Whodunit? The Mechanics of Attack Attribution

When it hits the fan, one of the first questions that you get asked is "Who did this?".

And like any good mystery, trying to find the attacker takes many twists and turns. There's a trail of evidence, a red herring or two, and the inevitable plot twist before the final reveal.

Unfortunately, despite what you see on TV, in the movies, or even in the press, attack attribution is hard. In face, it's one of the hardest problems in information security today.

In this talk, we use real world examples to work through what it takes to properly make the connection between attack and attacker.

Looking at real world techniques used to gather and validate evidence, we'll examine what it takes for that evidence to hold up to cross examination. We'll look at the role each of your security controls play in the attribution process and the steps you can take to immediately make attribution easier.

Come learn what it takes to actually prove who the attacker is and where attribution fits into your daily security practice.

Transcript

1. Whodunit? The mechanics of attack attribution
2. DISCLAIMER
3. This talk contains general information about legal matters. The information is not advice, and should not be treated as such. The legal information in this talk is provided “as is” without any representations or warranties, express or implied. Mark Nunnikhoven makes no representations or warranties in relation to the legal information in this talk. Without prejudice to the generality of the foregoing paragraph, Mark Nunnikhoven does not warrant that: the legal information in this talk will be constantly available, or available at all; or the legal information in this talk is complete, true, accurate, up-to-date, or non-misleading. You must not rely on the information in this talk as an alternative to legal advice from your attorney or other professional legal services provider. If you have any specific questions about any legal matter you should consult your attorney or other professional legal services provider. You should never delay seeking legal advice, disregard legal advice, or commence or discontinue any legal action because of information in this talk. Nothing in this legal disclaimer will limit any of our liabilities in any way that is not permitted under applicable law, or exclude any of our liabilities that may not be excluded under applicable law.
4. IANAL (I am not a lawyer)
5. Mark Nunnikhoven Sr. Research Scientist @marknca
7. Date Event 21-Nov Sony CEO Michael Lynton warned in anonymous email to “behave wisely” 24-Nov Story of a hack at Sony Pictures Entertainment leaks 25-Nov 5 unreleased movies show up online (Fury, Annie, Mr. Turner, Still Alice and To Write Love On Her Arms) 01-Dec PII published, FBI starts investigation 02-Dec Passwords, security certificates, marketing materials leaked online 04-Dec Passwords, security certificates, marketing materials leaked online 07-Dec Kevin Mandia email to Sony, “This attack is unprecedented in nature" 08-Dec More leaked data, first direct mention of…
9. Date Event 08-Dec More leaked data, first direct mention of… 11-Dec Gawker breaks story mentioning previous attack in February, 2014 13-Dec More leaked data, promise of more as a “Christmas present” 14-Dec Sony’s legal team threatens various media outlets 16-Dec Class action suit filed against Sony by former employees 16-Dec GoP issues threat to movie theatres & goers 17-Dec Sony cancels release after theatres raise concerns 18-Dec US officials “confirm” North Korean involvement 19-Dec FBI issues formal statement assigning attribution to North Korea
11. http://www.dailymail.co.uk/news/article-2880880/FBI-conclusively-links-North-Korea-Sony-hack.html Watch the video online
12. Date Event 19-Dec FBI issues formal statement assigning attribution to North Korea 20-Dec North Korea denies involvement, offers “joint investigation”
13. http://www.theguardian.com/us-news/2014/dec/21/obama-us-north-korea-state-terror-list-sony-hack Watch the video online
14. Date Event 20-Dec North Korea denies involvement, offers “joint investigation” 21-Dec North Korea threatens “the White House, the Pentagon and the whole U.S. mainland" 22-Dec US government calls on North Korea to compensate Sony 22-Dec State Department says there is “no specific credible threat information that lends credence” to North Korea’s threat 22-Dec North Korea bows out of UN Security Council meeting on human rights record 23-Dec Sony recants and decides to release movie to theatres 24-Dec “The Interview” is released in digital channels. Earns $31 million by 06-Jan-2015
15. I, BARACK OBAMA, President of the United States of America, find that the provocative, destabilizing, and repressive actions and policies of the Government of North Korea, including its destructive, coercive cyber-related actions during November and December 2014… *emphasis added
16. http://www.foxnews.com/politics/2015/01/07/fbi-director-reveals-new-evidence-linking-n-korea-to-sony-hack-answers-skeptics/ Watch the video online
17. http://www.nbcnews.com/storyline/sony-hack/sony-hack-n-korean-intel-gleaned-nsa-during-incursion-n288761 Watch the video online
20. Relevant Authentic Hearsay Acceptable as a copy Is it?
21. “NSA activity verified the actions were taken by North Korea” Statement #2 “An IP known to be associated with North Korean activity” Statement #1
23. SECTION 31
24. Definitions 31. (1) In this section,
 “corporation”
 « personne morale »
 
