Top Banner
APT: Hunting ÖDay Malware Mustafa Qasim
44

APT - Hunting 0Day Malware

Jun 09, 2015

Download

Technology

Mustafa Qasim

Presentation slides of my talk at Cyber Secure Pakistan 2013.

apt malware

malware events

heuristics sandbox

heuristics dilemma

antivirus l0l signatures

ips traffic signatures

highest technique

antivirus l0l vip entry

Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: APT - Hunting 0Day Malware

APT: Hunting ÖDay Malware

Mustafa Qasim

Page 2: APT - Hunting 0Day Malware

Since this presentation started

of organizations will have some malware event successfully evade their IT defenses.

Page 3: APT - Hunting 0Day Malware

On average, malware events occur at a single organization once every

3 MIN

UT

ES

Page 4: APT - Hunting 0Day Malware

Introduction

Page 5: APT - Hunting 0Day Malware

Once upon a time...

Page 6: APT - Hunting 0Day Malware
Page 7: APT - Hunting 0Day Malware
Page 8: APT - Hunting 0Day Malware

According to IDC, between 2003 and 2011, total IT security spend grew from $12 billion to $28 billion.

$12 Billion2003

$28 Billion2011

Page 9: APT - Hunting 0Day Malware

reActive

Vs

proActive

Page 10: APT - Hunting 0Day Malware
Page 11: APT - Hunting 0Day Malware

Fear of False Positive!

Page 12: APT - Hunting 0Day Malware

So called Defenders!

Page 13: APT - Hunting 0Day Malware

Firewalls

- Yes/No

- NexGen Firewall Buzz

- Latency Impact

Page 14: APT - Hunting 0Day Malware

IPS

- Traffic Signatures

- 0Day Prevention Buzz (Exploit > Vulnerability)

- Network Services vs. Client Side Attacks

Page 15: APT - Hunting 0Day Malware

Web Gateways

Called: Defense In-depth

In Actual: Iteration

Page 16: APT - Hunting 0Day Malware

Anti-Virus (L0L)

- Signatures

- Heuristics

- Sandbox

Page 17: APT - Hunting 0Day Malware

Anti-Virus (L0L)

- VIP entry via signed binary– Flame by Microsoft ;-)

Page 18: APT - Hunting 0Day Malware

Signatures

- Binary / Traffic

- Morphing, Obfuscation, Encryption

Page 19: APT - Hunting 0Day Malware

Heuristics Dilemma

Page 20: APT - Hunting 0Day Malware

Heuristics Dilemma

Page 21: APT - Hunting 0Day Malware

Isn't Sandbox made up of sand?

Page 22: APT - Hunting 0Day Malware
Page 23: APT - Hunting 0Day Malware
Page 24: APT - Hunting 0Day Malware

Disheartened by Backward Looking Defenders?

Page 25: APT - Hunting 0Day Malware

The highest technique is to have no technique.

My technique is a result of your technique; my movement is a result of your movement.

Page 26: APT - Hunting 0Day Malware

APT Malware vs. Traditional

Page 27: APT - Hunting 0Day Malware

APT Attack Life Cycle

Page 28: APT - Hunting 0Day Malware
Page 29: APT - Hunting 0Day Malware

Stage 1

Intrusion through exploitation

- Remote Exploit / Local Exploit

- Social Engineering

Page 30: APT - Hunting 0Day Malware

Stage 2

Malware is dropped

- Single Click

- 64base Encrypted Hidden Link

- Java revoke list check disabled

- Legacy vs Advanced

* pdf not exe

* DLL search order hijacking

Page 31: APT - Hunting 0Day Malware

Stage 3

Phones Home

- RAT

- Outbound Encrypted Connection

- Proxy CnC for a network

Page 32: APT - Hunting 0Day Malware

Stage 4

Spreads laterally

- Not always hits target

- Clear entry point

Page 33: APT - Hunting 0Day Malware

Stage 5

Data extraction

- Small Chunks

- Staged Host

- Encrypted RAR

Page 34: APT - Hunting 0Day Malware

Case Studies

- RSA breach

- Operation Aurora

Page 35: APT - Hunting 0Day Malware

Forensics & Challenges

- Behavior

- Code

* Packed

* Obfuscated

* Anti Debugger

* Anti VM

* Time

Page 36: APT - Hunting 0Day Malware

NGTP

- Signature less

- Protection not Detection

- Virtual Execution Engine

Page 37: APT - Hunting 0Day Malware

Pakistan Cyber Space

Page 38: APT - Hunting 0Day Malware

First things FIRST!

