Computer Crime Investigator’s Toolkit: Part III

Enterprise Networking Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Perl Scripting

Perl is a programming language adept at processing lists and strings. If you want to search log files and output the information, Perl is a very useful tool. Some computer writers have characterized the language as the duct tape of computing. The New Hacker’s Dictionary describes it as the "Swiss-Army Chainsaw." Its compactness, flexibility, and relative ease of use make it attractive to hackers of all persuasions.

While one doesn’t have to be a master programmer to be a computer crime sleuth, being able to read code helps generate insight. If you find a Perl script useful for checking the aging of passwords, for example, understanding how the program works goes a long way toward implementing the tool properly. And, you learn during the process how to develop your own tools. Some investigators may prefer C or C++ as a starting point. That preference has some merit since quite a few computer security tools are available written in those languages. But the most important skill is to learn a code and then build on that knowledge. More common ground exists between languages than you might realize.

The commonalities include:

  1. Comments. These lines of code document what is happening in the program. The compiler does not act on these lines, but they may be the most important lines of code. They serve as a record of why and how the program works. Perl tells the compiler that a line is a comment by beginning it with the pound sign, "#." (# This is an example of a comment line in Perl.) Learning to read comments tells a computer sleuth what’s going on in a program.

  2. Conditionals. Acting as decision points in the program, they usually take the form of the IF, THEN, ELSE statement. In Perl the statement takes the form of:

<p>if ($a = = 21) { print "Happy Birthday Scully!n" }</p>
<p>else { print "Mulder’s been abducted!n" }</p>
<p>Notice the THEN is implied through using the braces (known as the
The "= =" simply means "equal to." The "n"
tells the compiler to start a new
line after the string expression.</p>

  1. Variables. "$a" is a variable. It is a place to store a value in memory. Perl identifies variables by beginning them with "$." $Rons_Paycheck_Amount is a variable in Perl. Perl declares or assigns variables by a simple statement, $Rons_Paycheck_Amount = 1000.00. You’ll note the difference between the logical equal sign used for assigning "=" and the mathematical equal sign "= =."

  2. Loops. When the need arises for the computer to do something repetitive, loops do the trick. A loop consists of a counter value, which tells a loop where to start counting from; a conditional statement, which tells the loop what conditions to terminate under; and an increment, which tells the loop at what rate to count down or up. A possible Perl loop would be:

4<p>$Counter = 19;</p>
<p># This statement assigns the counter element a starting value of 19.
most # Perl statements end with the semicolon ";" unless
terminated by a
block. </p>
<p>while ($Counter > 0 ) {</p>
<p> print "Still processing" ;</p>
<p> $Counter – = 1 ;</p>
<p>} # The "while" statement gives the terminating condition, when
$Counter equals
# zero. </p>
<p># The phrase "- = 1" is the declining increment reducing the
$Counter variable
<p># one each cycle of the loop.</p>
<p>print "n Counter reduced to zero.n" ;</p>
<p># When the loop terminates, the last "print" statement

Other commonalities include functions, which are subroutines, arrays and other data structures, and variations on conditionals and loops. But this very basic introduction gives you some starting points to commence reading Perl code. If you want to see some Perl security scripts for Unix/Linux, go to

Networking Basics

Perhaps, with the exception of cryptography, no other area of computer security is as arcane as networking. Myriad acronyms dominate networking discussions. Problems often emerge at several levels of abstraction. Security holes are often subtle, missing the attention of even experienced analysts. Yet, every computer crime professional must have some grasp of networking, even though networking may not be the main focus of their work. Any computer crime may spill over into a network.

A good test of one’s network security knowledge is to read Stephen Northcutt’s article, "Intelligence Gathering Techniques" at He covers topics such as host mapping, ICMP echo requests, UDP echo requests, Broadcast ICMP, detection of scans, netmask-based broadcasts, port scans, scanning for a particular port, complex scripts, random port scans, FTP bounce, NetBios traces, stealth attacks, SYN/ACK, and inverse mapping.

If the article is a real head spin for you, it is time to do some networking study, which is nothing to be ashamed of. Many a network engineer and architect has reams of books to refer to on their desks; they are in them all the time just to do their daily jobs. Realizing what you don’t know is a healthy approach in this business. (If you want to see some Network security tools such as TAMU, COPS, and SATAN, ftp to and look at /packages/security.)

Possible attacks include:

  • Web Spoofing. An attacker’s server becomes the de facto ISP to the user’s browser. A user thinks he or she is reaching, say, when actually the user is receiving content from the hacker. An insidious attack when you consider the user may be supplying confidential data to the spoofed site.

  • Denial of Service. A common attack facing most public or commercial Websites. The trick lies in the attacker overloading the site’s routers or servers with bogus packets, usually SYNs.

