Forensics in a wireless environment

From: Kevin.M-CTR.Shannonat_private
Date: Thu Oct 31 2002 - 12:03:00 PST


Hello everyone.  I have been monitoring the list for a while but this is my
first post.

I believe it was Gary Palmer who mentioned
"Digital Forensic Analysis in a wireless/cellular environment. RIM
Blackberry,Bluetooth, 802.11x, CDMA, GSM, 3G, 4GSM, etc.. Very complex and
challenging."

I work for the Federal Government (in a contractor capacity) and I believe
that this is one of the reasons that the Fed is banning wireless devices at
many of it's installations.
A mobile wireless device could gain access to secure resources, copy said
resources, and who cares if Locard's exchange principle applies or not?
The wireless device could leave events in the logs, but it would not
matter.  Said perp. could go mobile, with the data he/she has acquired and
then destroy the wireless device.

This is going to make computer forensics a challenge when 802.11 and other
wireless access methods are used in an incident.


Kevin Shannon, Sr. Network Administrator DOT/FAA/AVN
Lockheed Martin InformationTechnology    http://www.it.lockheedmartin.com/
Office - 405.954.7134  Email - Kevin.M-ctr.Shannonat_private
http://avn.faa.gov/





-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com



This archive was generated by hypermail 2b30 : Sat Nov 02 2002 - 08:19:31 PST