Lawful Interception Packet Forensics Analysis System Casper Kan

Lawful Interception & Packet Forensics Analysis System Casper Kan Chang Decision Group June 2010

IP Packet Capture Way There are 3 types of IP packet capture ways based on application and industry standard ： ● ● Packet captured from IP network： for IP network infrastructure in enterprises, ISP, IDC and LTE/Wi. MAX operators IP packet from Telco switch ： 1. Tradition switch through Mediation Platform 2. For IMS and all IP networks, IP Packet can be captured through service broker of application layer or directly from IP core switch of Media and End Point layer of IMS system 3. From Cable TV

IP Packet Capture Way– Sniffer All data packets on Ethernet are broadcasted in the network, i. e. , all physical signals will flow to the network Interface card of the appliance. NIC card can be under promiscuous mode, so it can receive all data no matter what the MAC address it is. This is what the basic of Sniffer all about. Enterprise, ISP, IDC, LTE/Wi. MAX E-Detective

Lawful Interception Can get that evidence? For example : Email Sender email address, Receive email address Time and date Content Location …… More 4

Sample: Email (POP 3, SMTP and IMAP)

Sample: IM -Yahoo, MSN, ICQ, IRC, QQ, GTalk etc…

What Lawful Interception Needs Now…. . Network Packet Capture and Reconstruction Vo. IP Ethernet Off-line HTTPS/ SSL Wireless 802. 11 a/b/g/n Training & Support

E-Detective – Mirror Mode Implementation Organization or Corporate Network Deployment

Wireless-Detective – Implementation Diagram (1) Wireless-Detective Standalone System - Captures WLAN packets transmitted over the air ranging up to 100 meters or more (by using enhanced system with High Gain Antenna) WLAN Lawful Interception – Standalone Architecture Wireless-Detective Deployment (Capture a single channel, a single AP or a single STA)

Wireless-Detective – WPA-PSK Cracking Solution WPA Handshake packets need to be captured for cracking WPA key. Utilize Single Server or Distributed Servers (multiple smart password list attack simultaneously) to crack WPA key. Acceleration technology: GPU Acceleration Note: WPA handshakes packet can be captured by Standalone Wireless-Detective system or Distributed Wireless. Detective systems.

EDDC Offline Forensics Product Offline Raw Data (PCAP) Decoding and Reconstruction system. Comes with User and Case Management features. Collect, Import Raw Data Investigator 1 For Case 1 Results Collect, Case 2 Import Investigator 2 Raw Data Case 2 Results For Case 2 Decode and Reconstruct various Internet Protocols and

HTTPS/SSL MITM Interception System Intercept and reconstruct HTTPS/SSL traffic. Obtain HTTPS page login username and password. Intercept on specific targets (suspects)

HTTPS/SSL MITM Interception System Intercept and reconstruct HTTPS/SSL traffic. Obtain HTTPS page login username and password. Intercept on specific targets (suspects)

Software Architecture 14

More Then 140 Internet Protocols Supported Email Webmail IM/Chat (Yahoo, MSN, ICQ, QQ, IRC, Google Talk Etc. ) Others Online Games Telnet etc. HTTP (Link, Content, Reconstruct, Upload Download) File Transfer FTP, P 2 P VOIP

Data Captured through Tradition Telco Switch From LI port of Soft Switch/TDM to capture signals by ETSI/CALEA standard. Passing through mediation platform and convert the data for further analysis through Handover Interface (HI) before reaching EDDC for further packet analysis INI gateway Server MEDIATION -1 P INI rov ANALYSIS -2 I isio RI ning HI-1 Provisioning SBC TDM HI-2 IRI INI-3 Call Content HI-3 Content EDDC Control Information Router/IAD RTP Stream Edge Router Telco side Control Information Edge Router LEA side Router/IAD Target USER

Data Packet Captured through Telco IP Switch Directly capture IP data packets from both application or media layers of IMS/all IP networks. So it is not necessary to pass through mediation platform. It’s predicted that this will be the future trend for all Telco operators ANALYSIS (application layer) (session layer) Router/IAD E-Detective SGIM IP packet/SIP IP Packet/SIP EDDC IMS LEA side E-Detective (media layer) CMS Core Switch Router/IAD Target USER Edge Router Telco side Edge Router USER

Data Packet Captured through Cable TV Mediation Tel phone User loop Internet NIU 50~1000 MHz CMTS …… E-Detective Analog fiber optic 5~42 MHz NIU STB TV CM fiber optic node NIU Computer Cable TV Broadcasting 18

Technology Transfer Program • To Help ETRI to Enhance Capability of LI Application Research • Target – E-Detective – Wireless-Detective • Scope – Source Codes – On-Site Training – On-Site Assistance for Software Development • Reasonable Fee 19

Contact Information Casper Chang Kan/ CEO chang_kan@decision. com. tw Ted Chao/ Product Manager ted@decision. com. tw Address： 4/F No. 31, Alley 4, Lane 36, Sec. 5, Ming-Shan East Road Taipei, Taiwan, R. O. C. Phone No ： +886 2 2766 5753 Fax No ： +886 2 2766 5702 URL ： www. edecision 4 u. com