Hacker risks presentation to ACFE PR Chapter

Is XXI century Fraud Hacking?

ACFE Puerto Rico Chapter

Presented by: Enrique GonzalezJose Arroyo

Jose Quinones

2

IT Terminologies

• Threat – potential danger to information or systems

• Vulnerability – absence of a safeguard or weakness providing an opportunity for attack

• Attack – attempt to exploit a vulnerability or violate a security policy, mechanism or control

• Breach – successful attack with or without detection

• Exposure = (vulnerability + likelihood of attack – number of instances of being exposed to a loss from a threat agent)

Facts

• Internet has grown very fast and security has lagged behind.

• It is hard to trace the perpetrator of cyber attacks since the real identities are camouflaged

• It is very hard to track down people because of the ubiquity of the network.

• Large scale failures of internet can have a catastrophic impact on the economy which relies heavily on electronic transactions

Computer Crime _the Beginning

• In 1988 a "worm program" written by a college student shut down about 10 percent of computers connected to the Internet. This was the beginning of the era of cyber attacks.

• Today we have about 70K of incidents of cyber attacks which are reported and the number grows.

Computer Crime- 1994• A 16-year-old music student called Richard Pryce,

better known by the hacker alias DataStream Cowboy, is arrested and charged with breaking into hundreds of computers including those at the Griffiths Air Force base, Nasa and the Korean Atomic Research Institute. His online mentor, "Kuji", is never found.

• Also this year, a group directed by Russian hackers broke into the computers of Citibank and transferred more than $10 million from customers' accounts. Eventually, Citibank recovered all but $400,000 of the pilfered money.

Computer Crime- 1995• In February, Kevin Mitnick is arrested for a second time. He

is charged with stealing 20,000 credit card numbers. He eventually spends four years in jail and on his release his parole conditions demand that he avoid contact with computers and mobile phones.

• On November 15, Christopher Pile becomes the first person to be jailed for writing and distributing a computer virus. Mr Pile, who called himself the Black Baron, was sentenced to 18 months in jail.

• The US General Accounting Office reveals that US Defense Department computers sustained 250,000 attacks in 1995.

Computer Crime- 1999• In March, the Melissa virus goes on the

rampage and wreaks havoc with computers worldwide. After a short investigation, the FBI tracks down and arrests the writer of the virus, a 29-year-old New Jersey computer programmer, David L Smith.

• More than 90 percent of large corporations and government agencies were the victims of computer security breaches in 1999

Computer Crime- 2000• In February, some of the most popular websites in the

world such as Amazon and Yahoo are almost overwhelmed by being flooded with bogus requests for data.

• In May, the ILOVEYOU virus is unleashed and clogs computers worldwide. Over the coming months, variants of the virus are released that manage to catch out companies that didn't do enough to protect themselves.

• In October, Microsoft admits that its corporate network has been hacked and source code for future Windows products has been seen.

Computer Crime- 2000-07• March 2005 - Bank of America

– 1,200,000 lost social security and account numbers were lost

• May 2006 - Veteran’s Administration– 26,500,000 social security numbers and DOB were lost

when a laptop was stolen• January 2007 - TJ Maxx

– 47,500,000 credit card numbers were stolen by hackers taking advantage of unencrypted wireless network in parking lot

10 Largest Data Breaches Since 2000

Why do Hackers Attack? • Because they can!!!!!!!!!!• A large fraction of hacker attacks have been

pranks• Financial Gain• Espionage • Venting anger at a company or organization• Terrorism

Types of Hacker Attack• Active Attacks

– Denial of Service– Breaking into a site

• Intelligence Gathering• Resource Usage• Deception

• Passive Attacks– Sniffing

• Passwords• Network Traffic• Sensitive Information

– Information Gathering

Modes of Hacker Attack

• Over the Internet• Over LAN• Locally• Offline• Theft• Deception

Spoofing Definition: An attacker alters his identity so that some one

thinks he is some one else Email, User ID, IP Address, … Attacker exploits trust relation between user and

networked machines to gain access to machines Types of Spoofing:

IP Spoofing: Email Spoofing Web Spoofing

Denial of Service (DOS) Attack• Definition:• Attack through which a person can render a system unusable or

significantly slow down the system for legitimate users by overloading the system so that no one else can use it.

• Types:– Crashing the system or network

• Send the victim data or packets which will cause system to crash or reboot.

