Email addresses and E-Discovery

This has been bugging me for a while. And I'm just now going to write about it. And only because a user inadvertently brought it up.

While I was in the lunchroom, a user came in to eat; and brought her Blackberry. (We don't have a policy on Blackberrys...grrrr...a post for another day.) Anyway, one of the sales reps had emailed her back a one-word answer. "Yes." She ranted that she was sick of this rep replying one-word answers to her questions; and replying from his personal mail. She sent the original question to his corporate email address.

Back in November, the IT department was successful in changing the policy on forwarding all corporate email to personal email addresses. 90% of the users comply with this policy. First of all, management did not like the fact that official company business was being conducted with an "aol" or "hotmail" address. I didn't like it because we have no record of what is really going on. Suppose a salesrep makes a deal with a dealer giving them X% off of a future order. If the company did not comply (for whatever reason) how would we know. We can't grab aol or hotmail email. Should we get sued, we could never produce that email.

Unfortunately, it is not just salesreps that are doing this. There are some in upper management who use their personal email addresses.

So, how do you enforce this policy? I would love to hear some suggestions.

Lesson Learned: Always mention when you are going to analyze a machine

It's been an interesting week. People have been leaving the company in record amounts.

The latest occurred yesterday. The manager went to his boss, gave his resignation, said he was going for coffee and would be right back. He hasn't returned yet. At least as far as I've been told. My co-worker disabled the network account and email. He went down to the machine and uploaded to the network any files that were on the C: drive, thereby not being backed up.

We don't have a policy on what to do when a person leaves the company, willfully or not. I've tried. HR doesn't want the extra work.

Later in the afternoon, I figured I would take a look at the ex-employee's computer; looking for deleted files, pictures that shouldn't be, or anything else that shouldn't be on the company computer. So, later in the afternoon, having a few minutes to spare, I head down to the ex-employee's computer; wip out Helix, and start analyzing. I really didn't expect to find anything. I was sidetracked on the way, so I didn't mention to anyone where I was going.

I went to look at IE history, but accidentally hit the button for Nirsoft's Protected Storage Pass View. Well, the Trend Micro client installed on the machine picked it up as "hackerware." A note would be sent to the administrators. About ten minutes later, I there's a knock at the office door, and there standing outside is my co-worker and my boss. I quickly explained what I was doing. They were there because they thought the manager who left had come back and working maliciously on the computer. All was soon well. Important lesson learned, though. Let someone know what you are doing so as not to falsely set off alarms.

Update

There is no update.

My manager told me that they found out who was bringing the laptop in from home and connecting to our network. My manager mentioned that they've "talked" to the individual and are "assured" it will not happen again.

Personally, I think they don't want to discipline/fire a second employee in as many days.

And I think this offense is more egregious.

Sheesh.

My first run in with CP

At 8:30 Monday morning, the Director of HR called me to her office. I thought, "I haven't been in long enough to get in trouble." Little did I know what would be ahead of me. I knew I had a full plate of fires to put out; what was coming would dwarf everything for the day.

I reached her office and was told to shut the door. It seems there was an incident over the weekend. A female employee had logged into a computer and found "pictures inappropriate for work." There was probably more to the story, but I wasn't privy to it. I was asked to prove or disprove the accusation; and, if it was there find out how and when.

I took my laptop and retired to a smaller conference room, I really didn't want to do this from my cube. After shutting the door, I mapped a drive to the suspect machine, surfed to the My Pictures folder. Sure enough, there were pictures there. So, without opening anything, I copied the entire directory to a cdrom. Upon viewing the cdrom I was quickly able to verify that there were images inappropriate for work.

Now for the how and when. The when was pretty easy, as all the dates were the same. Could they be faked? Sure, but I didn't think so in this case. Next, I opened up regedit and connected to the suspect computer's registry. I looked in the currentcontrolset key, and found an iPod and Creative MuVo that were listed. When I found the Dos:E\ key, I pieced together that it appeared that the iPod was last listed as the E:\. However, the dates didn't match up. I knew the only way we would prove definitively is to get a hold of the iPod.

Before I started to write up my findings, the Director of HR met me in the conference room where I was working. My co-worker had just joined me and we were going over some other leads we wanted to chase down. The Director asked to see the pictures, mostly to see if there were other employees visible. Talk about awkward. But, I guess I had better get used to it. The first couple of pictures were definitely something taken from websites. Another bunch could have gone either way. But, while viewing the last couple, the Director asked me how old the girl was. Uh-oh.

So, we next formulated the steps to take. My part was easy, I was going to provide the facts; as best I knew them, and what I suspected, in order to fill in the holes. But, I tried to impress upon her that all the ducks had to be in a row.

After lunch, I got called into my manager's office, to find the President and the Director of HR. They asked for the cdrom. Calls had already been made to the company attorney. My manager asked me and my co-worker to go through mail and see if the pictures had been mailed anywhere; both in the company and out. Well, we found one outgoing mail message that was pretty incriminating. It was to an external address. My co-worker noticed that the email address was familiar. What?

It turns out the email address turned up in the firewall logs where we logged failed connection attempts to IM. Right after the IM failures, there was another email address with failures. So, we looked up the IP that the failures were coming from, and son of a gun if it wasn't something in the DHCP scope. Uh-Oh. A look at the the DHCP server showed a lease to a computer that we didn't name.

We've gone from proving a simple case of inappropriate images on the computer, to using an unapproved computer on our network. A quick scan of the firewall logs showed that this rogue computer had been on and off the network for about a month; usually third shift, and usually on the weekends. The sites they were visiting were typically web sites that allow you to IM when the firewall blocks those ports. We've pretty much proved that someone is trying to deliberately circumvent the access controls.

