1. “Can You See Me Now?” Shining the Light On Hackers & Identity Thieves
Lew Wagner, CPP, CISSP
ASIS International
Information Technology Security Council
Copyright August 22, 2007

2. What? Me worry? Correlation Wireless Intrusion Detection Firewall
Content Mgmt
Anti-Virus
Scanning Tools
AirSnort
Bots
Kismet
MetaSploit
Phishing
War Driving
DDoS

3. Introduction Purpose Threats to Information Systems Reactive Security
Case Studies
Reactive Security
Proactive Security
Conclusion

4. Purpose
Inform - Provide you with hacker and identity theft threats, safeguards, and examples
To help you analyze and make more informed decisions on:
Current in-place reactive and proactive security environments and
Detecting and planning for dynamic threats to your network and systems
Author’s identification of security industry vendor products is for instructional purposes only

5. Security Threats

6. MetaSploit - Uber Hacking Tool

7. Bots
Bots and botnets – series of “zombied” (compromised hosts) used by hackers who remotely control them for denial of service and other illegal activities
Detection is getting harder to achieve as these hackers are creating ways to disguise “mother ship” controller PC’s
SD.BOT and all its variants are a prevalent example of this category

8. Denial of Service (DoS)
DoS attacks – a victim’s external IP addresses and ports are flooded with thousands of half open connections thereby tying up that port from being used by legitimate users and customers
Distributed DoS (DDoS) attacks used hundred and thousands of slaved “zombie” PCs to flood a large victim’s multiple internet sites and ports thereby preventing the victim from communicating over the internet.
Often used as a threat if the victim doesn’t pay a ransom or by competing companies/ countries to hurt other entities economically

9. Phishing
Phishing attackers host content (either via or a website) to lure unwitting users into divulging personal information that can then be used by the attacker to fraudulently use (identity theft)
The stolen personal identity information can be used to either purchase goods and services under the victim’s name or take out funds from the victim's account.
Such phishing web sites are made to look like actual business site (e.g., Wells Fargo or eBay)
They are mostly financial web sites that are spoofed

10. Phishing (Cont.)
Source:

11. Phishing (Cont.) Phishing is the act of sending an email
The Consumer Reports National Research Center estimated people lost $630 million in the last two years in phishing scams.
Most anti-phishing browsers are ineffective (Source: Schecter, Dhamija, Ozment, Fischer; The Emperor’s New Security Indicators - An evaluation of website authentication and the effect of role playing on usability studies, joint Harvard & MIT white paper, May 20-23, 2007 in Oakland, California at 2007 IEEE Symposium on Security and Privacy)

12. KISMET-Wireless Sniffer

13. Yagi Wireless Directional Antennae

14. Reactive Security Tools

15. Firewall Reporter-Firewall

17. Checkpoint-Firewall

19. Snort - Network Intrusion Detection
Snort Network IDS (NIDS) server just behind firewall
Logged Events “snap-shotted” (73,453 events in 24 hr period)
All observed traffic coming from firewall (inside interface) into organization
All observed traffic coming from inside organization out to the firewall

21. 48 Security Event Types

22. Sample BASE Report

23. Attacks by Class

24. Most Common Attacks

25. Symantec-Anti-Virus

27. Proactive Security Tools

28. Tipping Point - Network Intrusion Prevention

32. AirDefense-Wireless Security

36. WCS-Wireless Control System

39. AppDetective-Spotting Database Weaknesses

42. WebInspect-Internet

46. Correlation Analysis Putting it all together
Compromising “trusted” connection systems
Threats from all vectors
As seen by multitude of security sensors
Too many single reporting devices to look at each individually and see “big picture”
“If this even, and this event, and that event, then the correlated impact is this”

47. Correlation Analysis

50. Conclusion
Technical threats to your infrastructure are pervasive and frequent
Simply installing a firewall and an antivirus solution is not enough
Extensive correlation of large quantities of security data is needed.
Dynamic defense in depth is needed to detect, assess, and mitigate today’s multi-vector attacks.

51. Contact Information
Lew Wagner:
Pres & CEO, Dynamic Defense In Depth, Inc.
( )
(317) (Cell Phone)