Iftach Ian Amit | November 2011                Advanced Data Exfiltration                The way Q would have done it      ...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      whoami All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      Agenda All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      Agenda All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      Agenda All rights reserved to Securit...
Iftach Ian Amit | November 2011                                                      Agenda All rights reserved to Securit...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   4Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   5Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   5Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   5Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   5Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   5Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   6Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   7Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   8Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   8Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   8Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   8Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   9Wednesday, December 7, 11
Iftach Ian Amit | November 2011                    •       eMails, web links,                            phishing... All r...
Iftach Ian Amit | November 2011                    •       eMails, web links,                            phishing...      ...
Iftach Ian Amit | November 2011                    •       eMails, web links,                            phishing...      ...
Iftach Ian Amit | November 2011                    •       eMails, web links,                            phishing...      ...
Iftach Ian Amit | November 2011                    •       eMails, web links,                            phishing...      ...
Iftach Ian Amit | November 2011           And... being nice/nasty/           obnoxious/needy always           helps! All r...
Iftach Ian Amit | November 2011           And... being nice/nasty/           obnoxious/needy always           helps! All r...
Iftach Ian Amit | November 2011           And... being nice/nasty/           obnoxious/needy always           helps! All r...
Iftach Ian Amit | November 2011           And... being nice/nasty/           obnoxious/needy always           helps! All r...
Iftach Ian Amit | November 2011           And... being nice/nasty/           obnoxious/needy always           helps! All r...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   11Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   11Wednesday, December 7, 11
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011                                                      Internet                             ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   12Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   12Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   12Wednesday, December 7, 11
Iftach Ian Amit | November 2011        What is the        target “willing”        to tell about        itself? All rights ...
Iftach Ian Amit | November 2011        What is the        target “willing”        to tell about        itself? All rights ...
Iftach Ian Amit | November 2011        What is the        target “willing”        to tell about        itself? All rights ...
Iftach Ian Amit | November 2011                               Who’s your daddy?                        And buddy, and frie...
Iftach Ian Amit | November 2011                               Who’s your daddy?                        And buddy, and frie...
Iftach Ian Amit | November 2011                               Who’s your daddy?                        And buddy, and frie...
Iftach Ian Amit | November 2011                               Who’s your daddy?                        And buddy, and frie...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   15Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   15Wednesday, December 7, 11
Iftach Ian Amit | November 2011                Select your target wisely                          And then craft your payl...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   17Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   17Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   17Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   17Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   17Wednesday, December 7, 11
Iftach Ian Amit | November 2011      • ZeuS: $3000-$5000      • SpyEye: $2500-$4000      • Limbo: $500-$1500 All rights re...
Iftach Ian Amit | November 2011      • ZeuS: $3000-$5000                      E!                    RE      • SpyEye: $250...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   18Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   18Wednesday, December 7, 11
Iftach Ian Amit | November 2011     Experienced travelers     know the importance      of packing properly All rights rese...
Iftach Ian Amit | November 2011     Experienced travelers     know the importance      of packing properly All rights rese...
Iftach Ian Amit | November 2011                 • File servers                 • Databases                 • File types   ...
Iftach Ian Amit | November 2011              Mass infection:                                    APT:              5-6 days...
Iftach Ian Amit | November 2011              Mass infection:                                    APT:              5-6 days...
Iftach Ian Amit | November 2011              Mass infection:                                    APT:              5-6 days...
Iftach Ian Amit | November 2011                                          PATIENCE              Mass infection:            ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   22Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   23Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   23Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   24Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   24Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   24Wednesday, December 7, 11
Iftach Ian Amit | November 2011                         -----BEGIN PGP MESSAGE-----                                       ...
Iftach Ian Amit | November 2011                          Still “too detectable” All rights reserved to Security Art ltd. 2...
Iftach Ian Amit | November 2011                          Still “too detectable”                         hQMOA1jQIm6UkL4eEA...
Iftach Ian Amit | November 2011                                                      Much better                    • Thro...
Iftach Ian Amit | November 2011                                                      Resistance is futile All rights reser...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   29Wednesday, December 7, 11
Iftach Ian Amit | November 2011         80                                                           53                   ...
Iftach Ian Amit | November 2011         80                                                           53                   ...
Iftach Ian Amit | November 2011                                           Kill some trees All rights reserved to Security ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   31Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   31Wednesday, December 7, 11
Iftach Ian Amit | November 2011                                        Good ol’e DD... All rights reserved to Security Art...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   33Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   33Wednesday, December 7, 11
Iftach Ian Amit | November 2011                                                      1/2 byte                             ...
Iftach Ian Amit | November 2011                                                      1/2 byte                             ...
Iftach Ian Amit | November 2011                                                      1/2 byte                             ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   34Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   35Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   35Wednesday, December 7, 11
Iftach Ian Amit | November 2011                                                           1 0 1 0 All rights reserved to S...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011                                                      DEMO All rights reserved to Security ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   37Wednesday, December 7, 11
Iftach Ian Amit | November 2011                      Killing paper isn’t nice                    • Fax it!                ...
Iftach Ian Amit | November 2011                                                      Conclusions All rights reserved to Se...
Iftach Ian Amit | November 2011                                                      Conclusions All rights reserved to Se...
Iftach Ian Amit | November 2011                                                      Conclusions All rights reserved to Se...
Iftach Ian Amit | November 2011                                                      Conclusions All rights reserved to Se...
Iftach Ian Amit | November 2011                    • Start with the                            human factor               ...
Iftach Ian Amit | November 2011                    • Start with the                            human factor               ...
Iftach Ian Amit | November 2011                    • Where people leave data                     • Hint - spend time with ...
Iftach Ian Amit | November 2011                    • Where people leave data                     • Hint - spend time with ...
Iftach Ian Amit | November 2011                                                           “be true to                     ...
Iftach Ian Amit | November 2011                                                           “be true to                     ...
Iftach Ian Amit | November 2011                  They are YOUR assets                         after all                   ...
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   44Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   44Wednesday, December 7, 11
Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011   44Wednesday, December 7, 11
Iftach Ian Amit | November 2011                TEST SOME MORE  For hints/guides see: www.pentest-standard.org All rights r...
Iftach Ian Amit | November 2011                                                      Questions?                       Than...
Upcoming SlideShare
Loading in …5
×

