Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack...

54
SESSION ID: SESSION ID: #RSAC Zee Abdelnabi Establishing a Quality Vulnerability Management Program TECH-W03 Red Team Lead Major Automotive Company @Infosec_17

Transcript of Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack...

Page 1: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

SESSIONID:SESSIONID:

#RSAC

ZeeAbdelnabi

EstablishingaQualityVulnerabilityManagementProgram

TECH-W03

RedTeamLeadMajorAutomotiveCompany@Infosec_17

Page 2: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

2

Page 3: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

3

Page 4: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

4

Page 5: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Page 6: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Overview

6

WhatisVM?HowtosellastorytobuildaVulnerabilitymanagementprogram

PickingtheRightTool

Evaluatecostsandadvantages:PayingforProfessionalServicesDeploymentvs.TrainingyourTeam

MistakestoAvoidCreatingaRunbook/TabletopExercises

VMLifecycle

Problems

Tips

Page 7: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

WhatisVulnerabilityManagement?

7

Theprocesswhenyouaccept,eliminate,ormitigatevulnerabilitiesbaseduponthebusinessriskandthecostassociatedwithfixingthevulnerabilities.

Mostvulnerabilitiesarelongknownbeforetheyareexploited.

Page 8: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

WhatdoyouREALLYthinkofVM?

It’srepetitive,time-consuming,seemstoneverend

8

Page 9: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Page 10: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

SelltheStorytoEstablishProgramtoManagement

10

Competitorexamples

Growth

Whatbusinessgoalsaremet

Useregulationsandcompliance:S-Ox,HIPAA,GLBAorPCIDSS

Maintainingcompaniesimage

Improvesecurity,IT,andthegeneralbusiness

Specificdeliverables

Identifyandreducerisk…itsnotaboutjustfixingvulnerabilities

Page 11: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

11

Privateresearchshownduringlivetalk

Page 12: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

12

Privateresearchshownduringlivetalk

Page 13: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

13

Privateresearchshownduringlivetalk

Page 14: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

14

Privateresearchshownduringlivetalk

Page 15: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Privateresearchshownduringlivetalk

Page 16: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

16

Privateresearchshownduringlivetalk

Page 17: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Page 18: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

CompareVMTools

18

LearnhowtopickthebesttoolsetforyourEnvironment.

AssetManagementisimportanthere:Whenyouknowwhatyouhave;youcanlookatthesystemsthatcanbemoreeffectivelyscanned

Scadaenv/orOSthattheVMtooldoesn’tscanwhygetit?Whattoolwillscanmostofwhatyouhave

Haveascorecard– weighwhat’smostimportanttoyouListyourmostimportantassets

NeedagoodAssetManagementsystem/tool

Page 19: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

ToolSelectionCriteria

19

Activevs.PassiveVM:IfyoucantgetanActivescanningtoolbecauseyoumighthavesystemsthatareveryfragileyoucanusePassive.

Passivedoesn’tscananything…

Ifyouhaveasystemyoudon’twanttoactivelyscan(becauseifyoudo,itwilldie),putitinthePassivetoolandgetAlertsonit

ImplementingToolsthataren’tusedorconfiguredproperlyisawaste:Toomanyfalsepositivesusesresources,causes“alertfatigue”

Toomanyfalsenegativesleadstooverconfidenceandfalsereassurancethatalliswell

Page 20: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

MakesuretheToolhas….

20

Adequatedocumentation

Detailedreportsonthediscoveredvulnerabilities,includinghowtheymightbeexploitedandfixed

Generalindustryacceptance

Availabilityofupdatesandsupport

High-levelreportsthatcanbepresentedtomanagersornontechnicaltypes

Page 21: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

ToolImplementationGuidelines

21

Consultthereadmeand/oronlineHelpfilesandFAQs.

Studytheuserguides.

UsetheToolinalabortestenvironmentfirst.MakesureitplayswellwithyourotherTools

EnsureTooldeliverspromisedfunctionality

Considerformalclassroomtraining.

