- [Instructor] Software code may be used
as evidence in an investigation,
and software forensic techniques may be used
to analyze that software in an effort
to render an expert opinion.
There are two major uses of software forensics
in today's cybersecurity environment.
First, software forensics are often used to help resolve
intellectual property disputes between parties.
This is a very common occurrence in civil disputes,
and software forensic specialists are often used in court
to testify about the origins of software code.
For example, suppose a key software developer
leaves a company and accepts a position at a competitor.
The competitor may then later release a new product version
that includes features very similar
to the first company's product.
The first company may accuse the competitor
of using the newly-hired software developer
to steal code.
The competitor may respond that they independently developed
the new feature without any help from the new hire
or access to the competitor's software code.
Software forensics experts may analyze the code
for the two products and draw conclusions
about whether one company
used the other company's source code to add functionality.
The second major use of software forensic techniques
is to identify the origins of malware.
Software forensics experts may analyze malicious code
found on a system and compare it
to other known malware objects
to determine whether they were written by the same author.
For example, the Department of Homeland Security
and the Federal Bureau of Investigation
released this joint report in December 2016,
accusing Russian Intelligence Services
of engaging in hacking activity
against targets in the United States.
In the report, they included snippets of code
that they claim represent the signatures
of this Russian activity, which they called GRIZZLY STEPPE.
You can see those snippets of code right here.
The idea is that if cybersecurity analysts
find these signatures in code on their systems,
they may be able to attribute the code
to that Russian source.
However, now that the signature information is public,
it would be easy for an attacker
to simply include the signature in their own attack
in an attempt to frame the Russian government
for an attack they had nothing to do with.
For this reason, you must take publicly available
signature information with a grain of salt
when seeking to use it for attack attribution.
Conducting software forensic analysis is tricky work
and requires both advanced software engineering knowledge
and investigative skills.
Information security professionals
should not attempt to do this work on their own,
but rather, should consult trained experts if required.