Abstract image of a woman sitting on books and studying on a laptop

Cyber ID Sleuth Data Security Forensics

Download as PPTX, PDF
B
btr-security

The document provides biographical information about Robert Listerman, who runs the data security compliance firm Data Security Compliance Advisors. It notes that he has over 30 years of experience in business consulting and process improvement. It also lists his certifications and roles in professional organizations related to accounting, identity theft risk management, and data security compliance.

BusinessTechnology
1 of 50
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ Data Security Forensics Prepared by: Robert A. Listerman, CPA, CITRMS
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Robert Listerman (Bob) is a licensed Certified Public Accountant, State of Michigan and has over 30 years of experience as a process improvement business consultant. He graduated from Michigan State University and became a CPA while employed at Touche Ross & Co., Detroit, now known as a member firm of Deloitte & Touche USA LLP Bob added the Certified Identity Theft Risk Management Specialist (CITRMS) designation issued by The Institute of Fraud Risk Management in 2007. The designation is in recognition of his knowledge and experience in identity theft risk management. Today Bob focuses his practice on data security compliance. Over 50% of identity theft can be traced back to unlawful or mishandling of non-public data within the workplace. Currently Bob serves his professional community as an active Board Member for the Institute of Management Accountants (IMA), Mid Atlantic Council “IMA-MAC.” He is currently servicing as President of IMA-MAC (2011-2013). He is a regular seminar presenter for the IMA, Pennsylvania Institute of CPAs (PICPA), and the Michigan Association of CPAs (MACPA). Bob serves on, and is a past chair of the MACPA’s Management Information & Business Show committee which enjoys serving over 1000 CPAs in attendance each year. He is Continuing Education Chair of the PICPA’s IT Assurance Committee. Bob serves his local community as a member of the Kennett Township, PA Planning Commission, Communications, Business Advisory, and Safety Committees. He is an active board member of the Longwood Rotary Club. He serves his Rotary District 7450 as their Interact Club Chair (Rotary in High School) since 2010. Past professional and civic duties include serving on the Board of Directors for the Michigan Association of Certified Public Accountants (1997-2000), past board member of the Delaware Chapter of the IMA and past Chapter president for the IMA Oakland County, Michigan (1994-1995). www.linkedin.com/in/boblistermanidriskmanager/
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A DATA BREACH of “PII” IS DEFINED AS A FIRST NAME, FIRST INITIAL OR LAST NAME PLUS: A Social Security Number A Driver’s License Number or State-Issued ID Number An Account Number, Credit Card Number or Debit Card Number Combined with any Security Code, Access Code, PIN or Password
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A REAL“BREACH” IS DEFINED AS ANY INTRUDER TO YOUR ENTERPRISE Your Trade Secrets Access To Your Servers By a “Hactivism” Criminal Whatever Is Important To Your Enterprise
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com  When a hacker gets anyone’s credentials, it is easy for them to build a profile of the individual to gain even more information from social media sites.  From there they can “spearPhish” more information from the victim OR THEIR CONTACTS!  Examples of profile building follow:
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com LOST CREDENTIALS PUT YOU UNDER ATTACK Name: Lucas Newman Extraction Date: 12/30/20XX Email: lnewman@firstrepublic.com Hometown: Portland, Oregon Hashed Password: 16b90b178faff0e3e2f92ec647b50b1 1 Occupation: Managing Director and Portfolio Manager Extraction Type: Hack Source:
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Name: Robyn Mondin Extraction Date: 12/30/20XX Email: robyn.mondin@firstcitizens.com Hometown: Asheville, North Carolina Clear Password: 36f76603a2212c7fc6ff4fb8ec77a64 c Occupation: Mortgage Banker Extraction Type: Hack Source:
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com EVERY EMPLOYEE, PARTNER, AND SYSTEM IS A WEAK LINK Name: Pat Grundish Extraction Date: 8/13/20XX Email: pat.grundish@53.com Hometown: Englewood, Ohio Clear Password: p_grundish Occupation: Mortgage Loan Officer Extraction Type: Hack Source: Name: Mandy Knerr Extraction Date: 8/13/20XX Email: mandy.knerr@53.com Hometown: Huber Heights, Ohio Clear Password: m_knerr Occupation: Sr. Marketplace Loan Officer Extraction Type: Hack Source:
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com STOLEN CREDENTIALS REPEATEDLY USED TO BREACH FINSERV 16 Financial Services institutions publically reported a data breach in 2012, totaling 1.1M breached records. We harvested 6 credentials belonging to Independent Capital Management in December 2011. As recently as 4/1/2013, we have found Citi credentials for a total of 1,688 February 22, 2012 • An unauthorized party misused Accucom credentials to make fraudulent $1.00 charges March 2, 2012 • A user ID assigned to Independent Capital Management used to access consumer credit reports March 13, 2012 • Hacker logged onto Citi's credit card online account access system by using passwords and user IDs October 29, 2012 • Hackers use stolen employee credentials to hack Abilene Telco, resulting in the theft of 847 credit reports
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE LONG-TERM EFFECTS OF LOST CREDENTIALS 2005 •An employee of a Kansas City investment bank registers for the free Stratfor newsletter December 2011 •Stratfor becomes aware of its breach January 2012 Stratfor initiates a massive breach response, including removing all related data from the Web February 2013 •Hactivist group identifies the credential/password combo that still accesses the investment banks’s webmail February 2013 •Hacktivist group publishes the investment bank’s client information on the it’s home page It took nearly eight years to feel the full effect of a duplicate password. Over 300,000 individuals had their personal information leaked, such as credit card numbers, addresses, phone numbers, and more. Employee used same password to access the Stratfor newsletter as his password to the investment bank’s webmail account.
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com MULTIPLE VECTORS OF ATTACK RESULT IN BREACHES Data Breaches Point of Sale Systems Email Web Mobile Lost/ Stolen DeviceFTP Cloud Services Employees Hacking Social Media
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THREE PRIMARY CAUSES DRIVE DATA BREACHES Data Breaches Monetization NegligenceEgo
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com USA Breaches* * From 2005 to June 11, 2014 Source: http://www.PrivacyRights.Org 867,525,654* Records Known to Have Been Breached in The USA!
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com IT Administrators harden their networks by building walls with Anti-Virus software to keep out the bad guys The Result is that Anti-Virus software can’t keep up and the bad guys are already inside your walls The Problem is that 76,000 new malware strains are released into the wild every day The Problem is that 73% of online banking users reuse their passwords for non- financial websites PROVIDING VISIBILITY BEYOND THE IT WALLS
