By Roberto Preatoni Fabio Ghioni Corp Vs Corp

28
THE LECTURERS THE LECTURERS Fabio Ghioni - Roberto Fabio Ghioni - Roberto Preatoni Preatoni www.zone-h.org the Internet thermometer Profiling modern State and Profiling modern State and Industrial Espionage Industrial Espionage

description

Roberto Preatoni & Fabio Ghioni - Corp-vs-Corp. Fabio Ghioni - Esperto in Tecnologie non convenzionali e del rischio, e in strategia per la difesa nel Cyber Warfare Profiling. Fabio Ghioni, editorialista, Fabio Ghioni saggista, Fabio Ghioni conferenziere, Fabio Ghioni consulente strategico, Fabio Ghioni top manager, è riconosciuto come uno dei maggiori esperti mondiali di sicurezza.

Transcript of By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Page 1: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

THE LECTURERSTHE LECTURERSFabio Ghioni - Roberto Fabio Ghioni - Roberto

PreatoniPreatoni

www.zone-h.orgthe Internet thermometer

Profiling modern State and Profiling modern State and Industrial EspionageIndustrial Espionage

Page 2: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

HERO-Z comics

TWO REASONS TO READ THEM

www.zone-h.orgthe Internet thermometer

Page 3: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Nmap’s fyodor HITB’s l33tdawg

www.zone-h.orgthe Internet thermometer

Page 4: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

MY ASS!

Page 5: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

www.zone-h.orgthe Internet thermometer

A visual definition of A visual definition of asymmetryasymmetry

Page 6: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

INDEXINDEX

1)1) Introduction: old and new threats Introduction: old and new threats

2)2) Industrial Espionage and State-sponsored espionageIndustrial Espionage and State-sponsored espionage

3)3) Cyber defense methodology: from digital identification of Cyber defense methodology: from digital identification of attacker to counterattack strategyattacker to counterattack strategy

4)4) Cyber counterattacks: information leakage, Injected Cyber counterattacks: information leakage, Injected InterceptionInterception

www.zone-h.orgthe Internet thermometer

Page 7: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

In the aftermath of September 11th, security issues came into the In the aftermath of September 11th, security issues came into the limelight… everybody focalized their attention on increasing anti-terrorist limelight… everybody focalized their attention on increasing anti-terrorist measures and countering the increasing number of hacker attacks to measures and countering the increasing number of hacker attacks to business and government networks…business and government networks…

www.zone-h.orgthe Internet thermometer

Page 8: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

… … but hardly anyone has ever mentioned a more insidious and but hardly anyone has ever mentioned a more insidious and widespread criminal activity: INDUSTRIAL ESPIONAGEwidespread criminal activity: INDUSTRIAL ESPIONAGE

WHY ?WHY ?

www.zone-h.orgthe Internet thermometer

Page 9: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Companies are often reluctant to publicly admit that they have Companies are often reluctant to publicly admit that they have been victims of industrial espionage for two main reasons:been victims of industrial espionage for two main reasons:

•it implicitly means that THERE WAS SOME KIND OF it implicitly means that THERE WAS SOME KIND OF VULNERABILITY to be exploitedVULNERABILITY to be exploited

•it implies the unveiling of MORE CONFIDENTIAL lines of businessit implies the unveiling of MORE CONFIDENTIAL lines of business

REAL CASESREAL CASES

-CC companies-CC companies

-T-mobileT-mobile

-KK

www.zone-h.orgthe Internet thermometer

Page 10: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

WHAT exactly is INDUSTRIAL ESPIONAGE?WHAT exactly is INDUSTRIAL ESPIONAGE?

The illegal acquisition of intellectual property and trade secrets, in other The illegal acquisition of intellectual property and trade secrets, in other words THEFT!words THEFT!

The techniques to steal information from outside a company range from The techniques to steal information from outside a company range from the traditional eavesdropping to social engineering tactics… the traditional eavesdropping to social engineering tactics…

www.zone-h.orgthe Internet thermometer

Page 11: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Since the 1990s Western Intelligence Agencies appear to have Since the 1990s Western Intelligence Agencies appear to have focused most of their time and resources on industrial espionage focused most of their time and resources on industrial espionage

In most countries corporations rely on Government Agencies to In most countries corporations rely on Government Agencies to carry out investigations whose results can be used to boost the carry out investigations whose results can be used to boost the National economy… National economy…

