Ideas on how the hacker is doing it?

Sensative information has been compromised by way of email and the jackel is using a hotmail account to share these sensative emails with others in the company who should not be reading them. I believe they are accessing calendars and monitoring emails as we speak.
The network is primarily Microsoft based with several SQL servers, Exchange, and 2003 servers. These servers are patched regularly and the patch management team does maintain a vigil with regards to patching. There are multipule sites that are using terminal services and Active directory group policies are used company wide.

The real stinger is this. I think the jackel is the guy who used to be in charge of Information Security at this company.
Now I have looked at the email header and tracked it back to the original IP which happens to be the company he went to work for....I have recommended the review of the exchange server accounts and have asked that this hotmail account to be blocked.

I suspect that IT is using Telnet on the routers and switches and that this guy has left himself a backdoor I will monitor the port tomorrow.

I have been asked to find this holeor holes and plug it. I am formulating a plan, but I have seen some amazing things come from the brain trust on this site and would appreciate any additional input. Simple or complex I have been charged with covering it all and I do not want to miss anything.

SO anyone up for a game against a grey hat? I will continue to post progress and findings and hopefully this can turn into a worthwhile senerio when all is said and done.

Bollocks, back up all your neaded data. Take the network apart re-format every pc and put it back together stronger tougher and harder than it was befor. Then go find the ex-admin and roger him to death.

Greetings:

I would actually suggest to your company management that the holes NOT be patched just yet, believe it or not.

I would contact your local FBI field office. They are VERY interested in cases like this (despite public perception otherwise), and would more than likely have an agent or two help you monitor his activity in such a way as to make it useful in a court of law.

Then you can plug the holes, and have this BLACK HAT arrested.

Ok so i'm a bit tipsy,

Firstly change you security settings on the router. Then do as JP sugests. If the router is your gateway change the password now, now. I say again now. Getting the feds involved is all well and good ,but your info is leaching away, once it's public it will always be public.

Quote:

---

Originally posted here by uno_digerati
The real stinger is this. I think the jackel is the guy who used to be in charge of Information Security at this company.
Now I have looked at the email header and tracked it back to the original IP which happens to be the company he went to work for....I have recommended the review of the exchange server accounts and have asked that this hotmail account to be blocked.

---

Since you automaticly assume him. I take it there was a bit of a tiff in the office, he had the priviledges to install what he wanted, then when he left you noticed these strange activities. Something of the sort correct? If so then I say I don't care who you are, how much money you make, and how deep in management you are in. No matter how high your rights to the box is it should still be audited and you should have two or three peaple monitoring these changes and compairing notes.

So if it is this then this means either this guy sliped something right under some other management's nose, he had access then did a few local exploits to up his rights you'd be surprised how many peaple only pay attention to critical updates for something done remotely, or (as I assume) there was a completely flawed policy over the network to begin with (ie) they left one guy to be godly over everything.

I wouldn't recommend a re-format, just by turning the computer off you can lose evidence. As you said you could just use a sniffer and collect evidence which this should have already had been done routinely as part of just another precaution if you ask me.

|The|Jackel

Quote:

---

Originally posted here by jinxy

Firstly change you security settings on the router. Then do as JP sugests. If the router is your gateway change the password now, now. I say again now. Getting the feds involved is all well and good ,but your info is leaching away, once it's public it will always be public.

---

Whose side are you on? Any sensitive information in the system is already comprimised, and by changing any setting or pass word you are tampering with the available evidence.
Do as JP has suggested and don't change anythingn untill the F.B.I. has authorized the change.

No your not, your just denying further access. If a bad guy has a gun the first thing you do is take it away from him.

Quote:

---

If a bad guy has a gun the first thing you do is take it away from him

---

That may be, but you don't trample all over the crime scene, otherwise you destroy and alter evidence..as much as I hate to agree with Mox (j/k :p)..and JP.

Electronic evidence is hard enough to get into court... if there is a chance any of it has been tamperd/altered, it will be completely inadmissable. ( <-- spelling doesn't look right?? )

EDIT: However, unplugging it from the network wouldn't be an issue from the forensics side...might be tough on business though.

