• bytemut - randomly change a percentage of bytes per seed file
• bitmut - randomly change a percentage of bits per seed file
• swap - swap adjacent bytes in a seed file
• wave - change every byte index from 0x00 through 0xFF

These strategies are similar to those used in other dumb fuzzers such as zzuf and fuzz. Because these mutators work at a binary level, they work best against binary file formats. Copy, an additional "strategy," doesn't actually fuzz the seed file, but can be useful for testing a new config or triaging known crashing test cases.

Crash Detection

FOE provides two methods for detecting crashes, using the Console Debugger (cdb), or hooking the user mode exception dispatcher, KiUserExceptionDispatcher. In our experience, using the hook can be slightly faster for the non-crashing test case and provides a minimally invasive environment for the target application. Please note that the hook has only been tested with 32-bit Windows XP and Windows Server 2003. Depending on your platform, the installer should automatically provide an appropriate config file. FOE can optionally save "heisenbug" crashes that occur when using the hook, but do not occur when the debugger is attached.

Post-crash

FOE uses the !exploitable debugging extension to perform crash uniqueness determination and preliminary crash triage. Optionally, the crashing test case can be minimized to the smallest difference from the original seed file, similar to BFF. Output for a campaign is collected in a single output directory tree.

Installation

Because fuzzing can fill temporary directories and put the target application in an unusable state, we recommend that FOE be used in a virtual machine. To install, simply unzip and run the Windows installer, which can also download the required dependencies. An .iso image with included dependencies is available for offline, virtual machine installation.

Quick Start

1. Place seed files in the FOE seedfiles directory
2. Modify the cmdline and runid options in configs\foe.cfg. Depending on how quickly the target application consumes the input file, you may need to increase the runner and debugger runtimeout values.
3. Run "foe.py configs\foe.cfg"

Many options can be specified in the configuration file. See the included README and configs\examples for more information. For those who would like to see FOE in action, Jared Allar has created a quick demonstration video. FOE can be downloaded here.

Feedback

If you have any comments or feedback, please email us.

The CERT® Insider Threat Center database currently contains over 550 cases of actual malicious insider crimes. We focused on the 123 cases categorized as IT sabotage in the development of this control. Insider IT Sabotage is defined as an insider’s use of information technology to direct specific harm at an organization or an individual.  The cases in our database reveal that almost all insiders involved in acts of IT Sabotage displayed behavioral indicators prior to committing their crimes.  Examples of such behavioral indicators include but are not limited to: conflicts with co-workers or supervisors, improper use of organization information assets, rule violations and/or security violations.  These indicators may be used to determine which users warrant targeted monitoring via this signature. Once individuals are identified, you should be able to determine the appropriate user names, account names, host names, and/or host addresses to enter into the signature to make the alert volume more meaningful and manageable.

Prior to applying this signature, you should facilitate proper communication and coordination between relevant departments across the enterprise, especially information technology, information security, human resources, physical security, and legal. This cooperation is necessary to ensure that any measures taken to combat insider threat comply with all organizational, local, and national laws and regulations.

Technical signatures developed by the CERT Insider Threat Center are generally designed to be applied towards a particular user or group of users. These signatures are not intended to be applied to all users across the enterprise, as doing so will generate a large number of false positives.
 

Leigh and I have found that CNAME flux is also in practice to some degree. By using a source of passive public DNS resolutions we have found domains that change their CNAME destination multiple times a day. We consider a domain to be exhibiting flux if it changes destination 8 or more times in one day. For example, the following records of a domain exhibiting CNAME flux were observed on October 2, 2011.

 The CNAME here seems to be balancing the load on a particular service by redirecting users to the more available servers, given the naming scheme and short time to live (TTL) of 10 seconds. However, like CDNs, if benign actors gain benefit from a tactic then malicious actors are likely to be able to use the same tactic to their ends.

So far, the domains using CNAME flux amount to a small percentage of the CNAME records observed. There are around 16M domains in our data source that use CNAME records each day, and only 15-200 of those domains exhibit CNAME flux. We measured the incidence of CNAME flux between October 1 and November 30, 2011. The results are presented in this chart.

We can’t say whether or not the practice will become more widespread. But CNAME flux is yet another creative use of one of the few ubiquitous Internet protocols, and creative protocol use tends to cause headaches for security folks.

