No, I didn't spell COFEE wrong. COFEE is an acronym for
Computer Online Forensic Evidence Extractor and it's Microsoft's digital
forensics software that they distribute to law enforcement agencies.
This tool is installed onto a USB flash drive and when
plugged into a computer, it will analyze the network by using numerous tools
that are built into the software. Running this software from a USB stick will
give the user access to password-protected and encrypted files on the computer
hard drive. This software was designed to help fight criminal computer activity
including identity theft, child pornography, online fraud, and illegal
filesharing .
Although the software has been available to authorities for
some time, the audience for Microsoft COFEE just expanded greatly with the
program showing up on P2P sites for download.
Microsoft COFEE Springs
a Leak
The program first leaked onto one of the largest private torrent trackers, what.cd,
where admins for the site quickly removed the torrent and posted a notice
banning all future uploads. The reasoning behind the removal was to curtail any
unwanted attention to the site from Microsoft or law enforcement agencies
trying to stop the spread of the software.
Either way, the software was up long enough for it to spread
and is now widely available on the internet to those who know where to look.
Some have said that this program is virtually useless in the
average user's hands, but the whole idea behind the release of the software was
for the average police officer to be able to use it with minimal computer
knowledge.
There is also the fear that once the software is analyzed by
"hackers," they will figure out a way to circumvent the decrypting tools and
hide files in spots that even COFEE won't be able to find.
Microsoft weighed in on the matter, acknowledging that their
software has leaked to the internet. They seem to remain confident that even
with the leaked software, it will not enable cybercriminals as most of the forensic tools included are already freely
available elsewhere. Microsoft says their COFEE software just aggregates these
tools into one easily-accessible place.
Hand's On with COFEE
I have a "friend" who got his hands on the COFEE software and tested it out
himself. Setting up the USB stick was as easy as opening the GUI (Graphical User Interface),
selecting the USB drive where COFEE is to be installed, and clicking Generate. This
sets up the USB stick with a file called Runner.exe and a bin directory of
command line executables.
After running this exe on the computer you are gathering
information about, you will see a command line interface pop up and go through
a number of processes - the results of which will be stored on the USB stick.
Opening the output folder in the Reports tab on the COFEE GUI will generate a
number of HTML and XML files to view the evidence that was gathered.
After a quick peek at the results, it seemed to have
detected all the system information for the PC , as well as which computers were
on the same network, and which open internet connections were established with
a list of IP addresses. Other information stored included services currently
running on the PC, any folders that are being shared, and a long list of
registry information.
Although using this program to extract information from a
computer to a USB stick made me feel a bit like Chloe O'Brian, the
program didn't seem to store any private documents, pictures, or spreadsheets
from the PC's hard drive. This info, along with any internet activity, is the
first places I would look if investigating criminal activity on a PC.
Your Thoughts?
Do you think these computer hacking tools developed by Microsoft are
cutting edge technologies that are necessary to keep up with cyber criminals,
or just another invasion of privacy by big business and law enforcement?
More Info:
Computer Online Forensic Evidence Extractor (COFEE)
Microsoft COFEE Leaks onto the Web
Pirates get a taste of Microsoft COFEE
|
Good Answers: