marchany cacubo2007

ID Theft: Are County Governments a Threat? Or How I’d Take Over the World: 

ID Theft: Are County Governments a Threat? Or How I’d Take Over the World Randy Marchany, VA Tech IT Security Office and Lab marchany@vt.edu

We Already Know How : 

We Already Know How We already know how to educate the general public on how to use a highly complex technical device safely It’s called Driver’s Ed The DMV We already know how to teach the general public to use 2 factor authentication It’s called an ATM card Why aren’t we showing home users how to secure

What People Think of Security: 

What People Think of Security Internal Network The Big Bad Internet The Firewall will protect us!

Place to Steal Personal Data: 

Place to Steal Personal Data S C Attack The Server Good Sysadmin Practices Install Sniffer, more dangerous in the wireless arena Install Encryption Email Attachments No Effective Defense if the Client is PC/Mac

Passwords ARE the First Defense: 

Passwords ARE the First Defense Bad Password Examples

Slide7: 

1 M 47 Million

We have met the enemy and it is vendors…..: 

We have met the enemy and it is vendors…..

It’s Insecure Out of the Box: 

It’s Insecure Out of the Box Security vs. Convenience Let the users debug the code OS vendors are starting to see the light Windows XP/2003 with security features enabled Apple OSX Linux systems with firewall enabled Application Vendors still don’t get it Oracle stepped in it http://news.com.com/When+security+researcher+become+the+problem/2010-1071_3-5807074.html

Slide18: 

Unlocked Key Mean Transmission In the Clear!

It’s Insecure Out of the Box: 

It’s Insecure Out of the Box Viruses will never be eliminated Multibillion $ industry to fight them Eliminate the threat, we no longer have multibillion $ industry. Wireless cash register software sending data in the clear Document imaging systems sending data in the clear Govt/LE records digitized by insecure software Printers, copiers based on NT!

Why buy the cow when you can get the milk for free?: 

Why buy the cow when you can get the milk for free?

Obtaining Personal Information: 

Obtaining Personal Information Public Records can be accessed from anywhere in the world. Local governments are allowing access to sensitive info via the Web without thinking about security.

County Clerks and Identity Theft : 

County Clerks and Identity Theft Making legal docs available on the net w/o good security practices. A secure www site isn’t enough Tom Delay SSN From Public Records Jeb Bush SSN From Public Documents Colin Powell Deed of Trust Colin Powell SSN from Public Records Do County Clerks (by extension, the state legislature) facilitate ID Theft?

What’s Going On Here?: 

What’s Going On Here? We’re spending $$$ to protect sensitive data (SSN) State govt is allowing SSN info to be obtained online Laws need to be coordinated Sometimes the data isn’t where you think it is….

Slide30: 

T-Mobile said the company's computer forensics and security team were "actively investigating to determine how Ms. Hilton's information was obtained."

PDA/Smartphones: 

PDA/Smartphones

Motivation: 

Motivation People want access to information all the time User expectation of information everywhere and all the time. Rapid evolution to use interconnected networks. Security Challenges Information sharing and security at odds. Laws, regulations, and policies not keeping pace. Stopgap measures.

RFID Technology: 

RFID Technology RFID tags. first “true” pervasive technology. Correlation tracking for inventory mgt Potential misuse by combining user habits with tags tracking data

PDA/RFID Threat Summary: 

PDA/RFID Threat Summary Data Disclosure Data Modification Tracking the target Denial of Service Attacks Drain the battery

Slide35: 

Basic View: This lets the users only view intrusion detection status of the B-SIPS Client Application. Advanced View: This lets the users view more information related to intrusion detection analysis. They can view the Smart Battery Data (SBData), currently running process list, the dynamic threshold (DT) value, and also calibrate the system. B-SIPS Client – An Intrusion Detection System

Battery Power Attack Contrasts : 

Battery Power Attack Contrasts Four sequential attacks detected by Axim X51v. Nmap SYN: -sS, UDP: -sU, Xmas: -sX, FIN: -sF

Attack the Client or the Server? Attack the PDA: 

Attack the Client or the Server? Attack the PDA PC, Mac, PDA/Smartphone Clients Your overall security architecture is subverted by PC, Mac, PDA/Smartphone insecurity.

