SlideShare a Scribd company logo

APTs Techniques Persistent Threats

•
•
ESET
ESET

This document summarizes a presentation on Advanced Persistent Threats (APTs) given by Aryeh Goretsky, a Distinguished Researcher at ESET. The presentation defines APTs as determined adversaries who conduct cyber attacks in phases, including reconnaissance of targets, analysis of vulnerabilities, development of tools to exploit vulnerabilities, trial runs of attacks, and implantation of attacks on targets. It discusses techniques used in APTs, such as rootkits, command and control servers, custom file systems and partitions, evasion methods, firmware attacks, and programming languages. The presentation aims to explain how to think like a determined adversary conducting a cyber attack campaign.

Technology
1 of 33
Advanced Persistent Threats Aryeh Goretsky, Distinguished Researcher SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
Aryeh Goretsky Distinguished Researcher Aryeh is ESET’s Distinguished Researcher and has been with the company for over nine years. A twenty-five year veteran of fighting viruses, today he is responsible for threatscape monitoring, investigations and working with researchers in and outside of ESET globally. He was the first employee at McAfee and is a veteran of several software and networking startups. He has received industry awards from Microsoft, Lenovo and Securing our eCity for his efforts to help make computing safer.
Agenda What exactly is an APT? Why I hate the term ‘APT’ Thinking like a Determined Adversary Phases I-V Commonly seen mechanisms actions and technologies seen in some APTs Defensive Technologies modern, layered approach to malware detection leveraging the cloud; cloud-based techniques security beyond anti-malware SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
Not on the Agenda This is not an overview of any particular APT family visit We Live Security for information on specific APT campaigns This is not a deep dive I’m here to talk about how to shoot, not make bullets SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
But before we begin… Pop quiz later… Vocabulary Lesson
GLOSSARY Vulnerability (n.) – A flaw in a computer program which exposes it to compromise
GLOSSARY Exploit (n.) – Program (or sequence of instructions) which takes advantage of a vulnerability. Of interest when it allows the execution of code or elevation of privilege. Or both.
GLOSSARY Virus (n.) – A computer program that modifies other computer programs to include a copy of itself.
GLOSSARY Worm (n.) – A computer program that spreads copies of itself. It may do so over networks, online services, removable media and other channels.
GLOSSARY Trojan horse (n.) – A computer program that purports to do something useful, but instead contains malicious code. A trojan horse does not replicate or spread itself.
GLOSSARY Computer viruses, worms, trojan horses and other threatening programs are called malicious software, or malware, for short.
GLOSSARY • Adware • Agents • Backdoor • Bootkits • Bots • Botnets • C&C servers • DDoS • Dialers • Downloaders • Droppers • Exploit Kits • Hoaxes • Keyloggers • Packers • Phishes • PUAs • Ransomware • Remote Access Tools • Rootkits • Spyware • Trojans • Viruses • Web Injects • Worms • Zero-days • Zombies
GLOSSARY • Adware • Agents • Backdoor • Bootkits • Bots • Botnets • C&C servers • DDoS • Dialers • Downloaders • Droppers • Exploit Kits • Hoaxes • Keyloggers • Packers • Phishes • PUAs • Ransomware • Remote Access Tools • Rootkits • Spyware • Trojans • Viruses • Web Injects • Worms • Zero-days • Zombies
What exactly is malware? Put simply: “Malware is software that, if you knew what it did, you wouldn’t want it on your computer.”
Advanced Persistent Threats APTs
What exactly is an APT? APTs APT is short for Advanced Persistent Threat But what does that mean? Here’s one definition: Advanced: the attacker was smarter than us Persistent: the attacker was successful Threat: we accepted risk of being attacked (credit to Paco Hope, Cigital)
So, what exactly is an APT? APTs There is no formal definition of APT. The term gets abused by: • Security companies that are trying to scare you into buying something from them. • Companies trying to escape blame for not having proper security controls.
Really, what is an APT? APTs Instead of APTs, I would like you to think of Determined Adversaries The determined adversary is the entity behind the APT. The APT is merely the point of the spear.
Thinking like a Determined Adversary CAMPAIGN (or how to run your attack campaign) Phase I Reconnaissance Phase II Analysis Phase III R&D Phase IV Trial Run Phase V Implantation of Target
Thinking Like a Determined Adversary CAMPAIGN Phase I: Target Reconnaissance • Build a map of the people and of the organization • Identify and describe public-facing network infrastructure • Identify tools and vendors used for network management, infrastructure and security But where do you get this information from? • Company web site: press releases, job descriptions • Social media: employees on LinkedIn, FaceBook, Twitter • Vendor press releases, support web sites • Organizations that the company/employees belong to • Network tools and public databases (whois, dig)
