Coast to Coast - An Incident Response Article

Disclaimer:
The following is an account of an intrusion event that I handled many years ago. I am no long involved with any of the parties mentioned in this article.

The client targeted was a financial institution and, here, will be called "the Bank." Some techniques and details of this incident will be omitted, for obvious reasons. The names and specific locations have also been changed. There are different ways people conduct incident response and handling. That's why there are 31 flavors of ice cream.

Tuesday morning started off like any other day. I was sitting in my office with my morning cup of coffee when my phone rang. My boss stated that he had received a call from a client, the Bank, stating that they were being attacked by hackers. Until that day, I had no working knowledge of the Bank's infrastructure nor did I know if the staff had the experience or expertise to correctly identify an actual attack versus a port scan, probe, virus, etc. Through my experiences working in security, I have come to realize that a lot people use buzz words like "hackers" to identify events that they do not thoroughly understand.

The initial information I had was sketchy at best. I learned that the Bank had firewall on the front end along with a NIDS and were in the process of implementing the ASA solution into the infrastructure. I contacted the Chief Information Officer of the Bank as I grabbed my laptop bag and headed to their corporate office. I wanted to get a first-hand assessment of their current situation. The information he provided told me they were experiencing something more than just a simple port scan or viral annoyance.

The CIO stated that they were having trouble with an attacker continually modifying the Bank's customer login portal. They believed this modified page was allowing the attackers to collect the Bank's customers ATM information in order to create duplicate ATM cards. Branch transactions reports showed that the attackers were successfully withdrawing customers' funds. The Bank was initially alerted to the attacks when customers started reporting unauthorized ATM withdrawals from their accounts. The CIO said he had a "band aid" solution in place, but they really needed to identify the method of entry and stop the attack. The temporary solution had decreased the frequency at which the page was being modified but had not stopped the attack completely. As I pulled into the corporate office, I knew the next several hours were going to be interesting.

During a quick meet and greet with the staff and management in the conference room, I needed to start the flow of information quickly and begin delegating collection tasks. Since the staff had not identified the point(s) of entry, I requested a network diagram of the infrastructure including all branches and especially all network entry points into the network. Additionally, I requested a copy of the firewall logs and configuration, router configuration, access logs, IDS log, IIS log, event logs from the web server, and SQL logs. On the positive side, most of the logs appeared to intact and the history of some spanned back several months. I asked for two copies of each log, the first copy containing the last 12 hours of activity and the second copy, the complete log.

While the reports were being generated, I questioned the staff about the information they knew for fact. Speculation during the information gathering phase can cause more trouble than good, leading to a wild goose chase and a loss of focus on the facts. The M.O. described by management and the staff suggested this was a fairly complex operation that consisted of a group or multiple persons being involved.

The staff stated that they had experienced an identical attack the previous year that resulted in a reported loss of around $30,000 in unauthorized ATM withdrawals. This resulted in the staff making various changes to the firewall configurations, the introduction of IDS monitoring, and changes to other system and network devices. The attacks ceased after these changes were made so the problem was thought to have been corrected. The current attack cycle had resulted in the loss of approximately $25,000 and growing so time was a luxury that could not be afforded. The initial attack profile developed by the staff from the previous and current attacks showed that within 10-20 minutes of the customer's financial information being collected, the attackers were making an ATM withdrawal from their account. The withdrawals were in the amount of the maximum withdrawal limit set by the Bank of $400 per day. In the event there were insufficient funds in that account, the attackers repeated the process on the next forged ATM card. This method was verified via the ATM surveillance cameras. In order to slow the attackers, the Bank suspended all ATM transactions city-wide in Anyplace, Florida, where the unauthorized transactions were occurring. The unauthorized transaction began again shortly afterward in Anywhere, California. ATM surveillance cameras and transaction reports confirmed the attacker at that location was using the same M.O. that was used in Florida.

The staff installed an automated webpage publishing program that would monitor the content of the customer login portal periodically and republish the original when the modified page was found. The stop-gap measure worked for a couple of hours until the attack frequency changed. At this is point, the Bank decided to seek outside help, and I was called.

