DOCSLIB.ORG

Session 06 Modern Offensive and Defensive Solutions

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Session 06 Modern Offensive and Defensive Solutions Notes Session 06 Modern Offensive and Defensive Solutions Security of Information Systems (SIS) Departamentul de Calculatoare November 2, 2018 1 / 45 Attack and Defense Notes I attack: exploit vulnerabilities I defense: prevent attacks, make attacks difficult, confine attacks I attacker needs to find one security hole I defender has to protect all security holes I attacker invests time I defense mechanisms incur overhead 2 / 45 Attacker Perspective and Mindset Notes I find one vulnerability and build from that I look for something that is valuable I do reconnaisance, look for weak spots I create an attack chain I use every trick in the book I start from existing knowledge 3 / 45 Defender Perspective and Mindset Notes I protect all entry points I users are vulnerable, as well as technology I use multiple defensive layers I monitor, be proactive I discipline, best practices are worth more than skills I invest more on valuable targets 4 / 45 Attacker Pros/Cons Notes I apart from ethical hackers, security researchers, it's a shady business I you may not need skills, just a weak target and a database of attack vectors I you may get caught I you only need to find one spot I possible great gains I little time for fame (annonymous) I the Internet gives you tons of targets I but many targets give little more than fun 5 / 45 Defender Pros/Cons Notes I less resources (time) than an attacker I must think of everything I is being paid constructively I you have a purpose: keep the system running I it never ends 6 / 45 Honeypots Notes I baits I a system appearing as vulnerable but closely monitored I deflect, change attention and collect attacker information 7 / 45 Evolution of Application Security Notes I buffer overflows I shellcodes I memory protection (DEP, WX)^ I memory randomization I canaries I code reuse I CFI (Control Flow Integrity) I memory safety, safe programming languages I static and dynamic analysis I hardware enhanced security 9 / 45 Fine-grained ASLR Notes I https://dl.acm.org/citation.cfm?id=2498135 I issue with ASLR: memory disclosure / information leak I one address leaked reveals all information I do it at page level I one leak may lead to other leaks that are chained together 10 / 45 SafeStack Notes I https://clang.llvm.org/docs/SafeStack.html I part of the Code Pointer Integrity project: http://dslab.epfl.ch/proj/cpi/ I moves sensitive information (such as return addresses) on a safe stack, leaving problematic ones on the unsafe stack I reduced overhead, protects against stack buffer overflows I microStache: https://www.springerprofessional.de/en/ microstache-a-lightweight-execution-context-for-in-process-safe-/ 16103742 11 / 45 Address Sanitizer Notes I ASan I https: //research.google.com/pubs/archive/37752.pdf I https://github.com/google/sanitizers/ I instruments code I only useful in development I detects out-of-bounds bugs, memory leaks 12 / 45 CFI/CPI Notes I https://dl.acm.org/citation.cfm?id=1102165 I https://www.usenix.org/node/186160 I http://dslab.epfl.ch/proj/cpi/ I coarse-grained CFI vs fine-grained CFI I Control Flow Integrity, Code Pointer Integrity I protect against control flow hijack attacks I CPI is weaker than CFI but more practical (reduced overhead) I CPI protects all code pointers, data based attacks may still happen I CPS (Code Pointer Separation) is a weaker yet more practical for of CPI 13 / 45 Shellcodes Notes I difficult to inject due to DEP, small buffers and input validation I preliminary parts of the attack may remap memory region I shellcode may do stack pivoting and then load another shellcode I alphanumeric shellcodes: still need a binary address to bootstrap 14 / 45 Code Reuse Notes I bypass DEP by using existing pieces of code I code gadgets I used in ROP (Return-Oriented Programming) and JOP (Jump-Oriented programming) 15 / 45 Return-Oriented Programming Notes I gadgets ending in ret I may be chained together to form an attack I Turing-complete languge I http://www.suse.de/~krahmer/no-nx.pdf I https://dl.acm.org/citation.cfm?id=2133377 I most common way of creating runtime attack vectors I JOP: https://dl.acm.org/citation.cfm?id=1966919 I gadgets end up in an indirect branch not a ret 16 / 45 Anti-ROP Defense Notes I prevent atacks I SafeStack I CFI/CPI, ASan I Microsoft CFG, RFG I