Network Admin Consult Needed - very long - sorry

[Arnold]

I sure hope someone can help with this. The background is somewhat lengthy, so if you want to just see what the technical issues are then please feel free to scroll down to that section:

BACKGROUND

I have a client who stands accused of using his college's computer lab to hack and crack a bit. The college initially expelled him after a one hour interrogation (well that is an insult to those who interrogate for a living - it was a dean yelling at him for an hour and telling him to confess - I think she must watch way too much TV). After some strongly worded correspondence they agreed to allow him to take advantage of the appeal process - a process which they had initially and on three seperate occassions denied existed - "as a courtesy."

We had a "guilty until proven innocent" hearing on Wed. with a decision promised within 24 hours. For those of you who don't know what one of these GUPI things is like I'll give a brief explanation. First, this is the most common (in my experience) method for companies and colleges (and often parents) to conduct themselves when they are angry at someone and want to get rid of them. Second, it is also what life would be like without Article III and the 4th, 5th, 6th, 7th and perhaps 8th amendments to the constitution.

We were told that my client was guilty, that he could appeal to a committee hand picked by the people who expelled him. The committee included an administrator who had no job security, a student who was there on at least a partial athletic scholarship and a professor who thankfully had tenure. So we had one member who could safely rule against the administration. We were told that the student must present his defense before he saw any of the evidence against him, he could not examine or cross examine witnesses, he could not have anyone testify in his defense, his attorney could be present but could not speak (and that was an accomodation) and if anyone said anything the attorney for the administration did not want to hear there was a security guard outside the door to throw the offender out. (I thought the security guard was a nice touch - most institutions are not so creative as to come up with that bit of intimidation).

We presented our case which included a brief opening statement by the student, an affidavit from the guilty student who actually admitted to doing the hacking and admitted that he stole my clients login info since it was easy to do as they were roommates, and the letter the real hacker had written to the administration at the time of the expulsion explaning that he had done this on his own, and pretty much that was all we had - no I didn't do it, here's the confession from the guy who did. I also had about a five page pre-hearing brief which they accepted.

The college then presented their witness the director of IT, who happens to be married to the college's president (a little additional intimidation for the board - the subtle do what I want or I'll have my husband fire you undercurrent) who provided some xls docs she had cobbled together that purported to show that unauthorized activity took place under my clients log in (we knew that) and that my client was at the computer when the activity took place (we denied that) and that was their case. We were not allowed to ojbect to the evidence, nor were we allowed to directly question the official about the evidence, nor were we allowed to question the people who created the document. We have no idea if the document is at all accurate or where it came from.

TECHNICAL QUESTION

If you read to here congrats, if you scrolled to here thanks.

There is a document that purports to be a log of all file modification events taking place during a specified time frame and includes a column marked name, a column marked folder, a column maked size, a column marked type and a column marked Date modified (containing date and time). This is a Windows O/S machine (I believe xp) connected to the network.

So I have a few questions - First, is there anyway to tell if the file access was a routine windows o/s event or had to be directed by the user. Second, is there anyway to say if any particular file is NEVER UNDER ANY CIRCUMSTANCES accessed by either windows, or a legitimate program, or a web infiltration and therefore it COULD ONLY HAVE BEEN DONE BY THE STUDENT from the keyboard at the moment the file was accessed. Lastly, is there any way to say that the file COULD NEVER be accessed by a malicious program placed while the user was away and running in the background, such that the user did not know it was running while the user was working.

In other words their case is strictly circumstantial, they have no evidence that he was the malicious user (no prohibited programs in his .ftp directory or anything like that) they only have the coincidence of time and their position is - he was in the room, his login was being used, he must have done it.

If anyone can help please PM me and we'll talk about where we go from here. Thanks for your patience.

 

[Greebo]

Arnold,

Well I'm pretty amazed that, given that you have a confession from a roommate that the roommate did the hacking, that they refuse to listen to that and want to pin it all on your client - however I suppose an argument can be made that your client was responsible for maintaining the sanctity of his security access, and thus is responsible for anything happening under his account... but that doesn't answer you questions.

