Persistence is Key: Advanced Persistent Threats
-
Upload
sameer-thadani -
Category
Technology
-
view
70 -
download
3
Transcript of Persistence is Key: Advanced Persistent Threats
Persistence is Key:
Advanced Persistent
Threats
By: Sameer Thadani
Objectives
What is an APT
What is an AET
Past targets
What to look for in the future
Advanced Persistent Threats
Advanced
Higher levels of sophistication
Has access to Zero-Day exploits
Adapts to the victims defenses
Persistent
Attacks are specific
Continue until the specific goals are met
Intend to maintain communication with victim
compromised systems
Threats
Real power players behind attacks such as nation-states
Not your mom and pop hacking job
APT Malware Anatomy
APT Attack Flow
Step 1 • Reconnaissance
Step 2 • Initial Intrusion into the Network
Sep 3 • Establish a Backdoor into the Network
Step 5 • Install Various Utilities
Step 6 • Lateral Movement and Data Exfiltration
Reconnaissance
First stage of an APT
Learning about the victims business
processes and technology
Tools
Whois
Nmap
Netcraft.com
Social Media Searching
Acting SKILLZ
Network Access
Spear-Phishing = #1 Way
Targeting specific high value people
Sending highly realistic email addresses
with attachments
Attachments include remote trojans or
malware
BUT WAIT, how does my malware get
passed IDS/IPS, Firewalls, and Email
Filters?
ADVANCED EVASION TECHNIQUES
Advance Evasion Techniques
Key techniques used to disguise threats to evade and bypass security systems
Why are they advanced?
They combine multiple evasion techniques that focus on multiple protocol layers.
Evasions change during the attack
They allow malicious payloads or exploits, such as malware to look normal
A wide variety of techniques
Combinations are endless
Polymorphic Shellcode
Constantly changing packet injected
code… using ADMmutate
Polymorphic Shellcode
Packet Splitting
Establish Backdoors
Establish backdoors
Backdoors allow attackers to stay in
constant contact with the compromised
machine. Ex. Poison Ivy
Install Utilities
Install key-logger
Ex: iSam
Lateral Movement Compromise more machines on the network and setup more
back doors, this allows for lateral movement and persistence
Ex. TRiAD Botnet Control System
EXFILTRATE DATA!
Why is this happening?
Nation-State intelligence to aid in wartime
strategy and exploitation
Diminish competition and improve strategic
advantage by stealing intellectual property
To extort or ruin VIP
To gain $$$$ and gain economic power
Learning from the past…
Google - Hydraq
RSA SecureID
Iran’s Nuclear Plant - Stuxnet
All targeted attacks on huge companies
Anyone can be targeted.
Preparing for the Future..
Keep your eyes open
Elevated log-ons at unexpected times
Finding any backdoor Trojans
Look for any anomalies for information flow
Look for HUGE data bundles
Questions?
Sources
http://www.infoworld.com/article/2615666/security/5-signs-you-ve-been-hit-with-an-advanced-persistent-threat.html
https://www.youtube.com/watch?v=ugXyzkkYN9E
https://www.youtube.com/watch?v=J9MmrqatA1w
http://searchsecurity.techtarget.com/definition/advanced-persistent-threat-APT
http://www.symantec.com/theme.jsp?themeid=apt-infographic-1
http://searchsecurity.techtarget.com/definition/advanced-evasion-technique-AET
http://www.csoonline.com/article/2138125/what-are-advanced-evasion-techniques-dont-expect-cios-to-know-says-mcafee.html
Issa.org