Advanced Data Exfiltration - the way Q would have done it

1,695 views

Published on

An updated version of my data exfiltration talk. Much more "visual" in nature.
Used it at Hashdays, Govcert.NL, SourceBCN, and SecurityZone.

Published in: Technology, Business
1 Comment
1 Like
Statistics
Notes
No Downloads
Views
Total views
1,695
On SlideShare
0
From Embeds
0
Number of Embeds
551
Actions
Shares
0
Downloads
37
Comments
1
Likes
1
Embeds 0
No embeds

No notes for slide

Advanced Data Exfiltration - the way Q would have done it

  1. 1. Iftach Ian Amit | November 2011 Advanced Data Exfiltration The way Q would have done it Iftach Ian Amit VP Consulting DC9723 CSA-IL Board member IL-CERT Visionary All rights reserved to Security Art ltd. 2002-2011 www.security-art.comWednesday, December 7, 11
  2. 2. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  3. 3. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  4. 4. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  5. 5. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  6. 6. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  7. 7. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  8. 8. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  9. 9. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  10. 10. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  11. 11. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  12. 12. Iftach Ian Amit | November 2011 whoami All rights reserved to Security Art ltd. 2002-2011 2Wednesday, December 7, 11
  13. 13. Iftach Ian Amit | November 2011 Agenda All rights reserved to Security Art ltd. 2002-2011 3Wednesday, December 7, 11
  14. 14. Iftach Ian Amit | November 2011 Agenda All rights reserved to Security Art ltd. 2002-2011 3Wednesday, December 7, 11
  15. 15. Iftach Ian Amit | November 2011 Agenda All rights reserved to Security Art ltd. 2002-2011 3Wednesday, December 7, 11
  16. 16. Iftach Ian Amit | November 2011 Agenda All rights reserved to Security Art ltd. 2002-2011 3Wednesday, December 7, 11
  17. 17. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 4Wednesday, December 7, 11
  18. 18. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 5Wednesday, December 7, 11
  19. 19. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 5Wednesday, December 7, 11
  20. 20. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 5Wednesday, December 7, 11
  21. 21. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 5Wednesday, December 7, 11
  22. 22. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 5Wednesday, December 7, 11
  23. 23. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  24. 24. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  25. 25. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  26. 26. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  27. 27. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  28. 28. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  29. 29. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 6Wednesday, December 7, 11
  30. 30. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  31. 31. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  32. 32. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  33. 33. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  34. 34. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  35. 35. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 7Wednesday, December 7, 11
  36. 36. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 8Wednesday, December 7, 11
  37. 37. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 8Wednesday, December 7, 11
  38. 38. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 8Wednesday, December 7, 11
  39. 39. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 8Wednesday, December 7, 11
  40. 40. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  41. 41. Iftach Ian Amit | November 2011 • eMails, web links, phishing... All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  42. 42. Iftach Ian Amit | November 2011 • eMails, web links, phishing... • Works like a charm! All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  43. 43. Iftach Ian Amit | November 2011 • eMails, web links, phishing... • Works like a charm! • And can be mostly automated All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  44. 44. Iftach Ian Amit | November 2011 • eMails, web links, phishing... • Works like a charm! • And can be mostly automated • SET to the rescue All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  45. 45. Iftach Ian Amit | November 2011 • eMails, web links, phishing... • Works like a charm! • And can be mostly automated • SET to the rescue All rights reserved to Security Art ltd. 2002-2011 9Wednesday, December 7, 11
  46. 46. Iftach Ian Amit | November 2011 And... being nice/nasty/ obnoxious/needy always helps! All rights reserved to Security Art ltd. 2002-2011 10Wednesday, December 7, 11
  47. 47. Iftach Ian Amit | November 2011 And... being nice/nasty/ obnoxious/needy always helps! All rights reserved to Security Art ltd. 2002-2011 10Wednesday, December 7, 11