France, the United States and Israeli have often been accused to France, the United States and Israeli have often been accused to spying on competitors’ industrial secrets through scanning spying on competitors’ industrial secrets through scanning systems such as Echelon or the Helios 1A satellite up until the systems such as Echelon or the Helios 1A satellite up until the more recent Carnivore software and Magic Lantern used officially more recent Carnivore software and Magic Lantern used officially for lawful interception (now outdated by more sophisticated for lawful interception (now outdated by more sophisticated solutions)solutions)

www.zone-h.orgthe Internet thermometer

Page 12: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Conversely, the INDUSTRIAL/BUSINESS INTELLIGENCE process Conversely, the INDUSTRIAL/BUSINESS INTELLIGENCE process consists of researching information on public source documents consists of researching information on public source documents in order to draw inferences about what competitors might be in order to draw inferences about what competitors might be going to do and provide the basis for possible counteractiongoing to do and provide the basis for possible counteraction

www.zone-h.orgthe Internet thermometer

Page 13: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Situational Awareness is the key Situational Awareness is the key word…word…

www.zone-h.orgthe Internet thermometer

Page 14: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

". . . attaining one hundred victories in one hundred battles is not the pinnacle ". . . attaining one hundred victories in one hundred battles is not the pinnacle of excellence.of excellence.

Subjugating the enemy's army without fighting is the true pinnacle of Subjugating the enemy's army without fighting is the true pinnacle of excellence."excellence."

Sun Tzu, The Art of War Sun Tzu, The Art of War

"There are but two powers in the world, the sword and the mind. In the long "There are but two powers in the world, the sword and the mind. In the long run the sword is always beaten by the mind." run the sword is always beaten by the mind."

Napoleon Bonaparte Napoleon Bonaparte

www.zone-h.orgthe Internet thermometer

Page 15: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Nevertheless, there is sometimes a fine line between the Nevertheless, there is sometimes a fine line between the legitimate tactics of competitive intelligence gathering and the legitimate tactics of competitive intelligence gathering and the illegitimate practice of industrial espionage…illegitimate practice of industrial espionage…

www.zone-h.orgthe Internet thermometer

Page 16: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

THE ATTACKSTHE ATTACKS

AUTONOMOUS AGENTS / BOTNETSAUTONOMOUS AGENTS / BOTNETS

Set up of botnets or drones instructed to perform searches within the traffic or within Set up of botnets or drones instructed to perform searches within the traffic or within the PC contentthe PC content

SOCIAL ENGINEERINGSOCIAL ENGINEERING

Exploitation of human vulnerabilities Exploitation of human vulnerabilities

Big mouthsBig mouths

INFORMATION LEAKAGE AND DATA MANIPULATIONINFORMATION LEAKAGE AND DATA MANIPULATION

•Intranet access due to loose access policiesIntranet access due to loose access policies

•Weak corporate applicationsWeak corporate applications

•Exploitation of insidersExploitation of insiders

OPEN SOURCES GATHERINGOPEN SOURCES GATHERING

•Old pal googleOld pal google

•Company pubblicationsCompany pubblications

EMPLOYEES EXPLOITATIONEMPLOYEES EXPLOITATION

•Home pc compromissionHome pc compromission

•Mailbox hijackingMailbox hijackingwww.zone-h.org

the Internet thermometer

Page 17: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

The classic Intelligence CycleThe classic Intelligence Cycle

Source: Law Enforcement Intelligence: A Guide for Source: Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement AgenciesState, Local, and Tribal Law Enforcement Agencies

http://www.cops.usdoj.gov/mime/open.pdf?http://www.cops.usdoj.gov/mime/open.pdf?Item=1396Item=1396www.zone-h.org

the Internet thermometer

Page 18: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Modern espionage process flowModern espionage process flow

www.zone-h.orgthe Internet thermometer

open sourceopen source

intelligence intelligence gatheringgathering

target definitiontarget definition

and acquisitionand acquisition

target target vulnerability vulnerability assessment and assessment and profilingprofiling

exploit exploit

generationgeneration

attack attack infrastructure setupinfrastructure setup

deception deception array setuparray setup

TARGET TARGET EXPLOITATIONEXPLOITATION

Page 19: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CASE STUDIES 1/5CASE STUDIES 1/5

Skynet 1.0Skynet 1.0

•A new application of Artificial IntelligenceA new application of Artificial Intelligence

•Set up of intelligent networked agentsSet up of intelligent networked agents

•Underground work is in progressUnderground work is in progress

www.zone-h.orgthe Internet thermometer

Page 20: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CASE STUDIES 2/5CASE STUDIES 2/5

T-MobileT-Mobile

•At the end of 2003 a hacker got access to the T-mobile users’ accounts and stole At the end of 2003 a hacker got access to the T-mobile users’ accounts and stole private material from jet-set users as well as a C.I.A. document located on a T-private material from jet-set users as well as a C.I.A. document located on a T-Mobile transit e-mail account belonging to a C.I.A. agent. The hacker exploited a Mobile transit e-mail account belonging to a C.I.A. agent. The hacker exploited a Bea Weblogic interface flaw.Bea Weblogic interface flaw.

