What would you do ?

Hi girls and boys,

I have some questions for you...

There's this bigshot CO from a big new firm who thinks he's being "hacked" from inside his firm and wants to find out who the culprit is. So forward I was called to formulate a plan of how I will deal with this.

Now there’s a catch.
I don’t know the OS, don’t know anything about the network or any policies and probably will know it only by the time I’ll meet this bigshot and set foot in this new clients firm. For all I know the entire “I’m being hacked” thing might be paranoia. :rolleyes:
Now I hope this OS will be a Windows 2000 or XP or at least a NT4 with the security eventlog enabled (but I think this hope is in vein) so I could plow through the logs and hope to find the “hacker”.

So most likely there’s no security in this new clients firm and that will be the main goal…to sell security. But first I will need to catch this “hacker” and I want to catch him red-handed if possible (not necessary). Are there any tools that will monitor the pc and alert the user if unauthorized access is in process? Now I know a firewall has this possibility and maybe even some AV’s but I don’t want to install any of these tools yet. So what I’m looking for is a tool that will work on even a Windows 98 or ME and can show me who is connected or better yet ...Can show the client who is connected or tries to connect…anyone knows a good tool that can do this (free if possible) ... I would use netstat to see the active connections or something similar depending on the OS but I don’t think this guy will be doing that.

I will be investigating the pc and try to find any Trojans, Backdoors or anything else that maybe used by the “attacker”, and also I will be checking the settings on the pc, Is a firewall installed is the AV up to date, who has local logon rights, who has domain rights (if it’s a domain that is) and so on … but will be leaving everything as is on the pc to see who will be connecting.

Now I know there’s not a lot of information but what would you do if faced with this task?
Any advice from you specialists is appreciated.

Why don't you ask him what his OS is? What is he seeing on his machine that makes him suspect he has been hacked?
Can you speak to any IT bod in the company (if there is one) and find out if the machines are patched if they have any firewalls. how they connect to the internet, if they have a router, if so what is it?

If you ask intelligent questions you will appear to be knowledgable and experienced to the client and you will be better prepaired when you finally go on site.


Most likely the CO has been browsing pr0n and has picked up spyware.

well...snort and ethereal along with any other packet sniffer will serve your needs.

I would worry about catching the hacker. Chances are it doesnt exist. Get them secure and clean up the thousands of adware/virii you are bound to find.

Helas ... I wish it was that simple ... this is an Assignment where I don't get to call the guy or get the possibilty to talk to any of the IT-guys over there (if any are available).

That's the whole point , I get no info but the basics that's why I post it here ... if I had all the info I would post different questions if any.

I'm just looking for different input ... what would you do with such a task , a task where you hardly get info ...

"A guy thinks he is being hacked ... I don't know his OS , I don't know what the security or network is like in this firm and I can't ask because the guy isn't availble (read I don't wanna ask)...but I want this new client ... help him catch the hacker"

..this is what my boss tells me ... so hence my question.

I have a fair idea of what can be done and what not ... I'm just looking for nice ideas and things I wouldn't imediately think of.

Quote:

---

well...snort and ethereal along with any other packet sniffer will serve your needs.

---

I see what you mean ... but probably this idea will be too advanced to sell the client, he'll probably will like a simple solution :rolleyes:

And yes I to think the most things found will be virusses and a like ... many of them.

Thanks for the input

Strange your boss keeps you from contacting.

You should probably take a CD of the usual spyware tools, Ad-aware, spyware blaster, Spyware search and destroy, coolsearch shredder (CWS). A free antivirus such as Avast or AVG would probably be a good idea but I'm not sure if the free licences cover commercial users. A free firewall might be an idea also.

While you are there you may want to quickly audit the physical security around his machine, does he lock his door at night etc.
Find out if they have a password policy. If not you can speak to him about strong passwords and why it's a good idea to change them reguarly.
Do employees share passwords?
Do they have antivirus in place? Is it up to date?

Do they have a desktop policy? Are employees installing their own software? Are they using the company bandwidth for dowloading illegal material? You can talk to him about the consequences of having unlicenced software on his network.


Do they have an acceptable use policy (AUP) for internet and email. Is employee internet/email monitored. Do they have internet filtering? Does he know he could get into trouble if his employees download offensive material?


