Cisco Router and Switch Forensics. Investigating and Analyzing Malicious Network Activity

Cisco Router and Switch Forensics: Investigating and Analyzing Malicious Network Activity......Page 1
Copyright Page......Page 3
Contents......Page 7
Lead Author and Technical Editor......Page 4
Contributing Authors......Page 5
An Overview of Cisco Router and Switch Forensics......Page 28
Network Architectures......Page 29
Routers......Page 32
Routers......Page 33
Switches......Page 34
Syslog......Page 35
Who Spotted It......Page 36
Relevant Laws......Page 37
Law Enforcement Issues......Page 38
Setting Up a Secure Network......Page 39
How to Respond......Page 40
Frequently Asked Questions......Page 41
Digital Forensics and Analyzing Data......Page 42
The Phases of Digital Forensics......Page 43
Collection......Page 44
Preparation......Page 46
Hardware Documentation Difficulties......Page 48
SANs......Page 49
Difficulties When 
Collecting Data from Virtual Machines......Page 50
Difficulties When Conducting 
Memory Acquisition and Analysis......Page 51
Utility of Hash Sets......Page 52
Trusted Platform Module (TPM)......Page 53
Analysis......Page 54
Metadata......Page 56
Binary and Malware Analysis......Page 57
Analysis of an Enterprise Event......Page 58
Timelines......Page 59
GREP......Page 60
Security Event Management Systems......Page 61
Reporting......Page 62
The Phases of Digital Forensics......Page 63
Frequently Asked Questions......Page 64
Endnotes......Page 65
Seizure of Digital Information......Page 66
Introduction......Page 67
Defining Digital Evidence......Page 68
Digital Evidence Seizure Methodology......Page 71
Seizure Methodology in Depth......Page 73
Step 1: Digital Media Identification
......Page 74
Step 3: Seizure of Storage Devices and Media......Page 75
To Pull the Plug or not to Pull the Plug, that is the Question
......Page 76
Factors Limiting the 
Wholesale Seizure of Hardware......Page 77
Disk Encryption......Page 78
Privacy Concerns......Page 79
The Concept of the First Responder......Page 80
Other Options for 
Seizing Digital Evidence......Page 81
Responding to a Victim of a 
Crime where Digital Evidence is Involved......Page 82
Seizure Example......Page 83
Determining the Presence and 
Location of Evidentiary Data Objects......Page 85
Obtaining Information 
from a Running Computer......Page 86
Imaging Information On-Scene......Page 87
Imaging Finite Data Objects On-Scene......Page 88
Use of Tools for Digital Evidence Collection......Page 89
Common Threads 
within Digital Evidence Seizure......Page 91
Determining the Most 
Appropriate Seizure Method......Page 93
Summary......Page 95
Common Threads within Digital Evidence Seizure......Page 97
Determining the Most Appropriate Seizure Method......Page 98
Frequently Asked Questions......Page 99
Endnotes......Page 100
The Mindset
of a Network Administrator......Page 102
The God Complex......Page 103
Job Security......Page 104
Salaries......Page 105
Social Engineering......Page 106
Google Them......Page 107
No-Tech Hacking......Page 108
Social Engineering......Page 110
Frequently Asked Questions......Page 111
Arrival on the Scene......Page 112
Introduction......Page 113
Preliminary Checklists......Page 114
Equipment......Page 115
Communicating with On-Scene Personnel......Page 116
Policies and Procedures......Page 117
Diagrams......Page 119
Passwords......Page 124
Access Control Lists......Page 125
Evidence Tape and Bags......Page 126
Safety......Page 127
To Stop an Attack You Must Be Able to Identify the Attack......Page 128
Maintaining or Restoring Business Continuity......Page 129
Follow Agency Guidelines......Page 130
Cooperating and Coordinating with Other Agencies......Page 131
Internet Crime Reporting Resources......Page 132
The Incident......Page 134
Securing the Scene: Protecting Equipment and Data......Page 135
The Incident......Page 136
Frequently Asked Questions......Page 137
Diagramming
the Network Infrastructure......Page 138
None......Page 139
Inaccurate......Page 141
Physical Layout......Page 143
Cabling......Page 144
Wireless Access Points......Page 145
Routers......Page 146
Servers......Page 147
E-Mail......Page 149
SQL and Oracle......Page 150
UNIX, Linux, and Windows......Page 151
DNS......Page 152
Laptops......Page 153
Subnets......Page 154
Virtual Local Area Network (VLAN)......Page 155
Topology......Page 156
Firewall Settings......Page 159
Access Control Lists......Page 161
Firewall Settings......Page 163
IDS Settings......Page 164
Virtual Private Network Access......Page 165
VNC......Page 166
SSH......Page 167
The Incident......Page 168
Physical Layout......Page 170
The Incident......Page 171
Frequently Asked Questions......Page 172
Cisco IOS Router Basics......Page 176
