Could a purpose built supercomputer play DEF CON Capture the Flag?
|
|
|
- Briana Hodge
- 8 years ago
- Views:
Transcription
1 Could a purpose built supercomputer play DEF CON Capture the Flag? Mike Walker Program Manager 1
2 Cyber Competition Challenges Turing, Rice, & Undecidable Problems: Is the software correct & secure? If not, how incorrect or insecure is it? Q: Can we compete when the answers required to name a victor are undecidable? 2
3 Competitive Programming: TopCoder 1: Construct 2: Challenge 3
4 Competitive Programming: TopCoder 1: Construct 2: Challenge 4
5 Competitive Programming: TopCoder 1: Construct 2: Challenge 2 31 int mid = (low + high) / 2; ArrayIndexOutOfBoundsException * * 5
6 Competitive Programming Q: Can we compete when the answers required to name a victor are undecidable? A: consensus evaluation 6
7 Competitive Computer Security: DEF CON CTF Artificial ecosystem of flawed software Construct Challenge 7
8 Competitive Computer Security: DEF CON CTF Artificial ecosystem of flawed software Construct Challenge 8
9 Competitive Computer Security: DEF CON CTF Artificial ecosystem of flawed software Construct Challenge 9
10 Competition Paradigm Harness consensus evaluation to identify breakthrough technology. 10
11 A tournament for fully automated network defense 11
12 DECREE ( DARPA Experimental Cyber Research Evaluation Environment Specially Designed Environment 7 System Calls [Garfinkel2003] terminate end program (exit) transmit write data to an fd (write) receive read data from an fd (read) fdwait wait for fds (select) allocate allocates memory (mmap) deallocate releases allocated memory (munmap) random populate a buffer with random bytes Restricted Inter-Process Communication No shared memory Only socketpairs Clean bidirectional communication Automatically created by system on startup Shared between all processes in an IPC CB 12
13 CTF: Alternative Software Ecosystem Authentic Analysis Challenges Synthetic Programs Memory aliasing Lightweight Network Services Race condition dependent memory corruption Used Only Once Randomized Initial State Dependent Flaws No A Priori Knowledge Hidden Interpreters Dynamic Network Utilization Defcon CTF Qualifiers 2007 Highest difficulty (500), network application flaw category Hidden mutex unlock condition triggers timing specific memory corruption* Authentic Skills, Synthetic Software *nopsr.us 13
14 Challenge Binaries No filesystem access, no new network connections, no process creation, no signals, no shared memory Userspace only and statically linked [Qu2011] Compiled Binaries only (not hand coded) Always available Ground truth A null pointer dereference vulnerability (CVE ) in the Linux kernel, where the dereference of pointer tun is before the null pointer check. The code becomes exploitable as gcc optimizes away the null pointer check [10] [Wang2013] Wide availability of lifters (these are open source x86) BAP (BAP IR) - RedHat (default Sendmail ) does not crash RedHat (default Sendmail ) does not crash RedHat 7.3 (p) - (patched Sendmail ) does not crash RedHat (self compiled Sendmail ) crashes RedHat (self compiled Sendmail ) crashes RedHat (self compiled Sendmail ) crashes Slackware 8.0 (p)- (patched Sendmail binary) crashes Slackware (self compiled Sendmail ) does not crash RedHat 7.x - (self compiled Sendmail ) does not crash (p) - patched box Due to the nature of the overflowed buffer declaration (static), exploitation of this issue is highly dependent on the way compiler orders the static data in the data segment [LSD2003] BitBlaze (VINE IR) - McSema (LLVM IR) - It is in the process of being open sourced [Dinaburg2014] QEMU (TCG IR) Valgrind (VEX IR) 14
15 Reproducibility Evaluating a non-trivial idea is beyond the time budget of any single paper as this requires running many benchmarks on multiple implementations with different hardware and software platforms. Often a careful comparison to the state of the art means implementing competing solutions. The result of this state of affairs is that papers presenting potentially useful novel ideas regularly appear without a comparison to the state of the art, without appropriate benchmarks, without any mention of limitations, and without sufficient detail to reproduce the experiments. This hampers scientific progress and perpetuates the cycle. [Vitek2011] DARPA s Intentions One single software platform DECREE One single hardware architecture x86 One large set of benchmarks (~200) Challenge Binaries Source code, Vulnerable Binary, Patched Binary, Deterministic Proof(s) Of Vulnerability, Polls Specially designed by the authors to distinguish between techniques Large set of data from the events Network traffic captures Competitor patched binaries, actual POVs used, etc. 15