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com STOLEN CREDENTIALS EXPOSE YOU TO UNKNOWN RISK 30,000 The number of new malicious websites created every day 1 80%Of breaches that involved hackers used stolen credentials 14% Of data breaches were due to employees using personal email accounts 2 SOURCES: 1. Sophos, 2012; 2. Verizon Data Breach Investigations Report, 2013 76%of network intrusions exploited weak or stolen credentials. 2
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com MALWARE EVADES TRADITIONAL ANTI-VIRUS SOFTWARE 200,000 – 300,000 The estimated number of new viruses discovered each day 1 52% Of malware in a recent study focused on evading security 2 24.5% Antivirus software’s average detection rate for e-mail based malware attacks 3 40%Of malware samples in a recent study went undetected by leading antivirus software 2 SOURCES: 1. Comodo Group, 2012; 2. Palo Alto Networks, 2013 3. Krebs on Security, 2012
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com DO YOU KNOW WHAT THESE ARE? "automatedtest", "automatedtester", "bagle-cb", "c_conficker", "c_confickerab", "c_confickerc", "c_pushdo ", "c_trafficconverter", "c_zeroaccess", "childpredator", "citadel", "condo", "cutwail", "d_tdss", "darkmailer", "darkmailer2", "darkmailer3", "darkmailer4", "darkmailer5", "deai", "esxvaql", "fakesendsafe", "festi", "fraud", "gamut", "gheg", "grum", "hc", "kelihos", "lethic", "maazben", "malware", "manual", "mip", "misc", "netsky", "ogee", "pony", "relayspammer", "s_kelihos", "s_worm_dorkbot", "sendsafe", "sendsafespewage", "slenfbot", "snowshoe", "spamaslot", "spamlink", "spamsalot", "special", "spyeye", "ss", "synch", "w_commentspammer", "xxxx", "zapchast", "zeus" Prewritten Malware coding available to hackers to modify enough to get through your security
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CASE STUDY: Sony PlayStation®Network April 19, 2011 •Sony discovers its network had been compromised but did not announce anything April 20, 2011 •Sony closed down the network but did not disclose what it already knew April 22, 2011 •Sony reveals that an “external intrusion” caused the network outages April 26, 2011 •Sony released a detailed account of incident and reveal for the first time that PII was leaked April 29, 2011 •Sony shares drop 4.5% and the company reveals 2.2 million credit card numbers were stolen March 2014 •Sony is still attempting to resolve issues from the 50+ different class actions law suits brought against it Current estimates of the total financial impact to Sony is $171 million Sony provided affected individuals with 12 months of identity theft protection and insurance coverage 100M user accounts compromised , exposing Full Name, Address, Phone Number, Date of Birth, Credit Card Number, User Name, and Password
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CASE STUDY: Target Corporation Nov. 27 – Dec. 15 2013 •Hacker execute extended attach against Target’s point-of-sale system Dec. 18, 2013 •News of the breach is reported by data and security blog KrebsOnSecurity Dec. 20, 2013 •Target acknowledges the breach, saying it is under investigation Dec. 21, 2013 •JP Morgan announces it is placing daily spending caps on affected customer debit cards Dec. 22, 2013 •Customer traffic drops over the holiday season, resulting in a 3-4% drop in customer transactions Jan. 10, 2014 •Target lowers its fourth- quarter financial projections, saying sales were “meaningfully weaker-than-expected” Current estimates of the total financial impact to Target is $200 million Target provided affected individuals with 12 months of identity theft protection and insurance coverage 110M user accounts compromised , exposing credit and debit card numbers, CVN numbers, names, home addresses, e- mail addresses and or phone numbers
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com “Ongoing forensic investigation has indicated that the intruder stole a vendor's credentials which were used to access our system.” Molly Snyder, Target Corporation January 2014
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Email Attack on Vendor Set Up Breach at Target* * Source: http://krebsonsecurity.com/ The breach at Target Corp. that exposed credit card and personal data on more than 110 million consumers appears to have begun with a malware- laced email phishing attack sent to employees at an HVAC firm that did business with the nationwide retailer, according to sources close to the investigation. KrebsOnSecurity reported that investigators believe the source of the Target intrusion traces back to network credentials that Target had issued to Fazio Mechanical, a heating, air conditioning and refrigeration firm in Sharpsburg, Pa.
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com ANATOMY OF A SPEARPHISHING ATTACK Target Victim 1 Install Malware 2 Access Network 3 Collect & Transmit Data 4 Breach Event 5
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE PROFILE OF AN ATTACKER The malware used to hack Target’s POS system was written by a Ukrainian teen • Andrey Hodirevski from southwest Ukraine carried out the attack from his home • The card details that he stole were sold through his own forum as well as other communities • CyberID-Sleuth™ investigated the breach when it occurred and was able to verify various discussions and identifiers pointing to this suspect
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com An Internet service provider (ISP, also called Internet access provider) is a business or organization that offers users access to the Internet and related services. Source: http://en.wikipedia.org/wiki/Internet_service_provider#Access_providers Definition
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com a.k.a: the “CLOUD”
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com The Internet “Web” Topography
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Can you identify what these numbers are?
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com IP Tracer Source: http://www.ip-adress.com/ip_tracer/
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com An IP Address gives the hacker access to your computer to run command and control botnet malware – you have been breached!
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ PROVIDES MORE THAN AUTOMATED ALERTS Credential Monitoring Identifying email addresses from a corporate domain that have been hacked, phished, or breached IP Address Scanning Identifying devices in a corporate network connected to a known malware command and control server Doxing awareness and hacktivist activity monitoring Locating the individuals and exchanges involved in intellectual property theft Hacks, exploits against networks, glitches, leaks, phishing/keylogging monitoring Identification of communities targeting brands, networks or IP addresses Identification of intellectual property distribution Identification of individuals posing a risk to any IP address
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES-PROVIDES EARLY WARNING AT TWO POINTS CyberID-Sleuth™ scours botnets, criminal chat rooms, blogs, websites and bulletin boards, Peer-to-Peer networks, forums, private networks, and other black market sites 24/7, 365 days a year CyberID-Sleuth™ harvests 1.4 million compromised credentials per month Dark Web CyberID-Sleuth™ identifies your data as it accesses criminal command- and-control servers from multiple geographies that national IP addresses cannot access CyberID-Sleuth™ harvests 7 million compromised IP addresses every two weeks
