SECURING TOMORROW TODAY

Transcription

1 SECURING TOMORROW TODAY October 17 th -18 th, 2018 Atlanta, GA 2018 ISSA International Conference 1

2 Blockchain of evidence Reliable, non-repudiatable (Undeniable) digital evidence from source to testimony Presenter: Jeff Neithercutt 2018 ISSA International Conference 2

3 Who am I? I am Jeff Neithercutt Former Police Officer and Police 911 Dispatcher in the SF Bay Area for 11 years Master s Degree in Cyber Security and Information Assurance with a specialization in Ethical Hacking and Penetration Testing Published Author, An Introduction to Tactical Hacking for the Law Enforcement Professional, available on Amazon, (don t buy it, new version coming out) Senior Cyber Security Consultant at PCG currently assigned to a state agency writing new IT Security Policies 2018 ISSA International Conference 3

4 Wikipedia: A blockchain, originally block chain, is a growing list of records, called blocks, which are linked using cryptography. Each block contains a cryptographic hash of the previous block, a timestamp, and transaction data (GPS info, user name, permissions, whatever)..and what is blockchain? Main Chain Genesis block Blockchain formation. The main chain (black) consists of the longest series of blocks from the genesis block (green) to the current block. Orphan blocks (purple) exist outside of the main chain and are not yet accepted, unaccepted, or non-conforming ISSA International Conference 4

5 Main Chain Genesis block A block represents the present and contains information about its past and future. Each time a block is completed it becomes part of the past and gives way to a new block in the blockchain. The completed block is a permanent record of transactions in the past and the new transactions are recorded in the current one. k-bitcoin-block.asp#ixzz5tevpjyjv.and what s in a block? Each block comprises records of some or all recent hashed transactions, and a reference to the block that preceded it. /terms/b/block-bitcoinblock.asp#ixzz5tewn6n3l 2018 ISSA International Conference 5

6 And why should you care? Public Distrust of Police and the Courts is growing steadily: According to a report from the Innocence Project on the first 255 DNA exoneration cases in the U.S., of the 63 cases involving civil suits or appeals dealing with prosecutorial misconduct, 21 percent led to reversals, reflecting harmful error (probably an improper judgment by the court). These findings mirror a study by the Center of Public Integrity, which found that among 11,452 appeals alleging prosecutorial misconduct between 1970 and 2002, 2,012 (17.6 percent) resulted in reversals or remanded indictments ISSA International Conference 6

7 Public Distrust of Police and the Courts is growing steadily: The National Registry of Exonerations maintains a database of 1,200 exonerations and false convictions since These men and women spent a total of 11,600 years in prison, each for an average of a decade. Official misconduct was a contributing factor leading to wrongful convictions in 44 percent of these cases, second only to perjury or false accusations (53 percent). And official misconduct is most common in homicide cases (58 percent on the wrongful convictions) and nonviolent crimes (55 percent) ISSA International Conference 7

8 And why should you care? Public Distrust of Corporations and the Courts is growing steadily: Most corporate scams involve the trusted top executives sharing information they KNOW AT THE TIME is false Frequently they continue perpetrating this fraud because they created the evidence that proves it worthy of trust 2018 ISSA International Conference 8

9 What does the current chain of evidence look like? At each stage of the process, the opportunity exists for contamination Defense and Prosecution, or Plaintiff, both have a vested interest in the reliability of the evidence collected If the evidence can be alleged to be tainted, altered, damaged, or not what it is supposed to be, enough to create a reasonable doubt, the submitter has a serious problem 2018 ISSA International Conference 9

10 Why is this important? The Criminal Justice Process has become anything but trusted Defense and Prosecution or Plaintiff both have too many proven cases of tainted evidence freeing the guilty, or caging the innocent We are sending INNOCENT PEOPLE to jail for years..based on trust in other people alone? Trust that has been PROVEN to be improperly placed ISSA International Conference 10

11 The current system relies on people s testimony..which may be intentionally or unintentionally false At each stage of the process, the opportunity exists for contamination Officers may inadvertently or intentionally taint evidence by mishandling it Evidence room personnel may mislabel or taint or steal evidence Witnesses may misidentify a suspect in a line-up under stress Suspects may give a false identity when arrested and the true person gets charged 2018 ISSA International Conference 11

