RSA USA 2015 - Getting a Jump on Hackers
Download as PPTX, PDF1 like701 views
The document discusses the persistent threats posed by hackers who exploit vulnerabilities in systems, emphasizing the importance of addressing known issues like unpatched software, particularly Java. It recommends continuous perimeter scanning, maintaining an updated software inventory, and implementing two-factor authentication to improve cybersecurity. Additionally, it highlights that most vulnerabilities are old and can be mitigated through proactive security measures and user education.
RSA USA 2015 - Getting a Jump on Hackers
- 1. SESSION ID: #RSAC Wolfgang Kandek Getting a Jump on Hackers Tech-T08 CTO Qualys @wkandek
- 2. #RSAC Hackers Attack your Organization by continuously probing your organization for weaknesses. Find and catalog vulnerabilities, software flaws and misconfigurations Use exploits to gain control over your systems
- 3. #RSAC Hackers – Attack Perimeter
- 4. #RSAC Hackers We can get a jump on them by using their weak spots. Weak Spots: Millions of Malware samples Thousands of Vulnerabilities Tens of Exploitation vectors
- 5. #RSAC Hackers Mass Malware APT and 0-days Nation State
- 6. #RSAC Hackers – Mass Malware Majority of all attacks Mature technologies (on both sides) Exploit Kits (Angler, Nuclear, …) Analysis and Patching “Digital Carelessness” Research
- 7. #RSAC Hackers – Mass Malware BSI – German Bundesamt für Sicherheit in der Informationstechnik Digital Situation Report December 2014 Situation is critical Digitale Sorglosigkeit => “Digital Carelessness” 95% of issues are easily addressed Attackers use known vulnerabilities In a limited set of software
- 8. #RSAC Hackers – Mass Malware BSI – German Bundesamt für Sicherheit in der Informationstechnik Digital Situation Report December 2014 Situation is critical Digitale Sorglosigkeit => “Digital Carelessness” 95% of issues are easily addressed Attackers use known vulnerabilities In a limited set of software
- 9. #RSAC Hackers – Mass Malware - Java Java is on our top unpatched threat for the year
- 10. #RSAC Hackers – Mass Malware - Java Java is on our top unpatched threats for the year BTW, attacks are on desktop not serverside Java We can’t patch Java Our business critical timecard application requires it.. Yes, you can. Oracle Java v7 and v8 have a “Java Router” embedded Multiple Javas on a machine can be selectively deployed Deployment Rulesets - by URL, by checksum, by…
- 11. #RSAC Hackers – Mass Malware - Java Java is on our top unpatched threats for the year BTW, attacks are on desktop not serverside Java We can’t patch Java Our business critical timecard application requires it.. Yes, you can. Oracle Java v7 and v8 have a “Java Router” embedded Multiple Javas on a machine can be selectively deployed
- 12. #RSAC Hackers – Mass Malware - Java Demo
- 13. #RSAC Hackers – APT and 0-days 0-days in 2014/2015 2x Windows in 2014 4x Internet Explorer in 2014, 1x2015 4x Adobe Flash in 2015 Use Safe Neighborhood Software Alternative OS: Mac OS X Alternative Browser: Chrome
- 14. #RSAC Hackers – APT and 0-days Alternative Browser: Chrome 60% Marketshare 220 critical vulnerabilities in 2012-2014 0 known attacks Aggressive Autoupdate & Fast Patching: 24 hours to 7 days Faster than typical exploits Sandboxing
- 15. #RSAC Hackers – VDBIR 2015 Few Vulnerabilities are being exploited – 40 in 2014 99.9% of Vulnerabilities exploited are > 1 year old 50% of 2014 CVE exploits happened within 2 weeks Lesson: Patch all, decide which to patch faster (pg 17) Exploitable Attribute: most important factor (pg 17)
- 16. #RSAC Hackers – APT and 0-days 0-days in 2014/2015 2x Windows in 2014 4x Internet Explorer in 2014,1x2015 4x Adobe Flash in 2015 Use Safe Neighborhood Software Alternative OS: Mac OS X Alternative Browser: Chrome Alternative Flash: HTML5? Sandbox: Chrome/Flash combo not attacked
- 17. #RSAC Hackers – APT and 0-days Sandboxing Jarno Niemela’s (F-Secure) VB 2013 Paper 930 APT malwares against Hardening
- 18. #RSAC Hackers – APT and 0-days Sandboxing Jarno Niemela’s (F-Secure) VB 2013 Paper 930 APT malwares against Hardening 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% System Hardening Application Hardening Sandboxie EMET Exploit Mitigations
- 19. #RSAC Hackers – APT and 0-days Sandboxing Jarno Niemela’s (F-Secure) VB 2013 Paper 930 APT malwares against Hardening Sandbox testing not conclusive Application Hardening and EMET are free
