|
|||||||||||||||||||
|
|||||||||||||||||||
Cyber-Smears & Cyber-Attacks: Protecting Your Company Basic Online Investigation TechniquesBy Tom Donovan Exhibit 4Introduction Where in the world is that Internet site located? Who is responsible for that site? These are the most frequently asked questions when your company is presented with a cyber-smear or cyber-attack. Dealing with Internet cases can be frustrating and time consuming, as technical issues and determining jurisdiction can always delay a decision on whether a case can or should be pursued. The purpose of this document is to allow you and your in-house personnel to take control without spending precious dollars on Internet specialists until you really need to. Below you will find an introduction to Internet terminologies and online tools that will aid you during the course of your investigation. Internet Basics Introduction to IP Addressing An Internet Protocol (IP) address is a set of numbers assigned to a user, or a website, creating a physical presence on the Internet usually in the form of a dotted quad: Some of Microsoft.com’s IP Addresses are: 207.46.249.190 Everyone with a presence on the Internet has an IP address assigned to them since a location must be established on where information will be sent to or received from. Thus, all websites have an IP address assigned to them which gives them presence on the Internet and allows the user to retrieve (view) the data that is on that site. Think of an IP address as your home mailing address, where you need an address for your house in order to receive packages. Without an IP address, no one can find you and the user can retrieve the data on your website. A domain (www.something.com) can have more than one IP address, however this is dependent on how much traffic the domain receives and if a request is made by the owner to the ISP hosting the site for several IP addresses. Thus, it is critical that you know the IP address of any website that you want to investigate. Tools To Aid In Your Investigation
WHOIS Accuracy: Falsified or inaccurate WHOIS information is a common problem that you may be able to overcome. The Internet Coalition for the Assignment of Names and Numbers (ICANN) has a policy that WhoIs data must be accurate. Once notified of the false/inaccurate information, the owner of the registered domain will often require the registrant to provide accurate WhoIs information or face deletion of the domain. A deleted domain means that site will no longer be accessible on the Internet via its domain name. Note that registrars will have different interpretations on the policy. Section 3.7.8 states: 3.7.8 Registrar shall abide by any specifications or policies established according to Section 4 requiring reasonable and commercially practicable (a) verification, at the time of registration, of contact information associated with a Registered Name sponsored by Registrar or (b) periodic re-verification of such information. Registrar shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy. http://www.icann.org/registrars/ra-agreement-17may01.htm Regional Internet Registries IP address space is distributed in a hierarchical way. IANA (Internet Assigned Numbers Authority IANA.org) allocates blocks of IP address space to Regional Internet Registries (RIRs). RIRs allocate blocks of IP address space to local Internet registries that assign the addresses to end users. A frequently asked question concerning IP addresses: “What if I do not have a domain name, but just an IP address, and I have already performed a traceroute and such, but I still do not know where the server is located?” Well, a good place to start is by visiting the ARIN (American Registry for Internet Numbers, Region: North America, Africa south of the equator, and portions of the Caribbean) website at www.arin.net. Next, perform a WHOIS on the ARIN database before performing a traceroute, as traceroutes can be hampered by firewalls. Performing a WHOIS on this database will tell you who owns or is subletting an IP block, thus giving you the location and jurisdiction of the server in question. Utilizing the ARIN database is rather easy, as explained in the example below: For this experiment, we will use one of Microsoft.com’s IP addresses as an example: First we will perform an NSLOOKUP to reveal Microsoft.com’s IP address: 207.46.249.190 Then we take the IP address of 207.46.249.190 and plug it into the SEARCH WHOIS box on the http://www.arin.net homepage (see screenshot below): 
We then click on SEARCH WHOIS and get the following results: 
The detailed output from the ARIN WHOIS reveals the following: Search results for: 207.46.249.190,
OrgName: Microsoft Corp
NetRange: 207.46.0.0 - 207.46.255.255
TechHandle: ZM39-ARIN
OrgAbuseHandle: ABUSE231-ARIN
OrgNOCHandle: ZM23-ARIN
OrgTechHandle: MSFTP-ARIN
# ARIN WHOIS database, last updated 2003-07-29 09:24 From this detailed report, we can surmise that this IP address originates in the United States, in Redmond, Washington. We also can state that any IP address that falls under the following range of 207.46.0.0 - 207.46.255.255 belongs to Microsoft Corporation. We also have the contact information, as in this case, an email address and telephone number. Another frequently asked question concerning the ARIN database would be: “What if I don’t know that the IP address I have is American based, which RIR would I choose?” It doesn’t matter, as all of these databases are connected to one another. Let’s say the IP address that you have originates in Russia, but you were unaware of this. All you would need to do is start with ARIN, plug in the IP address information, and ARIN would link you to the correct registry, which in this case would be RIPE, which would then yield you the correct record for the IP address in question. Other RIR's
Exercises Exercise #1: Using the tools, outlined below, perform a PING, NSLOOKUP, Reverse NSLOOKUP, TRACEROUTE, and WHOIS on Microsoft.com. Ping NSLOOKUP: Reverse NSLOOKUP: Traceroute: Whois Exercise #2: Using the knowledge that you have attained from the previous exercise, please use the ARIN database to perform a WHOIS search on the IP address for Hotmail.com. |
|||||||||||||||||||
