Skip to main content
gamedev.net
🔒 Locked

Computer Crime Trials

Started by Monder Oct 19, 2003 at 8:09 AM 11 replies 1.2k views
Original Post
Monder
Monder
Check out these two related articles (both from the register) http://www.theregister.co.uk/content/55/33451.html http://www.theregister.co.uk/content/55/33460.html They're about how a 19yr old has been aquitted of launching a ddos attack against 'web-based' systems. His defence was someone took over his computer using a trojan and then launched the attack. A forensic analysis of his computer showed attack tools but no sign of a trojan. An expert witness declared no technology existed for a trojan to completely remove itself from a computer in such a way to be undetectable to the forensic analysis. The defendant won. This 'trojan defence' has been used successfully before in the UK by a man who had some images of child pornography on his computer, he claimed they had been put there by a trojan. I can see the 'trojan defence' becoming a great problem in computer related crime cases
quote:
It's very difficult to counter the quite simple argument that someone else did it and ran away. We had hoped to showthat if someone else did it they would have left footprints and that, in this case, there weren't any.
quote:
It's difficult to prove something hasn't happened
Both from the expert witness who testified that if a trojan had been on his computer they would have detected it. So how do you think they could combat this problem? Even if it is proved it was done by a trojan should they still face a punishment (such as a fine) for having an insecure computer? [edit]Fixed links and title [edited by - Monder on October 19, 2003 9:11:19 AM] [edited by - Monder on October 19, 2003 2:40:22 PM]
Feral
Feral
Ooh that is a funny!! a fine for having an insecure computer... My, don''t tell the goverment, that would be quite the money maker! ;P

But funnies aside, it is not really fair to fine me for something I didn''t do. But then, one thing life isn''t is fair. At a guess I''d say the trojen defence will fade out once the court systems get a small clue what a computer is. ... `Course that may require a few lifetimes...

I supose a short term patch would be to require computer literacy to connect to the net or install or something like that. ... So you can claim that the defendant knows about trojens and stuff.
capn_midnight
capn_midnight
quote:
Original post by FeralofFireTop
But funnies aside, it is not really fair to fine me for something I didn''t do. But then, one thing life isn''t is fair.

how about if you don''t buckle your seat belt in a car? Or don''t signal before turning? Or don''t feed your dog for a week? You''ll get fined for everyone of those.
Ravuya
Ravuya
The problem is that the jury (and judge) is most likely completely computer illiterate and incapable of making an intelligent decision when confronted with the fact that there is no trojan found.

Personally, I think he should have gotten busted, but hey, logic apparently flies out the window any time there''s anything to do with these magical computer things in law!

Resist everyone
I am your only friend. Click here for more information.
Conner McCloud
Conner McCloud
quote:
Original post by capn_midnight
how about if you don''t buckle your seat belt in a car? Or don''t signal before turning? Or don''t feed your dog for a week? You''ll get fined for everyone of those.

If my car gets stolen because I left the keys in the ignition, and the theif runs over a little old lady, I would not be responsible. In a civil suit, the little old lady may be able to get some money out of me, but I couldn''t be charged with manslaughter and arrested.

If the police can trace the gun that kills a little old lady to me, but has no other evidence that I killed the little old lady, then I will probably not be found guilty of murder.

CM
Monder
Monder
I reackon for cases like this the jury (if they have one) should be composed of computer security experts (one of the articles I linked to mentioned this). But I don''t see that happening, I also see a lot more script kiddies getting off using this trojan defence, which may not seem that bad but when you consider paedophiles can use it as well it seem worse
Conner McCloud
Conner McCloud
And besides, why should I be punished because my computer was insecure enough to be used in an attack against some company, but the company isn''t punished for being vulnerable to the attack in the first place?

CM
ktuluorion
ktuluorion
You know, it wouldn''t surpise me if this was possible though. Think about it: The trojan could get inside your computer, do something (ie, yes, download pictars, or attack a website) then simply delete itself afterwards.

[Piebert Entertainment] [Ask The All-Knowing Oracle A Question]------------------------------------------------------------GDSFUBY GameDev Society For UnBanning YodaTheCodaIf you want to see yoda unbanned then put this in your sig ------------------------------------------------------------DAIAGA Dave Astle is a God Association. To join, put this in your sig!Founder and High Priest o
Conner McCloud
Conner McCloud
quote:
Original post by Monder
I reackon for cases like this the jury (if they have one) should be composed of computer security experts (one of the articles I linked to mentioned this).

In the US, both the prosecution and the defence take part in jury selection, and the jurors are initially chosen at random. I''ll bet Runaway Jury will explain some of this, I know the book did. The UK may be different, I don''t know.

Choosing from a pool of security experts would unfairly bias the jury in favor of the prosecution, so the defense would never allow it. It would be the same as having a jury filled with forensics experts hearing a murder case. They woudl be sympathetic towards the evidence given by the prosecution because they will give more weight to their peers than to a normal person. Furthermore, there''s a small pool of security expers around. Forcing them to have jury duty every time a computer case arises would never fly, so they''d have to have security experts on staff who comprise the jury in these cases. I''m sure you can see the problem in the prosecution paying the juror''s salaries.

CM
Monder
Monder
If it simply deleted itself a proper forensic analysis would pick it up rather easily. The reason I find it suspicious is there was a load of attack tools on this persons computer. Sure the trojan could''ve downloaded them and ran them but it would have to simulate a user using the, why not code all the attack stuff directly into the trojan?

quote:
And besides, why should I be punished because my computer was insecure enough to be used in an attack against some company, but the company isn''t punished for being vulnerable to the attack in the first place?


A DDOS attack is something you can really patch against. All I''m saying is having a fine for people''s whose computer get taken over by something that exploits an vulnerability that''s several months old could help stop a lot of viruses, it''s not like it''s hard to patch WinXP and if users complain about having to do it, well you have to take your car for an MOT every year don''t you?
Michalson
Michalson
quote:
Original post by Monder
An expert witness declared no technology existed for a trojan to completely remove itself from a computer in such a way to be undetectable to the forensic analysis.


Then the "expert" that was hand picked for his unique opinion was wrong. It is entirely possible to write an EXE file that can, after acting as a server/whatever evil purpose, could actually wipe itself from the disk, it could even do a multiple pass deletion to ensure that forensic analysis could find no trace of the EXE (the EXE contains the code for the deletion program. The exe then loads that code directly into memory as a new process and runs it, exiting the original process so that the deletion process can delete the exe. The deletion process then exits, leaving no evidence assuming the computer was turned off or RAM where that process was in overwritten)
C-Junkie
C-Junkie
heck, it never even has to touch the disk. exploit the flaw in IIS (er, or somehing else, of course!) and launch the DDoS. Sure, a reboot wipes out the trojan, but no evidence!
Monder
Monder
quote:
Original post by Michalson
quote:
Original post by Monder
An expert witness declared no technology existed for a trojan to completely remove itself from a computer in such a way to be undetectable to the forensic analysis.


Then the "expert" that was hand picked for his unique opinion was wrong. It is entirely possible to write an EXE file that can, after acting as a server/whatever evil purpose, could actually wipe itself from the disk, it could even do a multiple pass deletion to ensure that forensic analysis could find no trace of the EXE (the EXE contains the code for the deletion program. The exe then loads that code directly into memory as a new process and runs it, exiting the original process so that the deletion process can delete the exe. The deletion process then exits, leaving no evidence assuming the computer was turned off or RAM where that process was in overwritten)


I did think it sounded wrong. But it''s still suspicious that he had the attack tools as I mentioned above.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.