UFrancisco Nadador usitshela ngokuhlangenwe nakho kwakhe emhlabeni wokuhlaziywa kwe-forensic

Hoy sixoxa kuphela neLxA Francisco Nadador, onguchwepheshe be-computer forensics, othanda ukuphepha kwamakhompyutha, ukugenca nokuhlola ukungena. UFrancisco waphumelela e-University of Alcalá de Henares futhi manje uyaqondisa Okucindezelayo, ezinikezelwe emakilasini okufundisa ezihlokweni zokuphepha futhi inikezela ngezinsizakalo ezihlobene nalesi sihloko ezinkampanini.

Uqede iMaster (Open University of Catalonia) kwezokuphepha kwamakhompyutha egxile ezihlokweni ezimbili, i-Forensic Analysis ne-Network Security. Ngalesi sizathu, wathola i-Honorary Degree futhi kamuva waba yilungu leNational Association of Computer Judicial Appraisers and Experts. Futhi njengoba ezosichazela, Bamnikeza iMedal Cross ye-Investigative Merit ngeBheji Emhlophe ngomsebenzi wakhe wobuchwepheshe nocwaningo. Umklomelo uphumelele noChema Alonso, Angelucho, Josep Albors (Umphathi Omkhulu we-ESET Spain), njll.

Linux Adictos: Sicela uchazele abafundi bethu ukuthi kuyini ukuhlaziywa kwe-forensic.

UFrancisco Nadador: Kimina yisayensi ezama ukunikeza izimpendulo ngokwenzekile ngemuva kwesigameko sokuphepha kwamakhompiyutha yisimo sedijithali, izimpendulo zohlobo okwenzekile? Kwenzeke nini? Kwenzeke kanjani? Futhi kubangelwa yini noma kubangelwa ngubani?

I-LxA: Ukusuka esikhundleni sakho nasekwazini kwakho, ingabe amacala we-cyber abaluleke kangaka enzeka kakhulu
imvamisa eSpain njengakwamanye amazwe?

FN: Yebo, ngokwemibiko eshicilelwe yi-EU futhi esesidlangalaleni, iSpain ingezansi kwamazwe amasha, kanye namanye amazwe aseningizimu, yizifundo ezinikeza ucwaningo lokuqhathanisa nokusebenza kwamasu amasha amazwe ayingxenye ye-EU. Lokhu kungenzeka kubangele inani lezehlakalo zokuphepha lapha ukuthi libaluleke futhi ne-typology yazo ihluke.
Izinkampani ziba nezingozi nsuku zonke, kepha ngokungafani nalokho okungase kubonakale, okungukuthi, ukuthi zingavela ekuchayekeni kwazo kunethiwekhi, ziyizingozi ezivame ukubangelwa ukuxhumana okuntekenteke kunalolu chungechunge, umsebenzisi. Ngaso sonke isikhathi ukuthembela kwamadivayisi kanye nenani lalezi ezisingathiwe kukhulu, okudala ukwephulwa okuhle kwezokuphepha, isifundo engisifunde muva nje sithi ngaphezu kwe-50% yezehlakalo zokuphepha zibangelwe ngabantu, abasebenzi, ex -abasebenzi, njll., Izinkampani ezibiza izinkulungwane eziningi zama-euro, ngombono wami kunesisombululo esisodwa kule nkinga, ukuqeqeshwa nokuqwashisa kanye nokuqinisekiswa okukhulu ku-ISO27001.
Ngokuqondene ne-Cybercrimes, izinhlelo zokusebenza ezifana ne-WhatsApp, i-ramsonware (esanda kubizwa nge-cryptolocker), vele, i-virtual currency bitcoin, ukuba sengozini kwezinhlobo ezahlukahlukene ngaphandle kokulungiswa kahle, ukukhokha okukhohlisayo ku-Intanethi, ukusetshenziswa "okungalawulwa" kwamanethiwekhi omphakathi, njll., yilabo asebethathe izikhundla zokuqala ezilinganisweni zamacala obugebengu bethelevishini.
Impendulo ithi "YEBO", eSpain ubugebengu obenziwa ngamakhompiyutha benzeka njengobubalulekile njengakwezinye izifundazwe ezingamalungu e-EU, kodwa kaningi.

