Uploaded byZscaler
Stopping zero day threats
The document outlines the concept of zero-day threats, which are vulnerabilities not yet known to software vendors, and discusses the lifecycle of such vulnerabilities, including their discovery and the exploitation process used by attackers. It provides examples of notable zero-day vulnerabilities and emphasizes the rise of sophisticated attacks that leverage these weaknesses, highlighting the need for enhanced security measures and continuous monitoring. Additionally, the document reviews the current state of enterprise security defenses, exposing gaps and recommending advanced threat protection strategies to mitigate the risks associated with zero-day exploits.
More Related Content
Similar to Stopping zero day threats
Stopping zero day threats
- 1. Stopping Zero DayThreats Zscaler, Inc.
- 2. Defining the “zero-day”(software) threat The term “zero-day” refers to the number of days that the software vendor has known about the hole - ZERO. A security hole in software that is not yet known to the software maker or to Information Security vendors NO PATCH – NO SIGNATURE Code that attackers use to take advantage of a zero-day vulnerability to compromise a system for their benefit DROP - CONTROL - DISABLE Zero-day vulnerability Zero-day exploit
- 3. Zero-Day Vulnerability Lifecycle Lifecycleof a zero-day vulnerability New vulnerability discovered “in the wild” Someone informs the vendor about the vulnerability You install patches and update signatures Public is aware of the riskPublic unaware of risk You are safe…You are vulnerable… Patch Gap Most Vulnerable Vendor releases security patches to the public, CVE posted
- 4. Kill chain analysisof an advanced threat 1 Reconnaissance Harvesting email and IP addresses, Surveying defenses 2 Weaponization Coupling exploit with attack Infrastructure - deliverable payload 3 Delivery Delivering weaponized bundle to the victim via email, web – drive-by-download 5 Installation Installing malware on the asset 6 Command & Control (C2) Command channel for remote manipulation of victim’s system or additional malware downloads 7 Action on Objectives Lateral movement, data exfiltration, disruption, etc. 4 Exploitation Exploiting a vulnerability to execute code on victim’s system • Zero-day vulnerabilities • Unpatched vulnerabilities
- 5. Example of azero-day vulnerability ‣ Acrobat Reader - CVE-2014-0512 : Adobe Reader 11.0.06 allows attackers to bypass a PDF sandbox protection mechanism via unspecified vectors ‣ Internet Explorer 9 through 11 Exploit - CVE-2016-0072 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability,” ‣ Microsoft Server Service Vulnerability - allowed remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code ‣ Wordpress Cross-Site Scripting Vulnerability - allows attackers to execute arbitrary code or cause a denial of service (memory corruption) ‣ Operation Snowman Exploit - targets IE 10 with Adobe Flash, the vulnerability allows the attacker to modify one byte of memory at an arbitrary address ‣ Microsoft Office - CVE-2016-0052: allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability,"
- 6. Sophisticated breaches cango undetected for a long time Data breaches tend to continue for months and even years 18 Days 106 Days 180 Days 246 Days 266 Days
- 7. US Office ofPersonnel Management (OPM) Data Breach - Timeline 2014 2015Jul Aug Sep Oct Nov Dec Jan Initial OPM breach OPM investigates a breach of its computer networks dating back to July 2014. Authorities trace the intrusion to China. Inspector General Report A report by OPM’s Office of the Inspector General on the agency’s compliance with Federal Information Security Management Act finds “significant” deficiencies in the department’s IT security. KeyPoint Initial Detection Feb Mar Apr May Jun KeyPoint, a company that took over background checks for USIS, suffers breach. OPM states that there is “no conclusive evidence to confirm sensitive information was removed from the system.” OPM became aware of an intrusion affecting its systems and data in April 2015 and launched an investigation with its agency partners, the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Subsequent Detection OPM became aware of the potential compromise of data related to personnel records for current and former Federal employees Public Disclosure
