full-disclosure - How we caught an Identity Thief

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Feb 20 17:22:55 2006
From: bpasdar at igxglobal.com (Babak Pasdar)
Subject: How we caught an Identity Thief

Vladis,

Thank you for your response.  

I would just like to ask you and others not to make presumptions about
our preparedness, the intelligence of our consultancy, our script
writing capabilities or the depth of our team, since I did not emphasize
or define those things in the story.  I would certainly like to ask you
not to minimize the time and effort it takes to build a good forensics
case.  

I know it is a slow Full Disclosure day, but Harping on a writing style
component of the story is a waste of the list's resources.

What I was hoping the list would appreciate is that something good
happened.  A bad guy was caught!

This is my last comment on this issue, I will certainly let you and the
list have the last word.

Again, thank you for your response.

Babak

On Mon, 2006-02-20 at 11:15 -0500, Valdis.Kletnieks@...edu wrote:
> On Mon, 20 Feb 2006 09:15:12 EST, Babak Pasdar said:
> 
> > 1. I had to get back to our office from the client site over an hour
> > away :)  Laws of physics to New York City traffic apply no matter what.
> 
> Definite lack of resources there.  You *really* want to be at least 2 or 3
> deep at the "first responder" position.  What if you had 5 minutes before
> gotten on a plane headed for Los Angeles, and thus basically unreachable for
> the next 6 hours?
> > 2. The client or a security company's network are not the best source
> > for scanning and investigation activities.  Lest you have someone who
> > looks for these early signs of the investigation.  Scans have to be
> > alternately sourced.
> 
> Again, a security company that doesn't plan ahead for this and have a few
> AOL or NetZero accounts already set up indicates a security company that
> needs to get ahead of the learning curve.
> > 3. Running a few commands by no means is an indication of a fully
> > packaged and verified set of information. A forensics case has to be
> > started fully documenting all actions and times for possible future
> > reference in legal proceedings.  Rushing through something like this and
> > not following procedure is the first step in being caught with your
> > pants down later.
> 
> Again, this should not add "hours".  If you have procedure in place, it
> shouldn't add much more than 30-45 *seconds* to each command.  And if you're
> really smart, you have all the initial queries in a script, and only need
> to document that you ran the script....

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 827 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060220/7dc987cd/attachment.bin
-------------- next part --------------

_________________________________
igxglobal utilizes state of the art technology from PGP to ensure the safeguard of all electronic correspondences.  This message could have been secured by PGP Universal. To secure future messages from this sender, please click this link and contact your representative at igxglobal for further information:

https://keys.igxglobal.com/b/b.e?r=full-disclosure%40lists.grok.org.uk&n=4Njq7juzEf1Yn9MHjRn9Ow%3D%3D