RU170238U1 - COMPLEX FOR RESEARCH OF RADIO ELECTRONIC DEVICES - Google Patents

Abstract

An automated workstation for collecting information for conducting radio technical examinations, consisting of a personal electronic computer that acts as a control and processing unit, an interface module and a replaceable model module, which provides the possibility of a forensic investigation of an electronic device with a memory chip with minimal use of soldering equipment.

Description

The proposed device relates to the field of forensics and forensics, namely the use of electronic means to increase the efficiency and objectivity of conducting examinations and expert studies of electronic devices by automating a number of operations.

The proposed device allows with high reliability to quickly create a model copy of the electronic device and on its basis to conduct an expert experiment.

Since 2015, one of the types of forensic expertise is the radio technical expertise (RTE). At this stage of development, the RTE is an independent type of forensic examination belonging to the class of engineering and technical examinations carried out in order to: determine the status of an object as a radio electronic device (REU), its functional purpose, identify and study its trace in the crime under investigation, determine use cases and technical characteristics, as well as access to information stored in memory elements, followed by a comprehensive study of it.

The development of high technologies was clearly manifested in the improvement of industries associated with the manufacture of electronic devices, which comprehensively penetrated into all sectors of human activity.

Criminal structures have also adopted modern technologies and use electronic equipment for their illegal purposes.

Disclosure and investigation of crimes committed with the use of REU is impossible without the use of appropriate special knowledge.

The subject of the RTE is the establishment of objective facts of the use of radio electronics as tools for the preparation, commission or concealment of a crime committed that are relevant to a criminal, civil or arbitration case.

The objects of RTE are radio engineering products (kits and complexes of them) or their fragments, individual components and components. Also, the objects of the RTE include information containing technical specifications, scope and other reference data of the REU or their components, as well as information from the procedural documents: the protocol of the inspection of the scene, the protocol of interrogation of witnesses and other documents.

In the general case, the RTE is based on the engineering study of the object, analysis of its design, applied technological operations and materials, as well as a chain of logical reasoning and conclusions. In engineering studies, the properties of the object are revealed, which subsequently determine the methods and methods of research.

The tactics of actions for the disclosure and investigation of crimes are inextricably and directly dependent on the special tools and instruments used. Instruments, apparatus, equipment, tools, accessories used to collect and investigate evidence in the course of legal proceedings are commonly referred to as “forensic technology”.

The primary basis of the class of forensic technology under consideration is hardware and software, techniques and methods borrowed from such fields of science and technology as radio engineering, radio physics and metrology.

Gradually, the forensic technique is replenished with tools, techniques and methods specially developed for the purpose of RTE.

To date, the typical technical and forensic equipment of RTEs are the following tools [1]:

- generators of various frequency ranges,

- oscilloscopes,

- electronic testers,

- spectrum analyzers,

- radio installation equipment,

- soldering equipment,

- debuggers and programmers for microcontrollers,

- personal electronic computer (PC) for processing results and processing reporting documents.

Means of researching information stored in electronic form should provide [2]:

- technical ability to access information contained in the object of study;

- fixing information;

- the conversion of information into a form that is accessible to the expert.

These tasks are solved jointly by hardware and software research support.

Thanks to the availability of highly qualified specialists, a number of leading expert organizations are developing technologies for conducting practical work on conducting forensic examinations of the REU. For this, a set of specific atypical works is carried out, the corresponding tools are developed and mastered.

The result of the relevant work are software or hardware-software systems for all specific types of work.

Methodological developments and automation tools, accumulating the knowledge and experience of unique highly qualified specialists, make it possible to increase the level of solving RTE issues by small local forces by assigning these tasks to small groups or individual staff experts.

An important object of RTE research is a skimmer - an electronic or electronic device designed to steal data from bank cards with a magnetic strip by installing it on an ATM [3].

Skimmers store stolen data in the form of binary data (digital skimmer) or as a sound file (audio skimmer).

Data from audio skimmers is extracted as audio files and processed using programs for processing audio files.

Data from digital skimmers can have many different non-standard presentation formats.

A generalized digital skimmer circuit is shown in FIG. one.