Thinking Like a Determined Adversary CAMPAIGN Phase II: Target analysis (victim selection) • Identify vulnerabilities in people – candidate targets for spearphishing – weaknesses in outside vendor/organizations infrastructure • Identify vulnerabilities in network infrastructure – old or outdated networking gear used? • Identify vulnerabilities in OS & apps used by target – there’s usually something old and vulnerable… somewhere – If not, install a vulnerable program and exploit it • Identify vulnerabilities in security infrastructure – old or outdated security tools used? – hardened perimeter, but no internal controls
Thinking Like a Determined Adversary CAMPAIGN Phase III: Vulnerability R&D • Design tools (the “APT chain”) to insert into target organization – build it yourself (most expensive & time-consuming) – buy it (0-day brokers, black security companies, also expensive) – partner with related attackers* • The more parties you involve, the greater the risk of attribution.
Thinking Like a Determined Adversary CAMPAIGN Phase IV: Trial Run • Simulate target company network, test attack prototypes – look at data – post-mortem analysis – refine attacks • Refine attack chain until confidence level reaches desired level for given attack scenario(s) (lather, rinse, repeat) • Conduct some probes of real target to see how they are handled using separate (and burnable) attack infrastructure – modified copies of existing spam, regular malware, etc. – attack fatigue on their part may increase success of novel attack
Thinking Like a Determined Adversary CAMPAIGN Phase V: Implantation of Target/Victim • In you go! • Slow and steady, move laterally through org • Check constantly for signs of detection by target/victim • Continuously gather data which allows to refine attack campaign
Advanced Persistent Techniques TECHNIQUES So, what are the tools of the trade used by determined adversaries to run APT campaigns? • Rootkits • Control + Exfiltration logic (Command & Control servers) • Custom partitions and file system • Evasion • Firmware • Programming languages
Rootkits Rootkits & Bootkits • Program(s) designed to allow the attacker to bypass security and maintain persistent access to a system • Runs as early as possible, often as a low-level “helper” programs such as services (Windows), daemons (*NIX), kernel extensions (OS X), device drivers (various) etc. • Bootkit: runs before the operating system is loaded – Replace MBR (BIOS partitioned disk) or VBR (GPT partitioned disk) with their own code – Actually not commonly seen with APTs (great for persistence, but easily discovered)
Connected or air-gapped C&C / Data Exfiltration • Command & Control for Internet-connected – multiple domains registered in multiple geographies – or use compromised infrastructure – use of common protocols to avoid detection • And for air-gapped targets – could be autonomous • perform pre-programmed actions w/no outside control – exfiltrate data via other mechanisms • (hardware implants, USB flash drives, etc.)
Storage techniques for code and data Custom partitions and file systems • Custom partition – add new partition – resize existing partition(s) – use raw area of disk – mark a portion of existing file system as bad • Custom file system – can be custom format; can be compressed or encrypted – storage of stolen data – additional attack code – doesn‘t have to be in a file or file system… • Windows Registry
Evasion Getting in and staying undetected • Packers – use commercial or open source (either as-is or modify) – obtain custom packer from private market – create your own • Encryption – use commercial or open source (either as-is or modify) – obtain custom packer from private market – create your own • Avoidance Engineering – identify tools used at target – develop specific countermeasure to bypass
Firmware Firmware • Code residing on a chip embedded in hardware • Required to allow computer to initialize/make use of features not support directly by processor/motherboard • Located in many kinds of peripherals and devices – video card – network card – storage controller – storage devices (internal and removable) – motherboards (their own + for on-board devices)
Coding & Deployment Programing Language & File Formats • Can be any language, really. – popular programming languages (assembly, C, C++, C#, .NET CLR) • or unpopular (AutoLISP, LUA…) – scripted languages (Flash, Java, JavaScript, HTML, PDF…) • For file-based deployments – use same file formats as those at victim (PDF, Office, SWF…) – digitally-signed, if possible/applicable – metadata removed (or altered) to increase difficulty of forensics – obscured using custom packers or encryption
Q+A Discussion
Thank You WWW.ESET.COM WWW.WELIVESECURITY.COM aryeh.goretsky@eset.com @goretsky (personal) / @esetna / @welivesecurity /u/goretsky fb.com/goretsky