I-LxA: Uthole iMatriculation of Honor ngephrojekthi yakho yokugcina ye-Master oyenzile. Yini enye,
uthole umklomelo… Sicela usitshele lonke udaba.

FN: Angiyithandi kakhulu imiklomelo noma ukwamukelwa, iqiniso ukuthi, isiqubulo sami umzamo, umsebenzi, ukuzinikela nokuphikelela, phikelela kakhulu ukufeza izinhloso ozibekele zona.
Ngenze iMaster ngoba kuyisihloko engizifelayo ngaso, ngiyiqede ngempumelelo futhi kusukela lapho kuze kube manje sengizinikele kuyo ngokomsebenzi. Ngiyaluthanda uphenyo lwe-computer forensic, ngithanda ukusesha ngithole ubufakazi futhi ngiyazama ukukwenza kusuka ezimisweni zokuziphatha eziqeda amandla. Umklomelo, akukho okubalulekile, umuntu othile ubecabanga ukuthi umsebenzi we-Final Master wami uwufanele, kuphelele lapho, angiwuniki ukubaluleka okukhulu. Namuhla ngiziqhenya kakhulu ngesifundo engisenzile ukuphothula online kwi-computer forensics futhi manje esekushicilelweni lwayo lwesibili.

I-LxA: Yikuphi ukusabalalisa kwe-GNU / Linux okusebenzisa osukwini lwakho nosuku? Ngicabanga iKali Linux, DEFT,
Backtrack futhi Santoku? I-Parrot OS?

FN: Uqambe abambalwa ngoyebo. Okwe-Pentesting Kali ne-Backtrack, iSantoku yokuhlaziywa kwe-Forensic kwi-Mobile ne-Deft noma i-Helix, ngokuhlaziywa kwe-forensic ku-PC (phakathi kwezinye), yize kuyizinhlaka, zonke zinamathuluzi okwenza eminye imisebenzi ephathelene nokuhlaziywa kwe-pentesting kanye ne-computer forensic, Kepha kukhona amanye amathuluzi engiwathandayo futhi ngine-Linux version efana ne-autopsy, volatility, amathuluzi afana ne-Foremost, testdisk, Photorec, engxenyeni yezokuxhumana, i-wireshark, ukuqoqa imininingwane nessus, nmap, ukuxhaphaza i-metasploit ngendlela ezenzakalelayo ne-Ubuntu bukhoma uqobo lwayo cd, ekuvumela ukuthi uqale umshini bese, ngokwesibonelo, useshe i-malware, uthole amafayela, njll.

I-LxA: Yimaphi amathuluzi womthombo ovulekile izintandokazi zakho?

FN: Ngicabanga ukuthi bengingaphambi kwempendulo yalo mbuzo, kepha ngizongena kokunye. Ukuze ngithuthukise umsebenzi wami ngisebenzisa kakhulu amathuluzi womthombo ovulekile, ayasebenziseka futhi akuvumela ukuthi wenze izinto ezifanayo nalezo ezikhokhelwa ilayisense yokusebenzisa, ngokombono wami, umsebenzi ungenziwa ngokuphelele ngala mathuluzi.
Lapha izinhlaka zeLinux zithatha i-jackpot, ngisho, ziyamangalisa. ILinux iyipulatifomu engcono kakhulu yokuthunyelwa kwamathuluzi wokuhlaziya we-forensic, kunamathuluzi amaningi walolu hlelo lokusebenza kunanoma iyiphi enye futhi onke, kunalokho, iningi likhululekile, likhululekile futhi liwuMthombo Ovulekile, obavumela ukuba babe kushintshwe.
Ngakolunye uhlangothi, ezinye izinhlelo zokusebenza zingahlaziywa ngaphandle kwenkinga evela ku-Linux. Okuwukuphela kwento ebuyayo, mhlawumbe, ukuthi iyinkimbinkimbi ekusetshenzisweni nasekugcinweni kwayo, futhi futhi, njengoba ingezona ezentengiselwano, ayinayo ukwesekwa okuqhubekayo. Izintandokazi zami, ngake ngasho phambilini, iDeft, Autopsy, Volatility, nokunye okunye.

I-LxA: Ungasitshela okuncane ngeThe Sleuth Kit… Yini leyo? Izicelo?

