Chapter 1 Real World Incidents Spring Incident Response & Computer Forensics

What is an Incident?  Event: An observable occurrence in a system or network. --NIST  Incident: Violation or threat of violation of computer security policies, acceptable use policies, or standard security practices. --NIST

What is Incident Response?  Confirm whether or not an incident occurred?  Provide rapid detection  Determine and document the scope  Prevent a disjointed, non-cohesive response  Minimize disruption  Minimize damage  Restore normal operations  Allow for criminal or civil actions against perpertrators  Educate  Close loopholes

Case Study #1  Used SQL injection vulnerability  Webserver was located in a DMZ  Executed commands on the backend database system  Carried out extensive reconnaissance  Implanted a backdoor  Extracted and cracked password has for local administrator account on internal DB server  Thus, gained accesses to most systems  Installed keystroke-logging malware  Obtained password hashes from multiple systems belonging to administrators

Case Study #1  Found passwords for all users on the domain in a domain controller  Implanted more than 20 backdoors  With malware, modified the executables to avoid antivirus detection  The malware family allowed the attacker full control over the victim system, file upload/download capabilities, etc.  Stole data on many occasions  Found where sensitive networking documentation was stored  Found information on where financial data are stored

Case Study #1  Established RDP connections  Used FTP to download data  Also installed backdoors to transfer data  Used data compression techniques to avoid detection  Few months later discovered the jump server (the only system that can access sensitive resources)  Carried out reconnaissance on financial environment  Detected 90 systems that processed or stored credit card information  Proxied traffic from the jump server to mail server (since the latter had direct internet access)

Case Study #1  Executed pslist to find out running processes  Dumped memory contents of multiple processes  Found unencrypted cardholder information  Over three months, downloaded millions of instances of cardholder data from all 90 systems  About 10 months after the attacker breached the system, a sys admin noticed that the mail server communicating over TCP port 80 with an IP address in a foreign country