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com REMEMBER WHAT THESE ARE? "automatedtest", "automatedtester", "bagle-cb", "c_conficker", "c_confickerab", "c_confickerc", "c_pushdo ", "c_trafficconverter", "c_zeroaccess", "childpredator", "citadel", "condo", "cutwail", "d_tdss", "darkmailer", "darkmailer2", "darkmailer3", "darkmailer4", "darkmailer5", "deai", "esxvaql", "fakesendsafe", "festi", "fraud", "gamut", "gheg", "grum", "hc", "kelihos", "lethic", "maazben", "malware", "manual", "mip", "misc", "netsky", "ogee", "pony", "relayspammer", "s_kelihos", "s_worm_dorkbot", "sendsafe", "sendsafespewage", "slenfbot", "snowshoe", "spamaslot", "spamlink", "spamsalot", "special", "spyeye", "ss", "synch", "w_commentspammer", "xxxx", "zapchast", "zeus"
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Zeus Infection targeted towards multiple entities within the Hotel Industry within India CyberID-Sleuth™ identified a targeted Zeus campaign which appears to have been focused and distributed to Hotel chains, mainly within the India region. The attack in question caused active compromises against a number of systems. CyberID-Sleuth™ ’s main focus is the type of data often held within Reservation and other Hotel systems. Personal information such as credit card data, as well as passport scans or copies, are often held on Hospitality systems and the data identified next highlights that these same systems are compromised and under direct control of malicious actors. CyberID-Sleuth™ CASE STUDY ACTUAL CREDENTIAL DATA
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL MALWARE VARIANT Infection Type: Zeus Infection - V2.1 Payload: Theft of all credentials, Key logging of all data, Remote access to devices Total Infection Count: 487 Total Credential Count: 12894 ( including duplicates ) Command and Control (C2) Domain: matphlamzy.com
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA bwstarhotel.com - 111.68.31.202 ,('92', 'RSV1_E532648A3D69E5DE', '-- default --', '33619969', '', '', '1394590108', '7557047', '0', '±00', '1033', 'C:Program FilesMicrosoft OfficeOffice14OUTLOOK.EXE', 'RSV1owner', '101', 'pop3://reservation@bwstarhotel.com:starrsv1 *@116.251.209.92:110/', '111.68.31.202', 'ID', '1394590104') Date extracted and listed below is related to valid and legitimate accounts which are still active. These are not passwords taken from Breach events or other untrusted sources. They are taken directly from devices that are still infected/compromised!
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA bwmegakuningan.com - 139.0.16.90 ('447', 'USER-PC_E532648A9824115F', '-- default --', '33619969', '', '', '1394593039', '162643491', '0', '±00', '1033', 'C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE', 'user-PCuser', '101', 'pop3://reservation@bwmegakuningan.com: 79r2mz5xrx@116.251.209.92:110/', '139.0.16.90', 'DE', '1394593037')
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA townsquare.co.id - '180.250.172.36 ('453', 'RESERVATION_1F3D59E96522DF69', '-- default --', '33619969', '', '', '1394592970', '14267024', '0', '± 0', '1033', 'C:Program Files (x86)Microsoft OfficeOffice12OUTLOOK.EXE', 'TSPDCvitha', '101', 'pop3://reservation.seminyak@townsquare.co.id:tsbali1234@ 103.31.232.210:110/', '180.250.172.36', 'ID', '1394593095')
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Over 257 unique credit cards were stolen during the attack. CyberID-Sleuth™ identified the botnet, which was made up of infected devices. CyberID-Sleuth™ CASE STUDY ANATOMY OF THE FINDINGS Q. How many credit cards were captured? Q. Specifically what data did it steal and report back that you could see? CyberID-Sleuth™ could see EVERYTHING that was entered on a user’s device or saved as a password or credential. Q. How much did this breach cost the client? No “price” could be put on the damage caused to a victim after a fraudster has stolen their credentials. The data stolen would allow the fraudster access to internal systems, either via the stolen credentials or via backdoor access to affected systems.
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Q. What data about the attacker were we able to find? Limited details. Any information about the attackers are not shared with clients unless a directed attack, and is only shared with US and UK Law Enforcement. Q. How did the authorities use the data to capture the intruders The individual responsible for running the botnet in question is so far still at large. CyberID-Sleuth™ CASE STUDY ANATOMY OF THE FINDINGS
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ Credential Monitoring Demo * * Let us see if your credentials are for sale, at no obligation Tier I
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A STANDARD RESPONSE TIMELINE SHOULD BE FOLLOWED Incident Detection / Discovery Incident Notification & Resolution RemediationEfforts Internal and External Communication of Event, Reaction, and Remediation Notification Capabilities Go Live Coordinate Breach Notification Copy and Distribution with Breach Remediation Vendor Establish internal or third party communication channel to affected population Contact and or activate contract with Data Breach Remediation Vendor Prepare Internal and External Communication Plan & Copy Determine Organization’s Public Response Plan (including notification type, verbiage, and remediation offering if any) Implement Breach Response Plan Determine total scope of event, size of affected population, type of data lost or compromised, necessary legal and industry specific guidelines Activate technical / security focused breach response team processes and procedures based on Data Breach Plan Initial Internal Reporting, notifications, and security triage of the “event” AssessmentEfforts Plan Ahead By Forming a Breach Response Plan CyberID-Sleuth Tiers II & III
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE COSTS OF A DATA BREACH ARE VARIED • Detection or Discovery—”Activities that enable a company to reasonably detect the breach of personal data either at risk (in storage) or in motion” • Escalation—”Activities necessary to report the breach of protected information to appropriate personnel within a specified time period.” • Notification—physical mail, e-mail, general notice, telephone • Victim Assistance—card replacement, credit monitoring offer, identity theft protection offer, access to customer service representatives • Churn of existing customers / personnel • Future Diminished Acquisition of customers or employees
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com RECOMMENDATIONS TO REDUCE DATA BREACH EXPOSURE & COSTs • Promote Employee Data Management Training & Education • Require GC / CISO and their teams to understand industry, state, federal, and event specific data breach response guidelines and recommendations • Establish an internal data breach response plan and process flow • Prior to a data breach event contract with a data breach remediation, notification, and or forensics provider • Utilize and maintain available data loss prevention technologies such as CyberID-Sleuth™ • Require advance encryption and authentication solutions be in place across the organization • Contractually require notification from vendors who manage data from your organization to alert you of they incur a breach of any data • Support enactment of legislation that clearly dictates rules and guidelines for organizations to follow in advance of, and following a data breach event
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Take this 20 Question Assessment to Score Your Risk Level Give us a call and we can even do this over the phone!
Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com 1. Remember to ask us for a no-obligation credential search for your enterprise 2. Allow us to give you your 20 Question Assessment Score on your risk level Email your questions to CyberIDSleuth@BTR-Security.com or to get two no-obligation services mentioned below