Recommended

malware analysis
malware analysismalware analysis
malware analysis20CS201AkashR
 
Advanced persistent threats(APT)
Advanced persistent threats(APT)Advanced persistent threats(APT)
Advanced persistent threats(APT)Network Intelligence India
 
Malware- Types, Detection and Future
Malware- Types, Detection and FutureMalware- Types, Detection and Future
Malware- Types, Detection and Futurekaranwayne
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware AnalysisAndrew McNicol
 
Cybersecurity Roadmap for Beginners
Cybersecurity Roadmap for BeginnersCybersecurity Roadmap for Beginners
Cybersecurity Roadmap for BeginnersSanjeev Kumar Jaiswal
 
Threat Modeling Everything
Threat Modeling EverythingThreat Modeling Everything
Threat Modeling EverythingAnne Oikarinen
 
Advanced persistent threat (apt)
Advanced persistent threat (apt)Advanced persistent threat (apt)
Advanced persistent threat (apt)mmubashirkhan
 
Advanced Persistent Threats (APTs) - Information Security Management
Advanced Persistent Threats (APTs) - Information Security ManagementAdvanced Persistent Threats (APTs) - Information Security Management
Advanced Persistent Threats (APTs) - Information Security ManagementMayur Nanotkar
 

Recommended

malware analysis
malware analysismalware analysis
malware analysis20CS201AkashR
 
Advanced persistent threats(APT)
Advanced persistent threats(APT)Advanced persistent threats(APT)
Advanced persistent threats(APT)Network Intelligence India
 
Malware- Types, Detection and Future
Malware- Types, Detection and FutureMalware- Types, Detection and Future
Malware- Types, Detection and Futurekaranwayne
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware AnalysisAndrew McNicol
 
Cybersecurity Roadmap for Beginners
Cybersecurity Roadmap for BeginnersCybersecurity Roadmap for Beginners
Cybersecurity Roadmap for BeginnersSanjeev Kumar Jaiswal
 
Threat Modeling Everything
Threat Modeling EverythingThreat Modeling Everything
Threat Modeling EverythingAnne Oikarinen
 
Advanced persistent threat (apt)
Advanced persistent threat (apt)Advanced persistent threat (apt)
Advanced persistent threat (apt)mmubashirkhan
 
Advanced Persistent Threats (APTs) - Information Security Management
Advanced Persistent Threats (APTs) - Information Security ManagementAdvanced Persistent Threats (APTs) - Information Security Management
Advanced Persistent Threats (APTs) - Information Security ManagementMayur Nanotkar
 
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic AnalysisCNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic AnalysisSam Bowne
 
How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes ObserveIT
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning Cysinfo Cyber Security Community
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
The Rise of Ransomware
The Rise of RansomwareThe Rise of Ransomware
The Rise of RansomwareTharindu Edirisinghe
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDEGirindro Pringgo Digdo
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessmentCAS
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testingNezar Alazzabi
 
Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Hossam .M Hamed
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainSuvrat Jain
 
Cyber Hygiene in Dailylife
Cyber Hygiene in DailylifeCyber Hygiene in Dailylife
Cyber Hygiene in Dailylifessuser98b1f71
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Ch04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and AttacksCh04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and AttacksInformation Technology
 
Understanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for OrganizationUnderstanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for OrganizationPECB
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat IntelligenceDeepak Kumar (D3)
 
Bug Bounty - Hackers Job
Bug Bounty - Hackers JobBug Bounty - Hackers Job
Bug Bounty - Hackers JobArbin Godar
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and AnalysisPrashant Chopra
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...Mauricio Velazco
 
Is Anti-Virus Dead?
Is Anti-Virus Dead?Is Anti-Virus Dead?
Is Anti-Virus Dead?ESET
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent ThreatFireEye, Inc.
 

More Related Content

What's hot

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic AnalysisCNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic AnalysisSam Bowne
 
How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes ObserveIT
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessmentCAS
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testingNezar Alazzabi
 
Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Hossam .M Hamed
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainSuvrat Jain
 
Cyber Hygiene in Dailylife
Cyber Hygiene in DailylifeCyber Hygiene in Dailylife
Cyber Hygiene in Dailylifessuser98b1f71
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
 
Ch04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and AttacksCh04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and AttacksInformation Technology
 
Understanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for OrganizationUnderstanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for OrganizationPECB
 
Bug Bounty - Hackers Job
Bug Bounty - Hackers JobBug Bounty - Hackers Job
Bug Bounty - Hackers JobArbin Godar
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and AnalysisPrashant Chopra
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...Mauricio Velazco
 

What's hot (20)

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic AnalysisCNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
 
How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes How to Build an Insider Threat Program in 30 Minutes
How to Build an Insider Threat Program in 30 Minutes
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...
 
The Rise of Ransomware
The Rise of RansomwareThe Rise of Ransomware
The Rise of Ransomware
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
 
IT Security management and risk assessment
IT Security management and risk assessmentIT Security management and risk assessment
IT Security management and risk assessment
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
 
Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop Privilege escalation from 1 to 0 Workshop
Privilege escalation from 1 to 0 Workshop
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jain
 
Cyber Hygiene in Dailylife
Cyber Hygiene in DailylifeCyber Hygiene in Dailylife
Cyber Hygiene in Dailylife
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on it
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
Ch04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and AttacksCh04 Network Vulnerabilities and Attacks
Ch04 Network Vulnerabilities and Attacks
 
Understanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for OrganizationUnderstanding Penetration Testing & its Benefits for Organization
Understanding Penetration Testing & its Benefits for Organization
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 
Bug Bounty - Hackers Job
Bug Bounty - Hackers JobBug Bounty - Hackers Job
Bug Bounty - Hackers Job
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and Analysis
 
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
SANS Threat Hunting Summit 2018 - Hunting Lateral Movement with Windows Event...
 

