Cyber Crime and Cyber Terrorism

Secure Digest Functions (MD4, MD5, etc.) Collision Generation:
Someone 
can alter a file and then use Anti-Forensic software to make this file having 
the same MD4 or MD5 value like before the alteration, thus bypass a forensic 
integrity check.
• 
Digital Memory Anti-Forensics:
There are programs that are able to hide 
processes or other evidence from memory.
• 
Misleading Evidence:
Someone can leave evidence in such a way to mislead 
the forensic investigation.
• 
Packers/Binders:
Someone can use such a program in order to transform a file 
by changing its structure, thus it can bypass security mechanisms that searches 
for malicious behavior patterns inside files.
• 
Forensic Tools Vulnerabilities/Exploits:
There are already implementations 
available to show that some of the computer current Forensic Tools can be 
bypassed or exploited.
• 
Resource Waste:
To purposefully leave traces in a big network in order to make 
the forensic investigator waste valuable resources and time.
• 
Forensic Detection:
Someone can install a mechanism to be triggered after any 
computer forensic-related presence.
• 
Anonymous Actions:
It includes every action that can be done by a fake or 
unknown identity. The result from the investigator is to fail to trace back the 
malicious activities.
• 
Anti-Forensics In Flushable Devices:
Someone can take advantage of devices 
that can be flashed (like PCI cards or BIOS) and install malicious code inside 
them, thus they can remain unnoticed.
From a forensic scope, anonymity can be considered as a major anti-forensic approach. 
For example, below are top Free Anonymous Web Proxy Servers (
Mitchell, 2013
):
• Proxify: this web proxy support encryption via Secure socket Layer (SSL), 
HTTPS network protocols and hides IP address and cookies filtering cookies.
• Anonymouse: has been around for many years and supports Web, email and 
Usenet (news) proxies.
• Anonymizer: is the most known name in the anonymous web proxy services.
• Ninja Cloak: from their homepage you can insert the URL of the site to be 
visited. This web-based proxy uses CGI.
Today WiFi networks are used widely; therefore, it would make it very easy for 
malicious network users to hide their true identities by stepping randomly on these 
wireless networks in order to conduct their attacks.
While in theory the forensics investigator should monitor everything available 
around the suspect, in reality the post incident response could end up quite dramati-
cally. This could be due to: ignorance regarding the network activity logs, legal barri-
ers between the access point and the forensics acquisition, noncooperative ISPs, etc.

---