More Related Content

PDF
CyberID-Sleuth
btr-security
 
PPT
June NOW 2014
Louis Smith
 
PPTX
Anatomy of a spear phishing attack
Mark Mair
 
PPTX
Target data breach presentation
Sreejith Nair
 
PPTX
Data Security Breach: The Sony & Staples Story
International Institute for Learning
 
PPT
Cyber Crime Identity Theft
Rahmat Inggi
 
PPTX
Identity Theft and Data Compromise - TWCA Fall 2012
The Texas Network, LLC
 
PDF
Ftc identity theft kit
upsettinginfo
 
CyberID-Sleuth
btr-security
 
June NOW 2014
Louis Smith
 
Anatomy of a spear phishing attack
Mark Mair
 
Target data breach presentation
Sreejith Nair
 
Data Security Breach: The Sony & Staples Story
International Institute for Learning
 
Cyber Crime Identity Theft
Rahmat Inggi
 
Identity Theft and Data Compromise - TWCA Fall 2012
The Texas Network, LLC
 
Ftc identity theft kit
upsettinginfo
 

What's hot (20)

PPTX
What i learned at the infosecurity isaca north america expo and conference 2019
Ulf Mattsson
 
PPTX
Identity theft
SARASWATHI S
 
PDF
Ce hv8 module 19 cryptography
Mehrdad Jingoism
 
PPTX
Hacking presentation
Ajith Reddy
 
PPTX
Baker Tilly Presents: Emerging Trends in Cybersecurity
BakerTillyConsulting
 
PPTX
Investigating & proving cybercrime
Jenny Reid
 
PDF
Identity theft
Nick Chandi
 
PPT
Identity Theft nigerian fraud cross border fraud
Matt Smith
 
PDF
How Cyber-Secure is your Family Enterprise? A special report for clients of P...
Declan Winston Ramsaran
 
PDF
2015 Labris SOC Annual Report
Labris Networks
 
PPT
Module 3 social engineering-b
BbAOC
 
ODP
Critical Controls Might Have Prevented the Target Breach
2nd Sight Lab
 
PDF
Cyber Defense For SMB's
Guise Bule
 
PPT
Identity theft
Eqhball Ghazizadeh
 
PPTX
Phishing
guicelacatalina
 
PPTX
Phishing
Ajit Yadav
 
PPTX
Data security concepts chapter 2
Nickkisha Farrell
 
PDF
Business Fraud and Cybersecurity Best Practices in the Office or While Worki...
ArielMcCurdy
 
PDF
Social Engineering 2.0
Murray Security Services
 
PPTX
ID Theft and Computer Security 2008
Donald E. Hester
 
What i learned at the infosecurity isaca north america expo and conference 2019
Ulf Mattsson
 
Identity theft
SARASWATHI S
 
Ce hv8 module 19 cryptography
Mehrdad Jingoism
 
Hacking presentation
Ajith Reddy
 
Baker Tilly Presents: Emerging Trends in Cybersecurity
BakerTillyConsulting
 
Investigating & proving cybercrime
Jenny Reid
 
Identity theft
Nick Chandi
 
Identity Theft nigerian fraud cross border fraud
Matt Smith
 
How Cyber-Secure is your Family Enterprise? A special report for clients of P...
Declan Winston Ramsaran
 
2015 Labris SOC Annual Report
Labris Networks
 
Module 3 social engineering-b
BbAOC
 
Critical Controls Might Have Prevented the Target Breach
2nd Sight Lab
 
Cyber Defense For SMB's
Guise Bule
 
Identity theft
Eqhball Ghazizadeh
 
Phishing
guicelacatalina
 
Phishing
Ajit Yadav
 
Data security concepts chapter 2
Nickkisha Farrell
 
Business Fraud and Cybersecurity Best Practices in the Office or While Worki...
ArielMcCurdy
 
Social Engineering 2.0
Murray Security Services
 
ID Theft and Computer Security 2008
Donald E. Hester
 
Ad

Viewers also liked (15)

PPTX
Alfred Hitchcock
emka14
 
PPT
Tarea e learning presentación slidershare
Rossana Perdomo Berardo
 
PDF
04 e
Sunisa Nakphiromkon
 
PDF
05 e
Sunisa Nakphiromkon
 
PDF
Studio recital 2016
Yiyi Ku
 
PPSX
Santo Markus (Saint Mark)
Angpat Sankus
 
DOCX
Rasa sayang dibalik pengorbanan(sendiri)
Mungkin AndaKenal
 
PDF
03 e
Sunisa Nakphiromkon
 
PPTX
Right choice
upasana17
 
PDF
Jan 2557
Triton Pisanu
 
PPTX
Right choice
upasana17
 
DOCX
Plantillas de figuras geometricas en 3dimensiones
4lex4ndr4
 
DOC
งานด้ายปราง
Sunisa Nakphiromkon
 
DOC
Moringa Advantages
amberwill48
 
PDF
Diccionario Mejorado
4lex4ndr4
 
Alfred Hitchcock
emka14
 
Tarea e learning presentación slidershare
Rossana Perdomo Berardo
 
04 e
Sunisa Nakphiromkon
 
05 e
Sunisa Nakphiromkon
 
Studio recital 2016
Yiyi Ku
 
Santo Markus (Saint Mark)
Angpat Sankus
 
Rasa sayang dibalik pengorbanan(sendiri)
Mungkin AndaKenal
 
03 e
Sunisa Nakphiromkon
 
Right choice
upasana17
 
Jan 2557
Triton Pisanu
 
Right choice
upasana17
 
Plantillas de figuras geometricas en 3dimensiones
4lex4ndr4
 
งานด้ายปราง
Sunisa Nakphiromkon
 
Moringa Advantages
amberwill48
 
Diccionario Mejorado
4lex4ndr4
 
Ad

Similar to Cyber ID Sleuth Data Security Forensics (20)

PPT
George Gavras 2010 Fowler Seminar
Don Grauel
 
PDF
Douglas Jambor Sageworks Cybersecurity Presentation
Turner and Associates, Inc.
 
PDF
Proactive Log Management in Insurance by Van Symons
Clear Technologies
 
PDF
Data Breaches - Sageworks, Inc., Webinar Series by Douglas Jambor
Turner and Associates, Inc.
 
PDF
UPMC Identity Data Breach
Managed Outsource Solutions
 
PPTX
Keeping Data Secure in Large Companies
cwilcox1986
 
PPT
Powerpoint mack jackson
aiimnevada
 
PDF
Identity Theft Consumer Seminar
ronwolfinger
 
PPSX
November 2017: Part 6
seadeloitte
 
PPT
Tips to Protect Your Organization from Data Breaches and Identity Theft
Case IQ
 
PPT
Ira Wilsker's January 2014 Identity Theft Presentation
Greater Cleveland PC Users Group
 
PDF
Cybersecurity | Fraud 2.0 Presentation to the Association of Certified Fraud ...
Shawn Tuma
 
PDF
Data Breach Detection: Are you ready for GDPR?
Digital Transformation EXPO Event Series
 
PPTX
Protect against id fraud workshop 2 of 2
Management Insights LLC
 
PPTX
Cyber Risk Presentation to Murphy Chamber of Commerce (5.28.15)
Shawn Tuma
 
PDF
ISACA Los Angeles 2010 Compliance - Ulf Mattsson
Ulf Mattsson
 
PDF
Data Breach Guide 2013
- Mark - Fullbright
 
PDF
Leading Practices in Information Security & Privacy
Donny Shimamoto
 
PPTX
NumaanHuq_Hackfest2015
Numaan Huq
 
PDF
Data Breach Response: Before and After the Breach
Financial Poise
 
George Gavras 2010 Fowler Seminar
Don Grauel
 
Douglas Jambor Sageworks Cybersecurity Presentation
Turner and Associates, Inc.
 
Proactive Log Management in Insurance by Van Symons
Clear Technologies
 
Data Breaches - Sageworks, Inc., Webinar Series by Douglas Jambor
Turner and Associates, Inc.
 
UPMC Identity Data Breach
Managed Outsource Solutions
 
Keeping Data Secure in Large Companies
cwilcox1986
 
Powerpoint mack jackson
aiimnevada
 
Identity Theft Consumer Seminar
ronwolfinger
 
November 2017: Part 6
seadeloitte
 
Tips to Protect Your Organization from Data Breaches and Identity Theft
Case IQ
 
Ira Wilsker's January 2014 Identity Theft Presentation
Greater Cleveland PC Users Group
 
Cybersecurity | Fraud 2.0 Presentation to the Association of Certified Fraud ...
Shawn Tuma
 
Data Breach Detection: Are you ready for GDPR?
Digital Transformation EXPO Event Series
 
Protect against id fraud workshop 2 of 2
Management Insights LLC
 
Cyber Risk Presentation to Murphy Chamber of Commerce (5.28.15)
Shawn Tuma
 
ISACA Los Angeles 2010 Compliance - Ulf Mattsson
Ulf Mattsson
 
Data Breach Guide 2013
- Mark - Fullbright
 
Leading Practices in Information Security & Privacy
Donny Shimamoto
 
NumaanHuq_Hackfest2015
Numaan Huq
 
Data Breach Response: Before and After the Breach
Financial Poise
 

Recently uploaded (20)

PDF
Introduction to Generative Engine Optimization (GEO)
seoplus+
 
PDF
NEW - FEES STRUCTURES (01-july-2024).pdf
priyansubarmanwork
 
PDF
income tax laws notes important pakistan
VrindaTayade1
 
DOCX
Center Enamel A Strategic Partner for the Modernization of Georgia's Chemical...
cecvessels
 
PPTX
Slide gioi thieu VietinBank Quy 2 - 2025
hoadm5190
 
PPT
Lecture 3344;;,,(,(((((((((((((((((((((((
princessbliss09
 
PDF
TyAnn Osborn: A Visionary Leader Shaping Corporate Workforce Dynamics
CIO WOMEN MAGAIZNE CIO WOMEN MAGAIZNE
 
PDF
Kishore Vora - Best CFO in India to watch in 2025.pdf
insightssuccess2
 
PDF
THE COMPLETE GUIDE TO BUILDING PASSIVE INCOME ONLINE
Malcolm86
 
PPTX
Board-Reporting-Package-by-Umbrex-5-23-23.pptx
Pars Six Sigma Excellence
 
PDF
Daniels 2024 Inclusive, Sustainable Development
CMassociates
 
DOCX
80 DE ÔN VÀO 10 NĂM 2023vhkkkjjhhhhjjjj
janggookdal
 
PDF
Booking.com The Global AI Sentiment Report 2025
agatadrynko
 
PDF
Satish NS: Fostering Innovation and Sustainability: Haier India’s Customer-Ce...
red402426
 
DOCX
Handbook of Entrepreneurship- Chapter 5: Identifying business opportunity.docx
DrSubinKMohan
 
DOCX
FINALS-BSHhchcuvivicucucucucM-Centro.docx
RosemarieMacapagal1
 
PDF
533158074-Saudi-Arabia-Companies-List-Contact.pdf
Shaik Abubakr Siddiqui
 
PPT
Lecture notes on Business Research Methods
obedgyan3
 
PPTX
Project Management_ SMART Projects Class.pptx
ravindra661395
 
PPTX
interschool scomp.pptxzdkjhdjvdjvdjdhjhieij
PrashantNagi1
 
Introduction to Generative Engine Optimization (GEO)
seoplus+
 
NEW - FEES STRUCTURES (01-july-2024).pdf
priyansubarmanwork
 
income tax laws notes important pakistan
VrindaTayade1
 
Center Enamel A Strategic Partner for the Modernization of Georgia's Chemical...
cecvessels
 
Slide gioi thieu VietinBank Quy 2 - 2025
hoadm5190
 
Lecture 3344;;,,(,(((((((((((((((((((((((
princessbliss09
 
TyAnn Osborn: A Visionary Leader Shaping Corporate Workforce Dynamics
CIO WOMEN MAGAIZNE CIO WOMEN MAGAIZNE
 
Kishore Vora - Best CFO in India to watch in 2025.pdf
insightssuccess2
 
THE COMPLETE GUIDE TO BUILDING PASSIVE INCOME ONLINE
Malcolm86
 
Board-Reporting-Package-by-Umbrex-5-23-23.pptx
Pars Six Sigma Excellence
 
Daniels 2024 Inclusive, Sustainable Development
CMassociates
 
80 DE ÔN VÀO 10 NĂM 2023vhkkkjjhhhhjjjj
janggookdal
 
Booking.com The Global AI Sentiment Report 2025
agatadrynko
 
Satish NS: Fostering Innovation and Sustainability: Haier India’s Customer-Ce...
red402426
 
Handbook of Entrepreneurship- Chapter 5: Identifying business opportunity.docx
DrSubinKMohan
 
