PRELIM Flashcards
(99 cards)
1
Q
tools and techniques that frustrate forensic tools, investigations,
and investigators
A
ANTI FORENSICS
2
Q
a model that enables customers to be in control of their
computing resource needs and add computing resources as they
wish through a highly automated and responsive set of processes.
A
CLOUD COMPUTING
3
Q
any device capable of performing logical, arithmetic, routing, or
storage facility, or equipment or communications facility or
equipment directly to or operating in conjunction with such
device
A
COMPUTER
4
Q
-
any representation of facts, information, or concepts in
a local computer system or online
A
COMPUTER DATA
5
Q
refers to any device or group of interconnected or related devices, one or more of which, pursuant to a
program, performs automated processing data
A
COMPUTER SYSTEM
6
Q
application of scientific principles to the process of discovering information from a digital device
A
DIGITAL FORENSICS
7
Q
stores and provides relatively quick access to large amounts of data on an electromagnetically charged surface
A
HARD DISK/ DISK DRIVE/HARD DRIVE/HARD DISK DRIVE
8
Q
physical components of a computer
A
HARDWARE
9
Q
involves the application of scientific principles to the process of discovering information from mobile devices which include cell phones, smartphones, and table devices.
A
MOBILE FORENSICS
10
Q
involves capturing, recording, and analysis of network events to discover source of security attack
A
NETWORK FORENSICS
11
Q
a set of instructions compiled into a program that performs a particular task
A
SOFTWARE
12
Q
criminal act committed via computer
A
Computer Crime
13
Q
criminal activities in which a
computer was peripherally/incidentally involved
A
Computer Related Crime
14
Q
a criminal activity which has been committed through, or facilitated by the Internet.
A
Cybercrime
15
Q
any criminal activity which involves the
unauthorized access, dissemination, manipulation, destruction, or corruption of electronically stored data
A
Digital Crime
16
Q
application of investigation and analysis techniques to gather
and preserve evidence from a particular computing device in a
way that is suitable for presentation in a court of law
A
COMPUTER FORENSICS
17
Q
Computer Forensic is concerns in the process of
A
a. obtaining
b. processing and analyzing
c. storing digital information
for criminal, civil and administrative cases
18
Q
USES OF COMPUTER FORENSICS IN LAW ENFORCEMENT
A
- recovering deleted files
- searching unallocated space
- tracing artifacts
- processing hidden files
- running a string
search
19
Q
COMPUTER FORENSICS ASSISTANCE TO HUMAN RESOURCES /
EMPLOYMENT PROCEEDINGS
A
employer safeguard program
20
Q
COMPUTER FORENSICS SERVICES
A
- data seizure
- data duplication/preservation
- data recovery
- document searches
- media conversion
- expert witness services
- Computer evidence service options
- Other miscellaneous services
21
Q
data duplication/preservation
- When one party must seize data from another, two concerns must be
addressed:
A
a. the data must not be altered in any way
b. the seizure must not put an undue burden on the
responding party
22
Q
Computer evidence service options
- various levels of service, each designed to suit your individual
investigative needs
A
a. Standard service
b. On site service
c. Emergency service
d. Priority service
e. Weekend service
23
Q
Other miscellaneous services
A
- On-site seizure of computer data in criminal investigations
- Analysis of computers and data in civil litigations
- On-site seizure of computer data in civil litigations
- Analysis of company computers to determine employee activity
- Assistance in preparing electronic discovery requests
- Reporting in a comprehensive and readily understandable manner
- Court-recognized computer expert witness testimony
- Computer forensics on both PC and Mac platforms
- Fast turnaround time.
24
Q
BENEFITS OF PROFESSIONAL
FORENSIC METHODOLOGY
A
- No possible evidence is damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer.
- No possible computer virus is introduced to a subject computer during the analysis process.
- Extracted and possibly relevant evidence is properly handled and protected from later mechanical or electromagnetic damage.
- A continuing chain of custody is established and maintained.
- Business operations are affected for a limited amount of time, if at all.
- Any client attorney information that is inadvertently acquired
during a forensic exploration is ethically and legally respected
and not divulged
25
STEPS TAKEN BY COMPUTER FORENSICS SPECIALISTS
1. protect
2. discover
3. recover
4. reveal
5. access
6. analyze
7. print out
8. provide
26
CHALLENGES FACED BY INVESTIGATORS OF ELECTRONIC EVIDENCE
1. evidence may be difficult to detect
2. degree of anonymity
3. electronic evidence are quite fragile
4. global nature of evidence
27
CYBERCRIME CLASSIFICATIONS
(Inside or OUtside)
1. Against Individuals
2. Against Property
3. Against Organizations
4. Against Society
28
Against Individuals
1. e-mail spoofing,
2. spamming,
3. cyber defamation,
4. cyber harassment and cyberstalking.
