Upload File

apt - hunting 0day malware

44
APT: Hunting ÖDay Malware Mustafa Qasim

Upload: mustafa-qasim

Post on 09-Jun-2015

636 views

Category:

Technology


2 download

Report

Tags:

DESCRIPTION

Presentation slides of my talk at Cyber Secure Pakistan 2013.

TRANSCRIPT

Page 1: APT - Hunting 0Day Malware

APT: Hunting ÖDay Malware

Mustafa Qasim

Page 2: APT - Hunting 0Day Malware

Since this presentation started

of organizations will have some malware event successfully evade their IT defenses.

Page 3: APT - Hunting 0Day Malware

On average, malware events occur at a single organization once every

3 MIN

UT

ES

Page 4: APT - Hunting 0Day Malware

Introduction

Page 5: APT - Hunting 0Day Malware

Once upon a time...

Page 6: APT - Hunting 0Day Malware
Page 7: APT - Hunting 0Day Malware
Page 8: APT - Hunting 0Day Malware

According to IDC, between 2003 and 2011, total IT security spend grew from $12 billion to $28 billion.

$12 Billion2003

$28 Billion2011

Page 9: APT - Hunting 0Day Malware

reActive

Vs

proActive

Page 10: APT - Hunting 0Day Malware
Page 11: APT - Hunting 0Day Malware

Fear of False Positive!

Page 12: APT - Hunting 0Day Malware

So called Defenders!

Page 13: APT - Hunting 0Day Malware

Firewalls

- Yes/No

- NexGen Firewall Buzz

- Latency Impact

Page 14: APT - Hunting 0Day Malware

IPS

- Traffic Signatures

- 0Day Prevention Buzz (Exploit > Vulnerability)

- Network Services vs. Client Side Attacks

Page 15: APT - Hunting 0Day Malware

Web Gateways

Called: Defense In-depth

In Actual: Iteration

Page 16: APT - Hunting 0Day Malware

Anti-Virus (L0L)

- Signatures

- Heuristics

- Sandbox

Page 17: APT - Hunting 0Day Malware

Anti-Virus (L0L)

- VIP entry via signed binary– Flame by Microsoft ;-)

Page 18: APT - Hunting 0Day Malware

Signatures

- Binary / Traffic

- Morphing, Obfuscation, Encryption

Page 19: APT - Hunting 0Day Malware

Heuristics Dilemma

Page 20: APT - Hunting 0Day Malware

Heuristics Dilemma

Page 21: APT - Hunting 0Day Malware

Isn't Sandbox made up of sand?

Page 22: APT - Hunting 0Day Malware
Page 23: APT - Hunting 0Day Malware
Page 24: APT - Hunting 0Day Malware

Disheartened by Backward Looking Defenders?

Page 25: APT - Hunting 0Day Malware

The highest technique is to have no technique.

My technique is a result of your technique; my movement is a result of your movement.

Page 26: APT - Hunting 0Day Malware

APT Malware vs. Traditional

Page 27: APT - Hunting 0Day Malware

APT Attack Life Cycle

Page 28: APT - Hunting 0Day Malware
Page 29: APT - Hunting 0Day Malware

Stage 1

Intrusion through exploitation

- Remote Exploit / Local Exploit

- Social Engineering

Page 30: APT - Hunting 0Day Malware

Stage 2

Malware is dropped

- Single Click

- 64base Encrypted Hidden Link

- Java revoke list check disabled

- Legacy vs Advanced

* pdf not exe

* DLL search order hijacking

Page 31: APT - Hunting 0Day Malware

Stage 3

Phones Home

- RAT

- Outbound Encrypted Connection

- Proxy CnC for a network

Page 32: APT - Hunting 0Day Malware

Stage 4

Spreads laterally

- Not always hits target

- Clear entry point

Page 33: APT - Hunting 0Day Malware

Stage 5

Data extraction

- Small Chunks

- Staged Host

- Encrypted RAR

Page 34: APT - Hunting 0Day Malware

Case Studies

- RSA breach

- Operation Aurora

Page 35: APT - Hunting 0Day Malware

Forensics & Challenges

- Behavior

- Code

* Packed

* Obfuscated

* Anti Debugger

* Anti VM

* Time

Page 36: APT - Hunting 0Day Malware

NGTP

- Signature less

- Protection not Detection

- Virtual Execution Engine

Page 37: APT - Hunting 0Day Malware

Pakistan Cyber Space

Page 38: APT - Hunting 0Day Malware

First things FIRST!

Page 39: APT - Hunting 0Day Malware

“ If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.”