16 CTF: Real World Challenges Challenges CTF Player View Testbed View Attribution & Reputation Network Mixing Scoring Server Team 1 Jail VM 1 Resilience New Flags Random Intervals Mixing Team 2 Jail VM 2 Availability Service Poller Service Poller Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs 16
17 CTF: Real Time Defense Failed test traffic - Score Functioning Software + Score Service Poller Mixing Appliance Blended Traffic Service Polls Vulnerability Proofs Network Defense CB Function Flaw Patched Challenge Binary Competitor PoV Proof of Vulnerability (PoV) Failed PoV + Score Flawed Software - Score + Score 17
18 CTF: Human Reasoning Workflow Program Analysis Network Analysis Defense Generation Challenge Binaries Fuzzing Fingerprints Capture & Replay Triage Post-Mortem Analysis Scanners Unpack Static Analysis Trace, Monitor, Prioritize Program Path DB Guards Symbolic Execution SMT/SAT Signatures
19 CTF: Representative Microcosm Program Analysis Network Analysis Defense Generation Challenge Binaries Fuzzing Malware Analysis Fingerprints Capture & Replay Triage Post-Mortem Analysis Security Auditing Scanners Unpack Static Analysis Trace, Monitor, Prioritize Program Path DB Guards Symbolic Execution SMT/SAT Signatures
20 CTF in 2014: Seeds of Automation Program Analysis Network Analysis Defense Generation Challenge Binaries MU-4000 DEFENSICS Pai Mei Radamsa ReVirt(Chen) AFG (Song) Fuzzing Fingerprints McCabe IQ Microsoft!analyze Capture & Replay AGCFHE (Heelan) Triage Renovo (Song) Post-Mortem Analysis BitBlaze Codesonar Microsoft idna TEMU Tracecap Scanners Unpack Academic Paper Research Project Static Analysis DSLab S 2 E Symbolic Execution Trace, Monitor, Prioritize Program Path DB STING (Brumley) DynInst Guards Commercial Restricted Commercial Microsoft Z3 SMT/SAT Signatures
21 We ve Been Here Before Chess Grandmasters Dedicated Systems World Class CS IBM Research Deep Blue Cyber Grandmasters Can We Do It Again? Dedicated Systems Program Analysis dailyheadlines.uark.edu Deep CTF? Photo courtesy US Air Force Academy Cyber Competition Club 21
22 A League of Their Own Competition Rating World Champion Grand Master Hitech Deep Thought Deep Blue 2 Deep Blue Deep Thought 2 Senior Master Master Expert : First all-computer tournament Chess 4.5 Cray Blitz Belle 1977: NWU-Chess Grandmaster Michael Stean defeated by a computer MacHackVI Chess to 1977: An innovation explosion through measurable dominance: Chess hash tables Iterative deepening Bit boards Opening books Endgame databases Key Software, General Purpose Hardware Single Purpose Hardware Data Source: Computer History Museum 22
23 A League of Their Own Competition Rating World Champion Grand Master Senior Master Master Expert Deep Blue Hitech Deep Thought Deep Thought 2 Could a purpose built supercomputer play DEF CON CTF? Chess : First all-computer tournament MacHackVI Chess 4.0 Cray Blitz Belle Deep Blue 2 In the past Grandmasters came to our computer tournaments to laugh. Today they come to watch. Soon they will come to learn. 1977: NWU-Chess Grandmaster Michael Stean defeated by a computer 1970 to 1977: An innovation explosion through measurable dominance: Chess hash tables Monroe Iterative deepening Newborn, Bit boards Opening books Endgame databases Key Software, General Purpose Hardware President International Computer Chess Association, 1977 Single Purpose Hardware Data Source: Computer History Museum 23
24 Cyber Grand Challenge A new DARPA Challenge 24
25 Cyber Grand Challenge: Scheduled Participation Opportunities Open Track Open to any eligible team No IP restrictions on entrant system Proposal Track DARPA Scientific Review Board Funded $750k/phase Government Purpose Rights to funded development See rules at for full details 25
26 Cyber Grand Challenge: Scheduled Events Now Open Track Proposal Track $750k/phase Challenge Qualification Event Top teams advance to finals Open Track Finalists receive $750k prize Challenge Final Event 1 st place: $2,000,000 2 nd place: $1,000,000 3 rd place: $750,000 26
27 For All Secure GrammaTech Lekkertech SIFT SRI Trail of Bits University of California, Berkeley 27
28 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 28
29 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 29