– Exhausting the resources by flooding the system or network with information

• Since all resources are exhausted others are denied access to the resources

– Distributed DOS attacks are coordinated denial of service attacks involving several people and/or machines to launch attacks

Password Attacks - Process• Find a valid user ID• Create a list of possible passwords• Rank the passwords from high probability to low• Type in each password• If the system allows you in – success !• If not, try again, being careful not to exceed

password lockout (the number of times you can guess a wrong password before the system shuts down and won’t let you try any more)

Password Attacks – Types• Dictionary Attack

– Hacker tries all words in dictionary to crack password– 70% of the people use dictionary words as passwords

• Brute Force Attack– Try all permutations of the letters & symbols in the alphabet

• Hybrid Attack– Words from dictionary and their variations used in attack

• Social Engineering– People write passwords in different places– People disclose passwords naively to others

• Shoulder Surfing– Hackers slyly watch over peoples shoulders to steal passwords

• Dumpster Diving– People dump their trash papers in garbage which may contain information to crack

passwords

Study Findings

• 30% of users chose passwords whose length is <= 6 characters

• 60% of users use limited set of alpha-numeric characters

• 50% of users use names, slang words, dictionary words, or simple key sequences

• In just 110 attempts, a hacker would typically be able to gain access to one new account every second, or 17 minutes to break 1000 accounts

http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf

Password Protection

http://www.imperva.com/docs/WP_Consumer_Password_Worst_Practices.pdf

XKCD Comics explains it well

Good, old fashioned stealing

Who is causing the buzz?

• The amount of data that can be capture from just doing an Internet search

• The inability of corporate employees to identify a social engineering attack

• The easy access intruders have to both physical and virtual data through the use of Social Engineering

Money lost?

Who is been attacked?

How it is done?

How is it done?

• DefCon 20 SE CTF Report

Why?

Another target

• If this happens to corporations, imagine SE attacks to an individual.

ID theft & Falce ID

• Complete Digital Life destroyed to Mat Honan, thanks to Google, Apple and Amazon.

False ID

Number of Incidents 2011

http://www.idtheftawareness.com/id_theft_pages/WhatIsIdTheft.php

Is there hope?

“Phishing”

http://kooptickets.nl/~claudia/mycfcu.com/…..

Netherlands

Identity Theft

• When someone uses your personal information without your permission to commit fraud or other crime– Name– Social Security number– Date of birth– Credit card number– Bank account numbers

Identity

“Skimming”

“Skimming”

“Skimming”

“Dumpster Diving”

Jason E. Street

Scrap Paper

• March 10, 2008• School teacher purchases box of scrap paper

for her fourth grade students - $20• What she really gets?• Medical records of 28 hospital patients!

Medical ID Theft• April 2007, Salt Lake City• Woman delivers a baby at a local hospital• …then abandons it!• Baby tests positive for methamphetamine• Hospital identifies mother as Anndorie Sachs and tracks her

down• Anndorie says she did not have a baby recently• DCFS threatens to take away her other 4 children, aged 2-7

Medical ID Theft (cont)• Good news

– Accusations were dropped– Anndorie was absolved of paying the bill

• Bad news– Anndorie’s medical records were altered to show the blood type and

medical record of a complete stranger– Anndorie has a blood clotting disorder– The hospitals insist that they have fixed the issue, but Anndorie can’t

be sure because they need to PROTECT the PRIVACY of the IDENTITY THIEF!

Protect your sensitive information

• Shred pre-approved credit offers, receipts, bills, other records that have SSN

• Do not provide CC#, SSN, etc. out over email

• Do not click on links in unsolicited emails

What's your organization’s most important asset?

Critical and Confidential Data

• Intellectual Property: source code, product design documents, process documentation, internal price lists, R&D

• Corporate Data: Financial documents, strategic planning documents, due diligence research for mergers and acquisitions, corporate secrets

• Personal/Personnel/User Data: Social security numbers, credit card numbers, medical records, financial statements

How data is lost?

Threat actors

Verizon Data Breach Report 2012

Open Access

• Misconfigured share folders on a network can become a source for data leak.

• A common error of the system administrators is to give more privileges to users than they need. – This breaks the least privilege principle and has

consequences.• Wireless access

– Captive portals give a false sense of security– The encryption is as good as its password

Excessive Permissions

• Everyone: Full Control– Often developers code as a full admin on their

station and do not take into account restricted users.