Presented with these facts, I began to sift through the growing pile of logs, documents, and diagrams. As it stood, the source of the attack could be coming from the Internet but could also be internally based or backdoor method. Several infrastructural changes had been recently added, that had not been documented on the master diagram and was being updated on the fly. A modem bank resided on the network but was ruled out because it was disabled and used for vendor remote access. The diagram showed that VPN tunnels connected each branch back to corporate. There were only two connections to the Internet, a primary and alternate for DR purposes. The backup connection was verified as being inaccessible externally. The web server was segregated on a network apart from the corporate network and fed by a SQL server located within the corporate network. Once all the requested logs were collected, I started a Nessus scan on the internal network to help locate any possible servers, services, or undocumented communication devices that could be the source. Multitasking and efficiency is the name of the game.

The firewall logs did not show any signs of malicious traffic coming through. Review of the IDS logs did not provide any finger pointing either. The reason for this will be covered later. Additionally, the firewall configuration did not contain any "ANY" source/services rules or configuration error. The router logs did not provide any useful information. Doing any type of event correlation was beginning to look bleak. The IIS logs were the largest and took the longest to acquire because they had to be burned to disc. I started searching through the web server logs looking for any instance where the customer login portal page was requested. Due to its function the search returned several thousand entries. Buried deep within the thousands of entries was a HTTP request containing "xp_cmdshell." Utilizing this SQL Extended stored procedure function, a FTP GET request was made to a remote server which published the modified page on the web server. This had to be addressed but it did not explain why the firewall or IDS did not log or alert on it. The source IP address of that HTTP request came from the external interface of the firewall. A follow-up status meeting was called to realign the response focus.

I disclosed my findings to the staff and was informed that one of the undocumented infrastructure changes made was that IIS and SQL resided on the same server. The SQL server was moved to the web server based on a recommendation made by their own "security" person, whom I later found out was fired for hosting a porn server on the Bank's network. (Go figure.) Now that the method had been identified, the next step was to see how bad the configuration was and fix it.

Reviewing the permissions on the IIS/SQL server revealed a host of default permissions both with system security, IIS, and SQL. Oddly enough, the permissions on the IIS log directory were set appropriately. I can only guess that either the attackers could not access the logs, did not know how, or did not care. I was able to separate the web server and SQL server fairly quickly using a secure build document and security checklist. There were also some required coding changes made by their developers. Once everything looked good and tested out with both servers, I began investigating the mystery questions.

Why did the web server show the source address as the firewall when it was on a separate segment? Apparently the IIS server originally resided within the corporate network, and when it was moved, the table of the router was never updated. Traffic destined for the web server was forwarded to the firewall, which in turn forwarded it to the web server. It was one of those weird routing situations that you'd think wouldn't work, but it does. Long story short, was that the routing table was updated.

Why the IDS system did not alert on any of these attacks? The IDS system was implemented upstream between the firewall and the router, a choice location. However it was connected to a switch which did not support spanning. The staff incorrectly "proved" the IDS functionality by attacking the device directly. As a temporary solution to having a network tap, the switch was replaced with a hub until an upgraded solution could be implemented. It's not the cleanest of solutions, but it worked in the interim.

Why the firewall did not show any signs of this traffic? The firewall was not configured to log successful inbound connections. It did log successful outbound traffic and I was able to rule out the source of the attack originating from within the corporate network. Connection logging can fill log space on a device very quickly, and this was the case here. I mitigated this by configuring a remote syslog server for the firewall and router logs.

In summary, I located the source of the attacks later that day. It turned out be a compromised server in Sweden owned by an excavation company. I notified them of the intrusion and asked if they would look into it. I tracked down the source of the modified customer login portal page, which was located on one of those "free hosting" sites based in of Tennessee. I sent them a similar request. The Bank stated that they were not going to pursue the attackers even though they had video from the ATM machines and lost over $50,000. They felt that the negative PR was not worth it. Management also said they had been told by the local FBI office in so many words that unless it was over $100,000, the FBI really would not get involved. That statement was never verified.

This insecurity could have been identified more quickly if I had received the web server logs in the beginning, but that was the hand I was dealt at the time. Hindsight is always 20/20. On the days to follow, the attackers attempted the same exploit and many other variants, scans, and probes but were never successful. It would have been nice if, given the opportunity, to identify and catch this group. However, it did make for an interesting day, fighting the bad guys.

Have questions or would like to find out more information, visit: http://www.idgsecurity.com
Intrusion Defense Group, LLC. Copyright 2010

Shawn Guins
CISSP, EnCE

A Guide to Protecting Your Wireless Network

One of the best things about a wireless network, whether you are at home or at work is that you no longer have to watch out for trailing cables wherever you go. However this does come with its own associated risks, not least that a number of networks are completely unprotected, i.e. they don't need passwords or anything else for you to be able to hook up to that network.