FINALS-BSHhchcuvivicucucucucM-Centro.docx
RosemarieMacapagal1
 
533158074-Saudi-Arabia-Companies-List-Contact.pdf
Shaik Abubakr Siddiqui
 
Lecture notes on Business Research Methods
obedgyan3
 
Project Management_ SMART Projects Class.pptx
ravindra661395
 
interschool scomp.pptxzdkjhdjvdjvdjdhjhieij
PrashantNagi1
 

Cyber ID Sleuth Data Security Forensics

  • 1. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ Data Security Forensics Prepared by: Robert A. Listerman, CPA, CITRMS
  • 2. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Robert Listerman (Bob) is a licensed Certified Public Accountant, State of Michigan and has over 30 years of experience as a process improvement business consultant. He graduated from Michigan State University and became a CPA while employed at Touche Ross & Co., Detroit, now known as a member firm of Deloitte & Touche USA LLP Bob added the Certified Identity Theft Risk Management Specialist (CITRMS) designation issued by The Institute of Fraud Risk Management in 2007. The designation is in recognition of his knowledge and experience in identity theft risk management. Today Bob focuses his practice on data security compliance. Over 50% of identity theft can be traced back to unlawful or mishandling of non-public data within the workplace. Currently Bob serves his professional community as an active Board Member for the Institute of Management Accountants (IMA), Mid Atlantic Council “IMA-MAC.” He is currently servicing as President of IMA-MAC (2011-2013). He is a regular seminar presenter for the IMA, Pennsylvania Institute of CPAs (PICPA), and the Michigan Association of CPAs (MACPA). Bob serves on, and is a past chair of the MACPA’s Management Information & Business Show committee which enjoys serving over 1000 CPAs in attendance each year. He is Continuing Education Chair of the PICPA’s IT Assurance Committee. Bob serves his local community as a member of the Kennett Township, PA Planning Commission, Communications, Business Advisory, and Safety Committees. He is an active board member of the Longwood Rotary Club. He serves his Rotary District 7450 as their Interact Club Chair (Rotary in High School) since 2010. Past professional and civic duties include serving on the Board of Directors for the Michigan Association of Certified Public Accountants (1997-2000), past board member of the Delaware Chapter of the IMA and past Chapter president for the IMA Oakland County, Michigan (1994-1995). www.linkedin.com/in/boblistermanidriskmanager/
  • 3. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
  • 4. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A DATA BREACH of “PII” IS DEFINED AS A FIRST NAME, FIRST INITIAL OR LAST NAME PLUS: A Social Security Number A Driver’s License Number or State-Issued ID Number An Account Number, Credit Card Number or Debit Card Number Combined with any Security Code, Access Code, PIN or Password
  • 5. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A REAL“BREACH” IS DEFINED AS ANY INTRUDER TO YOUR ENTERPRISE Your Trade Secrets Access To Your Servers By a “Hactivism” Criminal Whatever Is Important To Your Enterprise
  • 6. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com  When a hacker gets anyone’s credentials, it is easy for them to build a profile of the individual to gain even more information from social media sites.  From there they can “spearPhish” more information from the victim OR THEIR CONTACTS!  Examples of profile building follow:
  • 7. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com LOST CREDENTIALS PUT YOU UNDER ATTACK Name: Lucas Newman Extraction Date: 12/30/20XX Email: lnewman@firstrepublic.com Hometown: Portland, Oregon Hashed Password: 16b90b178faff0e3e2f92ec647b50b1 1 Occupation: Managing Director and Portfolio Manager Extraction Type: Hack Source:
  • 8. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Name: Robyn Mondin Extraction Date: 12/30/20XX Email: robyn.mondin@firstcitizens.com Hometown: Asheville, North Carolina Clear Password: 36f76603a2212c7fc6ff4fb8ec77a64 c Occupation: Mortgage Banker Extraction Type: Hack Source:
  • 9. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com EVERY EMPLOYEE, PARTNER, AND SYSTEM IS A WEAK LINK Name: Pat Grundish Extraction Date: 8/13/20XX Email: pat.grundish@53.com Hometown: Englewood, Ohio Clear Password: p_grundish Occupation: Mortgage Loan Officer Extraction Type: Hack Source: Name: Mandy Knerr Extraction Date: 8/13/20XX Email: mandy.knerr@53.com Hometown: Huber Heights, Ohio Clear Password: m_knerr Occupation: Sr. Marketplace Loan Officer Extraction Type: Hack Source:
  • 10. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com STOLEN CREDENTIALS REPEATEDLY USED TO BREACH FINSERV 16 Financial Services institutions publically reported a data breach in 2012, totaling 1.1M breached records. We harvested 6 credentials belonging to Independent Capital Management in December 2011. As recently as 4/1/2013, we have found Citi credentials for a total of 1,688 February 22, 2012 • An unauthorized party misused Accucom credentials to make fraudulent $1.00 charges March 2, 2012 • A user ID assigned to Independent Capital Management used to access consumer credit reports March 13, 2012 • Hacker logged onto Citi's credit card online account access system by using passwords and user IDs October 29, 2012 • Hackers use stolen employee credentials to hack Abilene Telco, resulting in the theft of 847 credit reports
  • 11. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE LONG-TERM EFFECTS OF LOST CREDENTIALS 2005 •An employee of a Kansas City investment bank registers for the free Stratfor newsletter December 2011 •Stratfor becomes aware of its breach January 2012 Stratfor initiates a massive breach response, including removing all related data from the Web February 2013 •Hactivist group identifies the credential/password combo that still accesses the investment banks’s webmail February 2013 •Hacktivist group publishes the investment bank’s client information on the it’s home page It took nearly eight years to feel the full effect of a duplicate password. Over 300,000 individuals had their personal information leaked, such as credit card numbers, addresses, phone numbers, and more. Employee used same password to access the Stratfor newsletter as his password to the investment bank’s webmail account.
  • 12. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com MULTIPLE VECTORS OF ATTACK RESULT IN BREACHES Data Breaches Point of Sale Systems Email Web Mobile Lost/ Stolen DeviceFTP Cloud Services Employees Hacking Social Media
  • 13. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THREE PRIMARY CAUSES DRIVE DATA BREACHES Data Breaches Monetization NegligenceEgo
  • 14. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com USA Breaches* * From 2005 to June 11, 2014 Source: http://www.PrivacyRights.Org 867,525,654* Records Known to Have Been Breached in The USA!
  • 15. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com IT Administrators harden their networks by building walls with Anti-Virus software to keep out the bad guys The Result is that Anti-Virus software can’t keep up and the bad guys are already inside your walls The Problem is that 76,000 new malware strains are released into the wild every day The Problem is that 73% of online banking users reuse their passwords for non- financial websites PROVIDING VISIBILITY BEYOND THE IT WALLS
  • 16. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
  • 17. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com STOLEN CREDENTIALS EXPOSE YOU TO UNKNOWN RISK 30,000 The number of new malicious websites created every day 1 80%Of breaches that involved hackers used stolen credentials 14% Of data breaches were due to employees using personal email accounts 2 SOURCES: 1. Sophos, 2012; 2. Verizon Data Breach Investigations Report, 2013 76%of network intrusions exploited weak or stolen credentials. 2
