2012: The End of the World?
•
5 likes•5,876 views
My presentation at HackCon 7 Oslo, exploring where the world of information security is headed. Crude vs. stealthy exploit techinques, the underground digital economy, failure of anti-virus, the future of web application security and the (de)evolution of browsers and HTTP.
Recommended
Recommended
More Related Content
Similar to 2012: The End of the World?
Similar to 2012: The End of the World? (20)
More from Saumil Shah
More from Saumil Shah (20)
Recently uploaded
Recently uploaded (20)
2012: The End of the World?
- 1. What is coming in 2012? Saumil Shah CEO, Net-Square net-square HACKCON7 Oslo - 29.03.12
- 2. # who am i Saumil Shah, CEO Net-Square. • Hacker, Speaker, Trainer, Author - 15 yrs in Infosec. • M.S. Computer Science Purdue University. • saumil@net-square.com • LinkedIn: saumilshah • Twitter: @therealsaumil net-square
- 3. My area of work Penetration Reverse Exploit Testing Engineering Writing New Offensive Attack Research Security Defense Conference "Eyes and Speaker ears open" net-square
- 4. Highlights from 2010-2011 net-square "The Future is already here"
- 5. net-square
- 6. DigiNotar - SSL Certificates net-square
- 9. ...did it lead to this? net-square
- 10. Who had the last LOL? Infiltration is a 2 way street net-square
- 11. The economy is growing!! Players Services Prices net-square
- 12. net-square
- 13. net-square
- 14. The Underground Marketplace SPAM DDoS Carding Money Target Botnets Exchange Profiles 0day Botnet Exploit Exploits Kits Packs net-square
- 15. Underground Economy World of Warcraft account $4 Paypal/Ebay account $8 Credit Card $25 Bank Account $1000 0-day exploits WMF Exploit $4000 Quicktime/iTunes/RealPlaye $10000 r Mac OS X $10000 + free Mac Windows 7 $50000 IE / Firefox / Chrome $100000 PDF $100000 SCADA $250000+ net-square credit: Hacks Happen - Jeremiah Grossman - http://tinyurl.com/hacks-happen
- 16. CC Search, DDoS $80/day net-square credit: From Russia With Love - Fyodor Yarochkin and The Grugq - http://tinyurl.com/frmrussiawlove
- 17. DIY Botnets for $700/yr net-square
- 19. Trends in Exploit Development net-square
- 20. It was different 10 years ago! • Individual effort. • 1 week dev time. • 3-6 months shelf life. • Hundreds of public domain exploits. • "We did it for the fame." net-square
- 21. Today... • Team effort. • 1-2 months dev time. • 24h to 10d shelf life. • Public domain exploits ~ 0. • Value of exploits has significantly risen. net-square
- 22. No More Free Bugs net-square
- 24. What the Defense is up to • HIGH EXPOSURE • Rigorous Internal Testing • Proactive Exploit Mitigation Technology • Quick Turnaround Times (24 hours) • Bug Bounties • HIGH EXPOSURE • Good Efforts • Don't have resources / focus • Slow Turnaround Times (1 month) • Learning the hard way net-square
- 25. /GS SafeSEH DEP ASLR Permanent DEP ASLR and DEP net-square
- 26. /GS SEH overwrites SafeSEH non-SEH DLLs DEP Return to LibC ASLR Heap Sprays Permanent DEP ROP ASLR and DEP ROP+memleak net-square
- 27. I can haz sploits!? net-square
- 28. The buyers .gov Exploits corporate organized espionage crime net-square
- 29. The prices Vulnerability Value (USD) Source "Some exploits" 200,000-250,000 Govt. official referring to what "some people" pay. A "real good" exploit > 100,000 SNOsoft Research Team Chrome exploit upto 60,000 Google Vista exploit 50,000 Raimund Genes, Trend Micro Weaponized exploit 20,000-30,000 David Maynor, Secureworks ZDI/iDefense purchases 2,000-10,000 David Maynor, Secureworks WMF exploit 4,000 Alexander Gostev, Kaspersky Google exploit 500-3133.7 Google Mozilla exploit 500-3000 Mozilla Microsoft Excel > 1,200 Ebay auction site net-square credit: Charlie Miller - http://securityevaluators.com/files/papers/0daymarket.pdf
- 32. Exploit Sophistication ms10-002 Java ieobject Applet full ASLR+DEP bypass Drive-by net-square
- 33. Web App Vulnerabilities HTML HTTP Bloated +0.1 standards net-square
- 34. Application HTTP Delivery AJAX Authentication Flash Statefulness Sandbox Data Typing HTML5 Non-mutable CSP CORS... net-square
- 35. Breaches in 2011 855 incidents 174M records net-square credit: Verizon Data Breach Incident Report 2011
- 36. Attack Techniques 2007-2011 net-square credit: Verizon Data Breach Incident Report 2011
- 37. Popular Attack Techniques Stolen login credentials Keyloggers C&C Backdoors net-square credit: Verizon Data Breach Incident Report 2011
- 38. 96% attacks were "not difficult" net-square credit: Verizon Data Breach Incident Report 2011
- 40. Extent of damage caused Sony breach • $170 million T J Maxx breach • $17 million net-square
- 41. Nick Leeson $1.31b Kweku Adoboli $2b Jerome Kerviel Bernie Madoff $50b net-square $7.22b
- 42. Software Developers... • ...more dependent on external tools and frameworks for security. • Less on design and proper implementation. net-square
- 43. Software Development Trends 17 million devs 102 billion lines of code 6000 LOC/yr in 2008 1 bug per 10000 lines of code 10,200,000 defects per year 1% exploitable? 102,000 0-days/yr net-square credit: Hacks Happen - Jeremiah Grossman - http://tinyurl.com/hacks-happen
- 44. Security Products • Same ol' same ol' • FW IDS IPS AV SIEM UTM DLP DPI WAF ... • "Sit back and watch das blinkenlights" net-square
- 46. Effectiveness of AV/IDS/IPS/... net-square credit: twitter.com/j0emccray
- 47. The weak minded are easily tricked net-square
- 48. "A wall is only as good as those who defend it" Genghis Khan net-square
- 49. Change in Mindset "We assume that all our Internet Banking customers' computers are compromised. We now rely on near real- time fraud analytics." net-square
- 50. The FUTURE? Full ASLR by 2014 Mobile Attacks Real Time Analytics Blurred boundaries IPv6 net-square
Editor's Notes
- DEMO (c)