Digital Forensics of Raspberry Pi Used for MITM

Abstract

Raspberry Pi, a credit card sized, low power consuming and cost-effective computer gained global recognition since its development in 2008. The capability to run GNU-based Linux distribution like Snappy Ubuntu, Kali, Raspbian and even Windows 10, has partly contributed to its popularity. However, these devices can also be exploited. In this chapter, we will discuss how a digital forensic investigator could investigate a case where a Raspberry Pi was used to conduct Man in the middle attack. Using an adversary model, we will demonstrate how one can perform a man-in-the-middle attack against users by creating a rogue wireless access point and capturing critical user information. We will try to analyze different operating system and application log files; files and data recovered using different digital forensic tools to deduce the timeline and what things have happened using recovered evidence. We will also see how different digital forensic analysis tools like Autopsy, FTK AccessData and Bulk Extractor could be helpful in this case by performing benchmarking them against some key factors like recovered web history and cookies files, carved files, etc.