How to tell if you are being cyber stalked or hacked BCS, September 2017

Size: px

Start display at page:

Download "How to tell if you are being cyber stalked or hacked BCS, September 2017"

Ashlynn Eaton
5 years ago
Views:

1 How to tell if you are being cyber stalked or hacked BCS, September 2017 Paul Vlissidis - Technical Director, Senior Advisor paul.vlissidis@nccgroup.trust

Welcome Speaker Paul Vlissidis, Technical Director, Senior Advisor & Cyber Lead on C4 Hunted Experience Started NCC Group ethical hacking team in

3 Welcome Speaker Paul Vlissidis, Technical Director, Senior Advisor & Cyber Lead on C4 Hunted Experience Started NCC Group ethical hacking team in years of cyber security Hacked journalists, Hunted Contestants, Radio presenters Conference Speaking / Articles/ White Papers / TV / Radio 3

5 Stuff We Will Cover Hackers & Stalkers How Hackers/Stalkers work to hack you Case Study Signs to look for Defences

6 6

are usually opportunists Stalkers usually have other motives

7 Hacking or Stalking? Hackers usually want money You have probably never met them They are usually opportunists Stalkers usually have other motives Probably know you (79% of stalkers are known to victims) Have different motives e.g. revenge porn They will take their time

8 People The Weakest Link? it s you they are hacking Make them your strongest defence!

9 How Hackers identify victims Trawling the Internet for dumps Phishing Malvertising Drivebys Dodgy downloads (apps & software) Vishing Spoofing a free wifi network Lost or Stolen phones/laptops

10 Data Breaches 4.7 Billion and rising fast Usernames (usually ) Password (sometimes encrypted but usually easy to crack with free tools) Password hints Sometimes home addresses Other data Over 4.75 Billion accounts are out there. On Hunted we got an almost 100% hit rate on breached accounts It cannot be deleted it s a tattoo Check all your family s s

11 How Stalkers Target Victims Open Source Intelligence Dumps trawl Social Media profile address Home address Mobile Anything that could help them access your accounts They may already know you so this is easy You may be making it too easy by having a rich digital footprint

12 Case Study co.uk/news/article /How-lifestolen-cyberstalkers-They-tookcash-job-keyshome-simplyhacking- s-And- Christmas-planningyou.html 12

13 The Phone Call Claudia : Me: Claudia : Me: Claudia: Hello. Can you hack me? Er. What? I want to do a piece in the Mail On Sunday on how much of someone s life a hacker can get access to so I want you to hack me. Can you start straight away? It s not quite that simple we need to discuss scope and authorisation. How tiresome. What do we need to do? Basically you can do what you like but don t delete anything and don t reset any passwords without checking first.

Open Source Intelligence Website mobile and email Facebook - friends viewable but not much else Twitter very little but followers/followed correlated with Facebook friends Linkedin

14 Open Source Intelligence Website mobile and Facebook - friends viewable but not much else Twitter very little but followers/followed correlated with Facebook friends Linkedin correlated connections Companies House home address Company and credit searches - addresses Domain names home address and alternate in RIPE All in all fairly slim pickings.. 14

15 What we did find Mac.com, me.com indicated apple mac user Confirmed iphone user using imessage So. itunes account - almost certainly icloud account - probably Iphone backups if we are lucky. Time to go phishing using NCC Group s Piranha Phishing Simulation platform 15

masquerading as a trustworthy entity in an electronic communication.

16 Phishing Phishing is a social engineering technique to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication. Spear phishing is like phishing, but tailored for a specific individual or organisation. Source: NCC Group Piranha Service

The Sting (spear phish) 86.163.100.212 - - [09/Apr/2013:17:48:36-0400] "GET /?RTWPH-P9HY8-MT6B8-R9XE6-JFHB2 HTTP/1.

17 The Sting (spear phish) [09/Apr/2013:17:48: ] "GET /?RTWPH-P9HY8-MT6B8-R9XE6-JFHB2 HTTP/1.1" "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/ (KHTML, like Gecko) Version/6.0.3 Safari/ " 17

Email still the key to everything Trawled emails containing the word password or welcome 66 emails containing the word password

18 still the key to everything Trawled s containing the word password or welcome 66 s containing the word password and 85 s saying: Welcome. Backup of password vault was attached to an Cracked using slight variation of icloud password 18

19 Identity Theft 19

20 Challenge 1 Who am I staying with? US Embassy? /Facebook searches 20

21 Challenge 2 keys to my house Searched contacts for same street Search s/facebook for correspondence Narrowed down to 2. Guessed nearest Mobile account SMS -> neighbour Hi Pandora, I forgot that I had arranged to have someone checkout my central heating. He is due around 3pm and his name is Paul. Can you let him in? 21

22 Money transfer account number was needed for verification but this was stored in Contacts in icloud 22

23 Hiding the evidence 23

24 Phone restore icloud backup restored to a blank phone Access apps Access photo stream Spoof text to boss : I resign Geo tagged photos identified location in real-time 24

25 What have we learned? Being hacked isn t all about credit cards and money is more important than we think and deserves the best security we can muster Once they are in a cyber stalker can access some very personal aspects of your life I don t know Mr Vlissidis, but he knows just about all there is to know about me, from the financial to the personal. He has access to everything that I have stored on my computer. Every element of my life has been exposed. Claudia Joseph

26 Signs When Something Isn t Right s get marked as read or disappear Friends report getting odd messages from you on social media Your computer takes longer than usual to start up, restarts on its own or doesn't start up at all. The homepage set on your web browser has changed or web pages are slow to load. Make sure your security software is up to date and run it to check for infection. Check your security settings on , social media Check your login history and your google search history for anything that looks odd See If in doubt, seek technical help!

10 Steps To Protect Yourself Do Lock your computer/phone/tablet when you leave it and set a PIN Do Regularly apply latest software/app updates to

Do Use 2-factor authentication for your main email and cloud services Do Back up your important files/photos/data - safely and daily Don t install

27 10 Steps To Protect Yourself Do Lock your computer/phone/tablet when you leave it and set a PIN Do Regularly apply latest software/app updates to everything (+IoT). Do Use an anti-virus tool and keep it up to date. Do Use 2-factor authentication for your main and cloud services Do Back up your important files/photos/data - safely and daily Don t install software/apps unless you are very sure it is genuine Don t store passwords/pins in your contacts Don t share passwords between sites - Use a password manager Don t save card details on websites Do treat public Wi-Fi with suspicion use a VPN

Intelligence to identify phishing sites Posture Improvement - Phishing Simulation

28 NCC Group Services in this area Threat Detection Open Source Threat Intelligence against your company, executives, key staff Dark Web searches Domain Threat Intelligence to identify phishing sites Posture Improvement - Phishing Simulation (Piranha) both managed and self-service Managed Detection & Response FSB Cyber Helpline

29 @vlissidis

My Life as a Cyber Stalker MU, February 2017

My Life as a Cyber Stalker MU, February 2017 Paul Vlissidis - Technical Director, Senior Advisor paul.vlissidis@nccgroup.trust About NCC Group 850 million FTSE listed company Cyber Security Assurance 35