1. Give Me Your Data!
Pilfering Data without Breaking In
Dave Chronister
CISSP, MCSE, C|HFI
Founder / Managing Technical Partner
Parameter Security

2. About Me
• Security Practitioner
• Ethical Hacker
• Forensic Investigator
• (MO PI Lic#2012039253)
• Instructor
• Founder Parameter Security
• We Find, Not Fix Issues

4. Data is not Secured

5. Could I Obtain Sensitive Data?
Without Breaching Any Access Controls?

6. Determine Sources of Data
Purchase Old Hardware
Social Media Sites
FTP Sites

7. WARNING
This is a demonstration, not an instruction manual for criminal behavior.
Obfuscation of sensitive data was done by me.
When possible, the data owner was notified of insecure information.
The identity of the owners have been hidden to protect the Security Impaired.

8. Old Hardware
1. Create Forensic Image
2. Data Carve Files
3. Profit??

9. Old Hardware
EBay – 2 IPhone / 9 Hard Drives
Targeted Individuals Selling Equipment
(IT Employees Offloading Equipment)
2 Rounds of Purchases
2nd Round Included Hardware Resellers
Total Cost - $50 IPhone, $120 Hard Drives

10. Results:
IPhones Forensically Clean
Drives Re-Partitioned w/ Artifacts
5 – “Floor Models” (Only OS)
Hard Drives Zero’d Out
University of ######## Drive
Term Papers, Porn, and Mal-ware
Office Equipment Service company in PA
Service Logs, Time Off Request
2
1
7

11. Drive 9

12. Drive 9

13. Drive 9

14. Drive 9

15. Drive 9
Purchased from Re-Seller

16. Drive 9

17. Drive 9

18. Drive 9
• Purchased from Re-Seller
• Drive was not Formatted
• Partitions were not Deleted
• Drive belonged to Re-Seller Owner
Conclusion – Promising but could be Expensive
How do you handle EoL Media??

19. Photo Sharing Sites
Photobucket
Recent Uploads

20. Photo Sharing Sites
Recent Uploads – Open Buckets
App allows phones to upload pics automatically

21. Photo Sharing Sites
Before you ask, yes I found that

22. Photo Sharing Sites
Before you ask, yes I found that

23. Photo Sharing Sites
Before you start browsing…warning

24. Photo Sharing Sites
Before you ask, yes I found that

25. Photo Sharing Sites
Before you ask, yes I found that

26. Photo Sharing Sites
Before you ask, yes I found that

27. Photo Sharing Sites
Before you ask, yes I found that

28. Photo Sharing Sites
Before you ask, yes I found that

29. Photo Sharing Sites
But I Also Found…

30. Photo Sharing Sites
Credit Cards

31. Photo Sharing Sites
Address Information

32. Photo Sharing Sites
International Cards

33. Photo Sharing Sites
International Cards

34. Photo Sharing Sites
Vendor’s Notes

35. Photo Sharing Sites
Checks

36. Photo Sharing Sites
Lots of Checks

37. Photo Sharing Sites
Identity

38. Photo Sharing Sites
Identity

39. Photo Sharing Sites
Family Relationships

40. Photo Sharing Sites
With Their Info

41. Photo Sharing Sites
My Favorite

42. Photo Sharing Sites
Target #1

43. Photo Sharing Sites
Target #1

44. Photo Sharing Sites
Target #2

45. Photo Sharing Sites
Target #2

46. Results:
Credit Card Numbers
Login Information
Social Security Numbers
Also, Personal Info and Business Trade Secrets
Conclusion – Very Easy, No Cost, No way to Automate…. Yet….
10
15
30
Total Time Spent – Approx. 8 hours
How could you control “pix leakage?”

47. FTP Sites
Used Metasploit Framework – FTP Anon Scanner
Could also use Nmap

48. FTP Servers
Typical Finding

49. FTP Servers
Typical Finding

50. FTP Servers
Started Getting Good

51. FTP Servers
WTF?!?

52. FTP Servers
Trends Forming
Anonymous READ (220 Welcome to ASUS RT-AC66U FTP Service.)
Default config creates external FTP Site

53. FTP Servers
Trends Forming

54. FTP Servers
What Did We Find?
• Financial Information
• Unencrypted Backups
• Medical Records (PHI)
• Intellectual Property
• Passwords Galore (Include System Passwords to Global Companies)
• Voter Information/ Political Parties Info
In a Nutshell - Everything!

55. FTP Servers
ASUS Is Not Alone
• At least 3 more vendors have same issue
• Currently contacting vendors
• Will release when patched or after 3 months

56. FTP Servers
Anything Else Interesting?
READ/Write Access
PCI / Safe Harbor Violations

57. FTP Servers
Results:
• IPs Scanned – ½ Class A
• Anonymous FTP Servers – 3000+
• “Legitimate” Servers - >100
Conclusion – THE Path of Least Resistance

58. Questions?
www.ShowMeCon.com
Dave<dot>Chronister<at>ParameterSecurity<dot>com
@Bagomojo