Talk given at TRISC 2010 by Kai Axford from Accretive
Kai has delivered over 300 presentations and he is a manager at an IT solutions company. Background at Microsoft in security.
Kai starts with talking about noteworthy espionage events:
- Anna Chapman. The Russian spy that recently got arrested. Pulls up her facebook and linkedin page. Later in the talk he goes into the adhoc wireless network she setup to transfer files to other intelligence agents.
- Gary Min (aka Yonggang Min) is a researcher at DuPont. He accessed over 22,000 abstracts and 16,706 documents from the library at DuPont. He downloaded 15x more documents than anyone else. Gary was printing the documents instead of transferring on a USB. Risk to DuPont was $400,000,000. He got a $30,000 fine.
- Jerome Kerviel was a trader that worked in compliance before he started abusing the company. Stock trading and was using insider knowledge to abuse trading.
Cyberespionage is a priority in China’s five-year plan. Acquire Intellectual Property and technology for China. R&D is at risk from tons of international exposure. Washington Post released a map of all top secret government agencies and private in the US. http://projects.washingtonpost.com/top-secret-america/map/
Microsoft and 0-day from SCADA is another example. SCADA is a very dangerous area for us. 2600 did a recent piece about SCADA.
Lets step back and take a look at the threat. Insiders. They are the ones that will take our data and information. The insider is a greater risk. We are all worried about the 17-year old kid in Finland, but it is really insiders.
There is a question of, if you gave your employees access to something, are they ‘breaking in’ when they access a bunch of data and take it home with them?
Types of users:
- Elevated users who have been with the company for a long time
- Janitors and cleaning crew
- Insider affiliate (spouse, girlfriend)
- Outside affiliate
Why do people do this?
- Out of work intelligence operators world wide
- Risk and reward is very much out of skew. Penalties are light.
- Motivators: MICE (Money, Ideology, Coercion, Ego)
In everyone that does espionage, there is a trigger. There is something that makes it happen. Carnegie-Mellon did some research stating that everyone who was stealing data had someone else that knew it was happening.
Tools he mentioned and I don’t know where else to mention them:
- Maltego
- USB U3 tool. Switchblade downloads docs upon plugin. Hacksaw sets up smtp and stunnel to send out all the docs outbound of the computer.
- Steganography tools > S-Tools. This is what Anna was doing by putting info in images.
- Cell phone bridge between laptop and network.
- Tor
Mitigate using:
- defense in depth
- Background checks, Credit Check,
- gates, guards, guns,
- shredding and burning of docs
- clean desk policy
- locks, cameras
- network device blocking
- encryption devices
- Application Security.
- Enterprise Rights Management.
- Data classification.
the agile admin 
“everyone who was stealing data had someone else that knew it was happening.”
That is a weird statement. It sounds as though there is someone that he / she shares that secret with.
But that someone might just be the person that profits from the information.
That means being an insider and stealing data without selling / giving it to someone else would make little sense … And that someone else would know about the stealing, I presume.