detect attacks I Microsoft EMET (Enhanced Mitigation Experience Toolkit), ProcessMitigations module 17 / 45 Data-Oriented Attacks Notes I https://www.usenix.org/node/190963 I https://huhong-nus.github.io/advanced-DOP/ I overwrites data, not code pointers I bypasses CFI 18 / 45 Evolution of OS Security Notes I traditional main goals: functionality and reduced overhead I recent focus on OS security: plethora of devices and use cases I malware may easily take place among legitimate applications I kernel exploits become more common I OS virtualization, reduce TCB to hypervisor I include hardware-enforced security features 20 / 45 Mandatory Access Control Notes I opposed to Discretionary Access Control, where owner controls permissions I system-imposed settings I increased, centralized security I difficult to configure and maintain I rigid, non-elastic I Bell-LaPadula Model: http: //csrc.nist.gov/publications/history/bell76.pdf I SELinux, TrustedBSD, Mandatory Integrity Control 21 / 45 Role-Based Access Control Notes I https: //ieeexplore.ieee.org/abstract/document/485845 I https://dl.acm.org/citation.cfm?id=266751 I aggregate permissions into roles I role assignment, role authorization, permission authorization I useful in organizations 22 / 45 Sandboxing Notes I assume application may be malware I reduce potential damage I confine access to a minimal set of allowed actions I typically implemented at sandbox level (kernel enforced) I iOS sandboxing, Linux seccomp 23 / 45 Application Signing Notes I ensure application is validated I used by application stores and repositories: GooglePlay, Apple AppStore I device may not run non-signed apps 24 / 45 iOS Jekyll Apps Notes I https: //www.usenix.org/conference/usenixsecurity13/ technical-sessions/presentation/wang_tielei I apparently legimitate iOS app I bypasses Apple vetting I obfuscates calls to private libraries (part of the same address space, fixed from iOS 7) I once installed turns out to be malware I exfiltrates private data, exploits vulnerabilities 25 / 45 Jailreaking/Rooting Notes I https://dl.acm.org/citation.cfm?id=3196527 I get root access on a device I close to full control I requires a critical vulnerability that gets root access I tethered (requires re-jailbreaking after reboot) cs non-tethered I essential for security researchers 26 / 45 Hardware-centric Attacks Notes I side channels I undocumented hardware features I imperfect hardware features that leak information I proprietary features that get exploited I hardware is part of TCB, reveals kernel memory 27 / 45 Sidechannel Attacks Notes I do not exploit vulnerabilities in applications or kernel code I mostly use features such as 28 / 45 x86 Instruction Fuzzing Notes I https://www.blackhat.com/docs/us-17/thursday/ us-17-Domas-Breaking-The-x86-Instruction-Set-wp. pdf I https://github.com/xoreaxeaxeax/sandsifter I https://i.blackhat.com/us-18/Thu-August-9/ us-18-Domas-God-Mode-Unlocked-Hardware-Backdoors-In-x86-CPUs. pdf I instruction of length N is placed at the end of the page I creates a fuzzer for the x86 instruction set I found glitches, hidden instructions 29 / 45 IME Notes I Intel Management Engine I AMD Secure Techonology I hardware features and highly proprietary firmware I https://www.theverge.com/2018/1/3/16844630/ intel-processor-security-flaw-bug-kernel-windows-linux I user space app could access kernel space memory access I accused of being a backdoor to the system 30 / 45 rowhammer Attack Notes I https://users.ece.cmu.edu/~yoonguk/papers/ kim-isca14.pdf I https://www.vusec.net/projects/drammer/ I https://googleprojectzero.blogspot.com/2015/03/ exploiting-dram-rowhammer-bug-to-gain.html I https://www.blackhat.com/docs/us-15/materials/ us-15-Seaborn-Exploiting-The-DRAM-Rowhammer-Bug-To-Gain-Kernel-Privileges. pdf I hardware fault in DRAM chips I constant bit flip pattern in certain rows can cause a flip in another row (not belonging to the current process) I may be exploited to get root access 31 / 45 Spectre and Meltdown Notes I https://meltdownattack.com I https://www.usenix.org/system/files/conference/ usenixsecurity18/sec18-lipp.pdf I application may access data from another application I Meltdown exploits a hardware race condition allowing an unprivileged process to read privileged data I Spectre does a side channel attack on speculative execution features of modern CPUs I hardware fixes by Intel, software solutions 32 / 45 KPTI Notes I Kernel Page Table Isolation I