- 20. #RSAC Hackers – APT and 0-days But APT means attacker can do anything Bypass your Hardening, the Sandbox, EMET… How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed
- 21. #RSAC Hackers – APT and 0-days But APT means attacker can do anything How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed
- 22. #RSAC Hackers – APT and 0-days But APT means attacker can do anything How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed 7 skill categories
- 23. #RSAC Hackers – APT and 0-days But APT means attacker can do anything How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed 7 skill categories
- 24. #RSAC Hackers – APT and 0-days But APT means attacker can do anything How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed 7 skill categories Mixed results 50% trivial, 50% advanced All (!) attacked only 1 software version – Office 2010 (SP2, 32bit)
- 25. #RSAC Hackers – APT and 0-days But APT means attacker can do anything How good are they? Sophos: CVE-2014-1761 (Word RTF) analysis 15+ sample families assessed 7 skill categories Mixed results 50% trivial, 50% advanced
- 26. #RSAC Hackers – APT and 0-days Dan Guido – Exploit Intelligence Project Focus on robust configurations to prevent future exploits Few vulnerabilities are relevant: 14 in 2009, 13 in 2010 20 in 2014 Tighter Security Settings defeat new attacks DEP, ASLR EMET (btw, all IE 0-days in 2014) Disable EXE/Javascript in PDF Limit Java to internal Applications
- 27. #RSAC Hackers – APT and 0-days Dan Guido – Exploit Intelligence Project Focus on robust configurations to prevent future exploits Few vulnerabilities are relevant: 14 in 2009, 13 in 2010 20 in 2014 Tighter Security Settings defeat new attacks DEP, ASLR EMET (all IE 0-days in 2014) Disable EXE/Javascript in PDF
- 28. #RSAC Hackers – APT and 0-days Harden Applications and deploy EMET Safer Neighbourhoods - Alternative Technology stacks Limit Java to internal/known Applications – Deployment Rulesets
- 29. #RSAC Hackers – Attack Perimeter
- 30. #RSAC Hackers – Attack Perimeter
- 31. #RSAC Hackers – Attack Perimeter Perimeter is everywhere Mobility, Personal Devices SaaS Applications enable Security Pros All Machines Internet hardened No Client/Peer networking = no malware lateral growth Security Cons Traditional Non-Internet Tools challenged Internet Agent Solutions
- 32. #RSAC Hackers – Attack Perimeter
- 33. #RSAC Hackers – Attack Perimeter
- 34. #RSAC Hackers - Credentials Abuse worldwide connectivity (e-mail, mobile workstations, VPN) Steal credentials through phishing attacks (e-mail) Install undetectable malware Access VPNs
- 35. #RSAC Hackers - Credentials Abuse worldwide connectivity (e-mail, mobile workstations, VPN) Steal credentials through phishing attacks (e-mail) Install undetectable malware Access VPNs
- 36. #RSAC Hackers - Credentials Teach users to recognize attacks – ✔ Require better passwords – ✔ But limited effect > 2% will still click Password reuse rampant due to complicated rules Massive username/password databases available
- 37. #RSAC Hackers - Credentials Teach users to recognize attacks – ✔ Require better passwords – ✔ But limited effect > 2% will still click Password reuse rampant due to complicated rules Massive username/passworddatabases available
- 38. #RSAC Hackers - Credentials Teach users to recognize attacks – ✔ Require better passwords – ✔ But limited effect > 2% will still click Password reuse rampant due to complicated rules Massive username/password databases available Password decoding/guessing in the realm of all attackers.
- 39. #RSAC Hackers - Credentials Two factor authentication
- 40. #RSAC Hackers - Credentials Two factor authentication
- 41. #RSAC Hackers - Credentials Teach users to recognize attacks – ✔ Require better passwords – ✔ Teach your users to protect their own personal data Banks, E-mail, Linkedin 2FA is mature now Implement 2FA for your systems
- 42. #RSAC Act Now – x days x=30: Scan your Perimeter Server continuously, alert on changes x=60: Software inventory for Flash,Reader,IE,Office,Java x=90: Update versions – Mass Malware cure x=90+: Address Vulnerabilities Quickly x=90+: Harden Setup - APT and 0-days Newest Software, Use EMET, Safe neighborhoods x=90+: Authentication - Deploy 2-Factor Then: Watch Logs for Anomalies, Run Sandboxes