 “corporation” means any bank, including the Bank of Canada and the Business Development Bank of Canada, any authorized foreign bank within the meaning of section 2 of the Bank Act and each of the following carrying on business in Canada, namely, every railway, express, telegraph and telephone company (except a street railway and tramway company), insurance company or society, trust company and loan company;
 
 “government”
 « gouvernement »
 
 “government” means the government of Canada or of any province and includes any department, commission, board or branch of any such government;
 
 “photographic film”
 « pellicule photographique »
 
 “photographic film” includes any photographic plate, microphotographic film and photostatic negative.
 
 Marginal note:
 When print admissible in evidence
 http://laws-lois.justice.gc.ca/eng/acts/c-5/
25. http://laws-lois.justice.gc.ca/eng/acts/c-5/ In plain-ish english: You have to prove the evidence is authentic(31.1) and that hasn’t been changed(31.2). That the system that generated it was running “properly” or at least it’s operation didn’t affect the integrity of the evidence(31.3). The evidence must have been stored as part of ordinary operations and not at the request of the parties introducing it.
50. ?
54. Year 2010 2011 2012 2013 2014 Jail Time (years) 40 26 19.8 38 31.5 Name Sentence (Rank) Christopher Scott 7 years (#8) Kenneth Lucas II 11 years (#5) Christopher Chaney 10 years (#6) Jeremy Hammond 10 years (#6) David Ray Camez 20 years (#1) Max Ray Vision|Butler 13 years (#4) Nichole Michelle Merzi 5 years (#10) Rasmuz Frisenholt 400 hours service (#30) Adrian-Tiberiu Oprea 15 years (#3) Nicholas Knight 90 days service (#29) Albert Gonzalez 20 years (#1) James Jeffery 2.5 years (#14) Iulian Dolan 7 years (#8) Gottfrid Svartholm 3.5 years (#12) American Young Offender 6 year probation (#23) Lewys Martin 2 years (#16) Cameron Lacroix 4 years (#11) Ryan Cleary 2 years, 8 months (#13) Kitt Willians 1 year service (#26) Sigurður Ingi Þórðarson 2 years (#16) Ryan Ackroyd 2.5 years (#14) Canadian Young Offender 18 months probation (#27) Daniel Trenton Krueger 2 years (#16) Jake Davis 2 years (#16) Cody Kretsinger 1 year (#21) Freya Newman 2 year probation (#24) Mustafa Al-Bassam 20 months probation (#25) Matthew Weaver 1 year (#21) Christopher Weatherhead 1.5 years (#20) Ashley Rhodes 7 months (#28)
55. Notable Cybercrime Convictions (Global) 0 10 20 30 40 2010 2011 2012 2013 2014 Jail Time (Years) Convictions
56. Number of Cybercrime Attacks vs. Convictions (Global) 0 8 15 23 30 2010 2011 2012 2013 2014 Attacks (Billions) Convictions Gap of hopelessness
57. 1 in 2.7 billion 2 5942921875 = billions of attacks[9.2 + 12.3 + 16.4 + 21.9 + 29.2] / convictions[30] + billions of attacks Rough odds of being convicted of a cybercrime [2010—2014]
59. DISCLAIMER
60. This talk contains general information about legal matters. The information is not advice, and should not be treated as such. The legal information in this talk is provided “as is” without any representations or warranties, express or implied. Mark Nunnikhoven makes no representations or warranties in relation to the legal information in this talk. Without prejudice to the generality of the foregoing paragraph, Mark Nunnikhoven does not warrant that: the legal information in this talk will be constantly available, or available at all; or the legal information in this talk is complete, true, accurate, up-to-date, or non-misleading. You must not rely on the information in this talk as an alternative to legal advice from your attorney or other professional legal services provider. If you have any specific questions about any legal matter you should consult your attorney or other professional legal services provider. You should never delay seeking legal advice, disregard legal advice, or commence or discontinue any legal action because of information in this talk. Nothing in this legal disclaimer will limit any of our liabilities in any way that is not permitted under applicable law, or exclude any of our liabilities that may not be excluded under applicable law.
61. IANAL (I am not a lawyer)
62. “CSI” DEPTH
63. by @misbehave
64. by @jdhancock
65. Random | Targeted | No hope Actor Type
66. THANK YOU @marknca