Upload File

exploits - from zero day to ongoing threat

22

Upload: g-data-software

Post on 18-Feb-2017

252 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: Exploits - from zero day to ongoing threat
Page 2: Exploits - from zero day to ongoing threat

2

EXPLOITS – FROM 0DAY TO ONGOING THREATANDREAS FOBIAN, SECURITY RESEARCHER G DATA

Page 3: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 3

OVERVIEW

What are Exploits? Exploit Evolution

- Change of attack vectors- Lifecycle of a 0day

Defensive strategies/ technologies

Page 4: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 4

EXPLOITS - MOTIVATION

Definition: „Programm using a vulnerbility to execute arbitrary programms, not limited to calc.exe “

Exploit Kits: Framework for infections using exploits 50 – 200 Mio $ loss using exploit kits Bitkom: 14 billon $ loss in buisness sector

Page 5: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 5

EXPLOITS 101Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 6: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 6

ROOT CAUSE: COMPLEXITY

2007 2008 2009 2010 2011 2012 2013 2014 20150.00

2000.00

4000.00

6000.00

8000.00

10000.00

12000.00

14000.00

KLOC (OK)KLOC (Faults)

Page 7: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 7

EVOLUTION OF ATTACK VECTORS

Q1/200

5

Q2/200

5

Q3/200

5

Q4/200

5

Q1/200

6

Q2/200

6

Q3/200

6

Q4/200

6

Q1/200

7

Q2/200

7

Q3/200

7

Q4/200

7

Q1/200

8

Q2/200

8

Q3/200

8

Q4/200

8

Q1/200

9

Q2/200

9

Q3/200

9

Q4/200

9

Q1/201

0

Q2/201

0

Q3/201

0

Q4/201

0

Q1/201

1

Q2/201

1

Q3/201

1

Q4/201

1

Q1/201

2

Q2/201

2

Q3/201

2

Q4/201

2

Q1/201

3

Q2/201

3

Q3/201

3

Q4/201

3

Q1/201

4

Q2/201

4

Q3/201

4

Q4/201

4

Q1/201

5

Q2/201

5

Q3/201

50

20

40

60

80

100

120

140

160

jre_ekjreinternet_explorer_ekinternet_explorerflash_player_ekflash_playeracrobat_reader_ekacrobat_reader

Page 8: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 8

LIFECYCLE OF AN EXPLOIT

Vulnerbilityreleased

Vendor notifiesVulnerbility

Vulnerbilitypublished

Vulnerbilityfound

Patch released

td

tvtvd

tpd ta

Zero day Attack

Follow-on Attacks

Patchdeploymentfinished

tp

Reactive Protectionmechanisms

published

ts

Page 9: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 9

TARGETED ATTACK -> EXPLOIT KIT

3 Flash 0Days 0-”day”: October 2013 – 5.Juli 2015 Exploit Kit Integration 7.Juli 2015 Fixed 10. Juli 2015

Example: Hacking Team

Page 10: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 10

EVOLUTION OF ATTACK VECTORS

Q1/200

5

Q2/200

5

Q3/200

5

Q4/200

5

Q1/200

6

Q2/200

6

Q3/200

6

Q4/200

6

Q1/200

7

Q2/200

7

Q3/200

7

Q4/200

7

Q1/200

8

Q2/200

8

Q3/200

8

Q4/200

8

Q1/200

9

Q2/200

9

Q3/200

9

Q4/200

9

Q1/201

0

Q2/201

0

Q3/201

0

Q4/201

0

Q1/201

1

Q2/201

1

Q3/201

1

Q4/201

1

Q1/201

2

Q2/201

2

Q3/201

2

Q4/201

2

Q1/201

3

Q2/201

3

Q3/201

3

Q4/201

3

Q1/201

4

Q2/201

4

Q3/201

4

Q4/201

4

Q1/201

5

Q2/201

5

Q3/201

50

20

40

60

80

100

120

140

160

jre_ekjreinternet_explorer_ekinternet_explorerflash_player_ekflash_playeracrobat_reader_ekacrobat_reader

Page 11: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 11

Q1/200

5

Q2/200

5

Q3/200

5

Q4/200

5

Q1/200

6

Q2/200

6

Q3/200

6

Q4/200

6

Q1/200

7

Q2/200

7

Q3/200

7

Q4/200

7

Q1/200

8

Q2/200

8

Q3/200

8

Q4/200

8

Q1/200

9

Q2/200

9

Q3/200

9

Q4/200

9

Q1/201

0

Q2/201

0

Q3/201

0

Q4/201

0

Q1/201

1

Q2/201

1

Q3/201

1

Q4/201

1

Q1/201

2

Q2/201

2

Q3/201

2

Q4/201

2

Q1/201

3

Q2/201

3

Q3/201

3

Q4/201

3

Q1/201

4

Q2/201

4

Q3/201

4

Q4/201

4

Q1/201

5

Q2/201

5

Q3/201

50

1

2

3

4

5

6

7

8

9

javainternet_explorerflash_playeracrobat_reader

RELEASED EXPLOITS PER QUARTER

ASLR/DEP Sandboxing Click to play Vector Check

Page 12: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 12

DEP (DATA EXECUTION PREVENTION)

Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 13: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 13

DEP (DATA EXECUTION PREVENTION)

Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 14: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 14

ROP (RETURN ORIENTED PROGRAMMING)

Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 15: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 15

ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION)

Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 16: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 16

ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION)

Load Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

MSHTMT.DLL

JSCRIPT.DLL

JPG

JS

HTML

Malicious Code

(Shellcode)

IEXPLORER.EXE

Page 17: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 17

14 billon $ loss?