- 8. US OPM SensitivePersonal Information (SPI) Data Breach ‣ Who was affected? • “Current, former, and prospective Federal government employees, and those for whom a Federal background investigation was conducted” • Original est. – 4.2M records, adjusted to 18M ‣ What was stolen? • “Name, SSN, date and place of birth and current and former addresses... could include the type of information you would typically find in a personnel file, such as job assignme nts, training records ‣ Head scratcher • "If there is anyone to blame, it is the perpetrators," OPM Director Katherine Archuleta told members of a Senate panel
- 9. Black market White market Gray market Zero-day vulnerabilities =$$$ in the marketplaces • Cybercrime Organizations • Buy and sell exploit code • Goal: break into systems, steal data • Vendor bug bounty programs • Buy and sell vulnerability info • Goal: fix security holes • Military and intelligence agencies • Buy zero-day exploits and vulnerability info • Goal: surveillance and offensive ops
- 10. The market forzero-day exploits Forbes: Price List for Zero-Day Exploits – Government Agencies Gray market Black market White market
- 11. Zero Day Disclosure- “Rain Forest Puppy” policy • Ethical hackers and researchers often follow the policy and give the vendor five working days to respond • The reporter should help the vendor reproduce the bug • The reporter should delay notifying the general community about the bug if the vendor provides feasible reasons for doing so • When issuing an alert or fix, the vendor should give the reporter proper credits about reporting the bug • If the vendor fails to contact the reporter in those five days, the recommendation is to disclose
- 12. Advanced threat trendsand behavior
- 13. Data Breach Trends •Data breaches are on the rise • 2014-15 saw a significant jump of breaches in the retail and healthcare sectors • Breach disclosure laws have contributed to greater exposure in the mainstream press • There were more identity breach victims, but less money was directly stolen Source: http://www.informationisbeautiful.net/visualizations/ worlds-biggest-data-breaches-hacks/
- 14. SecurityAttackersEnterprises Attacks 2006 2016 Why areAdvanced Threats so hard to stop? Enterprise security has failed to keep pace with the evolving threat landscape Sedentary Workforce PCs and laptops Corporate network VPN connectivity required for remote employees Corp. owned devices Dynamic Workforce Smartphones and tablets Working from free wifi networks and 3G/4G connections BYOD Rogue Individuals Motivated by the challenge No financial gain Organized Criminals Well funded Highly skilled Criminal organizations Financial/political gain Loud and Noisy Server side vulnerabilities Attacks were obvious and a brief duration Damage could be costly but easy to clean up Quiet and stealthy Exploiting client-side vulns and social engineering Leveraging end users as a catalyst Goal - data exfiltration • URL filtering • Anti-virus • URL filtering • Anti-virus
- 15. Attacks are deeperand more sophisticated than ever before Loading Stage Spam & phishing e-mail Social Networking sites SEO poisoning Compromised websites Malvertising on legitimate sites Landing Stage Identification of client side technologies O/S, browser and plugins versions installed Determine effectiveness of payloads Often requires no user intervention Malware Payload Delivery Anti-VM and Anti-Analysis features Detection of known antivirus drivers Multiple levels of highly obfuscated JavaScript code Dynamic construction of exploit payload URLs only when a vulnerability is found Short lived exploit payload URLs often restricted to one visit per IP address Obfuscated and repackaged exploit/malware payloads
- 16. 17,412 new advancedthreats detected by Zscaler behavioral analysis in just 30 days (Jan 2016) Over 750 billion transactions in one month • 2 billion+ threats blocked • 1,199,188 suspicious objects extracted from traffic and sent to sandboxes • 17,412 new advanced threats detected and blocked for all cloud users simultaneously
