/* HRSVEA, B6402-13, Jesper Blomström, 2013-09-04
   HEARING WITH SECURITY SERVICE'S AUTHOR OF "INVESTIGATION OF REMOTE CONTROL
   POSSIBILITIES 2012-0201-BG25023-26" FROM THE LOGICA/NORDEA TRIAL AGAINST
   ANAKATA. TRANSCRIPTED AND TRANSLATED BY QNRQ.SE (@QNRQ)
   NO COPYRIGHT, ONLY LOVE.

   SECURITY SERVICE'S FORENSIC'S REPORT (ENGLISH): http://minfil.org/wj8s2CNoSUxIyFmVlPHc6VNYLtMw4a71/sfa7deb9b3/investigation_of_remote_control_possibilities_2012-0201-BG25023-26.pdf
  AUDIO RECORDING (SWEDISH): http://minfil.org/Qdc2dab7ba/HRSVEA__B6402-13__Jesper_Blomstr_m__Inspelning_1__15689677.mp2

   DURING TRIAL JESPER ADMITS THAT ANAKATA'S COMPUTER COULD HAVE BEEN REMOTELY
   CONTROLLED VIA THE FOLLOWING PYTHON CODE:

      import socket, subprocess

      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM))
      # Bind to port 9999 (example) on any network device
      s.bind(("", 9999))
      s.listen(1)
      # Accept connections from clients
      conn, addr = s.accept()

      # Loop forever
      while 1:
         # Read command sent from client
         data = conn.recv(1024)
         # Close link if no command is received
         if not data: break
         print("[+] Connection established")
         # Execute received command
         output = subprocess.check_output(data.decode().rstrip())
         # Send output of executed command back to the client
         conn.send("OUTPUT\n------\n".encode())
         conn.send(output)

