TESTIMONIALS

SERVICES

COMPUTER FORENSIC EXAMINATION

 

FORENSIC INFORMATION TECHNOLOGY SERVICES (F.I.T.S.)

INTERNET (CYBER) FRAUD - PHISHING/THREATS/MALICIOUS ACTS

A recently published survey conducted by Security Vendor AVG has found that a study of 9000 internet users in Australia has shown that 39% of these participants had been the victims of cyber crime compared to 28% in America.

The internet is a wonderful tool for making friends, doing business, locating services and generally broadening your general knowledge. However, the internet is fast becoming the major source of funding for fraudsters and organized criminal gangs.

There seems to be a blind faith by many internet users that “if its on the internet it must be the truth”.  If it sounds too good to be true then it generally isn’t true. The truth and the internet are sometime far removed from one another. People/businesses who advertise or promote themselves or their services/products on the internet do not have to pass the scrutiny that other media forms insist upon. At this point in time, the internet is open to anyone who wants to use it and publish upon it and mostly with total anonymity.

Anyone can open an e-mail account without declaring their true identity. Anyone can cut and paste details of another or a product and take that  identity/product and cleverly convince others that its the truth. Today to drive a car, to travel overseas,  to open a bank account or to gain employment, the applicant must prove their identity. The most powerful vehicle in the  world today is the internet and anyone can use it and remain totally secretive about who they are or for that matter, where they are. No proof is required to establish an e-mail address.

Lyonswood Investigations has seen a rapid increase in the amount of inquiries it receives from victims of internet crime. Generally,  law enforcement agencies are not interested or just don’t have the resources to assist. Most of these victims have been cleverly and very deviously cheated and convinced that the person they are dealing with or the product/service they wish to buy is genuine. Not all victims are stupid or naïve, many are prominent members of the community and highly intelligent. Internet fraudsters are very organized and plan their scams to hide behind a complicated network of bogus identities.

Much of internet fraud goes unreported as the victims, when fully alerted to the consequences of what they have done feel embarrassed and just put it down to a bad experience. Lyonswood believes the percentage of victims is far greater than the statistics would indicate.

It is this increase in reported  internet crimes that prompted Lyonswood Investigations to surround itself with skilled technicians to assist in the detection of and the location of those responsible.  Our forensic technicians are constantly improving their skills and qualifications to keep abreast of developments in detection and deception. It is a never ending endeavour to keep pace. Much of our work is the determining of whether a person/entity is in fact who or what they purport to be. Many of our clients are on the cusp of either doing business or providing important details to another and smell a rat. Many are relieved when their intuitiveness is rewarded by what our investigations reveal.

COMPUTER HACKING FORENSIC INVESTIGATOR

CHFI Helps Track Cyber-Thieves!

There are very few certified computer hacking forensic investigators in the world. We are pleased to be the first qualified persons in Australia

EC-Council CHFI Certification is a course that teaches the skills, provides the knowledge, and gives a person the tools needed to catch cyber-thieves. By training someone to use the same pathways, backdoors, network weaknesses, and computer programs the hackers use, the penetration tester becomes the hacker’s enemy.
Hackers are not the only threat to companies. Looking closer to home can often times provide the identity of the troublemaker. Employees who believe they are being treated unfairly can cause a system shutdown, or commit industrial espionage. By using a certified hacker these employees can be identified and prosecuted.
Law enforcement agencies can use the services of a EC-Council CHFI Certification employee to trace website owners and servers used in criminal activity. With these traces a criminal who thought they were totally anonymous, becomes very findable.
Government agencies can also utilize these people, although the certification process is different for a Certified Network Defense Architect. Of course the certification would have to be requested by a government agency selected for qualification.
Prevention is often the key to protecting the vital files in most computers. Banks, Insurance Companies, and Law Firms all have confidential information that if attacked could hurt untold numbers of customers. By performing internal computer audits any threat can be neutralized before it becomes active. All hackers leave a trail when they first enter a system, certified employees can detect these traces and close down the pathways.
Often employees hurt a company by deleting, destroying, or encrypting files. A certified employee can recover these files and trace the employee who committed the crime.
E-Mail fraud is also a growing concern for many people. Once these crimes have been committed it is often hard to prosecute because of the vast resources available to the criminal. Make those same resources available to your company to track and prosecute them, allow a CHFI Certified employee to be on staff ready to track them down.
Theft of company documents has been in the news lately, and the criminals were all traced and prosecuted because a legal hacker was there to trace them. Do not allow your company to be vulnerable, when a weapon is at hand to protect your vital information. Network security should never be overlooked.

SECURING DIGITAL EVIDENCE PRIOR TO FORENSIC ANALYSIS

One of the most common problems Lyonswood’s Forensic Investigators come across when assisting clients with the acquisition of Forensic Digital Data is that often the data that is suspected of containing vital evidence has not been secured quickly enough nor in a fashion that will assist the forensic process. The longer this data is over written or allowed to remain vulnerable to removal or tampering, the more costly the forensic recovery and the less likely it can be discovered or be successful in evidence.

