This document discusses security and hacking. It defines hacking as attempting to gain unauthorized access to computer resources and lists reasons people hack including for fun, to show off, secretly hack other systems, steal important information, and destroy enemy computer networks during war. It describes different types of hacking like website, network, email, and password hacking. It also outlines the evolution of malware from the 1980s to present day and shows statistics on mobile malware and app vulnerabilities. Finally, it discusses the anatomy of multi-staged cyber attacks and how traditional defenses are failing against new attacks.

1. Security
Prepared & Presented by Roland Abi Najem

2. The process of attempting to gain or successfully
gaining, unauthorized access to computer resources
is called Hacking.
What Is Hacking ?
4/22/2015Roland Abi Najem 2

3. Just for fun.
Show off.
Hack other systems secretly.
Notify many people their thought.
Steal important information.
Destroy enemy’s computer network during the war.
4/22/2015Roland Abi Najem 3
Reasons for Hacking

4.  Website Hacking
 Network Hacking
 Ethical Hacking
 Email Hacking
 Password Hacking
 Online Banking Hacking
 Computer Hacking
Types Of Hacking
4/22/2015Roland Abi Najem 4

5. Evolution Of Malware
4/22/2015Roland Abi Najem 5
APTs
Data Loss
Filtering
URL
Filtering
1990s
Anti-spam,Anti-spyware
2000s
Anti-malware
Trojans
Worms,
Bots
Spyware
Spam
Grey-listing
Behavioral
Analysis
Heuristics
Whitelisting
Rootkits
PhishingZero-days
1980s 2010s
OffenseDefense
CodeRed
Melissa
Birth of
Anti-Virus
Mobile
Threats

6. 4/22/2015Roland Abi Najem 6
Statistics Tell A Story
More than 5 billion downloads of
Google Play apps are vulnerable
to remote attacks
The Android platform has the most
mobile malware, around 96%
About 60% popular Google Play
apps have crypto weakness

7. 4/22/2015Roland Abi Najem 7
Anatomy Of A Multi-Staged Cyber
Attack
Exploit Detection is Critical All Subsequent
Stages can be Hidden or Obfuscated
IP
S
File
Share 2
File Share 1
5. Data Exfiltration
3. Callbacks and Control Established
4.Horizontal Spread
Callback Server
Exploit Server
1.Exploitation of System
2.Malware Executable Download
Firewall

8. 4/22/2015Roland Abi Najem 8
Structure Of A Multi-Flow Attack
Exploit injects code in
Web browser1
Exploit code downloads
encrypted malware (not SSL!)2
3 Exploit code decrypts malware
Target end point connects to
C&C server4
CallbackExploit in
compromise
d Web page
Encrypted
Malware
Command and
Control Server
Embedded
Exploit Alters
Endpoint
Callback
Encrypted
malware
downloads
Callback
and data
exfiltration
1 2 3 4

9. 4/22/2015Roland Abi Najem 9
Structure Of A Multi-Flow Attack
Email with weaponized document,
opened by user, causing exploit1
Client endpoint calls back to
infection server2
3 Backdoor DLL dropped
Encrypted callback over HTTP to
command and control server4
Callback
Server
Weaponized Email
(2011 Recruitment Plan.xls) Backdoor C&C Server
1 2 3 4

10. 4/22/2015Roland Abi Najem 10
Anatomy Of A Mobile Threat
Benign Access
1 Calendar Access 2 Microphone Access 3 Exfiltration 4 The tip of the iceberg
Exfiltration
Server
10AM CIA – FBI
sync on Cuba
Hidden Malicious Behavior

11. 4/22/2015Roland Abi Najem 11
Traditional “Defense In Depth” Is
Failing
Firewalls/
NGFW
Secure Web
Gateways
IPS
Anti-Spam
Gateways
DesktopAV
The New Breed of Attacks Evade Signature-Based Defenses

12. 4/22/2015Roland Abi Najem 12
The High Cost Of Being Unprepared
229 Days
Median # of days attackers are present on
a victim network before detection.
3 Months 6 Months 9 Months
Initial
Breach of Companies Learned
They Were Breached from
an External Entity
of Victims Had
Up-To-Date Anti-Virus
Signatures
THREAT UNDETECTED REMEDIATION
Source: M-Trends Report

13. 4/22/2015Roland Abi Najem 13
The High Cost Of Being Unprepared
3 Months 6 Months 9 Months
Initial
Breach of Companies Learned
They Were Breached from
an External Entity
of Victims Had
Up-To-Date Anti-Virus
Signatures
THREAT UNDETECTED REMEDIATION
Source: M-Trends Report,
Ponemon
32 Days
Average Time to Resolve an Attack

14. 4/22/2015Roland Abi Najem 14
Thank You 