Page 22: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

OutsourceorBuildCapabilities

22

EvaluatethecostsandadvantagesofpayingforProfessionalServicesdeploymentvstrainingyourteamDeterminetheskillsandcompetenciesnecessarytomakeasuccessfulteamFigureoutamountoftimerequiredtodothis— Increasesspeedandthequalityofdelivery— Freesmanagementtime,enablingcompanytofocusoncorecompetencieswhilenot

beingconferencedaboutconsultants— Possiblelossofcontroloveracompany’sbusinessprocesses— Lowerthanexpectedrealizationofbenefitsandresults

Page 23: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

MistakestoAvoid

23

RemediateallthingsPrioritization

Relyingononetool

Scanning,butnotactingonthescanresults

Identifyassetstoavoidscanning

ThinkingthatPatching=VM

Beingunpreparedforazerodayexploit

Rolesandresponsibilities– ProcessImprovement,escalation,accountability

Forgettingcompliancestandardstofollow

Page 24: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

MistakestoAvoid

24

PeoplemisinterprettheCVSS;ifCVSSislowdoesn’tmeanriskislow

Whenprioritizingkeepinmindtheattackdepth

Forgettingpolicyscanning

Intelligencegathering:Latestattacks

GarbageIn– GarbageOut(GIGO)

Volumesofuselesschecks

Authenticationvs.Un-authentication– Password(pw)changesWhoisresponsibleforgivingyouthosepwsorchangingthemAlertyourgroupsonpwchanges

Page 25: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

25

Page 26: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

CreateaRunbook

26

Communicationplan– CommunicationsMatrix– RACIchart

Overview

Management/teamà GOALS

ChallengesthecompanyhasencounteredduringVM

Networkinformation:Domainnames,internalandexternalIPaddresses,networkarchitecture

Assetsforgrouping/tagging,OptionProfilesbuilt

Createscanprofiles:scanningandreportingschedules.

ScanwindowsHowoftencanwescan?

Limitsonbandwidth?

Page 27: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

AttackinganAttackersPlan

27

Page 28: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

TabletopExercises

28

Demonstraterealliveattackscenarios:Biggestbusinessimpact(greatestrelevancetoorg)

ReviewScenarioBreakitintotactics

Gainassuranceonexistingcontrols

Howreadyareyou?

Helpsseetrendanalysis(seeingthisalot)

Increasesefficiency

Whyweretheybreached,samevulnerabilityused?

AttackpatternsWherearetheyattacking,whataretheydoing?

Page 29: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

ResultsandFollow-Up

29

Nowhaveattackerprofiling– attackpatternsbuiltupfromvulns

Buildscenariomodelsensorsandrunexperiments

Whichvulnscanbeexercisedthroughexternalsysteminputtorealizecybereffect

Actionableintelligence

Deepdiveintodarkside

Figuringouthowcansomeonemovethroughournetwork

Programmaturity

Automaticallyinjectpublicandprivatelistsofvulnerabilitiesandorganizethemintostandardizedattackpointsystem

Page 30: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

VulnerabilityManagementLifecycle

30

Page 31: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

DiscoverPhase

31

What’sactuallyrunninginthedifferentpartsofyournetwork.Accesspoints,webserversandotherdevicesthatcanleaveyournetworkopentoattack.

Operatingsystem,findingopennetworksports,determineswhatservicesareactiveonthoseports.Scanbynetworkrange.

Giveshacker’seyeviewofyournetwork

Page 32: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

DiscoverPhaseHelps

32

Wheredevices,suchasafirewalloranIPS,areplacedonthenetworkandhowthey’reconfigured

Whatexternalattackersseewhentheyperformportscansandhowtheycanexploitvulnerabilitiesinyournetworkhosts

Networkdesign,suchasInternetconnections,remoteaccesscapabilities,layereddefenses,andplacementofhostsonthenetwork

Whatprotocolsareinuse

Commonlyattackedportsthatareunprotected

Networkhostconfigurations

Page 33: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

33

Page 34: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Prioritize

34

Assetclassificationsystem:Assignbusinessvaluetoassets

Identifythehighestbusinessrisksusingtrendanalysis,Zero-DayandPatchimpactpredictions.

Prioritizeyoursystemssoyoucanfocusyoureffortsonwhatmatters.Someassetsaremorecriticaltobusinessthenothers

Criticalitydependsofbusinessimpact

Identifyassetowners

Page 35: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Prioritize

35

Whichsystems,ifaccessedwithoutauthorization,wouldcausethemosttroubleorsufferthegreatestlosses?

Whichsystemsappearmostvulnerabletoattack?

Whichsystemscrashthemost?

Whichsystemsarenotdocumented,arerarelyadministered,oraretheonesyouknowtheleastabout?

Page 36: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Assess

36

Scansystemsanywherefromthesameconsole:Yourperimeter

Internalnetworkandcloudenvironments

TargethostsbyIPaddress,assetgrouporassettag

ThosethingsyoufindscanandfindoutwhatVulnerabilitiestheyhave

Page 37: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Reporting

37

ReportingConsiderations:Whatreportsarecurrentlygenerated?

Build/Importreporttemplates

Whatinformationisneededfromreports?

Newdatapoints

Whatlevelsreceivereports(executive,linemanagers,linestaff)

MakeITthehero– Promotethemwhentheydoagreatjob&usemetrics

Holdpeopleaccountable

Page 38: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

ReportTemplatesandMetrics

38

Establishreporttemplatesandmetricsyouneedtoshowyourprogramissuccessful.