  • 18. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com MALWARE EVADES TRADITIONAL ANTI-VIRUS SOFTWARE 200,000 – 300,000 The estimated number of new viruses discovered each day 1 52% Of malware in a recent study focused on evading security 2 24.5% Antivirus software’s average detection rate for e-mail based malware attacks 3 40%Of malware samples in a recent study went undetected by leading antivirus software 2 SOURCES: 1. Comodo Group, 2012; 2. Palo Alto Networks, 2013 3. Krebs on Security, 2012
  • 19. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com DO YOU KNOW WHAT THESE ARE? "automatedtest", "automatedtester", "bagle-cb", "c_conficker", "c_confickerab", "c_confickerc", "c_pushdo ", "c_trafficconverter", "c_zeroaccess", "childpredator", "citadel", "condo", "cutwail", "d_tdss", "darkmailer", "darkmailer2", "darkmailer3", "darkmailer4", "darkmailer5", "deai", "esxvaql", "fakesendsafe", "festi", "fraud", "gamut", "gheg", "grum", "hc", "kelihos", "lethic", "maazben", "malware", "manual", "mip", "misc", "netsky", "ogee", "pony", "relayspammer", "s_kelihos", "s_worm_dorkbot", "sendsafe", "sendsafespewage", "slenfbot", "snowshoe", "spamaslot", "spamlink", "spamsalot", "special", "spyeye", "ss", "synch", "w_commentspammer", "xxxx", "zapchast", "zeus" Prewritten Malware coding available to hackers to modify enough to get through your security
  • 20. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CASE STUDY: Sony PlayStation®Network April 19, 2011 •Sony discovers its network had been compromised but did not announce anything April 20, 2011 •Sony closed down the network but did not disclose what it already knew April 22, 2011 •Sony reveals that an “external intrusion” caused the network outages April 26, 2011 •Sony released a detailed account of incident and reveal for the first time that PII was leaked April 29, 2011 •Sony shares drop 4.5% and the company reveals 2.2 million credit card numbers were stolen March 2014 •Sony is still attempting to resolve issues from the 50+ different class actions law suits brought against it Current estimates of the total financial impact to Sony is $171 million Sony provided affected individuals with 12 months of identity theft protection and insurance coverage 100M user accounts compromised , exposing Full Name, Address, Phone Number, Date of Birth, Credit Card Number, User Name, and Password
  • 21. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CASE STUDY: Target Corporation Nov. 27 – Dec. 15 2013 •Hacker execute extended attach against Target’s point-of-sale system Dec. 18, 2013 •News of the breach is reported by data and security blog KrebsOnSecurity Dec. 20, 2013 •Target acknowledges the breach, saying it is under investigation Dec. 21, 2013 •JP Morgan announces it is placing daily spending caps on affected customer debit cards Dec. 22, 2013 •Customer traffic drops over the holiday season, resulting in a 3-4% drop in customer transactions Jan. 10, 2014 •Target lowers its fourth- quarter financial projections, saying sales were “meaningfully weaker-than-expected” Current estimates of the total financial impact to Target is $200 million Target provided affected individuals with 12 months of identity theft protection and insurance coverage 110M user accounts compromised , exposing credit and debit card numbers, CVN numbers, names, home addresses, e- mail addresses and or phone numbers
  • 22. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com “Ongoing forensic investigation has indicated that the intruder stole a vendor's credentials which were used to access our system.” Molly Snyder, Target Corporation January 2014
  • 23. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Email Attack on Vendor Set Up Breach at Target* * Source: http://krebsonsecurity.com/ The breach at Target Corp. that exposed credit card and personal data on more than 110 million consumers appears to have begun with a malware- laced email phishing attack sent to employees at an HVAC firm that did business with the nationwide retailer, according to sources close to the investigation. KrebsOnSecurity reported that investigators believe the source of the Target intrusion traces back to network credentials that Target had issued to Fazio Mechanical, a heating, air conditioning and refrigeration firm in Sharpsburg, Pa.
  • 24. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com ANATOMY OF A SPEARPHISHING ATTACK Target Victim 1 Install Malware 2 Access Network 3 Collect & Transmit Data 4 Breach Event 5
  • 25. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE PROFILE OF AN ATTACKER The malware used to hack Target’s POS system was written by a Ukrainian teen • Andrey Hodirevski from southwest Ukraine carried out the attack from his home • The card details that he stole were sold through his own forum as well as other communities • CyberID-Sleuth™ investigated the breach when it occurred and was able to verify various discussions and identifiers pointing to this suspect
  • 26. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
  • 27. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com An Internet service provider (ISP, also called Internet access provider) is a business or organization that offers users access to the Internet and related services. Source: http://en.wikipedia.org/wiki/Internet_service_provider#Access_providers Definition
  • 28. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com a.k.a: the “CLOUD”
  • 29. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com
  • 30. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com The Internet “Web” Topography
  • 31. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Can you identify what these numbers are?
  • 32. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com IP Tracer Source: http://www.ip-adress.com/ip_tracer/
  • 33. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com An IP Address gives the hacker access to your computer to run command and control botnet malware – you have been breached!
  • 34. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ PROVIDES MORE THAN AUTOMATED ALERTS Credential Monitoring Identifying email addresses from a corporate domain that have been hacked, phished, or breached IP Address Scanning Identifying devices in a corporate network connected to a known malware command and control server Doxing awareness and hacktivist activity monitoring Locating the individuals and exchanges involved in intellectual property theft Hacks, exploits against networks, glitches, leaks, phishing/keylogging monitoring Identification of communities targeting brands, networks or IP addresses Identification of intellectual property distribution Identification of individuals posing a risk to any IP address
  • 35. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES-PROVIDES EARLY WARNING AT TWO POINTS CyberID-Sleuth™ scours botnets, criminal chat rooms, blogs, websites and bulletin boards, Peer-to-Peer networks, forums, private networks, and other black market sites 24/7, 365 days a year CyberID-Sleuth™ harvests 1.4 million compromised credentials per month Dark Web CyberID-Sleuth™ identifies your data as it accesses criminal command- and-control servers from multiple geographies that national IP addresses cannot access CyberID-Sleuth™ harvests 7 million compromised IP addresses every two weeks
  • 36. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™