Below are some key tasks that victims of digital crime ought to employ as soon as they become aware that they may in fact be victims:

Computers/Mobile Phones/ other recording devices/ back- up tapes/ discs/ USB memory sticks

The easiest way to secure these devices is to immediately turn them off and in the case of USB memory sticks/ back-up tapes, disks and external hard drives , remove them. Once removed/turned off, label the device externally with the date and time of securing and a serial number of that device or some other identifier like a part or model number. Then sign the label and where possible have a witnesses sign and confirm the details on that label and place that device in a secured (key/lock) location, preferably away from the workplace. If there is more than one device being secured, number them in sequence.

In the early stages of a Forensic investigation this is the most vital process to assist in ensuring that the integrity of the evidence and the evidentiary stream is protected and when / if it is called upon in courts of law it has the best chance of being accepted and the least chance of being successfully challenged.

Most common types of Internet fraud/deception

PHISHING
Definition:
Is the act of tricking someone into giving them confidential information or tricking them into doing something that they normally wouldn’t do or …internet fraud that aims to steal valuable information such as credit cards, social security numbers, user IDs and passwords.

This type of internet fraud is the most commonly reported to Lyonswood.

Case example:

Recently a young woman came to Lyonswood with her father. The young woman was about to divulge her bank account details to  a male she had become involved with on a chat line and her father became suspicious. She was convinced that he was a Russian businessman living in London who was seeking a relationship with  a view to marriage. She had spoken to him on his mobile phone.  To demonstrate his genuineness and to give her confidence in his honesty he sent her his U.K. drivers license and a copy of his Russian Passport. He told her that he would send her $10,000.00 so that she could travel to the U.K. and meet him. He asked her for her passport and drivers license so that he could be certain who she said she was and to give him confidence that when he deposited the money into her account it was going to a real person and not a fraudster. He told her that if she sent her Bank details he would make a direct deposit. He also sent her his address and his business address. Of course both of these addresses were genuine residential and business addresses.

This young lady took a great deal of convincing as she didn’t wish to look stupid and we suspect didn’t want her heart broken. Initially we requested our colleagues in U.K. to send us details of the occupants of these addresses and they did not match up with the names she had been provided. In fact the resident of the house was a Bishop in the Anglican Church. Still not convinced and making excuses for these discrepancies we requested a copy of a U.K. drivers license. The license provided did not match the one she had been given and now she questioned as to whether different counties had different licenses. There was only one format for this type of drivers license throughout the U.K.

There were many other discrepancies in the documents he provided her, the passport photo was placed over the passport stamp and thus it was clear that the photo had been cut and pasted over an existing passport photo, probably one this fraudster had phished from another victim. This type of fraudster gathers and trades identities with other phishing fraudsters on line.

Fortunately our client had not provided her passport or drivers license however she has provided her name and address details. The objective of the fraudster was to gain access to her bank account and clean it out. This fraudster was very patient and had groomed out client over many months. No doubt this person had groomed many others over that same period and we suspect many of those would not have been as lucky as our client.

COMPUTER FRAUD

There are many was for fraudsters to take from you your hard earned cash, clear out your bank accounts and even defraud you your other assets such as motor vehicles and boats. The way this is generally done is through convincing yet fraudulent documentation. You should never e-mail documents that prove your identity such as drivers licenses and passports. Once a clever fraudster has these, they virtually have your identity and can cut and paste photos of themselves or other persons over the existing photos or even use them and pretend they are you to defraud others.

One would hope by now that any e-mails you receive that offer large sums of money just for assisting someone to deposit some alleged fortune that has somehow come their way, are now well and truly ignored and deleted. These are generally referred to as Nigerian Scams and mostly originate out of Africa however there is a recent shift of this type of fraud to Mexico and South America.

Letters that allege they are from a bank, just because you may happen to have deposits with this bank, should also be disregarded. Lets face it, with only 4 major banks in this country, they have a 25% chance of getting lucky when they send an unsolicited e-mail. Banks rarely send e-mails of this type, particularly ones that  ask you to verify your account numbers and passwords.

The fact that someone has details about you doesn’t necessarily mean they obtained those details from you. Clever fraudsters search discarded rubbish from bins at night and steal you mail from your letter box to gain this information and if they obtain a copy of a bank statement then they most likely have your account numbers and balance. All they need then is your password.  It is not uncommon for these fraudsters to scan in your stolen bank statements and send them to you via a fabricated bank e-mail complete with logos that they have cut and pasted form the internet. The really smart ones even provide a telephone number for you to call to verify that the e-mail is genuine. The phone will answer and a voice will cleverly convince you that you have in fact called your bank. Always check the number and see that it corresponds with those of your bank. If it doesn’t then its likely to be a fraud.

THREATS, DEFAMATION/ SLANDER & Malicious ACTS

Today, with great ease, anyone can open an e-mail account or set up a website with total anonymity. The most powerful vehicle in the world today is not a V12 sports car, it’s the internet and you don’t have to prove who you are to get on board and drive it. Devious, nasty and greedy people use it every day to take revenge and manifest themselves in peoples lives in a threatening, slanderous and Malicious manner.

