_____

data forensics collected resources

Table of Contents

overview/description

Expanding a clear concern with electromagnetic [EM] phenomena as a question of substance, data forensics extends the spectrum of artistic concerns to embrace data space. Under the mastheads of signal and noise, data, or digital, forensics proposes a further examination of contemporary presence, a materiality and architecture seemingly at odds with a digital realm which humbles its carrier, submitting the aether to status of a lowly medium; that which is modulated.

Data forensics in this instance refers to the artistic and practical analysis of [un]intentional signals, raising questions of both this intention and a modelling of the world.

Data forensics extends a series of practical and theoretical investigations concerned with electromagnetic [EM] phenomena into the world of data space. Spanning signal and noise, digits and decay, data forensics explores the often unintuitive reality that digital data has its own electromagnetic (physical) presence, a physicality that can be read and perhaps even modulated through the carrier medium itself.

Data forensics presents a look-glass exchange between two domains. The digital informs and reveals the physical and vice versa; equally, there is an exchange of practices. For example, we can borrow techniques from real-world forensics, gumshoe-style to examine and attempt to make sense of leaked data emissions, or to expose and elaborate a notion of data sedimentation; examining an archaeology of everyday digital usage. At the same time, technological practices inform traditional forensics, as alternative architectures, ancient constructions and intensities, are revealed by novel, EM-inspired techniques.

Sub-topics under the broad heading of data forensics could include:

making sense of landscape from a forensics perspective, reverse engineering, mapping protocols of hiding onto the real, photo and audio reconnaissance, data sedimentation, data visualisation, TEMPEST, cryptography, mapping of event intensity using GPS, signals, noise and strategies for interpretation of the intentionality of transmissions

notes

conceptual

  • reception as a case of detection and amplification [of a weak signal]
  • reception as a revealing

OSI model - a division

spectrum analysis"physical"
–——————————
protocol analysisabstraction

marking this division is the physicality of the antenna and RSSI. a direction into architecture. antenna|protocol

[in an outside world]

what/where is abstraction in the world except as language and construction in the world

question of if this layered OSI model could (or would have already) enter(ed) the world.

physical layer - identifiable only as such

physical layer is a red herring as OSI model "in the world" bites its own tail. simulation theory

practical

Data forensics practice - detection and collection

detection [primarily of] EM and light

with wireless card detection is already obscured [at OS level - frames and so on - EXPAND]

what is 802.11 encoding/modulation:

one aspect is spread spectrum:

Frequency-hopping spread spectrum (FHSS) is a method of transmitting radio signals by rapidly switching a carrier among many frequency channels, using a pseudorandom sequence known to both transmitter and receiver.

modulation in this case is: Gaussian Frequency-Shift Keying (GFSK) is a type of Frequency Shift Keying modulation that utilizes a Gaussian filter to smooth positive/negative frequency deviations, which represent a binary 1 or 0. It is used by DECT, Bluetooth1, Cypress WirelessUSB, Nordic Semiconductor and z-wave devices. For Bluetooth the minimum deviation is 115 kHz.

http://en.wikipedia.org/wiki/GFSK

See also:

http://en.wikipedia.org/wiki/OFDM

and:

http://en.wikipedia.org/wiki/Complementary_code_keying

workshop

Data forensics [in the landscape].

A practical workshop with Martin Howse and Julian Oliver.

Thursday 6th November - Saturday 8th November 2008

Atelier Nord, Wergelandsveien 17, Oslo

Participation is free of charge Application deadline Thursday 23rd October Send applications with brief statement of interest to data@anart.no Further information: http://anart.no/projects/dataforensics

//

Any time a machine is used to process classified information electrically, the various switches, contacts. relays, and other components in that machine may emit radio frequency or acoustic energy.

… This problem of compromising radiation we have given the covername TEMPEST.

[TEMPEST: A Signal Problem. NSA 1972]

With an emphasis on the construction of hardware and software apparatus, the Data Forensics workshop will apply practical tools, techniques and theory to analyse [un]intentional data emissions within the city of Oslo.

The workshop extends a succession of practical and theoretical investigations concerned with electromagnetic [EM] phenomena into the world of data space. Spanning signal and noise, digits and decay, Data Forensics explores the often unintuitive reality that digital data has its own electromagnetic (physical) presence, a physicality that can be read and perhaps even modulated through the carrier medium itself.

Data Forensics presents a window between the domain of the digital and the physical; the digital both informs and reveals the physical and vice versa. It is through this relationship that we can find a fortuitous exchange of practices. We can - for example - borrow techniques from real-world forensics to examine and attempt to make sense of leaked data emissions. Alternatively, we can expose and elaborate upon the notion of data sedimentation; taking an archaeological approach to examining everyday digital activity.

