John Mallery Mallery Technical Training and Consulting, Inc.

www.malleryttc.com

May 3, 2012

Municipal Cyber Theft & How to Avoid It

Background Actively involved in computer forensics and computer

security since 1998. Projects mostly involve complex litigation or highly

adversarial situations. Testified in both civil and criminal matters. Co-author, “Hardening Network Security,” published by

McGraw Hill in 2005 More than 40 published articles Founder of Mallery Technical Training and Consulting, Inc.

Questions? How many of you think computers are the greatest invention

since sliced bread? How many of you think they are the spawn of Satan? How many of you bank online? How many of you shop online? How many computers do you own? Do you have a wireless network at home? Is it secure? How do you know?

Introduction Our lives are digital. Everything about us is documented electronically - even if

you don’t own a computer. The number of locations where data can be created and

stored is increasing on a daily basis. Result – there are now more places where data is vulnerable.

Definition Cybertheft - Stealing of financial and/or personal

information through the use of computers for making its fraudulent or other illegal use. (www.businessdictionary.com)

I would add: Theft of any confidential or business materials that can be used to gain a business advantage.

Falls under the umbrella of Cybercrime

Multi-tentacled Beast • Computers - desktop, laptop, tablet and server - at the home and office

• Optical Media (CD’s, DVD’s, Blue Ray Disks)

• USB Devices (Firewire and Thuderbolt devices as well)

• Flash drives in all shapes and sizes

• External hard drives - vast storage capacity

• Printers

• Scanners

• Cellular phones - smart phones are essentially full-blown computers

• Voice Mail Systems

• Digital Recording Devices

Multi-tentacled Beast (cont.)

• Backup tapes

• Legacy Systems and Devices

• servers, laptops and desktop computers taken out of service

• Magnetic media - floppy disks, jaz and zip disks

• Game Consoles - XBox and Playstation

• Networked Attached Storage (NAS) - hard drives attached to network, not just individual computers

• Online Data Storage Sites

• Social Networking Sites

Online Storage

Cell Phones Store and Access Data Social Networking Online storage Word Processing Internet History Voice memos Etc.

Do you know where all of your data is stored?

Smart Phones will back up to a variety of locations including the local computer.

Blackberry IPD files contain lots of Information

Do you know where all of your data is stored? More Data on a hard drive than you can imagine: Temporary Files Temporary Internet Files Unallocated clusters Etc.

Important Point #1 If you have a computer/device that is connected to the

Internet. It is a Target. Period. End of Discussion.

Interesting Statistics

From www.mandiant.com

Attacker Profiles

Important Point #2 Most organizations/individuals underestimate the value of

their data

Real World Example Bank calls, says they have a client who had several hundred

thousand dollars illegally transferred to an account in Romania.

Bank client is suing the bank for having weak security Propose that the bank client fell victim to a phishing scam. Bank client, “No &^%$#@ way, we are too smart for that.” Forensic analysis of client’s computer found they had fallen

victim to a phishing scam.

Real World Example #2 Bank had 18 unauthorized transfers established for

commercial banking customers. Examined computer belonging to individual responsible for

maintaining online banking system. Found remains of a document called “passwords.doc,” which

stored passwords in plain-text. Found a “man-in-middle” trojan. Administrator account with no password. Indiscriminate web surfing.

Computer Security Basics Data is at risk during creation, storage and transmission Creation – keystroke capture hardware and software Storage – hacking, malware, device theft, disgruntled

employees Transmission – packet capture, “man-in-the-middle” attacks

Key concept: Defense in Depth – layered approach to security.

Learn the Tools Already Available to You.

Get Back to Basics Strong Passwords Enable firewall on home computer Verify you are securely connected to a site before

transmitting confidential information Watch for Scams “We just detected your system is infected our online service can

help.”

Get Started Password Protect Word, Excel, and PowerPoint Files

Quick Note on Passwords All Passwords can be cracked Length of time depends on strength of pasword

The login password is meaningless on your computer. The hard drive can be taken out and connected to another computer.

Remembering them is a nightmare. If you must write them down – store them on an encrypted thumb drive.

New Habits Remove all file sharing (consumer) programs from your

computers. There is no legitimate reason for them Huge source of malware Repository of illicit images

Avoid indiscriminate web-surfing on computers that contain confidential information (or may connect to systems with confidential information).

“Drive By” malware installation

Encryption Utilize “whole disk”

encryption on all portable devices; laptops, external hard drives, etc.

Like brushing your teeth. It is something that has to be done. Options BitLocker – Windows 7

(Vista) Enterprise and Ultimate

FileVault – Mac OS X TrueCrypt –

www.truecrypt.org

Anti-Virus/Anti-Malware Solutions

Important Note #3 People that are serious about creating effective malware, have

computers running all versions of available anti-virus programs.

When developing malware, they test it to verify it is undetected by ALL software.

Might want to consider having two anti-malware programs.

Microsoft Security Essentials

Free – available here: http://windows.microsoft.com/en-US/windows/products/security-essentials

Additional Options AVG Anti-Virus FREE Norton AntiVirus 2012 Webroot SecureAnywhere Antivirus MalwareBytes – removal

Mac - ClamXav

Additional Topics Is it possible to securely remove data from a hard drive?

Yes! For a Windows computer you want to continue using: Delete files you wish to remove by using “shift + delete.” Why? Run Disk cleanup Defrag hard drive Run a tool like Eraser (http://eraser.heidi.ie/index.php) Set Registry to clear pagefile at shutdown

Mac’s have built in tools Screenshot from Disk Utility

Additional Topics How would you defeat a computer forensics examination?

Anti-forensics

Take the hard drive out of your computer Boot with a bootable Linux CD Conduct your nefarious activities Store all of your documents on Google Docs

(Now Google Drive) Remove CD and shut down computer

Anti-forensics Pull out your typewriter, type

and mail your covert communications

Use the phone for voice-to-voice

Have your communications in a “cone of silence”

Use a secure phone

Don’t do anything you are not supposed to do

Quiz What do these acronyms mean? POS LMIRL WOMBAT LOPSOD

Resources

www.malleryttc.com www.netlingo.com - best collection of Internet acronyms

Parent’s Guide to Internet Safety - http://www.fbi.gov/stats-services/publications/parent-guide/parent-guide

Questions? Contact info: john.mallery@malleryttc.com / 913.708.4199