hacker risks presentation to acfe pr chapter
DESCRIPTION
ACFE presentation on April 30, 2013 Presented by: Enrrique J Gonzalez, Jose Arroyo, Jose QuiñonesTRANSCRIPT
Is XXI century Fraud Hacking?
ACFE Puerto Rico Chapter
Presented by: Enrique GonzalezJose Arroyo
Jose Quinones
2
IT Terminologies
• Threat – potential danger to information or systems
• Vulnerability – absence of a safeguard or weakness providing an opportunity for attack
• Attack – attempt to exploit a vulnerability or violate a security policy, mechanism or control
• Breach – successful attack with or without detection
• Exposure = (vulnerability + likelihood of attack – number of instances of being exposed to a loss from a threat agent)
Facts
• Internet has grown very fast and security has lagged behind.
• It is hard to trace the perpetrator of cyber attacks since the real identities are camouflaged
• It is very hard to track down people because of the ubiquity of the network.
• Large scale failures of internet can have a catastrophic impact on the economy which relies heavily on electronic transactions
Computer Crime _the Beginning
• In 1988 a "worm program" written by a college student shut down about 10 percent of computers connected to the Internet. This was the beginning of the era of cyber attacks.
• Today we have about 70K of incidents of cyber attacks which are reported and the number grows.
Computer Crime- 1994• A 16-year-old music student called Richard Pryce,
better known by the hacker alias DataStream Cowboy, is arrested and charged with breaking into hundreds of computers including those at the Griffiths Air Force base, Nasa and the Korean Atomic Research Institute. His online mentor, "Kuji", is never found.
• Also this year, a group directed by Russian hackers broke into the computers of Citibank and transferred more than $10 million from customers' accounts. Eventually, Citibank recovered all but $400,000 of the pilfered money.
Computer Crime- 1995• In February, Kevin Mitnick is arrested for a second time. He
is charged with stealing 20,000 credit card numbers. He eventually spends four years in jail and on his release his parole conditions demand that he avoid contact with computers and mobile phones.
• On November 15, Christopher Pile becomes the first person to be jailed for writing and distributing a computer virus. Mr Pile, who called himself the Black Baron, was sentenced to 18 months in jail.
• The US General Accounting Office reveals that US Defense Department computers sustained 250,000 attacks in 1995.
Computer Crime- 1999• In March, the Melissa virus goes on the
rampage and wreaks havoc with computers worldwide. After a short investigation, the FBI tracks down and arrests the writer of the virus, a 29-year-old New Jersey computer programmer, David L Smith.
• More than 90 percent of large corporations and government agencies were the victims of computer security breaches in 1999
Computer Crime- 2000• In February, some of the most popular websites in the
world such as Amazon and Yahoo are almost overwhelmed by being flooded with bogus requests for data.
• In May, the ILOVEYOU virus is unleashed and clogs computers worldwide. Over the coming months, variants of the virus are released that manage to catch out companies that didn't do enough to protect themselves.
• In October, Microsoft admits that its corporate network has been hacked and source code for future Windows products has been seen.
Computer Crime- 2000-07• March 2005 - Bank of America
– 1,200,000 lost social security and account numbers were lost
• May 2006 - Veteran’s Administration– 26,500,000 social security numbers and DOB were lost
when a laptop was stolen• January 2007 - TJ Maxx
– 47,500,000 credit card numbers were stolen by hackers taking advantage of unencrypted wireless network in parking lot
10 Largest Data Breaches Since 2000
Why do Hackers Attack? • Because they can!!!!!!!!!!• A large fraction of hacker attacks have been
pranks• Financial Gain• Espionage • Venting anger at a company or organization• Terrorism
Types of Hacker Attack• Active Attacks
– Denial of Service– Breaking into a site
• Intelligence Gathering• Resource Usage• Deception
• Passive Attacks– Sniffing
• Passwords• Network Traffic• Sensitive Information
– Information Gathering
Modes of Hacker Attack
• Over the Internet• Over LAN• Locally• Offline• Theft• Deception
Spoofing Definition: An attacker alters his identity so that some one
thinks he is some one else Email, User ID, IP Address, … Attacker exploits trust relation between user and
networked machines to gain access to machines Types of Spoofing:
IP Spoofing: Email Spoofing Web Spoofing
Denial of Service (DOS) Attack• Definition:• Attack through which a person can render a system unusable or
significantly slow down the system for legitimate users by overloading the system so that no one else can use it.
