Brian Gorenc on the topic “Modern Day Entomology - Examing the Inner Workings of the Bug Bazaar”.
•Download as PPTX, PDF•
0 likes•149 views
HackIT is an annual cybersecurity conference that gathers the best technical researchers and top players in the cybersecurity industry to explore cutting-edge technologies together. In 2018, HackIT focused on the use of blockchain technology. Join our community: Website - https://hacken.live/hackit-slideshare Twitter - https://hacken.live/twitter_hackit Facebook - https://hacken.live/facebook_hackit Instagram - https://hacken.live/instagram_hackit Reddit - https://hacken.live/reddit Telegram community - https://hacken.live/tg-hackit #hackit #cybersecurity #blockchain #hacking
Recommended
More Related Content
Similar to Brian Gorenc on the topic “Modern Day Entomology - Examing the Inner Workings of the Bug Bazaar”.
Similar to Brian Gorenc on the topic “Modern Day Entomology - Examing the Inner Workings of the Bug Bazaar”. (20)
More from Hacken_Ecosystem
More from Hacken_Ecosystem (13)
Recently uploaded
Recently uploaded (20)
Brian Gorenc on the topic “Modern Day Entomology - Examing the Inner Workings of the Bug Bazaar”.
- 1. Modern Day Entomology Examining the Inner Workings of the Bug Bazaar
- 2. 2 Copyright 2018 Trend Micro Inc. Director of Vulnerability Research at Trend Micro Leads the Zero Day Initiative Organizes Pwn2Own Approver of Payments Past Experiences Lead Developer at Lockheed Martin Bug Hunter Past research: Microsoft Bounty submission Patents on Exploit Mitigation Technologies Bug hunting in many products Twitter: @MaliciousInput Brian Gorenc
- 3. Copyright 2018 Trend Micro Inc.3
- 4. 4 Copyright 2018 Trend Micro Inc. How it works Trend Micro Customers Protected Ahead of Patch Other Network Security Vendor’s Customers at Risk Vulnerability submitted to the ZDI program Vendor Notified Digital Vaccine® Filter Created Vendor Response Window Vulnerability is Patched or Remains Unfixed Public Disclosure
- 6. 6 Copyright 2018 Trend Micro Inc. Economy in Action Researchers Finds Bugs Bug Bounty Program Report to Vendor Sell Report $1K - $25K Signatures Exploit Kit Creator $10K - $100K Vuln Broker Government $10K - $1000K $10K - $1000K Bot HerderBotnet Creator Compromises PCs Sells Kit Rents Botnet Spammer DDoS Extortion Credential Harvesting Smart Criminal Make One Big Purchase Sells Stolen Creds Dumb Criminal Buys Beer & Chips Re-Sells Stolen Creds Used Against??
- 7. 7 Copyright 2018 Trend Micro Inc. 0 100 200 300 400 500 600 700 800 900 1000 Qtr4 2013 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 Qtr2 Active economy
- 8. 8 Copyright 2018 Trend Micro Inc. Variety High-Profile SCADA/IIoT Infrastructure Virtualization IoT Enterprise Security Misc Open Source Web Other Mobile Top Vendors
- 9. 9 Copyright 2018 Trend Micro Inc. Global economy
- 10. 10 Copyright 2018 Trend Micro Inc. Highly-deployed software submissions
- 11. 11 Copyright 2018 Trend Micro Inc. SCADA submissions
- 12. 12 Copyright 2018 Trend Micro Inc. Lessons learned from Hacking Team
- 13. 13 Copyright 2018 Trend Micro Inc. Lucrative business
- 14. 14 Copyright 2018 Trend Micro Inc. How to buy 0-day: Consultancy Services
- 15. 15 Copyright 2018 Trend Micro Inc. How to buy 0-day: Vulnerability Brokers
- 16. 16 Copyright 2018 Trend Micro Inc. Payments and Pay Schedules
