6 Anti-forensic techniques that every cyber investigator dreads | EC-Council Official Blog - EC-Council Blog

---

• 6 Anti-forensic techniques that every cyber investigator dreads | EC-Council Official Blog - EC-Council Blog
• 5 best TrueCrypt alternatives | Encrypt your computer with these apps - proprivacy.com
• The Best Way to Encrypt Email in Outlook - Security Boulevard

6 Anti-forensic techniques that every cyber investigator dreads | EC-Council Official Blog - EC-Council Blog Posted: 23 Nov 2019 12:00 AM PST Anti-forensic techniques can make a computer investigator's life difficult. From committing fraud in an organization to stealing crucial data, cybercriminals can perform a wide range of nefarious activities. In some cases, these perpetrators try to cover their tracks by deleting browser history, cache memory, and even cookies. But with an upward trend, it is now much convenient for cyber attackers to use already programmed software and tools to alter their digital footprints. Technically, these tools are designed to hide, remove, and eventually hinder cyber forensic analysis. With the use of anti-forensic techniques, it becomes exhausting to retrieve evidence during a computer investigation. Cybercriminals use many ways to hide information and their digital footprints. For instance, altering the header of a file can deceive people. Changing the header from .jpg to .mp3 will give the impression of an audio file, but the system will still treat as an image file. Similarly, an investigator focused on a particular file format can skip over important evidence. Under another method, perpetrators can use slack space, i.e., unused space of a file, to hide sensitive sections of a file. Dividing a file into smaller sections and hiding the information in the slack space, makes the data retrieval and data assembly challenging. The internet has a vast number of anti-forensic techniques to conceal the digital activities of an individual. Some of these techniques are basic, while some require sound technical knowledge. The advanced techniques are deliberately used by the black hat community to hamper a cyber investigation. Fascinating Anti-Forensic Techniques to Cover Digital Footprints 1. Encryption Under encryption, the data is converted into an unreadable format ("encrypted data" or "ciphertext") using a pair of keys. The primary motive of encryption is to prevent confidential files or data from unauthorized access. The encrypted data can be deciphered only by using the paired-up key. This is one of the traditional methods to protect data. Under modern cryptography methods, Data Encryption Standard (DES), Advanced Encryption Standard (AES), are a few of the popular techniques. They use symmetric as well as asymmetric encryption. Difference between symmetric and asymmetric algorithms? Symmetric algorithms use a single key to encrypt and decrypt data, while asymmetric algorithms use two separate keys for both the processes. 2. Steganography Steganography is the act of concealing data in plain sight. Most often, data is exchanged via an image. In this type of technique, a section of the image is altered so that it is not identifiable easily. The processed file looks ordinary and can go unnoticed. In the modern-day, the message is concealed using microdots and invisible ink. There is another form, linguistic steganography, where the message is hidden in a natural context. Steganography allows messages and even huge files to be hidden in pictures, text, audio, and video files. It is challenging to identify a steganography-attack, but repetitive patterns can reveal the secret message to the investigator. With that, the professionals can also use advanced tools to spot hidden data. 3. Tunneling This method uses encapsulation to allow private communications to be exchanged over a public network. The data packets will flow from public networks, thus generating no suspicion. One of the common ways is to use a Virtual Private Network (VPN), which encrypts the data for security reasons. To eliminate such attacks, organizations must continuously monitor their encrypted network connections. 4. Onion Routing The process of sending messages which are encrypted in layers, denoting layers of an onion, is referred to as onion routing. The data packet goes through several networking nodes where every layer of encryption gets peeled off. With the stripping of the final layer, the message gets closer to reach its destination. The message remains anonymous to the entire message delivery chain except the nodes placed after the source and before the destination. One of the best practices to fight against onion routing is to use reverse routing. This elimination process is time-consuming but can be used to defeat onion routing. 