Industrial Espionage

This is a serious matter, I am asking for assistance.

1. A 'user' loads MSN Messenger and sends confidential company information to
to a 'friend'.

2. Have tried blocking MSN's port 1863, but it then uses HTTP proxy port
(thanks MS !!) Then tried blocking all the MSN IPs, but it still goes through.

3. Tried 5 different keyloggers, but A/V keeps picking them up.

4. Have put a sniffer on the users IP, but the buffer fills up. And not knowing
what day the messages will be sent.......

5. Blocked the IP address at the router, but the user goes to another computer.

6. Installed MS 2000 Professional on sensitive computers.

All systems are Windows based (and I'm not strong in Linux)

Report this person to HR and have them fired.

Lock the user's account from authentication onto the domain for starters.
Next, go around and make sure they can't install any third-party programs (2000 and NT both have that ability).
Get proof that they've had transactions sent (by default, messengers log to a file somewhere).

Wait for the user to try to log in and nail them when they come looking for access with the proof in hand from their repeated transactions on multiple machines and get them for the following:

1: installing and using non-approved software on company machines.
2: transmission of confidential and proprietary information to outside parties.
3: repeated violations of 1 and 2 when measures were taken to block this communication.

That's enough to warrant someone being fired and have a bad mark on their referral list. If none of those work, wait out in the parking lot with security and have them have "an accident". *he he he*

:D

Can't 'fire' them without the proof.

Wish I could lock them out of the domain; but their job depends on them seeing 'some'
information. (they are locked out of sensitive material....as is everyone except management)
Implementing Logon policies would cause others to have problems.

Can't stop them from overhearing information.

Vorlin; I agree with you 100 percent. There are written policies in place prohibiting loading software of any sort, and using 'chat' type programs, and xxx websites, etc.

MS Messenger has the ability of NOT logging it's files. (dammit) Otherwise we would just
print them.

Have to prove they download it, install it, use it, then remove it again.

Bit of a conundrum

well first off if you using win 2000 pro and this person has a id or user name there are lots or option you can do . just give the guy guest privileges on the workstations and or server and deni access to internet. just giving him guest privileges will make him unable to load or down load a program to the machine tada no msn messenger.

Can you configure your Firewall to log ALL inbound and outbound activity from this user (or IP)?

DjM

Our firewall is NAT, and configured to log all inbound/outbound connections.

MSN packets only shows the Router/firewall address, and not the internal IP.
Seems all Chat programs do that.

I'm thinking of installing a WinProxy server, and cascading to the Router.
It's logging feature is pathetic, but maybe with a sniffer I may be able
to pinpoint the offending internal IP.

By the sounds of it, a sinffer might be your only option.

Sorry, can't help more, if I think of anything else, I'll get back to you.

if you are running a w2k network you can give him extremely detailed privileges via the ACE.

For $99 bucks I could send you a hardware keylogger that records all the keystrokes typed into the device. Depending on model, it could hold 64kb or 128kb. But hey, this would be illegal wouldn't it?


I'm not in that kind of business anymore....

LOL...

You might want to check this out (Here) , its an 'add-in' for MSN Messenger and has some logging features in it. Might be worth a look.

actually there are so many ways of taking out sensitive info from the company... if you hv successfully block the msn messenger, the 'user' may just copy them onto a cd or diskette and walk out....

"trust" and "integrity" is difficult to control...

ternimating them is one option... knowing how the 'user' gotten hold of such info is important as it will allow you to how info within a company is kept.

good luck in getting the evidents.


rgds
de

one way is by physically securing the network.. which means having survalance cameras around and a Network Admin room with a HUGE one way tinted glass that can see most of what is going on in the room..

another is by using the logs.. notice what time and day he usually sends the files...

from there.. install a packet sniffer on your Proxy server.. once u notice he/she is starting to do his/her dirty work.. switch on ur sniffer and see which computer he/she is using through ur cameras and your HUGE window.. and lock on that IP address....

OR... link Hyper Terminal Server to the MSN messenger link so that once he/she launces the MSN messenger Hyper Terminal launches too and you can see what he/she is doing in his/her computer and u can litteraly stop him/her considering Hyper Terminal gives u full control over that computer..

BTW Hyper Terminal is not a trojan horse.. its a LEGAL Network Administration tool... :)

rerout the network to a nic on the administration computer the install another nic that attaches to the router, use a packet sniffer to pick up any information being picked up. Keep an eye on the email going in and out. If you find any "bad" email being sent. Trace it back to the IP of the computer and bust his ass. Granted it's not the best approach as going thru log files sucks serious ass.

that's nice it means that you can almost
do an attack against all microsoft product...
;)

agree with others...just install a packet sniff...ethereal is free and works great...just snap up all the packets when you think bud is doin the deed...

goin thru logs suckz but ethereal can filter by computer name so you can filter and reassemble the whole session...still some crap to wade thru but it is all there...

btw ethereal doesn't trigger av and you can install it on any box on the lan...

if yer in win2k course you could always set up an acl for the messenger dir on all yer boxes...
without explicit permissions..yer user is SOL...

this sort of thing has been going on for years. knowing microsoft the person was probably instructed to get their hands on the data. :cool:

I don't know a quick 'n' dirty solution but there are a couple of things, if you can prove it, if you've been asked to do something by management request and if your company has policies in place.

1. cut the person off from Internet access. If their job requires email, send it through an internal forwarder.

2. remove messenger from the system, or replace with a non-functional executable run your own Messenger server from an Exchange email installation (trial versions of Exchange can be ordered from MS for $10 and include the messenging and conferencing component so that companies can use Messenger internally and therefore relatively securely.)

3. use the developer kit and Messenger APIs to send a copy of all useage to a different storage device (there are other ways to reroute and capture all info tranferred on your wires that aren't Messenger specific ... but those are obvious with minimal research and so I'll leave that avenue for your own explorations .... hint: look in tutorials and downloads)
(developer link for Messenger is http://msdn.microsoft.com/downloads/.../359/topic.xml )



Give us an update when you get it sorted out .... :p

Quote:

---

Originally posted by dcongram
This is a serious matter, I am asking for assistance.

3. Tried 5 different keyloggers, but A/V keeps picking them up.

---

I'm not going to be much help for your problem but as far as keyloggers go I've always used Starr and it's never been picked up by any AV software. You can download it HERE. Very user friendly also. Being employed by a Government department we have weekly meetings regarding intellectual property and the price you'll pay for any leaks there of.......


Also, again not much help and a little off topic, but I've just finished reading a book titled "Intrepid" which goes into quite some detail on the "secret" war waged by Winston Churchill during WWII. Industrial espionage played a vital role in Nazi Germanys' downfall....

Find a way to program messenger into AV.

Report this activity to your boss, before you get fired. present him with the options i.e: 1)this much money to buy software plus X amount of time for set-up and configuration, to catch'em red handed 2) find another reason to fire.

What the hell are you waiting for, get rid of 'em. What if some of that info being sent hurts the company you work for, you'll be responsible (morally) for any job losses resulting from this, because you didn't act. You need to cut it in the bud, not play games.

Okay....situation handled (and many thanks for all the suggestions)

How ? Disabled A/V on the computer. Installed a Key Logger
and.......Didn't show up for 3 days.

(my presence made them nervous about being caught)