Whatiseachteamtryingtoaccomplish?Add/removestaffPromotecostoptimizationDemonstrateeffectiveness

That’showyouwilldemonstratemetricsonhowmuchworkisbeingdone,howmanyVulnerabilitiesarebeingremediated

Makesurereportsareprovidingvalueandgivingmanagementtherightinformation

Page 39: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

TemplateExamples

39

Confirmed4/5sonly

ExecutiveTrendingReport

ExecutiveTrendingReport– 4/5s

ExecutiveTrendingReport– over90days

OverallPatches4+5– Last30days

PatchReport

Youcan’tmanagewhatyoucan’tmeasure

Page 40: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Remediation:FixingVulnerabilities

40

Howmanygroupsareinvolvedinremediationefforts?Thiswilldriveassetgroups/taggingPatching/configurationprocessWilltakeapproximately2-3hoursworkingwitheachgroup

HowpatchingandVulnerabilityremediationiscurrentlyperformedifnotcreateaplanPatchingscheduleWhatpatchingtoolwillyouusePatchtesting(java)Whatgroupsinvolved

Page 41: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Remediation

41

Iftheriskoutweighsthecost– eliminateormitigatetheVulnerability!

Implementmitigatingcontrols(defenseindepth)Intrusionpreventionsystems(IPS)Intelligentfirewalls

HaveaPlan,makesureyouhaveresourcesandpermissiontoacceptshort-termriskstomitigatelong-termvulnerabilities

WhathappensiftheCostoutweighstheRisk

Page 42: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Verification

42

Verifyappliedpatchesandconfirmcompliance

Verifytheticketsaftertheyareclosed

Page 43: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Majorityof2’sand3’s=Misconfiguration

43

Misconfigurationsofsystems,servers,andfirewallsalsoleadtothecompromiseofnetworks.

ChangestoGroupPolicyorotherchangemethods.Thisisawaytoreduceriskintheenvironmentonalargescalewithminimaleffort.Reviewnon-patchableVulnerabilitiestoidentifyquickwinsontheconfigurationsidetoreducerisk.

Removethevulnerabilitiesandbettersecureyoursystems

Page 44: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Page 45: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Problems:Don’tIgnoreIssues

45

TheHighImpactPatches:ReportthatidentifiestheareasthatreducethelargestamountofVulnerabilitiesandVulnerabilitiessoeffortcanbeprioritized.— OpeningupticketsforeachofthesepatchableVulnerabilitiesover90days.— Thiswilldriveremediationandgettheseissuesclosed.

NotusingIPs:TheseIPscanbeusedtoscanothersystemstodriveremediationandactualreductionofrisk.— Reviewinghoststoidentifyiftheyarestillintheenvironment.— HoststhatarenotscannedcannevershowfixedVulnerabilities,andkeeptheVulnerabilitycount

artificiallyhigh.

Page 46: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Problems

46

Thereare305IPsthathavenotbeenscannedinmorethan60dayswithsomehostsnotscannedsinceJuly2010.

SCCMbroken

Teamswillnotauthorizetheappropriatelevelofaccesstorunauthenticatedscans.Pluginthecredentials

Re-openedVulnerabilities

Page 47: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

RiskManagement

47

RISK=

AssetsxVulnerabilities xThreatsYoucan controlVulnerabilities.

Focusonyourhighpriorityassets,andReduceyourthreatlandscape

Page 48: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Tips

48

MostorganizationsdoagoodjobofkeepingMicrosoftoperatingsystemsandapplicationsuptodate.Butdon’tfairnearlyaswellwhenitcomestoLinux,UNIX,Mac,and3rdpartyapplicationssuchasAdobe.

Applicationscanningshouldbeaddedtothetypesoftestsperformedtomakesurethatanyneworexistingapplicationarenotvulnerable.

Createainternalhackinglab(recon,scanning,exploitation):✓ Exploitingmissingpatches✓ Attackingbuilt-inauthenticationsystems✓ Breakingfilesystemsecurity✓ Crackingpasswordsandweakencryptionimplementations

Page 49: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Tips

49

Don’tOverlookPhysicalSecurity

Wheneveryonehasastake,wheneveryteamhasskininthegame,thentheburdenofVMissharedandperhapslessenedforeachindividual.

