In the recent article "Are users getting smarter?" by Darren Ilston of MelBek Technology, the conclusion reached was that they are, and that they think they are.
I disagree.
Users have become more knowledgeable and are (finally!) becoming more aware of how computers work.
This doesn't make them smarter, but it does make them more proficient.
This means that a large percentage of them are aware of the fact that they are leaving a trail, and that means the more intelligent ones take some precautions.
Investigation work has always depended far more upon the perpetrator making mistakes than on high quality detective work.
Remember, analysis of prison inmates has found that they are, on average, lower than average intelligence, and an extremely high percentage of them have serious metal health issues–serious enough that they ought to be in treatment rather than incarcerated.
This is not because criminals are mentally unstable or stupid.
It merely means that the ones that get caught tend to be those things.
Most of them are in prison due to a failure to keep their mouths shut, and/or bad luck.
For instance, the burglars who robbed the Amsterdam diamond vault in 2004, while they did a very good job of penetrating security, were greatly assisted by some very basic holes in the design of the security system.
They were caught, not due to great detective work, but because one of them dispersed evidence across a large area of countryside–the man who masterminded the theft is still at large.
Are we supposed to comment on an article we didn't read or are you going to give a link to it (if it is available)? ?
jaclaz
[Quickly updates articles/papers page]
Woah there! Are you telling me you don't read the newsletter??
LOL lol
Woah there! Are you telling me you don't read the newsletter??
LOL lol
No, 😉 I am telling wizodd that when a resource is available on the internet, it is only a form of courtesy to add a link to it, expecially if you wish to comment on it, as not everyone reading the board is a member (and even if it is a member he may not read the newsletter) and not everyone visits the
http//www.forensicfocus.com/computer-forensics-papers
I personally find that 3/4 of the success of the Internet is due to the ability to have links to resources, let's make use of it.
)
jaclaz
I agree with wizodd's statements…I think from a digital analysis perspective, a lot of users, particularly the younger age groups (teens, mid-twenties) are getting more knowledgeable about some things, without being overly concerned…or better, thinking that they do, in fact, know it all…about other things.
As to catching the bad guys, I think that another thing to add to the mix is that there are a number of investigators who have a difficult time conceptualizing and transitioning from physical world crimes to the digital realm. When there's a home invasion, in the physical world, one expects to find some means of entrance (broken window glass, forced door, etc.) or some other indications as to the crime having occurred. The same sorts of artifacts are available in the digital realm, but users/victims aren't detecting/reporting them in a timely manner, and it's difficult for many investigators to transition their mindset, as well.
It seems like it all revolves around the meaning of "smart"
http//
If we assume that smart="intelligent", wizodd's thoughts are very accurate and true. )
If we assume that smart= "astute, as in business" the article seems regaining the lost accuracy, though "knowledgeable" as wizodd suggested, or "expert" might be a better choice for the adjective.
There is however a point that noone has touched if not marginally, and that, being one of my favorite ones wink , I will propose
- a third variable in the equation is the knowledge of the LE officers involved
Though nowadays even my cat (BTW, not a particular smart one) knows
that in a real world crime scene you are supposed to NOT touch anything until the scientific experts can make their samplings and investigations, a large number of first responders will
- check the last numbers called on a handy/read messages
- access the PC/laptop on the scene to see what was last activity, opening documents, running programs, etc., etc.
Thus making things a bit more difficult during the later digital forensical exam of the devices, and in some cases outright overwriting/deleting vital information.
So, if I may, I would complete the article by saying that though the "new technologically aware generation" of suspects appears like getting more technically knowledgeable than before, there seems not yet a parallel increase in the average LE knowledge, which has very little to do with being "smart" or "dumb", but rather a lot with being "updated" or "outdated".
jaclaz
Well I like this topic alot and, even if my knowledge is not that much, and my english is painfull, i would like to share my (and not only mine) opinion about this topic.
I'm taking part in a computer forensic course subtitled "antiforensic edition" and we are having a lot of talks about the evolving of knowledge, tools and techniques that are useful (and used) to elude, compromise, delay or obstruct a digital forensic investigation.
It's a matter of fact that "privacy preservation" (antiforensic) tools and technologies are decades ahead compared to tools, and technologies available for a digital forensics expert to perform an analysis and investigation.
and it's also a matter of fact that these technologies and tools require really little if no knowledge at all to be used even by the dumbest casual user, and that's the point users have in their potential arsenal an even growing set of tools and technologies that if used properly can make the life of an investigator an ever ending pain.
like, look at truecrypt, a full disc encryption.. if you find a powered off machine with a full encrypted disc using truecrypt? and maybe with an hidden OS installation too, for plausible deniability, what can you do?
really not much to extract data from that hard drive..
So what?
well if an user is really paranoid there's not much to do, but how many users do you know that are REALLY paranoid?
the good point that many people don't consider is that using privacy conservation/preservation tools (antyforensic tools) on the long run leads to a feeling of security, and having a feeling of being secure is the primary way to uncover yourself, you'll begin to commit errors, you will gradually stop to clean your traces sistematically and this will inexorably lead you to expose yourself sooner or later.
In addition we have to consider that being meticulous in antiforensic activities is really annoying, time consuming and on the long run, stressing, and all of these factors will affect your cloaking skill.
so to the question are people getting smarter?
well, maybe, but not in the sense of knowledge, they are simply getting aware that there are methods that can help them to preserve their anonimity online and cover their traces if conducting a crime, but the wetware is always to put on the line, and generally the wetware is the always the weak-link of the chain.
EDIT
oh and i would like to add a thing.
it's true that most of the times "bad guys" who are arrested, are arrested because they are dumb, but it's also true that in many situations, man is inclined to commit errors, wich doesn't necessarily means that he's stupid, it's a matter of instinct, you can't only rely on your brain, instinct will always play its role, and when it comes to crimes, instinct generally plays a bad role.