- 17. 17 Copyright 2018 Trend Micro Inc. Exploit Inventory
- 19. 19 Copyright 2018 Trend Micro Inc. 0 5 10 15 20 25 30 35 40 Qtr1 2011 Qtr2 Qtr3 Qtr4 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Browser Click-to-Play Intervention
- 20. 20 Copyright 2018 Trend Micro Inc. 0 10 20 30 40 50 60 70 80 90 100 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 New Mitigations
- 21. 21 Copyright 2018 Trend Micro Inc. 0 10 20 30 40 50 60 70 80 90 100 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 New Mitigations
- 22. 22 Copyright 2018 Trend Micro Inc. 0 5 10 15 20 25 30 35 40 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 End of Life Announcements
- 23. 23 Copyright 2018 Trend Micro Inc. 0 20 40 60 80 100 120 140 160 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 Unchecked
- 24. 24 Copyright 2018 Trend Micro Inc. 0 50 100 150 200 Qtr1 2012 Qtr2 Qtr3 Qtr4 Qtr1 2013 Qtr2 Qtr3 Qtr4 Qtr1 2014 Qtr2 Qtr3 Qtr4 Qtr1 2015 Qtr2 Qtr3 Qtr4 Qtr1 2016 Qtr2 Qtr3 Qtr4 Qtr1 2017 Qtr2 Qtr3 Qtr4 Qtr1 2018 Predicting the Next
- 25. 25 Copyright 2018 Trend Micro Inc. New Regulations
- 26. 26 Copyright 2018 Trend Micro Inc. Pwn2Own
- 27. War Stories 27
- 28. 28 Copyright 2018 Trend Micro Inc. Shades of Stuxnet
- 29. 29 Copyright 2018 Trend Micro Inc. Killing CIA’s Closed Network Infiltration Tool
- 30. 30 Copyright 2018 Trend Micro Inc. 30 Disrupting BlackEnergy
- 31. 31 Copyright 2018 Trend Micro Inc. CVE-2018-8174 used in targeted attacks 1. Victim opens a malicious Microsoft Word doc 2. Malicious doc downloads HTML page containing VBScript 3. VBScript triggers Use-After-Free vulnerability VBScript Double Kill Vulnerability ITW
- 32. 32 Copyright 2018 Trend Micro Inc. Matches Trending Data ZDI Pre-disclosure Guidance Catches CVE-2018-8373 CVE-2018-8373 ITW
- 33. Conclusion
- 34. 34 Copyright 2018 Trend Micro Inc. Conclusion
- 35. 35 Copyright 2018 Trend Micro Inc. https://www.zerodayinitiative.com/blog Plugging In https://www.zerodayinitiative.com @thezdi PGP https://www.zerodayinitiative.com/documents/zdi-pgp-key.asc Fingerprint: 743F 60DB 46EA C4A0 1F7D B545 8088 FEDF 9A5F D228 zdi@trendmicro.com
- 36. Questions Thank you for your time and attention
Editor's Notes
- Vulnerability Submitted: A researcher submits a previously unpatched vulnerability to the Zero Day Initiative, who validates the vulnerability, determines its worth, and makes a monetary offer to the researcher. Vendor Notified: The Zero Day Initiative responsibly and promptly notifies the appropriate product vendor of a security flaw with their product(s) or service(s). Digital Vaccine® Filter Created: Simultaneously with the vendor being notified, Trend Micro TippingPoint works to create a Digital Vaccine filter to protect customers from the unpatched vulnerability. Vendor Response: The Zero Day Initiative allows the vendor four months to address the vulnerability. Vulnerability is Patched or Remains Unfixed: The vendor will either release a patch for the vulnerability or indicate to the Zero Day Initiative that it is unable to, or chooses not to, patch the vulnerability. Public Disclosure: The Zero Day Initiative will publicly and responsibly disclose the details of the vulnerability on its Web site in accordance with its vulnerability disclosure policy.