— Sun Tzu, The Art of War

Page 40: APT - Hunting 0Day Malware

Honeynet Pakistan

- 6 Deployments

- Avg. 400 malware per day

- Around 100 Unique

Page 41: APT - Hunting 0Day Malware
Page 42: APT - Hunting 0Day Malware

ISPs

FinancialInstitutions

NADRA

Government Organizations

Page 43: APT - Hunting 0Day Malware

Honeytoken Snort Rule

alert ip any any -> any any (msg:"Alert! Token c86"; content:"r71p@g3r";)

Page 44: APT - Hunting 0Day Malware

Catch Me

Twitter: mustafaqasim

Freenode: mustu @ #offsec


BBVA Financial Results & Digital Transformation€¦ · Digital disruption Fraud RATIONALE • Workplace environment as a common target of attacks • Malware / APT taking advantage

Embryo development Day 0Day 1Day 2Day 3Day 5Day 6Day 4

Reversing and Decrypting the Communications of APT Malware (Etumbot)

Malware - UCR Computer Science and Engineeringcsong/cs255/l/malware.pdfTwo types of malware • Two types of malware • Targeted (a .k.a. advanced persistent threat, APT ), state-driven,

A Simpler Way of Finding 0day - Black Hat Briefings

Embrace 0day

Some things about recent Internet IoT/ICS attacks - a ...Enterprise Zone 0day, APT, Ransomware, Botnet, Phishing Mail and so on. • In general, the bad guys need to penetrate the

Politia Romana · sergiu-cÄlin rezultat apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt apt aurel stefan loan petri;or sebastian nicolae alin

Two Level Defense for APT attack (Malware) & Ransomware ...mindclick.co.th/koreathailand2017/attachment/Docs/NPCore/2017_Z… · - Includes social engineering techniques to try various

How Targeted APT and Advanced Malware Attacks Evade Anti-virus Software

MOBILE MALWARE AND APT ESPIONAGE - BlackBerry · 2019-12-20 · MOBILE MALWARE AND APT ESPIONAGE A VIRULENT THREAT Vietnam’s OCEANLOTUS has been conducting mobile malware operations

How does a 0day work? - DefCamp 2012

Next-Generation-Firewall – Wirksamer Schutz gegen Malware ...files.messe.de/abstracts/69537_HADI13_20Blank.pdf · Advanced Persistent Threats (APT) ıEine zielgerichtete Attacke,

From 0 to 0day on Sybian

Detection of APT Malware through External and … of APT Malware through External and Internal Network Tra c ... ’Detection of APT Malware through External and ... 1.3.1 Detection

Symantec White Paper - Symantec Endpoint Suite Product Guidei.crn.com/custom/Symantec-Endpoint-Suite-Solution-Brief.pdf · Symantec Endpoint Protection--Protect against APT malware

Solid IT Networks DIR-TSO-4296 Fortinet, March 2020 ... · FortiADC E-Series VM, Virtual Load Balancer/ADC for VMware ESXi $ 4,134.25 FAI-3500F; FortiAI-3500F appliance for 0day/Malware

A Simpler Way of Finding 0day

Reversing the Inception APT malware | Blue Coat...Finally we can see it’s connecting to webdav.cloudme.com and cleartext credentials in following screenshot. Malware tries to communicate

Palestra - Confraria 0day 2015 - Domínios *.gov.br, a cruel realidade

COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced malware and advanced persistent threats (APT) are frequently used as terms to describe malicious code that bypasses traditional

Palestra - Confraria 0day 2015 - Fatos e mitos sobre desenvolvimento seguro

Zararlı Yazılım Analizinde Güncel Problemleraselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/EnginKirda.pdf · Actors / APT Advanced Persistent Threats != malware! ... •Makine

Craig Searle BAE Systems Detica: APT – Myths & malware

A Simpler Way of Finding 0day - Exploit Database · A Simpler Way of Finding 0day . Robert Graham . David Maynor . Errata Security . Abstract: Instead of reverse engineering vulnerabilities

Ataki APT na instytucje rządowe na przykładzie grup APT 28 i APT …forumti.pl/22Forum/prezentacje/T.Pietrzyk.pdf · 2016-10-13 · Kilka dni temu pisališmy tugaj, Že znany malware

PowerPoint Presentationreslife.cofc.edu/halls/warren/Warren - All floors.pdf · apt. 316 apt. 3 apt. 317 1 warren apt. apt. 315 street - third apt. 312 apt. 313 floor plan apt. 311

GUÍA PRÁCTICA PARA COMBATIR EL MALWARE AVANZADO€¦ · diferente las Amenazas Persistentes Avanzadas (APT, por sus siglas en inglés). El malware moderno utiliza técnicas avanzadas

Malware Analysis Report: Dark Caracal APT The Pallas · PDF fileCSE CyberSec Enterprise SPA Via G.B. Martini 6, Rome, Italy Email: info@ Website: ZLAB Malware Analysis Report:

Project Zero- Making 0day hard(er) by Chris Evans

DATA SHEET FortiAI - BOLL · VBA, ELF, HWP (Hancom), 32 & 64bits PE files including DLLs, MSOFFICE, DEX, PHP, XML, POWERSHELL, Archive ... FortiAI-3500F appliance for 0day/Malware

SECURITY REIMAGINED - Digital News Asia · 2015-11-18 · The Most Prevalent Malware in Southeast Asia 5 Southeast Asia’s Leading Industries Attracting APT Malware 6 Regional Case

HTTP-Based APT Malware Infection Detection Using URL

Detecting APT Malware Infections Based on …...G. Zhao et al.: Detecting APT Malware Infections Based on Malicious DNS and Traffic Analysis the C&C servers, it helps the attacker

SAINT: Mapping the Cybercrime · 2018-04-20 · #hacking #spam #osint #deepweb #darkmarket #vulnerability #0day #apt #rat #bot #c&c #zombiepc #exploit #carders #phising #ddos #stressers