Pubs and restaurants, even fast food places like MacDonald's, have what are known as wireless hotspots, that is to say they have a wireless network that anyone in the vicinity with a computer can log on to without any issues; this is because the network because it is not password protected. Although protecting a personal wireless network is not too difficult, in fact most providers will provide walkthrough guides with the installation drive they provide; however, when it comes to a business wireless network, you need professional support.

The two most important issues concerning wireless networks are how the network is configured and installed. Protecting your network is extremely important as it is too easy for hackers to get in and install a virus on an unprotected network, and that virus could cause considerable harm to your business and its associated data.

A professional internet security service will ensure that you have the right kind of computer protection program, for example MacAfee solutions. For a home computer something like AVG is perfectly adequate and identifies dangerous or suspicious sites before you enter them. Of course there are a huge number of other companies out there offering their own unique content, including Symantec and Norton, so home protection is remarkably straightforward and shouldn't cost you too much either.

If you intend to have a lot of computers on a network then the least problematic option is to have structured cabling installed as this helps communication and makes data available to all those employees who have clearance. Once the structured cabling is installed the routers and switches need to be configured and installed. The routers need to be in a central location so all machines are able to access it equally. The router is then connected to the power source and the internet source. Routers should have RS-232 serial ports in case dial up internet services are ever needed. You will also need to connect a wired router or hub. Modern computers have built in wireless adaptors.

Once you have sorted out the routers choose a name for the network the router transforms the data from the internet into a wireless form. The router manufacturer will already have set a generic name but you need to change that to one of your choice as it is safer - this is known as an SSID or service set identifier. These settings need to be the same for every computer on the network. Once that is done you need to install and configure the firewall and other security options such as a virus programme and a spam filter for the email. IP telephones (internet provider phones) need to be installed and configured.

Of course if your business does have its own IT or networking support, you can have them perform the full installation on your behalf. This will help ensure that it is done correctly and remove the risk of any future issues or breaches in security.

Derek Rogers is a freelance writer who writes for a number of UK businesses. For information on Network Support Services, he recommends Network 24.

Change IP to Guard Your Privacy on the Internet

To change IP addresses has recently become quite common in households and businesses. Because of a lot of problems which usually root from the internet, keeping your privacy in the cyberspace is very important. Of course, everybody would want to keep their confidential and personal records private. However, with the continuously developing technology, even simple IP addresses can be a way for other people to steal your identity.

Identity theft, as we all know, is something that we should consider with utmost importance. It has been damaging a lot of people's lives over the past years, stealing not only their names, but also their lives. Most of these identity theft cases start from the internet, which only shows that people should be cautious in using the cyberspace. In this case, to change IP addresses is one solution to keep your privacy in the Internet.
Why change your IP address?

Aside from keeping your privacy, changing your IP address has a number of benefits.

• It keeps your real location be hidden from other people. Since IP addresses reveal a certain geographic area, a change in the IP address will show other people that you are from another country, city or continent, effectively protecting your private location.

• It keeps your identity anonymous, which makes hackers bump a dead end should they want to access your personal information through the Internet.

• It keeps you safe and protected whenever you shop online and make transactions over the internet. With this, all your personal and financial information are kept safe since hackers won't be able to trace the real you in the real world, keeping you safe from the dangers of identity theft and preventing you from losing millions of dollars through your lifetime.

• It keeps you safe from those annoying mailing lists and spam mails which flood your email accounts. By keeping your anonymity in the cyberspace, they would not have any way of tracing you and connecting your cyber information with real information.

Why surfing anonymously gives you peace of mind

To change IP addresses gives you the advantage of losing hackers and identity thieves away from you. As we all know, the Internet is now a repository of information all over the world. Although the chances of your identity being stolen by thieves, and your information being gotten by other people are slim, it is still better to be safe than to be sorry in the long run.

Identity theft has caused individuals and businesses lose millions of dollars each year, and it takes years to repair the damage that identity theft has caused to you. Surfing safely in the Internet gives you extra protection from causing lifetime damage from identity theft and other cyber crimes lurking nowadays. Moreover, you also get to protect not only your identity, but also your family's identities - just by simply changing your IP address. You get to have peace of mind knowing that your children won't have problems in the future because their personal information was stolen by somebody who has tracked down your IP address.

