What’s Happening In Forensics – Mar 03, 2020

In this episode, University College Dublin's Prof. Liliana Pasquale, program director for the new Master of Science in Cybersecurity, talks with Christa Miller about how the program came to be, some of the modules and the way they're structured, and what makes this program stand out from others. Also discussed is the need for a balance between academic research and practitioner perspectives, how "soft" skills lay a foundation for more technical skills, and the program's major advantages to prospective students.

In this paper, Kevin Lamshöft describes how researchers performed a threat analysis for a covert Command and Control (C2) channel using port scans as cover and syslog as carrier for data infiltration.

This talk includes a description of a theoretical threat scenario in which an adversary makes use of known covert channels in TCP and DNS, and proposes a novel method for hiding information in TCP ports scans and the resulting (sys)logs as a carrier for hidden messages.

For forensic purposes, the talk provides details on Indicators-of-Compromise (IoC) as well as mitigating measures aiming at preventing the covert channel apriori.

Moreover, the researchers propose a novel detection scheme in order to identify and prevent such threats hidden in port scans and evaluate its effectiveness using datasets generated by a proof of concept implementation of the proposed covert channel based threat scenario.

Learn more: https://dfrws.org/presentation/knock-knock-log-threat-analysis-detection-mitigation-of-covert-channels-in-syslog-using-port-scans-as-cover/

Starting with a physical crime scene – a fire – Manon Fischer describes how IoT devices such as “smart” plugs and thermostats store “distant traces” remotely, and could be used to help reconstruct a fire’s origin, cause, and timeline. Fischer also discusses the legal aspects of remotely stored data, which her future research will address.