• Abstract and Figures
• Public Full-text

Enhancing identification and reporting of potentially harmful public data on Danish organizations by Rasmus Lau Petersen Supervisor: Christian Damsgaard Jensen M.Sc.Eng.IT master thesis DTU Compute Technical University of Denmark Kongens Lyngby, August 1st, 2017 Summary (English) This master thesis aims to aid and enhance the current processes used to identify and report in Open Source Intelligence (OSINT) on Danish organizations. This is data generated by the daily work of the organization and its employees when they act and communicate. The data is collected by public registries or commercial 3rd parties, which can provide a valuable source of information for an attacker intending to target organizations. Security professionals are aware that such data exist and report on it as part of their services, but collecting it effectively is difficult. Relating it to the domain of the organizations acting under the different Danish legislation and standards can be difficult. The organizations themselves may have a good overview of the latter, but lack overview and awareness of OSINT and the attack scenarios this enables. We attempt to enhance the process of identification and reporting in two ways: By developing plug-ins (“transforms”) for the widely used OSINT-gathering program Maltego by Paterva and by developing a framework for inputting findings from Maltego to generate a report categorizing findings and relating them to common OSINT-enabled attack scenarios and applicable legislation, standards and guidelines. We examine current methodologies for conducting vulnerability- and penetration test assessments, standards, guidelines and Danish legislation pertaining to OSINT-data and identify and analyze a dozen common OSINT-enabled attack scenarios. The section on standards finds valuable, general guidance to enhance security maturity in organizations, but only little pertains to hinder OSINT-generation. Traits of social engineering-techniques, which often are involved in these types of attacks, are also analyzed. Two transforms were successfully developed for the Danish domain registry DK Hostmaster and a commercial supplier of aggregated data from the registry of Danish vehicles and debt of these. They can be included in and enhance the work processes in a security consultancy. The development also highlights problems with developing for closed source-software; due to the difficulties faced and solved in regards to this, a section on developing transforms for Maltego is included in the appendix. Based on the examined legislation, standards and guidelines and the scenarios created, a report- generation framework has been developed. It takes an export from Maltego and by manually assigning labels to each entry, outputs a report. The report imitates examples of commercially used reports using colors and summaries to make it easy-read. It connects the findings to the scenarios describing specifically targeted attacks and three of the surveyed standards. The framework works and outputs successfully as-is, but the work highlighted difficulties with linking the domains of data labels of actual findings to standardized scenarios and formal standards. It is an essential task to get these links correct to ensure proper conclusions in the output, so the report can be used as-is in the product portfolio of e.g. a security consultancy. We list suggestions for future work in the discussion and conclusion and highlights the need for conducting the research with input from e.g. security professionals of consultancies and internal organizational security functions. Page 3 of 211 Summary (Danish) Målet for denne afhandling er at støtte og forbedre processerne omkring identifikation og afrap- portering af Open Source Intelligence (OSINT) der måtte eksistere om danske organisationer. Denne type data bliver genereret som et bi-produkt at processerne omkring det daglige arbejde organisationen og dens ansatte udfører, når de agerer og kommunikerer. Dataen opsamles af offentlige instanser og kommercielle tredjeparter og kan udgøre en værdifuld kilde til information for angribere, der måtte ønske at angribe organisationerne. IT-sikkerhedsprofessionelle er op- mærksomme på eksistensen af denne type data og rapportering af den indgår som en del af deres tilbudte services, men opsamlingen af den er besværlig og tidskrævende, herunder også relatere dataen til den virkelighed organisationerne agerer under inkl. dansk lovgivning og standarder. Mens organisationerne nok har et godt overblik over sidstnævnte, kan de mangle indsigt i hvad OSINT-data er og de angrebstyper der er forbundet herved. I projektet søger vi at forbedre processerne for identifikation og afrapportering på to måder: Dels ved at udvikle plug-ins (“transforms”) til det vidt udbredte OSINT-indsamlingsværktøj Maltego udviklet af Paterva og dels ved at udvikle software, som ud fra resultaterne fra Maltego kan generere en rapport, som kategoriserer de gjorte fund og relaterer dem til almindeligt forekom- mende cyberangreb, hvor OSINT-data spiller en rolle samt gældende lovgivning, standarder og vejledning. Vi