SAÂD KADHI, HEAD OF CERT-EU.

HACK.LU 2019 / 2019-10-23 PUBLIC / TLP:WHITE DISTURBANCE THE SORRY STATE OF CYBERSECURITY AND WHAT WE CAN DO ABOUT IT

v1 IN THE BEGINNING IN THE BEGINNING, A CYBERSECURITY PRODUCT WAS BORN

THE ANTIVIRUS IN THE BEGINNING, IT PROTECTED US (TO SOME EXTENT)

FILELESS MALWARE RANSOMWARE SLAMMER (2003) BRAIN POWELIKS (1986) (2015) WORMS AIDS (1989) ILOVEYOU (2000) REVETON (2012) CODE NIMDA RED (2001) THE ANTIVIRUS (2001) CRYPTOLOCKER (2013) CONFICKER (2008) TROJANS & RATS PETYA (2016) EGABTR (1989?) POTENTIALLY UNWANTED APPLICATIONS WANNACRY (2017) NETBUS MIMIKATZ DARKCOMET (1998) (2011) (2012)

FINFISHER (2011?) IN THE BEGINNING, IT PROTECTED US (TO SOME EXTENT)

FILELESS MALWARE THIS SLIDE (NOR RANSOMWARE MY LIFE) WILL SLAMMER SUFFICE TO LIST (2003) BRAIN (1986) THEM ALL POWELIKS (2015) WORMS AIDS (1989) ILOVEYOU (2000) REVETON (2012) CODE NIMDA RED (2001) THE ANTIVIRUS (2001) CRYPTOLOCKER (2013) CONFICKER (2008) TROJANS & RATS PETYA (2016) EGABTR (1989?) POTENTIALLY UNWANTED APPLICATIONS WANNACRY (2017) NETBUS MIMIKATZ DARKCOMET (1998) (2011) (2012)

FINFISHER (2011?) Source: Wired HOW WE ENDED UP HERE?

CYBERINSECURITY: THE COST OF MONOPOLY HOW THE DOMINANCE OF MICROSOFT’S PRODUCTS POSES A RISK TO SECURITY DAN GEER, SEP 24, 2003

THESE EXAMPLES ARE ALL TELLTALE SIGNS OF THE DOMINATING MONOCULTURE

BUT… A MONOCULTURE HAS ADVANTAGES

(AND THE SECURITY OF MS PRODUCTS HAS SIGNIFICANTLY AND STEADILY IMPROVED) HOWEVER, CLASS BREAKS ARE TOO COSTLY TO IGNORE CLASS BREAKS 101

TARGETS A CERTAIN COMPROMISES A PIECE OF SOFTWARE CERTAIN DEVICE

COMPROMISES HUNDREDS IF NOT THOUSANDS OF DEVICES

DEVICE DEVICE

MONOCULTURE & STANDARDISATION DEVICE DEVICE

TARGETS A WIDELY DEPLOYED PIECE OF SOFTWARE DEVICE DEVICE

DEVICE DEVICE Source: Google's Project Zero CLASS BREAKS: EXAMPLES

SYMANTEC ENDPOINT PROTECTION (2016)

2012-2018: GOOGLE’S PROJECT ZERO FOUND SEVERAL HIGHLY CRITICAL VULNERABILITIES IN MANY OTHER AV PRODUCTS (KASPERSKY, ESET, COMODO, TRENDMICRO, SOPHOS…)

Source: The Register Source: imgflip.com FROM SUPPLY-CHAIN ATTACKS TO CLASS BREAKS

COMPANY X IS A COMPROMISES TARGETS COMPANY X SUPPLIER OF COMPANY A (SECONDARY TARGET) COMPANY A (PRIMARY TARGET)

Source: Reuters

COMPROMISES TENS IF NOT HUNDREDS OF COMPANIES

COMPANY A COMPANY B

COMPANY C COMPANY D

TARGETS COMPANY X COMPANY X IS A (SECONDARY TARGET) SUPPLIER OF MANY ORGS COMPANY E COMPANY F

COMPANY G COMPANY H THIS IS NOT THEORETICAL

2016 ?

2019

Source: Twitter

Source: Arstechnica MARCHING TOWARD FAILURE IN THE BEGINNING…

INSUFFICIENT (COVER ONLY A CERTAIN CLASS OF THREATS) FAILLIBLE (FAULTY SIGNATURES, BSOD)

THE ANTIVIRUS EXCELLENT VECTOR (FOR A NICE CLASS BREAK INSECURE ATTACK) (TOO MANY PARSERS, BAD CODING) WITH GROWING DIGITALISATION COMES PRODUCT PROLIFERATION

UBA UEBA UTM SANDBOX 2FA

NETWORK VPN ANTI-MALWARE FIREWALL (WITH DPI) NIDS THREAT FEEDS

VULNERABILITY WAF THE ANTIVIRUS SCANNERS NIPS TIP

ANTI-SPAM SOAR SIEM EPP

PERSONAL PROXY FIREWALL (WITH DPI) DLP EDR Source: RSA Conference LIKE THE ANTIVIRUS, THESE ‘SOLUTIONS’ ARE ALL PART OF THE ATTACK SURFACE

