Re: Forensics in a wireless environment

From: Valdis.Kletnieksat_private
Date: Mon Nov 04 2002 - 00:52:59 PST

  • Next message: Gino Pietro Guidi: "RE: Remote Syslogd"

    On Thu, 31 Oct 2002 14:03:00 CST, Kevin.M-CTR.Shannonat_private  said:
    
    > I work for the Federal Government (in a contractor capacity) and I believe
    > that this is one of the reasons that the Fed is banning wireless devices at
    > many of it's installations.
    
    This looks like an incomplete threat analysis to me, as the ban probably
    *should* be 'electronic devices' in general, rather than wireless...
    
    > A mobile wireless device could gain access to secure resources, copy said
    > resources, and who cares if Locard's exchange principle applies or not?
    > The wireless device could leave events in the logs, but it would not
    > matter.  Said perp. could go mobile, with the data he/she has acquired and
    > then destroy the wireless device.
    
    Said perp could also load the stuff onto the PDA/whatever, and wait till 5
    minutes after he leaves before hitting 'send'(*).  If you have a handheld that
    has 16 or 32M of purloined data on it, it may even be faster to take it home
    and upload to a PC via its cradle rather than do the modem-over-digital-phone
    thing and only get 5K/sec upload speed....
    
    Think "modified MP3 player with record capability".
    
    -- 
    				Valdis Kletnieks
    				Computer Systems Senior Engineer
    				Virginia Tech
    
    
    (*) There's a *reason* why a certain TLA banned "Furbies".  They did a more
    detailed threat analysis, it seems....
    
    
    



    This archive was generated by hypermail 2b30 : Mon Nov 04 2002 - 03:17:26 PST