Check for wireless access points, if they have them find out if they are secured or just left open. Are they broadcasting SSID.

What about information assets? Does the company have servers or is it a network of destops with files stored locally? Do they have centralised backups? Is there a backup policy and is it being followed? How are the backups stored? Do they have offsite storage? Are backups tested?
Disaster recovery plans (business continuity plans)?

I see you are in Belgium, the company could well have information covered under the data protection act. Principle 7 of the DPA is concerned with the security of information covered by the DPA, he could get strung up for breaching that.


If they really have little or no idea about security of their network there is a lot you can do for them that is little do do with the specific of the operating systesms.

Aspman,

Many thanks for your input ... I will definetly be looking at this: Principle 7 of the DPA

And offcourse if I get to the location I will be looking into everything you mentioned ...

I just hope I get the possibility to check it all out ...there's a lot of mistery hanging round this new client :confused:

Anyway thanks again for your input,

C.

Maybe you can try this tool: WhoIsConnected
http://www.nativecs.com/index.en.php
I know that it is not the most "sophisticated" but it will do the following according the home page.

The brief description of opportunities:

Monitoring of network connections and open resources.
Disconnect any selected connection and closing any open resource.
Monitoring Your network connections.
Processes controlling.
Show open IP ports (Windows XP/2003).
Disable the newest connections to Your computer (analogue of the command "disable login" in OS Novell NetWare).

This program works on computers with operational system Microsoft Windows 2000 and later.

obviously take all your tools with you, scanners, sniffers, virus software the lot.

fully update and patch all their systems, scan for trojans, ensure once you have patched and cleaned the systems that all passwords are changed. If it is being attacked from within the company then ensure the physical security of everything. no passwords lying around, rooms unlocked etc.

People should not have access to anything they dont need so check groups etc.

you can sit a sniffer on the network and listen for anything abnormal, check all logs and if not already ensure logging is set up correctly. Make sure when you get there you get a full background on everything (the network setup, the reasons why they think they are being attacked, the proof, full OS and software details .. the lot)

you can never have to much information

Quote:

---

obviously take all your tools with you, scanners, sniffers, virus software the lot

---

Yes I will be taking an arsenal of tools ... but the most important being somekind of Knoppix distro for checking the clients pc to the bone.

I will also be looking into the physical security of the big man's office ... it's probably wide open.

I hate not knowing anything ... but then again it is also fun finding out yourself isn't it :D .

Thanks for the input guys.

I think I see this problem a little differently. You said he thinks he is being hacked, you can't speak with IT people ( guessing he doesn't trust them either ).

Before I did anything I would convince your boss that you need to sit down with the client ( without your boss ) , maybe over lunch, and find out in a casual atmosphere why he thinks he is being hacked and from where. Then go about and find out how much he knows about the network, AUP, etc.

Basically you want to Social Engineer your client.

From there maybe you can get a better idea of what you will need.
Remember, he puts his pants on the same way you do, even if he does have someone else to wipe his ass. As long as you are not doing it what do you care?

Quote:

---

Basically you want to Social Engineer your client.

---

Now that's maybe not a bad idea ... but now I have to convince my boss of this , that's something else ... anyway I'll make a nice report of the things I'll want to do and the steps I'm gonna take... with some fancy numbers in it ...this might help :D

But definetly worth investigating this Lunch thingy ;)

Thanks,

C.

Something just doesn't sit well with me about this whole senerio. Why wouldn't you be able to talk to the client? Why aren't you given the info you need to do your job? Why aren't you allowed to seek this info? A client isn't a client unless they're willing and able to give you what you need. This is like if I told you there was a pot of gold burried somewhere in the US and I want you to find it. Happy treasure hunting.

Really though, you need to talk to the client and find out why he has this feeling so you will know where to start. I personally would leave out the IT staff due to the fact that, if its an inside hack they have the most access and ability in this regard. In my experience though, people use "I've been hacked" to explain anything that might go wrong with a computer. It's possibly he received a pop-up from a website that says, "You've been hacked! Download our software to protect yourself".

Sounds to me like maybe your boss wants you to tell him what to do so he can take credit for it.