10 Oct 2019, Source: ZDNet

7 Oct 2019, Source: thebestvpn 2019 Source: TechCrunch

2011, Source: CSOOnline … RUNNING ON TOP OF VULNERABLE PROCESSORS

Source: https://meltdownattack.com

Source: https://foreshadowattack.eu

Source: https://zombieloadattack.com AND THEY NEED HUMANS & €€€ TO INSTALL, USE AND MAINTAIN

CONFIGURE LOGGING PROPERLY (NO, IT’S NOT A FIRE & FORGET TASK) BUY THREAT FEEDS MONITOR THE HEALTH OF THE SYSTEM (ARE YOU SURE YOU ARE NOT MISSING LOGS?) BUILD AND MAINTAIN TRAIN PEOPLE USE CASES (TO USE SOME OBSCURE QUERY BUY A TIP BUY SOFTWARE LANGUAGE) BUY AN SIEM ADD-ON FOR YOUR COMPLIANCE NEEDS

HIRE DATA BUY HARDWARE MAKE CLUSTERS & BACK-UPS SCIENTISTS RECRUIT SYSADMINS BUY AN INCIDENT RESPONSE PLATFORM BUY SUPPORT BUY PRO SERVICES (BECAUSE YOU NEED NEW PARSERS AND BUY PRO SERVICES YOUR EXISTING PARSERS WILL CONFIGURE ALERTS (BECAUSE THERE ARE ALWAYS ‘EDGE BREAK) (AND HOPE YOUR ANALYSTS WON’T DIE OUT OF CASES’) FALSE POSITIVE FATIGUE) HOUSTON, WE HAVE A SERIOUS LAYER 8 PROBLEM

TRENDING!

THE PERFECT RECIPE FOR INFOBESITY DOOM TOO FRUSTRATION (& BURNOUTS) MANY THINGS TO LEARN FEAR OF THE HUMAN MISSING OUT BRAIN IS NOT A TOO COMPUTER MANY THINGS TO DEFEND CONTINUOUS DISTRACTIONS & CONTINUOUSLY INTERRUPTIONS CHANGING TECH

TOO LITTLE TIME CONTINUOUSLY TO INVESTIGATE CHANGING THREAT LANDSCAPE HANG ON APOLLO! HELP IS ON ITS WAY!

NOPE, ARTIFICIAL INTELLIGENCE IS NOWHERE READY TO HELP US

BREAKING DEEP NEURAL NETWORKS (DNNs) IS VERY EASY

Further reading: Adversarial Reprogramming of Neural Networks, Cornell University

ALGORITHMS ARE CREATED BY ‘FLAWED' HUMANS & TRAINED ON DATA OF VARYING QUALITY WHILE RUNNING ON VULNERABLE PROCESSORS

Source: Nature BREAKING THE FAILURE CYCLE THERE IS NO SILVER BULLET

GROWING TIME TO COMPLEXITY MARKET NO LIABILITY (USE AS-IS BUT DON’T FORGET TO PAY)

(SECURITY) BUGS ARE A DIRECT BYPRODUCT OF MODERN SOFTWARE LIMITED OR DEVELOPMENT NON-EXISTENT REGULATION FLAWED VC MODEL BAD CODING PRACTICES MARKETING IS LACK OF KING TRANSPARENCY AND THINGS ARE GETTING WORSE

The over-complexification of provisioning and deployment pipelines is a dangerous trend. I don't trust the layers upon layers of scripts and tools to not break randomly, and I worry the maintenance cost is getting out of hands. Yes, I'm looking at you, k8s.

Source: Julien Vehent, Firefox Operations Security at @Mozilla, Author of Security DevOps http://securing-devops.com; coder & speaker. WE KNOW THE SOLUTIONS AND THEY REQUIRE COURAGE & HARD WORK

ASK FOR MORE TRANSPARENCY FROM DEMAND EASY-TO-USE VENDORS & SUPPLIERS SOLUTIONS PUSHBACK! LOBBY FOR SOUND REGULATION & LIABILITY DEMAND INTEROPERABILITY LEVERAGE THE POWER OF THE CROWD EMPOWER & HELP LAW ENFORCEMENT (THOSE CRIMINALS MUST BE USE & CONTRIBUTE TO ARRESTED) FREE, OPEN SOURCE SOLUTIONS (WHEN APPLICABLE) PARTICIPATE IN VARIOUS INVEST IN PEOPLE & SKILLS COMMUNITIES & FOSTER TRUE SHARING HELP EACH OTHER OUT (SHOW ME HOW TO DO THIS & I’LL SHOW YOU HOW TO DO THAT) IDENTIFY THE CROWN JEWELS IN YOUR IMPLEMENT PROPER LEARN TO USE WHAT YOU NETWORK (YOU CAN LOSE A LEG BUT NOT A CYBER HYGIENE ALREADY HAVE HEART) (IT REALLY HELPS A LOT!) (AND STOP USING WHAT YOU DON’T NEED) THINK CONSTITUENT

CREATE VALUE