Page 18: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 18

EXPLOIT PROTECTION

Page 19: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 19

ADDRESS TABLE FILTERLoad Website

Create layout

Load images

Render graphic and show layout

Wait for Input Load Exploit

IEXPLORER.EXE

MSHTML.DLL

HTML

JPG

JS

Malicious Code

(Shellcode)

JSCRIPT.DLL

Page 20: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 20

CONCLUSION Fixing all security bugs is expensive A look at the past show:

- Killing offensive techniques forces attackers to develop new techniques - Goal: Increasing the cost of a functional attack

Mitigation Software Patchmanagement

Page 21: Exploits - from zero day to ongoing threat

G DATA | 30Y ANNIVERSARY SECURITY SUMMIT | BOCHUM, SEPTEMBER 24, 2015 21

… THANK YOU!

Page 22: Exploits - from zero day to ongoing threat

ONGOING PERSONNEL SECURITY - CPNI...effective ongoing personnel security measures will help to mitigate the insider threat, and should include: a strong security culture, where everyone

The Ether Wars: Exploits, counter-exploits and honeypots ... CON 27/DEF CON 27... · ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum 2 About

Buffer Overflow Exploits

Using Honeyclients for Detection and Response Against New ... · Client-side exploits are a growing threat – Lots of client-side vulnerabilities Microsoft Internet Explorer has

Threat Intelligence Report€¦ · Threat Intelligence Report IN THIS ISSUE • New supply chain threats • Ransomware exploits Oracle WebLogic • Hacktivism on the rise ... out

SentinelOne Endpoint Security Solution · New Threat Landscape Attacks use a Combination of Different Vectors… Malware Exploits Live Attacks Document-based exploits Browser-based

Hanging by a Thread: The ongoing threat to Somalia’s remittance lifeline

SECURITY REIMAGINED FireEye Network Threat...The FireEye ® Network Threat Prevention Platform identifies and blocks zero-day Web exploits, droppers (binaries), and multi-protocol

Trends in Global Cybersecurity - info.microsoft.com...threat landscape of exploits, vulnerabilities, and malware. We’ve used data gathered from more than 600 million computers worldwide

The Growing Hacking Threat to Websites: An Ongoing ... · The Growing Hacking Threat to Websites: ... likely victims of Web application hacking and outlines what organisations should

Exploits in Management*

Les exploits

Customizing Public Exploits

Common Exploits

Nethemba - Writing exploits

Lec04: Writing Exploits

THREAT REPORT 2019 Rev 06 - Quick Heal · Top 10 Potentially Unwanted Applications (PUA) and Adware 23 Top 10 Host-Based Exploits of 2018 24 Top 10 Network-Based Exploits of 2018

White Paper The Ongoing Malware Threat: How …...White Paper: The Ongoing Malware Threat incident,5 a figure that doesn’t take into account the fear and loss of trust that usually

Software Exploits

Lec03: Writing Exploits

QH Quarterly Threat Report Q1 - 2020 · million exploits, 0.17 million Adware & Potentially Unwanted Applications (PUA), 45K Cryptojacking malware, 0.25 million Infector and 0.24

Ed Rowley - People Make the Best Exploits: Roadmapping your security investment in line with the emerging threat landscape (#ExecLN Event)

Mullah Nasrudin Exploits

Anoiting for Exploits

FortiGate 100E Series Data Sheet - firewallshop.com · Secure SD-WAN Security § Protects against known exploits, malware and malicious websites using continuous threat intelligence

Political Gridlock:The Ongoing Threat to American Democracy

Low Level Exploits

White Paper The Ongoing Malware Threat: How Malware Infects

Invasaocom exploits

THREAT INTELLIGENCE PLATFORMSdocs.media.bitpipe.com/io_12x/io_128188/item_1253423/ThreatCon… · Effective threat intelligence management is an ongoing effort. The threat landscape

Cyber Threat Preparednessmedia.govtech.net/.../6_1045_CyberThreatPreparedness_MALEY.pdf · Zero Day Exploits • May 19, 2006, Microsoft Word XP & 2003 buffer over-flow –discovered

Threat Intelligence - IB-Bank · “The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.”

Title: Ransomware: How consumers and businesses value ...... · latest threat trends including vulnerabilities, exploits, active attacks, viruses and other malware, spam, phishing,

The Ongoing Malware Threat: How Malware Infects Websites and

SECURE PROGRAMMING Chapter 1. Overview What is the problem Cost? Threat? Software Security Concepts Policy Flaws Vulnerabilities Exploits Mitigations