Kingpin

Kevin Poulsen's Kingpin is a fascinating look at the world of cybercrime involving credit card theft and fraud. The story is told from two angles. The first is from the perspective of Max Butler, one of the leading cyber criminals of the last ten years, and the second is from the perspective of law enforcement. We follow the path of J. Kevin Mularski, an FBI agent, who leads the effort to track down and ultimately capture Max Butler.

As “Iceman,” Butler ran Carders Market, an online marketplace for illegal credit card data. The book covers many of the high-level techniques that Butler uses to break into systems, invade Point of Sale Systems, and it includes a solid discussion of how SQL injection is used to steal data. In fascinating detail Poulsen covers how Max uses hacking techniques to take over many of the illegal sites that hackers use to buy and sell credit card information, shut down his competitors, and move all of the traffic over to his Carders Market site.

The dual focus on the criminals and the law enforcement efforts to capture them makes the story a page turner, and it reads like a crime novel. Kingpin also covers some of the law enforcement efforts surrounding, Shadowcrew, the online criminal marketplace that was shut down due to the information received from the combination informant / cybercriminal Albert Gonzalez, who would later be arrested and convicted for the TJX and Heartland Payment Systems breaches. The FBI brilliantly set up a VPN for the Shadowcrew service so that they could tap all of the online conversations and identify the evildoers.

Kevin Poulsen certainly knows the hacker underground, as he was convicted in June of 1994 of several computer crimes and was sentenced to over 4 years in prison. Jonathan Littman covered his Kevin’s exploits in The Watchman: The Twisted Life and Crimes of Serial Hacker Kevin Poulsen. Poulsen is now a Senior Editor at Wired.com

Poulsen’s first-hand knowledge leads to one of the most interesting facets of the book. At many times Poulsen’s story of Max Butler describes the psychology of Max. He parallels many who are involved in the world of hacking. They are conflicted individuals, with a childlike love of learning and exploration, without the moral tools to stop them from crossing the line into criminal behavior.

The book has the two key elements that I look for: it is entertaining and informative. It is a must-read for those who have an interest in information security and care about the digital economy.

The CREATOR OWNER Problem

This post describes the problem caused by the CREATOR OWNER permissions that are set by default in Windows Server 2003 on folders. Take the example here of the Human Resources folder and all of the subdirectories underneath it. This is sensitive data that we want to manage the permissions extremely carefully. The challenge with the CREATOR OWNER permission is that when a user creates a subfolder within a folder that contains this permission, the SID of that User is set to Full permissions on the new folder, even though we had given them only Modify permissions within the "Terminations" folder.




If we look at the security of the "DoneBYSSmith-CO-ON" folder, we can see that Windows Server 2003 has added an Access Control Entry for Sally Smith and given that user Full control.



This is not what we wanted, but Windows does it because the CREATOR OWNER permission was set at the parent folder as shown here.



What we need to do is remove the CREATOR OWNER at the top level folder where inheritance is turned off and then push it down to all of the child objects. The permissions should then look like this at the parent folder. When any user in the grp.Share.HumanResources.Modify group creates a folder, then they will not inherit full permissions, which is normally what we want. They will instead retain just the permissions granted by the group they belong to.



Beware the CREATOR OWNER SID.

Stop Monitoring a Directory in Varonis

There are several types of directories that you may not want to monitor at all in Varonis DatAdvantage. These might be temporary folders that are used by products such as disk archiving solutions that have a cache directory on each Drive that is archived. This will stop all event collection and permissions monitoring for that folder and any subfolders.
Go to each drive where you believe this is an issue, click on the folder to be excluding to select it. Then right click on the folder and select the “Stop Monitoring” option.



When you select the directory a warning dialog box appears asking you to confirm your choice.

If you click “Yes” then the system stops monitoring the folder immediately.

Wireless Security and Monitoring in Government Agencies

Ericka Chickowski has posted on article on DarkReading discussing the shortfalls of wireless security across government agencies. I offered several of my thoughts to Ericka on the topic which were cited, especially mentioned the need for Network Access Control solutions. Here is the article. Here is a link to the GAO report.

Who is minding your Data Stores?

I recently received the “Benchmark Study on Patient Privacy and Data Security” by the Ponemon Institute, that was released on November 10, 2010. One thing that always screams out to me from these reports is how few of the data breaches are detected by the organization that was breached. According to this study less than half (47%) were detected by a hospital employee and in a significant number of cases (41%) it was the patient themselves that noticed the breach.

When you look at statistics from Gartner and other industry analysts, much of the security spending dollars are going to preventative controls and a much smaller percentage are going to monitoring solutions and detective controls. Do we as a security professionals have that backwards?

In spite of significant investments in firewalls and anti-virus tools - generally the two largest categories overall - organizations continue to get breached and data continues to leave the castle. Are you focused enough on detecting when unusual activities are taking place in your company and spotting potential breaches?

Home Directory Data Usage

One of the neat things that you can do with Varonis DatAdvantage is monitor how much disk space your users' home directories are taking up. If you are like most organizations where all of the home directories are stored in a common directory on the file server, this is a snap.

Using the 4f report - "File System Objects List" create a report with two filters.

• The first is: "Access Path" and should be set to the top level folder that contains the users' folders; such as "D:\home."
• The second is: "Directory Depth" and should be set to 3 so you capture each user's folder on a separate line in the report; such as "D:\home\auser."

Then click on the "Extended Properties" tab and select the "File count" and "Total size in MB" options. Sort, the report on "Total size in MB" and away you go.

This will generate a list of all of the home directories with their associated disk usage, allowing you to identify users who are taking up an inordinate amount of disk space. Save this report to a spreadsheet and run this on a periodic basis and you will be able to track usage trends.

Slap on the wrist for Russian Hacker in RBS Case

Unfortunately, the Russian authorities only handed out a suspended sentence for Viktor Pleshchuk, one of the hackers who broke into the systems at RBS WorldPay Inc. They stole approximately $9 million from 2,100 accounts and Viktor essentially got off scot free.

Several inherent problems are revealed in this decision. First, the United States has no extradition treaty with Russia for these types of crimes. Since a large number of attacks originate from Russia, this is something that the State Department should be working as one of the top priorities in Obama's efforts to improve cybersecurity. If we cannot punish the bad guys, all of the reports and committees are of little use. Second, according to the story on Bloomberg, his lawyer's statement that “This is not a regular crime but a cybercrime and Pleshchuk didn’t really have a full understanding of the damage he was causing,” is comical.

These type of criminals hurt thousands of people on a daily basis and need to be severely punished.