1. Cyber Crime
Tanmay S Dikshit

3. Stage 1 Reconnaissance Finding out about the target
Scan a well known site and find the hosts around it (Port Scan)
Use of Botnets
Stage 1 Reconnaissance

4. Stage 2 Weaponization Target a specific or a group of targets
Exploit a vulnerability
Target a specific site
Stage 2 Weaponization

5. Stage 3 Delivery Infect a document to send via Email
Infect a website with a malware
Use stolen or default credentials
Identify flaws in exposed software
Stage 3 Delivery

6. Stage 4 Exploitation Exploit Software
Remote stream of packets to exposed host
Stage 4 Exploitation

7. Stage 5 Installation Payload executes and continues to execute.
Registry key that starts the software.
Stage 5 Installation

8. Stage 6 Command and Control
Attack may carry out action for long time
Payload may provide long term source of intelligence
Stage 6 Command and Control

9. Stage 7 Actions Depends on motives of attacker Defacement
Information theft
Money Theft
Stage 7 Actions

11. Case Study
Lockheed Martin- Computer Incident Response Team (LM-CIRT) March 2009
3 intrusions
Common Advanced Persistent Threat tactic
Use of Targeted malicious

12. Case Study LM-CIRT March 2009
APT tactic: A suspicious attachment
About: American Institute of Aeronautics and Astronautics (AIAA) conference.
Sender: Authorized employee
Receiver: Only 5 users

13. Intrusion 1 Email Header
Received: (qmail invoked by uid 60001); Tue, 03 Mar :01: Received: from [60.abc.xyz.215] by web53402.mail.re2.yahoo.com via HTTP; Tue, 03 Mar :01: (PST) Date: Tue, 03 Mar :01: (PST) From: Anne E... Subject: AIAA Technical Committees To: [REDACTED] Reply-to: Message-id: MIME-version: 1.0 X-Mailer: YahooMailWebService/ Content-type: multipart/mixed; boundary= "Boundary_(ID_Hq9CkDZSoSvBMukCRm7rsg)” X-YMail-OSG: Please submit one copy (photocopies are acceptable) of this form, and one copy of nominee's resume to: AIAA Technical Committee Nominations, 1801 Alexander Bell Drive, Reston, VA Fax number is 703/ Form can also be submitted via our web site at Inside AIAA, Technical Committees
Header
Intrusion 1

14. Intrusion 1 The email contained a pdf file which was actually:
a benign PDF and
a Portable Executable (PE) backdoor installation file.
encrypted using a trivial algorithm with an 8-bit key stored in the exploit shellcode.
On Installation:
C:\Documents and Settings\[username]\Local Settings\fssm32.exe
Opens the benign pdf
The pdf is same as what was available on AIAA website at
The attack
Intrusion 1

15. Intrusion 1

16. Intrusion 2 Email Header
Received: (qmail invoked by uid 60001); 4 Mar :35: Message-ID: Received: from [216.abc.xyz.76] by web53411.mail.re2.yahoo.com via HTTP; Wed,04 Mar :35:20 PST X-Mailer: YahooMailWebService/ Date: Wed, 4 Mar :35: (PST) From: Anne E... Reply-To: Subject: 7th Annual U.S. Missile Defense Conference To: [REDACTED] MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=" =:97248" Welcome to the 7th Annual U.S. Missile Defense Conference
Header
Intrusion 2

17. Intrusion 2 The email contained a pdf file which was actually:
a benign PDF MDA_Prelim_2.pdf and
a Portable Executable (PE) backdoor installation file.
encrypted using a trivial algorithm with an 8-bit key stored in the exploit shellcode.
On Installation:
C:\Documents and Settings\[username]\Local Settings\fssm32.exe
Opens the benign pdf
The pdf is same as what was available on AIAA website at
The attack
Intrusion 2

18. Intrusion 2

19. Intrusion 3 Email Header
Received: (qmail invoked by uid 1000); Mon, 23 Mar :14:
Received: (qmail invoked by uid 60001); Mon, 23 Mar :14:
Received: from [216.abc.xyz.76] by web43406.mail.sp1.yahoo.com via HTTP; Mon,
23 Mar :14: (PDT)
Date: Mon, 23 Mar :14: (PDT)
From: Ginette C...
Subject: Celebrities Without Makeup
To: [REDACTED]
Message-id:
MIME-version: 1.0
X-Mailer: YahooMailClassic/ YahooMailWebService/
Content-type: multipart/mixed; boundary="Boundary_(ID_DpBDtBoPTQ1DnYXw29L2Ng)"
< body blank>
Header
Intrusion 3

20. Intrusion 3 The email contained a powerpoint file which was actually:
a malicious power-point file exploiting a Microsoft zero-day exploit
Exploit was publicly acknowledged after 10 days
Microsoft released a patch after a month
The attack
Intrusion 3

21. Intrusion 3

22. Cyber Security Intelligence-Driven Computer Network Defense
Adversary Campaigns Analysis
Intrusion Kill Chains