Keynote presentation held at ICT Expo conference in Helsinki 20.3.2013.

1. Hacking the Company
Risks with carbon based lifeforms using vulnerable systems

2. $ whoami

3. $ whoami
Curious Hacker (eg. I like to break things apart and rebuild them!)
Maker (eg. I like to make things)
RC-Geek (eg. I like to fly radiocontrolled devices)
Chief Security Officer @Crosskey Banking Solutions
Social Media Twitter: @khalavak, G+: Kim Halavakoski,
G+ communities: Security De-Obfuscated, PCI Jedis...

4. "Innostunut ja taitava tietokoneen ohjelmoija tai käyttäjä"
hacker as defined in RFC1392:
A person who delights in having an intimate understanding of the
internal workings of a system, computers and computer networks in
particular. The term is often misused in a pejorative context,
where "cracker" would be the correct term. See also: cracker.

6. How?

7. Vulnerabilities
Young padawan, don't forget:
Lack of focus leads to sloppiness,
sloppiness leads to misconfiguration and bugs,
and misconfiguration and bugs leads to compromise.

8. Vulnerabilities

9. Vulnerabilities & 0-days

10. 0-days

11. Top 10 vulnerable vendors

12. Who uses these vulnerable vendors anyway?
We all keep our systems patched? All the time? Almost? Sometimes?
Example of vulnerable vendors: Microsoft, Apple, Oracle, Sun Microsystems, Cisco, Mozilla, Linux,
Hewlett Packard, Adobe...
Ever used any of these vendors?

13. Top 10 vulnerable products

14. Who uses these vulnerable products anyway?
We all keep our software products patched? All the time? Almost? Sometimes?
Example of vulnerable software: Linux, Firefox, Mac OS X, Google Chrome, Internet Explorer, Seamonkey,
Solaris, Thunderbird
Ever used any of these softwares?

15. Browser market shares
According to the previous statistics with vulnerabilities in Internet Explorer, Firefox, Chrome
it seems like 92.61% of the browsers used on the Internet are vulnerable.

16. 46 vulnerabilities in 2012
48 vulnerabilities in 2013 (and it's only March!)
of which 26 vulnerabilities with CVSS score 10.0 in 2013 until now

17. http://java-0day.com

18. http://istherejava0day.com

19. Patching is Critical
Security is as strong as the weakest link.
If you take security seriously then making sure everything is
up to date is more important than ever.

20. Social Engineering
There is no patch for human stupidity

22. Social engineering works.
People are easily tricked. Really.
Tap into psychological factors that are part of human nature
Abuses trust frameworks that we are used to in real life.

23. "Could I have the root password, please?"

24. A good presentation needs a cat picture to soften the audience.
On a side-note, cybercriminals know that we like cute and funny pictures and videos,
so they are using our eagerness to click on cute things to hack your computer...
So even if supercute, think before you click!

25. How easily are you tricked?

26. How easily are you tricked?

27. Would you fall for this?

28. Are you sure it is Paypal?

29. Problems with your Visa card?

30. Salaries! Confidential! Dare to open that PDF document?

31. What did I order again?

33. Who?

34. Cybercriminals

35. Oleg Nikolaenko
24 year old hacker who ran the Mega-D botnet back in 2010
Mega-D was sending 30-40% of the spam on the Internet

36. Vladimir Tsastsin
Vladimir ran Estdomains and later Rove Digital, which ran "Operation Ghost Click" which
was behind the infamous DNSChanger malware that caused havoc all over the world.

37. Hacktivists

38. Governments and Nation states

43. Why?

44. Cybercrime market value: $114 billion

49. Where?

50. World:
10437

51. FI,SE,NO,DK,AX:
4447

52. FI:
2829
Top 10 values num %
Helsinki 411 14.528%
Tampere 406 14.351%
Hämeenlinna 176 6.221%
Jyväskylä 117 4.136%
Turku 87 3.075%
Vanda 85 3.004%
Espoo 71 2.51%
Pirkkala 63 2.227%
Lahti 63 2.227%
Oulu 59 2.086%

53. Helsinki 411 14.528%
Turku 87 3.075%
Vanda 85 3.004%
Espoo 71 2.51%
Pirkkala 63 2.227%
Lahti 63 2.227%

54. Helsinki:
411

55. From the 2829 IP-addresses in Finland I did a quick statistical analysis of the whois and DNS data and found:
most of the IPs are end-customers with ADSL, GPRS connections from Sonera, DNA, Nebula, Local Telephone companies, etc.
59 whois records that seem like companies
37 DNS records that looks like companies

56. ...some small, some bigger and some of them even "security" companies and some in
public services and even government use...

58. RSA -> Lockheed Martin
RSA was hacked, allegedly in order to get into Lockheed Martin
Twitter
Twitter was hacked using recent Java-vulnerabilities
Facebook
Facebook was hacked using recent Java-vulnerabilities through a third-party site iphonedevsdk.com
Microsoft
Microsoft was hacked using recent Java-vulnerabilities through a third-party site iphonedevsdk.com
Apple
Apple was hacked using recent Java-vulnerabilities through a third-party site iphonedevsdk.com

59. US National Vulnerability Database hacked
Malware planted on 2 webservers...
Undiscovered for 2 months...
"Hacking the NVD and planting malware on the very place where we get our vulnerability information,
that is just pure evil!"

62. Ocean's Eleven?

63. Matt Honan – Senior Editor at Wired Gadget Labs
Security flaws in Apple and Amazon customer service systems lead to hackers gaining control over his account and deleting files on his Mac.

64. How?

65. Metasploit
Penetration testing tool.
Developed by HD Moore back in 2003.
Bought by Rapid 7 in 2009.
Opensource verion still available.

66. Social Engineer Toolkit
Great tool for performing social engineering attacks:
phishing, web-attacks, malware infecter USB sticks, etc.
Developed by Dave Kennedy & Co

68. Demo
Fictious company with the following network setup:
firewall, mailserver, webserver, DNS-server, Internal Windows 7 workstation...

70. Conclusion

71. Carbon based lifeforms
Humans are the weakest link
Using age-old social frameworks in a modern connected world
Easily tricked into clicking, opening links, attachments and programs
Make errors, repeadetly
Computer software
Are programmed by humans
Have bugs
Used by humans
Hacking tools
Readily available
Easy to use
Developed by proffessionals
Cybercriminals
Cybercriminals
Hacktivists
Nation States & Governments

73. Questions?