https://lwn.net/Articles/741878/ I place kernel in separate address space I mitigation against hardware-centric attacks 33 / 45 Hypervisor Attacks Notes I https://dl.acm.org/citation.cfm?id=2484406 I attack/compromise hypervisor, get control of VMs I may exploit a vulnerability in the hypercall interface or may exploit a hardware bug I hyperjacking 34 / 45 Evolution of Web Security Notes I path traversals, misconfigurations I injections I XSS I misconfiguration I unsafe communication I application/language bugs 36 / 45 Secure Communication Notes I provide secure communication between client and server I HTTPS everywhere I Secure Cookie I strong encryption, strong protocols 37 / 45 Attacks on Security Protocols Notes I https://tools.ietf.org/html/rfc7457 I https://www.mitls.org/pages/attacks I flaws in protocol logic I cryptographic design
Load more

Recommended publications
  • Alcatel-Lucent Security Advisory Sa0xx
    Alcatel-Lucent Security Advisory No. SA0053 Ed. 04 Information about Poodle vulnerability Summary POODLE stands for Padding Oracle On Downgraded Legacy Encryption. The POODLE has been reported in October 14th 2014 allowing a man-in-the-middle attacker to decrypt ciphertext via a padding oracle side-channel attack. The severity is not considered as the same for Heartbleed and/or bash shellshock vulnerabilities. The official risk is currently rated Medium. The classification levels are: Very High, High, Medium, and Low. The SSLv3 protocol is only impacted while TLSv1.0 and TLSv1.2 are not. This vulnerability is identified CVE- 2014-3566. Alcatel-Lucent Enterprise voice products using protocol SSLv3 are concerned by this security alert. Openssl versions concerned by the vulnerability: OpenSSL 1.0.1 through 1.0.1i (inclusive) OpenSSL 1.0.0 through 1.0.0n (inclusive) OpenSSL 0.9.8 through 0.9.8zb (inclusive) The Alcatel-Lucent Enterprise Security Team is currently investigating implications of this security flaw and working on a corrective measure, for OpenTouch 2.1.1 planned in Q4 2015, to prevent using SSLv3 that must be considered as vulnerable. This note is for informational purpose about the padding-oracle attack identified as “POODLE”. References CVE-2014-3566 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566 Advisory severity CVSS Base score : 4.3 (MEDIUM) - AV:N/AC:M/Au:N/C:P/I:N/A:N https://www.openssl.org/news/secadv_20141015.txt https://www.openssl.org/~bodo/ssl-poodle.pdf Description of the vulnerabilities Information about Poodle vulnerability (CVE-2014-3566).
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Combat Top Security Vulnerabilities: HPE Tippingpoint Intrusion
    Business white paper Combat top security vulnerabilities HPE TippingPoint intrusion prevention system Business white paper Page 2 The year 2014 marked a new pinnacle for hackers. Vulnerabilities were uncovered in some of the most widely deployed software in the world—some of it in systems actually intended to make you more secure. HPE TippingPoint next-generation intrusion prevention system (IPS) and next-generation firewall (NGFW) customers rely on us to keep their networks safe. And when it comes to cyber threats, every second matters. So how did HPE TippingPoint do? This brief highlights the top security vulnerabilities of 2014—the ones that sent corporate security executives scrambling to protect their businesses. And it describes how HPE TippingPoint responded to keep our customers safe. Heartbleed—HPE TippingPoint intrusion prevention system stops blood flow early Any vulnerability is concerning, but when a vulnerability is discovered in software designed to assure security, it leaves businesses exposed and vulnerable. That was the case with the Heartbleed vulnerability disclosed by the OpenSSL project on April 7, 2014. They found the vulnerability in versions of OpenSSL—the open-source cryptographic library widely used to encrypt Internet traffic. Heartbleed grew from a coding error that allowed remote attackers to read information from process memory by sending heartbeat packets that trigger a buffer over-read. As a demonstration of the vulnerability, the OpenSSL Project created a sample exploit that successfully stole private cryptography keys, user names and passwords, instant messages, emails, and business-critical documents and communications. We responded within hours to protect TippingPoint customers. On April 8, we released a custom filter package to defend against the vulnerability.
    [Show full text]
  • IBM X-Force Threat Intelligence Quarterly, 1Q 2015
    IBM Security Systems March 2015 IBM X-Force Threat Intelligence Quarterly, 1Q 2015 Explore the latest security trends—from “designer vulns” to mutations in malware— based on 2014 year-end data and ongoing research 2 IBM X-Force Threat Intelligence Quarterly 1Q 2015 Contents Executive overview 2 Executive overview When we look back in history to review and understand the past year, you can be assured it will be remembered as a year of 4 Roundup of security incidents in 2014 significant change. 11 Citadel, the financial malware that continues to adapt In early January 2014, companies large and small scrambled to Are mobile application developers for Android putting their 14 better understand and analyze a major retail breach that left users at risk? them asking whether or not their own security measures would 17 Shaking the foundation: Vulnerability disclosures in 2014 survive the next storm. Before spring was barely in motion, we had our first taste of the “designer vuln”—a critical 21 About X-Force vulnerability that not only proved lethal for targeted attacks, 22 Contributors but also had a cleverly branded logo, website and call-name (or handle) that would forever identify the disclosure. 22 For more information 23 Footnotes These designer vulns appeared within long-held foundational frameworks used by the majority of websites, and they continued throughout 2014, garnering catchy name after catchy name—Heartbleed, Shellshock, POODLE, and into 2015, Ghost and FREAK. This in and of itself raises the question of what it takes for a vulnerability to merit a marketing push, PR and logo design, while the other thousands discovered throughout the year do not.
    [Show full text]
  • TLS Attacks & DNS Security
    IAIK TLS Attacks & DNS Security Information Security 2019 Johannes Feichtner [email protected] IAIK Outline TCP / IP Model ● Browser Issues Application SSLStrip Transport MITM Attack revisited Network Link layer ● PKI Attacks (Ethernet, WLAN, LTE…) Weaknesses HTTP TLS / SSL FLAME FTP DNS Telnet SSH ● Implementation Attacks ... ● Protocol Attacks ● DNS Security IAIK Review: TLS Services All applications running TLS are provided with three essential services Authentication HTTPS FTPS Verify identity of client and server SMTPS ... Data Integrity Detect message tampering and forgery, TLS e.g. malicious Man-in-the-middle TCP IP Encryption Ensure privacy of exchanged communication Note: Technically, not all services are required to be used Can raise risk for security issues! IAIK Review: TLS Handshake RFC 5246 = Establish parameters for cryptographically secure data channel Full handshake Client Server scenario! Optional: ClientHello 1 Only with ServerHello Client TLS! Certificate 2 ServerKeyExchange Certificate CertificateRequest ClientKeyExchange ServerHelloDone CertificateVerify 3 ChangeCipherSpec Finished ChangeCipherSpec 4 Finished Application Data Application Data IAIK Review: Certificates Source: http://goo.gl/4qYsPz ● Certificate Authority (CA) = Third party, trusted by both the subject (owner) of the certificate and the party (site) relying upon the certificate ● Browsers ship with set of > 130 trust stores (root CAs) IAIK Browser Issues Overview Focus: Relationship between TLS and HTTP Problem? ● Attacker wants to access encrypted data ● Browsers also have to deal with legacy websites Enforcing max. security level would „break“ connectivity to many sites Attack Vectors ● SSLStrip ● MITM Attack …and somehow related: Cookie Stealing due to absent „Secure“ flag… IAIK Review: ARP Poisoning How? Attacker a) Join WLAN, ● Sniff data start ARP Poisoning ● Manipulate data b) Create own AP ● Attack HTTPS connections E.g.
