September 19, 2016 Steve Konecny CFE, CIRA, CEH, CRISC Hands on Hacking
Who Has Been Hacked Lately? 2 650, Million 128 Million 6.5 Million
Who Else Has Been Hacked? 3 CPA firms hacked MAJOR FOUR 1 Hacker by
What Makes You So Special? Who would want to hack me? Too Small Low Profile Little Financial Gain 4
5
Top Cyber Crimes 1.Tax-Refund / Payment Fraud 2.Account Takeover 3.Identity Theft 4.Theft of Sensitive Data 5.Theft of Intellectual Property 6.Ran omware 6 $
Attack Cycle 7 Identify key individuals & create profiles Gather public info Google search data Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks
Attack Cycle 8 Assess, research, build tools Network scanning tools nmap/zmap Scan Nessus Scan Maltego Develop network profiles OS versions, models, etc Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks
Attack Cycle 9 Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks Phishing Database & password exploits Social engineering & networking Weak controls Default accounts & passwords Dated software & patch exploits APTs & zero-day
Attack Cycle 10 Backdoors, tunnels Remote admin software Modify registry Application exploitation User enumeration New processes when booting Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks
Attack Cycle 11 Compress data Download/exfiltrate data from system Encrypt/ransomware Zombie/bot Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks
Attack Cycle 12 Modify or delete logs Change file names Change process names Change file modification & creation time Delete artifacts Scan Attack & Access Complete Mission Target Maintain & Escalate Cover Tracks
Video 13
Internal vs. External Threats Data Breach Investigations Report. Verizon. Percent of breaches per threat actor over time Partner Internal Collusion External (n=8,158)
Detection of Breaches Data Breach Investigations Report. Verizon. (n=6,133) Breach discovery methods over time Law Enforcement Fraud Detection Third Party Internal
Dated Software & Patch Exploits Some Methods 16 Phishing Social Engineering & Networking Database & Password Exploits Weak Controls Default Accounts & Passwords Advanced Persistent Threat & Zero-Day
17
18
Phishing 19 30% Open messages 12% Open attachments PayPal, eBay, Battle.net, AOL, and Runescape are the most common phishing sites Data Breach Investigations Report. Verizon.
20 Spear Phishing Fake CEO asks Finance Dept “Send Me the Money” Change Payment Method Mid-Project HR Dept Sends Out 1,000+ W2s of Employees Fool me once, shame on you. Fool me twice, shame on me. Fool me thrice? Right Method – Wrong Account No need to file taxes this year – someone did it for you!
Example CEO Fraud 21
Some Methods 22 Phishing Social Engineering & Networking Database & Password Exploits Weak Controls Default Accounts & Passwords Dated Software & Patch Exploits Advanced Persistent Threat & Zero-Day
23
Top 25 Passwords | 2014 & (new) 91% of passwords are Top 1, % of passwords are Top 10,000 Data Splash Most Popular Passwords of 2014, 2015 Datasplash.com password qwerty football baseball 11. welcome abc qaz2wsx 16. dragon 17. master 18. monkey 19. letmein 20. login 21. princess 22. qwertyuiop 23. solo 24. password 25. starwars password qwerty baseball 9. dragon 10. football monkey 13. letmein 14. abc mustang 17. access 18. shadow 19. master 20. michael 21. superman batman 25. trustno1
Passwords 25 Circumvent Reset Attack, brute force 2O ACCOUNTS MINUTES HACKED 1O in under
Encryption 26 Encrypt Outlook Files No need for passwords Backdoor opens all encrypted messages Encrypt Application Files Word, Excel, Compressed Files, etc Many have backdoors May 2012 Flash drive AND encryption code 27, 000 records lost in the mail
27