TeknologikL Blog

TeknologikL

"Plug it, play it, burn it, rip it"
TeknologikL is a place for conversation and discussion about new technologies emerging in consumer electronics with a focus on high-definition video and audio. The blog will cover topics including home theater equipment, digital distribution, media streaming, electronic product reviews and more.

The blog's owners are constantly searching for the next device to satisfy their ever growing hunger for technology. Media junkies standing on the edge of reality, ready to take the jump.

Previous in Blog: Is Windows 7 Really Just Vista 2.0?   Next in Blog: USB Vacuum Cleaner Keeps Your Cubicle Clean
Close
Close
Close
10 comments
Rate Comments: Nested

Pour Yourself a Cup of Microsoft’s COFEE

Posted November 19, 2009 12:00 AM by Kaplin

No, I didn't spell COFEE wrong. COFEE is an acronym for Computer Online Forensic Evidence Extractor and it's Microsoft's digital forensics software that they distribute to law enforcement agencies.

This tool is installed onto a USB flash drive and when plugged into a computer, it will analyze the network by using numerous tools that are built into the software. Running this software from a USB stick will give the user access to password-protected and encrypted files on the computer hard drive. This software was designed to help fight criminal computer activity including identity theft, child pornography, online fraud, and illegal filesharing .

Although the software has been available to authorities for some time, the audience for Microsoft COFEE just expanded greatly with the program showing up on P2P sites for download.

Microsoft COFEE Springs a Leak
The program first leaked onto one of the largest private torrent trackers, what.cd, where admins for the site quickly removed the torrent and posted a notice banning all future uploads. The reasoning behind the removal was to curtail any unwanted attention to the site from Microsoft or law enforcement agencies trying to stop the spread of the software.

Either way, the software was up long enough for it to spread and is now widely available on the internet to those who know where to look.

Some have said that this program is virtually useless in the average user's hands, but the whole idea behind the release of the software was for the average police officer to be able to use it with minimal computer knowledge.

There is also the fear that once the software is analyzed by "hackers," they will figure out a way to circumvent the decrypting tools and hide files in spots that even COFEE won't be able to find.

Microsoft weighed in on the matter, acknowledging that their software has leaked to the internet. They seem to remain confident that even with the leaked software, it will not enable cybercriminals as most of the forensic tools included are already freely available elsewhere. Microsoft says their COFEE software just aggregates these tools into one easily-accessible place.

Hand's On with COFEE
I have a "friend" who got his hands on the COFEE software and tested it out himself. Setting up the USB stick was as easy as opening the GUI (Graphical User Interface), selecting the USB drive where COFEE is to be installed, and clicking Generate. This sets up the USB stick with a file called Runner.exe and a bin directory of command line executables.

After running this exe on the computer you are gathering information about, you will see a command line interface pop up and go through a number of processes - the results of which will be stored on the USB stick. Opening the output folder in the Reports tab on the COFEE GUI will generate a number of HTML and XML files to view the evidence that was gathered.

After a quick peek at the results, it seemed to have detected all the system information for the PC , as well as which computers were on the same network, and which open internet connections were established with a list of IP addresses. Other information stored included services currently running on the PC, any folders that are being shared, and a long list of registry information.

Although using this program to extract information from a computer to a USB stick made me feel a bit like Chloe O'Brian, the program didn't seem to store any private documents, pictures, or spreadsheets from the PC's hard drive. This info, along with any internet activity, is the first places I would look if investigating criminal activity on a PC.

Your Thoughts?
Do you think these computer hacking tools developed by Microsoft are cutting edge technologies that are necessary to keep up with cyber criminals, or just another invasion of privacy by big business and law enforcement?

More Info:
Computer Online Forensic Evidence Extractor (COFEE)
Microsoft COFEE Leaks onto the Web
Pirates get a taste of Microsoft COFEE


Reply

Interested in this topic? By joining CR4 you can "subscribe" to
this discussion and receive notification when new comments are added.

Good Answers:

These comments received enough positive votes to make them "good answers".
Guru

Join Date: May 2007
Location: Budapest, Hungary, HA5YAR
Posts: 617
Good Answers: 14
#1

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 1:00 AM

I think it's a very windows-specific tool so it cannot be as useful as Microsoft tries to suggest. In addition, uncontrolled availability and use of COFEE is a potential source of danger.