30 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 30
31 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 31
32 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 32
33 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 33
34 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 34
35 Additional security layers often create vulnerabilities Current vulnerability watch list: Vulnerability Title Fix Avail? Date Added XXXXXXXXXXXX XXXXXXXXXXXX Local Privilege Escalation Vulnerability No 8/25/2010 XXXXXXXXXXXX XXXXXXXXXXXX Denial of Service Vulnerability Yes 8/24/2010 XXXXXXXXXXXX XXXXXXXXXXXX Buffer Overflow Vulnerability No 8/20/2010 XXXXXXXXXXXX XXXXXXXXXXXX Sanitization Bypass Weakness No 8/18/2010 XXXXXXXXXXXX XXXXXXXXXXXX Security Bypass Vulnerability No 8/17/2010 XXXXXXXXXXXX XXXXXXXXXXXX Multiple Security Vulnerabilities Yes 8/16/2010 XXXXXXXXXXXX XXXXXXXXXXXX Remote Code Execution Vulnerability No 8/16/2010 XXXXXXXXXXXX XXXXXXXXXXXX Use-After-Free Memory Corruption Vulnerability No 8/12/2010 XXXXXXXXXXXX XXXXXXXXXXXX Remote Code Execution Vulnerability No 8/10/2010 XXXXXXXXXXXX XXXXXXXXXXXX Multiple Buffer Overflow Vulnerabilities No 8/10/2010 XXXXXXXXXXXX XXXXXXXXXXXX Stack Buffer Overflow Vulnerability Yes 8/09/2010 XXXXXXXXXXXX XXXXXXXXXXXX Security-Bypass Vulnerability No 8/06/2010 XXXXXXXXXXXX XXXXXXXXXXXX Multiple Security Vulnerabilities No 8/05/2010 XXXXXXXXXXXX XXXXXXXXXXXX Buffer Overflow Vulnerability No 7/29/2010 XXXXXXXXXXXX XXXXXXXXXXXX Remote Privilege Escalation Vulnerability No 7/28/2010 XXXXXXXXXXXX XXXXXXXXXXXX Cross Site Request Forgery Vulnerability No 7/26/2010 XXXXXXXXXXXX XXXXXXXXXXXX Multiple Denial Of Service Vulnerabilities No 7/22/ of the vulnerabilities are in security software Color Code Key: Vendor Replied Fix in development Awaiting Vendor Reply/Confirmation Awaiting CC/S/A use validation 35
36 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 36
37 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 37
38 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 38
39 At Microsoft, a Precursor Machine Reasoning now accounts for many security flaws removed from Windows systems. 7/30/
40 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 40
41 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 41
42 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 42
43 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 43
44 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 44
45 Defensive Adaptation Speed * a typical zero-day attack lasts 312 days * ** and takes 24 days to patch. ** Security Econometrics, Stefan Frei * Before We Knew It Bilge,Dumitras 45
46 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 46
47 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 47
48 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 48
49 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 49
50 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 50
51 Consensus Evaluation Service Poller Scoring Server Mixing Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs Consensus Evaluation CB Deployment Network Filters 51
52 Scheduled Final Event: Multi-Team Real Time Tournament Scoring Server Mixing Service Poller Flag Monitoring Proof of Vulnerability Service Poller Mixed Inputs 52
53 Participation Build a team and sign Lots of relevant work in ISSTA Session 1: Concurrency and Verification Session 3: Artifact Studies Session 4: Static Analyses and Transformations Session 5: Test Selection and Reduction Session 6: Localization and Repair Session 7: Security 53
54 Annual Competition / Conference? You have the infrastructure You *will* have the challenge binaries, all source code, POVs You have the expertise You have the power to keep CGC alive after August 2016 Games have the International Computer Games Association ( Robotics have the RoboCup ( Turing Test has the Loebner Prize Competition ( Artificial Intelligence has the AAAI Annual Computer Poker Competition ( Satisfiability has the SAT Competition ( Satisfiability Modulo Theories has the SMT Competition ( Software Testing and Security have??? 54
55 For more information: 55
Machine vs. Machine: Lessons from the First Year of Cyber Grand Challenge. Approved for Public Release, Distribution Unlimited
Machine vs. Machine: Lessons from the First Year of Cyber Grand Challenge 1 DARPA BAA 14-05 Autonomous cyber defense capabilities that combine the speed and scale of automation with reasoning abilities
