Investigating Internet Crimes. An Introduction to Solving Crimes in Cyberspace

Front Cover......Page 1
Investigating Internet Crimes......Page 4
Copyright Page......Page 5
Contents......Page 8
Foreword......Page 16
Preface......Page 18
About the Authors......Page 20
About the Technical Editor......Page 22
Acknowledgments......Page 24
1 Introduction to Internet Crime......Page 26
Internet crime’s prevalence......Page 27
Norton™ Cybercrime Report 2011......Page 29
HTCIA 2011 Report on Cybercrime Investigation......Page 30
McAfee® Threats Reports......Page 31
2012 Data Breach Investigations Report......Page 33
Internet Crime Compliant Center......Page 34
Internet harassment......Page 35
Traditional crimes and the Internet......Page 36
Investigative responses to Internet crime......Page 37
Why investigate Internet crime?......Page 39
What is needed to respond to Internet crime?......Page 40
Conclusion......Page 41
Further reading......Page 42
2 Internet Criminals......Page 46
Cybercrime profiling......Page 47
Cybercriminal profiles......Page 48
Cybersex offenders......Page 51
Internet harassment......Page 53
Cyberterrorism and cyberwarfare......Page 55
Internet Crime Compliant Center......Page 56
New York Police cyberstalking study......Page 57
Sex offenders online activities......Page 58
Capability......Page 59
Deductive profiling......Page 61
Conclusion......Page 62
Further reading......Page 63
3 How the Internet Works......Page 66
The importance of IP addresses......Page 67
DHCP and assigning addresses......Page 69
MAC address......Page 71
DNS records......Page 74
Translating IPv6......Page 78
Ipv4-Mapped IPv6 addresses......Page 79
IPv6 DUID......Page 80
Uniform resource locators......Page 83
Domain name registration......Page 84
Internationalized domain names......Page 85
Email or the SMTP......Page 86
News groups, Usenet, or the Network News Transfer Protocol......Page 88
Relevant RFCs......Page 89
Conclusion......Page 90
Further reading......Page 91
4 Collecting Legally Defensible Online Evidence......Page 94
Defining evidence......Page 95
Digital versus online evidence......Page 98
Investigative planning......Page 100
Investigative components......Page 102
Authentication......Page 103
Privacy......Page 107
Wiretap Act (18 U.S.C. § 2510-22)......Page 108
Stored Communications Act (18 U.S.C. §§ 2701-12)......Page 109
The Pen/Trap Statute (18 U.S.C. §§ 3127-27)......Page 110
EU Privacy Directive......Page 111
Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.)......Page 113
Mutual legal assistance......Page 114
General guidance......Page 115
Conclusion......Page 119
Further reading......Page 120
Collection......Page 124
Identification......Page 125
Protocol/application determination......Page 126
Collection methodology......Page 127
Preservation......Page 129
Tools/techniques for documenting Internet evidence......Page 130
Save As......Page 131
Hashing evidence......Page 132
Collecting entire websites......Page 134
Authenticating the collected evidence......Page 137
Validation of online evidence collection tools......Page 138
Webcase®......Page 139
Making an online evidence field collection USB device......Page 141
Field process for using the investigative USB device......Page 145
Apples in the field......Page 146
Apple office collection......Page 147
Organizing your online ESI......Page 149
The investigative report......Page 150
Further reading......Page 152
Investigative toolbars......Page 156
IP Trace......Page 157
Web Find......Page 158
Internet service provider......Page 160
Additional toolbar functions......Page 161
Whois......Page 162
MX function......Page 163
Netstat......Page 164
Resolve......Page 165
Traceroute......Page 166
TCP/IP function......Page 167
Stats function......Page 168
Paid online services......Page 169
TLO®......Page 170
Further reading......Page 171
Digital officer safety......Page 174
Online investigative computer protection process......Page 175
Basic investigative computer protection......Page 177
Firewall installation......Page 178
Hardware firewalls......Page 179
Software firewalls......Page 181
Malware protection......Page 182
Spyware protection......Page 183
Installing and updating browsers......Page 184
Blocking cookies......Page 185
Windows updates......Page 186
Cloning or image the investigator’s computer......Page 187
Keeping your system clean......Page 189
Testing your security......Page 190
Further reading......Page 191
IANA and RIR......Page 196
Internet commercial and freeware tools......Page 197
Geolocation of an IP address......Page 198
DNS records......Page 199
Tracing emails......Page 201
Where is the evidence?......Page 203
Viewing email headers......Page 204
Time differences......Page 206
Header information translation......Page 207
Another email header......Page 209
Multipurpose Internet Mail Extensions......Page 219
Looking at little X......Page 222
Faking an email and hiding its sender......Page 225
Mail protocols......Page 226
Investigator’s email collection options......Page 227
Zimbra Desktop email collections......Page 228
Using Outlook for email collections......Page 230
Relevant RFCs related to IP tracing......Page 232
Further reading......Page 233
Internet anonymity......Page 236
Responsible use......Page 237
Common methods to gain web anonymity......Page 238
What your browser reveals (http requests)......Page 240
Anonymizing your surfing......Page 241
Free online proxy servers......Page 243
To Tor or not to Tor......Page 244
Tor’s hidden web services......Page 247
Tor and tails......Page 249
Tracking criminals who use anonymous methods to hide......Page 250
Tools for catching the hiding Internet target......Page 251