• Types:– Crashing the system or network
• Send the victim data or packets which will cause system to crash or reboot.
– Exhausting the resources by flooding the system or network with information
• Since all resources are exhausted others are denied access to the resources
– Distributed DOS attacks are coordinated denial of service attacks involving several people and/or machines to launch attacks
Password Attacks - Process• Find a valid user ID• Create a list of possible passwords• Rank the passwords from high probability to low• Type in each password• If the system allows you in – success !• If not, try again, being careful not to exceed
password lockout (the number of times you can guess a wrong password before the system shuts down and won’t let you try any more)
Password Attacks – Types• Dictionary Attack
– Hacker tries all words in dictionary to crack password– 70% of the people use dictionary words as passwords
• Brute Force Attack– Try all permutations of the letters & symbols in the alphabet
• Hybrid Attack– Words from dictionary and their variations used in attack
• Social Engineering– People write passwords in different places– People disclose passwords naively to others
• Shoulder Surfing– Hackers slyly watch over peoples shoulders to steal passwords
• Dumpster Diving– People dump their trash papers in garbage which may contain information to crack
passwords
Study Findings
• 30% of users chose passwords whose length is <= 6 characters
• 60% of users use limited set of alpha-numeric characters
• 50% of users use names, slang words, dictionary words, or simple key sequences
• In just 110 attempts, a hacker would typically be able to gain access to one new account every second, or 17 minutes to break 1000 accounts
http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf
Password Protection
http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf
XKCD Comics explains it well
Good, old fashioned stealing
Who is causing the buzz?
• The amount of data that can be capture from just doing an Internet search
• The inability of corporate employees to identify a social engineering attack
• The easy access intruders have to both physical and virtual data through the use of Social Engineering
Money lost?
Who is been attacked?
How it is done?
How is it done?
• DefCon 20 SE CTF Report
Why?
Another target
• If this happens to corporations, imagine SE attacks to an individual.
ID theft & Falce ID
• Complete Digital Life destroyed to Mat Honan, thanks to Google, Apple and Amazon.
False ID
Number of Incidents 2011
http://www.idtheftawareness.com/id_theft_pages/WhatIsIdTheft.php
Is there hope?
“Phishing”
http://kooptickets.nl/~claudia/mycfcu.com/…..
Netherlands
Identity Theft
• When someone uses your personal information without your permission to commit fraud or other crime– Name– Social Security number– Date of birth– Credit card number– Bank account numbers
Identity
“Skimming”
“Skimming”
“Skimming”
“Dumpster Diving”
Jason E. Street
Scrap Paper
• March 10, 2008• School teacher purchases box of scrap paper
for her fourth grade students - $20• What she really gets?• Medical records of 28 hospital patients!
Medical ID Theft• April 2007, Salt Lake City• Woman delivers a baby at a local hospital• …then abandons it!• Baby tests positive for methamphetamine• Hospital identifies mother as Anndorie Sachs and tracks her
down• Anndorie says she did not have a baby recently• DCFS threatens to take away her other 4 children, aged 2-7
Medical ID Theft (cont)• Good news
– Accusations were dropped– Anndorie was absolved of paying the bill
• Bad news– Anndorie’s medical records were altered to show the blood type and
medical record of a complete stranger– Anndorie has a blood clotting disorder– The hospitals insist that they have fixed the issue, but Anndorie can’t
be sure because they need to PROTECT the PRIVACY of the IDENTITY THIEF!
Protect your sensitive information
• Shred pre-approved credit offers, receipts, bills, other records that have SSN
• Do not provide CC#, SSN, etc. out over email
• Do not click on links in unsolicited emails
What's your organization’s most important asset?
Critical and Confidential Data
• Intellectual Property: source code, product design documents, process documentation, internal price lists, R&D
• Corporate Data: Financial documents, strategic planning documents, due diligence research for mergers and acquisitions, corporate secrets
• Personal/Personnel/User Data: Social security numbers, credit card numbers, medical records, financial statements
How data is lost?
Threat actors
Verizon Data Breach Report 2012
Open Access
• Misconfigured share folders on a network can become a source for data leak.