Ok, so as The JAckel has deduced we are talking about a company whose idea of security is one Information Security guy and cutbacks took away a second. The only other auditing body was the network admin team and I believe the communication between them was tolerated when necessary. Not my idea of an ideal situation, but regardless......He left with a grudge and now wants to show us all how smart he is........
Jackel you make some great observations and as stated this was far from the ideal, but now what.....this is a 24/7 shop and disceting the network while desireable on some levels, will destroy event logs and lose the company money.

I am looking for maximum impact on his access with minimum effect on the business...... Jinxy.......a throttling may just not be to far from a reality and well deserved in my book:-)

uno,


It sounds like this individual is fairly well versed, so don't be surprise if he visits here as well. Who knows, he may have already read your thread. Obviously, he was sharp enough to create trouble for you. Anyway, don't even mess with this character, as stated before, get the FBI/Law Enforcement involved so he can get hammered by bubba. I'm sure they are looking for some of those Patriot Act violators, so give them one!

cheers

Just something to point out real quick, when a friend of mine was taken to court for uttering an idle threat back in high school (he was cleared of all charges), the police came to search his stuff. When they decided to take his computer, they didn't take just the hard drive; they took the entire computer. And not just that, the monitor, speakers, keyboard, mouse, and even his webcam!

I asked a friend of mine's dad who is a lawyer about this. It turns out that by just using another monitor, the case can be argued that the computer was tampered with, and thus all data on that computer was void in court.

Pretty messed up stuff to say the least.

If you are sure it is him and you want to press charges, don't do anything to the computer, but act quickly. If you care to let it go, then format and start over. Even if you do decide to take action, after everything is said and done still format and start over.

Don't drag the FBI into this.......

Not even his crimes deserve the somewhat unfair wrath of the feds.

Unless you hate and despise the person, it is not worth throwing them in jail for 10+ years. If you have a good idea who it is, which it seems you do, try confronting the person and letting them know you are aware of their actions. (Or confront them in a less obvious way or even by an anonymous email).

cheers

Feds=last resort

Quote:

---

(Or confront them in a less obvious way or even by an anonymous email).

---

I'm sorry, but ooh, that will leave them quaking in their boots. And just how will that serve as a deterrent? Just exactly what is to keep this person from doing it again? Oh yeah...jail maybe?

I'm not saying your opinion is wrong, everybody is entitled to it. I just disagree. Causing a disruption of business = loss of income = theft.

[qutoe]unfair wrath of the feds[/quote]

Umm..let's just say that's a topic for Cosmos.

My 2 cents

You may have to figure out how much this person is costing your company and way it against the possibility of how much the feds are going to cost your company. Take it from me they are intrusive.

Quote:

---

Originally posted here by br_fusion
Don't drag the FBI into this.......
Unless you hate and despise the person, it is not worth throwing them in jail for 10+ years. If you have a good idea who it is, which it seems you do, try confronting the person and letting them know you are aware of their actions. (Or confront them in a less obvious way or even by an anonymous email).

---

Mr.TS says: Say no to school. And stay in drugs! And some day you'll grow up to do more important things in life than just be a member of a gang like the bloodz and the krypt siddies.

Come on man! Urp... :chuck:

Let me put it this way, do you realise that mostly the large majority of ritualistic serial killers start out with minor theft, burglery, drugs, vandalism, assualt & (ect)... eventually riseing to more and more devious crimes which eventually leads to a assortment of murders. Next time I see some interesting characters commiting a crime I won't do darn thing... I'll take your advice and instead of walking away and calling the cops or something of the sort... I'll just walk over to them like a tottal dumb-ass and say hello or something then just let peaple walk away with what ever they feel like doing like a ga' damn pussy.

Quote:

---

You may have to figure out how much this person is costing your company and way it against the possibility of how much the feds are going to cost your company. Take it from me they are intrusive.