- 17. Not playing nicein the sandbox 0 5000 10000 15000 20000 25000 30000 35000 40000 45000 50000 Executes massive amount of sleeps in a loop Dropped PE files which have not been started or loaded Contains long sleeps Uploads sensitive system information Checks for kernel debuggers Reads the hosts file Enables driver privileges Queries the volume information Checks free space Looks for software installed Contains strings which match to known bank URLs Requests potentially dangerous permissions Uses a known web browser user agent for HTTP communication Creates mutexes Executes native commands Tries to load missing DLLs Kills processes Tries to detect sandboxes and other dynamic analysis tools Top Malware Behaviors Monitored in Sandbox
- 18. Case Study: ChineseAPT Group Emissary Panda Chinese APT group “Emissary Panda”, known for stealing Intellectual Property data from target companies Attacks seen on Zscaler Cloud • Investigation started with ABA block on content from a compromised Government site (watering hole) • Attack Chain shows use of Hacking Team’s leaked 0- day exploits • Installs a SSL based Remote Access Trojan (RAT) upon success Multiple Industries Targeted • Energy & Construction • Financial Services Firm • Pharmaceutical More at – research.zscaler.com (Aug ‘15) 210.209.89.162 /rs/ie.html 210.209.89.162 /rs/swfobject.js 210.209.89.162 /rs/out.swf 210.209.89.162 /rs/svchost.exe reis.railnet.gov.in/ APT attack infrastructure Compromised site
- 19. Case Study: CryptoWall •Version 3.0 first observed June 2015, version 4.0 Nov 2015 • Binary digitally signed (MDG Advertising) • Uses strong encryption to encrypt all files on HDD, attached devices and network shares • Imagine a domain admin getting infected… • CryptoWall features: • Asymmetric (public-key) encryption to encrypt user documents, making recovery infeasible • Ransom starts at U$500 and increases over time • One file will be decrypted for free… • Ransom collected in bitcoins or as pre-paid cash vouchers / cards • Usage of anonymizing networks like Tor & i2p • New versions even have chat-based support!
- 20. Stopping Zero DayThreats
- 21. How good aremy defenses? Current security controls are not working 93% of organizations had infected computers communicating with C&C servers of malware coming in the network was unknown to antivirus vendors52% 79% of organizations were experiencing data exfiltration Source: KPMG enterprise security, August 2014
- 22. Think encryption isgoing to keep you safe? ‣ SSL traffic is becoming pervasive, but most organizations are blind to it • 40% percent of Internet traffic is now encrypted with SSL, growing to more than 50% in 2016 ‣ The most sophisticated threats are using SSL • 16% of all traffic blocked uses SSL • 54% of advanced threats use SSL ‣ If your policies do not include SSL inspection, all your security tools are half-blind SSL traffic on enterprise networks is growing rapidly & creating security blind spots
- 23. Strategies based onalerting are doomed to failure ‣ Alerting allows infections to happen – with no guarantee you’ll notice them ‣ Alerting based strategies lead to SOC overload – which of the 1,000 alerts do you pay attention to? ‣ All threats and violations must be automatically blocked Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It Alert Fatigue
- 24. Kill chain analysisof an advanced threat Malicious websites can be blocked – “sometimes” Identify and block outbound data exfiltration Behavioral Analysis can detect malicious behavior By definition, can’t identify zero-day vulnerability Identify and block outbound CnC communications 1 Reconnaissance Harvesting email and IP addresses, Surveying defenses 2 Weaponization Coupling exploit with attack Infrastructure - deliverable payload 3 Delivery Delivering weaponized bundle to the victim via email, web – drive-by-download 5 Installation Installing malware on the asset 6 Command & Control (C2) Command channel for remote manipulation of victim’s system or additional malware downloads 7 Action on Objectives Lateral movement, data exfiltration, disruption, etc. 4 Exploitation Exploiting a vulnerability to execute code on victim’s system
- 25. Best practices forstopping APTs in Internet traffic Defense in depth Inline Antivirus & Anti-spyware Deep Content Inspection Browser and Plugin Vulnerabilities Page-Level Risk Analysis Block Malicious URLs and Files Sandboxing Botnet calls, malicious URLs, data exfiltration, SSL, etc. OUTBOUND TRAFFICINBOUND TRAFFIC Viruses, APTs, Adware, Spyware, Malicious Javascript, Exploits, Malformed Files, XSS, etc Known Threats Unknown ThreatsZero-day threats
