How nation-states and criminal syndicates use exploits to bypass se...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Mark Loman
How Nation-States and Criminal
Syndicates Use Exploits to Bypass
Security
SPO3-T11...

#RSAC
Vulnerabilities by Year
2
A vulnerability is a weakness in an application or the system that could
provide attackers...

#RSAC
Exploits
3
An exploit tries to turn a vulnerability (a weakness) into a way to
breach a system
Exploits are not malw...

#RSAC
Code Execution
4
3
191
103
64
10
75
466
66
19
14
363
519
113
0 100 200 300 400 500 600
Oracle Java (JRE)
Mozilla Fir...

#RSAC
Exploit Usage
5
Cybercriminals
Large-scale malware distribution
— Exploit Kits (web, malvertising)
Nation State Acto...

#RSAC
Exploit Kits 2016
For Large-scale Malware Distribution

#RSAC
Exploit Kits (2016)
7
Angler Defunct, shut down in June 2016 w/ arrest of Lure gang
Magnitude
Neutrino Defunct, not ...

#RSAC
Exploit Kits (2016)
8
1H2016
Angler Nuclear Neutrino
Magnitude RIG Other
2H2016
RIG Neutrino Other

#RSAC
Exploits in Kits (Jan 2017)
9
Magnitude
Neutrino-v
RIG, RIG-E
Sundown
Bizarro Sundown
CVE-2016-0189CVE-2016-4117
CVE...

#RSAC
Nation State Actors
Fancy Bear (APT28)
Also known as Pawn Storm, Sofacy Group, Sednit, Tsar Team and
STRONTIUM

#RSAC
APT28
11
Consistent use of Russian language in malware
Malware compile times correspond with business hours of Russi...

#RSAC
APT28 Targets
12
German parliament (2014)
French television hack (April 2015)
White House, NATO (August 2015)
Dutch ...

#RSAC
2016
Zero-Day Exploits Used by APT28
13
APR MAY JUN JUL AUG SEP OCT NOV DEC APR MAY JUN JUL AUG SEP OCTJAN FEB MARMA...

#RSAC
CVE-2015-5119 Hacking Team
14
Exploit developed
in 2013
Comes with attack
for Apple Macs

#RSAC
Nation State Actor
Buckeye (APT3)
Also known as Pirpi, UPS, Gothic Panda, TG-0110

#RSAC
Zero-Day Exploits Used by APT3
16
FEB MAR APR MAY JUN AUG SEP OCT NOVJAN
2015
CVE-2015-5119*Flash
Hacking Team
* Als...

#RSAC
APT3 vs Angler EK
How a Nation-State and Cybercriminals Abused CVE-2015-3113

#RSAC
Commonalities APT3 and Angler EK
18
Heap-based buffer overflow in Adobe Flash Player 18.0.0.160
Flash Video File (.F...

#RSAC
Angler EK CVE-2015-3113
19
0857c000 0857c040 6cbf0736 cccccccc cccccccc
0857c010 cccccccc cccccccc cccccccc cccccccc...

#RSAC
Angler EK CVE-2015-3113
20
0857c000 0857c040 6cbf0736 cccccccc cccccccc
0857c010 cccccccc cccccccc cccccccc cccccccc...

#RSAC
Angler EK CVE-2015-3113
21
0857c000 0857c040 6cbf0736 cccccccc cccccccc
0857c010 cccccccc cccccccc cccccccc cccccccc...

#RSAC
Angler EK CVE-2015-3113
22
0857c000 0857c040 6cbf0736 cccccccc cccccccc
0857c010 cccccccc cccccccc cccccccc cccccccc...

#RSAC
Angler EK CVE-2015-3113
23
0857c000 0857c040 6cbf0736 cccccccc cccccccc
0857c010 cccccccc cccccccc cccccccc cccccccc...

#RSAC
APT3 CVE-2015-3113
24
this.customClassInstance.theMethod(_loc32_, _loc32_, _loc32_,
_loc32_, _loc32_, _loc32_, _loc3...

#RSAC
APT3 CVE-2015-3113
25
this.customClassInstance.theMethod(_loc32_, _loc32_, _loc32_,
_loc32_, _loc32_, _loc32_, _loc3...

#RSAC
APT3 CVE-2015-3113
26
this.customClassInstance.theMethod(_loc32_, _loc32_, _loc32_,
_loc32_, _loc32_, _loc32_, _loc3...

#RSAC
APT3 CVE-2015-3113
27
02fae6ac 6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6ceb...

#RSAC
APT3 CVE-2015-3113
28
02fae6ac 6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6ceb...

#RSAC
APT3 CVE-2015-3113
29
02fae6ac 6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6ceb...

#RSAC
APT3 CVE-2015-3113
30
02fae6ac 6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6cebb68b 6cebb68b 6cebb68b
6cebb68b 6ceb...

#RSAC
APT3 CVE-2015-3113
31
1f140210 nop
...
1f140217 mov eax,1F140008h
1f14021c nop
...
1f14021f mov ebx, offset IEShims!...

#RSAC
APT3 CVE-2015-3113
32
1f140210 nop
...
1f140217 mov eax,1F140008h
1f14021c nop
...
1f14021f mov ebx, offset IEShims!...

#RSAC
Conclusion
33
1 vulnerability, 2 very different exploit attacks
Angler EK (Cybercriminals)
 ROP chain on the heap
...

#RSAC
Software (stack) based ROP mitigations
34
No historic and no reliable stack data (e.g. call-preceded gadgets)
011011...

#RSAC
Hardware Augmented Control-Flow Integrity
35
Obtains reliable history (repurposes unused feature in Intel® CPUs)
011...

#RSAC
Hardware Augmented Control-Flow Integrity
36
Callee Type AllocateVirtualMemory
0x1F140000 (65536 bytes)
Branch Trace...

#RSAC
Hardware Augmented Control-Flow Integrity
37
Callee Type AllocateVirtualMemory
0x1F140000 (65536 bytes)
Branch Trace...

#RSAC
Comparing HA-CFI and Control Flow Guard
38
Control-Flow Integrity
 Stops ROP attacks as a whole
(fine-grained analy...

#RSAC
Angler EK Evading EMET
Angler EK (March 2016) vs EMET (November 2016)
http://arstechnica.com/security/2016/06/drive-...

#RSAC
Angler EK Evading EMET
40
{Todo}

#RSAC
Angler EK Evading EMET
41
{Todo}

#RSAC
Conclusion
42
Attackers can leverage even old vulnerabilities by (re-)weaponizing
their exploits to evade today’s si...

#RSAC
Applying knowledge
43
Next week you should:
Inventorize vulnerable and unused applications, plugins and End-of-Life ...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 43 Ad

View on Slideshare

1 of 43 Ad