5. Obfuscation A technique that makes a message difficult to understand because of its ambiguous language is known as obfuscation. This method uses jargon and ingroup phrases to communicate. It could be intentional and unintentional. The primary objective of obfuscation is to reduce the risk of exposure. It can be done by altering the signature or fingerprint of malicious code. Deobfuscation is the same as countering onion routing. Removing layers exposes clean and readable code. 6. Spoofing The act of disguising communication to gain access to unauthorized systems or data. Spoofing can be performed through emails, phone calls, and websites. Two most common ways of spoofing are – IP Spoofing – Under IP spoofing, perpetrators use a different IP address to hide their system's IP address for initiating malicious activities. Generally, this type of spoofing intends to carry out a distributed denial of service (DDoS) It can be performed either manually or by the use of tools. MAC Spoofing – MAC addresses usually cannot be changed, but with technical skills, it is not impossible. With MAC spoofing, cyber attackers use fake MAC addresses. This is one of the difficult spoofing methods to counter. Other types of spoofing include ARP spoofing, DNS spoofing, email spoofing, and many more. Forensic investigators have many tools and techniques to identify spoofing, such as examining email headers in the case of email spoofing or investigating wireless access point activities in case of MAC spoofing, and likewise. Many of these topics are covered under the Computer Hacking Forensic Investigator (C|HFI). The program will give you an in-depth understanding of digital forensics. Being a hands-on program, its virtual labs mimic the real-world challenges, offering the best learning experience. The vast coverage of C|HFI includes database forensics, cloud forensics, operating system forensics, network forensics, mobile forensics, and many others. Related Articles

5 best TrueCrypt alternatives | Encrypt your computer with these apps - proprivacy.com Posted: 28 Nov 2019 03:36 AM PST If you want to protect your data from prying eyes, then you need to encrypt it. Previously many of us relied on Truecrypt to do this, however, as the popular encryption app was mysteriously discontinued, we have created this article to give you five alternatives to TrueCrypt. If you are serious about security, then you will do this yourself rather than using a third-party to do it for you. This is what is meant by end-to-end encryption (e2ee). But even if you are using e2ee, how do you know that the software is not doing something untoward? Such as secretly sending your encryption keys back to its developers, or creating a backdoor in the encryption. The only guarantee we can have against this is the use of open-source code. Only if a program can be freely examined to ensure it does what it is supposed to (and only what it is supposed to) can we place a reasonable amount of confidence in it. If the code has been audited by a reputable third-party then we can have even more confidence in it, but even this is imperfect, as code can always be changed the second the auditors leave the building. So the fact remains simply being able to audit the code is the surest guarantee possible that any program is secure. TrueCrypt alternatives We have listed the best alternatives to TrueCrypt below. Most of them use the industry-standard AES cipher, so you may also wish to learn how AES encryption works. Platforms Windows. MacOS, Android, and Linux. Third-party Android and iOS apps allow you to open and access data stored VeraCrypt containers. VeraCrypt is a fork of TrueCrypt and its direct successor. Other than minor branding changes, it front-end looks the same and its functionality is identical to that of TrueCrypt.  It basically is TrueCrypt except that its code has been fully audited, problems discovered with TrueCrypt have been fixed,  and the app is under active development.  As such, VeraCrypt is widely regarded in the security world as the go-to open-source full-disk encryption program. It allows you to create a virtual encrypted disk (volume) which you can mount and use just like a real disk Or it can encrypt an entire disk partition or storage device (e.g. a hard drive or USB stick), including the entire drive your Operating System boots from. By default, VeraCrypt encrypts all data stored in a volume with an AES-256 cipher, although when creating a volume you can specify an alternative cipher. The NIST averse, for example, can opt to use a Twofish, Serpent, or Camellia cipher. Data is then authenticated using SHA-512 by default, but again, users can opt to use different hashing algorithms if they prefer. A notable feature of VeraCrypt is that any file, for example, an innocent-looking photo file, can be used as the container for a VeraCrypt volume. Even more notable is its hidden volume feature which provides plausible deniability. It does this by hiding an encrypted volume inside another VeraCrypt volume in such a way that, if the correct precautions are taken, it is impossible to prove the second