APT - Hunting 0Day Malware

APT: Hunting ÖDay Malware

Mustafa Qasim

Since this presentation started

of organizations will have some malware event successfully evade their IT defenses.

On average, malware events occur at a single organization once every

Introduction

Once upon a time...

According to IDC, between 2003 and 2011, total IT security spend grew from $12 billion to $28 billion.

$12 Billion2003

$28 Billion2011

reActive

proActive

Fear of False Positive!

So called Defenders!

Firewalls

- Yes/No

- NexGen Firewall Buzz

- Latency Impact

- Traffic Signatures

- 0Day Prevention Buzz (Exploit > Vulnerability)

- Network Services vs. Client Side Attacks

Web Gateways

Called: Defense In-depth

In Actual: Iteration

Anti-Virus (L0L)

- Signatures

- Heuristics

- Sandbox

Anti-Virus (L0L)

- VIP entry via signed binary– Flame by Microsoft ;-)

Signatures

- Binary / Traffic

- Morphing, Obfuscation, Encryption

Heuristics Dilemma

Isn't Sandbox made up of sand?

Disheartened by Backward Looking Defenders?

The highest technique is to have no technique.

My technique is a result of your technique; my movement is a result of your movement.

APT Malware vs. Traditional

APT Attack Life Cycle

Stage 1

Intrusion through exploitation

- Remote Exploit / Local Exploit

- Social Engineering

Stage 2

Malware is dropped

- Single Click

- 64base Encrypted Hidden Link

- Java revoke list check disabled

- Legacy vs Advanced

* pdf not exe

* DLL search order hijacking

Stage 3

Phones Home

- Outbound Encrypted Connection

- Proxy CnC for a network

Stage 4

Spreads laterally

- Not always hits target

- Clear entry point

Stage 5

Data extraction

- Small Chunks

- Staged Host

- Encrypted RAR

Case Studies

- RSA breach

- Operation Aurora

Forensics & Challenges

- Behavior

- Code

* Packed

* Obfuscated

* Anti Debugger

* Anti VM

* Time

- Signature less

- Protection not Detection

- Virtual Execution Engine

Pakistan Cyber Space

First things FIRST!

“ If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.”

— Sun Tzu, The Art of War

Honeynet Pakistan

- 6 Deployments

- Avg. 400 malware per day

- Around 100 Unique

FinancialInstitutions

Government Organizations

Honeytoken Snort Rule

alert ip any any -> any any (msg:"Alert! Token c86"; content:"r71p@g3r";)

Catch Me

Twitter: mustafaqasim

Freenode: mustu @ #offsec

APT - Hunting 0Day Malware

Technology

Transcript of APT - Hunting 0Day Malware

How Targeted APT and Advanced Malware Attacks Evade Anti-virus Software

NATION-STATE MONEYMULE'S HUNTING SEASON · CHI-EN Shen (Ashley) Independent Researcher • From Taiwan! • Co-founder of HITCON GIRLS • Focusing on APT research, malware analysis

Hacking the 0day Market...market, we need to “normalize” and streamline this business: Come on… It’s not 2003 anymore. Hacking the 0day Market The Public Bug Bounty Program

Malware - UCR Computer Science and Engineeringcsong/cs255/l/malware.pdfTwo types of malware • Two types of malware • Targeted (a .k.a. advanced persistent threat, APT ), state-driven,

Using Massively Distributed Malware in APT-Style Attacks

Advanced Persistent Threat · APT - Overview ySummary / Synopsis –Advanced Persistent Threat yAnatomy yTimeline –Threat Vector Evolution yTools –Malware, Bots yTechniques –OSINT,

THE CURRENT STATE OF CYBERCRIME 2014: … REPORT THE CURRENT STATE OF CYBERCRIME 2014: GLOBAL MALWARE OUTLOOK April 2014 APT ATTACKS REMAIN UNABATED AND POS MALWARE ATTACKS BECOME

Some things about recent Internet IoT/ICS attacks - a ...Enterprise Zone 0day, APT, Ransomware, Botnet, Phishing Mail and so on. • In general, the bad guys need to penetrate the

PACKAGING DESIGN, ARTWORK & MOCKUPS | PRIVATE CLIENT · Apt. 58 Apt. 5 9 Apt. 5 7 Apt. 5 6 Apt. 55 Apt. 54 1 Apt. 60 2 Apt. 61 1 2 Apt. 1 9 t. 20 1 t. 18Ap t. 2 2 Apt. 17 Apt. 16

SAINT: Mapping the Cybercrime · 2018-04-20 · #hacking #spam #osint #deepweb #darkmarket #vulnerability #0day #apt #rat #bot #c&c #zombiepc #exploit #carders #phising #ddos #stressers

Corporate e Security Intelligence: minacce 0day e compromissioni

COMBATTING ADVANCED MALWARE THREATS IN EMAIL · Advanced malware and advanced persistent threats (APT) are frequently used as terms to describe malicious code that bypasses traditional

Presentation Title Presentation Date · Malware Sensors / Sandboxing / “APT-devices” ... -e.g. Hammertoss Check FireEye Report on APT29 -> search engine. SharkFest ‘16 • Computer

Reversing and Decrypting the Communications of APT Malware (Etumbot)

Malware & APT risks for Critical Infrastructures Infrastructure/2011 NERC GridSecCon... · FireEye Inc Confidential – Do Not Distribute Based on Preliminary Analysis So- How Much

PELAGO.COM.AU DISCOVER THE LIFESTYLE...APT.132 APT.126 APT.125 APT.133 APT.135 AP T.134 APT.136 AP T.124 APT12. 3 B B H C C6 A1 E D F1 APT.131 C5 APT.130 C4 APT.129 C2 APT.128 C APT.127

How does a 0day work? - DefCamp 2012

SECURITY REIMAGINED - Digital News Asia · 2015-11-18 · The Most Prevalent Malware in Southeast Asia 5 Southeast Asia’s Leading Industries Attracting APT Malware 6 Regional Case

DATA SHEET FortiAI - BOLL · VBA, ELF, HWP (Hancom), 32 & 64bits PE files including DLLs, MSOFFICE, DEX, PHP, XML, POWERSHELL, Archive ... FortiAI-3500F appliance for 0day/Malware

Project Zero- Making 0day hard(er) by Chris Evans