Cloud Forensics
Cloud computing is a computing-as-service paradigm with different declinations:
IaaS
PaaS
SaaS
We will deal with the concept of public clouds and in particular with:
Acquisition issues
Analysis issues
Attribution issues
Legal status issues
Acquisition issues
In general, even in IaaS scenarios, no control is given to user on hardware and storage space. Levels of access may vary:
Saas: only cloud service providers have logs/data.
PaaS: customer may have OS/application/network/database logs, depending on the CSP
IaaS: logs until OS level accessible to customers; network/ process logs at provider level (e.g. load balancer logs)
There are big consequences to this, the main one being that investigators cannot access raw hardware, which makes traditional acquisition procedures unfeasible for the host. Moreover:
A VM could be spread in different drives -> almost impossible to perform correctly data acquisition.
When deallocating, space is gone forever, meaning that there is no deallocated space to analyze -> the concepts of slack space and carving do not apply here.
In conclusion: sometimes we can reconfigure our host instance to collect more logs but otherwise, there's little we can do.
Availability of data
If the provider already logs the data we are interested in we can ask a judge to request to get the data but often these logs simply don’t exist.
Some data exist only in the specific instance of the user so cannot be reconstructed.
It can be technically possible to build certain data but it will be practically impossible due to the insanely complex system used by big service providers.
Examples of acquisition issues
Acquisition of a simple web page. What could possibly go wrong?
Dynamic content on page: How to capture? / How to reproduce in court?
Attribution: Whois data / DNS resolution (proving it from multiple points) / Connectivity and provider identification / Geolocation of hoster
In conclusion it is hard to guarantee integrity. The only way is to ask directly the provider to get data directly from databases but, in some cases, it’s simply impossible due to end-to-end encryption.
Analysis issues
As said before in the cloud context everything is virtualised, which means that it is beasically impossible to retrieve deleted data, or even fragments of it. In the very unlikely situation where you need to investigate the hypervisor software of a virtualized system, it will be almost impossible due to the lack of knowledge/tools. The only actor able to do it is the provider of the hypervisor itself but often this means going against their interest. It is important to note that disclosing that your hypervisor has been violated is not a smart business choice, which means that collaboration from hypervisor manifacturers is not to be expected.
Attribution issues
As seen previously attribution is hard already in cyberspace (e.g. IP spoofing, attribution to technical source eq attribution to agent, etc.), Cloud infrastructures add an additional layer of indirection to this, which means that it does not help at all.
Legal issues
Geographic location
Some judiciary acts require a physical location
Criminal investigation/prosecution based on physical locations
Applicable law depends on physical location
Electronic data is unique as it may actually span multiple physical locations! No other artifact has, or ever had, this property
Budapest convention support for the concept of Electronic Search and Seizure -> Removal of obstacles (i.e. legal forceful access to systems) cannot be ordered across countries
Contract and Service Level Agreement issues with Cloud Service Providers
Example of legal issues: some time ago dropbox used to buy space from AWS (S3). Who is the actual service provider? Are they dropbox or AWS responsibility? Which state of the USA is involved?
Dual criminality: to obtain help from another police jurisdiction the crime you are investigating must be a crime in both countries. For instance, many defamation crimes persecuted in Italy aren’t crimes in the USA.
Forensically enabled clouds
FEC: Cloud services providers that satisfies certain requirement for forensics applications.
Why should they care? There are laws for example in Europe which enforce those policies (e.g. iCloud in the USA). Some of the most famous Cloud actors nowadays have specialized helpdesk that handles only this type of relation with legal enforcement.
Requirements for a CSP to offer “forensic friendly” services
Make an effort to store (snapshots of) volatile VM data in their infrastructure
Make an effort to provide proof of past data possession
Data location (?)
Identity Management
Encryption and Key Management
Legal provision and SLAs
Last updated