FN: Yebo, sengivele ngakhuluma ngandlela thile ngalawa mathuluzi kumaphoyinti angaphambilini. Kuyindawo yokwenza ukuhlaziywa kwamakhompyutha kwe-forensic, isithombe sayo, "inja eyi-hound", kahle enguqulweni yakamuva inja inobuso bokuba nekhono elibi kakhulu, iqiniso .
Isixhumanisi esibaluleke kunazo zonke kuleli qembu lamathuluzi, ukuhlolwa kwesidumbu.
Angamathuluzi evolumu amasistimu avumela ukuhlolwa kwezithombe ze-computer forensic ezivela kuzingxenyekazi ezahlukahlukene ngendlela ye- "NON-INTRUSIVE", futhi lokhu kubaluleke kakhulu kunikezwe ukubaluleka kwaso kwezobuchwepheshe.
Inethuba lokusetshenziswa kumodi yomugqa womyalo, khona-ke ithuluzi ngalinye lenziwa endaweni ehlukile yokugcina noma futhi, ngendlela "enobungane" ethe xaxa, imvelo yokuqhafaza ingasetshenziswa, evumela ukwenza uphenyo ku indlela elula.

I-LxA: Ungakwenza okufanayo ne-LiveCD distro ebizwa nge-HELIX?

FN:Yebo, kungenye yezinhlaka zokuhlaziywa kwamakhompyutha we-forensic, futhi nemvelo eminingi, okuwukuthi, ihlaziya izithombe ze-forensic zezinhlelo zeLinux, Windows ne-Mac, kanye nezithombe ze-RAM namanye amadivayisi.
Mhlawumbe amathuluzi ayo anamandla kakhulu yi-Adept for cloning device (ikakhulukazi amadiski), i-Aff, ithuluzi lokuhlaziywa kwe-forensic okuhlobene nemethadatha futhi kunjalo! Ngaphandle kwalokhu inamathuluzi amaningi.
Okubi, inguqulo yayo yobuchwepheshe iyakhokhwa, yize nayo inenguqulo yamahhala.

I-LxA: I-TCT (The Coroner's Toolkit) iphrojekthi eyathathelwa indawo yiThe Sleuth Kit.
qhubeka nokusebenzisa lapho?

FN:I-TCT ibingeyokuqala yamathuluzi okuhlaziya i-forensic, amathuluzi anjengokuphanga ithuna, i-lazarus noma i-findkey ayigqamisile futhi ekuhlaziyweni kwezinhlelo ezindala kusebenza kahle kakhulu kunangaphambili, okufana ncamashi njengoba kwenzeka nge-backtrack ne-kali, Ngisazisebenzisa zombili, ngokwesibonelo.

I-LxA: I-Guidance Software idale i-EnCase, ikhokhwe futhi yavalwa. Futhi ayitholakali kwezinye izinhlelo zokusebenza ezingezona eze-Windows. Ngabe ilwenzela lolu hlobo lwesoftware ngokuba nezinye izindlela zamahhala? Ngicabanga ukuthi cishe zonke izidingo zimbozwe ngamaphrojekthi wamahhala futhi amahhala, noma ngabe nginephutha?

FN: Ngicabanga ukuthi sengikuphendulile lokhu, ngombono wami onesizotha cha, akunxephezeli futhi YEBO, zonke izidingo zokwenza ukuhlaziywa kwe-computer forensic zimbozwe ngamaphrojekthi wamahhala futhi amahhala.

I-LxA: Ngibhekisa embuzweni ongenhla, ngiyabona ukuthi i-EnCase ingeye-Windows nezinye i-
amathuluzi afana ne-FTK, Xways, wokuhlaziywa kwe-forensic, kepha namanye amathuluzi amaningi wokungena nokuphepha. Kungani usebenzise iWindows kulezi zihloko?

FN: Bengingeke ngazi ukuthi ngingawuphendula kanjani lowo mbuzo ngokuqiniseka, ngisebenzisa, okungenani, ku-75% wezivivinyo engizenza ngamathuluzi aklanyelwe amapulatifomu e-Linux, yize ngibona ukuthi kunamathuluzi amaningi ngokwengeziwe enzelwe lezi zinhloso ku-Windows amapulatifomu, futhi ngiyabona futhi ukuthi ngiwavivinya futhi kwesinye isikhathi ngiyayisebenzisa, yebo, inqobo nje uma kungawamaphrojekthi wokusebenzisa mahhala.