•Even though it was not a case of corporate sponsored espionage, the T-mobile Even though it was not a case of corporate sponsored espionage, the T-mobile subcribers data were posted on-sale on the Internet.subcribers data were posted on-sale on the Internet.

www.zone-h.orgthe Internet thermometer

Page 21: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CASE STUDIES 3/5CASE STUDIES 3/5

Israel Trojan HorseIsrael Trojan Horse

•In 2005 Israel was put in a difficult situation by an industrial espionage scandal In 2005 Israel was put in a difficult situation by an industrial espionage scandal involving several corporation and dozens of people.involving several corporation and dozens of people.

•Once again data were stolen using a trojan and social engineering.Once again data were stolen using a trojan and social engineering.

•Trojan-based attacks are growing rapidly and are considered as among the most Trojan-based attacks are growing rapidly and are considered as among the most important security risks for today’s corporations.important security risks for today’s corporations.

www.zone-h.orgthe Internet thermometer

Page 22: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CASE STUDIES 4/5CASE STUDIES 4/5

Chinese Trojan AttacksChinese Trojan Attacks

•Several American corporations got compromised in the last year by trojan attacks Several American corporations got compromised in the last year by trojan attacks perpetrated by chinese citizens, according to the attacks' logs.perpetrated by chinese citizens, according to the attacks' logs.

•Myfip, the trojan used for most of the attacks appeared to be one of the most Myfip, the trojan used for most of the attacks appeared to be one of the most sophisticated ever and one of its peculiarity was that it tried to steal also CAD/CAM files sophisticated ever and one of its peculiarity was that it tried to steal also CAD/CAM files usually related to engineering design works.usually related to engineering design works.

• In Italy shoes factories identified successful intrusions in servers having the blueprints of In Italy shoes factories identified successful intrusions in servers having the blueprints of new shoes models stolen even before they hit the production lines. North-West Italian new shoes models stolen even before they hit the production lines. North-West Italian shoe industry is now suffering a staggering 60% sales reductionshoe industry is now suffering a staggering 60% sales reduction

•According to an IBM report, in the first half of 2005, 'customized‘ attacks against According to an IBM report, in the first half of 2005, 'customized‘ attacks against governments, corporations and financial institutions jumped to 50 per cent.governments, corporations and financial institutions jumped to 50 per cent.

www.zone-h.orgthe Internet thermometer

Page 23: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CASE STUDIES 5/5CASE STUDIES 5/5

MILITARY INDUSTRYMILITARY INDUSTRY

www.zone-h.orgthe Internet thermometer

Page 24: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

PREVENTION AND DEFENSE PREVENTION AND DEFENSE

www.zone-h.orgthe Internet thermometer

Page 25: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

www.zone-h.orgthe Internet thermometer

Page 26: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

CYBER COUNTERATTACKSCYBER COUNTERATTACKS

INJECTED INTERCEPTIONINJECTED INTERCEPTION•allows to trace the IP address of a target and gain direct access to all data allows to trace the IP address of a target and gain direct access to all data contained on the computer no matter what is the means of data transport (i.e. contained on the computer no matter what is the means of data transport (i.e. physical or digital)physical or digital)

www.zone-h.orgthe Internet thermometer

Page 27: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

To

ols

www.zone-h.org

?the Internet thermometer

Page 28: By Roberto Preatoni Fabio Ghioni Corp Vs Corp

Domande?Domande?Italian

(َّي'ة (َّي'ةَأ َم(َط(اِل,بَم(َط(اِل,ب    َأArabic

ΕρωτήσειςΕρωτήσεις??Greek

¿Preguntas?¿Preguntas?Spanish

вопросывопросы??Russian

質問Japanese

Questions?Questions?English

tupoQghachmeyKlingon

www.zone-h.orgthe Internet thermometer