---

Correct me if I am incorrect here, but isn't there a limit on the damage done before the FBI can even step in? Further more isn't $10,000 what it take to get any type of sentencing in court passed? I remember reading this somewhere. Call the feds, they can help.


off to find source

:confused:
What the hell is up with this string, The person originally asked for help in finding the hole or holes that this person is using Instead it turned into a FBI yes or no question. F**k
me, this is not right. Did anybody actually suggest filing a report, keeping and logging records, and then just patching all the dam holes that are open. Or is it just me in my infinite damnation that I am thinking this way.

The FBI will do nothing except take a report unless there is a major loss/harm of equipment, life, or revenue.

$10,000 to get a sentence in court. Hhhmmmm don't think you can put a price on a prosecution. They run from $20 a hour your local piglet gets paid for a traffic ticket to millions for SEC filings

Greetings All:

No offense to anyone, but I think many of you are offering advice and opinions with an obvious lack of experience and understanding to back them up.

For starters, someone suggested that he simply format everything that's connected to the network and reinstall it all from scratch. That's cute. That may work for a 3 computer network that you have in your bedroom, but this is a literal impossibility for a corporation of any size to do.

Secondly, someone suggest that he contact the perpetrator directly. What exactly this is supposed to accomplish is above and beyond me? Letting him know that you know that he's the one responsible? I think, given the specifics, it's safe to assume that this man WANTS everyone to know that he's responsible. If he's formerly in charge of security, and assuming he's not 100% incompetent, he's more than likely well aware of simple things such as Hotmail passing along the originating IP of these e-mails that he's sending all over hell. He's probably relying on the fact that "no one would bother doing anything about it", which is indeed what many of you suggested he do about it, nothing.

As for this $10,000 in damages before the FBI gets involved, so his case wouldn't even meet that standard. Again, comments coming from those without experience with either the FBI or the Corporate world...

What we have here, is the case of a disgruntled employee, who used to be in charge of the corporation's security that he's now breaching. Who knows how many backdoors this man has left himself? In the routers, in the firewalls, in server configurations, software, scripts, hidden accounts, trojans, the list could go on and on. Some of which might be open holes, others might be time or action activated.

The problem here isn't HOW he's doing it, it's that the former employee in charge of information security has shown that he breached his former trust with the company, and as such, they can't trust ANYTHING that he had his hands on.

How much do you think THAT'S going to cost in man hours to rectify? A lot more than $10,000 I can tell you that (although that $10,000 is an imaginary number to begin with. such intrusions can be prosecuted regardless of monetary damages sustained).

At the very least, if the FBI gets involved, a plea could be offered that would require this former employee to disclose under oath all vulnerabilities that he had in place. Not that you could trust that either, but it would at least be a start.

Also, it's been my experience, that once contacted by the FBI, the ego's and motivation of these types is quickly and completely diminished.

Thank you all for your opinions and insight. Today I will talk to the powers that be and offer them 2 options.
1- Pursue legal prosecution (FBI)
2- Prevention and Preservation

Since this is there decision I will try to inform them with what I know and some of hte insight you have provided. I understand the ramifications of both and appreciate all your input. Once the powers that be decide what it is they want to do I will post here once again.

As several people stated I was hoping to get more information regarding the option to preserve and prevent, however, after reading JP post it is evident that there is so much hardware and software that will need to be examined, tested, and rebuilt.

The recommendation has been made to start with the router and I understand the reasoning. Changing admin passwords and verifying the access list is a great place to start.
My question is this. Why not start with the Active directory accounts and work from the Exchange Server out to the router since that seems to be the target? There is a webmail interface on an external website. My bet is that he has an admin account on the Exchange server and is using the webmail interface to look in peoples email folders........ Comments? Or suggestions for locking this down?

