Chapter 7. Proxies, Firewalls, and Routers

	"Every link in the chain has its own role to play."
	--Samir Datt

Just as every link in a chain has its own role to play, every component in the network has a role to play and evidence to contribute to our investigation. In this chapter, we will exclusively focus on understanding web proxies, firewalls, and routers; reasons to investigate them; and how this would help in taking the investigation forward.

In this chapter, we will cover the following topics:

• Getting proxies to confess

• Making firewalls talk

• Tales routers tell

Getting proxies to confess

Proxies are a very important component of any network. A proxy acts as an intermediary between other computers of the network and the Internet. In simple terms, this means that all the traffic entering or leaving the network should pass through the proxy server. Looking back at our previous chapter, we recall that logs can be a forensic investigator's best friend. Proxy servers can generate such logs that we can use for our investigations.

Roles proxies play

Proxy servers are usually deployed with a number of end objectives in mind. They can be used for the following:

• Sharing a network connection on a local area network: Here, multiple users can share a single Internet connection.

• Speeding up web access: This shared Internet connection that is accessed via a proxy allows the proxy to cache regularly demanded pages such as Google. This enables the server to immediately deliver a page that is in the cache, speeding up the web access.

• Reducing band width usage: This...

Making firewalls talk

Simply the name, firewall, conjures up an image of a great wall of fire burning anything that is unauthorized and trying to pass through.

Just as the name suggests, in the digital world, a firewall prevents an unauthorized access to or from a network. A firewall is usually at the perimeter of a private network and the open Internet, it acts as a barrier and allows traffic through based on a set of pre-defined rules:

The preceding image clearly demonstrates the functioning of a firewall. As we can see, the network traffic can either pass through or be rejected by the firewall when found to be contrary to a pre-defined rule. The key factor of interest for us is the fact that every interaction with the firewall leaves a trace. This is reflected in the form of an entry in the firewall logs. Network forensic investigations require us to understand the firewalls and events that produce the entries in the log files. As the Digital 007s, it's our job to "make the firewalls talk...

Tales routers tell

On the 15^th of September, 2015, the information security world was shaken by the news that a hack called SYNful knock modified the firmware of some CISCO routers. This allowed the attackers to maintain a persistent presence in the router, thereby exposing the network traffic and enabling the router to act as a listening post for the attacker.

Routers have long been the cornerstone of the Internet. The role of the router has been to connect the networks to the Internet and choose the best path so that the information arrives quickly. In fact, the global trend is that the national network infrastructures are dependent on the routers to handle the network traffic. Therefore, it stands to reason that if routers carry the world's traffic, they would also be privy to all the associated traffic logs:

Seeing the kind of role that routers play, routers are often the target of attacks, especially Denial-of-service (DoS) or disabling the router type of attacks. Router compromise is...

Summary

This chapter, though a bit long, has exposed us to three very important components of any network. As network forensic investigators, you learned about the underlying technologies and sources of evidence obtainable from proxies, firewalls, and routers. You also learned the roles they play in the big scheme of things and understood how and where the evidence resides.

We took a look at the Squid proxy server and different log formats that are prevalent for each of these components. We developed an understanding of the different fields in the log file and what each of these fields represent. We also gained an insight into the key role the routers play, the persistent and volatile memory that they have, the logs, as well as the importance of gathering information from both these memories and logs from a network forensic's perspective.

We made interesting progress and as we move on, we will study how data is smuggled through VPN tunnels in the next chapter. We will also see the different...