undersøger aktuelle metoder til at udføre sårbarheds- og penetrationstests, standarder, vej- ledninger og dansk lovgivning som beskæftiger sig med OSINT-data. Endvidere identificerer og analyserer vi omkring et dusin typiske cyber angreb, muliggjort af OSINT-data. Afsnittet identifi- cerer værdifuld, generel vejledning, som kan hjælpe med at forbedre sikkerheden i organisationer, men kun en mindre del af den beskæfter sig med at forhindre at der genereres OSINT-data. Vi undersøger og beskriver også typiske træk ved “social engineering”-teknikker, som ofte bruges ifm. denne type angreb. Der blev succesfuldt udviklet to transforms, som henter data fra dels den danske domæneregistrant DK Hostmaster og dels en kommerciel udbyder af et aggregeret datasæt over motorregistret samt gæld fra Tinglysningen ifm. dette. De to transforms can inkluderes i arbejdsgangen hos IT-sikkerhedskonsulenter og forbedre arbejdsprocessen herved. Udviklingen fremhævede dog også problemerne ved at udvikle til closed source-software; pga. udfordringerne herved, er de undervejs i projektet identificerede løsninger repræsenteret særskilt i appendix. På baggrund af den undersøgte lovgivning, standarder og vejledninger og de opstillede scenarier, blev der udviklet et stykke software til at generere en rapport. Softwaren kører på en eksporteret fil fra Maltego og ved manuelt at tildele typer til hvert stykke data i filen, genererer softwaren en rapport. Rapporten efterligner eksempler på kommercielt fremstillede rapporter ved at bruge farver og små konklusioner for at gøre den let forståelig. Den forbinder de i Maltego fundne data med de opstillede scenarier (dog kun målrettede angreb) og tre af de undersøgte standarder, som bedst lod sig relatere til OSINT-data. Softwaren fungerer og genererer i den nuværende udgave, men det udførte arbejde tydeliggjorde problemer med at koble praktisk orienterede datakategorier med standardiserede angrebsscenarier og formelle standarder. Det er essentielt at kunne udføre disse koblinger korrekt, for at sikre, at konklusionerne i den automatisk genererede rapport stemmer bedst muligt overens med virkeligheden og kan bruges i produktporteføljen i et IT-sikkerhedskonsulentfirma. Vi beskriver forslag til fremtidigt arbejde i diskussionen og konklusionen og fremhæver nødven- digheden af at udføre den videre research med input fra f.eks. IT-sikkerhedsprofessionelle fra både konsulenthuse og interne IT-sikkerhedsafdelinger ude i organisationerne. Page 5 of 211 Acknowledgements I would like to thank all the people around for enabling this project. In particular I would like to thank Keld Norman and Andy Cini for growing the initial idea with me and for Christian D. Jensen to join in on the idea and supervise the project for, including bi-weekly meetings, ad-hoc late night e-mails and valuable input. I would like to thank Specialklinikken Rebild by J. Erling Pedersen-Bach and massage therapist Cathrine Thovtrup, without whose treatments it would have been next to impossible to write a master thesis with the whiplash/concussion I acquired three years back, but now finally are in recovery from. I am grateful for my wonderful girlfriend whom have supported and helped me all the way through and especially when things got a bit busy. I look forward to spend much more time with you in our new apartment, which we also managed to buy during the month up till hand-in! An extended thank you to Rosita Kanto, Frederik Eriksen & William Embarek for proof-reading my report and shout-out to all the good people on ST Nybrogård Kollegiet, whom have had to listen to my grumblings during up’s and down’s. Last, but most certainly not least, where “thank you’s” do not even suffice: A sincere, heartfelt “thank you” to my parents, Nina & John Petersen, for 27 years of love, support, blood, sweat and tears, which have enabled me to get to this point! I am most grateful and will never be able to pay it back enough. Preface This thesis was prepared at DTU Compute in fulfilment of the requirements for acquiring an M.Sc. in Engineering and IT. The thesis deals with the problems of organizations acting in an increasingly connected world where all actions leaves traces. To discover and understand the implications of data on open sources is difficult, but the goal was to enhance the process by developing new plug-ins to a popular platform for OSINT-investigations and a framework for automatically generating a report concluding on the findings and relating them to applicable legislation, standards and guidelines. An overview of the thesis’ content is found in Section 1.2. Lyngby, August 1st, 2017 Rasmus Lau Petersen Contents 1 Introduction 11 1.1 Problem definition . 13 1.1.1 Goals . 15 1.1.2 Risks . 15 1.1.3 Work methods . 16 1.2 Overview of this report . 17 2 State-of-the-art 19 2.1 Penetration testing . 19 2.1.1 Pre-engagement interactions . 22 2.1.2 Intelligence gathering . 24 2.1.3 Threat modeling . 26 2.1.4 Vulnerability analysis . 29 2.1.5 Exploitation . 31 2.1.6 Reporting . 32 2.2 Risk analysis . 33 2.2.1 A general view: DS/ISO 27000-series . 33 2.2.2 Specific methodologies .

Load more

  211

Copy Link