    [Show full text]
  • The Software Vulnerability Ecosystem: Software Development in the Context of Adversarial Behavior
    University of Pennsylvania ScholarlyCommons Publicly Accessible Penn Dissertations 2016 The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Saender Aren Clark University of Pennsylvania, [email protected] Follow this and additional works at: https://repository.upenn.edu/edissertations Part of the Databases and Information Systems Commons, and the Engineering Commons Recommended Citation Clark, Saender Aren, "The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior" (2016). Publicly Accessible Penn Dissertations. 2233. https://repository.upenn.edu/edissertations/2233 This paper is posted at ScholarlyCommons. https://repository.upenn.edu/edissertations/2233 For more information, please contact [email protected]. The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Abstract Software vulnerabilities are the root cause of many computer system security fail- ures. This dissertation addresses software vulnerabilities in the context of a software lifecycle, with a particular focus on three stages: (1) improving software quality dur- ing development; (2) pre- release bug discovery and repair; and (3) revising software as vulnerabilities are found. The question I pose regarding software quality during development is whether long-standing software engineering principles and practices such as code reuse help or hurt with respect to vulnerabilities. Using a novel data-driven analysis of large databases of vulnerabilities, I show the surprising result that software quality and software security are distinct. Most notably, the analysis uncovered a counterintu- itive phenomenon, namely that newly introduced software enjoys a period with no vulnerability discoveries, and further that this “Honeymoon Effect” (a term I coined) is well-explained by the unfamiliarity of the code to malicious actors.
    [Show full text]
  • Exploit Kits, Which Seemed Nearly Dormant Last Year Following the Demise of Illicit Cryptocurrency Mining, the Hot New Thing in 2018, Appear to Be Making a Comeback
    2020 TRUSTWAVE GLOBAL SECURITY REPORT Table of Contents Introduction ........................ 3 Threat Intelligence .................22 Email Threats ......................... 23 Executive Summary ................. 4 Extortion Scams ....................... 25 Data Compromises ..................... 4 Archive Mutant Tricks .................. 28 Email Threats .......................... 6 Multi-Stage Phishing Using Web Attacks ........................... 8 Trusted Cloud Providers ................ 29 Exploits ............................... 8 Office 365 Account Phishing ............30 Malware ............................... 9 Emotet: The Threat is in the Mail ......... 33 Database and Network Security ......... 10 Web Attacks .......................... 36 Database Compromise ...............11 Humans: The Lowest Hanging Fruit ....... 38 Compromise Demographics ..............11 Exploits .............................. 39 Compromises Per Environment ...........14 Finding Insights Through Trustwave Fusion ......................44 Environments Compromised by Industry ............................15 Malware ..............................46 Compromises by Region .................17 More and More Magecart ...............50 Compromise Duration ...................18 The State of Security ............... 51 Methods of Compromise .................19 Data Security ......................... 52 Sources of Detection ...................20 Network Security ...................... 56 Contributors ....................... 59 2 Introduction Welcome to the 2020 Trustwave
    [Show full text]
  • Olson's Standard Poodles
    Sun-Golden Kennels STANDARD POODLE PUPPY PURCHASE AGREEMENT LIMITED REGISTRATION BREEDER/Seller: Mike or Sharon Long 7812 N. Longview Ct. Edgerton, WI. 53534 608-884-4000 [email protected] www.sungoldenkennels.com Definitions used herein include: "BUYER" shall herein be define as: ___________________________ BREEDER" or “SELLER” Shall herein be defined as: Mike or Sharon Long "PUPPY" shall herein be defined as “A PUPPY”, registered with the American Kennel Club (AKC) with the registered name of: SHARMIK’S________________________________ AKC Litter registration # PRXXXXXX Sire: AKC #PRXXXXXX Reg Name ____________________________________ Dam: AKC# PRXXXXXX Reg Name ___________________________________ The Sun-Golden Standard Poodle described above is sold for the sum of $1000.00 Payment to be made in full with cash or visa/mc. A pet puppy is defined here to be a Standard Poodle puppy which is in good health at the time of sale, and embodies the characteristics of the Standard Poodle breed. This puppy is purebred and the litter has been (registered) with the American Kennel Club. The Parents of this Puppy have had OFA x-rays to establish that they are free of Hip Dysplasia, Elbow disease, Heart disease and Eye disease The puppy is registered with a limited registration, which will prohibit breeding and registering offspring. The BUYER agrees this PUPPY is to be spayed/neutered at the appropriate age of (9-12 months) allowing for some sexual maturity of the pup which is necessary for their development. Veterinarian confirmation of this procedure must be supplied to the BREEDER by the time the pup is 1year of age or the contract is null and void.