hidden volume exists. Data stored in VeraCrypt containers can be securely synced across devices by storing a volume in (and mounting it from) a cloud storage sync folder. VeraCrypt can be used in this way to store data securely on otherwise insecure platforms such as Dropbox. It is not an ideal tool for this job, however. Volume sizes can be large and are of a fixed size which you must specify when creating them. And when any data inside a volume is changed the entire volume must be re-uploaded Of all the software discussed in this article, VeraCrypt is by far the most thoroughly audited open-source encryption solution available. Please check out our guides on VeraCrypt & how-to basics and A Guide to VeraCrypt hidden volumes for deep dives into this important encryption program. AES Crypt Platforms: Windows, macOS, Linux, Android (third party but open source). A third-party AESCrypt for iOS app is also available, although it is closed source and free users are limited to simply viewing files pre-encrypted on the desktop using AES Crypt. AES Crypt is a free open source (FOSS) cross-platform per-file encryption app which secures files using the AES-256 cipher. As a per-file encryption app, it allows you to manual encrypt individual files. Batch file encryption is not supported, although this limitation can be overcome somewhat by creating zip files out of folders, and then encrypting the zip file with AES Crypt. This very easy-to-use Java-based file program integrates with the OS, providing simple file encryption using the right-click menu button in Windows, or drag and drop in macOS and Linux (or an extension allows right-clicking in macOS). File decryption is performed by simply double-clicking the encrypted.aes file, and entering the password you supplied when creating it. A command-line interface is also available. It should also be noted that when you create an encrypted version of a file, the original unencrypted version remains untouched. This is great if you just want to store the encrypted version online, but for maximum security, you should delete the original. Just don't forget the password! Platforms (free): Windows. Free MacOS, Android, and iOS apps are available which allow you to open and view files, but not encrypt them. Platforms (Premium): Windows, macOS, Android, and iOS. Like AES-Crypt, AxCrypt is an open-source cross-platform per-file encryption app which secures files using AES. It is, however, a quite different beast. It comes in a free version aimed mainly at Windows users and a Premium version which costs $35 USD per year (30-day free trial). AxCrypt Free integrates with the Windows OS to provide seamless on-the-fly AES-128 file encryption. Rather than setting a password each time you encrypt a file, you sign into the app and then all selected files are automatically encrypted and decrypted using that password. Folders themselves cannot be encrypted using AxCrypt Free, but all files in a folder can be batch-encrypted. Or you can select as many files as you want from anywhere on your PC and perform batch encryption on them. For Windows users, then, AxCrypt Free offers many advantages over the rather basic AES Crypt. What you lose, however, is cross-platform compatibility. Free apps for macOS, Android, and iOS (but not Linux) allow you to open and view encrypted files, but not encrypt them. The Premium version fixes this problem with full support for all mentioned platforms. It also offers many useful additional features on all supported platforms, including full folder encryption (with sub-folder encryption), key sharing, account key backup, anonymous file names, and more. Platforms: Linux (DEB package or compile from source), macOS (using Homebrew). gocryptfs is inspired by the brilliant but flawed EncFS. Like Encfs, it creates paired folders or "volumes." One volume contains the unencrypted files (let's call it the "private folder'), while the second matching volume (let's call it the "encrypted folder") holds an encrypted version of the files in the first (private) volume. Unlike VeraCrypt, each file in a volume is encrypted and stored individually, so a change to one file does not mean re-uploading an entire encrypted container. This makes gocryptfs much better than VeraCrypt at storing files on cloud services such as Dropbox, as local files are kept unencrypted in the private volume, but are mirrored on Dropbox (etc.) in encrypted form by simply placing the matching "encrypted volume" in a cloud folder. What gocryptfs does not do is simply encrypt a file. Someone with access to the "personal folder" has access to the unencrypted files. In addition to this, files names in the encrypted folder are obscured, but metadata such as directory structure and file size are not. gocryptfs is command line only, but the setup is very easy. Once set up, you can drag-and-drop files to and from the private folder using your regular GUI file manager. Alternatively, SiriKali