8 ms·

"Knowing what I know about computer security and how EASY it is to plant digital evidence without leaving a trace." This right here is the conversation which n

"Knowing what I know about computer security and how EASY it is to plant digital evidence without leaving a trace." This right here is the conversation which needs to happen around this particular topic. In the security community the topic of forensic discovery of child porn tends to get a hand-wave because child porn. It's there so someone must be guilty. The fact is, it is trivial to plant such evidence on anyone's computer and honestly, if a computer is connected to the Internet, define ownership. Is your computer connected to the Internet? Then it's not your computer. Ever used public WiFi? It's absolutely trivial for someone to inject image requests which never get rendered, but which remain in the cache. This can be done en-mass without anyone ever noticing until someone's computer gets searched. Based on digital evidence alone no one should ever be arrested, let alone convicted on these charges, but the fact is, to catch someone who is guilty is very difficult. Difficult to the degree that it should require video and/or photographic evidence of the perp at the computer looking at the images. Therefore it seems law enforcement and the justice system has decided that the easy way out is to just go with what's on the hard-drive. If a few innocent people get caught, no big deal, it's for the greater good.

alanwatts 11y ago
>to catch someone who is guilty is very difficult. Difficult to the degree that it should require video and/or photographic evidence of the perp at the computer looking at the images. That would be very easy to fake too.
- patcheudor 11y ago
  I would argue that it's orders of magnitude more difficult by way of comparison to simply injecting naughty bits into an HTTP response.
pgpd 11y ago
How hard would it be to do a demo for jurors in a courtroom? Simple proof-of-concept getting all of them to connect to a "wifi" network which is a tethered device owned by the lawyer, have them navigate to a regular website, and then inject images for the 2nd go-around to introduce reasonable doubt?
- patcheudor 11y ago
  Trivial. The way to do this in a courtroom is to demonstrate it to the judge and jury by having a reputable forensics expert certify a computer is free from kitty pictures. Then have the judge connect that computer to a "Free WiFi" network to be used for the demo and have them go anywhere. Just start randomly browsing the Internet. Meanwhile, use an intercepting proxy like The Burp Suite, Fiddler 2, or Charles operating transparently (ergo., port 80 is routed through the proxy) and in every HTTP response replace the close HTML tag with a bunch of 1x1 sized images of kittens playing with yarn or something. After about five minutes of browsing, have the forensics expert look at the computer again and nail the judge for looking at kittens. Using an intercepting proxy which allows scripting, the whole thing could even be done in a way which would very much look like the judge was seeking pictures of kitties playing with yarn, right down to search engine queries. The last time I looked, not a lot of search engines implement cross site request forgery (CSRF) tokens for the entry of simple search terms. It's not like setting up a demo like this is even tough. At most it's a couple hours of work for a basic functional demo. UPDATE: For anyone claiming the forensics expert would find the tampered markup, the no-store cache directive pretty much takes care of that. For all tampered requests, just set the cache directive in the header to no-store and per the requirements of the RFC, the HTML will not be cached to disk. Also, I've encountered very few forensics experts who understand the web enough to grasp what can and cannot be done via the browser.
  - LeifCarrotson 11y ago
    > 1x1 sized images of kittens playing with yarn Here's a 1x1 image of this you can use. The yarn is actually very small, clear, monofilament fishing line, but I think it's a nice picture: http://commons.wikimedia.org/wiki/File:Blank.gif http://commons.wikimedia.org/wiki/File:Blank.gif
  - hobs 11y ago
    If you wanted to do evil, the NSA has already showed the ability to use the "quantum intercept" (return a response before the initial server does). No need to even have the power of proxy if they are using bare http.
agripa2 11y ago
This is utterly terrifying. What are some common steps to prevent this kind of "invisible" injection of images. If you're on private WiFi are you good to go? Any common tips to stay secure?
- LeifCarrotson 11y ago
  Don't use insecure WiFi networks, or if you do, use a VPN. That prevents you from getting these images injected by people sitting near you on the same network. And don't visit web sites controlled by people who would do this, or linking to ad networks controlled by people who would do this. That's a little more out of your hands...
  - patcheudor 11y ago
    One, I don't know anyone who doesn't use non-secure WiFi networks & even if they don't, they typically still do without knowing, ergo., the 'attwifi' situation. Two, I've reviewed a number of VPN solutions over the years and they are far from perfect. Amongst some of my more notable findings: 1) Banner / update text delivered via HTTP to the client in a fully renderable state within the VPN client. Yeah, that was a fairly common issue many years ago and could be used to hijack the application UX to ask the user for things like their password. 2) Split tunneling. Some VPN providers will send HTTP traffic through the VPN while sending HTTPS traffic out the hostile leg of the VPN. This is cool and all until you use an application which doesn't properly validate the server public and then boom, a bad guy can get in the middle. Over the last half decade I've reported said flaw (failure to properly validate the server public) to over three dozen financial institutions, a couple anti-virus companies, and a major automotive manufacturer. It's real, it happens. Not to mention the Superfish and related situations. Three, femtocells. Even if a bad actor can't get to someone's mobile computer (phone) via WiFi, they sure can by forcing it to negotiate a vulnerable cellular protocol and simply inject from there.
    - maqr 11y ago
      Can you elaborate on the femtocell vector and mitigation strategies?