Hum, as he was the Admin, and he is a Son-of****, he may inserted a lot of backdoors beside de obvious ones. (JP and others said all about the obvious). For example, He can inserted a trojan that will be trigged by some event (such as a date, a account modification etc) and it will f*** all network.
Since you have your network assets compromissed, im assuming that this guy REALLY knows what he did and I advice you to take precaution.
I true believe that FBI must be in this case, because guys like this must go to JAIL (10 years? too short - life maybe?)
Admin guys that do that are like corrupt cops: they must be taken as EXAMPLE to other smart guys

Digerati:

JP is dead right here. Let's think about this. I don't know how big your network is but whatever.... There are a gazillion ways it may be subverted...... That's a lot of work to do to clean it. Take a stroll down to your accounting department. When you gat there they should be able to tell you the depreciation you caused to the carpet as you walked there and how much per minute the 1 sq. foot of space you are taking up costs for the time you stand there. My point, everything costs money. You cost your company money every time you respond in this forum. It doesn't take long for those costs to rack up and become some serious cash that your CEO doesn't really want to see "bleeding" away from his bottom line.

The point of that is..... You have a "choke point".... Thats a place where all things _must_ pass. The choke point is him. Neutralize the choke point and the private information stops leaking. The cheapest form of neutralizing him is to pick up the phone and call the FBI, period. You'll spend hours, days or weeks trying to prevent him and you will miss something.... all that money down the drain. For the price of a phonecall and a couple of hours with the feds showing them the evidence and "Bingo", the problem of leaking information is solved... He will go really quiet, really quickly when they turn up on his doorstep.... I've seen this happen.

This is one of those cases I really joined up to comment on. Having worked with the US Government (Dept. Of Treas.), I can say for an absolute fact that the FBI is the place to go. Get the blue pages of your phone book and get the local office number, phone calls are always taken more seriously, and get routed to the right people, faster. The FBI and secret service investigate such things regularly, however I will say that the first thing they are likely to promote is a lockdown of your entire network for forensic investigation, irrespective of whatever logs you can provide. Assuming this person had at least as much of a clue as I do (and hopefully anyone in such a capacity would have significantly more) he would have inserted as much code into your systems as he felt he could get away with, and apparently had ample time to do so. I would bet the INDIVIDUAL boxes have been infected with trojan-like code besides the network itself, as many have already said.

I have to strongly encourage the FBI route, thats all my ranting is really for.

The verdict is in......The powers that be do not want the press or the help of the government. So the decision handed down to me has been to prevent and preserve.
I am going to start with the suggestions made by JP regarding the router, I am going to have all admin passwords and hardware passwords changed for any admin accounts, I am then going to move to the Exchange Server and work to validate the accounts. I will also setup a sniffer to monitor open ports and log traffic on unusual ports.

Ok folks this is what I was afraid would happen.....Any other suggestions on the next steps to take. I am going to work from server to server once the perimeter is checked.

First thing you need is a network audit..... You need to know what you are dealing with. This will avoid you missing a direct dial in access via modem or a WAP that he might be using. Also, don't forget that he may have _no_ access from the outside. He may have a person on the inside sending stuff out to him. At this point you can trust nothing and nobody... period.

Not forgetting that the issue may not be coming over wire I would run a quick scan of the entire netblock against every port in the range, (1-65535), nothing fancy, just a simple connect scan to see if anything is out there that probably shouldn't be. If there is something open, block it and put a packet sniffer outside the firewall to log every packet to that IP/port combination. That should cover you for the external-internal threat and will be relatively quick to complete.

After that you are really faced with a forensic examination of every box within the trusted network. You can't rely on finding a single box and saying "there... done", he may have subverted many so every box needs checking. Since this is a "call home" scenario the app may be scheduled. If it isn't then it is most likely running as a service or as some other startup item. Everything needs to be validated that is running automatically on every machine. If he has managed to subvert legitimate services/items then you may never find him and you will need to start everything from scratch..... Look at creating a RIS server if you have to go that route.

All the while remember to look for modems and WAP's, (especially rougue ones), make sure they are locked down.

Good luck....

Oh, and remember, there are certain places that you are required by law to report the violation.... Make sure your company consults the legal beagles......