12 How bad is this problem now? At each stage of the process, the opportunity exists for contamination Officers may inadvertently or intentionally taint evidence by mishandling it Evidence room personnel may mislabel or taint or steal evidence Witnesses may misidentify a suspect in a line-up under stress Suspects may give a false identity when arrested and the true person gets charged 2018 ISSA International Conference 12

13 How bad is this problem now? Annie Dookhan (born 1977) is a former chemist of a Massachusetts c rime lab [1] who admitted to falsifying evidence, affecting up to 34,000 cases. [2] 2018 ISSA International Conference 13

14 How is blockchain structured? It depends.. Permissioned? Unpermissioned? Public? Private? ISSA International Conference 14

15 Each Block is mathematically tied to, and reliant on, the one before it, and after it.. Once recorded, the data in any given block cannot be altered retroactively without alteration of all subsequent blocks ISSA International Conference 15

16 If it is an anyonymous system like BitCoin, it is "an open, distributed ledger that can record transactions between two parties efficiently and in a verifiable and permanent way". Once recorded, the data in any given block cannot be altered retroactively without alteration of all subsequent blocks, which requires consensus of the network majority. Although blockchain records are not unalterable, blockchains may be considered secure by design ISSA International Conference 16

17 If it is a Permissioned system like a bank might use, "The startup determines who may act as transaction validator on their network, and it has included CGI, MIT and Microsoft as transaction validators, while also building its own nodes in different locations around the world.". But again, once recorded, the data in any given block cannot be altered retroactively without alteration of all subsequent blocks, which requires consensus of the network majority. Although blockchain records are not unalterable, blockchains may be considered secure by design ISSA International Conference 17

18 Permissioned Blockchain is a lot like DNA. In comparison, the DNA becomes the distributed ledger, and just like in a DNA chain, you can easily tell which parents belong to which children, and it s pretty darn hard to deny that someone is your child. It s a lot like DNA.If you could vote on who was actually in your family Direct Descendants First Member of Direct Line Basically, the Genesis block is your genetic origin, the beginning of your family line. If it s a permissioned blockchain, you actually know who you ve all come from, and each generation has to have assigned rights to join the family. Also, anyone claiming to belong to the family has to be agreed upon by 51% of the other permissioned members in order to join your DNA chain ISSA International Conference 18

19 Because the Chain of Evidence in both Criminal and Civil Trials are based on the premise that source and origin were legitimate, and that all parties to the transfer of custody between collection and presentation were truthful and trustworthy, it has begun to fall prey to untruthful and untrustworthy parties, whether intentional or accidental Imagine if you could 100% prove all evidence is what it claims to be immediately on collection?...but later.at trial? Main Chain Genesis Block If the person collecting the evidence were to immediately hash it with irrefutable location and source data, and any attempt to change it later could be immediately proven at any place in the chain of custody, could evidence ever be tainted, corrupted, or accidentally or intentionally modified after hashing? 2018 ISSA International Conference 19

20 1. Never perform your analysis on original evidence media 2. Copy to New media if possible, forensically sterile media otherwise 3. Copy must be IDENTICAL bit by bit copy with no extra, no missing bits Current rules of Digital Evidence Collection: 4. The evidence must not be CHANGED by the copying/access process if at all possible, any changes that are made inadvertently should be documented 5. Examination process must also prevent any changes to evidence media 6. The Chain of Custody must be carefully maintained to verify who accessed the evidence physically or logically, at what date/time, by what means, for what purpose, and on who s authority 2018 ISSA International Conference 20

21 Lettuce Begin. Is it even possible to track evidence 100% reliably from source to Courts? (And what does lettuce have to do with it?) 2018 ISSA International Conference 21

22 What can we learn from romaine lettuce about blockchain use in evidence systems? The first food poisoning cases came to light in late March eight patrons of fast-food restaurants in New Jersey suffered bloody diarrhea and cramps that sent them rushing to hospitals. More than two months later, one person is dead in California, 75 others have been hospitalized, and federal authorities still don't know where a nasty strain of E. coli bacteria latched onto romaine lettuce from Yuma, Ariz ISSA International Conference 22

23 Why didn t they just tell people not to eat the tainted lettuce? They were able to figure out eventually that the general area the tainted lettuce had come from was the Yuma, Arizona area, but how could you warn people? The press put out warnings to people not to eat lettuce from Yuma Arizona, but the lettuce hadn t been source labeled, so people assumed that the Stores where they bought it knew and would remove the dangerous lettuce..but they didn t know.in fact, they COULDN T know 2018 ISSA International Conference 23