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge Antonio Bianchi antoniob@cs.ucsb.edu University of California, Santa Barbara HITCON Enterprise August 27th, 2015 Agenda Shellphish The
Trustworthy Software Systems
Trustworthy Software Systems Greg Morrisett Cutting Professor of Computer Science School of Engineering & Applied Sciences Harvard University Little about me Research & Teaching Compilers, Languages, Formal
Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Data on Kernel Failures and Security Incidents
Data on Kernel Failures and Security Incidents Ravishankar K. Iyer (W. Gu, Z. Kalbarczyk, G. Lyle, A. Sharma, L. Wang ) Center for Reliable and High-Performance Computing Coordinated Science Laboratory
Extreme Networks Security Analytics G2 Vulnerability Manager
DATA SHEET Extreme Networks Security Analytics G2 Vulnerability Manager Improve security and compliance by prioritizing security gaps for resolution HIGHLIGHTS Help prevent security breaches by discovering
The Reverse Firewall: Defeating DDOS Attacks Emanating from a Local Area Network
Pioneering Technologies for a Better Internet Cs3, Inc. 5777 W. Century Blvd. Suite 1185 Los Angeles, CA 90045-5600 Phone: 310-337-3013 Fax: 310-337-3012 Email: info@cs3-inc.com The Reverse Firewall: Defeating
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global
CSE331: Introduction to Networks and Security. Lecture 17 Fall 2006
CSE331: Introduction to Networks and Security Lecture 17 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Summary:
Virtualization System Security
Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing
North Dakota 2013 IT Security Audit Vulnerability Assessment & Penetration Test Project Briefing Introduction ManTech Project Manager Mark Shaw, Senior Executive Director Cyber Security Solutions Division
Telecom Testing and Security Certification. A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT
Telecom Testing and Security Certification A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT 1 Need for Security Testing and Certification Telecom is a vital infrastructure
ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details
Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription
D. Best Practices D.1. Assurance The 5 th A
Best Practices I&C School Prof. P. Janson September 2014 D. Best Practices D.1. Assurance The 5 th A 1 of 20 IT systems are insecure for two main reasons: People are fallible and systems are complex and
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
An overwhelming majority of IaaS clouds leverage virtualization for their foundation.
1 2 3 An overwhelming majority of IaaS clouds leverage virtualization for their foundation. 4 With the use of virtualization comes the use of a hypervisor. Normally, the hypervisor simply provisions resources
A BETTER SOLUTION FOR MAINTAINING HEALTHCARE DATA SECURITY IN THE CLOUD
CONTINUOUS MONITORING A BETTER SOLUTION FOR MAINTAINING HEALTHCARE DATA SECURITY IN THE CLOUD Healthcare companies utilizing cloud infrastructure require continuous security monitoring. Learn how to prevent
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development
Integrating Web Application Security into the IT Curriculum
Integrating Web Application Security into the IT Curriculum James Walden Northern Kentucky University Topics 1. 2. 3. 4. Why should we teach web application security? What material do we need to cover?
WHITEPAPER. Nessus Exploit Integration
Nessus Exploit Integration v2 Tenable Network Security has committed to providing context around vulnerabilities, and correlating them to other sources, such as available exploits. We currently pull information
Application Intrusion Detection
Application Intrusion Detection Drew Miller Black Hat Consulting Application Intrusion Detection Introduction Mitigating Exposures Monitoring Exposures Response Times Proactive Risk Analysis Summary Introduction
Custom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
Technology Blueprint. Protect Your Email Servers. Guard the data and availability that enable business-critical communications
Technology Blueprint Protect Your Email Servers Guard the data and availability that enable business-critical communications LEVEL 1 2 3 4 5 SECURITY CONNECTED REFERENCE ARCHITECTURE LEVEL 1 2 4 5 3 Security
SkyRecon Cryptographic Module (SCM)
SkyRecon Cryptographic Module (SCM) FIPS 140-2 Documentation: Security Policy Abstract This document specifies the security policy for the SkyRecon Cryptographic Module (SCM) as described in FIPS PUB 140-2.