So...

First, is there anyway to tell if the file access was a routine windows o/s event or had to be directed by the user.

That depends on the level of security enabled on the machine that hosts said file. For example, our network administrators have tools that can tell what files are open on a given server and by whom (whom being defined as a network identity). However, it is entirely possible, under windows, to impersonate a network identity using an application that runs on its own without that identity directly invoking it. Example: I wrote a program once that had to access several network resoruces from a web server and the web server itself run under a very gimped account (security first!). To access the file resources, I had to allow the web server to PRETEND to be another user, one that did have rights to those network resources. If you have the username and password of the identity to impersonate, doing this is a relatively simple matter.

Second, is there anyway to say if any particular file is NEVER UNDER ANY CIRCUMSTANCES accessed by either windows, or a legitimate program, or a web infiltration and therefore it COULD ONLY HAVE BEEN DONE BY THE STUDENT from the keyboard at the moment the file was accessed.

If the students keyboard is not physically connected to the computer hosting the file, no. Network access to a file carries some implicit credential information, but not whether its a real human or a program doing the request. Ultimately its always a program, when it comes down to it - even if the program is "explorer.exe".

LOCALLY speaking, maybe - IF the computer in question owning the file in question had an extremely high level of security enabled.

Lastly, is there any way to say that the file COULD NEVER be accessed by a malicious program placed while the user was away and running in the background, such that the user did not know it was running while the user was working.

I had to read that a few times to understand it, but the direct answer to your question is "it is only remotely likely" or "probably not". I need to change case around to explain it however:
You're asking if its possible to prevent any application from accessing a particular file without a user knowledge. The answer is yes - but to do so you would have to put gateway applications in place that on every file access request to the hard drive, alerted the user to the fact that the file was being accessed. Anti-virus software does that - so that every file that is accessed is accessed through the anti-virus software.

However, it bears pointing out that hundreds and thousands of files get accessed on a computer, as part of routine operation, without the user EVER being made aware of it. (Some applications can even run in a fashion that prevents them from being seen by the user even when they look at the list of running processes.)

Background applications run all the time and access application files, support libraries, logs, and data files to name just a few types without ever alerting the user. Antivirus software can handle it - but if a user had to respond to every single file request being made, thats all they would ever do.

For a SINGLE file, its more plausible - a gateway application that traps all file requests and only alerts the user when specific files are touched is possible, but like I said before, unlikely.

So in other words, its extremely possible for a file on a computer to be affected by a malicious program - especially one running in a hidden fashion - and that your client might never have known about it. That's the very definition of how computer viruses work.


Oh - sorry - just saw the PM request - well if you want more info - or my technical credentials - PM me.

 

[Arnold]

Arnold,

Well I'm pretty amazed that, given that you have a confession from a roommate that the roommate did the hacking, that they refuse to listen to that and want to pin it all on your client - however I suppose an argument can be made that your client was responsible for maintaining the sanctity of his security access, and thus is responsible for anything happening under his account... but that doesn't answer you questions.

They did expel the other guy and he is not putting up a fight. My counter argument to the responsiblity charge (this is one of the school's arguments) is that a policy holding one responsible in ALL circumstances for use of their credentials is unworkeable. What happens when the Dean is hacked? Do you fire him because a student was malicious. They would all say no. What is the reasoning - because the Dean was not culpable, and the same applies here. There is no culpability when one is the victim of theft.

Officer: what happened here?
Me: I left the house unlocked just for a few minutes when I ran up to the store for a gallon of milk and someone stole my stereo.
Officer: you are under arrest, you were told you would be held responsible if your stuff is stolen, even if you didn't steal it.
Me: Stupid is not the same as theft.
Officer: Tell it to the judge from your jail cell.

I need to think about the rest of what you wrote.

Thanks.

 

[Greebo]

Its an unworkable policy, I agree.

Let me know if you need anything more or further explanation.

 

[mikea]

The directory time stamps on the files and folders can easily be modified. If a real pro got in the times would never have changed.

