Slashdot Mirror
Cleaning Up the Mess After a Major Hack Attack
Hugh Pickens writes "Kevin Mandia has spent his entire career cleaning up problems much like the recent breach at Stratfor where Anonymous defaced Stratfor's Web site, published over 50,000 of its customers' credit card numbers online and have threatened to release a trove of 3.3 million e-mails, putting Stratfor is in the position of trying to recover from a potentially devastating attack without knowing whether the worst is over. Mandia, who has responded to breaches, extortion attacks and economic espionage campaigns at 22 companies in the Fortune 100 in the last two years and has told Congress that if an advanced attacker targets your company then a breach is inevitable (PDF), calls the first hour he spends with companies 'upchuck hour' as he asks for firewall logs, web logs, and emails to quickly determine the 'fingerprint' of the intrusion and its scope. The first thing a forensics team will do is try to get the hackers off the company's network, which entails simultaneously plugging any security holes, removing any back doors into the company's network that the intruders might have installed, and changing all the company's passwords. 'This is something most people fail at. It's like removing cancer. You have to remove it all at once. If you only remove the cancer in your leg, but you have it in your arm, you might as well have not had the operation on your leg.' In the case of Stratfor, hackers have taken to Twitter to announce that they plan to release more Stratfor data over the next several days, offering a ray of hope — experts say the most dangerous breaches are the quiet ones that leave no trace."
Hacked by this Mandia bloke, no doubt.
Clean installs on everything, new passwords, and don't trust anything executable that has been on the compromised machines anywhere near the time it was hacked.
It's not a huge deal here anyway - because this lot have a high profile everyone forgets how small they really are. Your local newspaper probably has a bigger operation and a hell of a lot more subscribers.
A bunch of people that had nothing to do with the breach will more than likely end up losing their jobs over it (often the same people that warn about these vulnerabilities beforehand), while the retards that caused the breach, either through their ineptitude or refusal to spend money on proper security, walk away unharmed.
In all seriousness, there really needs to be a court recognized standard for IT security due diligence. There are too many organizations doing their own thing or using "compensating controls" that only work in some auditors dream world.
First objective: Assure stake-holders and the public that Stratfor is handling things professionally, nevermind the stupid mistakes they made before. Those were probably some intern's doing, who has been sacked. It's all professional again now. It wasn't that bad in the first place, because the hackers are publishing information. Can you imagine how much worse it would have been if they had kept the secrets to themselves? You see, nothing happened and everything is in professional hands now. Stratfor, run by professionals who deserve your trust.
There goes my new year's resolution. I wanted to be less sarcastic and cynical this year. Damn you, Stratfor.
I'm curious though. In the PDF Kevin Mandia states that 90% of private enterprises don't know their networks have been compromised until the government (DoD, etc) tell them. So, how does the government know that these companies are compromised ?
I mean, apart from seeing spammy emails coming out, or in the case of the spooks, them seeing information on another system somewhere that's obviously been "stolen" from a US bank or something, how would they know ?
What sort of things would have to happen for a company to get a "Hey, you have bad guys all over your network" visit from the government guys ?
I'm able to get to it through this link though:
http://www.nytimes.com/2011/12/30/technology/hacker-attacks-like-stratfors-require-fast-response.html
I agree with the sentence "the most dangerous breaches are the quiet ones" the reason is you don't know you got hacked and you don't know what they got. When a hack is quite the hacker can come and go as they pleases and instead of getting in and getting out the hacker has time to explore and make more exploits and holes for themselves to get in and out on. The best and most dangerous hackers are the ones you don't know about or can't stop from getting in and out of your network. I remember my security instructor saying "If a hacker wants in he is getting in just a matter of how long it takes them. You can do your best to prevent and clean up after but you can't stop it. If a hacker wants in there going get in some how."
http://www.thetechnologygeek.org
Anonymous published 50,000 credit card numbers online... and just whose interest is this attack in?... O_o
No good deed goes unpunished. - Avon, Blake's 7
You fail reading comprehension. Cleaning up problems, not Servers/PCs. There is a more to incident response than cleaning up the hardware.Obviously you haven't been there at "upchuck hour".
That is why I think we really need to stop encouraging and supporting these criminal hackers and put more consolidated effort into finding them and stopping them.
What they are doing is about the same as saying. I don't like the rich so I will steel from the poor who has to pay him.
Ha Ha we will laugh at the company who didn't fix all their security patches in time and didn't block done that Zero Day vulnerability. Or in real life terms. It is the companies fault for not operating their business in an impenetrable fortress.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
"I wanted to be less sarcastic and cynical this year."
Tell us another one.
Uhm no, mere vandals need to be cherished and promoted; those who work for the Chinese govt won't tell you something is amiss.
It is the companies' fault for not following basic security practices, especially if what they take taxpayers' money for is "intelligence".
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Like Kevin Mandia, I too clean up these messes professionally. Cleaning these things up starts with the data gathering and analysis, virus scans, offline analysis - and more that are not mentioned.
The MOST important thing that ANY admin should know is that the true professional hackers do not use rootkits. They will use exploits to gain their foothold, but rather than install a rootkit, they will install remote network admin utilities, such as Dameware NT utilities (old), or more recently I've seen LabTech Software.