is a GUI frontend compatible with gocryptfs. Data is secured and using AES-256-GCM, with GCM also providing authentication. SecureFS and Crysfs are similar EncFS-inspired apps. SecureFS fixes the issues with EncFS and is notable for being available for all major platforms, including Windows (requires MS Visual C++ 2015 redistribution package). Crysfs' support for Windows is still very experimental, but it fully supports Linux and macOS, and improves on gocrypt and SecureFS by encrypting file metadata and directory structure. Platforms: Windows, macOS, Linux, Android, iOS. Cryptomator provides transparent encryption of files stored in the cloud. The encrypted vault is stored in your cloud folder, but is decrypted and mounted locally as a virtual drive for seamless drag-and-drop functionality. Files are encrypted individually, so when changes are made, only the corresponding encrypted file is changed. In addition to the content of files, the directory structure is hidden, although file modification dates cannot be hidden without breaking your cloud provider's synchronization feature. Vaults are secured using AES-256-CTR and unlocked using a passphrase which is protected against brute force attacks using the scrypt key derivation function. Cryptomator for the desktop works on a pay what you want model. It can be had for free, but users are encouraged to donate towards its development. The mobile apps (which support fingerprint unlock) cost $8.99 at time of writing. Final Thoughts VeraCrypt is a drop-in replacement for TrueCrypt. If your encryption needs are somewhat different, then the open-source tools discussed in this article reflect the variety of use-cases for encryption apps. You may need to choose between AES Crypt and AxCrypt, and between gocryptfs (or other Encfs-inspired variant) and Cryptomater, but most apps lists here do their own specific thing with very little crossover in functionality between them. The best advice, therefore, is to deploy a variety of encryption apps. This means you will the right tool for the job, rather than trying to knock square pegs into round holes by using a single app to perform jobs it was not designed to do.

The Best Way to Encrypt Email in Outlook - Security Boulevard Posted: 08 Apr 2019 12:00 AM PDT Today, many in the enterprise see O365's email encryption for Outlook as the best-in-class security for messaging. Unfortunately, the reality is that Microsoft's email encryption standard has serious deficiencies that leave messages unsecured and vulnerable to attack. While the platform provides numerous security options, these options are unable to meet today's overwhelming security challenges.   To better understand the challenges of O365 encrypted email in Outlook we should look at the methods for email encryption Microsoft offers and their shortfalls.   The Outlook on Microsoft email   TLS – The Standard Outlook on Protecting Data   Today, NIST standards recommend the use of Transport Layer Security (TLS) to protect messages in transit to and from the email server. By default, O365 ensures TLS for messages by ensuring messages go through an encrypted layer from the user's inbox to the email server. The goal of TLS is to prevent an eavesdropper from snooping on messages or using a sniffer to intercept messages.   A significant problem with TLS though is that it does nothing to encrypt the text of the message itself. While the transport layer is encrypted, the message itself remains in plain text. Additionally, TLS does nothing to ensure encryption from the sender's email server to the recipient's email server. If the recipient's server does not require TLS then the message will remain as an unencrypted email.     If the enterprise is relying on TLS then its email remains vulnerable . If an enterprise is solely relying on TLS, messages are not encrypted on the client nor on the email server but rather only in transit. Additionally, the email might not be encrypted as it travels to the recipient's email server and their client. At each of these unencrypted points, the email is vulnerable to attack.   The Outlook on Office 365 Message Encryption (OME)   Microsoft also provides Office Message Encryption (OME) for encrypting email in Outlook. OME is a rules-based security tool where Microsoft manages and stores the encryption keys. OME secures messages with these encryption keys once they arrive to the OME server. Messages that meet specific conditions will then be encrypted.   Admins can set up transport rules that determine when encryption is used based on the content of the message. If a user sends a message that matches the encryption rule, encryption is applied automatically.     