Incident Response Coordination on a Global Scale: Your Assistance is Requested...Return to TOC
No ratings
Presented at FIRST 2014 by
During autumn of 2013, CERT-FI got a call from the police. Finnish and American law enforcement officials had been investigating a group of hackers with links to Finland. The investigators had gotten hold of large amounts of stolen user credentials and material indicating thousands of backdoored servers all over the world. The police requested that CERT-FI would take care of contacting the victims. Why not, we thought. This is what we do every day. Turns out, there was lots of material. An awful lot of it. CERT-FI duty officers have already been handling the material for months and have notified thousands of sysadmins during the process. It looks there is still some months worth of work ahead even if the police didn't uncover any new material. This clearly was more than we had prepared for. Probably more than most CSIRTs in the world would have prepared themselves for. Originally, the case seemed like no-brainer. A systems administrator of a US based web site reported an intrusion to CERT-FI, as there were signs indicating a Finnish actor behind the case. CERT-FI checked the facts, passed the material forward, pulled some strings in Finland and pretty much put the case to a rest. In the meanwhile, the incident report lead to criminal investigation, investigation lead to a potential suspect, the suspect got arrested, the police lead a successful interrogation and hit a jackpot upon the seizure of perpetrators' computers. Couple of weeks later, the case returned on CERT-FI's desk, this time bigger than any case we had ever handled. The presentation will focus on incident response coordination on a global scale. We will discuss the following stages of this particular incident: 1) Initial discovery: most incidents still go unnoticed; this time, one vigilant sysadmin got lucky 2) "Pass the Torch, part I": the vigilant sysadmin reported an - what was believed at the time - isolated case to CERT-FI 3) Domestic LE process: good old-fascioned police investigation 4) International LE process: the hacker group begins to unfold 5) "Pass the Torch, part II": CERT-FI contacted national CSIRTs all over the world (still ongoing) 6) "Pass the Torch, part III": The reports were being passed to the sysadmins (still ongoing) 7) Follow up: (we haven't even gotten to that yet) An incident of this magnitude requires active local and national level CSIRT cooperation. Unless the actual victims are notified their systems will never be cleaned. In our presentation we will discuss our understanding of the roles of various parties. We will outline the challenges we faced while reaching the countries that still lack an established national CSIRT (kudos to FIRST community for helping us out!). What would we do differently next time? What would our advice to be to other CSIRTs? When do we consider this particular case closed? We will also present our experiences about handling the media relations. In domestic settings, we utilised the mainstream media to get a word across. After the story picked up, we almost got run over by the media.