Viewers also liked

Is Anti-Virus Dead?
Is Anti-Virus Dead?Is Anti-Virus Dead?
Is Anti-Virus Dead?ESET
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent ThreatFireEye, Inc.
 
Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Yuval Sinay, CISSP, C|CISO
 
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudy
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudyなんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudy
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudyPOStudy
 
Unpack your troubles*: .NET packer tricks and countermeasures
Unpack your troubles*: .NET packer tricks and countermeasuresUnpack your troubles*: .NET packer tricks and countermeasures
Unpack your troubles*: .NET packer tricks and countermeasuresESET
 
Launching a Rocketship Off Someone Else's Back
Launching a Rocketship Off Someone Else's BackLaunching a Rocketship Off Someone Else's Back
Launching a Rocketship Off Someone Else's Backjoshelman
 

Viewers also liked (6)

Is Anti-Virus Dead?
Is Anti-Virus Dead?Is Anti-Virus Dead?
Is Anti-Virus Dead?
 
M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat M-Trends® 2010: The Advanced Persistent Threat
M-Trends® 2010: The Advanced Persistent Threat
 
Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)Common Techniques To Identify Advanced Persistent Threat (APT)
Common Techniques To Identify Advanced Persistent Threat (APT)
 
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudy
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudyなんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudy
なんたって”DevQA” アジャイル開発とQAの合体が改善を生む - 永田 敦 氏 #postudy
 
Unpack your troubles*: .NET packer tricks and countermeasures
Unpack your troubles*: .NET packer tricks and countermeasuresUnpack your troubles*: .NET packer tricks and countermeasures
Unpack your troubles*: .NET packer tricks and countermeasures
 
Launching a Rocketship Off Someone Else's Back
Launching a Rocketship Off Someone Else's BackLaunching a Rocketship Off Someone Else's Back
Launching a Rocketship Off Someone Else's Back
 

Similar to APTs Techniques Persistent Threats

Practical Incident Response - Work Guide
Practical Incident Response - Work GuidePractical Incident Response - Work Guide
Practical Incident Response - Work GuideEduardo Chavarro
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion DetectionAPNIC
 
ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011Xavier Mertens
 
Web hacking 1.0
Web hacking 1.0Web hacking 1.0
Web hacking 1.0Q Fadlan
 
CH1- Introduction to malware analysis-v2.pdf
CH1- Introduction to malware analysis-v2.pdfCH1- Introduction to malware analysis-v2.pdf
CH1- Introduction to malware analysis-v2.pdfWajdiElhamzi3
 
Inetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentationInetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentationJoshua Prince
 
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...Sean Whalen
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisAntonio Parata
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in securityOsama Ellahi
 
Detection and Analysis of 0-Day Threats
Detection and Analysis of 0-Day ThreatsDetection and Analysis of 0-Day Threats
Detection and Analysis of 0-Day ThreatsInvincea, Inc.
 
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...Mobodexter
 
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017FRSecure
 
The Threat Landscape & Network Security Measures
The Threat Landscape & Network Security MeasuresThe Threat Landscape & Network Security Measures
The Threat Landscape & Network Security MeasuresCarl B. Forkner, Ph.D.
 
Defending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricalityDefending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricalityClaus Cramon Houmann
 
Surfing with Sharks KS ED TECH 2012
Surfing with Sharks KS ED TECH 2012Surfing with Sharks KS ED TECH 2012
Surfing with Sharks KS ED TECH 2012inf8nity
 

Similar to APTs Techniques Persistent Threats (20)

ETHICAL HACKING
ETHICAL HACKINGETHICAL HACKING
ETHICAL HACKING
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
Practical Incident Response - Work Guide
Practical Incident Response - Work GuidePractical Incident Response - Work Guide
Practical Incident Response - Work Guide
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
 
ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011ISACA Ethical Hacking Presentation 10/2011
ISACA Ethical Hacking Presentation 10/2011
 
Web hacking 1.0
Web hacking 1.0Web hacking 1.0
Web hacking 1.0
 
CH1- Introduction to malware analysis-v2.pdf
CH1- Introduction to malware analysis-v2.pdfCH1- Introduction to malware analysis-v2.pdf
CH1- Introduction to malware analysis-v2.pdf
 
Inetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentationInetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentation
 
Ready set hack
Ready set hackReady set hack
Ready set hack
 
Declaration of malWARe
Declaration of malWAReDeclaration of malWARe
Declaration of malWARe
 