It should be noted that our database contains one instance in which a copier, FAX, and printer were all used in the same attack. More on that later.

Technology in the workplace enables employees to efficiently do their jobs and accomplish the mission of the organization. It is often these technologies that also enable malicious insiders to cause harm to the organization. Management, Information Security, and Information Technology support teams must work to secure both the physical and virtual environments. This typically entails implementing physical protections for servers, workstations, and mobile devices while Access Control Lists (ACLs) restrict access to data. Often times other devices are overlooked and left with little to no protection.

These devices should be included in organizational risk assessments:

• printers
• scanners
• FAX machines
• copiers

Printers can allow a malicious insider to extract sensitive company documents and remove the documents from the organization to share with competitors or even start their own business.

• In one case, the insider was a disgruntled scientist at a technology component manufacturer. The insider exfiltrated research documents using his access privileges. He downloaded the documents onto his laptop, sent them to his email account, and physically carried the document printouts out of the workplace. He also mailed some of the research documents to the component manufacturer's competitors. The total losses were estimated to be about $3 million. The insider was sentenced to five years probation, fined over $7000, and ordered to perform 200 hours of community service.

• In another case, the insider worked with a conspirator to sell physical blueprints and trade secrets to a competitor organization. Although potential losses were estimated to be between $50 million and $100 million, the victim organization was able to prevent the information from being used by the competitor. The insider was sentenced to prison and fined $20,000.

Organizations should carefully monitor printer activity and retain logs of printed documents. These logs should be audited as part of an organization’s continuous log monitoring program. Personnel should be alerted when anomalies occur, such as printing before or after business hours or printing an unusually high number of documents for that particular user.

Companies must also ensure that hardcopy documents are properly disposed of when they are no longer needed. Documents containing proprietary information must be destroyed by those who are authorized to do so. Organizations should consider who has access to hardcopy documents during the document’s lifecycle. The CERT database has cases where janitors took documents containing personally identifiable information (PII) or other sensitive information from the organization. If the documents had been properly managed and disposed of, the risk of malicious insider activity may have decreased.

Scanners also pose a threat to organizations. Documents that are not in digital form or are not accessible in electronic form due to access restrictions can be scanned by a user who has authorized access to a scanner.

• In one case, an insider was contracted by a telecommunications company to scan physical trade secret documents into digital form. After scanning the documents, the insider stole some of the electronic files and posted them on a hacking website. The total potential damages were estimated to be $25 million while the insider was ordered to repay over $145,000 in restitution.

• An insider was employed by a document imaging company. The imaging company was a trusted business partner of a university. The insider stole 1,700 student transcripts containing the students' PII while digitally archiving them for the university. The insider was never identified, and the monetary impact of the incident was never fully understood.

Companies need to provide commensurate levels of protection to printed documents as they do for digital files. People receiving printouts must have a valid need to know and permission to have access to these hard copies. In the above cases, trusted business partners had access to physical documents to perform a contractual obligation. Contracts with trusted business partners need to stipulate the need for thorough background investigations. In addition, if company sensitive documents are being scanned, a company representative should monitor the process to ensure that the contractor is not mishandling company information.

FAX machines are an older technology that continues to exist in many organizations. These devices can be used by an insider to send documents out of the organization, often without being detected. .

• Insiders were employed by a financial institution and used the institution's computer systems to access PII of 68 customers, including the customers' credit card numbers. They then faxed this information outside of their organization to their accomplices. In total, almost $600,000 was stolen through the fraudulent activity. The insider was sentenced to over one year imprisonment, two years of supervised release, participate in a drug/alcohol program and repay over $99,500 in restitution.

• In another case the insider was a disgruntled engineer for a product manufacturing company. Fearing his job was in jeopardy, he sent technical drawings to a competitor organization via fax and email. The damage to the victim organization was estimated to be roughly $1.5 million. The insider was sentenced to over two years in prison and ordered to repay $1.3 million in restitution.

In the above examples, the insiders were able to FAX documents to accomplices or competitors. One solution to reduce this threat is to limit access to FAX machines whereby employees in the organization must submit their documents to another individual to review and transmit.

Copiers allow insiders to duplicate company documents without the worry of having to remove original documents from the organization, which could lead to faster detection.