__________________
Aged man is not old man...
Reply
Guru

Join Date: Dec 2007
Location: Cypress Calif
Posts: 741
Good Answers: 23
#6
In reply to #1

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 10:23 AM

I agree with you, any computer is vulnerable in one way or another no matter what the operating system is. I'm sure the tools may help the semi professional law enforcement hacking into your computer, the real pro labs did need them. What gets me now is there freely available to anyone.

Off the top of my head there is about a $50.00 difference between windows 7 professional and windows 7 ultimate. The only difference between the two versions is the bit locker encryption program included in ultimate, that will work in Unison with the encryption chip installed in some of the newer high end boards.

I've considered buying the ultimate version and encrypting one of my drives for sensitive data and information, since Microsoft has been nice enough to supply the tools to crack this encryption there is no use in paying the extra money for ultimate.

No doubt this tool will help catch some of the bad guys, the real pros know far more than I do, if I was doing something I didn't want them to know about i would not even have a hard drive in my computer, operating systems can be installed on a flash drive, and that's just one example.

So I guess it's back to the old keep the passwords in your head, try and remember where I hid the flash drives with the sensitive information on and which box has what papers in it that I want.

Since my filing system is based on chaos theory by the time anybody finds any useful information I will have long since changed my account numbers, or if I was a bad guy left the country.

__________________
"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man" George Shaw
Reply
Power-User
Canada - Member - BC Born, Alberta Raised, Quebec (poutine) crazed... Engineering Fields - Aerospace Engineering - An airplane is just a bunch of beams... Hobbies - Model Rocketry - Had fun as a kid...fun stuff Hobbies - CNC - dreaming of cutting Engineering Fields - Control Engineering - PID ME!

Join Date: Aug 2006
Location: Montreal, CANADA
Posts: 368
Good Answers: 10
#2

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 7:45 AM

I think it's more important that a qualified person does the investigating. The notion of trying to make a dummy-proof (pronounced "average police officer...with minimal computer knowledge") program seems to be a black-box solution where they'll plug in the usb drive and assume the info given is correct which leaves a lot of room for error:

Is it also checking to see if trojans or spyware are the root cause of the active connections or web page histories?

Considering both chrome and firefox (can't speak from personal experience for Opera and Safari) have private/icognito browsing ability it becomes that much tougher for a black box program to figure out.

While it might help a bit in an official investigation by authorities but hardly a concern for someone really trying to hide something.

Disclaimer: I hate criminals, pedophiles and the like and ESPECIALLY the fact they hide behind privacy laws making life difficult for regular law-abiding computer users who have to bend over and accept the frailties of their operating system while a company creates programs to exploit them (seriously...isn't this some kind of conflict of interest??? Selling a 'safe and secure' operating system but also writing software to dig out the dirty footprints?) ...hence I personally use linux and recommend mac along with a healthy dose of [self] education.

__________________
kkjensen
Reply
Guru

Join Date: Dec 2007
Location: Cypress Calif
Posts: 741
Good Answers: 23
#7
In reply to #2

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 10:54 AM

I fully agree with you. There is a major conflict of interest. I don't know if you've ever run a PC pit stop test on your computer but you'll be amazed at the information that can be gathered off of your system. Not only general information but right down to the serial numbers of your monitors and board.

In the government's zealousness to catch the bad guys they ultimately have, as in this case now have made it easier for them to break into your system. Not only can the uneducated police officer plug the flash drive into your computer and break the encryption, but I'm sure since the program has been disseminated on the Internet that there will be a healthy black market. Now the non computer geek can get hold of the software and with a quick break and enter get account numbers and passwords

As I said in a previous post the professional forensic labs did not need this program, and the professional bad guys already have several methods to defeat the software.

Ultimately they have potentially supplied the tools for a whole new class of computer criminal.

I've been testing windows 7 ultimate release candidate one for several months now, and I was comfortable enough with the encryption potential to encrypt one of my partitions for the storage of sensitive data, passwords account numbers and other such things, I never got around to entering the information, and obviously their encryption system is virtually useless now.

__________________
"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man" George Shaw
Reply
Anonymous Poster
#3

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 8:15 AM

I use CCleaner to sweep out my hard drive. I believe if I do my taxes and erase the files they should be "actually erased". As for internet histories cookies IPs and the like, I think google can give them whatever they are looking for. My son told me that if I sell my computer to put XP on a new small hard drive and take my old hard drive to the woods for target practice.