Exactly the type of information I am looking for Tiger Shark thanks for your input!!! I will continue to post my findings

You are receiving advise to get the FBI in on this, why not give them a call and a chance at it, then if they are not interested, do a complete clean-up....Do it.

Boto: Because his CEO and superiors have told him he can't...... Keeping his job is probably a motivating factor in his decision to follow their directive......

Uno: I should have mentioned it before but I was in a hurry. Google "Aida32", download the zipped package and place it in a generally available folder on a server in the trusted zone. Follow the intructions, (they are pretty basic), that come with it and create a login script to run it automatically at login and write it's report to the other shared folder you create in the instructions. Have everyone log out and log in again, (or if it a big network just wait till tomorrow morning). Install the non-zipped version on your workstation and drag and drop the entire list of reports onto the interface it provides. It will audit your network in amazingly fine detail with very little work. You'll see modems, installed programs, startup programs etc. It will help you a lot and cut the initial time for the audit significantly.

Sorry i wasn't thinking right when I last posted, tou could have had everyone turn their computers off tonight and have a really good audit by 10:00 am.

I run this continuously but don't allow overwrite of existing reports. In that way I get snapshots and copy the old to an archive folder every week or two and let the process run again. i can compare last to current and see what has changed..... It's very handy.

Interesting discussion. I really dont have a lot to add in terms of the the real issue at hand. I just wanted to point out that the Aida32 app that Tiger Shark mentioned isn't so easy to find on the web now since the maker of it has decided to close up shop. It's fairly easy to find the personal edition (think aida32pe_375.zip is the latest there) but the enterprise edition of it, of which I have this one.. aida32ee_388.zip is not such an easy find. In fact, I searched a little bit and thought I found it here but I got a bit confused when I clicked on the download link and it brought me elsewhere.

I've uploaded my version (aida32ee_388) to the yousendit.com server.. at this place one can upload a file up to 1 gig in size.. But, it will only remain on the server for 7 days and I think there's a restriction on how many times it can be downloaded to prevent the warez folks from abusing the service. So all you other AO'ers.. please don't try and download from this link until after uno has said that he's gotten it.. (if he wants it to begin with) it's 3.058 meg in size.

and the link to get it is here

SumDum: Thanks mate.... I didn't think it would go away on the search engines so quickly. I was only on his site a couple of weeks ago reading about him stopping further maintenance - Bloody shame really it is an incredibly detailed, fast and accurate tool. Two weeks ago all it took was to google aida32 and it was right there at the top of the list..... <sigh>

Uno: Don't worry about trying to get it. Being the pack rat I am - when I find a good app I archive the setup files. Particularly good/useful apps go on my USB key fob.... Aida32 is there too. If you can't get it from Sumdum's location PM me and I'll give you a login and password to an FTP site and put it there for you.

Shame about the FEDs

OK, so let's move on?...............are you going to belly up and let this sack of sh1t get away with it?

Go to beancounters department (get an NBC suit from your local military surplus stores first) and ask them to pull his expenses claims for the last 5 years, and AUDIT them..........put in a claim for recharges for anything not 100% substantiated.........he WILL understand?

Also, as he is a slimeball, and you are all bona fide loyal American taxpayers? maybe a sock over the phone call to the IRS would not go astray..............time he had an audit?

I do not like d1psh1ts...........as you might have gathered?

Good luck

Excellent information guys..... (Tiger Shark....Sumdumguy, kudos and props to you both)

The network audit I am about ot undertake is large and I have taken your suggestions and downloaded the package. I will work with the network admins to get it out on the network so that I can start getting a feel for what I am truly up against.

I would like to continue posting my progress and finding if there is any interest?? If there is a different thread I should start or if I should just say thanks to you all and let this one archieve. Suggestions?

Your thread, so your decision..........

What are your thoughts about the IRS?....or did your CEO dung his strides at that as well

Findnewjobometer registers full scale deflection :D

You KNOW what I mean

EDIT: For those who do not understand, I am saying that those with a clear conscience have no fear of the authorities.....has it ocurred that the other guy might be the "victim"? albeit wrong in his actions?

you're welcome uno.. and good luck..

and it probably would be best to keep us updated in this thread as opposed to starting another.. unless of course, you wish to discuss unrelated issues.