      conn.close()
*/


JUDGE: This is a hearing with Jesper Blomström and the prosecutor begins.
HENRIK: Thank you very much. Just a short... Yes, you know that we have had this hearing now in the Appeal Court with this Jacob Applebaum and you were present at the police hearing with him also.
JESPER: Mm...
HENRIK: And he questions, well we can say quite a lot, about the conclusions and writings that is in this PM that you stand as author of that is on page 411 until page 417 in the investigation material. A PM that is dated 14th March 2013. I can say that during the end of this long hearing there are two writings, if I understand Jacob Applebaum, perhaps that wasn't very easy, then he means that there are direct errors or at least inconsistency connected to this. The first thing that I would like to ask you about, but perhaps before I enter these general points, you also know that there has been a general questioning that has been discussed in the Appeal Court process, we have also talked about it continously. I will very easily ask the first question: do you still stand for the conslusions that you made in this PM?
JESPER: Yes, I do. I have authored this PM together with a co-worker that I dare claiming is one of best on Microsoft and Windows in Sweden, but I am the one that stand for all conslusions. But we have helped each other when writing it. I also think that it's important to read the introduction of the PM when reading the conclusions, because we were given a task from the Stockholm County Police department that the computer had been remotely controlled first through one way that we investigated and then another that we controlled, so that you have that in the back of your head when you read the PM. With all facts in hand, since there has emerged a discussion, that perhaps I should have expanded the explanations additionally or that I should have formulated myself a bit softer in certain ways, but I definitely stand for the conclusions.
HENRIK: When you say that perhaps you should have formulated yourself a bit softer, is there something in particular that you are thinking about? I know that you have looked at this PM.
JESPER: It's when we write that we don't see any programs that have been used for remotely controlling the computer. Based on the given task and the circumstances then in those frames we don't see any traces.
HENRIK: When we have asked, both lawyer Salomonsson and I, this Jacob Applebaum about these various firewall rules that are attached as attachment 1 in this PM, then he pushes on various, if I understand correctly, possibilities for remote control via various programming languages and some debugger and OpenVPN server and... How do you look at, for example in these programming languages Neko and Python, do you know anything about those programming languages?
JESPER: Yes, Python definitely. Neko I have learned about in relation to Haxe and other languages, but yes I know what they are. But it must be clear when reading this that these are only rules that show programs and what they are allowed to do. It doesn't say anything about whether the program is even running or not. It is required that a program is running and accepts connections for it to be possible to remotely control a computer, that's the first. And secondly the programs that are specified in the firewall don't even have to exist, they are only rules that we see here. And it's a lot of rules, I know. It can be worth adding that we haven't looked at every every file in every computer, because it's like a giant haystack with enormous, thousands, of files in various ways. And then we would need to go through each individual program: is it this one that has remotely controlled, is it this, is it this, and that whole part. There hasn't been any investigation like that on the computer because there is simply not enough time.
HENRIK: And then I would like to enter these specific points that have been questioned. The first one on page 412, I know that lawyer Salomonsson reported previously on this. Under... the latest point on the rules and so forth. It goes like this: "no active network services with remote control possibilities are accessible via the local firewall". Here Jacob Applebaum says: that is wrong.
JESPER: Then I can say that he hasn't been with us when we have started the computer to see what is actually spinning on the computer; which services are available, which programs are running waiting for remote control, if there would be any, which we haven't discovered.
HENRIK: What does this mean then: "no active network services with remote control possibilities are accessible via the local firewall". Can you explain what that sentence means?
JESPER: Yes, if you now have a program that would enable remote control then that program must be running somehow on the computer. Either by starting it or that it is starting automatically. And then if we take Remote Desktop, which would be the normal way of remotely controlling a Windows computer this way, we have concluded that it is not automatically started and it does not allow such login or remote control. It hasn't been started at all since July 2011, when the computer was reinstalled. Those are the conclusions that we, that I, have made.
HENRIK: So that conclusion, you still stand by that?
JESPER: Yes.
HENRIK: The second point which was questioned is the second last on page 413 which says "the login related events that occur in the operating system's security log show no other source addresses than 127.0.0.1 or ::1".
JESPER: Yes, Windows has a behavior like that by default in itself that there are various services that perform logins against the operating system itself. Those are entirely normal events that have occured there in the security log.
HENRIK: And once again, what does this mean? "The login related events that occur in the operating system's security log show no other source addresses than 127.0.0.1" and so forth.