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...
Open Secrets of the Defense Industry: Building Your Own Intelligence Program ...
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware Analysis
 
Botnets Attacks.pptx
Botnets Attacks.pptxBotnets Attacks.pptx
Botnets Attacks.pptx
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in security
 
Detection and Analysis of 0-Day Threats
Detection and Analysis of 0-Day ThreatsDetection and Analysis of 0-Day Threats
Detection and Analysis of 0-Day Threats
 
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
 
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 5 – FRSecure CISSP Mentor Program 2017
 
The Threat Landscape & Network Security Measures
The Threat Landscape & Network Security MeasuresThe Threat Landscape & Network Security Measures
The Threat Landscape & Network Security Measures
 
Defending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricalityDefending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricality
 
Surfing with Sharks KS ED TECH 2012
Surfing with Sharks KS ED TECH 2012Surfing with Sharks KS ED TECH 2012
Surfing with Sharks KS ED TECH 2012
 

More from ESET

ESET Cybersecurity students
ESET Cybersecurity studentsESET Cybersecurity students
ESET Cybersecurity studentsESET
 
ESET Cybersecurity training
ESET Cybersecurity trainingESET Cybersecurity training
ESET Cybersecurity trainingESET
 
How to implement a robust information security management system?
How to implement a robust information security management system?How to implement a robust information security management system?
How to implement a robust information security management system?ESET
 
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...ESET
 
Visiting the Bear Den
Visiting the Bear DenVisiting the Bear Den
Visiting the Bear DenESET
 
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...ESET
 
ESET Quick Guide to the EU General Data Protection Regulation
ESET Quick Guide to the EU General Data Protection RegulationESET Quick Guide to the EU General Data Protection Regulation
ESET Quick Guide to the EU General Data Protection RegulationESET
 
Bootkits: Past, Present & Future - Virus Bulletin
Bootkits: Past, Present & Future - Virus BulletinBootkits: Past, Present & Future - Virus Bulletin
Bootkits: Past, Present & Future - Virus BulletinESET
 
Operation Buhtrap - AVAR 2015
Operation Buhtrap - AVAR 2015Operation Buhtrap - AVAR 2015
Operation Buhtrap - AVAR 2015ESET
 
Shopping Online
Shopping OnlineShopping Online
Shopping OnlineESET
 
Banking Online
Banking OnlineBanking Online
Banking OnlineESET
 
Is Linux/Moose endangered or extinct?
Is Linux/Moose endangered or extinct? Is Linux/Moose endangered or extinct?
Is Linux/Moose endangered or extinct? ESET
 
ESET: #DoMore With Our Comprehensive Range of Business Products
ESET: #DoMore With Our Comprehensive Range of Business ProductsESET: #DoMore With Our Comprehensive Range of Business Products
ESET: #DoMore With Our Comprehensive Range of Business ProductsESET
 
ESET: Delivering Benefits to Enterprises
ESET: Delivering Benefits to EnterprisesESET: Delivering Benefits to Enterprises
ESET: Delivering Benefits to EnterprisesESET
 
ESET: Delivering Benefits to Medium and Large Businesses
ESET: Delivering Benefits to Medium and Large BusinessesESET: Delivering Benefits to Medium and Large Businesses
ESET: Delivering Benefits to Medium and Large BusinessesESET
 
#DoMore with ESET
#DoMore with ESET#DoMore with ESET
#DoMore with ESETESET
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat ReviewESET
 
Learn more about ESET and our soulutions for mobile platforms
Learn more about ESET and our soulutions for mobile platformsLearn more about ESET and our soulutions for mobile platforms
Learn more about ESET and our soulutions for mobile platformsESET
 
Trends for 2014: The Challenge of Internet Privacy
Trends for 2014: The Challenge of Internet PrivacyTrends for 2014: The Challenge of Internet Privacy
Trends for 2014: The Challenge of Internet PrivacyESET
 
ESET Technology From
ESET Technology FromESET Technology From
ESET Technology FromESET
 

More from ESET (20)

ESET Cybersecurity students
ESET Cybersecurity studentsESET Cybersecurity students
ESET Cybersecurity students
 
ESET Cybersecurity training
ESET Cybersecurity trainingESET Cybersecurity training
ESET Cybersecurity training
 
How to implement a robust information security management system?
How to implement a robust information security management system?How to implement a robust information security management system?
How to implement a robust information security management system?
 
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...
#AntimalwareDay: The ESET Celebration of the Origins of Computer Defense in N...
 
Visiting the Bear Den
Visiting the Bear DenVisiting the Bear Den
Visiting the Bear Den
 
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...
AVAR Sydney 2014: Lemming Aid and Kool Aid: Helping the Community to Help Its...
 