Connecting to the Router......Page 177
HyperTerminal......Page 178
The Console Port......Page 179
The Auxiliary Port......Page 185
Telnet......Page 186
Web Interface......Page 191
Cisco Network Assistant......Page 194
Router Modes......Page 195
User Modes 1 through 14......Page 196
Commands......Page 197
Global Configuration Mode......Page 198
Routing Protocols......Page 199
Interior and Exterior Gateway Protocols......Page 200
Distance Vector Routing Protocols......Page 201
RIP......Page 202
EIGRP......Page 204
BGP......Page 205
OSPF......Page 206
Backing Up Configurations......Page 208
TFTP......Page 209
Restoring Configurations......Page 210
Router Issues......Page 212
Final Security Issues......Page 213
ACLs......Page 215
Router Passwords......Page 220
The Incident......Page 221
Routing Protocols......Page 230
The Incident......Page 231
Frequently Asked Questions......Page 232
Understanding
the Methods
and Mindset
of the Attacker
......Page 234
Information Gathering......Page 235
Google Hacking......Page 236
No-Tech Hacking......Page 238
Scanning and Probing......Page 240
Nmap......Page 241
Netcat......Page 245
Nessus......Page 247
Maltego......Page 252
Other Scanning Tools......Page 254
Metasploit......Page 260
MSF Version 3......Page 262
MSF Version 2......Page 263
Milw0rm......Page 265
Password Cracking......Page 266
Backdoors......Page 268
Rootkits......Page 269
Tunneling......Page 270
Anti-Forensics......Page 271
The Incident......Page 272
Maintaining Access......Page 274
The Incident......Page 275
Frequently Asked Questions......Page 276
Collecting the Non-Volatile Data from a Router......Page 278
Initial Steps......Page 279
Obtain the Router Password......Page 280
Procedures......Page 281
Serial Cable......Page 282
HyperTerminal......Page 283
Web-Based Interface......Page 286
Cisco Network Assistant......Page 287
Router Non-Volatile Data Collection Procedures......Page 289
TFTP......Page 301
Router Commands to Run on the Cisco Router......Page 304
Analysis of Gathered Non-Volatile Router Data from a Cisco Router......Page 311
Analyzing What Happened......Page 312
Log Files......Page 321
Building Your Case......Page 323
The Incident......Page 324
Router Non-Volatile Data Collection Procedures......Page 328
The Incident......Page 329
Frequently Asked Questions......Page 330
Collecting the Volatile Data
from a Router......Page 332
Before You Connect to the Cisco Router......Page 333
Initial Steps......Page 334
Preinvestigation Tasks......Page 335
Obtain the Router Password......Page 338
Modes of Operation......Page 339
Remote Evidence May Be All That Is Available if the Passwords Have Been Modified......Page 340
SNMP......Page 342
HTTP......Page 346
Live Capture Procedures......Page 347
Background......Page 351
Connecting to the Cisco Router......Page 352
HyperTerminal......Page 353
Web-Based Interface......Page 354
Interactive Access......Page 355
Controlling VTYs and Ensuring VTY Availability......Page 356
Network-Based Backup of Config Files......Page 357
Configuration Files and States......Page 358
The Major Commands......Page 359
The show audit Command......Page 360
The show version Command......Page 362
The show access-lists Command......Page 363
The show banners Command......Page 364
The show arp and how ip arp Commands......Page 365
The show tech-support Command......Page 366
The show stacks Command......Page 367
The show logging Command......Page 368
AAA Logging......Page 369
ACL Violation Logging......Page 370
Advanced Data Collection......Page 371
Automated Router Forensics......Page 372
RAT......Page 373
How to Install RAT......Page 374
How to Run RAT......Page 378
Command Syntax......Page 383
CREED: The Cisco Router Evidence Extraction Disk......Page 384
Phase 1: Gain an Understanding of the System......Page 385
Phase 3: The Initial Steps......Page 386
The Incident......Page 387
Volatile Data Collection Procedures......Page 413
The Incident......Page 414
Frequently Asked Questions......Page 415
Endnotes......Page 416
Cisco IOS Switch Basics......Page 418
Switch Concepts......Page 419
Advantages over Hubs......Page 420
Cut-Through......Page 421
Store-and-Forward......Page 422
CAM......Page 423
MAC Flooding......Page 424
Layer 3 Switches......Page 425
Microsegmentation......Page 426
Broadcast Domains......Page 428
Port Security......Page 429
Connecting to the Switch......Page 430
Switch LED Indicators......Page 431
HyperTerminal......Page 432
The Console Port......Page 433
Telnet......Page 436
Web Interface......Page 438
Cisco Network Assistant......Page 439
Switch Modes......Page 443
Commands......Page 444
Commands......Page 445
Global Configuration Mode......Page 446
VLAN Database Configuration......Page 447
Managing IOS......Page 448
