from russia with love - modern tools used in cyber attacks

- A note on notes: The speaker strives to keep most of his slides empty, for that reason some slides contain extensive notes at the bottom (right here). Ignoreat your own peril…

copyright (2014) comForte 21 1

- Thomas Burg has an extensive background in systems programming, networking, and security. For more than 30 years, Thomas has worked with a range of computingplatforms, including Windows, UNIX, and HP NonStop. Burg is Chief Technology Officer for comForte, a software vendor specializing in security, connectivity, andmodernization solutions for the HP NonStop market. At comForte, he has helped guide the company’s strategic product direction and orchestrated a range of technologyinitiatives, such as the company’s SSL/SSH encryption suite, which was ultimately adopted by HP within the NonStop OS.


“Brain” was …• created by a pair of programmers from Pakistan• They did include their phone number and address in the first version (!)


In 2011, the Chief Research officer of F-Secure (http://en.wikipedia.org/wiki/Mikko_Hypponen) travelled to Pakistan and did find the two guys who are nowworking as computer professionals


http://en.wikipedia.org/wiki/Mikko_Hypponen

Initially, viruses were spreading through BBS systemsEventually they started spreading through e-mailNew concepts were introduced:

Macro language viruses (Visual Basic for Word)Worms (self-replicating)

Still the viruses were mostly experimental, “hacking”, “to prove something could be done”. Sometimes they were damaging already though.


New techniques for hiding and avoiding of detection arrived:rootkitsself-encrypting, polymorphismbotnets

The Cost of attacks / effects on global economy are risingVirus-infection has become part of ‘normal’ computer businessMost importantly, more and more viruses were simply created to make money – rather than to ‘prove something’. Hence the difference between “white hat”and “black hat” hackers.


The Zeus botnet ring of 2007 provides a good example for ‘separation of duties’ among a ring of criminals“malware coders” create the malware“mules” launder the money“exploiters” get the money

Victims can be individuals, businesses, financial institutions


The geography of Zeus shows how the Internet allows to attack anyone from anywhere:malware written in Eastern Europevictims targeted in USA and UK


Recent breaches include Sony, RSA, New York Times, as of late 2013 Target…


The timeframe for an attack can easily be weeks or months as the attacks are “multi-staged”. ((Side note: none of these techniques are new; they are knowamong the security community for 10+ years.))

Note the “targeted server” – the attacker was looking for specific source code and found it. Servers (rather than user workstations) are increasingly becoming thetarget of attacks.

It is only the increased motivation of the attacker which made this possible


It is still not known who was behind the RSA data breach – yet obviously the attacker had a very specific goal in mind and was clearly focused on that goal; evenif this involved a ‘multi-staged’ attack.


This slide sums up the massive changes in the “attack vectors”, namely the malware often central to an attack:• Shift from “simple” to “complex” viruses. Complex viruses are often _not_ detected by Antivirus software• Shift from “for fun”/”hacking” to commercial or state-sponsored interest

Beyond this, there is a new quality of the attacks: APT, Advanced Persistent Threats, see next slide


This presentation was intended to provide a quick overview how the “attack landscape” has changed in the last 18 years. The author believes it is ratherimportant to understand that todays’ attacks differ radically from the usual attacks on computer systems about a decade ago: Todays’ attacks are more and moremulti-stepped and sophisticated rather than (as in the good ol’ times) just employing a single weakness in the defenses.

This is _not_ to say that one should use the “head in the sand” approach.


from russia with love - modern tools used in cyber attacks

Technology

todays attacks

usual attacks

target of attacks

complex viruses

multistaged attack

attack vectors

attack landscape

new techniques