C:\Fakepath-6 09 10 Financial Fraud Webinar

Detect Advanced Crime in the
Financial Sector

Ryan Kalember
Director, Product Marketing

Fraud Detection is More Challenging Than Ever

You Need to See…
… Networked Systems
… Zero-day Threats
… Critical Data Stores
… Privileged Users
… Network Connections
… Fraud Techniques
… Application Activity

www.arcsight.com © 2010 ArcSight Confidential 2

Cybercrime Keeps Growing

100 Million Credit Cards 45 Million Credit Cards
$130 Million Cost $250 Million Cost

1.5 Million Debit Cards
$73 Billion Risked by Rogue Trader
Processing License Revoked
$7 Billion Lost


Modern Breaches Share a Pattern

Acquire target, sneak in, hop around
(Perimeter doesn’t help)

Get privileged access to critical assets
(Impact takes time)

Conduct the crime for an extended time
(Early detection matters)


Today’s Cybercrime Is Different

Attacks
Smart Humans

High Value Targets Business faces more risk
than ever.

Defenses

Signatures Ineffective
Traditional defenses
No Choke Point won’t work.

Vulnerabilities
A different approach
Key Systems Unwatched
is required.
Key Users Unwatched


Modern Threats

1. Spear-Phishing

2. Hackers and Coordinated Attacks

3. Malware/Bot Infiltration

4. Man in the Browser Attacks (MITB)

5. Insider Attacks

6. Insider Theft


Spear-Phishing Threat Vectors

MyFriend This is hilarious: bit.ly/p0wn3d

Myfriend2010

RT@myotherfriend best thing I’ve read all
day bit.ly/p0wn3d
about 39 minutes ago from web

From: colleague@mycompany.com
colleague@mycompany.com
To: me@mycompany.com
me@mycompany.com

Thought you’d find this report interesting.
PDF
PDF
Report.pdf
Report.pdf
210 KB
210 KB


Hackers and Coordinated Attacks


Detection Techniques


RBS WorldPay Breach


RBS WorldPay Breach

Breach: Privilege Escalation: Monetize:
Hack Perimeter Security Access Debit Card System ATM Network Fraud


Malware Beaconing

BOT


Man in the Browser: Zeus Bot


Bot Detection Event Sequencing

Normal Transaction:

Fraudulent Transaction:


Insider Attacks

ID: JOHN

PWD: ******

JOHN

Login Successful
Welcome User: JOHN
ID: JOHN

PWD: ******

SAM Alert: Unauthorized use
of account JOHN

Windows user SAM 9-08-09 12:38
SAP user JOHN 9-08-09 12:39


Insider Theft

Admin/Pa$$wd Admin/Pa$$wd

Admin/Pa$$wd Admin/Pa$$wd

ID: Admin
PWD: Pa$$wd

Who extracted the confidential files?


Detecting Hackers and Coordinated Attacks


Convert Transactions into Events

Mainframe Transaction:
5000000 4857382225004272 4857382225000247 20081201
20081201 651227 999999998
74857388336478441246882083360000002199 5411
000000000000000 ATM TXN REV MARLOW
BE 74857388336478441246882
34800000000000001411113480000000000000141111 000000000000000000
000000001.00001NN 000000000000000000 0000000000000000001
D0000005 0000000000000000001
000070053 4857382225000247
3822250042727485738833647844124688283369500000069


Analyze Transactions for Patterns


Pattern Investigation: Accounts vs. Amounts vs. Types

Two accounts are making very similar sets
of transactions through the retail channel


Cross-Channel Attack

Card Uses Harvested
Application
Web Credentials

Get Personal Data
from Autoforms
My Account
Accounts Balance
Authenticate using
Personal Details

Request Transfer

Call Center
Account ID 12345678
Passcodes rover12
2-Factor Auth ?
Address 12 Acacia Ave.
D.O.B. 1/12/1966
Products Current, Card

Mother’s Name Smith

Cross-Channel Attack

Card Detect Strange
Application
Browsing Pattern

Put Account on
Watch List
My Account
Accounts Balance
Detect Xfer by
Phone Banking

Elevated Risk =
Txn Blocked

Account ID 12345678
Call Center
Passcodes rover12 CRM/VOIP Fraud Mobile List Application Web Servers
2-Factor Auth ? Servers
Address 12 Acacia Ave.
D.O.B. 1/12/1966
Products Current, Card
Sources:

Detecting Bot Malware Beaconing


Malware Beacon Detection – Behavioral Analysis


Detecting MITB Attacks


Identity Correlation

Correlate common identifiers such as email address, badge ID, phone extension
Events occurring across devices that identify users by different attributes
Attribute the event to a unique “identity” allowing correlation across any type of device

Identifiers Identity
rjackson
348924323
jackson@arc.com Robert
robertj Jackson
rjackson_dba
510-555-1212


Detecting Role Violation Attacks

Role Violations by Department and Employee Type


Detecting Attacks in Shared Admin Accounts

Application Access: Source: 10.10.10.10


[02.5.2009 10:33:46] Login Success 10.10.10.10 fmadmin


?

?

Detecting Attacks in Shared Admin Accounts



IP Address Identity
10.12.23.7 haroldr
10.12.23.23 czfb12
10.12.22.35 bobc
192.168.10.6 katie
10.10.10.10 jimmyj


Detecting Terminated User Attacks

HR

Terminated

Finance

Why is he accessing the
finance file server?


Conclusion


ArcSight

Company Background Analyst Recognition
#1 in Market Share –
• Founded May 2000 Last three reports
• 2000+ Clients
#1 In-use for both SIEM
• 500+ employees, offices worldwide and Log Management
• NASDAQ: ARST
SIEM Leader’s
Quadrant -
SEVEN years running

Industry Recognition


Enterprise Threat and Risk Management:
Comprehensive View of Business Risk

Global Reporting by
Lines of Business

Security High Risk High Risk
Incidents Users Transactions

Security Identity Transactions

- DoS - Insider Threat - 1st and 3rd Party
- SQL Injection - PII/IP Protection - Online Banking
- Malware - Privileged Users - AML
- External Threats - Internal Fraud - Trading

FW, IDS, AV, Proxy, VA Internal Apps, DLP, Customer Transactions, Web
Email, Web, Badge Logs, Mainframe, CRM

Thank You for Attending


C:\Fakepath-6 09 10 Financial Fraud Webinar

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (6)

Similar to C:\Fakepath-6 09 10 Financial Fraud Webinar

Similar to C:\Fakepath-6 09 10 Financial Fraud Webinar (20)

More from TechBiz Forense Digital

More from TechBiz Forense Digital (20)

Recently uploaded

Recently uploaded (20)

C:\Fakepath-6 09 10 Financial Fraud Webinar