29
which the e-mail header is forged so that the mail appears to originate from one source but actually has been sent from another source.
e-mail spoofing
30
sending multiple copies of unsolicited mails or mass e-mails such as chain letters.
Spamming
31
This occurs when defamation takes place with the help of computers and/or the Internet
Cyber Defamation
32
following an individual's activity over internet
Cyber Harassments and Cyber Stalking
33
Against Property
1. credit card frauds
2. internet time theft
3. intellectual property crimes.
34
the usage of the Internet hours by an unauthorized person which is actually paid by another person
internet time theft
35
intellectual property crimes - includes the following:
1. Software piracy
2. Copyright infringement
3. Trademark violations
4. Theft of computer source code
36
Illegal copying of programs, distribution of copies of software.
Software piracy
37
Using copyrighted material without proper permission
Copyright infringement
38
Using trademarks and associated rights without permission of the actual holder.
Trademarks violations
39
Stealing, destroying, or misusing the source code of a computer.
Theft of computer source code
40
Against Organizations
1. unauthorized accessing of computer 2. denial of service
3. computer contamination/virus attack
4. e-mail bombing
5. salami attack
6. logic bomb
7. trojan horse
8. data diddling.
41
Accessing the computer/network without permission from the owner
Unauthorized accessing of computer
42
The criminal reads or copies confidential or proprietary information, but the data is neither deleted nor changed
Computer voyeur
43
When Internet server is flooded with continuous bogus requests so as to denying legitimate users to use the server or to crash the server.
Denial of service
44
a computer program that can infect other programs with virus
Computer contamination / Virus attack
45
sending large number of mails to the individual or company or mail servers ultimately resulting into crashing
e-mail bombing
46
financial crimes committed when negligible amounts are removed and accumulated into something larger
Salami attack
47
an event dependent program designated to crash the computer
Logic bomb
48
a program downloaded and installed on a computer that appears harmless, but is, in fact, malicious
Trojan horse
49
altering of raw data before it is processed by a computer and then changing it back after the process was completed
Data diddling
50
Against Society
1. Forgery
2. Cyber Terrorism
3. Web Jacking
51
hackers gain access and control over a website of another even changing the content of website
Web Jacking
52
no physical or geographic boundaries
cybercrime
53
committed in a certain place to a certain
target / victim at a time
traditional crime
54
Reasons why cybercrimes continue to exist despite creation of anti
cybercrime laws:
1. Inherent vulnerability of computer networks/ internet.
2. The enormous number of computers connected to the internet
gives cybercriminals a wide array of target.
3.The internet is an effective medium for running automated systems, thus leading to automation of illegal internet activity.
4. The unregulated nature of the internet.
5. Overwhelming impact of advancements in technology.
6. Anonymity in the virtual world
7. Different cybercrime laws of different countries
8. Existence of different social engineering techniques
55
TYPES OF HACKING
A. Ethical Hacking
B. Unethical Hacking
56
- used to identify vulnerabilities and secure systems
- simulation of real-world attacks to fix security flaws
- conducted within legal and ethical boundaries
Ethical Hacking
57
- violation of ethical standards and regulations
- unauthorized access to sensitive information, disrupt operations,
or cause harm
Unethical Hacking
58
Phases of Unethical Hacking
1. Performing Reconnaissance Reconnaissance (pre-attack phase)
2. Scanning and Enumeration
3. Gaining Access
4. Escalation of Privilege
5. Maintaining Access
6. Covering Tracks and Planting Backdoors
59
Some Techniques for Reconnaissance:
a. Dumpster Diving
b. War Driving
c. Sniffing
d. Social Engineering
60
systematic attempt to locate, gather, identify, and record
information about the target
Performing Reconnaissance (pre-attack phase)
61
probing a target network/system to
identify potential vulnerabilities
Scanning
62
gathering information about the target system or network
Enumeration
63
aim is to become system administrator & have full access and control
Escalation of Privilege
64
pull down the password file or steal other passwords so that they can
access other user’s accounts
Maintaining Access
65
set of tools used to help the attacker maintain his access to the system and use it for malicious purposes
rootkits
66
a. Using rootkits or other tools to cover their tracks
b. Hunt down log files and attempt to alter or erase them
c. Utilize file hiding techniques, such as hidden directories, hidden attributes, and alternate data streams (ADS)
d.Creation of backdoors to reenter the computer at will
