How to Detect and Stop Organizational Data Theft

TL;DR

Data theft can be detected by analyzing network flow for sharp changes in traffic volume, protocol mix, and destination, then attributing anomalies to specific IP addresses. Organizations should combine this technical monitoring with employee behavior indicators and secure coding practices, because fully patched systems can remain vulnerable when custom applications fail to sanitize input.

Transcript

Hi, my name is Joe G. Mantkevicius. I lead the insi-- uh, the technical solutions team in the Insider Threat Center at CERT, and today I'll be talking to you about data theft. Uh, specifically, the title of my presentation is Three Ways to Lose Data and One Way to Stop It. Now, because of the abbreviated form of this presentation, I will only be sh... Read More

Key Insights

• Data theft is difficult to price because similar-looking PDF, Visio, and Word files can carry vastly different strategic value. The cases examined by CERT ranged from losses of a few thousand dollars to a largest observed case valued at five billion dollars.
• Data theft can destroy competitive advantage when an attacker obtains years of research. The consequences described include companies going out of business and thousands of employees losing their jobs, showing why organizations should not treat information as valuable only when it has an obvious market price.
• Insider theft can produce a visible change in network behavior. In the reconstructed case, aggregate traffic rose roughly twentyfold over normal levels, while VPN traffic on port 4500 and SMB file-transfer traffic each represented about 40 percent of the observed profile.
• Network flow analysis works by isolating anomalous traffic and attributing it to a particular IP address. CERT demonstrated this process with SiLK, a flow analysis engine developed at Carnegie Mellon, while emphasizing traffic flow at layer four of the OSI model.
• Nontechnical warning signs are as important as technical indicators in insider investigations. The insider had taken several leaves of absence and requested access to future strategic designs, so unusual personnel behavior and elevated-access requests provided context for the abnormal network traffic.
• A short malicious PHP script can establish control of a vulnerable system. The demonstrated script attempted to open a socket and command-and-control channel, showing that an attacker could take over a server with code containing fewer than one hundred lines, possibly around fifty.
• A web application can remain vulnerable even when its operating system and web server are fully patched. The demonstrated Windows Server 2008 system used automatic updates and ran an updated IIS server, but insecure custom application code still permitted malicious SQL input and file placement.
• Input sanitization is the direct defense against the demonstrated custom application flaw. The vulnerable web server script required only two additional lines to sanitize submitted data, preventing the injection path that allowed a PHP payload to be written onto the server.

Questions & Answers

Q: How can network flow analysis detect data theft?

Network flow analysis can reveal data theft by comparing current traffic with an established normal profile. In the insider case, aggregate traffic increased roughly twentyfold, and VPN traffic on port 4500 and SMB file-transfer traffic each accounted for about 40 percent of the profile. An analyst then used SiLK to isolate the anomalous flow and attribute it to a specific IP address.

Q: What network behavior indicated insider data theft?

The key indicator was a dramatic departure from the organization’s normal traffic pattern. Normal laboratory traffic was predominantly web browsing, with HTTP accounting for 60 percent. During the insider’s activity, aggregate traffic rose about twenty times, while VPN traffic and SMB file transfers each reached roughly 40 percent. This pattern was consistent with extensive file downloading over approximately thirty-six hours.

Q: Which employee behaviors can signal a possible insider threat?

The insider case included several nontechnical warning signs that gave context to the network anomaly. The employee, an engineer, had taken several leaves of absence and requested access to future strategic views of the company’s designs. CERT’s analysis emphasized that organizations should examine unusual personnel behavior and requests for expanded access alongside technical evidence such as large file transfers.

Q: How did the outsider compromise the web server?

The attacker exploited a vulnerability in a custom web application. The demonstrated method converted a PHP script into hexadecimal form, placed SQL commands where a login name was expected, and used an into outfile vulnerability to write the script onto the web server. Executing that script then created a command-and-control connection through which the attacker accessed and downloaded the server’s files.

Q: How was Metasploit used to control the victim server?

Metasploit was used to establish and manage a reverse TCP command-and-control session. The attacker configured the connection to listen on port 4444 and supplied the attacker’s own IP address. After the planted PHP script was executed, the Metasploit console reported that session one had opened. The attacker entered that session, accessed the victim server, and downloaded its files.

Q: Why was patching insufficient against the demonstrated attack?

Patching was insufficient because the vulnerability existed in custom application code rather than in the operating system or IIS. The demonstrated Windows Server 2008 machine was configured for automatic updates, and its IIS server was also fully updated. Despite that patch status, the in-house web application accepted dangerous input, allowing the attacker to inject SQL commands and place a PHP script on the server.

Q: How could input sanitization have prevented the web attack?

Input sanitization could have stopped the attack by preventing submitted login data from being interpreted as SQL commands. The vulnerable application accepted malicious input that invoked an into outfile operation and wrote a PHP payload to the server. According to the presentation, adding two lines to sanitize input data would have made the demonstrated script invulnerable to that injection technique.

Q: Why is stolen organizational data difficult to value?

Stolen organizational data is difficult to value because file formats do not reveal the importance of their contents. The cases discussed involved ordinary PDF, Visio, and Word documents, yet estimated losses ranged from a few thousand dollars to five billion dollars. The real impact can include lost research, reduced competitive advantage, national security consequences, company failure, and thousands of layoffs.

Summary & Key Takeaways

• Data theft can cause consequences ranging from modest financial losses to the collapse of companies and the loss of thousands of jobs. The stolen items may appear to be ordinary PDF, Visio, or Word files, but their value depends on the strategic research, intellectual property, competitive advantage, or national security information they contain.

• An insider case showed how abnormal network activity can expose theft. Traffic increased roughly twentyfold, with about 40 percent attributed to VPN traffic and another 40 percent to SMB file transfers. CERT analysts used SiLK flow analysis to isolate the anomalous traffic and associate it with a particular IP address.

• An outsider compromised a patched web server by injecting a hexadecimal-encoded PHP script through a vulnerable custom application. The script opened a reverse TCP command-and-control channel through Metasploit, allowing the attacker to download sensitive files. Two input-sanitization lines could have removed the application vulnerability that system patching did not address.