5/17/2011. The. Why Do You Rob Banks? Targeting and Reconnaissance. New Pathways. ACCGNY Compliance Seminar. We re Not In Kansas Any More

Transcription

1 The Emerging Technology Compliance Risks ACCGNY Compliance Seminar Alex Simpson Eric M. Friedberg May 19, 2011 Why Do You Rob Banks? We re Not In Kansas Any More Anonymous Ready To Dump More HBGary s, Launch AnonLeaks Why Anonymous is attacking Visa, Gawker, Amazon, MasterCard, and PayPal. And what will happen next! DoD, Major Private Contractor Potentially Vulnerable in Cyber Attack HBGary s: DuPont, Other Firms Hit In Aurora Attack Targeting and Reconnaissance New Pathways Law Firms Public Relations Firms Other Related Parties 1

2 Spearphishing SQL Injection Day One Likely Day One State of Play C&C, Exfiltration made to resemble legitimate traffic: common ports and protocols Zero day malware, vast majority not detected by antivirus Malware incorporates randomly-generated information, to evade identification by signature or hash APT traffic encrypted or obfuscated Malware regularly updated Host-based malware may be packed or unpacked Response - Reverse-Engineering/Unpacking Law Enforcement Liaison Fuzzy and segment hashing Heuristics Keywords Signatures Exfiltration path 2

3 Web 2.0 Explosion The Big Three Links to Other Users Public Messages Private Messages Chat Photos Biographical Information Affiliations File Sharing People v. Fielding, 2010 WL (Cal.App. 3rd Dist., June 18, 2010). Geolocation 3

4 Can Be Key in Criminal Cases Investigating Anonymous Comments Traditional Technique of Following the Subpoena Chain Web Forum ISP Internet Subscribers After Jessica Binkerddrove under the influence and was involved in a 2007 car crash that killed her passenger, she and her defense attorney were hoping for probation. After the prosecutor produced photos from Jessica s MySpace page showing her partying with friends and wearing an outfit with a liquor company s T-shirt and bandoleers of shot glasses, the judge was convinced that she had shown no remorse for the tragedy and sentenced her to 5 years and 4 months in prison. Identifiable Accounts that Escape Anonymizers Evidence Gathering Murder Conviction Reversed for Failure to Properly Authenticate MySpace Pages The Maryland Court of Appeals reversed and remanded for a new trial the defendant's murder conviction for failing to properly authenticate MySpace pages. In a lengthy opinion, the Court found the trial judge abused his discretion in attempting to authenticate the social networking site's web pages of defendant's girlfriend through the lead investigator's testimony only. On the girlfriend's web page it stated, "FREE BOOZY!!!! JUST REMEMBER SNITCHES GET STITCHES!! U KNOW WHO YOU ARE!!" The defendant argued that the State failed to offer any extrinsic evidence describing MySpace, as well as indicating how the lead investigator obtained the pages in question and adequately linking both the profile and a posting threatening a key State's witness to the girlfriend. The Court found that the picture of the girlfriend, coupled with her birth date and location, were not sufficient "distinctive characteristics" on a MySpace profile to authenticate its printout. Court of Appeals decision - Griffin v. State, 2011 Md. LEXIS 226, (Md. Apr. 28, 2011) 4

5 Commonwealth v. Williams, 456 Mass. 857, 867, 926 N.E.2d 1162, (Mass., 2010.) Admission of MySpace instant messages intimidating a witness from an anonymous MySpace page purporting to be the page of the defendant s brother were not properly authenticated. [W]hile the foundational testimony established that the messages were sent by someone with access to [defendant s brother's] MySpace Web page, it did not identify the person who actually sent the communication. Nor was there expert testimony that no one other than Williams could communicate from that Web page. People v. Beckley, 185 Cal.App.4th 509, , 110 Cal.Rptr.3d 362, 365 (Cal.App. 2 Dist., 2010) Admission of MySpace photograph of witness flashing gang signs (to rebut her claim that she was not gang-affiliated) was error, because (i) the detective who downloaded the photograph could not testify from his personal knowledge that the photograph truthfully portrayed Fulmoreflashing the gang sign and... no expert testified that the picture was not a composite or faked photograph. Recent experience shows that digital photographs can be changed to produce false images....indeed, with the advent of computer software programs such as Adobe Photoshop it does not always take skill, experience, or even cognizance to alter a digital photo.... Even the Attorney General recognizes the untrustworthiness of images downloaded from the internet, quoting the court's warning in St. Clair v. Johnny's Oyster & Shrimp, Inc. (S.D.Tex.1999) 76 F.Supp.2d 773, 775that [a]nyone can put anything on the Internet. No web-site is monitored for accuracy and nothingcontained therein is under oath or even subject to independent verification absent underlying documentation. Moreover, the Court holds no illusions that hackers can adulterate the content of any web-site from any location at any time. Laying A Foundation for Authentication People v. Clevenstine, 68 A.D.3d 1448, 1448, 891 N.Y.S.2d 511, 514 (N.Y.A.D. 3rd Dept.,2009). Sustaining in rape case admission of MySpace instant messages where [i] both victims testified that they had engaged in instant messaging about sexual activities with defendant through the social networking site MySpace, [ii] an investigator from the computer crime unit of the State Police related that he had retrieved such conversations from the hard drive of the computer used by the victims, [iii] a legal compliance officer for MySpace explained that the messages on the computer disk had been exchanged by users of accounts created by defendant and the victims, and [iv] defendant's wife recalled the sexually explicit conversations she viewed in defendant's MySpace account while on their computer. Trace originating IP back to subject s computer Obtain subscriber information for the subject account Tie sent items to a PDA Time-line communications to book-end subject communication Get data for timeline from on-line repository or forensic review of hard drive, PDA Establish password-protected nature of the account Party to a communication testifies as to authenticity ESI Compliance Cloud Computing 5

6 Cloud Computing & Cloud Storage PRESERVATION CHALLENGES LINKS LINKS LINKS COMMENTS 6

7 Cloud Stack Contact Information Eric Friedberg Co-President, Stroz Friedberg Alex Simpson Vice President, General Counsel & Corporate Secretary, Reis, Inc x326 7