 

[TMetzinger]

I happen to feel that holding a user responsible for the use of his account is the desirable state, but this is only acheivable when access is granted via a more secure system than passwords, such as a token or biometrics.

Unfortunately, you're dealing with a private institution that can get away with making it's own rules, and unless you are willing to spend $$$ for a civil suit (and then you'll probably only be able to recover a prorated amount of the tuition paid), you play by their rules (which I agree are unfair).

Now, if this were a state school, you could use political influence to convince the administration to see it your way.

Best wishes,

Timothy Metzinger
Nortel Government Solutions, Inc
Certified Computer Forensics Technician
Certified Information Systems Security Professional

 

[Arnold]

The directory time stamps on the files and folders can easily be modified. If a real pro got in the times would never have changed.

I'm I understand that you are saying that the time stamps may not be accurate, thanks for pointing that out.

 

[SJP]

PM sent

Steve

 

[Arnold]

I happen to feel that holding a user responsible for the use of his account is the desirable state, but this is only acheivable when access is granted via a more secure system than passwords, such as a token or biometrics.

Unfortunately, you're dealing with a private institution that can get away with making it's own rules, and unless you are willing to spend $$$ for a civil suit (and then you'll probably only be able to recover a prorated amount of the tuition paid), you play by their rules (which I agree are unfair).

Now, if this were a state school, you could use political influence to convince the administration to see it your way.

Best wishes,

Timothy Metzinger
Nortel Government Solutions, Inc
Certified Computer Forensics Technician
Certified Information Systems Security Professional

Well, without disclosing our legal strategy I would point out that the vast majority of civil court cases are company v. company, or company v. person. person v. company and person v gov't is very small by comparison - but I don't have the actual numbers.

There are whole bodies of law to govern the relations between non governmental entities and individuals, these are contract law, tort law, property law, probate law, family law - the list goes on.

If I give $x thousand to an educational institution it is in exchange for something and that something is not arbitrary and unfair treatment but rather it is for an education consistent with the known capabilities of the institution and fair treatment in grading and other aspects of the relationship. So for example, if the tenant in the dorm room next to mine vandalizes the hallway I do not expect to be expelled for their misbehavior. I would argue that this is part of the contract - my tuition was not a gift, rather it was a bargained for exchange. The fact that the administration is in a position of extraordinary power only increases their duty to be fair and even handed.

But hey, I'm just a country lawyer from the village of Ardmore.

 

[TMetzinger]

I agree with your argument, but I'm not sure if the money spent trying to make the point via a lawsuit wouldn't be better spent going to a different and better school.

Depends on how much money is available, I guess.

 

[Ed Guthrie]

I agree with your argument, but I'm not sure if the money spent trying to make the point via a lawsuit wouldn't be better spent going to a different and better school.

Depends on how much money is available, I guess.

If the student gets expelled money is the least of his/her concerns--gaining subsequent admission to another school of equal or better status with an expulsion on my transcript would be my chief concern. I fully understand why a student would fight this with every resource available.

 

[TMetzinger]

Sorry, that was my point as well - spend the money on getting a clean transcript, rathern than trying to force the college to admit they were self-righteous ig'nant bastids. Then take your money and get your education somewhere else.

Threatening a lawsuit and publicity might be enough pressure for them to "seal" the proceedings and give the student a clean sheet for the next school.

 

[Brian Austin]

There are very few applications that produce unbreachable log files. Anything in the Windows OS can be faked at any number of levels, some as simple as resetting the time or switching timezones if the user has the correct permissions.

While doing some network security work for local law enforcement, I chose my applications carefully, selecting logging systems and sniffers that have been presented in court before with success. This is not a long list of applications.

Technically, the college can easily be defeated in a lawsuit with a network security expert on your side. An Excel spreadsheet showing exported log files is ridiculous at such an amateur level, it doesn't surprise me that the college's systems couldn't have been easily hacked. I'd also suspect that, unless someone had the foresight to actually archive those log files, they have already been overwritten by more recent logs. If you're going to court, they may not have any evidence left.

 

[astanley]

Former security guy (in my past), current business development person that works on contracts that cover Sensitive and Secure IT investigations (of the many services my company offers...).

