from your pocket to your heart and back
DESCRIPTION
Cyber Security in the Financial and Healthcare Industries, and How They Affect Homeland SecurityTRANSCRIPT
From Your Pocket, to Your Heart, and Back
Cyber Security in the Financial and Healthcare Industries, and How They Affect Homeland Security!!Ian Amit, Director of Services
Hi!
Always remember that you are absolutely unique.!Just like everyone else.!
Margaret Mead
Part I !
Where we look at some examples
Wireless Network Penetration Testing Services
Confidential. Proprietary. [18]
Detailed Findings Tables
#RAPCON–1 Unauthenticated RAP Console Leaks IPSec Configuration
Device(s) RAP Console
Category Information Disclosure
Testing Method Black Box (Hardware)
Tools Used Firefox
Likelihood Medium (3)
Impact High (4)
Total Risk Rating High (12)
Effort to Fix Medium
Threat and Impact
The RAP Console is unauthenticated and displays information about the access point. Figure 1 shows a screenshot of the RAP Console home page.
Figure 1: Unauthenticated RAP Console
On the Diagnostics tab it is possible to view the conn_log, sapd_debug, dmseg, and rapper debug logs. The rapper debug log will log the PAP Username:
IKE_EXAMPLE: Starting up IKE server
Wireless Network Penetration Testing Services
Confidential. Proprietary. [18]
Detailed Findings Tables
#RAPCON–1 Unauthenticated RAP Console Leaks IPSec Configuration
Device(s) RAP Console
Category Information Disclosure
Testing Method Black Box (Hardware)
Tools Used Firefox
Likelihood Medium (3)
Impact High (4)
Total Risk Rating High (12)
Effort to Fix Medium
Threat and Impact
The RAP Console is unauthenticated and displays information about the access point. Figure 1 shows a screenshot of the RAP Console home page.
Figure 1: Unauthenticated RAP Console
On the Diagnostics tab it is possible to view the conn_log, sapd_debug, dmseg, and rapper debug logs. The rapper debug log will log the PAP Username:
IKE_EXAMPLE: Starting up IKE server
Wireless Network Penetration Testing Services
Confidential. Proprietary. [19]
setup_tunnel Initialized Timers IKE_init: completed after (0.0) (pid:16341) time:1999-12-31 16:37:53 seconds. Before getting PSK PSK:****** User:xiaobo1 Pass:******
A more serious information disclosure is the “Generate & save support file” option available on the home page of the RAP Console. The support.tgz file contained 73 files, including the ikepsk, pappasswd, and papuser files, as shown in Figure 2.
Figure 2: Contents of support.tgz
These files contain the encrypted IPSec pre-shared key, and the unique username and the encrypted password for this access point.
An attacker who has gained physical access to the access point or access to the RAP Console for the access point would be able to recover the credentials used by the access point to establish a VPN back to the controller. The credentials are encrypted with a static key, which can be easily decrypted.
Recommendations
The RAP Console has no security model. Disable it if possible.
What’s the problem there?
Medical or Financial?
What’s the problem there?
Medical or Financial?
What’s the problem there?
Who cares?
Medical or Financial?
What’s the problem there?
Who cares?
Fairly unique to healthcare, right?!Need to provide people access to medical facilities…
Kind’a like a financial institution needs to provide customers access to facilities, and their money…
ASSETSTraditionally protected?
Mapping all access paths?
Mapping all storage locations?
Secondary? Tertiary?…
Human Resources
What can it tell on your organization?
Business plans?
Access to resources?
Motivation (i.e. opportunity…)
Part II !
Where we try to connect MORE dots
The single biggest problem in communication is the illusion that it has taken place.!
George Bernard Shaw
Homeland security? Critical Infrastructure!
Homeland security? Critical Infrastructure!
Homeland security? Critical Infrastructure!
Homeland security? Critical Infrastructure!
Homeland security? Critical Infrastructure!
Part III !
Where we “disprove” what we just learned :-P
Always remember that you are absolutely unique. !Just like everyone else.!
Margaret Mead
Remember this?:
Always remember that you are absolutely unique. !Just like everyone else.!
Margaret Mead
Remember this?:
We can't solve problems by using the same kind of thinking we used when we created them!
Albert Einstein
Yes, you do need your!own special way of dealing!with your security posture.
What makes me “tick”?
• What can take the business down?!
!
• Who is involved???
vs.
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Produc RiskProduct Centric Threat/Asset Centric
Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Based on lab threats Based on real (relevant) threats
Product Centric Threat/Asset Centric
Let that last one sit there for a second…
Produc Risk
Zero lateral knowledge transfer Peer knowledge transfer
Zero self learning (experience) Improves with practice
Based on lab threats Based on real (relevant) threats
“Industry Best Practice” Tailored for YOUR practice
Product Centric Threat/Asset Centric
Product / Event
Risk / Asset
Vertical
Lateral
Product / Event
Risk / Asset
Vertical
Lateral
We all know the “how” !
Start asking “why”!
We all know the “how” !
Start asking “why”!
Thank YOU! !
@iiamit