I-LxA: Lo mbuzo ungahle ube exotic, ukuwubiza ngokuthile. Kepha ucabanga ukuthi ukwethula ubufakazi ezivivinyweni, kuphela ubufakazi obuhlinzekwa yisoftware yomthombo ovulekile okufanele busebenze hhayi obuvaliwe? Ake ngichaze, kungaba umcabango omubi kakhulu bese ngikholelwa ukuthi bakwazile ukwenza isoftware yokuphathelene enikezela ngemininingwane eyiphutha ngomqondo othile wokukhipha umuntu othile noma amaqembu athile futhi bekungekho ndlela yokubukeza ikhodi yomthombo ukubona ukuthi yini iyayenza noma ayiyenzi leyo software. Kusontekile, kepha ngicela ukuthi unikeze umbono wakho, uziqinisekise noma, kunalokho, ujoyine lo mbono ...

FN: Cha, angiyena lowo mbono, ngisebenzisa kakhulu amathuluzi esoftware amahhala futhi ezimweni eziningi ngiyavula, kepha angikholwa ukuthi noma ngubani wethula amathuluzi anikezela ngemininingwane eyiphutha ukuze akhulule noma ngubani, yize kuyiqiniso ukuthi muva nje kunezinhlelo ezithile esezivele ukuthi banikeze ngamabomu idatha engalungile, bekukomunye umkhakha futhi ngicabanga ukuthi yiwo kuphela oqinisekisa umthetho, empeleni, angicabangi kanjalo, intuthuko, ngokombono wami, yenziwa ngobunyoninco futhi, okungenani kulokhu, kusekelwe kuphela kwisayensi, ubufakazi obuphathwe ngokombono wesayensi, kalula, lowo umbono wami nenkolelo yami.

I-LxA: Ezinsukwini ezimbalwa ezedlule, uLinus Torvalds wathi ukuphepha okuphelele akunakwenzeka nokuthi abathuthukisi akufanele bakhathazeke ngalokhu futhi banikeze ezinye izici kuqala (ukuthembeka, ukusebenza, ...). U-Washintong Post wawathatha la mazwi futhi ayethusa ngoba uLinus Torvalds "uyindoda enekusasa le-Intanethi ezandleni zakhe", ngenxa yenani lamaseva nezinsizakalo zenethiwekhi ezisebenza ngenxa yenhlamvu ayenzile. Ufanelwe yimuphi umbono?

FN: Ngivumelana naye ngokuphelele, ukuphepha okuphelele akukho, uma ufuna ukuphepha okuphelele kuseva, uyivale noma uyinqamule kunethiwekhi, uyingcwabe, kepha-ke, ayiseyona iseva, izinsongo zihlala zikhona, okufanele sikumboze yizingcuphe, ezingagwemeka, kepha-ke, kufanele zitholakale kuqala futhi kwesinye isikhathi kuthatha isikhathi ukwenza lokhu kusesha noma abanye bakwenza ngezinjongo ezingacacile.
Kodwa-ke, ngicabanga ukuthi kwezobuchwepheshe sisezingeni eliphakeme kakhulu lokuphepha kwezinhlelo, izinto sezithuthuke kakhulu, manje sekuwukuqwashiswa komsebenzisi, njengoba ngishilo kuzimpendulo ezedlule, futhi lokho kuseluhlaza.

I-LxA: Ngicabanga ukuthi abenzi be-cybercriminals benza kube nzima njalo (TOR, I2P, Freenet, steganography, encryption, Emergency Self-Destruction of LUKS, proxy, metadata cleaning, etc). Wenza kanjani kulawa macala ukunikeza ubufakazi enkantolo? Ingabe kukhona izimo lapho ungeke ukwazi khona?