ActFast

Page 50: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

50

MakingContacttoReportVulnerabilities

Privateresearchshownduringlivetalk

Page 51: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

InaPerfectWorld:YouthinkyourVMprogramwilllooklikethis…

BUT…

Page 52: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Page 53: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

Tips

53

FrequentGapAssessments:Makesurethatyougobackoverwhatyoudid.Documentwhatworks,whatdoesn’t,andwhyitdidn’t/failed.Communicatelessonslearnedandcontinuepushingitthroughtheprogramforcontinualimprovement

InternalVulnerabilityassessmentswithpolicycompliancescanningshouldbeperformedandrunmonthly.

Maintainsecuritythroughongoingtestinganddiscovery.

Page 54: Establishing a Quality Vulnerability Management Program · 29 Now have attacker profiling –attack patterns built up from vulns Build scenario model sensors and run experiments ...

#RSAC

“Apply”Slide

54

Nextweekyoushould:Haveaconversationwiththerightdepartmentandunderstandwhatyoucurrentlydoforvulnerabilitymanagement.

Inthefirstthreemonthsfollowingthispresentationyoushould:DeterminethecurrentlevelofmaturityofyourprogramAssesspreandpostvulnerabilitylifecycle.Performanassessment.

Withinsixmonthsyoushould:SelectacentralizesystemtodumpOSINTvulnerabilitiesandabasiclabsetup.Createaninternalrunbookandperformtabletopexercise


Insider Attacker Detection

Insider Attacker Detection

Strategies of the Attacker

Strategies of the Attacker

JBOSS Profiler Performance Profiling. Contents ● Motivation – The problem ● Profiling ● Profiling Tools ● Java and Profiling ● JBoss Profiler ● Example.

JBOSS Profiler Performance Profiling. Contents ● Motivation – The problem ● Profiling ● Profiling Tools ● Java and Profiling ● JBoss Profiler ● Example.

Php Vulns Slides

Php Vulns Slides

Active Attacker July 14, 2012

Active Attacker July 14, 2012

PradeepKumar Sharma† Black hole attack: An attacker starts dropping all the network packets through its path. If the attacker is also a sink node, the attacker is much moreeffective.

PradeepKumar Sharma† Black hole attack: An attacker starts dropping all the network packets through its path. If the attacker is also a sink node, the attacker is much moreeffective.

Attacker aproach for attacking ics

Attacker aproach for attacking ics

Attacker Ghost Stories - ShmooCon 2014

Attacker Ghost Stories - ShmooCon 2014

Open Source Insight: Record Vulns in 2017 and Predictions for Open Source in 2018

Open Source Insight: Record Vulns in 2017 and Predictions for Open Source in 2018

Rooting your internals - Exploiting Internal Network Vulns via the Browser Using BeEF Bind

Rooting your internals - Exploiting Internal Network Vulns via the Browser Using BeEF Bind

Memory Vulns Delalleau

Memory Vulns Delalleau

NETWORKDEFENCEUSING ATTACKER-DEFENDER ... - Masaryk …

NETWORKDEFENCEUSING ATTACKER-DEFENDER ... - Masaryk …

Attacker Economics - F5

Attacker Economics - F5

Rios (2013) medical device vulns

Rios (2013) medical device vulns

Attacker Math

Attacker Math

Analyzing and Profiling Attacker Behavior in Multistage Intrusions

Analyzing and Profiling Attacker Behavior in Multistage Intrusions

TURF AERATOR SPECIALISTSarchive.lib.msu.edu/tic/bigga/gki/page/1999apr61-70.pdf · E-mail: sales@grassrootsl.demon.co.uk GENESIS ATTACKER ATTACKER PVT Attacker has a unique positive

TURF AERATOR SPECIALISTSarchive.lib.msu.edu/tic/bigga/gki/page/1999apr61-70.pdf · E-mail: [email protected] GENESIS ATTACKER ATTACKER PVT Attacker has a unique positive

THE UNFORTUNATE REALITY OF INSECURE LIBRARIES OWASP Libraries.pdf · What’s More Secure: Vulns or No Vulns? Library A Library B CVE-2007-1234 OSVDB 12345 OSVDB 31337 CVE-2009-5678

THE UNFORTUNATE REALITY OF INSECURE LIBRARIES OWASP Libraries.pdf · What’s More Secure: Vulns or No Vulns? Library A Library B CVE-2007-1234 OSVDB 12345 OSVDB 31337 CVE-2009-5678

houdini - UDURRANIHoudini UDURRANI Summary: - Attacker uses a worm builder to create a VBS payload - Attacker obfuscates the payload - Attacker embeds the obfuscated VBS file into

houdini - UDURRANIHoudini UDURRANI Summary: - Attacker uses a worm builder to create a VBS payload - Attacker obfuscates the payload - Attacker embeds the obfuscated VBS file into

Erik Cabetas An Overview of Interpreted Language Vulns.

Erik Cabetas An Overview of Interpreted Language Vulns.