A skimmer connector is used by cybercriminals to read data stored in a memory chip into a PC. The read data is processed and used to produce fake bank cards, which are then used to illegally withdraw money from ATMs or make purchases.

During the examination of the skimmer, the expert must establish the numbers of bank cards and their owners in order to identify potential damage from them.

Depending on the expert situation and the complexity of the skimmer functioning algorithm, expert research is carried out in three ways.

Option 1

If the skimmer’s functioning algorithm is known to the expert from the case materials or from the results of previous examinations, then the skimmer is connected to the PC and the data is read by software similar to that used by attackers.

Option 2

The simplest skimmer functioning algorithm is to write read binary data from a bank card to a memory chip.

Then the expert removes the memory chip from the skimmer using soldering equipment and reads the contents of the memory chip using the programmer and PC.

A memory dump is parsed manually or using software.

Option 3

A complex algorithm for the functioning of a skimmer is to write read binary data from a bank card to a memory chip after conversion. Depending on the type of conversion (coding, scrambling, encryption), the complexity of expert research may vary.

The expert removes the memory chip from the skimmer using soldering equipment and reads the contents of the memory chip using the programmer and PC.

A memory dump is parsed manually or using software. If the data structure does not allow to establish the information contained, then the memory chip is soldered back into the skimmer and an expert experiment is performed, consisting in inserting (once or repeatedly) a bank card with the data known to the expert or a specially prepared card with test data through the skimmer slot.

The memory chip is re-evaporated from the skimmer and a memory dump is read using the programmer.

A second attempt is made to interpret the read data with the new recorded data.

In the absence of new data in a read dump (if the microcontroller writes data to memory when a fixed portion of data is accumulated) or insufficient new data to perform the analysis, the experiment with writing data to the skimmer is repeated.

The difficulty of performing expert research according to the third option (the most common) is the miniature size of the skimmer and its element base, which often leads to the failure of the skimmer upon repeated exposure to soldering equipment.

A set of equipment for conducting research on digital skimmers, including: a PC, soldering equipment and a programmer that acts as a pairing module, is selected as a prototype.

The claimed device has a comprehensive goal: to ensure the prompt creation of a model copy of the skimmer received for examination, and conduct its comprehensive study.

The essence of the invention lies in the fact that the studied skimmer using the inventive device is connected to a PC, with which it reads data from a memory chip and writes data generated by an expert to a memory chip through a skimmer.

List of figures:

FIG. 1 - Skimmer circuit. Shows the main elements of the device and the relationship between them.

FIG. 2 - Scheme of the Complex for the study of electronic devices. Shows the main elements of the device and the relationship between them.

FIG. 3 - An experimental sample of the Complex for the study of electronic devices. Shows the appearance and layout of the main elements of the device.

The goal is achieved in that the Complex for the study of electronic devices consists of:

- Management PC 1,

- Interface module 2,

- Replaceable model module 3.

The control PC 1 is a universal computer equipped with software for generating signals for feeding the skimmer to the input, controlling the Interface Module 2, and storing and analyzing the skimmer memory dump.

The interface module 2 is a device designed to receive a signal from a PC and supply it to the input circuit of the skimmer, as well as read information from the memory chip of the skimmer. The listed functions Interface module 2 performs sequentially. From a functional point of view, Interface Module 2 is a combination of a managed switch and programmer, the first of which provides the connection of a memory chip to the studied skimmer for supplying an acoustic signal from the Control PC 1 to the input of the skimmer or to the Control PC 1 for reading data from the memory chip, and the second - to coordinate the signal buses of the memory chip and the PC interface 1.

The replaceable model module 3 is a printed circuit board with platforms for accommodating typical skimmer memory microcircuits, designed to connect a memory microcircuit to the Interface Module 2.

Interface module 2 consists of the Audio Channel Switching Unit 2.1, the Interface Unit 2.2 and the Switching Unit of the memory chip 2.3.

The audio channel switching unit 2.1 is a controllable electronic key.

The interface unit 2.2 is a device based on a microcontroller designed to ensure the interaction of a PC with a memory chip, i.e. performs the function of a programmer.