Page 39: APT - Hunting 0Day Malware

“ If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.”

— Sun Tzu, The Art of War

Page 40: APT - Hunting 0Day Malware

Honeynet Pakistan

- 6 Deployments

- Avg. 400 malware per day

- Around 100 Unique

Page 41: APT - Hunting 0Day Malware
Page 42: APT - Hunting 0Day Malware

ISPs

FinancialInstitutions

NADRA

Government Organizations

Page 43: APT - Hunting 0Day Malware

Honeytoken Snort Rule

alert ip any any -> any any (msg:"Alert! Token c86"; content:"r71p@g3r";)

Page 44: APT - Hunting 0Day Malware

Catch Me

Twitter: mustafaqasim

Freenode: mustu @ #offsec


Related Documents
Malware Analysis Report: Dark Caracal APT The Pallas · PDF fileCSE CyberSec Enterprise SPA Via G.B. Martini 6, Rome, Italy Email: info@ Website: ZLAB Malware Analysis Report:

Malware Analysis Report: Dark Caracal APT The Pallas · PDF...

Category: Documents
Craig Searle BAE Systems Detica: APT – Myths & malware

Craig Searle BAE Systems Detica: APT – Myths & malware

Category: Technology
HTTP-Based APT Malware Infection Detection Using URL ...

HTTP-Based APT Malware Infection Detection Using URL ...

Category: Documents
DIY Blue Teaming - ShellCon · 2019. 10. 23. · DIY Blue Teaming Ways to make malware not work 0day (and it's often attached malware) tends to fail in the wild, like A LOT. When

DIY Blue Teaming - ShellCon · 2019. 10. 23. · DIY Blue.....

Category: Documents
COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced malware and advanced persistent threats (APT) are frequently used as terms to describe malicious code that bypasses traditional

COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced...

Category: Documents
Malware & APT risks for Critical Infrastructures Infrastructure...Malware & APT risks for Critical Infrastructures. Ashar Aziz, Founder, CEO & CTO . FireEye, Inc. October 18-20, 2011

Malware & APT risks for Critical Infrastructures...

Category: Documents
Defeating Advanced Persistent Threat Malware · Solution to APT Malware: A DNS ... An Approach Worth Investigating – Infoblox DNS ... commonly-used description for this category

Defeating Advanced Persistent Threat Malware · Solution to...

Category: Documents
Reversing the Inception APT malware | Blue Coat...Finally we can see it’s connecting to webdav.cloudme.com and cleartext credentials in following screenshot. Malware tries to communicate

Reversing the Inception APT malware | Blue Coat...Finally we...

Category: Documents
Zararlı Yazılım Analizinde Güncel Problemleraselcuk.etu.edu.tr/SiberGuvenlikGunu-2019.12.23/EnginKirda.pdf · Actors / APT Advanced Persistent Threats != malware! ... •Makine

Zararlı Yazılım Analizinde Güncel...

Category: Documents
Corporate e Security Intelligence: minacce 0day e compromissioni

Corporate e Security Intelligence: minacce 0day e...

Category: Technology
Ataki APT na instytucje rządowe na przykładzie grup APT 28 i APT …forumti.pl/22Forum/prezentacje/T.Pietrzyk.pdf · 2016-10-13 · Kilka dni temu pisališmy tugaj, Že znany malware

Ataki APT na instytucje rządowe na przykładzie grup APT 28...

Category: Documents
Cyber-Resilience-Analyse mittels …edoc.sub.uni-hamburg.de/haw/volltexte/2014/2625/pdf/MA_Harms.pdf · APT, Malware, Simulation, Resilience, Graph, Multi-Agent-System Abstract This

Cyber-Resilience-Analyse mittels...

Category: Documents