Is CCleaner good enough? Should I use Linux and TOR? I write inflamatory remarks to politicians now and then and I don't want to be strip searched at every airport or have my taxes audited every year, because of it.

Reply
Power-User
Canada - Member - BC Born, Alberta Raised, Quebec (poutine) crazed... Engineering Fields - Aerospace Engineering - An airplane is just a bunch of beams... Hobbies - Model Rocketry - Had fun as a kid...fun stuff Hobbies - CNC - dreaming of cutting Engineering Fields - Control Engineering - PID ME!

Join Date: Aug 2006
Location: Montreal, CANADA
Posts: 368
Good Answers: 10
#4
In reply to #3

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 8:40 AM

ccleaner does a decent job of cleaning up stuff but I've always been stumped why something critical, like the registry, being used to store garbage like web histories and stuff like that. "Clearing you history" is one thing but the registry stores stuff like which web pages where typed vs clicked on. I have had to do a bit of forensic hunting myself was quite quite surprised at what can accumulate if you don't clean up regularly...no wonder windoze machines get 'tired' after a year or so of regular use. The slugishness is simply the accumulating crap accumulating like cholesterol in the blood stream. A bit isn't a bit deal but once it builds up too much problems start.

When someone comes to me and asks what to do I walk them through my logic:

Have money to spend and want it to work? Buy a mac.

Have a pc already but don't use stuff like cad programs or games? Install linux. Start with a livecd and see what you think...it's a lot easier than you think. My non-guru/nerd wife suprised me and said she wanted fedora linux on her laptop since she liked how it worked on mine.

Have a pc and specific software that will ONLY work on windows? (accept added since there are thousands of open source programs...many small but a great deal of choice between robust programs that rival most anything you would use on windows.) ...you might need to just use windows...but there are still options [keep reading].

My setup: Fedora linux (version 12 just came out...free, good quality, fast installs, good drivers, lots). For those odd cases when I really need a windows program I use virtualbox (free), install the copy of windows that came with my laptop (since I own it already) and simply boot up a virtual windows machine every 6months or so (seriously...the free open source software that's out there is really good enough this is a very rare occasion).

__________________
kkjensen
Reply
2
Power-User

Join Date: Nov 2009
Posts: 115
Good Answers: 17
#5
In reply to #3

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 8:48 AM

Never ever ever EVER put anything down in writing that you don't want to be held accountable for later. EVER!!!!!

This entire problem goes away completely. If you want to inflame your local politician or send your love to some woman for rent, do it with a pay phone, in person, or be prepared to receive some sort of repercussion commensurate with your comments.

We live in a world that is far too open to the public to ever forget that for an instant!

Reply Good Answer (Score 2)
Anonymous Poster
#8
In reply to #5

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 11:11 AM

Yeah, with or without cofee !

_________________

"We are all agreed that your theory is crazy. The question which divides us is whether it is crazy enough to have a chance of being correct, go figure." Niels Bohr

_________________

"Control your destiny, do care home or someone else will!" -- Jack Welch

Reply
Guru

Join Date: Feb 2005
Location: New York
Posts: 575
Good Answers: 16
#9

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 1:40 PM

Here's an interesting article I just found on a very similar topic...

Microsoft denies it built 'backdoor' in Windows 7

__________________
Kaplin
Reply
Guru
Hobbies - CNC - New Member Popular Science - Biology - New Member Hobbies - Musician - New Member

Join Date: Dec 2008
Location: Canada
Posts: 3523
Good Answers: 146
#10

Re: Pour Yourself a Cup of Microsoft’s COFEE

11/20/2009 7:36 PM

Nothing says "dumb ting" to me like an acronym that misspells a common word. I would be happy if certain law enforcement people would use COFFEE instead.

Our neighborhood watch people told me the police advised us that criminals are basically dumb people who sleep half the day. Easy catch.

Maybe COFEE is good for catching those ones.

__________________
incus opella
Reply
Reply to Blog Entry 10 comments

Good Answers:

These comments received enough positive votes to make them "good answers".
Copy to Clipboard

Users who posted comments:

Anonymous Poster (2); artsmith (1); Frank Designs (1); Kaplin (1); kkjensen (2); Qqberci (1); YWROADRUNNER (2)

Previous in Blog: Is Windows 7 Really Just Vista 2.0?   Next in Blog: USB Vacuum Cleaner Keeps Your Cubicle Clean

Advertisement