The Target Breach – Case Study, Lessons Learned and the Lockheed Martin Intrusion Kill Chain Model
Total Page:16
File Type:pdf, Size:1020Kb
The Target Breach – Case Study, Lessons Learned and the Lockheed Martin Intrusion Kill Chain Model . Improve your AIX Security by learning from the analysis of this breach . Stephen Dominguez, WW AIX and LoP Security Lead for IBM Lab Services . Sept 21st, 2016 Who am I ? Peyton Manning/Broncos fan and also love jazz World-wide AIX and Linux on Power Security Lead for IBM Lab Services Worked with Power for 19 years, specifically security for 13 I've worked with around 400+ corporate customers throughout the world Obtained US Top Secret Security Clearance in 2011 I have a security blog, www.securitysteve.net Who am I ? I have a security blog, www.securitysteve.net You can follow me on twitter, @Secur1tySteve IBM Lab Services is a cost center that works closely with IBM development to assist Power customers with their systems To learn about all Lab Services' security services: www.securitysteve.net/consulting-services/ We have several flexible funding IBM programs available to provide security consulting services at no charge to eligible customers If you'd like for me to setup a conference call so we can chat about security, shoot me an email at [email protected] Agenda Recent statistics on security breaches Introduction to the Target Breach The Lockheed Martin Intrusion Kill Chain Model The 13 Phases of the Breach 5 Major Lessons from the Target Breach Countering the Breach in AIX Recent Statistics on Security Breaches From the June 2016 Ponemon Institute's: “2016 Cost of Data Breach Study: Global Analysis” Abstract of Ponemon Institute's Findings 383 companies surveyed from 12 different countries Average cost of security breach of large company globally: $4 million Since 2013, the costs have risen globally by 29% Average cost of stolen record globally is $158 Ponemon Institute's 7 Global Megatrends 1. The cost of a data breach hasn't fluctuated significantly since starting research 2. The biggest financial consequence to organizations that experienced a data breach is lost business ie regain and retain customers' trust 3. Most data breaches continue to be caused by criminal and malicious attacks. These breaches also take the most time to detect and contain. They have the highest cost per record. 4. Investments are being made in technologies and in-house expertise to reduce the time to detect and contain 5. Regulated industries, such as healthcare and financial services, have the most costly data breaches 6. Improvements in data governance programs will reduce the cost of a data breach. For example: Incident response plans, appointment of a CISO, employee training and awareness programs 7. Investment in certain data loss prevention controls and activities such as encryption and endpoint security solutions are important for preventing data breaches. Introduction to the Target Breach Primary Reference • Main reference for this session is “Case Study: Critical Controls that Could Have Prevented Target Breach” by Teri Radichel, [email protected] • Permission has been obtained from Teri to abstract from her case study • Target never released official details of the breach. This reference references around 50 other references. • You can download the PDF of the case study off of: www.securitysteve.net/links 9 Secondary Reference • Secondary reference for this session is “The Target Store Data Breaches – Examination and Insight” by Marianna Hardy • This is a book available from Amazon 10 Third Reference • Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains by Lockheed Martin Corp • Whitepaper. There's a link for this from my links section of my blog, www.securitysteve.net/links/ 11 Abstract • In December 2013, 40 millions credit card numbers were stolen from 2000 Target stores by accessing data on point of sale (POS) systems • On January 10th Target also announced that PII data ie names, addresses, phone numbers, and email addresses of up to 70 million customers was stolen • There was an overlap of 12 million people between the two types of data stolen, so 98 million people total were affected in one way or the other • 11 GB of data was stolen • The customer data was sold on online black market forums known as “card shops” • The Senate Committee on Commerce in March 2014 concluded that Target missed opportunities to prevent the breach • Target reported the breach cost them $61 million 12 Abstract continued ... • The Target security staff made their misgivings known about the vulnerabilities of their POS systems before the breach • The attackers had access to Target systems for over a month • Independent sources make a rough estimate as to the cost of fraudulent charges resulting