Uno: a big network.... Good luck.... Post back here or PM me if you think I can give you any more help.

I would suggest that you create a log file on a secure server and have all the admins log everything they do, with their name and the date/time, what they did, why they did it and what the result was. That way, when it's all over and you haven't found anything you can go back and collate the whole thing to see what might have been missed, what might have been done improperly or not completed fully and what might have been misinterpreted as good when it was questionable.

Also, if you declare a box sound then I would put Zonealarm or something similar on it to lock it down some more, ensure all critical updates are installed, (You can do it nicely off a SUS server for free), and change the local admin password too. You don't want the bastige moving onto a clean machine behind you... Kinda defeats the whole point... ;)

Quote:

---

Findnewjobometer registers full scale deflection

---

I dunno Nihil..... This has the potential to be a very successful venture for uno. If he is thorough and ends up putting a stop to the leak, which clearly isn't something as bland as payroll records or the bosses wouldn't be so concerned about the publicity, then he can practically write his own check IMO...... Fun challenge too if his bosses give him free reign...

Quote:

---

Originally posted here by br_fusion
Don't drag the FBI into this.......

Not even his crimes deserve the somewhat unfair wrath of the feds.

Unless you hate and despise the person, it is not worth throwing them in jail for 10+ years. If you have a good idea who it is, which it seems you do, try confronting the person and letting them know you are aware of their actions. (Or confront them in a less obvious way or even by an anonymous email).

cheers

Feds=last resort

---

In the beginning of what would turn out to be the 'gateway' of cyber-crime, I would have believed the feds to be the last resort because most things could've been worked out, etc. That being said, nowadays, they'd be the first group I'd bring in if the situation were not able to be solved in more conducive manners. Now, with new "virii" available every other day, new bugs, holes, and exploits running rampant, I wouldn't take the chance.

How is it unfair wrath? If you KNOWINGLY (and yes, they all know) try to compromise a network or pc with intent to exploit for further cause (trojan/mining/etc) or steal data and/or destroy the system in an attempt to hide your actions, then you deserve every ounce of the wrath of the authorities.

Because if I were to go after someone in a "less obvious way" (read: meet them in the back of a parking lot somewhere and handle business then), you can damned well be sure they'd press every assault & battery charge they could or more to not have me face the "undeserved wrath of the police". And confronting them to let them know of your awareness of their actions would be laughable at best. Most people who're willing to break the laws like that would probably respond with "Yeah, prove it" or "And I'll go public with your data" or "I'll destroy everything you have if you talk to the police". Bad idea there...

FIrewall and IDS.....As luck would have it the IDS rep is coming today to talk to me about Symantec Manhunt, which exists on the system, however, no knows how to use it. Once again everyone is looking to me. I am almost certian it is monitoring from behind the firewall.

I want to setup the system so that there is an external sensor using SNORT and the internal is using Manhunt. There is an established DMZ and nating is being used.

If anyone has used these products or has suggestions on thier setup. Tiger shark you mentioned a secure server, which I want to put on a seperate switch with management connections to the Database server and analysts console.

With Snort I plan on using 2 interfaces, one for the Sniffing and one for the maintinance.

Looks like a fun weekend ahead :-)

The system I use for Snort, which may be more than you want here but should help you get some things going is in a tutorial I wrote here

I can't help you with the Manhunt stuff 'cos I've never used it. I don't know why, but I used to like NAV and hate all their "add-on" stuff... now I'm no great proponent of NAV any more either... But that's a whole other story.

If you want some simple custom rules written or need anything else on what I do feel free to ask, I'm in and out of here all weekend - bloody addict I guess.

I, personally, would keep your secure server as just that - secure and single use. Only allow Terminal services to it from the network and only allow a single account to access it from the network. Use IP Filtering to block all other connections. Use a different box for your log server.