ESET Quick Guide to the EU General Data Protection Regulation
ESET Quick Guide to the EU General Data Protection RegulationESET Quick Guide to the EU General Data Protection Regulation
ESET Quick Guide to the EU General Data Protection Regulation
 
Bootkits: Past, Present & Future - Virus Bulletin
Bootkits: Past, Present & Future - Virus BulletinBootkits: Past, Present & Future - Virus Bulletin
Bootkits: Past, Present & Future - Virus Bulletin
 
Operation Buhtrap - AVAR 2015
Operation Buhtrap - AVAR 2015Operation Buhtrap - AVAR 2015
Operation Buhtrap - AVAR 2015
 
Shopping Online
Shopping OnlineShopping Online
Shopping Online
 
Banking Online
Banking OnlineBanking Online
Banking Online
 
Is Linux/Moose endangered or extinct?
Is Linux/Moose endangered or extinct? Is Linux/Moose endangered or extinct?
Is Linux/Moose endangered or extinct?
 
ESET: #DoMore With Our Comprehensive Range of Business Products
ESET: #DoMore With Our Comprehensive Range of Business ProductsESET: #DoMore With Our Comprehensive Range of Business Products
ESET: #DoMore With Our Comprehensive Range of Business Products
 
ESET: Delivering Benefits to Enterprises
ESET: Delivering Benefits to EnterprisesESET: Delivering Benefits to Enterprises
ESET: Delivering Benefits to Enterprises
 
ESET: Delivering Benefits to Medium and Large Businesses
ESET: Delivering Benefits to Medium and Large BusinessesESET: Delivering Benefits to Medium and Large Businesses
ESET: Delivering Benefits to Medium and Large Businesses
 
#DoMore with ESET
#DoMore with ESET#DoMore with ESET
#DoMore with ESET
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat Review
 
Learn more about ESET and our soulutions for mobile platforms
Learn more about ESET and our soulutions for mobile platformsLearn more about ESET and our soulutions for mobile platforms
Learn more about ESET and our soulutions for mobile platforms
 
Trends for 2014: The Challenge of Internet Privacy
Trends for 2014: The Challenge of Internet PrivacyTrends for 2014: The Challenge of Internet Privacy
Trends for 2014: The Challenge of Internet Privacy
 
ESET Technology From
ESET Technology FromESET Technology From
ESET Technology From
 

Recently uploaded

"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024The Digital Insurer
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGMarianaLemus7
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions
 

Recently uploaded (20)

"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
Vulnerability_Management_GRC_by Sohang Sengupta.pptx
Vulnerability_Management_GRC_by Sohang Sengupta.pptxVulnerability_Management_GRC_by Sohang Sengupta.pptx
Vulnerability_Management_GRC_by Sohang Sengupta.pptx
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDG
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping Elbows
 