Lyonswood Investigations and Forensic Group receives inquiries every week relating to unknown e-mail senders making threats. There are ways to discover the identity of the person making the threats.

DATA  RECOVERY/MINING

Work stations/notebooks/blackberries/ mobile phones/ i-pods / memory sticks/CF cards

Lost data, data suspected of being copied and transported elsewhere (Stolen data), data that might breach laws, codes of ethics or workplace and privacy guidelines is often sought as a vital piece of evidence required to identify the sender, the person receiving the data or the thief. Today, the act of industrial espionage is mostly carried out via the internet and it’s big business.

Disloyal employees are regularly selling information to your opposition or feathering their own nest by transporting your intellectual property before they jump ship to your competitor.

Lyonswood Investigations and Forensic Group has a good track record of recovering the evidence even though the persons responsible have attempted to cover their tracks. This is where Lyonswood Investigations and Forensic Groups Forensic I.T. specialists have the edge on these fraudsters through skilled professionals with the latest techniques backed up by state of the art software programs. We have many satisfied clients that we have assisted to get their businesses and lives back on track.

Sometimes the issues are simple and others far more complex. Maybe you have lost those very important baby, family or holiday photos through a malfunctioning micro drive or CF card. Lyonswood Investigations and Forensic Group can probably help you retrieve them.

ADOLESCENT DUE DILIGENCE/ AT RISK CHILDREN

Today, children are teethed on computers. Children are using computers before they start schooling and thus become very proficient at using them, quite often even more proficient than their parents. This is where vigilance is required and quite often not able to be provided because the parents are nowhere as savvy as their children.

When most parents were children computers were either at their infancy or not even existent. Very devious and clever criminals including those who might want to hurt your child or sexually abuse that child trawl the internet pretending to be comparative age group piers and deceive these young people into all sorts of  very dangerous behavior including but not limited to, disclosing their address, school, times when their parents wont be at home or away on leave and even sending photos of themselves  and even naked.

If you have reason to suspect your child might be exposed to one of these practices  or perhaps require software to minimize exposure to these risks, Lyonswood can assist you to have peace of mind.

IDENTIFYING A FRAUDSTER OR ORIGINS OF A THREAT VIA AN EMAIL ADDRESS

Lyonswoods technicians are trained in the latest techniques and the use of state of the art software developed to discover the threads of evidence and imprints that these fraudsters leave behind. One of the tools we use is the software product EnCase.
EnCase Forensic software is the current industry standard in computer forensic investigation technology.

With an intuitive GUI, superior analytics, enhanced email/Internet support and a powerful scripting engine, EnCase provides investigators with a single tool, capable of conducting large-scale and complex investigations from beginning to end. Law enforcement officers, government/corporate investigators and consultants around the world benefit from the power of EnCase Forensic in a way that far exceeds any other forensic solution.

• Acquire data in a forensically sound manner using software with an unparalleled record in courts worldwide.
• Investigate and analyze multiple platforms — Windows, Linux, AIX, OS X, Solaris and more — using a single tool. 
• Save days, if not weeks, of analysis time by automating complex and routine tasks with prebuilt EnScript® modules, such as Initialized Case and Event Log analysis. 
• Find information despite efforts to hide, cloak or delete. 
• Easily manage large volumes of computer evidence, viewing all relevant files, including "deleted" files, file slack and unallocated space. 
• Transfer evidence files directly to law enforcement or legal representatives as necessary. 
• Review options allow non-investigators, such as attorneys, to review evidence with ease. 
• Reporting options enable quick report preparation.
  

---

Actual Cases

Case 1:
Your forensic document examiner was brilliant. We can now obtain what is rightfully ours, our inheritance. People can be so devious when it comes to matters of money. All along we believed that Dad's signature was a forgery. The evidence that you were able to obtain with respect to Dad's state of mind around the time he allegedly signed the will was also vital. (Names withheld).

Case 2:
The letters that this woman was sending almost destroyed our marriage. The efforts on the part of your investigators are to be commended. The matching up of documentation that you managed to obtain from her proved beyond doubt who it was. I know you won't tell me, but I still can't imagine how you obtained these records. I guess that's a trade secret. I can't thank you enough. (Male name withheld).

Case 3:
I had no idea that DNA could be obtained from a document. Your advice that people up to no good generally sweat rang true. Although there were no finger prints on the documents that were good enough to present to the court, the DNA removed from the paper proved that it was my brother who had falsified my father’s signature.

Case 4:
Thank for from us both. We can now rest easy now that this woman’s accusations have been disproved. People can be so devious when it comes to money: All these years my husband has paid out child support believing that the boy was his. The DNA you gathered from the tissue he used to blow his nose contains the truth. Who could have known it would be this easy, I feel sorry for the boy as I suspect she knows who the father is but I doubt she will ever tell him.