    [Show full text]
  • Check-Point-2015-Security-Report
    2015 SECURITY REPORT CHECK POINT 2015 SECURITY REPORT 01 INTRODUCTION AND METHODOLOGY 04 02 UNKNOWN MALWARE: THE VAST UNKNOWN 10 03 KNOWN MALWARE: KNOWN AND DANGEROUS 18 04 MOBILE SECURITY: DON’T FENCE ME IN 32 05 APPLICATIONS: GETTING YOU WHERE IT HURTS 40 06 DATA LOSS: LIKE SAND THROUGH THE HOUR GLASS 48 07 CONCLUSION AND RECOMMENDATIONS: 56 THE PATH TO PROTECTION REFERENCES 60 CHECK POINT - 2015 SECURITY REPORT | 3 01 INTRODUCTION AND METHODOLOGY “The first time you do something, it’s science. The second time you do something, it’s engineering.” 1 –Clifford Stoll, astronomer, author, digital forensics pioneer CHECKINTRODUCTION POINT - 2015 AND SECURITY METHODOLOGY REPORT | 4 THE EVOLUTION OF MALWARE THE SECURITY LANDSCAPE | ACCELERATION OF OF MALWARE 25 YEARS AGO 20 YEARS AGO 15 YEARS AGO 10 YEARS AGO 5 YEARS AGO NOW Invention of Invention of Prevalent Use URL Filtering, NGFW Threat Intelligence, Firewall Stateful of Anti-Virus, UTM Threat Prevention, Inspection VPN, IPS Mobile Security > 1988 1994 1998 2003 2006 2010 2014 2020 Morris Worm Green Card Lottery Melissa Anonymous WikiLeaks DDoS Bitcoin IoT Everywhere Formed Attacks: Stuxnet SCADA 2000 2007 2013 2017 I Love You Zeus Trojan Dragonfly Driverless Cars Hacked? 2011 Stolen Authentication 2012 Information Flame Malware In science, it’s all about discovery—studying cause other mobile devices might not be tools, per se, but and effect. Once something is understood and can be they can be hijacked to give hackers the ability to predicted, it then becomes a process of engineering, penetrate corporate networks. to replicate. In the world of cyber threats, it’s the same.
