>> Hey, everyone. Welcome back to the course.
In the last video, we talked about different types of
Cloud computing and different types of Cloud attacks.
In this video, we're going to go over
different types of Cloud crime.
We've got Cloud as a subject.
We want to know these for the exam.
We'll talk about each one.
Cloud as a subject.
>> Basically, the attacker tries to compromise
>> the security of the Cloud environment.
The goal here is to steal data,
inject malware, even delete data.
Cloud as an object.
This is where the attacker tries to commit
the crime against the Cloud service provider.
Things like DDoS attack.
They want to keep that Cloud service provider
>> from being able to [inaudible] just up and running.
>> Again, with our CIA triad going
back to the availability of the information.
Cloud as a tool.
>> The attacker uses a compromised Cloud account
>> to then attack other accounts.
For example, in a community Cloud environment,
they attack one organization.
They take over that session,
and then they try to attack the other accounts as well.
Different challenges in Cloud forensics.
Sometimes we can't get all the logs
or there's insufficient logs.
Large-scale data.
Think about the Cloud.
We're using a lot of data in there,
stored in these huge data centers.
We, as the forensic investigator,
may not be able to realistically
get all that information because it
could be terabytes and terabytes of data,
and we just can't handle that.
Also, some challenges.
>> The different IoT devices in place,
>> like mobile devices.
>> It could be also information from CCTV cameras
that are going into the Cloud and being stored.
Then legal aspects.
>> Think about the Cloud.
>> Think about Amazon, for example.
I know [inaudible] popular ones.
They're storing the data in other countries.
We've got to understand that there may be
jurisdictional issues that we know the data is there,
but we actually can't go get it
because they're a company that they're storing it in,
they don't have any type of law
in place that allows us to go get the information.
Or there's too many hurdles to go through.
Service level agreements.
Here, the main things
that an investigator wants to focus on
are the restrictions on the customer
>> by the Cloud service provider,
>> as well as different security measures of
the Cloud service providers
using for the customer account.
That's going to be valuable information for you to
understand what kind of information you can
get if you get a warrant or subpoena for
the suspect's stuff from the Cloud service provider,
what kind of information you might actually
>> get back from that.
>> SLAs also cover things like
availability of support, et cetera.
But the main things to remember from this are
security measures and the restrictions on the customer
by the Cloud service provider.
Let's talk about Dropbox.
You'll just want to memorize these different paths
here and you'll want to do that for
Google Drive as well that we'll
talk about in just a little bit.
In Dropbox, the file cache.dbx file
>> stores information on shared directories,
>> as well as file transfers.
You'll definitely want to memorize that for the exam.
You'll also want to know that's
Dropbox prefetch is stored
in Windows prefetch and then DROPBOX.EXE,
as well as some other
information that's going to be stored in
a username\Dropbox and then a
username\AppData\roaming\Dropbox.
Again, that very last one there,
you'll just want to memorize for the exam.
>> Then we have Google Drive.
>> Google Drive does add some registry keys here.
You'll just want to memorize these paths as well.
Software Microsoft Windows
>> Current Version Installer Folder.
>> Just memorize that last part of that.
The CurrentVersion\Installer\Folder.
Also, the other one on here you'll probably want
to memorize is going to be the one
>> that starts NTUSER.
>> Basically, it ends in
>> CurrentVersion\Run\GoogleDriveSync.
>> Again, just memorize that for the exam.
Some other paths for you as well.
You do have some studying here to just try to
memorize the different paths and really just
tuck them in your head
>> so that way you are familiar with them
>> if you see them on the exam and in any capacity.
>> The sync_config.db file.
You're going to find that in this path here but just
memorize that particular file name.
Then also the snapshot.db file is going to be
stored at that path as well.
The snapshot.db shows each file access.
Things as the name implies, snapshot,
shows that URL path created,
modified time and date,
the MD5 hash, et cetera.
Just memorize what that entails for the exam.
Then the sync_log.log file
contains the user's Cloud transactions.
That's another one you'll just want to
memorize for the exam.
Some post-assessment questions here.
The sync_log.log file in Google Drive
>> shows a listing of the user's Cloud transactions.
>> Is that true or false?
>> That one is true.
>> It definitely does that and
we talked about that just a moment ago.
Question number 2 here, this path right here.
The Software\Microsoft
\Windows\CurrentVersion\Installer\Folder.
That's a whole lot to say.
Is a registry key added by Google Drive.
Is that true or false?
That's true as well.
>> That's one of the registry keys we had seen.
>> Again, you'll just want to memorize
that CurrentVersion\Installer\Folder for your exam.
Then finally, our last question here,
the filecache.dbx file,
stores information on shared directories
and file transfers.
>> That's true or false?
>> That one was true as well.
>> Kind of an easy quiz there.
>> All of them were true.
>> In this video, we talked about
cloud crimes and we wrapped
up our discussion on the cloud.
The next module, we're going to
talk about malware forensics.