Configuration Files......Page 449
Backing Up Configurations......Page 450
Restoring Configurations......Page 451
Switch Issues......Page 452
Final Security Issues......Page 453
Boot Problems......Page 455
Switch Passwords......Page 456
The Incident......Page 457
Switch Terminology......Page 460
Backup and Restoration of Switches......Page 461
The Incident......Page 462
Frequently Asked Questions......Page 463
Collecting the Non-Volatile and Volatile Data from a Switch......Page 464
Interview the POC......Page 465
Obtain the Switch Password......Page 466
Document Your Steps......Page 467
Serial Cable......Page 468
HyperTerminal......Page 469
Telnet......Page 470
Cisco Network Assistant......Page 471
Documentation......Page 472
Cisco Network Assistant......Page 473
FTP......Page 474
Clock......Page 475
Version......Page 476
Startup Config......Page 477
Banners......Page 478
Logging......Page 479
Examining the VLAN Database......Page 480
Analyzing What Happened......Page 481
The Incident......Page 482
Volatile and Non-Volatile Data Collection Procedures......Page 488
The Incident......Page 489
Frequently Asked Questions......Page 490
Preparing Your Report......Page 492
Chain-of-Custody Form......Page 493
Agency-Specific Forms......Page 494
Evidence Forms......Page 495
Evidence Number......Page 496
Timeline of Recorded Events......Page 497
Trusted Binaries......Page 498
Drawings......Page 499
The Incident......Page 500
Shutdown Procedures......Page 501
Drawings......Page 502
Frequently Asked Questions......Page 503
Preparing to Testify......Page 504
Reports......Page 505
Forms......Page 506
Chain of Custody......Page 507
Checklists......Page 508
Video......Page 509
Charts......Page 510
Understanding the 
Daubert and Frye Standards......Page 511
Tested Theories......Page 512
Peer-Reviewed and Publicized Theories......Page 513
Scientific Evidence......Page 514
Applicability to Procedures......Page 515
Federal Rules......Page 516
Preparation......Page 517
Errors and Omissions......Page 518
Words of Caution......Page 519
The Incident......Page 520
Visual Tools......Page 522
Errors and Omissions......Page 523
The Incident......Page 524
Frequently Asked Questions......Page 525
D......Page 526
E......Page 527
M......Page 528
R......Page 529
S......Page 530
Z......Page 531
Cisco Wireless Device Forensics......Page 532
Overview of 802.11 Standards......Page 533
Protecting the Data Link and Physical Layers......Page 534
Authentication......Page 535
Risk Assessment......Page 536
Hot Standby......Page 537
Configuring Hot Standby......Page 538
Implementing Firewalls for Additional Security......Page 539
Public Secure Packet Forwarding......Page 540
WLAN LAN Extension 802.1x/EAP......Page 541
EAP Request and Response......Page 542
802.1x......Page 543
EAP TLS......Page 544
LEAP Authentication Process......Page 545
Implementing LEAP......Page 546
Configuring ACS......Page 547
Configuring Access Points......Page 549
Configuring the Client......Page 552
WLAN LAN Extension IPSec......Page 556
IKE......Page 557
AH......Page 558
Implementing IPSec over WLAN......Page 559
Configuring the VPN Gateway......Page 561
Configuring an Access Point......Page 562
Configuring Filters Using the CLI in IOS......Page 563
Configuring Filters Using a Web Browser in IOS......Page 564
Configuring a VPN Client......Page 565
WEP......Page 567
IV and RC4 Vulnerabilities......Page 568
Message Integrity Check......Page 569
Using a Web Browser for Access Point Configuration......Page 570
The Cisco Wireless and Wireless-Aware Vision......Page 571
The Cisco Structured Wireless-Aware Network Product Line......Page 572
Client Adapters......Page 573
Cisco Wireless LAN Switches and Routers......Page 574
Cisco Wireless Antennas and Accessories......Page 575
Pilar Mount Diversity Omnidirectional Antenna 2.4 GHz (AIR-ANT3213)......Page 577
Directional Wall Mount Patch Antenna 2.4 GHz (AIR-ANT3549, AIR-ANT1729)......Page 578
Cisco’s 2.4 GHz Antennas Summary......Page 579
Cisco Wireless IP Phone......Page 581
Upgrading from VxWorks to IOS......Page 582
Using the Browser and VxWorks......Page 583
Aironet 1200 AP......Page 584
First-Time Basic Configuration......Page 586
Aironet 1100 AP......Page 588
Aironet 350 AP......Page 589
Cisco Aironet 350 Series Client Adapters......Page 590
Cisco Aironet 802.11a/b/g Client Adapters......Page 592
CiscoWorks Wireless LAN Solution Engine (WLSE) 2.x......Page 593
Fault Monitoring......Page 594
Configure Tab......Page 596
Reports......Page 598
Radio Manager......Page 599
WLAN LAN Extension 802.1x/EAP......Page 601
The Cisco Structured Wireless-Aware Network Product Line......Page 602
Cisco Aironet WLAN Client Adapters......Page 603
CiscoWorks Wireless LAN Solution Engine (WLSE) 2.x......Page 604