• A common error of the system administrators is to give more privileges to users than they need. – This breaks the least privilege principle and has
consequences.• Wireless access
– Captive portals give a false sense of security– The encryption is as good as its password
Excessive Permissions
• Everyone: Full Control– Often developers code as a full admin on their
station and do not take into account restricted users.
• Combination of Share Permissions and File Permissions is often misconfigure
• dbo privileges on the database for regular users• Firewall rules
How data can be protected?
• Proper File an share permissions– Don’t use Everyone or Users groups– Adhere to least privilege principle
• Group Policy Objects (GPO) are you friends– Activate Audits Objects and Processes– Configure Logging– Tracking
• Monitor your data– IDS/IPS– DPI
Data Loss Prevention
• Finger Print• File Size• File Type• RegEx• Rule Based
Are you sure you are getting it all?
Encryption
• During Transmission– VPN– Secure Shell– Tunneling
• At rest– File Encryption (EFS, File Vault, etc.)– Full drive encryption (Bit Locker, Truecrypt, etc.)
• It also can be used by the bad guys
... bring the cracker
Who’s got your data?
Verizon Data Breach Report 2012
Track your data
• Embed a URI or <web bug>
• Digital Rights Management
• Traffic/Network FLOWs• Deep Packet Inspection• SSL proxy
After the fact, what do you do?
• How identify an incident
• Incident Handling Process
• Live vs Dead Analysis
Incident vs Event
• Event: Observable, measurable occurrences on our systems. It can be something that happened to someone who saw it, or was recorded by a log or audit file on a device.
• Incident: actions that result in harm or the significant threat of harm to the information systems or data in the organization
Steps to Incident Handling
• Preparation: Policies, procedures, educate, practice
• Identification: Declare, classify, prioritize
• Containment: Observe, quarantine, isolate
• Eradication: Clean, patch, reconfigure
• Recovery: Restore, test, monitor,
• Lessons Learned: Debrief, discuss, evaluate, modify,
mitigate
Live Analysis
• Live Analysis– Memory Dump– Live Disk Imaging– Network Status/Capture– System State
• Dead Analysis– Pull the plug– Disk imaging– Image analysis
Why live analysis should always be considered?
• RAM only processes– Metasploit Meterpreter
• RAM disks– /dev/shm– ImDisk
• Network Connections– Open transfers– Networked shares like SMB/NFS or SSHFS– Tunneling
So …
• Your data is the most important asset in the organization and “others”
• You have to do your best effort to protect your assets but sometimes your best is not enough
• Be prepared to fail, learn from it and keep your mind open to possibilities
How many of you...
…have your Social Security card in your wallet or purse
right now?
Due Care and Due Diligence• Due Care: Steps taken to show that a company has taken
responsibility for the activities that occur within the corporation and has taken the necessary steps to help protect the company, its resources, and employees.
• Due Diligence: The process of systematically evaluating information to identify vulnerabilities threats, and issues relating to an organization’s overall risk.
• Example:– Due care: Installing Antivirus software– Due diligence: Keeping Antivirus signatures updated
64
65
Examples of Major Computer Crime Laws
• PATRIOT Act• Electronic Communications Privacy Act• Computer Fraud and Abuse Act• National Infrastructure Protection Act of 1997• Computer Security Act of 1987• Computer Crime Research Center (http://www.crime-
research.org/legislation/)• Council Of Europe - Convention On Cybercrime (Ets
No. 185)• Convention On Cybercrime (Budapest, 23.Xi.2001)
66
Laws, Directives, and Regulations
• Gramm-Leach-Bliley Act of 1999• Requires financial institutions to develop privacy notices and give
their customers the option to prohibit financial institutions from sharing their information with nonaffiliated third parties
• Requires:• The board of directors to be responsible for security issues
within financial institutions• Risk management• Training to all employees on information security issues• Test security measures implemented• Written security policy
67
Laws, Directives, and Regulations
• Computer Fraud and Abuse Act• The primary U.S. federal antihacking statute.• Prohibits seven forms of activity and makes them federal crimes
• Federal Privacy Act of 1974• Applies to records and documents developed and maintained by
specific branches of the federal government.• An actual record is information about an individual’s education,
medical history, financial history, criminal history, employment, and other similar types of information.