FN: Yebo, uma kuliqiniso ukuthi izinto ziya ngokuxaka futhi kukhona nezimo lapho ngingakwazanga ukwenza khona, ngaphandle kokuqhubeka ne-cryptolocker edumile, amaklayenti angishayele ucingo engicela usizo lwami futhi asikwazanga yenza okuningi ngakho, njengoba kwaziwa, kuyi-ransomware ukuthi, ngokunenzuzo ubunjiniyela bezenhlalo, futhi umsebenzisi uyisixhumanisi esibuthakathaka, ubhala ngemfihlo okuqukethwe kuma-hard drive futhi uhola bonke ochwepheshe bezokuphepha kwamakhompiyutha, amayunithi esayensi omthetho ukuphoqelelwa, abenzi bezokuphepha, kanye nomhlaziyi we-forensic, okwamanje asikwazi ukubhekana nale nkinga.
Embuzweni wokuqala, senza kanjani ukuletha lezi zinkinga ecaleni, kahle-ke senza kanjani ngabo bonke ubufakazi, ngiqonde ukuthi, ngezimiso zokuziphatha, namathuluzi ayinkimbinkimbi, ulwazi lwesayensi nokuzama ukuthola izimpendulo zemibuzo embuzweni wokuqala, ofanele ukudilizwa engikushilo, angiwutholi umehluko, okwenzekayo ukuthi kwesinye isikhathi lezi zimpendulo azitholakali.

I-LxA: Ungazincoma izinkampani ukuthi zishintshele ku-Linux? Kungani?

FN: Bengingeke ngisho okuningi, ngiqonde ukuthi, ngicabanga ukuthi uma nginokuthile okungenamalayisense okunginikeza izinsizakalo ezifanayo nento ebiza imali, kungani ngiyichitha? Omunye umbuzo ukuthi awunginiki okufanayo services, kodwa, yilokho uma kwenzeka. I-Linux uhlelo olusebenzayo oluzalwe ngombono wensizakalo yenethiwekhi futhi inikezela ngezici ezifanayo kuwo wonke amapulatifomu asemakethe, yingakho abaningi beyikhethile ngepulatifomu yabo, ngokwesibonelo, ukunikela insizakalo yewebhu , ftp, njll., ngiyayisebenzisa futhi hhayi nje ukusebenzisa i-forensic distros kepha futhi njengeseva esikhungweni sami sokuqeqesha, ngine-Windows kwi-laptop yami ngoba ilayisense ifakiwe nedivayisi, ngakho-ke ngilahla izinto eziningi I-Linux.
Ukuphendula lo mbuzo, iLinux ayibizi, kunezinombolo ezikhulayo zezinhlelo zokusebenza ezisebenza kule nkundla futhi izinkampani eziningi zentuthuko zenza imikhiqizo yeLinux. Ngakolunye uhlangothi, yize ingenayo i-malware, inani lezifo liphansi, lokhu kuhlangene nokuguquguquka okukunikezwa yipulatifomu ukuzivumelanisa negilavu ​​ezidingweni, ngombono wami, amandla anele Ukukhetha kokuqala kwanoma iyiphi inkampani futhi okubaluleke kunakho konke, wonke umuntu angacwaninga okwenziwa yisoftware, ingasaphathwa eyokuthi ukuphepha kungenye yamandla ayo.

I-LxA: Njengamanje kukhona uhlobo lwezimpi zamakhompiyutha lapho nohulumeni babamba iqhaza. Sibonile i-malware efana ne-Stuxnet, i-Stars, i-Duqu, njll., Eyenziwe ohulumeni ngezinhloso ezithile, kanye ne-firmware ethelelekile (ngokwesibonelo, amabhodi e-Arduino ane-firmware yawo eguquliwe), amaphrinta e-"spy" laser, njll. Kepha ngisho ne-Hardware ayiphunyuki kulokhu, ama-chips aguquliwe nawo avele ukuthi, ngaphezu kwemisebenzi ebeklanyelwe yona, ibandakanya nokunye ukusebenza okufihliwe, njll. Sike sabona namaphrojekthi athile asangene njengo-AirHopper (uhlobo oluthile lwe-keylogger yomsakazo), i-BitWhisper (ukuhlaselwa ngokushisa ukuze kuqoqwe imininingwane kulowo ohlukunyezwayo), i-malware ekwazi ukusakazwa ngomsindo, ... akusaphephile noma amakhompyutha axhumekile kunoma iyiphi inethiwekhi?