  • Sniffers. An attacker builds intelligence against your site by monitoring your traffic and picking off passwords and user data.

  • DNS Spoofing. The hacker compromises the DNS server and changes the IP address database, redirecting user URL calls to sites of the hacker’s choice.

  • Mobile Code Attacks. Using Java applets or ActiveX controls, the attacker plants Trojan horses into your local machine. This malicious code can be embedded into HTML pages, making it especially vicious. And, external Web pages aren’t the only concern. Any computer crime investigator looking at HTML pages on a local machine should examine any links using the source code viewer first. Links can contain booby traps that can plant viruses or Trojan horses on the investigator’s disks or that can delete files on the machine’s hard drive. Always assume any local machine contains booby traps.

  • IP Spoofing. An attacker fakes the IP address of a machine the server recognizes or trusts in order to gain entry. An interesting book describing IP attacks and the general process of investigating network and Internet attacks is Takedown by Tsutomu Shimomura with John Markoff, Hyperion, 1996.

Tracing Email

When you want to know from which machine an email originated, specialized search engines on the Web can help. The one available for the Americas is Most people who send and receive email never see the detailed header information for a piece of electronic mail. Yet, many email services like MS Outlook allow you to see the full header when you select it under viewer options. The key phrase to pay attention to is "Received: from."

A sample email header (with alterations for security reasons) is below:

<p>Received: from
( []) by with SMTP
Exchange Internet Mail Service Version 5.5.2650.21)</p>
<p> id XBMVVB8A; Fri, 1 Dec 2000 05:04:58 -0600</p>
<p>Received: from mail pickup service by with Microsoft
<p> Fri, 1 Dec 2000 03:06:19 -0800</p>
<p>Received: from x.x.x.x by with http:
Fri, 01 Dec 2000 11:06:19 GMT</p>
<p>X-Originating-IP: [x.x.x.x]</p>
<p>From: "Anyone" <></p>
<p>Subject: Test</p>
<p>Date: Fri, 01 Dec 2000 05:06:19 -0600</p>
<p>Mime-Version: 1.0</p>
<p>Content-Type: text/plain; format=flowed</p>
<p>Message-ID: <></p>
<p>X-OriginalArrivalTime: 01 Dec 2000 11:06:19.0949 (UTC)
<p>The first "Received: from" phrase indicates that the last
server to transmit
the email was with IP address That server
the email from the fictionalized MS Exchange<span> server at
using Simple Mail Transfer Protocol (SMTP).</p>
<p><i>What a search on ARIN produced for IP address</i></p>
MS Hotmail (<a
1290 Oakmead Pkwy Ste 218<br>
Sunnyvale, CA 94086<br>
Netname: HOTMAIL<br>
Netblock: <a
target=”_blank”></a> – <a
Myers, Michael (<a
Domain System inverse mapping provided by:<br>
Record last updated on 11-Feb-2000.<br>
Database last updated on 30-Nov-2000 19:05:05 EDT.<br>

The next "Received: from" tells you what server at received the email from The next two lines tell you the IP address of the machine at machine sent the email to, or generated the email at, before it was transmitted to In this case that machine’s address has been fictionalized to x.x.x.x. But the real IP address could be run on ARIN for identification. The same goes for the domain name. The "From" line gives the sender’s email address at

Tracing emails will continue to play an ever-increasing role in computer crime investigation. To see how it played a role in a recent Texas homicide case, read "Murder via the Internet" at


Print Sources:

Casey, Eoghan, Digital Evidence and Computer Crime, Academic Press, 2000.

Hayden, Matt, Networking in 24 Hours, Sams, 1998.

Hoffman, Paul E., Perl 5 for Dummies, IDG Books, 1997.

Mendell, Ronald L., Security Management, June 1999, "Is the Internet Just a Web of Misinformation?"

Raymond, Eric S., The New Hacker’s Dictionary 3rd Edition, MIT Press, 1996.

Sharrar, Kristopher A. and Granado, Jose, Security Management, March 1997, "Confessions of a Hard Drive."

Shimomura, Tsutomu with John Markoff, Takedown, Hyperion, 1996.

Syngress Editors, Hack Proofing Your Network: Internet Tradecraft, Syngress, 2000.

Tiwana, Amrit, Web Security, Digital Press, 1999.



Security scripts

Intrusion Detection

Intrusion Detection Pages


Attacks on IP Networks

Network Intelligence

Whois Service
Internic and IP Address Searches:

Links to several registries

American Registry for Internet Numbers (ARIN)


Tracing Email

SecurityPortal is the world’s foremost on-line resource and services provider for companies and individuals concerned about protecting their information systems and networks.
The Focal Point for Security on the Net ™

Get the Free Newsletter!

Subscribe to Daily Tech Insider for top news, trends, and analysis.

Latest Articles

Follow Us On Social Media

Explore More