JESPER: Now we are beginning to dig into technical complexity, it's not like I have answers to everything since I wrote this together with a co-worker, but we have not found any traces of remote control performed by another computer.
HENRIK: What does these two source addresses mean?
JESPER: 127.0.0.1 is a way to describe the local computer, and ::1 is another way of describing it. So...
HENRIK: So that means that no others, in the operating system's security log, there are no other addresses indicating logins except these internal ones, if we can call them that?
JESPER: Exactly. In my impression the system has a function that it logs into itself.
HENRIK: And then I also understood Applebaum like that this statement would be contradictory in relation to the first: "no active network services with remote control possibilities are accessible via the local firewall", that the latter would show that the first is wrong. Do you have any comments on that?
JESPER: No, I feel that I'm not really able to comment that. There is nothing that contradicts something else.
HENRIK: What is it that (inaudible)
JESPER: No, but we are going into such advanced technical details that we need to ask those really good Windows people I think to straighten out how Windows sub systems work and that whole part, if we are going into that detail.
HENRIK: No. But you still stand by these conclusions in relation to task that you were given?
JESPER: Yes, that's how it is.
HENRIK: Thank you, no more questions.
JUDGE: Salomonsson.
OLA: Perhaps you can't answer that, but Applebaum (inaudible) activity, so he is on this level and can express himself. Do you know anything about his person? The prosecutor was on the line of asking him if he has an academic education, do you know anything about Applebaum so to say, in the IT world? You live with IT a lot.
JESPER: Yes, I do. I know nothing about his academic background and all that, but...
OLA: It's not that, it's irrelevant. It's the knowledge, not how it's acquired.
JESPER: I dare saying that the person that has authored this PM is probably significantly sharper on Microsoft and Windows internals so to say.
OLA: Then we should take him here, I think. I would like the name of that person.
JESPER: Mm...
OLA: And who is that?
JESPER: He is sitting over there, Jörgen Olofsson.
OLA: And why haven't we gotten to know this before we almost close the case?
JESPER: I have said that...
OLA: Wait a little, this is a question to the prosecutor. Why is this coming here now? Applebaum is going to be on a plane tomorrow to the European Parliament, this is something that... you should know, this is something that we on the defender side have said that this is a relevant part. If we go back to this that the prosecutor read, this "there are no active listening network services accessible". How did you start the computer, do you remember that?
JESPER: We have mirrored it and created an identical environment as he has had on the computer. So we started it in many ways and investigated it.
OLA: But isn't it like that, I understand that, it doesn't start automatically? Is it like that?
JESPER: Which one?
OLA: The computer.
JESPER: The computer. A computer doesn't start automatically.
OLA: No, not his. That it's started manually so to speak, after...
JESPER: A computer? Surely you can start it manually, yes.
OLA: Starting the program.
JESPER: That's another thing, yes. You can start programs manually, yes. But if you look at for example Remote Desktop, which has occurred in hearings earlier would be a way to remotely control the computer, then that is nothing that has started automatically and that service hasn't been started at all since July 2011.
OLA: And you can see that?
JESPER: Yes.
OLA: OK. Let's see, this with... What the prosecutor read on 413, "the login related events that occur", that is also a conclusion that you stand by. But, can they have connected to OpenVPN, do you know that?
JESPER: OpenVPN is not a remote control program in itself. I have noticed that OpenVPN has existed, a VPN is something that is established if you want to communicate securely over an insecure network, like the Internet, then you establish an encrypted tunnel so to speak and this OpenVPN, my impression is that they have used OpenVPN to connect out and remotely control other computers, but it's nothing that automatically enables anybody else to remotely control your computer just because OpenVPN is installed.
OLA: Is there a way to connect inwards?
JESPER: Yes, how, we must ask then? Just because OpenVPN server, it doesn't enable that anybody gets access to the server. From there you must use for example Remote Desktop to connect.
OLA: I will, can I show you something?
JESPER: Absolutely.
OLA: This, if you look at this. It's the same thing as I showed earlier. This is a program.
JESPER: Yes.
OLA: You recognize that also I think.
JESPER: Yes, it's a Python program with some kind of remote control...
OLA: When you see this, do you know if you have been looking for things like this in seized material, primarily in the Macbook?
JESPER: I repeat the introduction of the PM. We were given a task from the County Police that it has been remotely controlled so, so or so differnt ways. And that has been our primary focus. Then we have expanded this search and thought that OK, can we see any other traces, some other logs from remote control? What you are showing for me is some sort of Python program/script and I can't answer to if that exists on the computer or not. What we see in the firewall rules is that it allows Python to communicate, if I remember correctly. What I believe that means is that someone has made some kind of Python program/script that needs network access for something. It can be downloading a website, communicating with a website or anything...
OLA: Or remotely controlling the computer.
JESPER: We can't entirely exclude that, if I formulate it that way. Yes, someone can have written a complete remote control program in Python and that is what is allowed. You are right about that.