24 Two months? People are dying here!!! In reality, most evidence tracking could take even longer!! Dozens of supply lines. 32 states.. A paper trail that often may actually be on paper, demonstrates the limits of tracing food by methods rooted in another century ISSA International Conference 24

25 One up..one back..tracking? No one knows more than one level of source No one knows more than one level of delivery Dozens of supply lines. 32 states.. A paper trail that often may actually be on paper, demonstrates the limits of tracing food by methods rooted in another century ISSA International Conference 25

26 Wal-mart fixed it! Wait..Wal-Mart? What does Wal- Mart know about blockchain? Actually, very little, but they were willing to listen to IBM, who had a blockchain system in place to solve the food contamination tracking problem..so did it? 2018 ISSA International Conference 26

27 What s Really tracked? Developed using the Hyperledger blockchain technology, the pilots were designed to accurately record the following: Farm origin data Batch number Factory and processing data Expiration dates Storage temperatures Shipping details 2018 ISSA International Conference 27

28 What s the difference? Two years ago, Wal-Mart Food Safety Experts told staff to trace a packet of sliced mango from a Walmart aisle the traditional way. "I looked at my clock and wrote down the time and date, and I timed them," he said. "It took them six days, 18 hours and 26 minutes." Under a week is considered fast by the current link-by-link method known as "one up, one back" tracking 2018 ISSA International Conference 28

29 Did Blockchain improve it? It took a month to build the blockchain network, which depends on cooperative partners agreeing on what information to contribute. By then, Wal-Mart felt confident enough to pull off the test live, at a stockholder meeting last summer. "It wasn't staged," he said. "We had a backup in case the technology failed." It worked they mapped the same mango supply line in 2.2 seconds ISSA International Conference 29

30 So how do we apply Blockchain to evidence tracking, and why should we? RFID Tags The transaction is synchronized among hundreds of computers and all nodes reflect the updated data as it occurs. Once a transaction is validated and added to a blockchain, the transaction or asset is theoretically immutable. A change in one copy or block of data on a system still leaves hundreds of other copies existing on hundreds of other computers. It would be virtually impossible to change the data on all of the decentralized systems. 1.Integrity: the evidence has not been altered or corrupted during the transferring. 2.Traceability: the evidence must be traced from the time of its collection until it is destroyed. 3.Authentication: all the entities interacting with a piece of evidence must provide an irrefutable sign as recognizable proof of their identity. 4.Verifiability: the whole process must be verifiable from every entity involved in the process. 5.Security: Changeovers of an evidence cannot be altered or corrupted ISSA International Conference 30

31 Permissioned blockchain for law enforcement Evidence Statements Either direct to blockchain, or digitized later and hashed to blockchain at that time, depending on technology used, but secured by hashing as soon as possible, then blockchained ASAP. Digitized 2018 ISSA International Conference 31

32 So how do we apply Blockchain to evidence tracking? When hashed, each individual item is completely unique. Adding meta data to each item allows for identification by GPS location, Date, Time, Unique Identification Number (Badge number), or any other item you want ISSA International Conference 32

33 Couldn t the collector just use someone else s user name and/or password? Each user in a Permissioned System Is assigned a user name, frequently forced to change their password, And is issued a physical key to connect to each device they will collect evidence with ISSA International Conference 33

34 So how do we apply Blockchain to evidence tracking, and why should we? 2018 ISSA International Conference 34

35 Why Even Use Electronic Blockchain? 2018 ISSA International Conference 35

36 Why Even Use Electronic Blockchain? Concatenated Hash This example is the most common and simple form of a Merkle tree known as a Binary Merkle Tree. As you can see, there is a top hash that is the hash of the entire tree, known as the root hash. Essentially, Merkle trees are a data structure that can take n number of hashes and represent it with a single hash ISSA International Conference 36

37 Publish the Merkle Proof in the Newspaper!! Merkle Proof This concept enables Merkle proofs, with which, someone can verify that the hashing of data is consistent all the way up the tree and in the correct position without having to actually look at the entire set of hashes. Instead, they can verify that a data chunk is consistent with the root hash by only checking a small subset of the hashes rather than the entire data set ISSA International Conference 37

38 Publish the Merkle Proof in the Newspaper!! The root hash can be used as the fingerprint for an entire data set, including an entire database or representing the entire state of a blockchain ISSA International Conference 38

39 2018 ISSA International Conference Thank You 2018 ISSA International Conference 39