• The insider was employed as a mail room supervisor by the victim organization, which was a financial institution. While on site and during work hours, the insider opened the organization’s mail and copied checks that customers had sent in for deposits. The insider sold the copies to an identity theft group, which used the valid account numbers to make fraudulent checks. The insider was arrested, but information regarding the monetary impact was unknown.

Access to copiers needs to be limited when company sensitive information is at stake. In the above example, the insider was able to copy customer checks for identity theft purposes. The insider’s activities should have raised red flags when opened mail was delivered.

Finally, the malicious insider who used all of the methods that we have been discussing, worked as an administrative assistant to a top executive at the victim organization. As part of her job responsibilities, she had access to confidential trade secrets and other proprietary information. She was caught making copies of confidential documents and leaving with them from her workplace and attempting to sell them for money. She handed over some of the copies to buyers, as well as faxed some. The insider also printed out some of the executive's emails which contained confidential project information. The only monetary impact reported was $40,000 restitution ordered to be paid by the insider.

These cases highlight the need for organizations to be more vigilant about all technologies used in the organization. Scanners, copiers, printers, and FAX machines all have a place in an organization. However, incorporating them into enterprise risk assessments as well as polices that govern their use will help to identify and mitigate risks associated with their use.

Our team would like to hear what you are doing to counter this threat. If you have any questions or comments please email us using the feedback link.

The table below identifies types of assets that were attacked in a sample of 50 cases from our 85 total theft of IP cases.

It is clear that trade secrets and internal business information are the most frequently attacked assets. Included in the trade secret and internal business categories, we see assets such as future product designs, customer/price lists, and internal policies not intended for public consumption. These results might seem surprising, especially the relatively low number of customer information items stolen. Personal information such as social security numbers or health records is generally considered to be personally identifiable information (PII) rather than intellectual property. Theft of PII is classified as insider fraud in our database and is thus out of scope for this analysis.

We also found that in more than half of the theft of IP cases we analyzed, use (or misuse) of the network was the primary method of exfiltration. In 32 cases where the network was the primary vehicle for getting the data out of the organization, approximately 50% involved insiders using their corporate email accounts to send data off to personal email accounts, competitors, and foreign governments. Organizations should strongly consider reviewing the monitoring capabilities they use with respect to email, particularly those being sent to suspect recipients. Conversely, the least utilized network channels involved more technically complex crimes, such as setting up covert channels over ssh or other improperly blocked/filtered channels outside the network to move data off of internal servers.

Our study indicated that the most common method of physical exfiltration of data was removable media. Prior to 2005, the most common removable medium was writable CD. However, recent incidents indicate that removable USB mass storage devices like thumb drives and external hard disks are now more popular. USB devices have a much greater storage capacity than CDs, which makes it easier for insider to move their entire desired data set at once.

What can organizations do about these problems? First, they can always consider the role of best practices and established standards in defending against insider attacks. Insider attacks frequently exploit policies or controls that are covered in accepted best practices for IT system security. Second, organizations should always consider more than just the technical aspects of the crime. In a recent report Deriving Candidate Technical Controls and Indicators of Insider Attack from Socio-Technical Models and Data, we examined the importance of creating technical indicators for behavioral actions so that we can gain a more complete understanding of how to defend against insider crimes. Organizations should pay specific attention to these technical vulnerabilities while they attempt to understand what controls are practical to put in place for removable media in the organization. If removable media is necessary to keep operations moving, an organization may want to establish technical measures to limit which machines allow use of removable media, take an inventory of authorized media, and implement some measure of physical security to prevent removal or introduction of new uninventoried devices from the facility. When considering network security, organization should attempt to identify suspicious email communications (particularly with attachments) to direct competitors, foreign governments, or other illegitimate recipients of corporate mail. Organizations should consider using a log aggregation and indexing tool to look for patterns in behavior that might warrant further investigation. This is especially true during major organizational events that may cause stress among employees, such as mergers, downsizing, acquisitions, or reorganizations. These events could possibly influence employee behavior in a negative way, and a heightened awareness of security might be necessary.

If you have questions, comments, or cases to share, please contact us using the feedback link. We are interested in hearing more about what your organization has done about these problems and how well the approaches have worked. Operational feedback helps direct our work, so your contributions and feedback are valuable. All responses will remain confidential, and no data that you share will ever be released or included in future reports.

