Firefox confuses cyber sleuths
p2p news / p2pnet:- Firefox, Opera and other non-Microsoft browsers have cyber sleuths all hot and bothered.
Internet Explorer hides nothing from police and other investigators who examine PCs to discover which sites the user has visited, according to a class held Wedensday [sic] at the annual training meeting of the High Tech Crime Investigation Association, says CNET News.
Investigators know the location of the IE browser cache, cookie files and history, and they know how to read those files. Also, popular forensics tools can help out.
But when Net cops are confronted by browsers such as Firefox and Opera, the data are no longer on a plate ; )
These programs use different structures, files and naming conventions for the data that investigators are after, Glenn Lewis revealed at a well-attended session staged during the at the annual training meeting of the High Tech Crime Investigation Association.
Lewis works for the corporate investigation firm Kroll, which describes itself as, the world`s foremost independent risk consulting company.
Not only but also, files are in a different location on the hard drive, which can cause trouble for examiners. Furthermore, forensics software may not support the Web browsers, Lewis said.
Apparently, a specific challenge with Firefox and Opera is identifying which web addresses have been entered manually as opposed to having been clicked on in a hyperlink, Lewis told the class, according to CNET.
The distinction may be important in a case where a suspect claims he did not intend to visit a Web site, but accidentally clicked on a link or was sent to a site automatically, continues the story. It is hard to make that argument if an address was physically typed into the Web browser.
Lewis recommended “free tools for investigators” including Opera 4 File Explorer, which displays Opera cache files, and Web Historian, which “exports history information for IE, Opera and Firefox into an easily readable Excel spreadsheet”.
(Cheers, Alex)
If there’s something you think we should know, tips[at]p2pnet.net
See:-
CNET News – Alternative browsers pose challenge for cybersleuths, August 31, 2005
September 2nd, 2005 at 8:59 pm
This is one of the reason why I do not Use Microcrap software. I don’t want everything I consider private handed by Microsucks to who ever decides to snoop about my computer. But just because Microsloth decides to blatantly hand over this information via INDEX.DAT file does not mean that open source programs do not do the same.
Check for thumbnail and fave icon directories. Do a search for privace and the name of your favorite internet program. Just because you use Free, open-source software does not make you immune to snoop programs. Most open source programs at least makes an effort to keep data out of wrong hands, but do not lure yourself into a false sense of security.
September 3rd, 2005 at 8:36 am
Sorry guys, but i doubt very much that those apps are legal to use since that blizzard vs bnetd case has been finalized. Unless they’ve been coded by the authors of the original apps, then they’ve been reverse engineered to interact with them and you’re violating the dmca.
So does this mean the tools that cops and cartel clones use to recover data deleted from hard drives are now in direct violation of the dmca? After all, MS created the fat, fat32, and ntfs file systems, and those data recovery tools are in fact reverse engineered to interact with those “systems”. Clearly a violation of the DMCA.
Tho i guess MS could have released api’s to enable these sort of tools, but i’d say unless the authors of those tools obtained and received permission from MS to create them, anyone who uses them is in deep doodoo. Muahahahahaha!
September 3rd, 2005 at 9:02 am
Wouldn’t it only be violating the DMCA with Opera and IE though, seeing as Firefox is open source and published under the GNU GPL?
September 4th, 2005 at 3:48 am
Hmmm i’m not sure on that one, you could be right.
Which is very bad news for companies that create proprietry software, like MS. Why? Well if the only databases you’re allowed to reverse engineer your company’s customer data out of, are open source ones, why would you risk buying a proprietry database to hold that customer info?
You can’t depend on the company that made that proprietry database being around in 5 to 10 yrs when you need to upgrade. If it’s now illegal to pay a programmer to create a data migration tool, the only other option would be to pay hundreds of ppl to manually read the info out of the old database and manually enter it into the new one. Introducing a billion typo’s as a result. Can you imagine the chaos?
This sort of situation happens! I work for a company that has client with a 20+ yr old unix based customer database, with a 5 yr old web based front end for that the staff use to interact with the old database. As a result of that ruling, its no longer legal to do this, unless the web based front end was supplied by the original creators or at least current owners of the original database.
I mean even just adding new call plans involves updating the database design, if that database was designed by a now defunct company, paying someone else to make the changes could now be illegal! Even just to add a new field to the records!
“No sir i’m afraid we can’t add your email address to your account contact information, we’re not legally allowed to update our database to include a field for that information as the original creator of the database went bankrupt and closed down 6 months ago. Apparently we have to buy a whole new database and have ppl manually copy the info from the old one to the new one.”?!?!?!?!
This whole situation is ridiculous and hopefully big biz will make enough of a squeal to get those reverse engineering parts of the dmca fixed up. Then again we’re relying on bureacrats to “fix” something. Not good.
September 4th, 2005 at 12:45 pm
I would have thought in a real world scenario like that the comapny would just go ahead and reverse-engineer the database and hope nobody noticed.
We don’t have the DMCA or anything like it (yet) in the UK, but is it now illegal to take apart a clock, radio, car, etc that you didn’t make yourself? Is it illegal to try to figure out what the recipe is for some dish you didn’t invent yourself?
Chris
September 5th, 2005 at 4:01 am
If not right now, i’m sure it soon will be.