  48. 48. Iftach Ian Amit | November 2011 And... being nice/nasty/ obnoxious/needy always helps! All rights reserved to Security Art ltd. 2002-2011 10Wednesday, December 7, 11
  49. 49. Iftach Ian Amit | November 2011 And... being nice/nasty/ obnoxious/needy always helps! All rights reserved to Security Art ltd. 2002-2011 10Wednesday, December 7, 11
  50. 50. Iftach Ian Amit | November 2011 And... being nice/nasty/ obnoxious/needy always helps! All rights reserved to Security Art ltd. 2002-2011 10Wednesday, December 7, 11
  51. 51. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  52. 52. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  53. 53. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  54. 54. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  55. 55. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  56. 56. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  57. 57. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  58. 58. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  59. 59. Iftach Ian Amit | November 2011 Internet 3rd party You! Target All rights reserved to Security Art ltd. 2002-2011 11Wednesday, December 7, 11
  60. 60. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 12Wednesday, December 7, 11
  61. 61. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 12Wednesday, December 7, 11
  62. 62. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 12Wednesday, December 7, 11
  63. 63. Iftach Ian Amit | November 2011 What is the target “willing” to tell about itself? All rights reserved to Security Art ltd. 2002-2011 13Wednesday, December 7, 11
  64. 64. Iftach Ian Amit | November 2011 What is the target “willing” to tell about itself? All rights reserved to Security Art ltd. 2002-2011 13Wednesday, December 7, 11
  65. 65. Iftach Ian Amit | November 2011 What is the target “willing” to tell about itself? All rights reserved to Security Art ltd. 2002-2011 13Wednesday, December 7, 11
  66. 66. Iftach Ian Amit | November 2011 Who’s your daddy? And buddy, and friends, relatives, colleagues... All rights reserved to Security Art ltd. 2002-2011 14Wednesday, December 7, 11
  67. 67. Iftach Ian Amit | November 2011 Who’s your daddy? And buddy, and friends, relatives, colleagues... All rights reserved to Security Art ltd. 2002-2011 14Wednesday, December 7, 11
  68. 68. Iftach Ian Amit | November 2011 Who’s your daddy? And buddy, and friends, relatives, colleagues... All rights reserved to Security Art ltd. 2002-2011 14Wednesday, December 7, 11
  69. 69. Iftach Ian Amit | November 2011 Who’s your daddy? And buddy, and friends, relatives, colleagues... All rights reserved to Security Art ltd. 2002-2011 14Wednesday, December 7, 11
  70. 70. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 15Wednesday, December 7, 11
  71. 71. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 15Wednesday, December 7, 11
  72. 72. Iftach Ian Amit | November 2011 Select your target wisely And then craft your payload :-) All rights reserved to Security Art ltd. 2002-2011 16Wednesday, December 7, 11
  73. 73. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  74. 74. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  75. 75. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  76. 76. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  77. 77. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  78. 78. Iftach Ian Amit | November 2011 • ZeuS: $3000-$5000 • SpyEye: $2500-$4000 • Limbo: $500-$1500 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  79. 79. Iftach Ian Amit | November 2011 • ZeuS: $3000-$5000 E! RE • SpyEye: $2500-$4000 F • Limbo: $500-$1500 All rights reserved to Security Art ltd. 2002-2011 17Wednesday, December 7, 11
  80. 80. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 18Wednesday, December 7, 11
  81. 81. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 18Wednesday, December 7, 11
  82. 82. Iftach Ian Amit | November 2011 Experienced travelers know the importance of packing properly All rights reserved to Security Art ltd. 2002-2011 18Wednesday, December 7, 11
  83. 83. Iftach Ian Amit | November 2011 Experienced travelers know the importance of packing properly All rights reserved to Security Art ltd. 2002-2011 18Wednesday, December 7, 11
  84. 84. Iftach Ian Amit | November 2011 • File servers • Databases • File types • Gateways (routes) • Printers All rights reserved to Security Art ltd. 2002-2011 19Wednesday, December 7, 11
  85. 85. Iftach Ian Amit | November 2011 Mass infection: APT: 5-6 days before 5-6 months before detection detection All rights reserved to Security Art ltd. 2002-2011 20Wednesday, December 7, 11
  86. 86. Iftach Ian Amit | November 2011 Mass infection: APT: 5-6 days before 5-6 months before detection detection All rights reserved to Security Art ltd. 2002-2011 20Wednesday, December 7, 11
  87. 87. Iftach Ian Amit | November 2011 Mass infection: APT: 5-6 days before 5-6 months before detection detection Frequent updates No* updates * Almost All rights reserved to Security Art ltd. 2002-2011 20Wednesday, December 7, 11
  88. 88. Iftach Ian Amit | November 2011 PATIENCE Mass infection: APT: 5-6 days before 5-6 months before detection detection Frequent updates No* updates * Almost All rights reserved to Security Art ltd. 2002-2011 21Wednesday, December 7, 11
