Incident Response: The First 10 Minutes Matt Bing Incident Response Coordinator The University of Michigan

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 2 Who am I? 10+ years experience in IT security 2 years at U-M  ITSS (IT Security Services)  Incident Response Coordinator tEnsure consistent handling of serious incidents University-wide tExpert advice – computer forensics, network and malware analysis Please understand due to confidentiality, I will not be discussing real incidents

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 3 Agenda What is an incident? Incident lifecycle First steps in incident handling Tools What you can do

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 4 What is an incident? IT security incidents have three faces  Data - attempted or successful unauthorized access, use, disclosure, modification, or destruction of information  Resources - interference with IT operation  People - violation of explicit or implied policy Impact  Not all incidents are equal

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 5 Goals of incident response Minimize consequences of incidents Enable informed decisions to be made by appropriate stakeholders  Not just an IT problem Understand the cause and effect of an incident Incorporate lessons learned  Processes and procedures  Countermeasures

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 6 Incident lifecycle Phase 1 – “The first 10 minutes”  Notification  Initial assessment  Escalation  Containment Phase 2  Analysis  Further action  Lessons learned

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 7 First steps Notification  First signs of an incident  IDS alert / abuse report / user notification  Amount of information is typically low Initial assessment  What is the possible impact?  How confident are you this is an incident?  Almost always requires further investigation

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 8 Risk of actions Availability of data goes down as your understanding of an incident goes up  File system MAC times are overwritten  Logs are rotated  Attackers cover traces  Examining a system changes it, possibly destroying valuable volatile data  Can that crucial deleted log entry in slack space be overwritten? Every action taken when examining an incident is a risk benefit/decision  Increasing level of intrusiveness

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 9 Risk of actions Does pulling the network cable have no risk? while `true`; do ping -c 1 || rm -rf /; sleep 30; done What about pulling the power cable?  Lose ALL volatile information on the system  Active processes, network connections

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 10 Initial assessment Scenario  We receive an abuse from Merit that a Windows XP machine on our network ( ) is generating a large amount of traffic. We don’t know what could be causing this, but this machine might contain student SSNs.  How do we determine with a high-degree of confidence whether this machine is compromised?

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 11 Portscan

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 12 Portscan

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 13 Portscan

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 14 Portscan Nmap  Netcat  Risks: depends entirely on the services probed, possibly modified MAC times on daemons, or generated log entries

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 15 TCPView

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 16 TCPView

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 17 TCPView  Risks: copied a binary to the system and executed it  Can we trust the output if there is a rootkit installed?  Requires Administrator access, was a keyboard sniffer installed when we logged on?  Modified registry if run from USB or CDROM  Utility installs new system device driver  New entry in Prefetch cache

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 18 Event Viewer

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 19 Event Viewer Risks: modifies access time on MMC.EXE, file containing event logs %windir%\SYSTEM32\config\*.evt

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 20 Virus Scan Identifies any potential malicious code on the system, but…. Risks: overwrites the Access time on all files scanned  High level of intrusiveness

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 21 What next? Escalation  Notify the appropriate business owners  Devise a containment plan together  Explain the risks Containment  Pull the network plug?  Add a firewall rule or router filter?

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 22 After the first 10 minutes Analysis  What other information about the system do you have?  Netflow, firewall, antivirus logs  Analyze to determine root cause and effect  Escalate to other stakeholders, as necessary Further action  Notification to affected individuals?  Involve law enforcement? Lessons learned

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 23 Other tools EnCase  Helix  VMWare  http :// IDA Pro 

I NFORMATION T ECHNOLOGY S ECURITY S ERVICES 24 What you can do Develop a toolset Stay current in the security community Identify critical systems and locations of sensitive data Know your business owners Introduce yourself to law enforcement

Questions / Comments Thank You