All is well ...finally

I persuaded my Boss to have a face to face meeting with the client ..it took some fancy numbers and different colors though :D ;)

Seems as this is a "personal" friend of my boss (fancy that, not realy a new client then) and he didn't want this to be taken lightly (as if) ... but now that he saw my plan he was all open about it (Jeezz).

So what is the problem ... the client has a new laptop (With Windows XP) and it needs to be updated and checked ... but he doesn't trust the local IT-staff anymore because he thinks they leave some "port" (his words) open on his laptop and use it to get sensitive info.(Why not get them fired then ??..probably wants more evidence ??)

But anyway the story short is , I need to do a security audit (why not tell me this immediately then) and report back to the client directly , not pass by the IT-staff...So all your tips will come in handy... now where's that Knoppix disk.

All the hush-hush for this... go figure ... but that's what you get with "personal" friends I guess!

Anyway thanks guys for giving me some advice ...It made writing the report a bit easier.

C.

Cemetric

Please take a little advice from someone who has "been there and done that" so to speak. You are obviously talking about a professional relationship with a major new potential client?

1. Do not use the free versions of commercial software. They are for private use only. If you do this you will only create the impression that you are unprofessional and untrustworthy. Go for the 30 day evaluations instead ;)

2. Do not try to do anything on the cheap. It is results that count not price.............you are your company's ambassador, and first impressions are important. If you act the cheapskate, they will expect your fees to be the same:)

3. Let the client do the talking, listen and evaluate. When they have finished you can ask your questions. Make sure that they indicate that you have listened to and understood what the client has said.

4. Keep important meetings offsite and away from the client's premises. Preferably during working time (not lunch breaks) when the "ears that hear and eyes that see" are otherwise occupied.

5. Make sure that you have a good cover story to explain why you are there. Otherwise you will be spotted immediately and they will cover their tracks and hide. I don't know the Belgian scene these days but perhaps some "data protection/security statutory compliance audit"............."TVA recording compliance audit"......

I base this advice on the time I spent as an auditor, and the brief was to catch thieves (fraudsters)

Good luck

Mmm very good advice nihil,

I'll keep it in mind ... as I got time to prepare myself ...the first meeting is set for the 13th of may ..so it seems it's not that urgent anymore ... this case is getting weirder by the minute.

But you make a valid point in your point 1 , I didn't think about it like that.
So it gives me a bit more time to prepare and search some tools with that 30 days eval.

About the cheapskate ... I think he alleady gets a "nice" price ..but that , as you mention, doesn't mean I have to "act" the cheapskate so valid point yet again.

As for the other points ... all good advice and will try to use it :)

Many thanks,

C.

In windows 2000 and XP (not sure about NT) if you go the the Computer Management part of the control panel it will show you Current share connections, including user name, computer name and a few other tid bits of information, I haven't done much security work for large companies but I know home computer users like to see that MS Windows is doing something about their security, even though we know it's not doing a good enough job! ;)

Among others, IknowNot and Nihil gave some good advice. I agree.

Quote:

---

Originally posted here by Cemetric
but he doesn't trust the local IT-staff anymore because he thinks they leave some "port" (his words) open on his laptop and use it to get sensitive info

---

Just to add to Nihils advice. The big Guy thinks he's being hacked? some "port"? He doesn't trust the IT Staff. Remember the IT staff doesn't need to Hack the laptop. When it's connected to the network, Some If not all (Depending on the size of the company) will have admin rights, know the local admin account, etc.

I've ran into a situation where a programmer for HR software was giving out individual pay amounts to fellow employees. The programmer had access to the data to do her job, but abused the privilege.

So here's my additional advice. Keep quiet during the investigation. Compile the data and let the Boss ask the questions. Don't offer any advice unless asked.

Quote:

---

Originally posted here by dinowuff
So here's my additional advice. Keep quiet during the investigation. Compile the data and let the Boss ask the questions. Don't offer any advice unless asked.

---

I disagree. I think being the expert in the field you are obligated to give advice. I agree that you might want to be selective on the advice you give, but by all means tell the boss what he needs to know. In most cases the boss doesn't know what questions to ask, so waiting for him to ask them isn't going to get anything accomplished. If its a case of misguided mistrust, educate him.