Topics for active research and discussion within an artistic context include but are not limited to:

making sense of landscape from a forensics perspective, photo and audio reconnaissance, data sedimentation, data visualisation, TEMPEST, cryptography, mapping of event intensity using GPS, signals, noise and strategies for interpretation of the intentionality of transmissions

Participants do not need to have practical or theoretical experience within these multiple fields; a keen interest in this novel artistic terrain is essential.

schedule

  • Day One:

    Introduction all participants

    Introduction to theory and techniques of data forensics: experiments, demonstrations, software, hardware - an overview.

    Data collection expedition in Oslo city centre

  • Day Two:

    Discussion of previous day's research

    Discussion of artist works within the field of data forensics

    Assessment of relevant techniques by each participant

    Commence personal projects in Oslo interior/exterior

  • Day Three.

    Discussion of personal projects

    Further collective experiments and suggestions for future work and direction

    Sketches for artistic work

resources

Operating System

For workshops a LiveCD solution.

Arudius 0.5 (LiveCD): http://www.fosstools.org/

Taxonomy

To imagine some kind of taxonomy - exploratory tools, (active/passive)probes, reconstruction, interpretative, visualisation, decryption and encryption, a beginning to making sense.

That this taxonomy could also follow and to some extent critique (or allow for a philosophical examination of) the OSI model of networking:

Physical layer - hardware. detection and collection/logging

  • scrying platform: http://scrying.org
  • TEMPEST (see below) covers both EM and audio emissions

eg. acoustic cryptanalysis: http://people.csail.mit.edu/tromer/acoustic/

  • Blinkenlights (Silence on the Wire. ch5. p.65+)
  • use of wireless routers as leaked city data collection devices
  • cantenna (waveguide antennas), antenna construction, antennas as a bridge between domains [EXPAND]

http://www.turnpoint.net/wireless/cantennahowto.html

http://flakey.info/antenna/waveguide/ [with calculator for waveguide distances and so on]

[use of tetrapaks was also successfully tested in Berlin]

http://www.reseaucitoyen.be/wiki/index.php/BoiteDeLait

http://www.reseaucitoyen.be/wiki/index.php/Home_made - good resource

http://www.saunalahti.fi/~elepal/antenna2.html - also with link to calculator

Transport layer - signal tools

x*oscope is a digital oscilloscope that uses a sound card (via /dev/dsp or EsounD) and/or Radio Shack ProbeScope (Cat. No. 220-0310) a.k.a osziFOX as the signal input.

  • wavemon, baudline, further spectrum analysis [http://www.wireless.org.au/%7ejhecker/specan/]

Further layers - protocol examination, encryption and decryption/steganography. [again active and passive]

  • making sense also. sense of context or reverse engineering of a protocol wrapper. sense is/in the encoding scheme itself
  • netstat, netcat (nc), ntop, nmap, ngrep, tcpdump, snort, hping2,

dsniff

http://wordpress.calgarymesh.ca/2006/08/09/using-iwspy-to-monitor-signal-strengths-in-ad-hoc-networks/

http://users.skynet.be/chricat/signal/signal-strength.html

network protocol analyser (formerly known as ethereal)

Wireshark is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark's native capture file format is libpcap format, which is also the format used by tcpdump and various other tools.

Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, …), etc.

Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic.

Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Packet capture and dissection library

And above this: visualisation and making sense of data sets, toolkits, frameworks and languages

local and remote examination of execution, memory snooping, modification, paring.

  • visualisation and examination: baudline also (raw), octave, gnuplot,

python visualisation (scipy, others).

TEMPEST:

TEMPEST as a revealing

Any time a machine is used to process classified information electrically, the various switches, contacts. relays, and other components in that machine may emit radio frequency or acoustic energy.

… This problem of compromising radiation we have given the covername TEMPEST.

[TEMPEST: A Signal Problem. NSA 1972]

See also: http://1010.co.uk/org/tempest_presn.html

steganography

Bibliography: http://data-hiding.com/

Bibliography for text-based steganography: http://semantilog.ucam.org/biblingsteg/

StegFS (filesystem): http://www.mcdonald.org.uk/StegFS/

[ wbStego: http://wbstego.wbailer.com/ ]

Stegtunnel (covert channel in the IPID and sequence number fields of any desired TCP connection): http://www.synacklabs.net/projects/stegtunnel/

Stepic (Python image steganography): http://domnit.org/2007/02/stepic

Forensic tools: http://unixsadm.blogspot.com/2007/10/digital-forensic-tools-imaging.html

Text-based steganography: http://www.siefkes.net/software/nlstego/ and http://lcamtuf.coredump.cx/soft/snowdrop.tgz

Text-based2: http://www.fasterlight.com/hugg/projects/stegparty.html

and:

http://www.nicetext.com/

and:

http://www.fourmilab.ch/stego/

Steghide (images) : http://steghide.sourceforge.net/

Hydan (within executables): http://crazyboy.com/hydan/

references

general

Footnotes:

1 FOOTNOTE DEFINITION NOT FOUND: 1

Author: m <m@1010.co.uk>

Date: 2009-12-31 15:37:24 GMT

HTML generated by org-mode 6.31trans in emacs 23