OLA: I am only asking from my side... Wait, Gottfrid. The question is actually only, as I have understood, you haven't searched for it, and that is not intended as critique.
JESPER: No, I understand.
OLA: You have these directives that you talk about, and this does not fit within those directives as I understand. The searching for this.
JESPER: No, then we would need to go into every file on the computer to see the programs. Just because it says python.exe in the firewall rules, it's not certain that it is Python. It can be anything.
OLA: The question is... Let's see, I have something else here just let me find it.
JESPER: Mm.
OLA: I am assuming, Jesper, that you speak English fairly well.
JESPER: It's OK, mm.
OLA: (inaudible) look at these points here that are marked in green, then we will soon clarify for the Appeal Court what this is.
JESPER: Let's see, which context is this... It's some...
OLA: You can look at that last row and then you understand a little bit, and then (inaudible). Considering this task to check the computer, I would think that this is...
JESPER: Mm, wait... Mm, yes.
OLA: What I have shown you now, Jesper, is also material that has been received but I can't say with which authority it is written. But it is so to speak a manual of how to search computers for reaching the conclusion of: guilt or innocense, which is exercised in other countries. Now you're looking at these points, and I'm asking generally: have you done for example these checks?
JESPER: Mirroring the harddrives as early as possible which it said somewhere in the beginning, we did that, absolutely. And we have wished that the Cambodian police would do things a certain way, for example waiting for the Swedish police before conducting the raid.
OLA: Is there anything here that you spontaneously feel, in regards of the material, that hasn't been done in this investigation?
JESPER: Well, there are many things. We haven't gone through all programs on the entire computer, and since we haven't gone through all programs then we haven't investigated all programs for being trojans either. But I must also add that I have actually all pieces of the puzzle here, and it's not only a matter of the technology but...
OLA: No, but we can agree on that. I don't have any more questions then.
GOTTFRID: Yes, yes, yes (whispers)
OLA: Yes, that's right. I think that during a comppleting hearing with you, Jesper, you spoke about locked... Let's see, I will find the question. We spoke about editing the logs despite them possibly being locked by the operating system, do you remember that?
JESPER: Yes, and that is regarding Windows logs, the event logs that are connected to the various security...
OLA: I think it was like this, that you earlier in that hearing said that it's impossible to edit the files then.
JESPER: No, they are locked by a sub system in Windows, it's not just a text file residing there that you can put NULL into and such things. I can add another thing that I reacted on when I sat listening to this earlier witness with Holmboe, Richard who was heard, where he says that it's possible to clean these logs with for example scripts for PowerShell that he has said. But the thing is that even if you do that you will get row which says that the log has been cleaned.
OLA: Yes, he said that.
JESPER: He said that? OK. I didn't pick that up, but OK.
OLA: Editing leads to cleaning, so there is still some kind of result.
JESPER: Yes.
OLA: Then the question is, in this context, isn't it possible to access, via direct access, is that correct? Disk access, direct access to the disk.
JESPER: Yes, exactly.
OLA: To evade this.
JESPER: The lock, yes.
OLA: I don't think you touched on that subject earlier, but you can do that.
JESPER: We spoke then about the problems with someone remotely accessing it to edit these things simultaneously, which is very hard since they are locked. That requires you to do things that are very difficult.
OLA: Then that's that. Do you know that, or if, there are available tools for this?
JESPER: I don't dare answering exactly what tools are available, but I definitely believe that it exists.
OLA: Sap 2(?), do you know what that is?
JESPER: I have heard about it, but I...
OLA: Mm... (Gottfrid writes down question, judge and Ola speaking irrelevance.) We are doing it like this since I think it's better if I ask the question than if Svartholm Warg does it himself.
GOTTFRID: For example.
OLA: I will take this with you Jesper.
JESPER: Mm...
OLA: If you know of available guides and tools for cleaning event logs in Windows?
JESPER: I know that there has been, but I don't know if anything has changed with Windows 7 for example, it's...
OLA: I understand from the question that there are available tools for specifically Windows making it available for more or less anybody.
JESPER: Mm, I don't dare answering which possibilities exist right now for that type of operating systems, 64 bit Windows 7.
OLA: I have gotten a name, Metasplit.
GOTTFRID: Sploit!
OLA: Perhaps you don't want to say that.
JESPER: Yes, I know of Metasploit, mm...
OLA: It's probably something like that, but maybe you don't know what it is.
JESPER: It's something more than specifically cleaning logs, it's a complete framework for doing all kinds of things in relation to offensive actions.
OLA: And then an argumentative question from Gottfrid, how is it that you with that background say that it's impossible?
JESPER: If we think about it like this then, I don't know what (inaudible), but let's assume getting access to a computer and only moving in the RAM, perhaps things like that can be done to avoid leaving traces and that is correct, you can do that. But you will have problems as soon as the computer restarts, which it has done many times, you would also need to survive a reinstall for remote control and that's not possible for anybody.
OLA: Then I think we are finished with that.
JESPER: Thank you.
JUDGE: Is it finished?
OLA: It's finished!