• Combination of Share Permissions and File Permissions is often misconfigure

• dbo privileges on the database for regular users• Firewall rules

How data can be protected?

• Proper File an share permissions– Don’t use Everyone or Users groups– Adhere to least privilege principle

• Group Policy Objects (GPO) are you friends– Activate Audits Objects and Processes– Configure Logging– Tracking

• Monitor your data– IDS/IPS– DPI

Data Loss Prevention

• Finger Print• File Size• File Type• RegEx• Rule Based

Are you sure you are getting it all?

Encryption

• During Transmission– VPN– Secure Shell– Tunneling

• At rest– File Encryption (EFS, File Vault, etc.)– Full drive encryption (Bit Locker, Truecrypt, etc.)

• It also can be used by the bad guys

... bring the cracker

Who’s got your data?

Verizon Data Breach Report 2012

Track your data

• Embed a URI or <web bug>

• Digital Rights Management

• Traffic/Network FLOWs• Deep Packet Inspection• SSL proxy

After the fact, what do you do?

• How identify an incident

• Incident Handling Process

• Live vs Dead Analysis

Incident vs Event

• Event: Observable, measurable occurrences on our systems. It can be something that happened to someone who saw it, or was recorded by a log or audit file on a device.

• Incident: actions that result in harm or the significant threat of harm to the information systems or data in the organization

Steps to Incident Handling

• Preparation: Policies, procedures, educate, practice

• Identification: Declare, classify, prioritize

• Containment: Observe, quarantine, isolate

• Eradication: Clean, patch, reconfigure

• Recovery: Restore, test, monitor,

• Lessons Learned: Debrief, discuss, evaluate, modify,

mitigate

Live Analysis

• Live Analysis– Memory Dump– Live Disk Imaging– Network Status/Capture– System State

• Dead Analysis– Pull the plug– Disk imaging– Image analysis

Why live analysis should always be considered?

• RAM only processes– Metasploit Meterpreter

• RAM disks– /dev/shm– ImDisk

• Network Connections– Open transfers– Networked shares like SMB/NFS or SSHFS– Tunneling

So …

• Your data is the most important asset in the organization and “others”

• You have to do your best effort to protect your assets but sometimes your best is not enough

• Be prepared to fail, learn from it and keep your mind open to possibilities

How many of you...

…have your Social Security card in your wallet or purse

right now?

Due Care and Due Diligence• Due Care: Steps taken to show that a company has taken

responsibility for the activities that occur within the corporation and has taken the necessary steps to help protect the company, its resources, and employees.

• Due Diligence: The process of systematically evaluating information to identify vulnerabilities threats, and issues relating to an organization’s overall risk.

• Example:– Due care: Installing Antivirus software– Due diligence: Keeping Antivirus signatures updated

64

65

Examples of Major Computer Crime Laws

• PATRIOT Act• Electronic Communications Privacy Act• Computer Fraud and Abuse Act• National Infrastructure Protection Act of 1997• Computer Security Act of 1987• Computer Crime Research Center (http://www.crime-

research.org/legislation/)• Council Of Europe - Convention On Cybercrime (Ets

No. 185)• Convention On Cybercrime (Budapest, 23.Xi.2001)

66

Laws, Directives, and Regulations

• Gramm-Leach-Bliley Act of 1999• Requires financial institutions to develop privacy notices and give

their customers the option to prohibit financial institutions from sharing their information with nonaffiliated third parties

• Requires:• The board of directors to be responsible for security issues

within financial institutions• Risk management• Training to all employees on information security issues• Test security measures implemented• Written security policy

67

Laws, Directives, and Regulations

• Computer Fraud and Abuse Act• The primary U.S. federal antihacking statute.• Prohibits seven forms of activity and makes them federal crimes

• Federal Privacy Act of 1974• Applies to records and documents developed and maintained by

specific branches of the federal government.• An actual record is information about an individual’s education,

medical history, financial history, criminal history, employment, and other similar types of information.

• An agency cannot disclose the information without written permission from the individual

68

Laws, Directives, and Regulations

• Computer Security Act of 1987:• Requires U.S. federal agencies to identify computer systems

that will contain sensitive information• Develop security policy and plan for each of these systems• Conduct periodic training for individuals who operate,

manage, or use these systems• Security awareness training and define acceptable computer

use and practices

• Economic Espionage Act of 1996• Provides the necessary structure when dealing with industry

and corporate espionage and further defines trade secrets to be technical, business, engineering, scientific, or financial

LawOffense Section Sentence

Obtaining National Security Information (a)(1) 10 (20) yearsAccessing a Computer and Obtaining Information (a)(2) 1 or 5 (10)

Trespassing in a Government Computer (a)(3) 1 (10)Accessing a Computer to Defraud & Obtain Value (a)(4) 5(10)

Intentionally Damaging by Knowing Transmission (a(5))(A) 1 or 10 (20)

Recklessly Damaging by Intentional Access (a(5))(B) 1 or 5 (20)Negligently Causing Damage & Loss by Intentional Access (a(5))(C) 1 (10)

Trafficking in Passwords (a)(6) 1 (10)Extortion Involving Computers (7) 5 (10

The maximum prison sentences for second convictions are noted in parentheses he maximum prison sentences for second convictions are noted in parentheses

Current US Legal Framework

• Difficulties in Prosecution

– Lack of Understanding• Judges, Lawyers, Police, Jurors

– Evidence• Lack of Tangible Evidence

– Forms of Assets• Magnetic Particles, Computer Time

– Juveniles• Many Perpetrators are Juveniles• Adults Don’t Take Juvenile Crime Seriously71

Computer Crime Challenge

72

Investigations

• Incident Response• Have policy and procedures in place for incident

response• Incident response team• Follow predetermined steps• Decide whether to conduct own forensics

73

Investigations

• Incident Handling• Procedures for how to handle all incidents• Related to disaster recovery planning• Contain and repair any damage caused by an

event or prevent any further damage• Linked to security training and awareness program• Become part of mailing list of the Computer

Emergency Response Team (CERT)

74

Investigations

• Forensics• A science and an art that requires specialized techniques for

the recovery, authentication, and analysis of electronic data for the purposes of a criminal act.

• Computer Forensics• Must be properly skilled• Work from a copy• Specialized tools• Chain of custody• Photograph crime scene

• Forensics Investigations Process

– Identification– Preservation– Collection– Examination– Analysis– Presentation– Decision

75

Investigations

Incident Investigators

• Network Analysis– Communication analysis– Log analysis– Path tracing

• Media Analysis– Disk imaging– MAC time analysis (modify,

access, create)– Content analysis– Slack space analysis– Steganography

• Software analysis– Reverse engineering– Malicious code review– Exploit review

76

Penetration Testing• Process of simulating attacks on a network and its systems at

the request of the owner, senior management.

• Uses a set of procedures and tools designed to test and possibly bypass the security controls of a system.

• Its goal is to measure an organization’s level of resistance to an attack and to uncover any weaknesses within the environment.

• Penetration tests can evaluate web servers, DNS servers, router configurations, workstation vulnerabilities, access to sensitive information, remote dial-in access, open ports, and available services’ properties that a real attacker might use to compromise the company’s overall security.

77

Penetration Testing• When performing a penetration test, the team goes through a five-

step process:

– 1. Discovery - Foot printing and gathering information about the target

– 2. Enumeration - Performing port scans and resource identification methods

– 3. Vulnerability mapping - Identifying vulnerabilities in identified systems and resources

– 4. Exploitation - Attempting to gain unauthorized access by exploiting vulnerabilities

– 5. Report to management - Delivering to management documentation of test findings along with suggested countermeasures

78

Penetration Testing• The penetration testing team can have varying degrees of

knowledge about the penetration target before the tests are actually carried out:

– Zero knowledge - The team does not have any knowledge of the target and must start from ground zero.

– Partial knowledge - The team has some information about the target.– Full knowledge - The team has intimate knowledge of the target.– A blind test is one in which the assessors only have publicly available

data to work with. The network staff is aware that this type of test will take place.

– A double-blind test (stealth assessment) is also a blind test to the assessor as mentioned previously, plus the security staff is not notified.

79

FASS Group

Enrique J. Gonzalez, MISCFE, CISSP

Forensic, Auditing, Security [email protected]

Jose A. Arroyo, MSMCSA, MCT, CEH

[email protected]

[email protected]

TalkToAnIT.com

Jose L. Quiñones, BSMCSA, MCT, CEH, CIE, GCIH, GPEN, RHCSA

[email protected]

[email protected]

CODEFidelio.org