Modern Binary Exploitation Course Syllabus
Modern Binary Exploitation Course Syllabus Course Information Course Title: Modern Binary Exploitation Course Number: CSCI 4968 Credit Hours: 4 Semester / Year: Spring 2015 Meeting Days: Tuesday/Friday
Understanding and evaluating risk to information assets in your software projects
Understanding and evaluating risk to information assets in your software projects ugh.. what a mouthful Dana Epp Windows Security MVP Who am I? Microsoft Windows Security MVP Information Security Professional
Bypassing Memory Protections: The Future of Exploitation
Bypassing Memory Protections: The Future of Exploitation Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Research into reliable exploitation techniques: Heap Feng Shui in JavaScript
Web Engineering Web Application Security Issues
Security Issues Dec 14 2009 Katharina Siorpaes Copyright 2009 STI - INNSBRUCK www.sti-innsbruck.at It is NOT Network Security It is securing: Custom Code that drives a web application Libraries Backend
The Hacker Strategy. Dave Aitel dave@immunityinc.com. Security Research
1 The Hacker Strategy Dave Aitel dave@immunityinc.com Security Research Who am I? CTO, Immunity Inc. History: NSA->@stake -> Immunity Responsible for new product development Vulnerability Sharing Club
CSE331: Introduction to Networks and Security. Lecture 18 Fall 2006
CSE331: Introduction to Networks and Security Lecture 18 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Attacker
Defense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND LOG MANAGER
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND Introduction > New security threats are emerging all the time, from new forms of malware and web application exploits that target
Red Hat. www.redhat.com. By Karl Wirth
Red Hat Enterprise Linux 5 Security By Karl Wirth Abstract Red Hat Enterprise Linux has been designed by, and for, the most security-conscious organizations in the world. Accordingly, security has always
Critical Infrastructure Security: The Emerging Smart Grid. Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn
Critical Infrastructure Security: The Emerging Smart Grid Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn Overview Assurance & Evaluation Security Testing Approaches
How To Secure Cloud Computing
Resilient Cloud Services By Hemayamini Kurra, Glynis Dsouza, Youssif Al Nasshif, Salim Hariri University of Arizona First Franco-American Workshop on Cybersecurity 18 th October, 2013 Presentation Outline
FortiGate-3950B Scores 95/100 on BreakingPoint Resiliency Score (Security, Performance, & Stability)
FortiGate-3950B Scores 95/100 on BreakingPoint Resiliency Score (Security, Performance, & Stability) Overview Fortinet FortiGate -3950B enterprise consolidated security appliance has achieved a BreakingPoint
Security Implications Associated with Mass Notification Systems
Security Implications Associated with Mass Notification Systems Overview Cyber infrastructure: Includes electronic information and communications systems and services and the information contained in these
TOOL EVALUATION REPORT: FORTIFY
TOOL EVALUATION REPORT: FORTIFY Derek D Souza, Yoon Phil Kim, Tim Kral, Tejas Ranade, Somesh Sasalatti ABOUT THE TOOL Background The tool that we have evaluated is the Fortify Source Code Analyzer (Fortify
Linux Kernel. Security Report
Linux Kernel Security Report September 25 Authors: Andy Chou, Bryan Fulton and Seth Hallem Coverity has combined two years of analysis work carried out in a commercial setting at Coverity with four years
SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014
SECURITY PRACTICES FOR ADVANCED METERING INFRASTRUCTURE Elif Üstündağ Soykan, Seda Demirağ Ersöz 08.05.2014, ICSG 2014 Table of Contents Introduction AMI Communication Architecture Security Threats Security
Safety measures in Linux
S a f e t y m e a s u r e s i n L i n u x Safety measures in Linux Krzysztof Lichota lichota@mimuw.edu.pl A g e n d a Standard Unix security measures: permissions, capabilities, ACLs, chroot Linux kernel
IBM Security QRadar Vulnerability Manager
IBM Security QRadar Vulnerability Manager Improve security and compliance by prioritizing security gaps for resolution Highlights Help prevent security breaches by discovering and highlighting high-risk
IBM Advanced Threat Protection Solution
IBM Advanced Threat Protection Solution Fabio Panada IBM Security Tech Sales Leader 1 Advanced Threats is one of today s key mega-trends Advanced Threats Sophisticated, targeted attacks designed to gain
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Persistence Mechanisms as Indicators of Compromise