Hi, this is Chris King. From our research, we realized that malicious insiders do not all fit into a single category. We found that there are individuals who steal or commit fraud for financial gain, others who steal intellectual property because of a sense of entitlement or to obtain a position with a competitor, and some who want to exact revenge against an organization because they are angry. We noticed a pattern in the ways insiders acted and were able to separate them into three main categories of crime: IT sabotage, theft of intellectual property (IP), and fraud. This update focuses on theft of IP.

• A technical service representative at a medical equipment company sought a job with a competing organization. The insider complied with her recruiter's request to send her current employer's customer lists, lab results, and manufacturing processes through email, postal mail, and commercial carriers in exchange for the new position.
• The founder of a company that held a patent for a specific technology began to work for a software development company that used that technology. Over the course of 3 years, the insider accessed confidential business documents that were directly related to the patent infringement litigation that his company was preparing to initiate. He downloaded the documents to his laptop and then quit his job at the software development company. His company then filed a patent infringement lawsuit against the software development company.
• A chemist at a paint manufacturer went on a business trip to work with one of the paint manufacturer's foreign subsidiaries. During the trip, the insider negotiated employment with one of the paint manufacturer's competitors and then resigned from his job. When representatives from the paint manufacturer analyzed the insider's laptop, they discovered 44GB of trade secret information. The insider was arrested when he attempted to leave the country. At the time of his arrest, he had a USB drive that contained the trade secret information.

In an analysis of theft of IP incidents, we discovered there are primarily two types of individuals who steal IP - the "entitled independent" and the "ambitious leader." The entitled independent is an insider who mainly acts alone to steal IP from an organization to take to a new job or side business. These insiders believe that they own the information they worked on during their employment, and they believe that they are entitled to the IP they created. The ambitious leader is an insider who recruits other insiders to help steal information for a larger purpose. The theft of IP in these cases is either to start a new business, to work with a competing organization, or to sell the information to a competing organization. For more information on how we developed these two models, see A Preliminary Model of Insider Theft of Intellectual Property.

Although only 12% of the cases in the CERT^® insider threat database can be defined as theft of IP, this is one of the most damaging types of insider attacks. Of our cases, the average potential damages for this type of incident were $29M-$42M, with some of the trade secrets valued at $1B in R&D costs. In these cases, 52% of insiders stole trade secret information, 30% stole sensitive internal documents (billing, customer lists, etc), and 20% targeted source code.

Even though these high-value assets are protected, it is the trusted insiders who are working on these products that often steal them. The insiders' authorized access to the system or designs they work on complicates efforts to protect an organization's IP.

We have developed some countermeasures for this type of crime. For more technical detail, see An Analysis of Technical Observations in Insider Theft of Intellectual Property Cases. For more general information, see the Common Sense Guide to Prevention and Detection of Insider Threats. A few technical preventative measures are presented here:

• Many theft of IP cases in our database involved the use of removable media. Organizations should consider having some metric of employee use of removable media. Understanding who requires removable media and for what purposes can help an organization determine what may constitute normal and healthy business use.
• Of the cases in which an organization's network was used to perpetrate the theft, most involved email and remote access over VPN. Given that several cases included sending email to a direct competitor, organizations should consider either tracking or blocking email to and from competitors. Our cases did not explicitly show insiders using sophisticated concealment methods, such as proxies. However, we did find that insiders periodically leverage their personal, web-based email as an exfiltration method.
• According to our theft of IP models, most insiders steal IP within 30 days of leaving an organization. Organizations should consider a more targeted monitoring strategy for users who have already given notice that they will be leaving. Further, organizations should consider inspecting available log traffic for any indicators of suspicious access, large file transfers, suspicious email traffic, after-hours access, or use of removable media. Central logging appliances and event correlation engines may help craft automated queries that reduce an analyst's workload for routinely inspecting this data.
• Organizations should consider reviewing access termination policies associated with employee exit procedures. Several cases in our database provided evidence that insiders remotely accessed systems by using previously authorized accounts that were not terminated upon the employee's exit. Precautions against this kind of incident would seem to be common sense, but this trend continues to manifest in newly cataloged cases.
• As part of an employee's exit interview, organizations should consider reminding the employee of the contents of the intellectual property agreements that they signed, and even consider asking them to sign a statement saying that they have not taken any intellectual property with them.

Also consider using the security guidance published by NIST.