FN: Njengoba sengivele ngiphawulile, uhlelo oluphephe kunazo zonke yilolo olucishiwe abanye bathi luvalelwe emgodini, umuntu uma enqanyuliwe ngicabanga ukuthi kuphephile futhi, kepha lowo akuwona umbuzo, ngiqonde ukuthi, ngombono wami umbuzo awusilo inani lezinsongo ezikhona, kunamadivayisi amaningi futhi axhunyiwe, okusho ukuthi inani elikhulu lokuba sengozini nokuhlaselwa ngamakhompyutha ezinhlobonhlobo, usebenzisa, njengoba ubonakalisile embuzweni, imifantu ehlukene futhi sihlasela amavekthara, kepha angicabangi ukuthi kufanele Sigxile enkingeni ekunqanyulweni ukuze siphephe, kufanele sigxile ekuvikeleni zonke izinsiza, amadivayisi, ukuxhumana, njll., njengoba sengishilo, yize kuyiqiniso ukuthi inani lezinsongo kukhulu, akulona iqiniso elincane ukuthi inani lamasu okuphepha lincane kangako, asinaso isici somuntu, ukuqeqeshwa kokuqwashisa nokuphepha, akukho okunye futhi izinkinga zethu, noma zixhumene, zizoba ncane.

I-LxA: Siqeda ngombono wethu futhi njengochwepheshe kwezokuphepha okufanele lezi zinhlelo, ungasinikeza nemininingwane okunzima kakhulu ukuyithola nokuthola izimbobo eziningi zokuphepha:

Mayelana nombuzo wesigidi samadola, yiluphi uhlelo oluphephe kunazo zonke, impendulo yanikezwa ngaphambili, ayikho i-100% ephephile exhunywe kwinethiwekhi.
IWindows ayazi ikhodi yayo yomthombo, ngakho-ke akekho owaziyo kahle ukuthi yenzani noma ukuthi ikwenza kanjani, ngaphandle kwabathuthukisi kunjalo. Ikhodi yomthombo yeLinux iyaziwa futhi, njengoba ngishilo, ukuphepha kungenye yamaphuzu ayo aqinile, ngokumelene nayo ukuthi ayinabungani obuningi futhi kunama-distros amaningi.Kwe-Mac OS, iphuzu layo eliqinile, ubuncane bayo obubuyela ekukhiqizeni, uhlelo oluhle lwabaqalayo. Kuzo zonke lezi zizathu, ngokubona kwami ​​okunzima kakhulu ukukuvikela yiWindows, yize izifundo zakamuva ziveza ukuthi iyona enobungozi obuncane, ngaphandle kwesiphequluli sakho. Ngokubona kwami, akunangqondo ukuqinisekisa ukuthi lolu hlelo noma lolu hlelo lokusebenza lusengozini engatheni, zonke izici ezithinteka kuzo kufanele zibhekwe, ukuba sengozini, ukufaka izicelo, abasebenzisi balo, njll. Lapho konke lokhu okungenhla sekucatshangelwe, ngikholwa ukuthi amasistimu kufanele aqiniswe ngazo zonke izinhlobo zezinyathelo zokuphepha, ngokujwayelekile futhi asebenze kunoma yiluphi uhlelo, ukuqiniswa kokufanayo kungafingqwa yilawa maphuzu ayisisekelo:

• Ukuvuselelwa: Njalo gcina leli phuzu ohlelweni nakuzo zonke izinhlelo zokusebenza ezisebenzisa inethiwekhi zisesikhathini.
• Amaphasiwedi kufanele anele, ngiqonde ukuthi, kufanele okungenani kube nezinhlamvu eziyi-8 nesichazamazwi esikhulu.
• Ukuphepha kwepherimitha: I-firewall enhle ne-IDS ngeke kulimaze.
• Ukungabi namachweba avulekile anganikeli isevisi esebenzayo nebuyekeziwe.
• Yenza amakhophi ayisipele ngokuya ngezidingo zecala ngalinye uwagcine ezindaweni eziphephile.
• Uma usebenza nedatha ebucayi, ukubethela okufanayo.
• Ukubethela kokuxhumana futhi.
• Ukuqeqeshwa nokwaziswa kwabasebenzisi.

Ngiyethemba uyithandile le ngxoxo, sizoqhubeka nokwenza okuningi. Siyajabula ngokushiya kwakho i- imibono nokuphawula...