APTs Techniques Persistent Threats

  • 1. Advanced Persistent Threats Aryeh Goretsky, Distinguished Researcher SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
  • 2. Aryeh Goretsky Distinguished Researcher Aryeh is ESET’s Distinguished Researcher and has been with the company for over nine years. A twenty-five year veteran of fighting viruses, today he is responsible for threatscape monitoring, investigations and working with researchers in and outside of ESET globally. He was the first employee at McAfee and is a veteran of several software and networking startups. He has received industry awards from Microsoft, Lenovo and Securing our eCity for his efforts to help make computing safer.
  • 3. Agenda What exactly is an APT? Why I hate the term ‘APT’ Thinking like a Determined Adversary Phases I-V Commonly seen mechanisms actions and technologies seen in some APTs Defensive Technologies modern, layered approach to malware detection leveraging the cloud; cloud-based techniques security beyond anti-malware SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
  • 4. Not on the Agenda This is not an overview of any particular APT family visit We Live Security for information on specific APT campaigns This is not a deep dive I’m here to talk about how to shoot, not make bullets SOeC Cyber Boot Camp 2015 • Monday, June 22, 2015
  • 5. But before we begin… Pop quiz later… Vocabulary Lesson
  • 6. GLOSSARY Vulnerability (n.) – A flaw in a computer program which exposes it to compromise
  • 7. GLOSSARY Exploit (n.) – Program (or sequence of instructions) which takes advantage of a vulnerability. Of interest when it allows the execution of code or elevation of privilege. Or both.
  • 8. GLOSSARY Virus (n.) – A computer program that modifies other computer programs to include a copy of itself.
  • 9. GLOSSARY Worm (n.) – A computer program that spreads copies of itself. It may do so over networks, online services, removable media and other channels.
  • 10. GLOSSARY Trojan horse (n.) – A computer program that purports to do something useful, but instead contains malicious code. A trojan horse does not replicate or spread itself.
  • 11. GLOSSARY Computer viruses, worms, trojan horses and other threatening programs are called malicious software, or malware, for short.
  • 12. GLOSSARY • Adware • Agents • Backdoor • Bootkits • Bots • Botnets • C&C servers • DDoS • Dialers • Downloaders • Droppers • Exploit Kits • Hoaxes • Keyloggers • Packers • Phishes • PUAs • Ransomware • Remote Access Tools • Rootkits • Spyware • Trojans • Viruses • Web Injects • Worms • Zero-days • Zombies
  • 13. GLOSSARY • Adware • Agents • Backdoor • Bootkits • Bots • Botnets • C&C servers • DDoS • Dialers • Downloaders • Droppers • Exploit Kits • Hoaxes • Keyloggers • Packers • Phishes • PUAs • Ransomware • Remote Access Tools • Rootkits • Spyware • Trojans • Viruses • Web Injects • Worms • Zero-days • Zombies
  • 14. What exactly is malware? Put simply: “Malware is software that, if you knew what it did, you wouldn’t want it on your computer.”
  • 16. What exactly is an APT? APTs APT is short for Advanced Persistent Threat But what does that mean? Here’s one definition: Advanced: the attacker was smarter than us Persistent: the attacker was successful Threat: we accepted risk of being attacked (credit to Paco Hope, Cigital)
  • 17. So, what exactly is an APT? APTs There is no formal definition of APT. The term gets abused by: • Security companies that are trying to scare you into buying something from them. • Companies trying to escape blame for not having proper security controls.
  • 18. Really, what is an APT? APTs Instead of APTs, I would like you to think of Determined Adversaries The determined adversary is the entity behind the APT. The APT is merely the point of the spear.
  • 19. Thinking like a Determined Adversary CAMPAIGN (or how to run your attack campaign) Phase I Reconnaissance Phase II Analysis Phase III R&D Phase IV Trial Run Phase V Implantation of Target
  • 20. Thinking Like a Determined Adversary CAMPAIGN Phase I: Target Reconnaissance • Build a map of the people and of the organization • Identify and describe public-facing network infrastructure • Identify tools and vendors used for network management, infrastructure and security But where do you get this information from? • Company web site: press releases, job descriptions • Social media: employees on LinkedIn, FaceBook, Twitter • Vendor press releases, support web sites • Organizations that the company/employees belong to • Network tools and public databases (whois, dig)
  • 21. Thinking Like a Determined Adversary CAMPAIGN Phase II: Target analysis (victim selection) • Identify vulnerabilities in people – candidate targets for spearphishing – weaknesses in outside vendor/organizations infrastructure • Identify vulnerabilities in network infrastructure – old or outdated networking gear used? • Identify vulnerabilities in OS & apps used by target – there’s usually something old and vulnerable… somewhere – If not, install a vulnerable program and exploit it • Identify vulnerabilities in security infrastructure – old or outdated security tools used? – hardened perimeter, but no internal controls
  • 22. Thinking Like a Determined Adversary CAMPAIGN Phase III: Vulnerability R&D • Design tools (the “APT chain”) to insert into target organization – build it yourself (most expensive & time-consuming) – buy it (0-day brokers, black security companies, also expensive) – partner with related attackers* • The more parties you involve, the greater the risk of attribution.
  • 23. Thinking Like a Determined Adversary CAMPAIGN Phase IV: Trial Run • Simulate target company network, test attack prototypes – look at data – post-mortem analysis – refine attacks • Refine attack chain until confidence level reaches desired level for given attack scenario(s) (lather, rinse, repeat) • Conduct some probes of real target to see how they are handled using separate (and burnable) attack infrastructure – modified copies of existing spam, regular malware, etc. – attack fatigue on their part may increase success of novel attack
  • 24. Thinking Like a Determined Adversary CAMPAIGN Phase V: Implantation of Target/Victim • In you go! • Slow and steady, move laterally through org • Check constantly for signs of detection by target/victim • Continuously gather data which allows to refine attack campaign
  • 25. Advanced Persistent Techniques TECHNIQUES So, what are the tools of the trade used by determined adversaries to run APT campaigns? • Rootkits • Control + Exfiltration logic (Command & Control servers) • Custom partitions and file system • Evasion • Firmware • Programming languages
  • 26. Rootkits Rootkits & Bootkits • Program(s) designed to allow the attacker to bypass security and maintain persistent access to a system • Runs as early as possible, often as a low-level “helper” programs such as services (Windows), daemons (*NIX), kernel extensions (OS X), device drivers (various) etc. • Bootkit: runs before the operating system is loaded – Replace MBR (BIOS partitioned disk) or VBR (GPT partitioned disk) with their own code – Actually not commonly seen with APTs (great for persistence, but easily discovered)
  • 27. Connected or air-gapped C&C / Data Exfiltration • Command & Control for Internet-connected – multiple domains registered in multiple geographies – or use compromised infrastructure – use of common protocols to avoid detection • And for air-gapped targets – could be autonomous • perform pre-programmed actions w/no outside control – exfiltrate data via other mechanisms • (hardware implants, USB flash drives, etc.)
  • 28. Storage techniques for code and data Custom partitions and file systems • Custom partition – add new partition – resize existing partition(s) – use raw area of disk – mark a portion of existing file system as bad • Custom file system – can be custom format; can be compressed or encrypted – storage of stolen data – additional attack code – doesn‘t have to be in a file or file system… • Windows Registry
  • 29. Evasion Getting in and staying undetected • Packers – use commercial or open source (either as-is or modify) – obtain custom packer from private market – create your own • Encryption – use commercial or open source (either as-is or modify) – obtain custom packer from private market – create your own • Avoidance Engineering – identify tools used at target – develop specific countermeasure to bypass
  • 30. Firmware Firmware • Code residing on a chip embedded in hardware • Required to allow computer to initialize/make use of features not support directly by processor/motherboard • Located in many kinds of peripherals and devices – video card – network card – storage controller – storage devices (internal and removable) – motherboards (their own + for on-board devices)
  • 31. Coding & Deployment Programing Language & File Formats • Can be any language, really. – popular programming languages (assembly, C, C++, C#, .NET CLR) • or unpopular (AutoLISP, LUA…) – scripted languages (Flash, Java, JavaScript, HTML, PDF…) • For file-based deployments – use same file formats as those at victim (PDF, Office, SWF…) – digitally-signed, if possible/applicable – metadata removed (or altered) to increase difficulty of forensics – obscured using custom packers or encryption

