Computer Security I

JOB: Security, IR, Forensics Required Skills: Experience in host forensics, windows/linux internals, vulnerability assessment (more than just running a tool but actually doing analysis of that data or manually gathering vulnerability analysis data via an innovative/custom method) and/or Computer Network Exploitation Performed analysis of host data at rest, forensic analysis of windows, UNIX, or mobile systems, and/or experience with file hashing and fuzzy file hashing Experience with industry standard system tools (Sysinternals suite for example) Performed analysis of code in memory, including analysis of RAM snapshots, Windows crash dump files, and/or UNIX kernel dumps Performed software reverse engineering to include use of code disassemblers (like IDAPro) and debugging unknown code (like Ollydbg) CS background (scripting/programming/development) are required

1+ years in 2 of the following: File Hashing and Fuzzy File Hashing (e.g. ssdeep, fciv, and md5deep) Commercial, open source tools for intrusion detection (e.g., Snort, BroIDS) Packet capture/evaluation (e.g. tcpdump, ethereal/wireshark, NOSEHAIR) Network mapping/discovery (e.g. nmap, TRICKLER) Industry standard system/network tools (e.g. netcat, netstat, traceroute, rpcinfo, nbtscan, snmpwalk, Sysinternals suite)

2+ years in 1 of the following: Development of exploits for Microsoft Windows operation systems Development of exploits for UNIX operating systems Development of exploits for personal computer device/mobile device operating systems (e.g. Andriod, Blackberry, IPhone, and IPad) Software Reverse Engineering to include use of code disassemblers (e.g. IDA Pro) and debugging unknown code (e.g. Ollydbg) Analysis of code in memory, including analysis of RAM snapshots, Windows crash dump files, and/or UNIX kernal dumps Implementing network with IPv6 protocols.

Recent Attacks/Breaches Bad, Bad, Bad

2014 – 40 Million Credit Cards NEW YORK (CNNMoney) The major hack of discount retailer Target that stole credit and debit card data from 40 million accounts was still reverberating several days later.

Target: Hackers stole vendor's credentials in credit card breach This month (January 2014), Target revealed that about 70 million customers were affected in the credit card data heist from its stores at the end of last year, double the previous estimates.

Home Depot Confirms Breach CC #s Already on Auction Home Depot confirms breach but stays mum as to size. Home supply retailer confirms card data stolen, likely starting in April. Could be larger than the Target breach 2013. Ars Technia

Credit Card Market Place Cybercrime Store rescator[dot]cc Lists Home Depot credit cards Lampeduza[dot]la rescator[dot]la kaddafi[dot]hk octavian[dot]sucheapdumps[dot]org cpro[dot]su vor[dot]cc. http://krebsonsecurity.com/2014/09/data-nearly-all-u-s-home-depot-stores-hit/

USIS Breach at US security contractor exposed at least 25,000 workers Summary: USIS, which performs background checks for the Department of Homeland Security, revealed that it was hacked earlier this month. The same company vetted Edward Snowden for the government. Update: Government To Drop Background Check Firm USIS

JPMorgan and Other Banks Struck by Hackers By NICOLE PERLROTH, NYT, AUG. 27, 2014 Photo Outside JPMorgan’s corporate headquarters in New York. The bank was one of at least five that suffered a coordinated cyberattack this month. Credit Andrew Burton/Getty Images

Russian Hackers Amass Over a Billion Internet Passwords Alex Holden of Hold Security said most of the targeted websites were still vulnerable. Credit Darren Hauck for The New York Times - 8/5/2014

Power Grid Attack Lightsout exploit kit

Cyber Intrusion Blamed for Hardware Failure at Water Utility A recent cyber attack on a city water utility in Illinois may have destroyed a pump and appears to be part of a larger intrusion at a U.S. software provider, new information suggests.

Remote Access to SCADA Systems

US power plants 'vulnerable to hacking' Power plants across the US and Canada could overheat, shut down or be caused to malfunction because of vulnerabilities that leave them open to hacking, according to new research. Alex Hern, 10/17/2013 The Guardian

Researchers Uncover Holes That Open Power Stations to Hacking “We found vulnerabilities in virtually all implementations [of the protocol],” Sistrunk said. “Some of them are worse than others.” By Kim Zetter 10.16.13 Wired