This software is great for Managed Service Providers - it also is a dream come true for cyber-criminals as it provides a backdoor into networks using signed code that will not appear on any antivirus, anti-malware or anti-rootkit scan. It can sit dormant for years, get backed up, and restored. Even if you do run anti-virus scans on your backups prior to restoring them - as one commenter stated above - it would be of no use.
So, when I am gathering the data dump, what I do is look for ALL network management tools, and I have created scripts that search for these.
*****
Google this: C:\WINDOWS\LTSVC\LTSVC.exe Hijackthis
You will find examples of people who have run Hijackthis on their computer and posted the log online - the common complaint is that they keep getting reinfected and cannot figure out how. They've run {insert virus tools here} a number of times and cannot figure it out. They usually resort to reinstalling the OS.
*****
Anyhow - gathering up all the logs from every device on the network, linking how they went from machine-to-machine, enumerating lists of installed software on each machine, and also performing offline analysis of drives, searching for any file/directory modifications based upon time stamp. It is FAR more involved, but it is the only way to enumerate the intrusion.
Removal must be done all at once. Either cut the network access of all the devices, then remove, or write a custom removal script and schedule it as a task to have everything be done at precisely the same moment.
I then have custom IDS signatures that look for any unauthorized Remote Management & Monitoring software.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
experts say the most dangerous breaches are the quiet ones that leave no trace.
You would not have known.
In fact, security experts would like that to be your last thought before you go to sleep at night, and your first thought when you wake up, and uppermost in your mind when they pad your bill with zeroes.
Its 2012, and only one goddamn place on the internet has a paywall, and thats the one story slashdot links to. It was bullshit when you did it in 1998, and its bullshit now. (and apparently, it will be bullshit when you are still doing it in 2022)
Given the usage, it has to be a term that's fairly commonly known somewhere but I've never seen it.
They could by all means be that. Or it could be that the "3 million +" emails that are being used as a threat are only the loud part of the breach, by the same logic therefore, the less dangerous part.
The most dangerous breaches are the ones you don't know about... lol... no shit
What ever you do, don't ever mention Windows in relation to malware ..
It's not even that complicated. There's no sophisticated motive behind Anonymous other than simple vandalism. You see the behavior in small children who like to knock things down just to see them fall. People are looking for political, economic, social, etc reasons. There's no consistent thread. It's just vandalism.
http://en.wiktionary.org/wiki/nature_strip
Australian term, meaning "An area of grass beside a roadway, possibly with a few trees or shrubs, lying in between the footpath part and the roadway proper". Basically: Fools store their beer in their front yard, and complain when people take them for free.
The whole idea of a "corporate intranet" somehow being more secure than the general internets is a huge security risk. Instead, one should partition any corporate network into small networks which each have their own, full firewall. Servers should always be behind firewalls and expose just the ports which are needed to serve the specific protocols. Never, ever leave the stinking pile of insecurity called "Oracle" open for access from anyone, except designated application servers. I personally brought down an Oracle listener with the awful cracker tool called "telnet" and some random typing.
Some companies, such as BP, already follow this policy. Basically, don't expect your intranet to be "friendly". There is normally also no need that two PCs connect to each other, so eliminate that threat at the router. Don't have huge "file exchanges" where even unrelated people from your enterprise are all assembled. Also try to live with the smallest file server shares that are possible under the processes of your company.
In a big corporate network, there will nearly always be one infected machine, and if it is just the private computer some stupid person brought into the office.
Also, lock out all the "personal devices" crapola. Android is now a major virus platform and you should not take chances by allowing people to connect these devices to anything except a route to the general internet *and not more* !
If you take adopt this policy, all infections will be quite localized and can be easily dealt with.
http://it.slashdot.org/comments.pl?sid=2603836&cid=38589290
http://it.slashdot.org/comments.pl?sid=2603836&cid=38589290
http://en.wiktionary.org/wiki/nature_strip
Australian term, meaning "An area of grass beside a roadway, possibly with a few trees or shrubs, lying in between the footpath part and the roadway proper". Basically: Fools store their beer in their front yard, and complain when people take them for free.
Pretty much - except that your nature strip, unlike your front yard, is not your property - it belongs to the local council (for all intensive purposes) though you maintain it. It's where you put your garbage, and thing you don't want (like old furniture) for public collection.
Though people will sometimes complain if things on the nature strip are taken by the public (like out of their rented rubbish skip) the complaint has no legal standing (much like the bullshit legal sounding jargon people append to their emails - modern day hexes).
US has been warned. These people are true to their word, true to their cause and will be as hard to stop as any fanatic(not all fanatics are evil). Wake up and see these companies for the corruption and manipulation of our economy and our "free" way of life for what they are America! Democracy is good, Capitalism will be our own demise. It's a shame that the people who these groups claim to be fighting for end up the victims! But, heck, thats the same thing the Military does over sea's! They just call it VIOLENT-PACIFICATION and COLLATERAL DAMAGE!
http://it.slashdot.org/comments.pl?sid=2603836&cid=38588550
The goal isn't to collect data, it's to embarras companies. Being quiet doesn't achieve the latter.