Klaus Majewski, Business Development Manager Advanced Evasion Techniques
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Klaus Majewski, Business Development Manager
Advanced Evasion
Techniques
Paradigm shift
“Political Cyberattacks Hit Large Companies”
“Zeus botnet thrivingDespite recent arrests.”
Where are we today…
The 2009 CSI Annual Survey:
Cost of cyber attacks $ 235,000 on average
Financial fraud $ 450,000 per incident
Theft of information $ 710,000 per incident
Verizon Business’ 2010 Data Breach Investigations
Report reveals that 40% resulted from hacking, while
38% used malware. The overwhelming majority of
attacks were from organized crime, at 85%.
How Cyber criminals and
hackers can improve success
rate of targeted attacks?
To put it simple.
Use
Advanced
Evasion
Techniques.
Evasion Definition
In the same way a stealth fighter can attack without detection
by radar and other defensive systems.
Evasion techniques are a means to disguise and/or modify cyber
attacks to avoid detection and blocking by information security systems.
Evasions enable advanced and hostile cyber criminals to deliver any
malicious content, exploit or attack to a vulnerable system without
detection, that would normally be detected and stopped. The security
systems are rendered ineffective against such evasion techniques.
Security is easy if
criminals follow
the same rules as
we are following?
Are they?
The Background
Evasions enable advanced and hostile cyber
criminals to deliver any malicious content,
exploit or attack to a vulnerable system,
without detection, that would normally be
detected and stopped.
Evasion research has been carried out since
at least the late 1990s.
Most evasion techniques to date have stayed
within the confines of established rules for
network traffic.
Security systems can be rendered ineffective
against evasion techniques, in the same way a
stealth fighter can attack without detection by
radar and other defensive systems.
Stonesoft R&D has discovered and reported a new species of evasion techniques that can be altered or combined in any order to avoid detection by security systems.
Advanced Evasion Techniques (AETs)
Use of AETs
In highly advanced and targeted attacks
against well-protected networks.
By organizations with many resources and high stakes.
From the point of view of cyber criminals and hackers, AETs work like a master key to anywhere. They provide all the time in the world to try exploits and find the one that works.
They’re insurance against getting caught.
What does this mean...
Digital assets aren’t well protected
AETs do not behave in traditional ways,
and the current protection against them is
weak.
False perception of security creates easy
targets
The majority of security appliances are
unable to provide protection
Predator 3.0
• Network security device research
environment built for automated
testing
• Evasion fuzzer
– Fuzz the carrier protocols, but
leave payload intact as a targeted
server actually sees it
– Able to use multiple, randomly ran
evasion techniques
simultaneously on multiple layers
Predator Evolution
First version written in 2007, had 12 evasions that
were not stackable
Current Version 3.0 has 180+ evasions that are
stackable. And counting…
2180 =
15324955408658888583583470271503091836187
39122183602176
Becomes impossible to test all combinations
IPv6 will offer much bigger combination universe
Some thoughts on AETs
“Advanced Evasion Techniques can evade many network security systems. We were able to validate Stonesoft’s research and believe that these Advanced Evasion Techniques can result in lost corporate assets with potentially serious consequences for breached organizations.”
- Jack Walsh, Program Manager.
“If the network security system misses any type of evasion it means a hacker can use an entire class of exploits to circumvent security products, rendering them virtually useless. Advanced Evasion Techniques increase the potential of evasion success against the IPS, which creates a serious concern for today’s networks.”
- Rick Moy, President.
“Recent research indicates that Advanced Evasion Techniques are a real and credible – not to mention growing –and growing threat against the network security infrastructure that protects governments, commerce and information-sharing worldwide. Network security vendors need to devote the research and resources to finding a solution.“
- Bob Walder, Research Director.
Vision for the Future
• We believe that our research
has a clear positive impact to
the quality of the whole IPS /
NGFW industry
• Test labs and the research
community will bring more
focus to the evasions
• There is a lot of work to be
done…
Total # of reported
evasions techniques
(traditional +
advanced)
Discovery of
AETsNumber of reported
evasion techniques
Se
curity
ga
ps
Static/ Dynamic protection
Time 2010-2011
Protection level offered by the static protection
Estimated increase of
reported evasions and
protection levels
(dynamic vs. static)
Normalization
• Protocol normalization is a way to fight against
evasions
• The Anti Evasion readiness depends on the
capabilities and efficiency to do normalization on all
levels
• This means, that all protocol decoding is normalized
and exploits can be detected by fingerprint matching -
> there is a need for only representation of exploit
Financial Effects
Loss of reputation & trust
Operations continuity breakages
Data asset thefts and spying
Quality damages
Ongoing evaluation and auditing
More knowledge needed
Patching and human errors
Operational workload
Migration to continuously and
automatically updatable systems
Compliance requirement changes
Replacement of non updatable
devices, systems and
endpoints
Anti evasion ready appliances
Security is a processIncrease your
knowledge of advanced evasion techniques at
antievasion.com
Audit critical infrastructure,
applications (ERP,CRM) and critical data
Identify which servers are hosting those critical
assets and evaluate AETs protection
Protect those assets with anti evasion ready solutions and latest
updates
Make a plan how to migrate to dynamic
(software based)
security.
Disconnect all critical assets which can not be
patched or protected against AETs
www.antievasion.com
Related Documents