from the stolen credit card numbers from $250 million to $2.2 billion • 80 lawsuits filed against Target • The Payment Cards Industry (PCI) Council could have fined Target $400 million to $1.1 billion • This was among the largest data breaches in U.S. history 13 Breach Aftermath • CEO and CIO lost their jobs • Target's board of directors were threatened with removal • Banks payed $200 million to customers affected by the breach • Banks sued Target's PCI compliance auditor, Trustwave • Target has dealt with investigations from the Department of Justice, the FTC, and SEC. • Target hit by PCI compliance fines and State fines 14 The Lockheed Martin Intrusion Kill Chain Model From Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains Advanced Persistent Threat (APT) • Initial security threats posed from self-propagating code (virus). Anti-virus technology has reduced that risk. • A new class of threat has emerged, the APT • The APT is when an adversary is well funded, highly skilled, focuses their attack manually (not-automated), and can attack over months or years “In February 2010, iSec Partners noted that current approaches such as anti-virus and patching are not sufficient, end users are directly targeted, and threat actors are after sensitive intellectual property. (Stamos, 2010)” - from Lockheed White Paper • The Lockheed Whitepaper says: “Yet APT actors continually demonstrate the capability to compromise systems by using advanced tools, customized malware, and 'zero day' exploits that anti-vrus and patching cannot detect or mitigate.” • The Target hackers used “advanced tools, customized malware and 'zero day' exploits that anti-virus and patching cannot detect ..” 16 What is a Kill Chain • “A kill chain is a systematic process to target and engage an adversary to create desired effects”. • The kill chain concept comes from the military • Lockheed adapted the Kill chain concept for providing a structure to analyze intrusions • We can use kill chains to understand how to deploy Computer Network Defense (CND). CND is a set of processes used to detect, monitor, analyze, and defend against network intrusions. • The kill chain is an end-to-end, integrated process where a deficiency in one segment of the chain can interrupt the entire process. • Multiple kill chains can occur within an adversary's campaign • Helps understand the iterative nature of intelligence gathering 17 Breach Phase 4: Establish a C2 System • Attacks used the vendor portal as a pivot to other systems • The attackers performed reconnaissance from this C2 to system to look for vulnerabilities on other systems • The attackers further infiltrated the target network from this system • Attackers performed additional reconnaissance from the system using network command tools • Attackers downloaded additional hacking tools to the system • Kill Chain 1 Phase 7 (Actions on Objectives) • Kill Chain 2 Phase 1 (Reconnaissance) 19 The 13 Phases of the Breach Breach Phase 1: Reconnaissance • Google search used to learn about Target interacts with vendors • Search revealed information about a vendor portal and a list of HVAC and refrigeration companies • Google search also revealed a case study on Microsoft site that described Target's use of Microsoft virtualization software, centralized name resolution, and Microsoft System Center Configuration Manager (SCCM), to deploy patches. • This Microsoft case study revealed Target's technical infrastructure, including POS system information, in significant detail • Kill Chain 1 Phase 1 - Reconnaissance 23 Breach Phase 2: Phishing Attack • Email sent to refrigeration vendor, Fazio Mechanical, 2 months before the breach • Fazio could have prevented the malware via real-time malware prevention tooling. Instead, they were using the free version of Malwarebytes Anti-Malware • Malware, believed to be Citadel, installed on vendor computer. • Malware embedded in PDF or Microsoft document • Citadel is a password-stealing bot program • Citadel obtained the login credentials for the online vendor portal • Kill Chain1 Phase 2 & 3 (Weaponization & Delivery) 24 Breach Phase 3: Access Target via Vendor Portal • Attackers use stolen login credentials to gain initial Target network access • A former Target security team member indicated that it was probably Target's web portal: Ariba external billing system • According to the same source, this portal was not fully isolated from the rest of Target's network • The attackers used an administrative application BMC account with its default username and password to move within the network. • By using possibly NetCat.exe raw commands were issued on various systems. NetCat.exe could have been used to load hacking related commands to compromised systems • Access to the Target network