In order to learn more about Change IP and learn how you could try out a unique software solution free go to blog post http://www.change-ip-proxy.com/blog/change-ip/change-ip-and-protect-your-online-identity/

For Virus Removal Virus Protection is Essential

There are many subtle signs of a computer virus that a casual computer user may not even notice at first. Some of those subtle signs can be like the computer starting to freeze up for no apparent reason or the screen appearing to blink all of a sudden. For many computer users these small clues can go undiscovered and the next thing they know the computer has locked up on them or is doing bizarre things. Programs closing without being prompted, screens popping up stating a specific removal virus program must be purchased to remove the virus they are saying the computer has and other bizarre and unspecified problems are just a few examples that may happen when a virus truly is infecting the computer. Some viruses are able to take control of the desktop locking the user out and taking away the control. Viruses of this nature can be very difficult to identify and even harder to remove.

Removal virus programs are available that can alert the user the virus has found its way on the computer and in addition to removal virus protection programs are recommended to prevent them getting on in the first place. Much of the time a new or refurbished computer when purchased will have a trial period for a computer security protection program giving the purchaser an opportunity to try out the software program and to realize the importance of having one.

Leaving a computer vulnerable to the internet and its capacity to pass viruses on to other computers undetected can destroy the computer and leave the owner wondering what happened. Protect your interest when getting a computer and make sure it has the same assurance of protection one would want for their automobile especially if running a business.

For more information on viruses and removing them, visit RemovalVirusHelp.wordpress.com

From J. Pal, a freelance writer on a wide variety of topics.

While Surfing the Internet, Don't Send Your Personal Data Out to Sea

You're reading this article on the Internet, right? Probably been surfing for a while, checking a few blogs, maybe doing some online shopping. Fun stuff. Just keep in mind that while you're surfing the 'net, don't toss your personal data out to sea where it's available for anyone to view, or worse, use.

This article lists a few precautionary tips for keeping your private data private while using the Internet:

• When you register for an email account, don't use your home address, private phone number, or other personal information. Instead, use a personal mailbox address, a work phone number, etc. Keep in mind there are online services that sell people's registration information to anyone.
• It's a good idea to have a "throw-away" email address that you use for online shopping, forms that require an email address, etc. You can set up such email addresses at Hotmail, Yahoo, Gmail, others (although you're required to register your data at these sites, you can sign up as Mickey Mouse at 1234 Big Ears Circle for all they care). Hushmail is another option (check out hushmail.com).
• Choose an e-mail account that does not reveal unnecessary information about you, such as where you attend school. For example, an e-mail address from a free Webmail service might be preferable to one with a .edu domain.
• Choose unusual passwords and change them regularly. Make passwords at least 7 letters long and include numbers mixed with meta-characters when possible (for example, s*72wt#8%). Never share your passwords with anyone.
• Don't open unsolicited or unknown email messages, and especially don't open any attachments from unknown users.
• Consider using an anonymous web browser. This will make it impossible for your web-surfing to be logged by websites, thus preventing others to pick up any information on you. Information on this service is located at http://www.anonymizer.com.
• When you register for a domain (your website address), don't use your home address or other personal information. Anyone can look up the owner of a domain name by using a service such as http://www.checkdomain.com or simply typing "whois" and the domain name. For example, use your personal mailbox instead of your home address. Better yet, for a small fee you can select an option to make all registration information private.
• Use anti-virus software, a firewall, and anti-spyware software to keep your computer safe and secure.
• Set your privacy settings on social networking communities (such as MySpace, Facebook, etc.) so your photos and personal data aren't viewable by the public. Set options that filter who can be added as a friend, etc., to your account. Remember, if you choose to be public on these sites, anybody can read anything you write.
• Discuss your safety and privacy requirements with your Internet service provider (ISP) and enlist their help and advice. You're paying them to use their service, and you have a right to assistance.

By taking such steps to safeguard your personal data, you'll ensure your private data stays private. Now grab your virtual surfboard and hit the Internet waves!

Colleen Collins-Kaufman is a professional private investigator and multi-published author. She and her business partner run a Colorado-based private detective agency, Highlands Investigations & Legal Services, Inc., that specializes in asset/background searches, criminal/civil investigations, domestic relations, legal research/writing, financial fraud, personal injury, skiptracing, and surveillance. To read more about their services, go to http://www.highlandsinvestigations.com

Remove Soft Soldier - Perform a Soft Soldier Removal in Minutes

Look out for Soft Soldier. Looks can be deceiving, it "pretends" to be an antivirus program but it is not. In fact it does the opposite. The rogue program will install a bunch of viruses and infections throughout your system.