- Adobe, Apple, Foxit, Google, Microsoft, Mozilla, Oracle, WebKit
- 3S Pocketnet Tech, ABB, Advantech, ARRIS, Codesys, Cogent Real-Time Systems, Ecava, GE, Honeywell, Indusoft, MICROSYS, Proface, PTC, Rockwell Automation, Schneider Electric, Tibbo, Trihedral Engineering Ltd, Unitronics, WellinTech
- Now, when Hacking Team happened most in the industry poured over the evidence look for 0-day. Not ZDI. We looked for financial data. Who was buying, Who was selling, What were the prices? Are we making a impact in the shady grey market? Hacking Team dumps give us solid evidence here…and it is quite lucrative. RAV service 90,000 E to Czech Republic Similar service to Kazazkhstan for 180,000 E Additional buyers: Guatemala Lebanon Mongolia Russia Egypt Vietnam Malaysia Federal police of brazil Bangladesh Police - Rapid Action Battalion Republic of South Korea - Army Saudi Arabia Cyprus UAE Mexico Republic of Hungary And Small company called Cyberpoint in MD< USA
- Information from their Board of Directors meeting leads to other interesting insights into the marketplace 10 million in revue Expected >30% growth Paid employees $80,000 on average Other Personal Cost 500,000 Grow by 50% next year What is the category? Could it be consultancy fees and the broker costs. Highly likely. To make this money, you need in this business you need 0-day exploits. Via FTE or from the free market… How do they do they engage in the free market?
- Go directly to the researchers. But you have to be good… For example, take Vitaliy Toropov
- Next option is Vulnerability Brokers to keeps the remote access product working is brokers. Here we have an Adobe Flash exploit for sale The most interesting here is the asset availability. Why buy exclusive or non-exclusive? Stealthiness, of course. For highly target attacks, a “fire-and-forget” model is the only real option. The more it is out there, the more likely it will get caught. But what does that benefit cost?
- Much better then the consultancy rate. $95,000 Paid out over a 3 month period. Why is this done? 0-day is only as good as long as it is 0-day. Fees are paid out over time so the original researcher does not burn the bug after the payment.
- What is being avilable? Browsers, Kernel, Mobile, Security Software, Core Software like PHP So how does ZDI fair in the what it is attracting from the marketplace? Are we buying and fixing bugs that will impact the grey market and protect customers? The answer is YES But where is the evidence of our impact in this market place?
- Jan 2013 - https://blog.mozilla.org/security/2013/01/29/putting-users-in-control-of-plugins/
- JIT (Bound Checking, Type Confusion) UAF due to MemGC failed as a mitigation Issue in JavaScript Array Implementation
- JIT (Bound Checking, Type Confusion) UAF due to MemGC failed as a mitigation Issue in JavaScript Array Implementation
- Adobe End of life announcement - https://theblog.adobe.com/adobe-flash-update/
- JIT (Bound Checking, Type Confusion) UAF due to MemGC failed as a mitigation Issue in JavaScript Array Implementation
- JIT (Bound Checking, Type Confusion) UAF due to MemGC failed as a mitigation Issue in JavaScript Array Implementation
- December 2013 The purpose of the amendments was to prevent Western technology companies from selling surveillance technology to governments known to abuse human rights. The Wassenaar Arrangement was established to contribute to regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies, thus preventing destabilizing accumulations. Participating states seek, through their national policies, to ensure that transfers of these items do not contribute to the development or enhancement of military capabilities which undermine these goals, and are not diverted to support such capabilities. https://www.wassenaar.org/app/uploads/2018/01/WA-DOC-17-PUB-006-Public-Docs-Vol.II-2017-List-of-DU-Goods-and-Technologies-and-Munitions-List.pdf
- Starting in 2007, the Pwn2Own hacking competition has grown into the world’s premier hacking contest. 2017 was the 10th anniversary of the contest, and more than $1 million dollars was made available to contestants. It’s only a slight hyperbole to refer to Pwn2Own as the root of all research. When we announce a new category for Pwn2Own, we don’t expect to see any entries in that category that year. However, history has shown that once we announce a new target at Pwn2Own, researchers start working in that area and submit entries the following year. That happened in 2016 when we announce VMWare as a target. As expected, we didn’t get any entries in 2016, but we did get two successful VMWare escapes in 2017. This was also our first year with Hyper-V and Apache web server as a target, and again, we didn’t receive any attempts on these targets. Next year’s conference should prove interesting.