You're Bleeding Sensitive Data: Find it Before They Do [Presented by Steve Werby at OWASP LASCON 2011]

1. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You’re bleeding sensitive data Find it before they do

2. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby

3. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Raise awareness

4. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Raise awareness Identify low hanging fruit

5. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Raise awareness Identify low hanging fruit Show you the tools

10. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Obligatory disclaimer The opinions shared in this presentation represent the views of my employer. That’s right – the views of all 9,310 of my coworkers. I know because I’m omniscient…and omnipotent.

11. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Obligatory disclaimer The opinions shared in this presentation represent my the views and only my views of my employer. That’s right – the views of all 9,310 of my coworkers. I know because I’m omniscient…and omnipotent. Presentation disclaimers are only slightly more useful than disclaimers at the bottom of an email.

12. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby 18,931 individuals employed in 2002 File accessible via web from 2008-2011 Possibly accessible since 2002 Name, SSN, DOB, home phone, home address

13. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby 757 patients from 2007-2011 File accessible via web for 2 months Discovered by relative of patient Name, DOB, medical history, diagnoses, treatment plans

14. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby 20,000 emergency room patients File accessible via web for 1 year Posted to StudentOfFortune.com Name, admission dates, diagnosis codes, billing charges

16. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Jeremiah Grossman: “Anything you upload to a public website is not private…it’s public.” Craig S. Wright: “I would estimate 100 or more breaches occur for each one that becomes publicly known.”

20. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby robots.txt files that include directories you don’t want attackers to find Analytics programs that display hostnames and usernames Source code via broken web servers and unparsed backup files

21. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Actually, I've been working on a plan…I'll hide under some coats, and hope that somehow everything will work out.

25. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Requires easily accessible tools and little skill

26. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Requires easily accessible tools and little skill

27. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Finding data requires 1. Know what tools to use 2. How to use those tools 3. What to look for

28. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Effective Google-fu  Operators  OR operator  – operator  * operator  ~ operator  Filters  site:  filetype:  intext:, intitle:, inurl:  link:

29. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Effective Google-fu

33. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Effective Google-fu  filetype:  HTML - .htm, .html, .asp, .aspx, .cfm, .php  PDF - .pdf  Plain text - .txt, .csv  Microsoft Office - .doc, .docx, .ppt, .xls, .xlsm, .xlsx  Rich text - .rtf  OpenOffice - .odc, .odp, .ods  Databases - .dbf  Email – .eml, .msg  Other - .pst, .gz, .zip, .mdb, .xml

35. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Know your data  ID numbers  Financial data  Personal info  Personnel info  IT data  Website issues

36. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Know your data  ID numbers – SSN, drivers license, account #  Financial data – payroll, credit card, bank account  Personal info – address, phone, email, DOB  Personnel info – evaluations, disciplinary action  IT data – logs, system monitoring, vulnerable s/w  Website issues – compromises, error handling

37. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Know your data  IT data – logs, system monitoring, vulnerable s/w Monster LinkedIn Twitter

42. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Field names and labels  first name, f_name, first, namef, name_f  hw, homework, hw_1, hw 1, homework 1  assignment, exam, final, midterm, quiz, test  lab, paper, participation, project  username, user_name, user name  student id, studentid, student_id

43. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby File names  grades, grades_final, finalgrades  <dept><section>, <dept>_<section>  <dept><section>_<year>  <dept><section>_<semester><year>

46. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby 2003 2002

47. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby inurl:moodle.xml filetype:xml

51. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby  Proactively check for a subset of sensitive data  Real SSNs, account names, customer names

65. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Effective SHODAN-fu  Operators  +, -  Filters  hostname:  net:  os:, port: (21, 23, 80, 443, etc.):  before:, after:

66. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You found my device? So what‽

67. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You found my device? So what‽  Devices with no IT support  Unaware of web interfaces and exposed services  Unaware device is accessible via Internet  Unaware of value to adversary

68. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You found my device? So what? You don’t know the password.

69. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You found my device? So what? You don’t know the password.  Can it be guessed?  Was it really changed from the default?

70. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby You found my device? So what? You don’t know the password.  Devices with no IT support  Unaware of web interfaces and exposed services  Unaware device is accessible via Internet  Unaware of value to adversary

73. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby The basics  Delete data and systems that are longer needed  If it’s sensitive keep it on your private network  robots.txt is not your friend  [LHS of] email address != username  Disable directory browsing

75. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby The basics  Delete data and systems that are longer needed  If it’s sensitive keep it on your private network  robots.txt is not your friend  [LHS of] email address != username  Disable directory browsing

76. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Beyond the basics  Visibility into what you have  Scan for services  Maintain system and application inventory  System security  Patch OS and applications  Change default passwords  Disable/change banners and paths  The human side  Education and policies

77. Steve Werby | LASCON 2011: You’re bleeding sensitive data… | @stevewerby Questions?

You're Bleeding Sensitive Data: Find it Before They Do [Presented by Steve Werby at OWASP LASCON 2011]

More Related Content

Recently uploaded (20)

Featured (20)

You're Bleeding Sensitive Data: Find it Before They Do [Presented by Steve Werby at OWASP LASCON 2011]