In no case that we have seen has someone been hung out on the absoultely error ridden data from standard Windows services - in fact, in all of our security agreements, we build in the specified tool sets and rules structures we use for forensics and security management - and Windows is NOT open for consideration.

My guess is, based on my experience in this arena, that someone has a marginal clue and is just throwing stuff around as "conclusive". Under any serious technical analysis the data would not hold water.

Good luck to your client.

Cheers,

-Andrew

 

[astanley]

Former security guy (in my past), current business development person that works on contracts that cover Sensitive and Secure IT investigations (of the many services my company offers...).

In no case that we have seen has someone been hung out on the absoultely error ridden data from standard Windows services - in fact, in all of our security agreements, we build in the specified tool sets and rules structures we use for forensics and security management - and Windows is NOT open for consideration.

My guess is, based on my experience in this arena, that someone has a marginal clue and is just throwing stuff around as "conclusive". Under any serious technical analysis the data would not hold water.

Good luck to your client.

Cheers,

-Andrew

 

[Arnold]

Former security guy (in my past), current business development person that works on contracts that cover Sensitive and Secure IT investigations (of the many services my company offers...).

In no case that we have seen has someone been hung out on the absoultely error ridden data from standard Windows services - in fact, in all of our security agreements, we build in the specified tool sets and rules structures we use for forensics and security management - and Windows is NOT open for consideration.

Good to know, thank you.

My guess is, based on my experience in this arena, that someone has a marginal clue and is just throwing stuff around as "conclusive". Under any serious technical analysis the data would not hold water.

Good luck to your client.

Cheers,

-Andrew

You are spot on.
Thank you for taking the time to respond.

 

[Arnold]

There are very few applications that produce unbreachable log files. Anything in the Windows OS can be faked at any number of levels, some as simple as resetting the time or switching timezones if the user has the correct permissions.

While doing some network security work for local law enforcement, I chose my applications carefully, selecting logging systems and sniffers that have been presented in court before with success. This is not a long list of applications.

Technically, the college can easily be defeated in a lawsuit with a network security expert on your side. An Excel spreadsheet showing exported log files is ridiculous at such an amateur level, it doesn't surprise me that the college's systems couldn't have been easily hacked. I'd also suspect that, unless someone had the foresight to actually archive those log files, they have already been overwritten by more recent logs. If you're going to court, they may not have any evidence left.

Thanks Brian, I am pleased to see that my initial assessment was correct. I have not been a serious computer geek since the late '60s (can you say "core" memory?) but I try to keep abreast of the technology.

 

[Areeda]

Just one minor point. When these kind of accounts are created the user usually agrees to the terms of use that include something like "will take all reasonable precautions to safeguard the security of their account".

When you say it's easy to get a roomates password, I wonder.

I hope you get a favorable conclusion to this.

Joe

 

[tdager]

Areeda....I agree.

I also do Security Consulting and one of the things I tell my clients all of the time is that technology is not always the answer, a strong policy can also work.

While I agree that one cannot be 100% responsible for all actions (if the A/D server is hacked and the passwords compromised that is the admins fault, not the end-user), in this case if your client shared the password, stickied it to the monitor, etc. then (if such a policy exists) he is in violation of policy.

Now for the legalities, well that is why he has you, his attorney.

 

[jesse]

When you say it's easy to get a roomates password, I wonder.

It is very easy.
http://www.amecisco.com/hkstandalone.htm
Is a very good method. You just unplug the keyboard from the computer, plug the keyboard into this, and plug this into the computer. It will record every key typed. The user could look for keylogging software all day, and wouldn't find it..since it's jsut a hardware device inline with the keyboard.

I myself.. have actually looked for such things inline with my keyboard in the past. I was probably being a bit paranoid.

 

[Brian Austin]

It will record every key typed. The user could look for keylogging software all day, and wouldn't find it..since it's jsut a hardware device inline with the keyboard.

The one I have will record an average user's keystrokes for almost a year before the FIFO log starts losing data.

And yes, it will capture EVERYTHING.