Editor's Notes

  1. It’s an initialism Source for quote: https://twitter.com/pacohope/status/563247237472747521
  2. Basically, APT has become the 21st century corporate version of “The dog ate my homework.”
  3. And those are the five fingers of death.
  4. Looking for weaknesses Executives, secretaries, non-technical people who might be running software that requires admin access (legacy accounting apps, anyone?) Remember, Target malware came in through HVAC contractor… Also watering hole attack HEARTBLEED attack, anyone? (crunchy on the outside, soft and chewy inside)
  5. You can build everything yourself, as a certain attacker might have done to inject malware into another’s nuclear production facilities. *not really an option for non-government/non-government sanctioned attackers, but it is for some if the DA is gov-based/supposed.
  6. Go through a process of continuous product refinement until you have an attack chain that meets your criterial for success
  7. Take your time, carefully mapping not just infrastructure, but whom your victim typically communicates with Don’t immediately start running nmap or hammering attacks against domain controllers, that kind of stuff gets you noticed
  8. A rootkit is a program whose purpose is two-fold: allow an attacker backdoor access to a system Allow an attacker to maintain that access Often using stealthy mechanisms to avoid detection (disk and file I/O redirection, log alterations, etc.) A real good example of this was from the Windigo Campaign, which went through various techniques to ensure site operators didn’t realize their websites were compromised. If a Determined Adversary can get their code to run before or in conjunction with the operating system loading, they can control what gets loaded—or seen--subsequently. The boot loader on an operating system is the first piece of code which runs from disk after the hardware has initialized. On PC ISA architecture, that means the Master Boot Record when dealing with BIOS-based systems, or more recently, the Volume Boot Record for GPT/UEFI-based systems, This is not actually a file, but rather executable code stored in the beginning sectors of a disk, whose job is to run the first file, which then loads the rest of the OS. Bootkits often seek to disable anti-tamper mechanisms such as checks by the OS for digitally-signed code, or putting the OS into debug mode in order to allow unsigned drivers to load and so forth. This allows the bootkit to perform more complex actions at various points as the operating system loads by loading drivers, services, modifying processes in memory, etc. Bootkits may also be responsible for stealth mechanisms, custom partition/file system initialization, and persistence (i.e., ensuring re-execution on reboot)
  9. For C&C’s, it’s best to use lots of old (ideally 3-5+ years), unobtrusive-sounding domains that were registered a long time ago (years prior to campaign) with little or regular churn on whois data. Having the domains registered and hosted in as many different locations is best, as it complicates research and forensics into them. Or, use compromised infrastructure, especially on some smaller, random ISP or web host which has difficulty handling security. It’s best to use communications protocols common to the attacker, whether its HTTP, IRC, Twitter, same as company’s IM app, etc. It’s much harder to look for a needle in a haystack when the needle looks like every other piece of straw. Air-gapped meaning no physical connection to networks (also applies to wireless LANs, these days) Some of the bots used to attack Estonian network infrastructure in 2007 didn’t have C&C servers, just built-in target lists and timers for when to hit them. If the goal is just to perform a fixed set of operations, or just do damage (spin centrifuges, wipe HDDs, etc.), though, it may not need any further commands.
  10. File system formats often tend to be FAT-like, or simple (flat-file) database structures
  11. This is probably the one everyone’s freaking out about. Look at Xeno Kovah’s work at MITRE….