APT & Data Breach - Lesson Learned
•Download as PPSX, PDF•
0 likes•60 views
(2015) This slides to show the audience how APT work and can cause massive data breach in one famous company in US. Lesson learned: keep security in mind for the sake of your business.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to APT & Data Breach - Lesson Learned
Similar to APT & Data Breach - Lesson Learned (20)
More from Ade Ismail Isnan
Recently uploaded
Recently uploaded (20)
APT & Data Breach - Lesson Learned
- 1. Sony Pictures Data Breaches Brief Technical Analysis By: Ade Ismail Isnan Compiled from many source. Send any suggestion to: adeismail@tibandung.com
- 3. Sony Pictures Hack • Targeted & organized attack • The duration of the hack is yet unknown, though evidence suggests that the intrusion had been occurring for more than a year, prior to its discovery in November 2014. • Perfect example of Advanced Persistent Threat (APT) attack
- 4. APT Attack Vector • Email attachment contains malware • Drive-by download website • Malware attached with legacy apps (Trojan) • Application attack • 0-day vulnerability • Social engineering
- 5. Facts About Sony Pictures, Prior the Attack • “1 firewall and more than 100 other devices were not being monitored” (source: recode.net) • “The auditor found the password Sony employees were using didn’t meet best practice standard. Sony employee were using proper nouns.” (source: cio.com) • “Sony Executive knew about extensive IT Flaws two months before leaks” (source: gizmodo.com)
- 6. Backdoor.Destover • Also known as BKDR_WIPALL.A in TrendMicro threat DB • This backdoor were used by the hacker to take control of Sony computers (source: trendmicro.com) • Once activated this backdoor provide access to the compromised system for the attacker with hardcoded username • It also tries to connect to the several IP address on the internet (over SSL/encrypted), including: – 203.131.222.102:443 – 208.105.226.235:443
- 7. Backdoor.Destover Attempt to login to shared network drives Connect to its C&C Server via encrypted communication (SSL) Programmed to wipe ALL data on compromised hosts
- 8. Backdoor.Destover Another dropped malware, net_var.dat, search and scan in Sony network (by ping sweep & TCP/UDP sweep scan) So then it will provide list of targeted hostnames
- 10. Attack Flow: (1) Attack Vector
- 11. Attack Flow: (2) Backdoor Provide Access Compromised Exploit! -Bruteforce weak password -Unpatched service vulnerability Compromised Exploit! -Bruteforce weak password -Unpatched service vulnerability Compromised
- 12. Attack Flow: (3) Stealing Data Compromised Compromised Compromised Films, email conversations, employee data, password files, and many more (reported: around 100 TB)
- 13. Attack Flow: (4) Time Bomb in Nov 24th Compromised Compromised Compromised
- 14. Key for the Major Breach: Bad Password Management Below is a screenshot of some of the contents of the ‘Password’ folder from the Hacker’s “bonus.rar” file:
- 15. Aftermath • The hackers involved claim to have taken over 100 Terabytes of data from Sony, includes some films that planned to be released to movie theatre in 2015:
- 16. Aftermath (contd.) • The hackers wipe some sensitive data using the built-in function of Backdoor.Destover malware • The hackers released Sony sensitive information to public (eg: contract, salaries, email conversation, employee database, etc) • Cyber attack could cost Sony studio as much as USD$ 100 million (source: reuters.com)
- 17. Aftermath (contd.) • Several Sony-related social media accounts were also taken over (those social media passwords were also included in “bonus.rar” file)
- 18. Lesson Learned • Lack of awareness of security risks by Sony Pictures from management executive & employee • The importance of IT security monitoring and system patches • Sony Pictures should have and enforce the standard security procedure to the organization • Sony Pictures should classify the level of sensitivity of its data/information/infrastructure (eg: Top Secret, Highly Confidential, Proprietary, Internal Use Only, Public) and control access to them. • Sony IT employee should not store password in plan-easy-to- read-text • Sony Pictures doesn’t have proper incident handling procedure
- 19. Major Security Breach Cases Company Case eBay The online auction house suffered a breach in May 2014 that compromised the account information of over 100 million customers. JP Morgan This investment banking institution had been breached. The breach reportedly affected over 76 million households and 7 million small businesses which resulted in the compromise of user contact details including names, addresses, phone numbers, email addresses, and others. Sony Playstation In August 2014, Sony has become a target of a distributed denial of service (DDoS) attack. The attack impacted their online services. Sony Pictures Entertainment The hackers involved claim to have taken over 100 Terabytes of data from Sony, includes some films that planned to be released to movie theatre in 2015. This cyber attack could cost Sony studio as much as $100 million USD Forbes Organizations performing threat intelligence research and endpoint security have collaborated in reporting that Forbes.com was among several sites that were compromised from November 28 through December 1, 2014. China Government Hundreds of phone numbers, names, IP addresses and email addresses from Chinese government servers have been stolen and leaked online by Anonymous group Various & Multinational Institutions an APT group called Carbanak, a.k.a Anuanak and Silicon, has stolen an estimated $1 billion USD from more than 100 financial institutions in 30 countries.
- 20. What is Security Awareness? Security awareness is knowledge of potential threats. It is the advantage of knowing what types of security issues and incidents members of our organization may face in the day-to-day routine of their Corporate functions. Technology alone cannot provide adequate information security. People, awareness and personal responsibility are critical to the success of any information security program.
- 21. Process People Technology Systems must be built to technically adhere to policy People must understand their responsibilities regarding policy Policies must be developed, communicated, maintained and enforced Processes must be developed that show how policies will be implemented Security Implementation Relies On:
- 22. Why is Awareness Important?
- 23. Virus Signature Virus Signature Virus Signature How about this? I’m new threat! Antivirus software updated… - 1 new known virus added! Oopss… Oopss… Oopss…
- 24. Most Common Security Mistakes 1. Passwords on Post-it Notes 2. Leaving the computer on, unattended 3. Opening e-mail attachments from strangers 4. Poor password etiquette 5. Laptops on the loose 6. Plug and play without protection 7. Not reporting security violations
- 25. Q&A Thank You By: Ade Ismail Isnan Compiled from many source. Send any suggestion to: adeismail@tibandung.com