- 26. Zscaler Advanced ThreatProtection Protect – stop infections from happening ‣ Always in-line – can always block ‣ Multiple layers of security with automated in- line SSL inspection ‣ Behavioral analysis for zero day files ‣ File quarantine - first global victim is protected ‣ Instant cloud-wide blocking of new threats ‣ Lock down all ports & protocols with built-in NG firewall
- 27. Zscaler Advanced ThreatProtection Detect – identify compromised devices ‣ Monitor infection trends ‣ Isolate infected machines ‣ Identify types of attacks ‣ Track users with risky behavior ‣ Show value of the solution to the CxO
- 28. Zscaler Advanced ThreatProtection Remediate – minimize impact and heal ‣ Stop data exfiltration attempts, including over SSL ‣ Lock down unauthorized ports and protocols ‣ Block botnet CnC communications ‣ Complete visibility, even to cloud applications ‣ Easy to use, detailed forensics ‣ Correlation across users /devices / locations
- 29. How Zscaler sandboxingworks Block or Allow “known” files: • Malware identified by AV, threat database, or static analysis • Benign files identified by whitelist or file type Unknown files go through Behavioral Analysis : • “Detonate” in a virtual sandbox • Capture and analyze behavior • Identify malware vs benign • Update threat database • Automatically block malware • Automatically pass benign files
- 30. Zscaler APT ProtectionKey Highlights: Behavioral Analysis Report Quarantine – ensures no one gets infected with zero day attack Forensics analysis with key features to make remediation easy: • Screen captures during malware execution • Packet captures for detailed analysis • Detection evading techniques used • Memory and process analysis • Networking level activity
- 31.
- 32. Backhaul traffic throughthe data center Slow, complex, & expensive Mobile HQ Remote Offices Too many gateways to buy, deploy & manage Build a perimeter around every office HQ Remote Offices Security appliances: two challenging choices
- 33. Exploits APTMalware Public Cloud SaaS PrivateCloud Botnets Real-time global visibility (threats, apps, users) Single policy definition point (context) Mobile Employee HQ Remote Offices Full inline inspection (SSL) All ports, all protocols Off Network PAC / Mobile Agent On Network GRE/IPSEC Traffic forwarding Two use cases: Zscaler: putting a perimeter around the Internet So you don’t need to put a perimeter around every office and every device
- 34. Web security Advanced threat protection Cloudapp visibility & control Cloud Firewall Bandwidth Controls Data loss prevention Context-aware policies Global real-time analytics SSL inspection Threat Correlation Multi-tenant distributed carrier-grade cloud (Peering relationships) Zscaler cloud security platform Cloud Sandbox Purpose-built, integrated services consolidate and simplify the appliance mess
- 35. Industry analysts agree… “…on-premisesweb content security can’t protect digital business…” “…largest global cloud footprint with more than 100 enforcement nodes…”
- 36. Zscaler delivers valueto all stakeholders CISO: BETTER SECURITY Scan and score every byte (SSL) Always up-to-date Correlation of threat prevention techniques Consistent policies globally Full audit controls- every user, device, & app in all locations CIO/CTO: SIMPLIFICATION No patch management or EOS issues No shipping, staging, updating Checkbox to enable new features No maintenance windows Elastic scale CFO: FASTER ROI Minimize CAPEX investment – no boxes to purchase Reduce OPEX – no boxes to maintain END USER: IMPROVED EXPERIENCE Faster response times Localized Internet content Single admin console Real-time global reports Performance SLA
- 37. Consider Three Users… •We must seek security solutions that ensure consistent policy, protection and visibility, regardless of device or location. • Cloud provides the opportunity to level the playing field. Office Coffee Shop Airport Device PC / Laptop Laptop Tablet/ smartphone Protection IDS, IPS, FW, SWG, DLP, etc. Host based AV and firewall Nothing Visibility Location based reporting Nothing Nothing
- 38. Next Steps 37 Free SecurityHealth Check Risk free evaluation of your security infrastructure Go to: http://www.zscaler.com/securitypreview Live Product Demos Register here: https://www.zscaler.com/productdemos
- 39.