More proactive methods......Page 252
Further reading......Page 254
Covert operations on the Internet......Page 258
Internet operations and policy considerations......Page 260
Ethics during undercover operations......Page 263
Basic undercover procedures......Page 265
Developing your undercover persona......Page 266
The undercover role......Page 269
Finishing touches to your persona......Page 270
Countermeasures......Page 272
Social networking site undercover challenges......Page 273
Conclusions......Page 275
Further reading......Page 276
Reactive investigations......Page 278
Proactive investigations......Page 281
Community policing in cyberspace......Page 282
Social media policy considerations......Page 283
Social media monitoring......Page 284
Policy considerations for undercover operations......Page 286
Managing undercover Internet investigations......Page 287
Internet investigation policy......Page 288
Operational planning......Page 289
References......Page 291
Sources of online information......Page 294
Search services......Page 295
Google Basics......Page 297
Google’s Advanced Operators......Page 299
Searching with Bing......Page 300
Finding information on a person......Page 304
Finding business information......Page 306
Non-US government sources......Page 307
Charity/nonprofit resource sites......Page 308
Searching blogs......Page 309
Professional communities......Page 310
News searches......Page 311
Conclusions......Page 312
Further reading......Page 313
How webpages work......Page 318
How markup languages work......Page 319
Website reconnaissance......Page 321
URL traits......Page 323
Domain registration......Page 324
Website history research......Page 325
Checking for malicious code on a site......Page 327
Foreign language websites......Page 329
Webpage tracking bugs......Page 330
Documenting a website’s multimedia and images......Page 331
Two video metadata types......Page 332
File formats and what they contain......Page 333
Gspot......Page 334
Video inspector......Page 335
The legal process of identifying a website......Page 336
Further reading......Page 337
Social networking’s impact on legal systems......Page 340
Law enforcement, social media, and the news......Page 341
Social media in small town USA......Page 343
Social media around the world......Page 344
Social media evidence in the courts......Page 345
Planning......Page 346
Social networking sites commonalities......Page 348
The top social networking sites......Page 349
Examining Facebook......Page 351
Internet tools for understanding a Facebook target......Page 352
Using NodeXL......Page 353
Investigating user data......Page 354
Twitter......Page 355
Finding tweets......Page 356
Other social networking sites of interest......Page 357
Common business social networking sites......Page 359
Finding individuals on social media sites......Page 360
Social media evidence collection......Page 361
Flickr......Page 362
Social media investigations policy......Page 363
Conclusion......Page 364
Further reading......Page 365
Client server: protocols and tools......Page 370
Instant Messaging......Page 371
Instant Messaging configuration......Page 372
Web-based chat......Page 373
Internet Relay Chat......Page 374
Connecting to an IRC......Page 375
Joining a channel (chatroom)......Page 376
Hiding in IRC......Page 378
IRC resources......Page 379
Netstat......Page 380
Netstat to identify applications connected to an IP address......Page 381
Peer to Peer......Page 383
Accessing P2P sites......Page 385
Bulletin boards......Page 386
USENET newsgroups or bulletin boards......Page 387
Understanding USENET as an investigative tool......Page 388
Locating free Usenet servers......Page 389
Investigative tools for USENET......Page 390
Craigslist......Page 392
Further reading......Page 394
Perception of law enforcement on the Internet......Page 400
Contributing factors to the problem......Page 401
Are there “broken windows” in cyberspace?......Page 403
Internet Crime Complaint Center......Page 404
US Federal Trade Commission......Page 405
International Consumer Protection and Enforcement Network and E-Consumer......Page 406
Hard prevention: using technology to stop internet crime......Page 407
Existing programs......Page 409
Presentations......Page 412
Basic parent online safety education......Page 413
Employer security awareness programs......Page 415
Online presence......Page 416
Investigator cybercrime education......Page 417
Conclusions......Page 420
Further reading......Page 421
Basic Internet investigative steps......Page 426
Case studies......Page 428
Craigslist stolen property scenario......Page 429
Internet threat to company officer scenario......Page 430
Cyberharrassment scenario......Page 431
Internet murder scenario......Page 432
Conclusion......Page 433
Further reading......Page 434
18 Epilogue......Page 436
Appendix A: HEX to ASCII Conversion Chart......Page 438
Appendix B: Stored Communications Act Quick Reference Guide: USDOJ Search and Seizure......Page 445
Appendix C: Online Crime Victim Interview......Page 446
Appendix D: Internet Investigations Report Format......Page 448
Appendix E: Digital Officer Safety Computer......Page 449
Appendix F: Router Setup Checklist......Page 450
Appendix G: Tracing Email Worksheet......Page 451
Appendix H: Undercover Persona Worksheet......Page 452
Appendix I: Model Policy For LE Investigative......Page 453
Appendix J: Model Policy For Off-Duty LE......Page 463
Appendix K: Investigating A Person Online......Page 467
Appendix L: Investigating A Website Worksheet......Page 470
Appendix M: Chat and Text Messaging Abbr List......Page 474
Appendix N: mIRC-commands......Page 480
Index......Page 486