The memory microcircuit switching unit 2.3 is a controllable multi-channel electronic switch designed to connect the skimmer memory microcircuit to the Control PC 1 through the 2.2 Interface Unit or to the studied skimmer.

Interface module 2 is connected to the host PC 1 via USB, the sound output of the host PC 1 is connected to the signal input of the audio channel 2.1 switching unit, the output of which is designed to connect to the input circuit of the studied skimmer, the control input of the audio channel 2 switching unit is connected to the controlling PC via USB

The multi-channel output of the Plug-in model module 3 is connected to the multi-channel input of the Switching Unit of the memory chip 2.3, the first multi-channel output of which is connected via the Interface Unit 2.2 to the USB of the host PC 1, and the second multi-channel output of which is connected to the microcontroller of the studied skimmer.

The control inputs of the Interface Unit 2.2 and the Switching Unit of the memory chip 2.3 are connected to the Control PC 1 via USB.

The contact pads of the Replaceable model module 3 are intended for connecting the legs of the memory chip of the studied skimmer.

The principle of operation of the Complex for the study of electronic devices is as follows. The memory microcircuit is soldered from the studied skimmer and soldered to the place corresponding to its type on the Replaceable model module 3, which is then connected to the Interface module 2 through a connector connected to the multi-channel input of the Switching unit of the memory chip 2.3.

The signal output of the Audio Signal Switching Unit 2.1 is connected to the input of the input circuits of the studied skimmer.

The control PC 1, using the control signal via USB, connects the sound output of the PC 1 to the input of the input circuits of the studied skimmer.

The control PC 1, using the control signal via USB, connects the sound chip of the skimmer memory via the Replaceable model module 3 and the Switching unit of the memory chip 2.3 to the studied skimmer.

The signal from the audio output generated in the Control PC 1 is fed to the input of the skimmer via the Audio Signal Switching Unit 2.1, converted by the skimmer, and recorded as binary data in the memory chip.

The control PC 1, using the control signal via USB, connects the sound chip of the skimmer memory through the Replaceable model module 3. The switching unit of the memory chip 2.3 and the Interface unit 2.2 to the control PC 1.

The control PC 1 reads the data from the skimmer memory microcircuit, and the operator parses and analyzes the read data.

An experimental sample of the Complex for the study of electronic devices is presented in FIG. 3. Indicators are used to control the voltage and current supply of the skimmer.

Thus, the objective of the invention is achieved.

BIBLIOGRAPHY

1. Sheludchenko V.I. Technical and forensic tools and methods for collecting computer information // Materials of the All-Russian Interdepartmental Seminar. - Belgorod: Ministry of Internal Affairs of the Russian Federation, 2002. - S.205-207.

2. Kopytin A.V., Marshalko B.G., Fedotov E.T. Forensic examination of a personal computer // Materials of the All-Russian Interdepartmental Seminar. - Kazan: Ministry of Internal Affairs of the Republic of Tatarstan, 2004. - P.115.

3. https://youtu.be/wvH43nyoXek

Claims (1)

A complex for the study of electronic devices, consisting of a host PC 1 and a pairing module 2, characterized in that the composition also includes a removable model module 3, a sound channel 2.1 switching unit, a 2.2 coupler unit and a 2.3 memory chip switching unit, while the pairing module 2 connected to the control PC 1 via USB, the audio output of the control PC 1 is connected to the signal input of the switching block of the sound channel 2.1, the output of which is designed to connect to the input of the input circuits of the studied skimmer, the branching input of the audio channel switching unit 2.1 is connected to the host PC via USB, the multi-channel output of the plug-in model module 3 is connected to the multi-channel input of the switching unit of the memory chip 2.3, the first multi-channel output of which is connected via the interface unit 2.2 to the USB of the managing PC 1, and the second multi-channel output of which it is designed to connect the studied skimmer to the microcontroller, the control inputs of the interface unit 2.2 and the switching unit of the memory chip 2.3 are connected to the control PC 1 via USB, contact loschadki removable model unit 3 intended for joining the legs of the test memory chip skimmer.

Images