Edit: After re-reading your statement, are you talking about the tech boss, or the client boss?

zENGER:

I was referring to everyone at the client site especially the client boss. I have a tendency to think out loud while troubleshooting. I write down everything when investigating security breaches. When asked "Why are you looking at that log"?, or "what is that data telling you"? I simply respond - nothing conclusive yet.

Case in point. I once looked at a network with Trend Micros Office Scan installed on all the clients. At that time the office scan client used port 12345 to get it's updates from the local server. So I'm sniffing the traffic and say out loud "Wow - that looks like the NetBus Trojan". The client freaks, runs to his office and calls my boss stating that I found a big virus and he is going to cancel the contract with my company for failure to support.......

Big issues, almost got fired. If I had waited until I gathered all the info, I wouldn't have even mentioned the traffic since, in this case, it was normal network traffic.

I'll agree with that. I think it was a little bit of a misinterpretation of your initial statement. Goes to show a good rule for anything is don't speculate, investigate everything thuroughly and then provide a complete report. I took your initial response as saying don't tell the boss anything that he doesn't directly ask for, which I now see was just an error in my interpretation.

Hmmm,

Normally you would want an "audit room" so people cannot see or hear what you are doing.

A direct line telephone (beware of mobiles, a scanner can pick them up) and your own printer and somewhere secure to keep your documentation , or take it away with you.

You need to clarify your "terms of reference" with your boss up front. The normal practice is that you do the investigation, report back to your boss, and your boss will then report to the client, with you present for detail if required. You must get a budget/timescale for the job as well, which would normally get approval by the client before you start.

There is a need for quality assurance (and a$$ covering :D ) in that your boss will review your findings and discuss them with you. Once he is satisfied with your findings, he will go to the client..........that is his job after all? He may not be convinced, and want you to do more work.

If you look at financial auditors you will see a clear structure and methodology. The audit staff do the work, the audit senior reviews this, the audit manager then reviews it and it finally goes to the audit partner, who reports to the client. I was once Commissaire of a Belgian company, and the auditors reported to me :D Of course a financial audit is more formal because there are statutory regulations involved.

I believe that the general principles of performing a hacking investigation and a fraud investigation are identical (well at least your charge out rate goes up 4x! ;) )

OH, what I forgot to add to my last post is that trials of commercial versions of software tend to be fully featured, support network environments and are supported by the supplier.

You guys give me more info then I even hoped for :D

I mean this in a good way.. it is good to read experiences of people who actually have been in the field as well ... and have more experience in the field of security audits.

From what I'm reading the best practice and the way I'm gonna do this ... or as good as...

-I'll have a meeting on neutral ground with the big guy from the firm that needs to be monitored ...
-I need to find out why he doesn't trust his local IT-staff anymore and why he thinks there's a "port" open on his pc.
-I'll talk him through the process of the audit (but not in too much details).
-I'll report back to my boss and talk about the audit in detail and about the rendez vous with the big guy.
-By then it will be time to do the actual audit ... This afternoon I heard the audit will probably be extended to a full security and network audit ...yippiee :rolleyes:
-I'll collect my findings ... I use my own laptop for collecting data and making the reports and always take it with me...nothing is left behind. (sometimes we use a laptop and put it on the network for a few days to collect info but this stays in a closed room with limited access if possible , also this practice is just for a network audit without the security part).
-I report back to my boss with the necessary data and reports ...he then handles the rest with his "personal" friend.

Anyone has anything to add ... I know it's not very detailed but you get the picture.

Anyway many thanks to you guys for the perfect input and info.

C.

Do you think when you are finished you might consider taking the time to put together a tut on what tools you used and a generic form/presentation of the data for those parties interested? (myself included of course)

Maybe even the steps involved in the process from the meeting to the synopsis... I would be interested in nihil putting together a tut as well as he is obviously experienced in this.

Quote:

---

Do you think when you are finished you might consider taking the time to put together a tut on what tools you used and a generic form/presentation of the data for those parties interested? (myself included of course)

---

I might consider that ...yes :)

If I can fit it in the schedule (if I have a schedule like today that would be ideal :D ).

I'll try to make my report in that way I can use it as a Tutorial for AO.

Then again I might just write it entirely different ;)

But it will be after the 13th of may though.

C.