Investigation of a Cybercrime:
A Case Study

Hacking and Hijacking in Redmond

Principal Programmer Quits

The First Indication of a Problem

"Network Solutions Registration Services"

Other Attempts to Hijack Domain

Disaster Strikes on August 2

Continuing Problems

Call The Cops!

THIRD PARTY RECORDS

Call The Prosecutor!

"Network Solutions Registration Services"

Following Slides Courtesy Of:

How an Email
Travels the Internet

The Journey of an Email

"Email addresses identify:"

"The information on the left..."

"The Internet numbers also identify..."

"An abbreviated record of an..."

Email Tracing

Abbreviated Headers

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Email Tracing

Finding the Senderís Email Address

Email Tracing

Email Tracing

"Step 2:"

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

Find the Originating IP Address

"The unbroken chain-of-custody is:"

"To identify the origins of..."

"Remember!"

"In this example,"

Slide 54

"Network Solutions Registration Services"

Slide 56

IP Address Tracing

IP Address Tracing

IP Address Tracing

IP Address Tracing

IP Address Tracing

"In this example,"

Call The Prosecutor!

Out of State Records

Out of State Records

Out of State Providers -
A New Proposal

Call The Prosecutor!

"Network Solutions Registration Services"

JPS Log Files

Search Warrant

Search Warrant

Search Warrant

E-Mail Spoofing

E-Mail Spoofing

"Network Solutions Registration Services"

E-Mail Spoofing

E-Mail Spoofing -
A More Sophisticated Method

"Return-Path:"

SpoofMail 1.17

SpoofMail 1.17

SpoofMail 1.17

"Return-Path:"

E-Mail Spoofing -
Other Sophisticated Methods

"How Did We Establish Probable..."

Results of the Search

Relationship Between Log Files

What was Available to Examine?

What was Available to Examine?

Slide 89

What was Available to Examine?

Slide 91

What was Available to Examine?

Rillingís History Files Started Mid-August, 1999

Slide 94

Slide 95

Slide 96

Interesting Usage Just after Police Interview

Slide 98

What was Uncertain

Problems with the case

Problems with the case (cont)

Additional Computer Analysis

Additional Computer Analysis

Additional Computer Analysis - Troyís Analysis

Sysevent.log

The Charging Decision

The Charging Decision (cont.)

The Plea Offer

Defense Counter Offer

Other Issue - Restriction on Defendantís Internet Access

The Result

Sentencing

Post Sentencing

Justice (sometimes) Triumphs in the End

Contact Information