• An agency cannot disclose the information without written permission from the individual
68
Laws, Directives, and Regulations
• Computer Security Act of 1987:• Requires U.S. federal agencies to identify computer systems
that will contain sensitive information• Develop security policy and plan for each of these systems• Conduct periodic training for individuals who operate,
manage, or use these systems• Security awareness training and define acceptable computer
use and practices
• Economic Espionage Act of 1996• Provides the necessary structure when dealing with industry
and corporate espionage and further defines trade secrets to be technical, business, engineering, scientific, or financial
LawOffense Section Sentence
Obtaining National Security Information (a)(1) 10 (20) yearsAccessing a Computer and Obtaining Information (a)(2) 1 or 5 (10)
Trespassing in a Government Computer (a)(3) 1 (10)Accessing a Computer to Defraud & Obtain Value (a)(4) 5(10)
Intentionally Damaging by Knowing Transmission (a(5))(A) 1 or 10 (20)
Recklessly Damaging by Intentional Access (a(5))(B) 1 or 5 (20)Negligently Causing Damage & Loss by Intentional Access (a(5))(C) 1 (10)
Trafficking in Passwords (a)(6) 1 (10)Extortion Involving Computers (7) 5 (10
The maximum prison sentences for second convictions are noted in parentheses he maximum prison sentences for second convictions are noted in parentheses
Current US Legal Framework
• Difficulties in Prosecution
– Lack of Understanding• Judges, Lawyers, Police, Jurors
– Evidence• Lack of Tangible Evidence
– Forms of Assets• Magnetic Particles, Computer Time
– Juveniles• Many Perpetrators are Juveniles• Adults Don’t Take Juvenile Crime Seriously71
Computer Crime Challenge
72
Investigations
• Incident Response• Have policy and procedures in place for incident
response• Incident response team• Follow predetermined steps• Decide whether to conduct own forensics
73
Investigations
• Incident Handling• Procedures for how to handle all incidents• Related to disaster recovery planning• Contain and repair any damage caused by an
event or prevent any further damage• Linked to security training and awareness program• Become part of mailing list of the Computer
Emergency Response Team (CERT)
74
Investigations
• Forensics• A science and an art that requires specialized techniques for
the recovery, authentication, and analysis of electronic data for the purposes of a criminal act.
• Computer Forensics• Must be properly skilled• Work from a copy• Specialized tools• Chain of custody• Photograph crime scene
• Forensics Investigations Process
– Identification– Preservation– Collection– Examination– Analysis– Presentation– Decision
75
Investigations
Incident Investigators
• Network Analysis– Communication analysis– Log analysis– Path tracing
• Media Analysis– Disk imaging– MAC time analysis (modify,
access, create)– Content analysis– Slack space analysis– Steganography
• Software analysis– Reverse engineering– Malicious code review– Exploit review
76
Penetration Testing• Process of simulating attacks on a network and its systems at
the request of the owner, senior management.
• Uses a set of procedures and tools designed to test and possibly bypass the security controls of a system.
• Its goal is to measure an organization’s level of resistance to an attack and to uncover any weaknesses within the environment.
• Penetration tests can evaluate web servers, DNS servers, router configurations, workstation vulnerabilities, access to sensitive information, remote dial-in access, open ports, and available services’ properties that a real attacker might use to compromise the company’s overall security.
77
Penetration Testing• When performing a penetration test, the team goes through a five-
step process:
– 1. Discovery - Foot printing and gathering information about the target
– 2. Enumeration - Performing port scans and resource identification methods
– 3. Vulnerability mapping - Identifying vulnerabilities in identified systems and resources
– 4. Exploitation - Attempting to gain unauthorized access by exploiting vulnerabilities
– 5. Report to management - Delivering to management documentation of test findings along with suggested countermeasures
78
Penetration Testing• The penetration testing team can have varying degrees of
knowledge about the penetration target before the tests are actually carried out:
– Zero knowledge - The team does not have any knowledge of the target and must start from ground zero.
– Partial knowledge - The team has some information about the target.– Full knowledge - The team has intimate knowledge of the target.– A blind test is one in which the assessors only have publicly available
data to work with. The network staff is aware that this type of test will take place.
– A double-blind test (stealth assessment) is also a blind test to the assessor as mentioned previously, plus the security staff is not notified.
79
Jose A. Arroyo, MSMCSA, MCT, CEH
TalkToAnIT.com
Jose L. Quiñones, BSMCSA, MCT, CEH, CIE, GCIH, GPEN, RHCSA
CODEFidelio.org