e. Insertion of programs or malicious codes for future activation in hidden
files/directories botnet & zombie
Covering Tracks and Planting Backdoors
67
Identity Theft and Identity Fraud
Criminal Acts Facilitated by Identity Theft / Fraud:
1.Money Laundering
2.Drug trafficking
3.Alien Smuggling
4.Weapon Smuggling
5.Extortion
6.Misappropriation of Funds
7.Embezzlement and other financial crime
68
Types of Identity Theft and Identity Fraud
1. Assumption of Identity
2. Theft for Employment
3. Reverse Criminal Record Identity Theft
4. Virtual Identity Theft / Fraud
5. Credit Identity Theft / Fraud
69
- rarest form of identity theft/fraud
- occurs when an individual simply assumes the identity of his/her
victim, including all aspects of the victim’s life
Types of Identity Theft and Identity Fraud
70
- fraudulent use of stolen or fictitious personal information to obtain employment
- common to illegal immigrants
Theft for Employment
71
occurs when a criminal uses a victim’s identity, not to engage in criminal activity, but to seek employment
Reverse Criminal Record Identity Theft
72
- use of personal, professional, or other dimensions of identity toward the development of a fraudulent virtual personality
- often used for online dating, role playing, and accessing deviant
sites or locations containing questionable content and are used by
individuals to explore forbidden areas or to satisfy their curiosity behind a veil of anonymity
Virtual Identity Theft / Fraud
73
- most common and most feared type
-use of stolen personal and financial information to facilitate the
creation of fraudulent accounts
Credit Identity Theft / Fraud
74
illegal use of a stolen credit card
credit card fraud
75
Other Classifications of Identity Fraud
1. Financial Identity Theft
2. Criminal Identity Theft
3. Identity Cloning
4. Business / Commercial Identity Theft
76
identity = gain financial transactions
Financial Identity Theft
77
identity = committing crimes usually cybercrimes
Criminal Identity Theft
78
-offender assumes the identity of the victim in his or her daily life
Identity Cloning
79
use of another business’ or organization’s name to obtain credit,
funds, goods, or services
Business / Commercial Identity Theft
80
Victimology
Susceptible victims of Identity Theft/Fraud include but are not
limited to the following:
1.Smartphone owners who fail to safeguard their devices with passwords
2.People who publicly share personal information in social networking sites
3.People who are usually using services of online banking, online
communication, and online shopping
4.People / companies who experienced data breaches
81
CATEGORIES OF TECHNIQUES EMPLOYED BY IDENTITY
A. physical
B. virtual
82
Physical Methods of Identity Theft
1. Mail Theft
2. Dumpster Diving
3. Theft of Computers
4. Bag Operations
5. Child Identity Theft
6. Insiders
7. Fraudulent / Fictitious Companies
8. Card Skimming, ATM Manipulation, and Fraudulent Machines
83
retrieving info from unsecured mail boxes
Mail Theft
84
- surreptitious entry into hotel rooms to steal, photograph, or photocopy
documents, or copy magnetic media, or download information for a laptop
computer and is made easier with the availability of mass storage
removable media
Bag Operations
85
- stealing their children’s identities for employment, evasion of
authorities, financial gain and credit
5. Child Identity Theft
86
- reading and recording of personal information encoded on the
magnetic strip of an automated teller machine or credit card
Card Skimming, ATM Manipulation, and Fraudulent Machines
87
VIRTUAL OR INTERNET FACILITATED METHODS
1. Phishing
2.Spyware and Crimeware
3.Keyloggers and Password Stealers
4. Trojans horse or Trojan
88
- malware that is often disguised as legitimate software
Trojans horse or Trojan
89
devices or software programs which record the input activity of a
computer or system
Keyloggers
90
type of computer virus that infects your machine, records all of your user
passwords and then emails them to a remote user
Password Stealers
91
a browser based software designed to capture and transmit
privacy sensitive information to third parties without the knowledge and
consent of the user
Spyware
92
is a spyware created or employed specifically to facilitate identity theft or other economically motivated crime.
Crimeware
93
provide mechanism for cybercriminals to change website IP addresses repeatedly without affecting the domain name
Botnets
94
e-mail = recipient for his/ her assistance in claiming “found” money
Advance fee Fraud / 419 Fraud
95
malicious programs which redirect user’s network traffic to undesired sites
Redirectors
96
redirects the connection between IP address and its target service
and is accomplished when the link is altered so that consumers are unwittingly redirected to a mirror site
B. Pharming
97
company trademarks and logos
A. Spoofing
98
solicitation of information via e mail or directing individuals to
fake websites
Phishing
99
CATEGORIES OF PHISHING ATTACKS
A. Spoofing
B. Pharming
C. Redirectors
D. Advance fee Fraud / 419 Fraud
E. Botnets