To set up OME rules for your enterprise, the IT admin needs to:   In a web browser, sign in to Office 365. Choose the Admin tile. In the Office 365 admin center, choose Admin centers > Exchange. In the EAC, go to Mail flow > Rules and select New  > Create a new rule In Name, type a name for the rule, such as Encrypt mail for Finance@MyCompany.com. In Apply this rule if select a condition, and enter a value if necessary. For example, to encrypt messages going to Finance@MyCompany.com: In Apply this rule if, select the recipient is. Select an existing name from the contact list or type a new email address in the check names box. To select an existing name, select it from the list and then click OK. To enter a new name, type an email address in the check names box and then select check names > OK. To add more conditions, choose More options and then choose add condition and select from the list. If you want to apply the rule only if the recipient is outside your organization, select add condition and then select The recipient is external/internal > Outside the organization > OK. To enable encryption using the new OME capabilities, from Do the following, select Modify the message security and then choose Apply Office 365 Message Encryption and rights protection. Select a template from the list, choose Save, and then choose OK. The sender then composes a message in Outlook, selects Options> Permission, and selects the appropriate permission level and then sends the message.   The admin will need to repeat these steps for rule creation for every encryption rule they wish to enforce.   The challenge of implementing multiple encryption rules is only a part of the challenge of using OME. A bigger challenge is that OME servers can only enable the encryption rules once they have read the email and determined that encryption is required. While some users might not worry if Microsoft reads their emails, the reality is that this vulnerability creates a large hole in the enterprise's security. If Microsoft can read your email than so can attackers.   In April 2016, Microsoft filed a suit against the U.S. government. Microsoft filed the suit because they required the company to hand over customer email and not inform the customers it had done so. Of course, the U.S. government was only able to make this request because Microsoft had the keys to the server in the first place. Clearly, Microsoft's ability to view user emails comes with significant security risks.   How to encrypt email in Outlook using s/MIME   S/MIME is another email encryption standard Microsoft provides for encrypting email in Outlook. S/MIME is a certificate-based encryption solution that allows IT admins to provide end-to-end encryption for email. By definition, s/MIME ensures that only the sender and the intended recipient can open and read the message. A digital signature helps the recipient validate the identity of the sender. Below is a diagram for how s/MIME encryption works to send a message in Microsoft Outlook.   Here are the steps for how an IT admin should set up O365's s/MIME:   Install a Windows-based Certification Authority and set up a public key infrastructure to issue S/MIME certificates. Publish the user certificate in an on-premises Active Directory Domain Services (AD DS) account in the UserSMIMECertificate and/or UserCertificate attributes. Your AD DS needs to be located on computers at a physical location that you control and not at a remote facility or cloud-based service somewhere on the Internet. Set up a virtual certificate collection in order to validate S/MIME. This information is used by Outlook on the web when validating the signature of an email and ensuring that it was signed by a trusted certificate. Set up the Outlook or EAS end point to use S/MIME.   Because S/MIME receipt requests must include a digital signature, you must have a digital ID to request an S/MIME receipt.   In an open message, click Options. In the More Options group, click the Message Options Dialog Box Launcher  . Under Security, click Security Settings. Select the Add digital signature to this message check box. Select the Request S/MIME receipt for this message check box. Click OK and Close on the Security Properties and Properties dialog boxes. Send your message. In addition to the multiple steps required for sending a message through s/MIME, the platform requires that both sender and recipient are using s/MIME. If the recipient is not using s/MIME then the pair cannot take advantage of the end-to-end encryption it provides.   s/MIME also requires the sender to have the public keys for each individual they will exchanges messages with. Senders must also maintain their own private keys. If their device is stolen, they need to get a new public and private key. They also will need to redistribute their new public key to all of their colleagues. Any information secured under the original private key is lost.   Furthermore, s/MIME is vulnerable to attack. As was shown in last year's eFail revelation, s/MIME is vulnerable to man-in-the-middle attacks. This vulnerability means that s/MIME lacks the ability to prevent would be attackers from taking advantage of the platform and reading users' messages.   