that.