Why PDA Attacks Work: 

Why PDA Attacks Work Poor Password Selection System Management Training Deficiencies Inadequate User Training External Open Environments affect your network Vendor supplied defects Lack of Mgt. Support to correct problems

Taking Advantage of the Surveillance Society We’ve Become…..: 

Taking Advantage of the Surveillance Society We’ve Become…..

Protect the Data – not the Machine: 

Protect the Data – not the Machine File system encryption Nice but why encrypt everything on the device? Oooh, I encrypted Office CE! Probably will win because people are lazy Data File Encryption Thumb drive encryption

What we would do to take over the world: 

What we would do to take over the world Deep Strike Strategy Local Strike Strategy Use Stealth worms Attack gadgets Pollute LE, Govt identities Wipe out the machines on D-day

Deep Strike: 

Deep Strike Target the data entry process Forget modifying it once it’s in the system Input faults at data entry point Corrupt NCIS/AFIS data Corrupt legal record entry Attack local stock broker systems Someone just “bought” a lot of shares Use to trigger auto buy/sell programs Corrupt in-stream stock quotes Just enough to fly “under the radar” Target hospital/medical wireless nets DDOS them to prevent info transmission

Deep Strike: 

Deep Strike Target RFID Inventory systems DOD, “ Walmarts” Direct shipments elsewhere. Don’t steal it, just redirect it at the critical time Force manual control to slow down the process E-passport, E-Drivers License, E-tags Track your targets Target the compilers, microcode Modify the chip instruction set Change the compilers to add backdoors Ken Thompson’s paper on Trust

Target Security Clearances: 

Target Security Clearances Target security clearance methodology Question the vetting process means every one that got clearance using that process is suspect Target Military personnel credit ratings Get SSN from county court house www sites Bad credit = revoked security clearances

Deep Strike: 

Deep Strike Target automated public service radio systems Use EAS automated receivers to send fake evacuation messages Evacuate mid size cities, small towns Target stadium or highway display boards “there’s a bomb in the seats” Stress local 911 1 more call than there are ambulances Use cell phones to generate the calls

Deep Strike: 

Deep Strike Target gadgets Not for control but for DDOS Target E-voting systems Target home systems For ID theft and DDOS Use stealth worm capabilities to fly under the radar of IDS, IPS Avoid Blaster-style attacks until needed as a diversion

Deep Strike: 

Deep Strike Erode trust in security mechanisms so they will be ignored For example, businesses will not turn down a sale but they will turn down a security process that is perceived to be corrupted Pick an infrastructure Stock market Credit card Drivers license

Local Strike: 

Local Strike Target LE, Military for ID pollution Mess up agent’s credit rating so the family can’t buy anything It’s a distraction Repeat for investigative teams/leaders/mgt Attack via Choicepoint, Seisint, etc. Use the tools LE would use Repeat for civilian leadership Legislative, executive, judicial

D-DAY: 

D-DAY Use the previous setup to create minor distractions “Why are they shipping 30K snowblowers to AZ” Launch real attack Activate bots introduced by stealth worms Wipe out all user data on infected machines

Solutions: 

Solutions Need Cyber training, awareness at ALL levels of society ATM Cards prove it can be done Society learned how to use a complex transportation technology (cars) in the past Driver’s license ensure a base level of knowledge of proper use of the technology ATM Cards prove it can be done

Summary : 

Summary Nothing has changed? Users trigger attacks Sysadmins trigger attacks Vendors trigger attacks The order has changed Vendors errors move to the top Mgt errors close second Cause training deficiencies State legislation is moving to the top