Anatomy of an Attack

Anatomy of an Attack
Anatomy of an Attack Understanding the means and motivation of your enemies Johnathan Norman Director of Security Research Alert Logic
Whoami • Director of Security Research @ Alert Logic – Manage investigations – Responsible for “0day” coverage – Vulnerability analysis and discovery • Exploit Developer • 10+ years monitoring networks • Winner of a few CTF’s – Netwars All-Star challenge
Agenda Old & New Enemies Thinking like the attacker Real world example Best Practices
If you know your enemies and know yourself, you will not be imperiled in a hundred battles… - Sun Tzu
The Actors • Hacktivists – Anonymous, LulzSec etc… • Cyber Criminals – Impact 73% of online users1 • Government – Stuxnet anyone? 1 Norton Cyber Crime Report 2010
Traditional Attacks Hacker Profile – Talented individual – Young, bored Motivation – To prove a point – Curiosity – Credibility Attack Methods – Worms targeting memory vulns in network services – Attack payload not usually customized
Modern Attack Profile Hacker Profile – Organized Crime – Dedicated teams who are paid – Teams often work for criminal organizations as a career Motivation – Targeted attack for financial gain – Desire anonymity Attack Methods – Vulnerable web applications – Client side applications – Malware used to keep control
Cybercrime Market The Numbers – Global computer crime market estimated to be $7B in 20102 – Russia responsible for $2.5B – Growing ~35% per year overall Interesting Trends – Increase of specialization of participants – On-Demand and Pay-Per-Use services – Developing C2C market 2Group-IB Report - 2010
Roles Role Description Malware Developers Develop kits to control owned systems and steal data Rootkit Developers Develop advanced software to hide presence of malware Traditional Hackers Search for vulns, write and sell exploits to pack vendors Distributors Find ways to install malware kits on as many victims as possible Hosting Providers Hosting with few restrictions Misc Tools Developers Executable packers and obfuscators Organization Leaders Assemble teams and influence PPI prices per country
Crime Pays Stolen Assets/Criminal Activity Payout Credit Card Details $5-10, expected $1-2 post PSN Bank Credentials $80-$700 Bank Transfers 10% to 40% of amount transferred Social Security Numbers $30-50 0Day Exploits $5000 - $100,000 Exploits for published vulnerabilities $5000 – $50,000 Exploit Packs $200 – $5,000 Malware Pay-Per-Install Up to $1.50 for US victims, $0.15-0.60 for other countries
Hacking 101 • The 3 Questions – What do I have – What do I know – What is my target? • The Process – Reconnaissance – Discovery – Mapping – Exploit
The World is Yours My Skills – P2P networking – Defacing websites The Plan – Get paid distributing malware
How it Works – The Business Model Register With Cybercrime Group 2 Data Sold Wholesale 5 BLACK MARKET Purchase Malware Pack CYBERCRIME GROUP 1 6 Payment Made 4 Infected Users Send Data to Group DISTRIBUTOR Infect Users, P2P 3 seeding, XSS VICTIMS
What do I get? Malware likely based on TDSS – First widely used x64 rootkit for Windows Vista and Windows 7 – Kernel mode rootkit – Modified binaries generated on-demand to avoid AV detection Choosing an Affiliate – Pay-Per-Install model – Reputation – Claim up to US $7000 per day – Phone support provided with personal account manager
The Final Touches Binary Modification Tool Anti-Virus Bypass
Delivery/Attack Surface Infection Method Difficulty Effectiveness Websites Easy Good P2P Networks Easy Medium SPAM Easy Medium Paid Ads Medium Medium Phishing Easy Poor Traditional Network Exploit Difficult Poor Blackhat SEO Medium Medium Cross Site Scripting ‐ Most sites are vulnerable ‐ Easy to find and users trust the websites SQL Injection ‐ Easy to find ‐ Very common Source: Veracode State of Software Security Report, April 2011
Open SMB shares/ Weak Passwords Web App Vulnerability Netbios Open RDP Spear phishing
Limit Your Exposure Lifecycle of a Threat Risk Patch is Released RISK = Vulnerabilities x Assets x Threats Risk Reduction Framework OBJECTIVE -> REDUCE RISK # of Vulnerable Limit Exposure Assets Policy Review Patch Management Vulnerability Scanning Monitor Be Aware of Known Vulnerabilities Risk Threshold Daily IDS/Log Data Review Know your network! Educate Users Awareness Training Time Management Focus on Security Exploit is Public Vulnerability Automated Passé Discovered Exploit
Tools or Expert Help?
Remember the Questions… • 3 Questions – What do I have – What do I know – What is my target? • Penetration testing helps
Defending Users AV Isn’t Enough – Malware evolves ahead of AV signatures – 60% of malware is undetected by AV Education – At least half of the executables on P2P network infected – Don’t install software from untrusted sources – Safe browsing – Flash drives
Key Takeaways 0day is rarely the average users weak point Tools are not always the solution Focus on your attack surface, not the latest news Antivirus will not save you! educate users
Next Generation Mobile Devices – Full blown operating systems with IP stacks – Security posture like OS’s in the 90’s – High-speed 4G Internet connectivity – get owned faster! – Malware in Android market (50+ apps) – Users connect to the office wifi
Q&A jnorman@alertlogic.com @spoofyroot http://www.alertlogic.com/blog

Check these out next

Anatomy of an Attack

Recomendados

Más contenido relacionado

Presentaciones para ti(19)

Destacado(20)

Similar a Anatomy of an Attack(20)

Último(20)

Anatomy of an Attack

Hinweis der Redaktion