Persistence Persistence Mechanisms as Indicators of Compromise An automated technology for identifying cyber attacks designed to survive indefinitely the reboot process on PCs White Paper Date: October
Center of Academic Excellence Cyber Operations Program 2013 Application
Center of Academic Excellence Cyber Operations Program 2013 Application Name of Institution: Mailing Address of Institution: Date: Institution s President s Name and Official Email Address: Department
Vulnerability Management
Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of
Threat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
Achilles Assurance Platform. Dr. Nate Kube Founder / CTO Wurldtech
Achilles Assurance Platform Dr. Nate Kube Founder / CTO Wurldtech Presentation Outline Statement of the Problem 3 rd Generation Achilles Assurance Platform Questions and Answers Achilles Certification
============================================================= =============================================================
Stephan Lantos Subject: FW: @RISK: The Consensus Security Vulnerability Alert: Vol. 13, Num. 23 In partnership with SANS and Sourcefire, Qualys is pleased to provide you with the @RISK Newsletter. This
Host-based Intrusion Prevention System (HIPS)
Host-based Intrusion Prevention System (HIPS) White Paper Document Version ( esnhips 14.0.0.1) Creation Date: 6 th Feb, 2013 Host-based Intrusion Prevention System (HIPS) Few years back, it was relatively
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
Practical Threat Intelligence. with Bromium LAVA
Practical Threat Intelligence with Bromium LAVA Practical Threat Intelligence Executive Summary Threat intelligence today is costly and time consuming and does not always result in a reduction of successful
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
SAFECode Security Development Lifecycle (SDL)
SAFECode Security Development Lifecycle (SDL) Michael Howard Microsoft Matthew Coles EMC 15th Semi-annual Software Assurance Forum, September 12-16, 2011 Agenda Introduction to SAFECode Security Training
Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD
Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD whoami? Senior Director of a Red Team PSIRT Case Manager Data Analyst Internet Crime Investigator Security Evangelist
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
Automate the Hunt. Rapid IOC Detection and Remediation WHITE PAPER WP-ATH-032015
Rapid IOC Detection and Remediation WP-ATH-032015 EXECUTIVE SUMMARY In the escalating war that is cyber crime, attackers keep upping their game. Their tools and techniques are both faster and stealthier
Exploiting Transparent User Identification Systems
Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background
The Open Cyber Challenge Platform *
The Open Cyber Challenge Platform * Jacob Fonseca, Kevin Bryan, Lisa DiPippo, Victor Fay-Wolfe * Supported By The U.S. National Science Foundation grants: Federal Cyber Service Scholarship For Service
DATA CENTER IPS COMPARATIVE ANALYSIS
DATA CENTER IPS COMPARATIVE ANALYSIS Security 2014 Thomas Skybakmoen, Jason Pappalexis Tested Products Fortinet FortiGate 5140B, Juniper SRX 5800, McAfee NS- 9300, Sourcefire 8290-2 Data Center Overview
Game Playing in the Real World. Next time: Knowledge Representation Reading: Chapter 7.1-7.3
Game Playing in the Real World Next time: Knowledge Representation Reading: Chapter 7.1-7.3 1 What matters? Speed? Knowledge? Intelligence? (And what counts as intelligence?) Human vs. machine characteristics
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest
13 Ways Through A Firewall What you don t know will hurt you
Scientech 2013 Symposium: Managing Fleet Assets and Performance 13 Ways Through A Firewall What you don t know will hurt you Andrew Ginter VP Industrial Security Waterfall Security Solutions andrew. ginter
Testing for Security
Testing for Security Kenneth Ingham September 29, 2009 1 Course overview The threat that security breaches present to your products and ultimately your customer base can be significant. This course is
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Building A Secure Microsoft Exchange Continuity Appliance
Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building
Device Hardening, Vulnerability Remediation and Mitigation for Security Compliance
Device Hardening, Vulnerability Remediation and Mitigation for Security Compliance Produced on behalf of New Net Technologies by STEVE BROADHEAD BROADBAND TESTING 2010 broadband testing and new net technologies