  • 37. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com REMEMBER WHAT THESE ARE? "automatedtest", "automatedtester", "bagle-cb", "c_conficker", "c_confickerab", "c_confickerc", "c_pushdo ", "c_trafficconverter", "c_zeroaccess", "childpredator", "citadel", "condo", "cutwail", "d_tdss", "darkmailer", "darkmailer2", "darkmailer3", "darkmailer4", "darkmailer5", "deai", "esxvaql", "fakesendsafe", "festi", "fraud", "gamut", "gheg", "grum", "hc", "kelihos", "lethic", "maazben", "malware", "manual", "mip", "misc", "netsky", "ogee", "pony", "relayspammer", "s_kelihos", "s_worm_dorkbot", "sendsafe", "sendsafespewage", "slenfbot", "snowshoe", "spamaslot", "spamlink", "spamsalot", "special", "spyeye", "ss", "synch", "w_commentspammer", "xxxx", "zapchast", "zeus"
  • 38. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Zeus Infection targeted towards multiple entities within the Hotel Industry within India CyberID-Sleuth™ identified a targeted Zeus campaign which appears to have been focused and distributed to Hotel chains, mainly within the India region. The attack in question caused active compromises against a number of systems. CyberID-Sleuth™ ’s main focus is the type of data often held within Reservation and other Hotel systems. Personal information such as credit card data, as well as passport scans or copies, are often held on Hospitality systems and the data identified next highlights that these same systems are compromised and under direct control of malicious actors. CyberID-Sleuth™ CASE STUDY ACTUAL CREDENTIAL DATA
  • 39. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL MALWARE VARIANT Infection Type: Zeus Infection - V2.1 Payload: Theft of all credentials, Key logging of all data, Remote access to devices Total Infection Count: 487 Total Credential Count: 12894 ( including duplicates ) Command and Control (C2) Domain: matphlamzy.com
  • 40. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA bwstarhotel.com - 111.68.31.202 ,('92', 'RSV1_E532648A3D69E5DE', '-- default --', '33619969', '', '', '1394590108', '7557047', '0', '±00', '1033', 'C:Program FilesMicrosoft OfficeOffice14OUTLOOK.EXE', 'RSV1owner', '101', 'pop3://reservation@bwstarhotel.com:starrsv1 *@116.251.209.92:110/', '111.68.31.202', 'ID', '1394590104') Date extracted and listed below is related to valid and legitimate accounts which are still active. These are not passwords taken from Breach events or other untrusted sources. They are taken directly from devices that are still infected/compromised!
  • 41. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA bwmegakuningan.com - 139.0.16.90 ('447', 'USER-PC_E532648A9824115F', '-- default --', '33619969', '', '', '1394593039', '162643491', '0', '±00', '1033', 'C:Program FilesMicrosoft OfficeOffice12OUTLOOK.EXE', 'user-PCuser', '101', 'pop3://reservation@bwmegakuningan.com: 79r2mz5xrx@116.251.209.92:110/', '139.0.16.90', 'DE', '1394593037')
  • 42. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ IDENTIFIES ACTUAL CREDENTIAL DATA townsquare.co.id - '180.250.172.36 ('453', 'RESERVATION_1F3D59E96522DF69', '-- default --', '33619969', '', '', '1394592970', '14267024', '0', '± 0', '1033', 'C:Program Files (x86)Microsoft OfficeOffice12OUTLOOK.EXE', 'TSPDCvitha', '101', 'pop3://reservation.seminyak@townsquare.co.id:tsbali1234@ 103.31.232.210:110/', '180.250.172.36', 'ID', '1394593095')
  • 43. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Over 257 unique credit cards were stolen during the attack. CyberID-Sleuth™ identified the botnet, which was made up of infected devices. CyberID-Sleuth™ CASE STUDY ANATOMY OF THE FINDINGS Q. How many credit cards were captured? Q. Specifically what data did it steal and report back that you could see? CyberID-Sleuth™ could see EVERYTHING that was entered on a user’s device or saved as a password or credential. Q. How much did this breach cost the client? No “price” could be put on the damage caused to a victim after a fraudster has stolen their credentials. The data stolen would allow the fraudster access to internal systems, either via the stolen credentials or via backdoor access to affected systems.
  • 44. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Q. What data about the attacker were we able to find? Limited details. Any information about the attackers are not shared with clients unless a directed attack, and is only shared with US and UK Law Enforcement. Q. How did the authorities use the data to capture the intruders The individual responsible for running the botnet in question is so far still at large. CyberID-Sleuth™ CASE STUDY ANATOMY OF THE FINDINGS
  • 45. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com CyberID-Sleuth™ Credential Monitoring Demo * * Let us see if your credentials are for sale, at no obligation Tier I
  • 46. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com A STANDARD RESPONSE TIMELINE SHOULD BE FOLLOWED Incident Detection / Discovery Incident Notification & Resolution RemediationEfforts Internal and External Communication of Event, Reaction, and Remediation Notification Capabilities Go Live Coordinate Breach Notification Copy and Distribution with Breach Remediation Vendor Establish internal or third party communication channel to affected population Contact and or activate contract with Data Breach Remediation Vendor Prepare Internal and External Communication Plan & Copy Determine Organization’s Public Response Plan (including notification type, verbiage, and remediation offering if any) Implement Breach Response Plan Determine total scope of event, size of affected population, type of data lost or compromised, necessary legal and industry specific guidelines Activate technical / security focused breach response team processes and procedures based on Data Breach Plan Initial Internal Reporting, notifications, and security triage of the “event” AssessmentEfforts Plan Ahead By Forming a Breach Response Plan CyberID-Sleuth Tiers II & III
  • 47. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com THE COSTS OF A DATA BREACH ARE VARIED • Detection or Discovery—”Activities that enable a company to reasonably detect the breach of personal data either at risk (in storage) or in motion” • Escalation—”Activities necessary to report the breach of protected information to appropriate personnel within a specified time period.” • Notification—physical mail, e-mail, general notice, telephone • Victim Assistance—card replacement, credit monitoring offer, identity theft protection offer, access to customer service representatives • Churn of existing customers / personnel • Future Diminished Acquisition of customers or employees
  • 48. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com RECOMMENDATIONS TO REDUCE DATA BREACH EXPOSURE & COSTs • Promote Employee Data Management Training & Education • Require GC / CISO and their teams to understand industry, state, federal, and event specific data breach response guidelines and recommendations • Establish an internal data breach response plan and process flow • Prior to a data breach event contract with a data breach remediation, notification, and or forensics provider • Utilize and maintain available data loss prevention technologies such as CyberID-Sleuth™ • Require advance encryption and authentication solutions be in place across the organization • Contractually require notification from vendors who manage data from your organization to alert you of they incur a breach of any data • Support enactment of legislation that clearly dictates rules and guidelines for organizations to follow in advance of, and following a data breach event
  • 49. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com Take this 20 Question Assessment to Score Your Risk Level Give us a call and we can even do this over the phone!
  • 50. Data Security Compliance Advisors Certified Identity Theft Risk Management Specialists 873 East Baltimore Pike #501 Kennett Square, PA 19348 610-444-5295 www.BTR-Security.com 1. Remember to ask us for a no-obligation credential search for your enterprise 2. Allow us to give you your 20 Question Assessment Score on your risk level Email your questions to CyberIDSleuth@BTR-Security.com or to get two no-obligation services mentioned below