  89. 89. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  90. 90. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  91. 91. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  92. 92. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  93. 93. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  94. 94. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  95. 95. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 22Wednesday, December 7, 11
  96. 96. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 23Wednesday, December 7, 11
  97. 97. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 23Wednesday, December 7, 11
  98. 98. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 24Wednesday, December 7, 11
  99. 99. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 24Wednesday, December 7, 11
  100. 100. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 24Wednesday, December 7, 11
  101. 101. Iftach Ian Amit | November 2011 -----BEGIN PGP MESSAGE----- So... Version: GnuPG/MacGPG2 v2.0.14 (Darwin) hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZp FGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8Bf BHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt /gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuS Gilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakp Tm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6 leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfO hdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLei SyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIG vu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5 gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX /vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19 o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+ uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ 3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O 6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbT YcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5Kg mMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Is qvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N 0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI= =jN3t -----END PGP MESSAGE----- All rights reserved to Security Art ltd. 2002-2011 25Wednesday, December 7, 11
  102. 102. Iftach Ian Amit | November 2011 Still “too detectable” All rights reserved to Security Art ltd. 2002-2011 26Wednesday, December 7, 11
  103. 103. Iftach Ian Amit | November 2011 Still “too detectable” hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZp FGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8Bf BHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt /gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuS Gilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakp Tm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6 leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfO hdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLei SyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIG vu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5 gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX /vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19 o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+ uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ 3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O 6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbT YcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5Kg mMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Is qvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N 0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI= =jN3t All rights reserved to Security Art ltd. 2002-2011 26Wednesday, December 7, 11
  104. 104. Iftach Ian Amit | November 2011 Much better • Throws in some additional encodings • And an XOR for old time’s sake • And we are good to go... • 0% detection rate All rights reserved to Security Art ltd. 2002-2011 27Wednesday, December 7, 11
  105. 105. Iftach Ian Amit | November 2011 Resistance is futile All rights reserved to Security Art ltd. 2002-2011 28Wednesday, December 7, 11
  106. 106. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 29Wednesday, December 7, 11
  107. 107. Iftach Ian Amit | November 2011 80 53 443 All rights reserved to Security Art ltd. 2002-2011 29Wednesday, December 7, 11
  108. 108. Iftach Ian Amit | November 2011 80 53 443 All rights reserved to Security Art ltd. 2002-2011 29Wednesday, December 7, 11
  109. 109. Iftach Ian Amit | November 2011 Kill some trees All rights reserved to Security Art ltd. 2002-2011 30Wednesday, December 7, 11
  110. 110. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 31Wednesday, December 7, 11
  111. 111. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 31Wednesday, December 7, 11
  112. 112. Iftach Ian Amit | November 2011 Good ol’e DD... All rights reserved to Security Art ltd. 2002-2011 32Wednesday, December 7, 11
  113. 113. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 33Wednesday, December 7, 11