    [Show full text]
  • Mission Accomplished? HTTPS Security After Diginotar
    Mission Accomplished? HTTPS Security after DigiNotar Johanna Amann* ICSI / LBL / Corelight Oliver Gasser* Technical University of Munich Quirin Scheitle* Technical University of Munich Lexi Brent The University of Sydney Georg Carle Technical University of Munich Ralph Holz The University of Sydney * Joint First Authorship Internet Measurement Conference (IMC) 2017 TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public Key Pinning) • SCSV (TLS Fallback Signaling Cipher Suite Value) • CAA (Certificate Authority Authorization) • DANE-TLSA (DNS Based Authentication of Named Entities) Methodology • Active & passive scans • Shared pipeline where possible • Active measurements from 2 continents • Largest Domain-based TLS scan so far • More than 192 Million domains • Passive measurements on 3 continents • More than 2.4 Billion observed TLS connections Certificate Transparency CA Issues Certificates Provides publicly auditable, append-only Log of certificates CT Log Also provides proof of inclusion Browser Verifies Proof of Inclusion Certificate Transparency CT Log CA Webserver Browser Certificate Transparency CT Log CA Certificate Webserver Browser Certificate Transparency CT Log CA Certificate Certificate Webserver Browser Certificate Transparency CT Log CA SCT Certificate Certificate Webserver Browser Certificate Transparency CT Log CA SCT Certificate Certificate Webserver Browser Certificate, SCT in TLS Ext. Certificate Transparency CT Log CA Webserver Browser Certificate Transparency Precertificate
    [Show full text]
  • Threat Intelligence Report
    THREAT INTELLIGENCE REPORT 2019 REWTERZ – THREAT INTELLIGENCE REPORT 2019 EXECUTIVE SUMMARY Rewterz Threat Intelligence Report 2019 includes findings of our Security Operations Centers (SOC) that monitored and identified cyberattacks and analyzed global cyber security threats through our threat intelligence-gathering platform. Our team brings forth this valuable real-time data to equip organizations against cyber-attacks beforehand. Rewterz Threat Intelligence Platform utilizes numerous attack sensors collecting data of malicious events from global threat feeds, making it the most comprehensive and advanced threat intelligence gathering network in the country. With evolution in cybercrimes, safeguarding your sensitive information needs to be prioritized to save the integrity, availability and confidentiality of your organization. To cope with growing techniques of cyber-crimes, our SOC team uses most advanced threat intelligence and manages the real-time data of threat landscape through our Security Orchestration Automation and Response (SOAR) platform, SIRP. Our orchestration and automation platform helps reduce the redundant processes of incident handling and lets analysts focus on more complex tasks. SIRP automates the usage of Threat Intelligence data for our SOC teams, equipping them for smooth incident handling, vulnerability management, access control regulation and risk management, meanwhile saving considerable amount of their time. Rewterz has now mastered the art of threat intelligence and is ready to help you proactively fortify your defenses and mitigate threats. Through this report, we aim to share and dissipate knowledge about sophisticated threats and advanced attacker practices in use on the Internet today. This report enables readers to gain clear insight on the nature of the threats currently faced by organizations operating in the cyber world.
    [Show full text]
  • Exploiting Host-Based Vulnerabilities
    Exploiting Host-Based Vulnerabilities • Exploit Windows-Based Vulnerabilities • Exploit *nix-Based Vulnerabilities Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 1 Commonalities Among Windows-Based Vulnerabilities (Slide 1 of 2) • OSs and most applications based on C, which has no default bounds-checking. • Susceptible to buffer overflows, arbitrary code execution, and privilege escalation. • Developers need to use security best practices and unit testing. • Proprietary product, so source code is not publicly available. • Fewer reviews open the door for undiscovered weaknesses. • Complexity enables vulnerabilities to remain undetected after release. • Microsoft doesn’t patch all vulnerabilities—they release new versions. • This leaves the vulnerability unaddressed in older installations. Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 2 Commonalities Among Windows-Based Vulnerabilities (Slide 2 of 2) • Servers: Network-based vulnerabilities; workstations: Application-based vulnerabilities. • Uses standard protocols and technologies. • Susceptible to cross-platform exploits. • Physical access puts hosts at greater risk. • Connecting cables to administrative console ports. • Booting to a different OS. • Using removable media. • Stealing and damaging hardware. • Social engineering is required to expose certain vulnerabilities. Copyright (c) 2018 CompTIA Properties, LLC. All Rights Reserved. | CompTIA.org 3 Windows Operating System Vulnerabilities Category Description Remote code execution Any condition that allows attackers to execute arbitrary code. Buffer or heap overflow A programming error that allows attackers to overwrite allocated memory addresses with malicious code. Denial of service Any condition that allows attackers to use resources so that legitimate requests can’t be served. A programming error that allows attackers to access a program’s memory space and hijack the normal Memory corruption execution flow.
    [Show full text]