How to encrypt email in Outlook using Information Rights Management (IRM)   IRM is a Microsoft encryption standard that protects email and documents by preventing sensitive information from being printed, forwarded, or copied by unauthorized people. For example, a company administrator might create a template called "Confidential Financials". "Confidential Financials" could specify that an e-mail message using that policy is only opened by users inside the company domain.   When a user sends an email that has the "Confidential Financials" rule in the email header, the standard is implemented. Alternatively, the user can manually enable the rule.   Steps to implement IRM   Implementing IRM begins with the admin creating rules to govern the behavior of the email. Sign in to Office 365 as a global admin or SharePoint admin. Select the app launcher icon in the upper-left and choose Admin to open the Office 365 admin center. (If you don't see the Admin tile, you don't have Office 365 administrator permissions in your organization.) In the left pane, choose Admin centers > SharePoint. In the left pane, choose settings. In the Information Rights Management (IRM) section, choose Use the IRM service specified in your configuration, and then choose Refresh IRM Settings. After you refresh IRM settings, people in your organization can begin using IRM in their SharePoint lists and document libraries.   How end-users can implement IRM:   Create a new email in Outlook Click on the Options tab in the header Select the permissions for the email by clicking on the Permission block and choosing the appropriate standard Select More Options dialogue launcher to determine when the message will expire Send email Repeat these steps for every email that must be secured by this standard IRM was designed to encrypt messages so they couldn't be forwarded, printed or downloaded. However, these protections are easily bypassed by simply taking a screen shot of the text. Moreover, admins maintain the keys for IRM which means that they have the ability to decrypt the messages. If an admin is able to decrypt the message then so can an attacker. How to encrypt email in Outlook without the extra steps or extra worry There is a better solution to answer the question of how to encrypt email in Outlook. This solution starts with PreVeil's easy to use email encryption platform protected with end-to-end encryption. With end-to-end encryption, the email is encrypted on the user's device and is only ever decrypted on the user's device. Unlike TLS, OME and IRM, PreVeil never decrypts messages along the way.   Unlike s/MIME, PreVeil also provides methods for key management so that the user is never challenged to access their data if they lose their device. PreVeil also offers auto-encrypt so that senders don't need to remember to add labels to the email header.   Here's how to encrypt email in OutlookDownload the PreVeil application for email:   Go to https://www.preveil.com/download/ and download the version of PreVeil you wish to use. Choose between Windows, Mac, AppStore and Google Play On the next screen, click the "Download" button. Another screen displays to let you know that the PreVeil installer is downloading. When the download is complete, you can access the PreVeil.exe file in your Downloads folder Go to preveil.com/app to create your account. You are taken to your new PreVeil Inbox and provided with the opportunity to install PreVeil into Outlook. Click on <<Add PreVeil to Outlook>> in the interface How to send an encrypted email in Outlook   Go to Outlook and look for your Encrypted Inbox Click on <<New Email>>. Enter the recipient in the To field and compose your message Click on send   If your recipient has PreVeil installed on their end, they will be able to easily read the message either in the PreVeil application, Outlook, gMail or MacMail. Otherwise, they will receive a link in their email that allows them to either download the PreVeil application or read the encrypted in their browser.   CONCLUSION   PreVeil is able to overcome the challenges that Microsoft's native email encryption platforms provide and enable users to encrypt email in Outlook. With PreVeil, you can take control of the enterprise's inbox and secure your messages from phishing and spoofing.   Want to learn more about how to encrypt email in Outlook? Contact us! The post The Best Way to Encrypt Email in Outlook appeared first on PreVeil. *** This is a Security Bloggers Network syndicated blog from PreVeil authored by Orlee Berlove. Read the original post at: https://www.preveil.com/blog/the-best-way-to-encrypt-email-in-outlook/

You are subscribed to email updates from "best encrypted mobile phone,encrypt samsung s6,encryption and decryption tools" - Google News. To stop receiving these emails, you may unsubscribe now.	Email delivery powered by Google
Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States