  114. 114. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 33Wednesday, December 7, 11
  115. 115. Iftach Ian Amit | November 2011 1/2 byte = 16 values 1 0 1 0 All rights reserved to Security Art ltd. 2002-2011 33Wednesday, December 7, 11
  116. 116. Iftach Ian Amit | November 2011 1/2 byte = 16 values 1 0 1 0 All rights reserved to Security Art ltd. 2002-2011 33Wednesday, December 7, 11
  117. 117. Iftach Ian Amit | November 2011 1/2 byte = 16 values 1 0 1 0 All rights reserved to Security Art ltd. 2002-2011 33Wednesday, December 7, 11
  118. 118. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  119. 119. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  120. 120. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  121. 121. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  122. 122. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  123. 123. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  124. 124. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  125. 125. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 34Wednesday, December 7, 11
  126. 126. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 35Wednesday, December 7, 11
  127. 127. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 35Wednesday, December 7, 11
  128. 128. Iftach Ian Amit | November 2011 1 0 1 0 All rights reserved to Security Art ltd. 2002-2011 35Wednesday, December 7, 11
  129. 129. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  130. 130. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  131. 131. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  132. 132. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  133. 133. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  134. 134. Iftach Ian Amit | November 2011 DEMO All rights reserved to Security Art ltd. 2002-2011 36Wednesday, December 7, 11
  135. 135. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 37Wednesday, December 7, 11
  136. 136. Iftach Ian Amit | November 2011 Killing paper isn’t nice • Fax it! • Most corporations have email-to-fax services • heard of the address 555-7963@fax.corp.com ? • Just send any document (text, doc, pdf) to it and off you go with the data... All rights reserved to Security Art ltd. 2002-2011 38Wednesday, December 7, 11
  137. 137. Iftach Ian Amit | November 2011 Conclusions All rights reserved to Security Art ltd. 2002-2011 39Wednesday, December 7, 11
  138. 138. Iftach Ian Amit | November 2011 Conclusions All rights reserved to Security Art ltd. 2002-2011 39Wednesday, December 7, 11
  139. 139. Iftach Ian Amit | November 2011 Conclusions All rights reserved to Security Art ltd. 2002-2011 39Wednesday, December 7, 11
  140. 140. Iftach Ian Amit | November 2011 Conclusions All rights reserved to Security Art ltd. 2002-2011 39Wednesday, December 7, 11
  141. 141. Iftach Ian Amit | November 2011 • Start with the human factor • Then add technology All rights reserved to Security Art ltd. 2002-2011 40Wednesday, December 7, 11
  142. 142. Iftach Ian Amit | November 2011 • Start with the human factor • Then add technology All rights reserved to Security Art ltd. 2002-2011 40Wednesday, December 7, 11
  143. 143. Iftach Ian Amit | November 2011 • Where people leave data • Hint - spend time with developers. • “Hack” the business process • Test, test again, and then test. Follow with a surprise test! All rights reserved to Security Art ltd. 2002-2011 41Wednesday, December 7, 11
  144. 144. Iftach Ian Amit | November 2011 • Where people leave data • Hint - spend time with developers. • “Hack” the business process • Test, test again, and then test. Follow with a surprise test! All rights reserved to Security Art ltd. 2002-2011 41Wednesday, December 7, 11
  145. 145. Iftach Ian Amit | November 2011 “be true to yourself, not to what you believe things should look like” Old chinese proverb All rights reserved to Security Art ltd. 2002-2011 42Wednesday, December 7, 11
  146. 146. Iftach Ian Amit | November 2011 “be true to yourself, not to what you believe things should look like” Old chinese proverb All rights reserved to Security Art ltd. 2002-2011 42Wednesday, December 7, 11
  147. 147. Iftach Ian Amit | November 2011 They are YOUR assets after all No reason to be shy about it... And remember to add honey... All rights reserved to Security Art ltd. 2002-2011 43Wednesday, December 7, 11
  148. 148. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 44Wednesday, December 7, 11
  149. 149. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 44Wednesday, December 7, 11
  150. 150. Iftach Ian Amit | November 2011 All rights reserved to Security Art ltd. 2002-2011 44Wednesday, December 7, 11
  151. 151. Iftach Ian Amit | November 2011 TEST SOME MORE For hints/guides see: www.pentest-standard.org All rights reserved to Security Art ltd. 2002-2011 45Wednesday, December 7, 11
  152. 152. Iftach Ian Amit | November 2011 Questions? Thank you! Whitepapers: www.security-art.comData modulation Exfil POC: Too shy to ask now? http://code.google.com/p/ iamit@security-art.com data-sound-poc/ Need your daily chatter? twitter.com/iiamit All rights reserved to Security Art ltd. 2002-2011 46Wednesday, December 7, 11

×