Designing and Coding Secure Systems
Designing and Coding Secure Systems Kenneth Ingham and Anil Somayaji September 29, 2009 1 Course overview This class covers secure coding and some design issues from a language neutral approach you can
OWASP AND APPLICATION SECURITY
SECURING THE 3DEXPERIENCE PLATFORM OWASP AND APPLICATION SECURITY Milan Bruchter/Shutterstock.com WHITE PAPER EXECUTIVE SUMMARY As part of Dassault Systèmes efforts to counter threats of hacking, particularly
MWR InfoSecurity Security Advisory. Symantec s Altiris Deployment Solution File Transfer Race Condition. 7 th January 2010
al al MWR InfoSecurity Security Advisory Symantec s Altiris Deployment Solution File Transfer Race Condition 7 th January 2010 20010-01-07 Page 1 of 8 Contents Contents 1 Detailed Vulnerability Description...4
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information
Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows
Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
CSE331: Introduction to Networks and Security. Lecture 32 Fall 2004
CSE331: Introduction to Networks and Security Lecture 32 Fall 2004 Hackers / Intruders External attacks Typical hacker Exploits carried out remotely Does not have an account on the remote machine Insider
An Analysis of the Capabilities Of Cybersecurity Defense
UNIDIRECTIONAL SECURITY GATEWAYS An Analysis of the Capabilities Of Cybersecurity Defense Michael Firstenberg, Director of Industrial Security Waterfall Security Solutions Proprietary Information -- Copyright
First Line of Defense to Protect Critical Infrastructure
RFI SUBMISSION First Line of Defense to Protect Critical Infrastructure Developing a Framework to Improve Critical Infrastructure Cybersecurity Response to NIST Docket # 130208119-3119-01 Document # 2013-044B
An Integrated CyberSecurity Approach for HEP Grids. Workshop Report. http://hpcrd.lbl.gov/hepcybersecurity/
An Integrated CyberSecurity Approach for HEP Grids Workshop Report http://hpcrd.lbl.gov/hepcybersecurity/ 1. Introduction The CMS and ATLAS experiments at the Large Hadron Collider (LHC) being built at
PCI-DSS Penetration Testing
PCI-DSS Penetration Testing Adam Goslin, Co-Founder High Bit Security May 10, 2011 About High Bit Security High Bit helps companies obtain or maintain their PCI compliance (Level 1 through Level 4 compliance)
Some Anti-Worm Efforts at Microsoft. Acknowledgements
Some Anti-Worm Efforts at Microsoft Helen J. Wang System and Networking Research Group Microsoft Research Oct 29, 2004 1 Acknowledgements Matt Braverman, Opher Dubrovsky, John Dunagan, Louis Lafreniere,
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities Learning Objectives Name the common categories of vulnerabilities Discuss common system
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
CS 392/681 - Computer Security. Module 16 Vulnerability Analysis
CS 392/681 - Computer Security Module 16 Vulnerability Analysis Course Policies and Logistics Homework 5 due tonight Homework 6 posted Read Chapter 23 11/13/2003 Module 16 - Vulnerability Analysis 2 Some
Information Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
STATE OF WASHINGTON DEPARTMENT OF SOCIAL AND HEALTH SERVICES P.O. Box 45810, Olympia, Washington 98504 5810. October 21, 2013
STATE OF WASHINGTON DEPARTMENT OF SOCIAL AND HEALTH SERVICES P.O. Box 45810, Olympia, Washington 98504 5810 October 21, 2013 To: RE: All Vendors Request for Information (RFI) The State of Washington, Department
Product Documentation. Preliminary Evaluation of the OpenSSL Security Advisory (0.9.8 and 1.0.1)
Product Documentation Preliminary Evaluation of the OpenSSL Security Advisory (0.9.8 and 1.0.1) Contents Contents Copyright... 3 Preliminary Evaluation of the OpenSSL Security Advisory (0.9.8 and 1.0.1)...
WIND RIVER SECURE ANDROID CAPABILITY
WIND RIVER SECURE ANDROID CAPABILITY Cyber warfare has swiftly migrated from hacking into enterprise networks and the Internet to targeting, and being triggered from, mobile devices. With the recent explosion
Post-Access Cyber Defense
Post-Access Cyber Defense Dr. Vipin Swarup Chief Scientist, Cyber Security The MITRE Corporation November 2015 Approved for Public Release; Distribution Unlimited. 15-3647. 2 Cyber Security Technical Center
1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained
home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
That Point of Sale is a PoS
SESSION ID: HTA-W02 That Point of Sale is a PoS Charles Henderson Vice President Managed Security Testing Trustwave @angus_tx David Byrne Senior Security Associate Bishop Fox Agenda POS Architecture Breach