alanwatts 11y ago

>to catch someone who is guilty is very difficult. Difficult to the degree that it should require video and/or photographic evidence of the perp at the computer looking at the images. That would be very easy to fake too.

patcheudor 11y ago
I would argue that it's orders of magnitude more difficult by way of comparison to simply injecting naughty bits into an HTTP response.

pgpd 11y ago

How hard would it be to do a demo for jurors in a courtroom? Simple proof-of-concept getting all of them to connect to a "wifi" network which is a tethered device owned by the lawyer, have them navigate to a regular website, and then inject images for the 2nd go-around to introduce reasonable doubt?

patcheudor 11y ago
Trivial. The way to do this in a courtroom is to demonstrate it to the judge and jury by having a reputable forensics expert certify a computer is free from kitty pictures. Then have the judge connect that computer to a "Free WiFi" network to be used for the demo and have them go anywhere. Just start randomly browsing the Internet. Meanwhile, use an intercepting proxy like The Burp Suite, Fiddler 2, or Charles operating transparently (ergo., port 80 is routed through the proxy) and in every HTTP response replace the close HTML tag with a bunch of 1x1 sized images of kittens playing with yarn or something. After about five minutes of browsing, have the forensics expert look at the computer again and nail the judge for looking at kittens. Using an intercepting proxy which allows scripting, the whole thing could even be done in a way which would very much look like the judge was seeking pictures of kitties playing with yarn, right down to search engine queries. The last time I looked, not a lot of search engines implement cross site request forgery (CSRF) tokens for the entry of simple search terms. It's not like setting up a demo like this is even tough. At most it's a couple hours of work for a basic functional demo. UPDATE: For anyone claiming the forensics expert would find the tampered markup, the no-store cache directive pretty much takes care of that. For all tampered requests, just set the cache directive in the header to no-store and per the requirements of the RFC, the HTML will not be cached to disk. Also, I've encountered very few forensics experts who understand the web enough to grasp what can and cannot be done via the browser.
- LeifCarrotson 11y ago
  > 1x1 sized images of kittens playing with yarn Here's a 1x1 image of this you can use. The yarn is actually very small, clear, monofilament fishing line, but I think it's a nice picture: http://commons.wikimedia.org/wiki/File:Blank.gif http://commons.wikimedia.org/wiki/File:Blank.gif
- hobs 11y ago
  If you wanted to do evil, the NSA has already showed the ability to use the "quantum intercept" (return a response before the initial server does). No need to even have the power of proxy if they are using bare http.

agripa2 11y ago

This is utterly terrifying. What are some common steps to prevent this kind of "invisible" injection of images. If you're on private WiFi are you good to go? Any common tips to stay secure?

LeifCarrotson 11y ago
Don't use insecure WiFi networks, or if you do, use a VPN. That prevents you from getting these images injected by people sitting near you on the same network. And don't visit web sites controlled by people who would do this, or linking to ad networks controlled by people who would do this. That's a little more out of your hands...
- patcheudor 11y ago
  One, I don't know anyone who doesn't use non-secure WiFi networks & even if they don't, they typically still do without knowing, ergo., the 'attwifi' situation. Two, I've reviewed a number of VPN solutions over the years and they are far from perfect. Amongst some of my more notable findings: 1) Banner / update text delivered via HTTP to the client in a fully renderable state within the VPN client. Yeah, that was a fairly common issue many years ago and could be used to hijack the application UX to ask the user for things like their password. 2) Split tunneling. Some VPN providers will send HTTP traffic through the VPN while sending HTTPS traffic out the hostile leg of the VPN. This is cool and all until you use an application which doesn't properly validate the server public and then boom, a bad guy can get in the middle. Over the last half decade I've reported said flaw (failure to properly validate the server public) to over three dozen financial institutions, a couple anti-virus companies, and a major automotive manufacturer. It's real, it happens. Not to mention the Superfish and related situations. Three, femtocells. Even if a bad actor can't get to someone's mobile computer (phone) via WiFi, they sure can by forcing it to negotiate a vulnerable cellular protocol and simply inject from there.
  - maqr 11y ago
    Can you elaborate on the femtocell vector and mitigation strategies?