Attacking the cloud with social engineering
•Télécharger en tant que PPTX, PDF•
3 j'aime•2,014 vues
An ethical hacker's view of cloud security risks from social engineering
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Attacking the cloud with social engineering
Similaire à Attacking the cloud with social engineering (20)
Plus de Peter Wood
Plus de Peter Wood (20)
Dernier
Dernier (20)
Attacking the cloud with social engineering
- 1. Attacking the cloud with social engineering Peter Wood Chief Executive Officer First•Base Technologies An Ethical Hacker’s View
- 2. Slide 2 © First Base Technologies 2013 Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base in 1989 (one of the first ethical hacking firms) CEO First Base Technologies LLP Social engineer & penetration tester Conference speaker and security ‘expert’ Member of ISACA Security Advisory Group Vice Chair of BCS Information Risk Management and Audit Group UK Chair, Corporate Executive Programme FBCS, CITP, CISSP, MIEEE, M.Inst.ISP Registered BCS Security Consultant Member of ACM, ISACA, ISSA, Mensa
- 3. Slide 3 © First Base Technologies 2013 Cloud models
- 4. Slide 4 © First Base Technologies 2013 Cloud computing definition Cloud separates application and information resources from the underlying infrastructure, and the mechanisms used to deliver them http://www.cloudsecurityalliance.org/guidance/csaguide.v2.1.pdf
- 5. Slide 5 © First Base Technologies 2013 The ‘SPI’ Model Software (SaaS) – cloud provider owns application, operating system and infrastructure Platform (PaaS) - cloud provider owns operating system and infrastructure, client owns application Infrastructure (IaaS) cloud provider owns infrastructure, client owns application and operating system
- 6. Slide 6 © First Base Technologies 2013 SPI in context • Software as a Service – Just run it for me! – Examples: Google Apps, Salesforce.com • Platform as a Service – Give me a nice API and you take care of the rest – Examples: Google App Engine, Microsoft Azure • Infrastructure as a Service – Why buy machines when you can rent cycles? – Examples: Amazon EC2, Rackspace Cloud
- 7. Slide 7 © First Base Technologies 2013 Cloud Benefits
- 8. Slide 8 © First Base Technologies 2013 What's different in cloud IaaS Infrastructure as a Service PaaS Platform as a Service SaaS Software as a Service Security ~ YOU Security ~ THEM
- 9. Slide 9 © First Base Technologies 2013 What does it mean for attackers? • Login from anywhere • Browser access • Simple credentials • No intruder detection • No physical security • Trick a user and it’s game over!
- 10. Slide 10 © First Base Technologies 2013 Why social engineering? • Staff can be tricked at home, in a coffee shop, at an airport … • No corporate desktop controls • Easy to impersonate your IT staff or help desk • Using email, phone, chat …
- 11. Slide 11 © First Base Technologies 2013 Just a little brainstorm
- 12. Slide 12 © First Base Technologies 2013 Why should you care? Exposure of • Customer data (industrial espionage, reputation) • Credit card data (PCI DSS, reputation, direct costs) • Personal information (data protection, reputation) • Sensitive information (contractual penalties, reputation) • Business plans (industrial espionage, reputation) • Staff data (data protection, spam, social engineering, reputation) • and identity theft: personal and business
- 13. Slide 13 © First Base Technologies 2013 Even cloud email has value …
- 14. Slide 14 © First Base Technologies 2013 Why APT works
- 15. Slide 15 © First Base Technologies 2013 Attack Techniques
- 16. Slide 16 © First Base Technologies 2013 Classic phishing email
- 17. Slide 17 © First Base Technologies 2013 Spear phishing email
- 18. Slide 18 © First Base Technologies 2013 Spear phishing • Emails that look as if they are from your employer or from a colleague • The email sender information has been faked • Malicious attachment or link to drive-by web site • The payload can steal credentials or install a Trojan • Or even simple form filling to capture user details
- 19. Slide 19 © First Base Technologies 2013 Telephone social engineering • Not every hacker is sitting alone with a computer, hacking into a corporate VPN • Sometimes all they have to do is phone!
- 20. Slide 20 © First Base Technologies 2013 The remote worker 1. Call the target firm’s switchboard and ask for IT staff names and phone numbers 2. Overcome their security question: Are you a recruiter? 3. Call each number until voicemail tells you they are out 4. Call the help desk claiming to be working from home 5. Say you have forgotten your password and need it reset now, as you are going to pick up your kids from school 6. Receive the username and password as a text to your mobile 7. Game over!
- 21. Slide 21 © First Base Technologies 2013 Phones are very flexible Previous calls gave access to: • CEO’s email and calendar • IT manager’s desktop • Remote access to a network • … and cloud services!
- 22. Slide 22 © First Base Technologies 2013 Telephone SE • Impersonation of IT staff to obtain user’s credentials • Impersonation of user to obtain new password • Impersonation of provider to obtain user’s credentials • Impersonation of client admin to provider • Impersonation of provider to client admin • … and so on … Game Over
- 23. Slide 23 © First Base Technologies 2013 People love USB sticks! I found it in the car park … … just wanted to see what was on it …
- 24. Slide 24 © First Base Technologies 2013 USB sticks • Autorun infection of user’s computer • Manual click to infect user’s computer • Contains link to drive-by web site • The payload can steal credentials or install a Trojan • Or even simple form filling to capture details • … and so on … Game Over
- 25. Slide 25 © First Base Technologies 2013 Defence
- 26. Slide 26 © First Base Technologies 2013 Human firewall • Train your staff to recognise social engineering attacks • Invest in continual awareness campaigns
- 27. Slide 27 © First Base Technologies 2013 Technical controls • Implement two-factor authentication (if you can) • Use ‘least privilege’ principles for access to services
- 28. Slide 28 © First Base Technologies 2013 Procedural controls • Ensure joiners, movers and leavers are handled thoroughly and quickly! • Divide responsibilities between your administrators and the service provider's administrators, so no one has free access across all security layers
- 29. Slide 29 © First Base Technologies 2013 Peter Wood Chief Executive Officer First Base Technologies LLP peterw@firstbase.co.uk http://firstbase.co.uk http://white-hats.co.uk http://peterwood.com Twitter: peterwoodx Need more information?
Notes de l'éditeur
- The lower down the stack the Cloud provider stops, the more security you are tactically responsible for implementing & managing yourself.
- “One of main reasons organizations adopt cloud applications is to free their employees from the constraints of a physical network. With cloud apps, you don’t have to log into a work-issue PC attached to a corporate LAN in a company office to get your information or do your job. Any web-connected computer will do, so efficiencies and opportunities abound.”
- “This same freedom also applies to hackers of all varieties, but in particular social engineering attackers. Compromised passwords can now be employed from any web-connected PC; the attacker need not enter your building to steal or destroy data. Your employees can be conned in favourable settings — a coffee shop or airport lounge — without the oversight or support of company security staff. Above all, it is much easier for an attacker to pose as a legitimate authority when their target is already accustomed to dealing with remote teammates via phone, email or chat. If you’ve never met your IT staff, it’s far simpler for a hacker to pretend to be from that IT staff.”