Don't let it stay on your computer. Not only will it slow down your system and mess with your settings, it can also steal private information right off your hard drive.

Before learning to remove the virus you should know how it infiltrates your system. Knowing the source, will help you avert future problems.

The most common methods of infection are:

• You installed a fake "video codec" from a multimedia file downloaded off the web or P2P network. Never install codecs from files downloaded off the net.

• Downloading shareware or freeware programs. Be careful you only download things from trusted providers.

• Checking out a malicious website that hijacked your web browser and snuck the virus into your computer. This can happen pretty often without active antivirus protection.

Soft Soldier Removal

To get rid of the virus you need to access various directories and and do the following

1. Delete EXE, BAT, or other process files (example Soft Soldier.exe)
2. Delete DLL and LNK files that are silently operating in the background
3. Delete registry entries that have been infected.

Make sure you delete the entire virus at once. Otherwise these sneaky infections will just regenerate themselves when you reboot.

I only recommend manual removal for folks who have are computer experts. It can be quite challenging and dangerous to remove Soft Soldier if you do not know precisely what you are doing. Remove the wrong files from the registry and you can cause further damage to your system.

What you need is a Soft Soldier removal software. A program that can eliminate the infection automatically with a few clicks of the mouse. Not only have I found software that can remove Soft Soldier, it also offers real time defense against potential threats. You can try a free scan below and see what it comes up with.

Tired of viruses infecting your computer? Want to surf the web with the peace of mind that your computer is safe and secure? Get your free scan from the top virus protection and remove Soft Soldier.

Jim Marshall is an expert computer technician with fifteen years of experience in the industry. Since his own computer was destroyed by malicious software, he has been studying antispyware, adware, and malware systems for years. His website details the comprehensive results of this research, ranking the best antispyware and antivirus programs available.

http://www.spyware-fix.net

How to Protect Personal Information on Your Computer

With more people using the internet everyday, there has been a significant increase in the threats of online criminals attempting to steal personal information. When you use email, surf the net, and provide financial information to retailers, you have to make sure no one can steal your information. Fortunately, technological improvements in computer security and implementing safety precautions can drastically reduce the chances of having your information stolen.

The following tips are designed to help you protect personal information on your computer:

• Acquire Security Software: It is important that you have the appropriate security software to protect your computer from viruses, hackers, worms, spyware, spam, identity theft, and Adware. A quality and renowned security software program will protect your computer from a variety of security risks. Some software provides a combination of protection methods while others provide just one security function.

• Implement Wireless Security Protection: If you access the internet through a Wi-Fi network, make sure you have the appropriate protection from hackers. With wireless networks, the radio waves travel in the surrounding area, so a hacker sitting nearby can access your connection and hack into your computer.

• Use a Firewall: A firewall adds a security obstruction between a personal computer and the internet. It helps prevents hackers from accessing your computer. It will block any suspicious and unauthorized entry into a computer system.

• Email Encryption: When you use email encryption, it reduces the chances of someone intercepting and accessing your information.

• Beware of Phishing Scams: Many online criminals will send fraudulent emails and use fraudulent websites to gather a person's personal information. Never provide personal information to unknown businesses. Confirm the site is legitimate by either checking with the Better Business Bureau or online sites that expose fraudulent sites and emails. Purchase products from sites that encrypt transaction payments. Encrypting payment information will code your personal and financial data after you submit the payment.

• Beware of Certain Free Download Programs: Some free download software can contain harmful programs. They can allow the person who sent it access to your computer. Security software can prevent these programs from installing. Adware and Spyware are software that can contain these malicious programs.

• Backup Information: Back up and store your information in case your security barrier is breached so you will not lose important information. Store it on a CD or an external hard drive.

• System Security Configuration: Configure your browser or operating system to manage pop-ups, delete cookies, and block specific web sites.

• Change Passwords Regularly: Change your passwords at least every 30 days to reduce the chance of a hacker accessing your online personal and financial information.

• Monitor your Credit Report: You should regularly check your credit report history. This will let you know if anyone has been using your financial information.

When you use the internet for shopping, banking, emailing, and sending instant messages, there are shady people who may try to access your computer to steal your information. Using the latest security software and practicing safe security practices, will reduce the chance of having your personal information stolen and used for illegal purposes.

Whether it'd be for business purposes or personal use, the need for projector rental Toronto. is growing. Laptop rental Toronto is also important to assist needs such as event planning. While it offers exceptional performance, there is projector rental Calgary.