RSA 2016 teaser

1. Introduction Case studies Landscape of Attacks
What lurks in your cloud: studying breaches
in virtualised infrastructure
Who? Seth Chromick
From? Affilations: vArmour Networks
When? 2016, RSA

2. Introduction Case studies Landscape of Attacks
Introduction
This session covers a number of case studies of network
breaches in virtualized environments, detailing actors,
methods and techniques.

3. Introduction Case studies Landscape of Attacks
about us
whoami Having over 10 years of information security experience,
spending over 5 years as a part of red team, assisting
customers with incident response and forensics as a part of
security consulting, building virtualized network defence
systems for past two years

4. Introduction Case studies Landscape of Attacks
outline
From Nation State compromises to criminal enterprises
exfiltrating your your data: we’ve seen a growing number of
these. In this session we walk through several case studies of
network compromises in virtualised environment, understand
the common mistakes made by network administrators in
cloud platforms, analyse creative ways of attackers figuring
out ways to abuse these problems, study their tactics,
techniques; learn how to understand their motivation and lead
to conduct attribution.

5. Introduction Case studies Landscape of Attacks
History apt vs crime tactics
APT and crime techniques are coverging. Several talks were
given on this subject (good paper by Gabor Szappanos,
"Exploit this: Evaluating the Exploit skills of Malware
groups").
APT teams deploy Drive by Downloads in targetted attacks in
wateringhole-related activities.
crime teams utilize spear-phish to distribute content (dridex,
tinba and the likes)

6. Introduction Case studies Landscape of Attacks
Old cases
Some of these cases cover identified activities from 2011 to
2015
2011 exploit kits are sold as software. Content served with no
restrictions
2012 SaS model emerges. Serve-one-per-IP techniques seen ih the
wild. Use of cookies to control distribution
2013 Human vs. bot detection emerges. (human interraction,
mouse-move, close-popus, anti-sandbox automation
techniques, proxy detection)
mass legit domain abuse becomes common.
2014-2015 switch roles. (TDS systems became less popular for
country-specific distribution, mass mailings/spam/phish is
getting more common for content distribution).

7. Introduction Case studies Landscape of Attacks
Some of historical activities

8. Introduction Case studies Landscape of Attacks
historical activities(2)

9. Introduction Case studies Landscape of Attacks
historical activities

10. Introduction Case studies Landscape of Attacks
historical activities (tricky case from 2013)

11. Introduction Case studies Landscape of Attacks
historical activities (tricky case from 2013)

12. Introduction Case studies Landscape of Attacks
historical activities (tricky case from 2013)

13. Introduction Case studies Landscape of Attacks
historical activities (tricky case from 2013)
Over 500 compromised domains was collected in 24 hours
Domain rotation every couple minutes

14. Introduction Case studies Landscape of Attacks
historical activities (404 detected)

15. Introduction Case studies Landscape of Attacks
historical activities (proxy detected)

16. Introduction Case studies Landscape of Attacks
historical activities (URL based conig
exfiltration)

17. Introduction Case studies Landscape of Attacks
historical activities (cookie based
monetization scheme update)

18. Introduction Case studies Landscape of Attacks
historical activities (FTP password based
exfiltration)

19. Introduction Case studies Landscape of Attacks
historical activities (tricky IP format)

20. Introduction Case studies Landscape of Attacks
historical activities (no action without
interaction)

21. Introduction Case studies Landscape of Attacks
historical activities

22. Introduction Case studies Landscape of Attacks
Digging deep
case study This case study covers a set of interesting activities observed
in Central Asian region and ties to geo-political situation in
the area.
and briefly shares our approach to incident attribution :p
also .. Why you shouldn’t be running government sites on
php cms platforms ;-)
also challenges - getting data is hard. it gets harder when you
work with government clerks :)

23. Introduction Case studies Landscape of Attacks
Landscape of Attacks in Asian Region
Government
Websites: easy
targets
cut here -