On November 25th, Malik Mesellem demonstrated the new wave of client-side threats we're dealing with in this age of cybersecurity. Next to his presentation, Malik gave several demo's showing exactly how these threats work. This slide deck also includes some screenshots of the demonstrations Malik gave.

1. Is your network
h@Cking pr00f?
Malik Mesellem

2. Malik Mesellem
Ethical Hacker
MME BVBA
° 2010
Security Audits
& Training
Objective
approach
Focus is
to advise
No-nonsense
mentality

3. What are we afraid of?
Buffer
Overflows
DoS
Trojans
Port
Scans
Spoofing

4. I don’t think so…
Old skool
attacks✝
We all have
firewalls ;)
(since 1990)

5. So WTH(ack) is the problem?
And who is
the enemy?

6. A new wave of client-side threats…

7. + Complex application-level attacks

8. + Complex application-level attacks

9. Your secure (?) infrastructure
Web server
Client
DC
App server
Firewall

10. Hacker’s attack plan?
ATTACK
the border
= web apps

11. Application-level attack
SQL injection
SELECT * FROM
… WHERE …
‘ OR 1=1--

13. Web server DOWN ;(

14. Hacker’s attack plan?
ATTACK
the weakest
= humans

15. Client-side attack
Spear phishing
email campaign
CVE-2014-0515
0-day
client-side
exploits

17. Client computer DOWN ;(

18. You’ve just lost 2 assets!
They are inside
the network…
Pivot, seek,
and pwn!

19. Network-level attack
Issues in OS or
application
Buffer overflow

20. Application server DOWN ;(

21. You’ve just lost 3 assets!
Keys to your
castle…

22. Now they go for the GOLD!
Pass-the-Hash
Token
impersonation

23. GAME OVER
You’ve lost
everything $$$

24. GAME OVER
You’ve lost
everything $$$

25. OMG… we definitely need heroes!

26. Secure email
gateway
Vulnerability & patch
UTM firewall
Endpoint AV
Mobile
control
management

27. Two-factor
authentication
Web application
firewall
Server
security
IDS/IPS
Security audits
Training

28. Two-factor
authentication
Web application
firewall
Server
security
IDS/IPS

29. What if…

30. Q&A?
Is your network
h@Cking pr00f?
Malik Mesellem
Thank you!