Antiforensics: the looming arms race

Tuesday, 13 May 2003, 9:51 AM EST

The anticipated release of a Windows-based "antiforensics" tool will likely heat up a simmering arms race between cybersleuths and digital bad guys.


Increasing use of forensics tools is making it harder for hackers and script-kiddies to cover their tracks, prompting many to experiment with existing antiforensics tools, such as The Defiler's Toolkit and Burneye.

"We're not seeing widespread usage in the underground yet, but it's coming," says Ed Skoudis, VP of security strategy for Predictive Systems. "We're starting to see them get picked up more and more." (Predictive was recently acquired by two companies; International Network Services and Science Applications International Corp.).

There's evidence a Windows version of these Linux-oriented tools exists, but isn't circulating. Once it is, experts expect an upswing in antiforensics activity, which will make hacker investigations more difficult.

First published in July 2002, The Defiler's Toolkit manipulates data used by the popular Unix forensics analysis tool The Coroner's Toolkit. It targets the Linux Ext2fs file system and hides data (such as malicious code) in areas of a hard drive that Coroner's Toolkit can't search. It also can delete files and the metadata associated with those files.

[ Read more ]




Spotlight

The context-aware security lifecycle and the cloud

Posted on 25 November 2014.  |  Ofer Wolf, CEO at Sentrix, explains the role of the context-aware security lifecycle and illustrates how the cloud is shaping the modern security architecture.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Nov 26th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //