Karen McDowell, Ph.D., GCIH Information Security, Policy, and Records Office (ISPRO) June 2013 ANATOMY OF A HACK

Transcription

1 Karen McDowell, Ph.D., GCIH Information Security, Policy, and Records Office (ISPRO) June 2013 ANATOMY OF A HACK

2 Step 1: Do Reconnaissance Successful hackers are excellent researchers, diligent, and persistent They study our websites, our entries on social media, and other available information This stage is non-intrusive.

3 Step 2: Attract the Victim Send a spear-phishing Trick the victim into clicking on a link and giving away their PII Attacker is usually interacting with the system within five minutes of person clicking on

4 Step 3: Gain Control Install custom-made malicious software, exploiting a vulnerability* in the system Attempt to gain administrator credentials to go deeper into the network Establish one or more back doors to communicate with a command and control server (C&C) *Good reason to keep your computers and programs current and backed up!

5 Step 4: Exfiltrate Data & Conscript Exfiltrate intellectual property and/or your credentials to the C&C servers Conscript your computer for later use in other attacks like DDoS The theft of intellectual property in the US in the past year alone is measured in terabytes* of data

6 Overall: Cloak Source Hackers routinely penetrate major universities, routing attacks through them. Decentralized universities are porous and create perfect proxies. University employees are prime targets.

7 Where was the antivirus? Unfortunate that Symantec is taking a lot of heat for failing to detect NYT Antivirus is well known to be only a speed bump, yet you gotta have it. Hackers also use zero-day attacks*, which no antivirus can detect *attack that exploits a previously unknown vulnerability in a computer application

8 Crack passwords Hackers cracked and stole the corporate passwords for many Times employees Gained access to the personal computers of 53 employees, most of them outside The Times s newsroom Over 3-month period installed 45 pieces of custom malware

9 What did we learn? The Times wisely allowed the hack to go on for 3 months to learn the attackers methods and to prevent a return Good news! Companies under attack are taking the crucial step to pool their resources ú RSA Conference February 2013

10

11 Recent Major Attacks EMC s computer security unit RSA US Chamber of Commerce Wall Street Journal New York Times Apple & Microsoft Facebook & Twitter Federal Reserve Reuters & Sony Google

12 The RSA Hack: A Cautionary Tale The Human is the Weakest Link

13

14 Attack Vectors Spear phishing messages Phone calls target you at home USB Sticks left lying around anywhere Weak passwords, vulnerable machines Drive-by-Downloads Coupon Bars (there has to be a better way to do this)

15 Iranian Elections & US Bank Attacks Dear User, Add an alternate address to your account. You can use this to sign into your account, reset your password, and more Click on this link:

16 You Are a Target! Username & Passwords Harvestings Financial Extortion (Ransomware) Identity Hijacking Botnets Virtual Goods

17

18 How Can I Spear-Phish You? Let me count the ways! Average more than one a week Someone always responds All hackers need is one response

19 Notice the

20

21

22

23

24

25

26

27

28

29

30 30 Courtesy of Yale University

31

32 Wire Transfer Phish

33 Don t Be a Victim! Realize you are a target Know your adversary s tricks Take control of your online presence Forward to abuse@virginia.edu Just don t click on it Don t respond DELETE

34 What You Can Do! Check our Current Security Alerts & Warnings page and subscribe to the RSS Feed, or Follow us on Twitter, and/or for an answer or simply to report it. Delete the questionable by all means!

35 Vishing, VOIP, Smishing, QRishing Telephone tech support scams Your account needs updating Register for free prizes! Your credit card has been deactivated

36 QR Codes and QRishing

37 Do You Wanna Be a Money Mule?

38 Money Mule Offer Flatters Me

39 Part II of the Same Offer

40 Password Guesser out.12920:join: Oct 21 14:36:33 Guessed akovacs (/usr1/bin/badpasswd in! maxwell.passwd) [morrison].ab8khkzfzkcc out.12920:join: Oct 21 14:36:33 Guessed dsummers (/usr1/bin/badpasswd in! maxwell.passwd) [w0mbat] /P8idUdpMO/6Q out.12920:join: Oct 21 14:36:33 Guessed crockett (/usr1/bin/badpasswd in! maxwell.passwd) [bxxxsxxx] 2ULXddBrRGI.I out.12920:join: Oct 21 14:36:33 Guessed jlucas (/usr1/bin/badpasswd in! maxwell.passwd) [stealth] 6KIIfIlFO0qP6 out.12920:join: Oct 21 14:36:33 Guessed cminton (/usr1/bin/badpasswd in! maxwell.passwd) [Faustus] 6hiuZITiFmlX.!

41 Courtesy of Indiana University

42 Passphrases are just words Easy to remember My son only calls me when he needs money (without spaces) If I won the lottery, I would quit working (w/o spaces) Avoid famous sayings or quotes, like ú Give me liberty or give me death", ú To be or not to be-25" ú Four score and seven years ago"

43 Not less than 20 Characters Mixed characters (number, letter, symbol) I hope you all are enjoying this conference in 2013! without quotes My son only contacts me when he wants money!! with or without spaces Can you 35 tell the difference between a phish and a fish?

44 Length or Complexity? Length is much more powerful. First letter of each word My Prius uses too much gas in the winter for the password MPu2m8it* Add 3-4 character extensions to this root passphrase, like BoA! or Wf#

45 Easy to Do

46 Skype Calls from Anyone?

47 Three Golden Rules Verify unsolicited communication. Maintain strong passwords. Create a different password from each account.

48

49 Hacks on Hacks Zappos and LinkedIn, etc. Hackers steal passwords, send you a spear-phishing message purporting to be from hacked company Click here to reset your password!

50

51 Hackers for Hire Pavel Vrublevsky Owner of Russian payments firm ChronoPay

52

53 Anything Can Be Spoofed Allows users to call people while displaying a fake name Tor.com allows you to anonymize Wireless hot spots in hotel, airports, coffee shops, and other public places Firesheep, Kismet, other software lets anyone impersonate you

54 Defense-in-Depth on Mobile Verify SMS/text messages independently to avoid smishing Take initiative to update system and application software Know Remote wipe option 3/4G is safer than local wireless hotspots Disable or at least be aware of GPS and geotagging

55 Smishing GATEWAY BANK ALERT: Your card starting with 4138* has been DEACTIVATED. Please contact us at

56 Android, Blackberry, iphone Passcode ú Enable at least 4 digits ú Don t use 1234, or 0000, 2580, 5555, etc. ú Exceeding the number of allowed password attempts deletes all data Auto-Lock ú Locks the screen after a pre-set time period of non-use (consider 30 minutes or less) ú Passcode-lock enhances auto-lock

57 Are Market Place Downloads Safe? Do not click Install before you review. Do you want this app to have so much access to your information? Think before you app!

58 Tips to Protect Mobile Devices Click with care many tempting offers duplicate the look and feel of legit sites Do not respond to security alerts or password request s on your smart phone. They are usually fraudulent. Install an app security scanner on your phone or ipad

59 Mobile Phone Protection Lookout Mobile Security ú McAfee Mobile Security ú products/android.aspx Verizon Mobile Security ú Vipre Mobile Security ú

60 Greatest Threat to Smart Phones? About 113 smartphones are stolen or lost every minute in the US, with many of the thefts turning violent. In 2012, 1.6 million Americans were victimized for their smartphones ú These crimes have led to severe injuries and the loss of life Secure Out Smartphones there is a technical solution a kill switch

61 iphone, ipad Security Settings iphone: General tab > Restrictions > Enable Restrictions > Select Enable "Ask to join networks function on iphone ipad: Enable Data Protection ú Settings > General > Passcode

62 Find my iphone/ipod/ipad Find my iphone requires Apple icloud account and recent device Add other, older devices, once an account is setup find-my-iphone.html

63 Android Security Settings Internet > More > Settings > Block Pop-up Windows and Clear Cache, Cookie data often. ú Uncheck Remember Form Data Enable Location and Remember Passwords Always browse with if you login using any credentials

64 Wireless Network Tips Use WPA2 encryption on router Change the default SSID Change the default login and password Create strong passwords for all devices including printers Install an alternate DNS provider

65 Free Annual Credit Report Check your free annual credit report Not freecreditreport.com Check personal data for accuracy You will not receive a credit score, unless you pay for it Don t use a Debit card online!

66 Unforgettable from Australia Stay One Click Ahead and Outsmart the Scammers

67 We are the Weakest Links

68 STOP.THINK.CONNECT stopthinkconnect.org