CSI* – Computer Forensics Files: Real Cases #9 The Case of the Teacher and the Teen Trickster
The stories are true; the names and places have been changed to protect the potentially guilty.
It was a grey October day, the kind of day when a guy likes to cozy up next to a bank of servers to keep warm, when the Teacher first called me. “They think I’m nuts!” were the words emanating from the phone. Well, just because you’re paranoid doesn’t mean they’re not out to get you. I sat up and went to my desk, away from the noisy fans cooling off all those Gigahertzes. “What’s the problem, Miss?”
The young woman explained that she was a not-yet-tenured teacher in a New England (greyer there than here) high school with a problem. Seems that a student in one of her classes was repeating things in the classroom that she had uttered only the night before in the apparently illusory privacy of her own living room. This was happening on a repeated basis and this little freak was freaking her out. She made sure her windows were shut at night. She had someone else speak inside her house while she listened outside – no words escaped to be heard, much less repeated. She looked around for bugs…found only a few spiders. She hired a P.I. to sweep for listening devices – none were found. She went to the police, who were uninterested without some evidence. Her supervisor at the school would not take it seriously. The principal at the school thought she was nuts. She felt that she was in danger of being fired and losing out on a career she’d savored. She was at her wit’s end and sounded it.
She began to suspect her computer was the means of access to invading her privacy, but had no idea how. She already had identified the subject individual and did an admirable amount of research on the subject of computer invasion. She sent me reams of chat logs, articles about cyberinvasions, firewall logs, and other suspicious-looking goings-on with her computer.
I put on my data galoshes and began to wade through the deluge to see what looked like a threat and what did not, and to see if I could find the means of remote access, if any.
Norton Antivirus had picked out some. One was “lsass.shutdown” – the Sasser Worm. A bad character indeed. By contrast, “lsass.exe” is a part of Windows XP itself. Sasser came in looking like something harmless, but in the wider Web, it shut down computers – sometimes before they even finished booting. Airline flights had to be cancelled. Satellite communications were blocked. Insurance companies and banks had to close down for a short while. The Sasser Worm was a bad actor, but it wasn’t giving remote control access and after all, her antivirus program had used its own kind of handcuffs to subdue that particular intruder.
What is DLL Files?
DLL is the abbreviation of Dynamic Link Library. DLL files are an essential part of the Windows operating system. “A Dynamic Link Library (DLL) is a file of code containing functions that can be called from other executable code (either an application or another DLL). Programmers use DLLs to provide code that they can reuse and to parcel out distinct jobs. Unlike an executable (EXE) file, a DLL cannot be directly run. DLLs must be called from other code that is already executing.”
A professional online search website, such as Google, has a giant, updated database that includes the latest people search lookups, cell phone numbers, landline numbers, fax numbers and unlisted numbers. It will also include the latest information about someone’s background. There are free people sites that claim to offer search details. However, these databases are not as updated as the professional sites. They also will not include cell phone number information because cell phone numbers are private numbers.
And…pay dirt! Sitting in the registry entries from old compressed system restore snapshot files were references to 30 instances of the setup files for one nasty Backdoor Trojan and for one desktop surveillance spyware program. They came complete with dates of installation and IP addresses of the point of origin. Quite a find.
It seems our freaky teen perp was a script kiddie. He’d apparently gone to a site that gives away prepackaged hacking and exploit programs to all-comers. Rather than give the teacher an apple, he’d apparently sent her an email with an evil payload. Once in place it was child’s work – er, kiddie’s work – to control her computer at will. At this point, it was no big deal to turn on our heroine’s microphone, record her talking in her living room, download the file to his own computer, then repeat the content back to the Teacher the next day. Who wouldn’t be set off-balance by that?
Finally we had enough evidence to let the police complete the job. I sent the report to the DA, who ran with the case. Being a minor, the terrible teen got off with a warning, some unwanted attention, and a transfer to a different classroom.
For the future, I first recommended completely reformatting or replacing her hard disk and securing her Windows Administrator account with a password. Amazing but true, most people don’t know there is an Administrator account on their computer, and leave it wide open and unsecured. Booting into Safe Mode (hold down the F8 key at boot up, select “Safe Mode”), then accessing the user accounts through the Control Panel allows the user to easily set passwords. I suggested getting a new AOL account (if she had to have AOL), and getting a relatively inexpensive hardware firewall. At the time, I suggested the Netgear FVS318.
The happy ending: our worthy Teacher kept her job, validated her complaints, eventually finished her Master’s degree and got to be something of a security expert in her own right. By the time we finished with all the back and forth, it was nearly Spring. As for me, I moved out of the server room and back to my place in the Sun. Okay, it’s a desk; it’s by a window; it’s where I do my forensic thing you can be Published without charge. You can to republish this article in your website or blog. Please provide links Active.
