“Can You See Me Now?” Shining the Light On Hackers & Identity Thieves Lew Wagner, CPP, CISSP ASIS International Information Technology Security Council lew.wagner@comcast.net Copyright August 22, 2007

What? Me worry? Correlation Wireless Intrusion Detection Firewall Content Mgmt Anti-Virus Scanning Tools AirSnort Bots Kismet MetaSploit Phishing War Driving DDoS

Introduction Purpose Threats to Information Systems Reactive Security Case Studies Reactive Security Proactive Security Conclusion

Purpose Inform - Provide you with hacker and identity theft threats, safeguards, and examples To help you analyze and make more informed decisions on: Current in-place reactive and proactive security environments and Detecting and planning for dynamic threats to your network and systems Author’s identification of security industry vendor products is for instructional purposes only

Security Threats

MetaSploit - Uber Hacking Tool

Bots Bots and botnets – series of “zombied” (compromised hosts) used by hackers who remotely control them for denial of service and other illegal activities Detection is getting harder to achieve as these hackers are creating ways to disguise “mother ship” controller PC’s SD.BOT and all its variants are a prevalent example of this category

Denial of Service (DoS) DoS attacks – a victim’s external IP addresses and ports are flooded with thousands of half open connections thereby tying up that port from being used by legitimate users and customers Distributed DoS (DDoS) attacks used hundred and thousands of slaved “zombie” PCs to flood a large victim’s multiple internet sites and ports thereby preventing the victim from communicating over the internet. Often used as a threat if the victim doesn’t pay a ransom or by competing companies/ countries to hurt other entities economically

Phishing Phishing attackers host content (either via email or a website) to lure unwitting users into divulging personal information that can then be used by the attacker to fraudulently use (identity theft) The stolen personal identity information can be used to either purchase goods and services under the victim’s name or take out funds from the victim's account. Such phishing web sites are made to look like actual business site (e.g., Wells Fargo or eBay) They are mostly financial web sites that are spoofed

Phishing (Cont.) Source: http://atlas.arbor.net/summary/phishing?out=csv

Phishing (Cont.) Phishing is the act of sending an email The Consumer Reports National Research Center estimated people lost $630 million in the last two years in phishing scams. Most anti-phishing browsers are ineffective (Source: Schecter, Dhamija, Ozment, Fischer; The Emperor’s New Security Indicators - An evaluation of website authentication and the effect of role playing on usability studies, joint Harvard & MIT white paper, May 20-23, 2007 in Oakland, California at 2007 IEEE Symposium on Security and Privacy)

KISMET-Wireless Sniffer

Yagi Wireless Directional Antennae

Reactive Security Tools

Firewall Reporter-Firewall

Checkpoint-Firewall

Snort - Network Intrusion Detection Snort Network IDS (NIDS) server just behind firewall Logged Events “snap-shotted” (73,453 events in 24 hr period) All observed traffic coming from firewall (inside interface) into organization All observed traffic coming from inside organization out to the firewall

48 Security Event Types

Sample BASE Report

Attacks by Class

Most Common Attacks

Symantec-Anti-Virus

Proactive Security Tools

Tipping Point - Network Intrusion Prevention

AirDefense-Wireless Security

WCS-Wireless Control System

AppDetective-Spotting Database Weaknesses

WebInspect-Internet

Correlation Analysis Putting it all together Compromising “trusted” connection systems Threats from all vectors As seen by multitude of security sensors Too many single reporting devices to look at each individually and see “big picture” “If this even, and this event, and that event, then the correlated impact is this”

Correlation Analysis

Conclusion Technical threats to your infrastructure are pervasive and frequent Simply installing a firewall and an antivirus solution is not enough Extensive correlation of large quantities of security data is needed. Dynamic defense in depth is needed to detect, assess, and mitigate today’s multi-vector attacks.

Contact Information Lew Wagner: Pres & CEO, Dynamic Defense In Depth, Inc. lew.wagner@comcast.net (E-Mail) (317) 502-1667 (Cell Phone)