We had a quick meeting with upper management. We gave our statements and left. While chasing some last leads we see the accused go to HR. Of course he denied it. When pressed, he finally admitted most of what we knew. He tried to give what he thought was a valid explanation; but it wouldn't hold up in the face of the evidence we had.

Sit down now.......they didn't fire him on the spot. They let him go back to work until they had heard from the attorney. My co-worker and I almost fell over. I ran to my cube, and checked my mapped drive...sure enough, all the evidence was just deleted from his machine. (I was't too worried; worse case, we would have undeleted it.) Here's the good part, we set up the My Documents folder to redirect to the network. Should we need to, it's a simple restore.

Fast forward to today. The accused was fired first thing in the morning. I still haven't heard what the attorney has done. I wouldn't be surprised if the company gets subpoenaed for the data so that the authorities can go after him. As for the rogue laptop, my manager supposedly knows who it is, but nothing has been done. (Personally, I think this is a bigger offense, and has more risk. But that's just me.)

I went home wiped out. I hope the company doesn't screw this up, but I'm not holding my breath.

The good news is I got my tix for Bruce's new tour.

You can't make this stuff up...

I don't know what made me look up at the ceiling in the server room. But I couldn't believe what I saw. Knowing the place that I work at....they are active.

If, Not When...

A little while ago, the network sysadmin started thinking more about security. I think the incident with the Storm Worm got him a little worried. He really took to the firewall and started locking it down. One night, I performed a port scan of our firewall from home. I was a little surprised at what came back. One of the open ports was FTP, 21. I suggested we shut down the FTP server. It doesn't get used. Well, it does, but once in a blue moon. We don't allow attachments larger than 10 megs through the firewall. So, if a vendor needs to get us a file, we create a temporary user on the firewall, and let them upload it. The reverse happens when one of our users needs to get a big file to a vendor. Since this happens maybe 5-6 times a year, I suggested we turn off FTP, and start it as needed.
The decision was "no."
The other day, the network admin was scanning the ftp logs. The FTP server is getting attacked brutally. Each log has thousands upon thousands of brute-force login attempts.
I still say we should turn off FTP, but the answer is still "no."

Better Late Than Never

[Given the theme here.....]

BRUCE SPRINGSTEEN'S 'MAGIC'
SET FOR OCTOBER 2 RELEASE ON COLUMBIA RECORDS

'Magic,' Bruce Springsteen's new studio recording and his first with the E Street Band in five years, is set for release by Columbia Records on October 2, 2007. Produced and mixed by Brendan O'Brien, the album features eleven new Springsteen songs and was recorded at Southern Tracks Recording Studio in Atlanta, GA.

'Magic' Song Titles:

1. Radio Nowhere
2. You'll Be Comin' Down
3. Livin' in the Future
4. Your Own Worst Enemy
5. Gypsy Biker
6. Girls in Their Summer Clothes
7. I'll Work for Your Love
8. Magic
9. Last to Die
10. Long Walk Home
11. Devil's Arcade

'Magic' is the first new studio album by Bruce Springsteen and the E Street Band since 2002's GRAMMY Award-winning, multi-platinum, number one album 'The Rising' (Columbia Records), which was also produced by O'Brien.

Bruce Springsteen's longtime manager Jon Landau said, "'Magic' is a high energy rock CD. It's light on its feet, incredibly well played by Bruce and the members of the E Street Band, and, as always, has plenty to say. It's also immensely entertaining. 'Magic' is the third collaboration between Bruce and Brendan O'Brien and is a culmination of their very productive creative relationship."

Firewall log: LDAP.Request.DoS

We keep seeing this in our firewall logs. The packets are going from our DMZ server to our primary domain controller. What I'm not sure is if this is an active attack, or, is there something mis-configured on the DMZ server that triggers a false positive?

====Alert====
From: FortiLog-100A(192.168.1.12)
Trigger Name: Attack Log Warning
Log type: attack log
Alert Severity: High
Triggered Threshold: More than 1 event occured in the last 0.5 hour.
Source Device: Local FortiAnalyzer[Hostname:FortiLog-100A IP: 192.168.1.12]
Last Raw Message:
itime=1187120433 date=2007-08-14 time=15:42:40 devname=Fortigate-200A device_id=FG200A2105401280 log_id=0419070000 type=ips subtype=signature pri=alert vd=root serial=1945370 attack_id=14770 severity=critical src=192.168.9.2 dst=192.168.1.201 src_port=55845 dst_port=389 src_int=dmz1 dst_int=internal status=detected proto=6 service=389/tcp user=N/A group=N/A ref="http://www.fortinet.com/ids/ID14770" msg="operating_system: MS.Windows.Active.Directory.LDAP.Request.DoS

We get quite a few of these. Because of the frequency, I seem to think that they are malicious in nature. The knowledge base says the attack is against a Windows 2000 vulnerability. Our servers are Windows 2003. If anyone has seen this and has any insight, I would love to hear from you.

Updates....

I've updated my links section to add a couple of links. The ISC should be read every day in order to get a good idea of what is current.

Plus, if you don't read Chief's column at "A Day In The Life Of An Information Security Investigator," you should. Absolutely great reading. He's got two great columns up; a picture dump, and a write up of Black Hat and Defcon. I couldn't attend. I wish I could have. Chief's write ups at least let me get a feeling for it.

Pictures From Black Hat and DefCon 2007, 1

Pictures From Black Hat and DefCon 2007, 2

Some Things I've Learned Attending Black Hat & DefCon

Wireless hacking

I'm still learning. I have a long way to go. I was reading another blog on the activities of Black Hat, out in Vegas. This attack was discussed:

http://www.tgdaily.com/content/view/33207/108/

It almost makes me not want to use a laptop with public wireless.