Hackers attack forensics tools

Criminals are increasingly deploying aggressive anti-forensics technology to
ensure that prosecution is impossible, according to experts.

Christopher Novak, Principal, Verizon Business, said: “We're increasingly
seeing hackers not only attempt to avoid detection, but actually
attack forensic investigators. For example, there are several toolkits out there that actively defeat forensics tools by crashing the system when recognised tools are booted. Anti-forensics techniques are a clear and present danger.”

Overall, anti-forensics techniques such as wiping of data have become a factor
in 88 per cent of cases handled by Verizon Business. Additionally, the techniques are becoming more successful, according to Novak, demonstrated by the fact that 63 per cent of businesses are typically taking months rather than days to discover data leaks.

“Investigations are taking longer, due to techniques ranging from simple wiping of data to corrupting altering or obfuscating log files. We're also
seeing increasing interest in and use of encryption and steganography to hide attack tools and secure stolen data from other hackers”, said Novak in his presentation 'Cyber CSI: How Criminals Manipulate Anti-Forensics to Foil the Crime Scene'.

However, Novak was keen to point out that the last year has seen a shift from
externalised threats to internal issues due to increased security and awareness. “We often find now that it's a businesses partners or third parties that are the source of problems”, he said.

See original article on scmagazineus.com