2010: The Year of the Exploit
|
|
|
- Oliver Owens
- 7 years ago
- Views:
Transcription
1 2010: The Year of the Exploit Juraj Malcho Alexandr Matrosov Eugene Rodionov David Harley
2 Microsoft Windows Server Releases Roadmap The picture courtesy of Microsoft
3 Microsoft Significant vulnerabilities MS Buffer Overrun In RPC Interface (Blaster) MS LSASS Vulnerability (Rbot MS MDAC exploit (the base of Exploit Packs) MS Windows Animated Cursor Remote Code Execution Vulnerability MS MS Vulnerability in Server Service (Conficker) Vulnerability in Windows Shell (Stuxnet) Microsoft Security Advisory ( ) Insecure Library Loading Could Allow Remote Code Execution
4 MS LNK exploit Windows Shell vulnerability Discovered in the wild as a 0-day Out-of-band patch released on August 2 nd 2010 Affects all Windows versions Spreading (not only) via removable devices regardless of security settings MITRE code CVE Win32/Stuxnet
5 VirusBlokAda identified Stuxnet and the LNK exploit on June 17 th (Trojan-Spy.04850) Microsoft and others only took a notice a month later Realtek Semiconductors notified on June 24 th regarding the certificate problem Allegedly, the notification was ignored July 13 th The Moment of Truth Win32/Rootkit.TmpHider July 6 th 2010: Win32/Rootkit.Agent.NTK Gradual unfurling of the truth about Stuxnet At first seemed to be spyware Only in September was it found to be a tool of destruction
6 Targeted attack Not only an eye-opener for the general public, but even for many in the IT security industry Uncompromisingly professional Created by a team of people 0-day vulnerability portfolio 4 0-day vulnerabilities: MS10-046, MS10-061, MS10-073, MS10-0XX + MS Signed! Compromised Realtek & JMicron certificates Weeks of exhaustive analysis The effect on Siemens Simatic SCADA SW Speculation about other possible targets
7 invisible First variants January/March/June 2009 Vulnerability arsenal was limited by then: MS MS MS (win32k.sys!ntusermessagecall) autorun.inf Significant upgrade in January 2010 Another driver added Signed by Realtek Technologies certificate New 0-day vulnerabilities added: MS10-046, MS10-061, MS10-073, MS10-0XX
8 signatures
9 vulnerabilities removable devices MS Win2000/XP MS general attack vector propagation additional attack vectors Stuxnet propagation and installation vectors in MS Windows privilege escalation installation privilege escalation local network MS Vista/Win7/Server 2008 MS10-0XX MS10-061
10 exploit #1: MS10-0XX A vulnerability in Task Scheduler service Scheduled tasks integrity checking problem Used for privilege escalation Windows Vista and above
11 exploit #2: MS A vulnerability in win32k.sys Based on faulty processing of keyboard layout files Used for privilege escalation Windows 2000 and WindowsXP are affected fanny.bmp Win32/Agent.OSW (Win32/Dottun) between win32k.sys and LNK exploit connection
12 exploit #3: MS A vulnerability in Printer Spooler Shared printers problem 2009/04 Used to spread over the network All Windows versions vulnerable A problem in verifying the identity of the printing client Instead of being sent to a printer files are dropped to: %SYSTEM32% (privileged operation): Windows\System32\winsta.exe and Windows\System32\wbem\mof\sysnullevnt.mof
13 exploit #4: MS LNK exploit CVE A design error, no shell code or buffer overflow issue Used to spread via removable media All Windows versions vulnerable The graphics are loaded from the file referenced in the LNK file and not only that
14 exploit #4: MS ways of storing the path to the payload: \\.\STORAGE#Volume#_??_USBSTOR#Disk&Ven USB&Prod_FLASH_DRI VE&Rev_# &0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\~WTR4141.tmp \\.\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven USB&Pr od_flash_drive&rev_# &0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\~wtr4141.tmp \\.\STORAGE#RemovableMedia#8&1c5235dc&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\~WTR4141.tmp \\.\STORAGE#RemovableMedia#7&1c5235dc&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\~WTR4141.tmp
15 MS related malware and its evolution 8(+) CVE /MS (win32k.sys) since 2009/11!!!
16
17 ... needs to be considered and protected
18 Education is a necessary part of defence Gathering data Not so difficult online Mining and exploring it To find the right target Marketing folks know this Cyber criminals are no different Careful what you say Nothing comes for free Mistrust information you didn't ask for or people you
19 Questions? Juraj Malcho Alexandr Matrosov Eugene Rodionov David Harley
The Peak of Chaos Shane D. Shook, PhD 10/31/2012
w h a c k e r n a v k n d n h m y a w h o? n r h p e n c n o s a n w s o v y i d u n n n r n m s r k d e a i k o w i r c d i o m u t w e t w s u t s i v i t c a Shane D. Shook, PhD 10/31/2012 Cyber Crime
Stuxnet Malware. Official communication presented at CIP Seminar 02-11-2010 by Thomas Brandstetter. Siemens AG 2010. All Rights Reserved.
Official communication presented at CIP Seminar 02-11-2010 by Thomas Brandstetter What is the Stuxnet and what can it do? Stuxnet is a high sophisticated malware that targets very specific configurations
The Stuxnet Worm The Nexus of Cyber Security and International Policy. By George Aquila george.aquila@tufts.edu Mentor: Ming Chow
The Stuxnet Worm The Nexus of Cyber Security and International Policy By George Aquila george.aquila@tufts.edu Mentor: Ming Chow 1 Abstract: This paper focuses on the Stuxnet worm as an example of the
IOActive Security Advisory
IOActive Security Advisory Title Severity Discovered by CVE Lenovo s System Update Uses a Predictable Security Token High Michael Milvich michael.milvich@ioactive.com Sofiane Talmat sofiane.talmat@ioactive.com
PCI Vulnerability Validation Report
Friday, March 9, 013 PCI Vulnerability Validation Report Introduction This report shows the results of a vulnerability validation tests conducted by CORE Impact Professional Professional in support of
The Leader in Cloud Security SECURITY ADVISORY
The Leader in Cloud Security SECURITY ADVISORY Security Advisory - December 14, 2010 Zscaler Provides Protection in the Face of Significant Microsoft Year End Patch Cycle Zscaler, working with Microsoft
Using Tofino to control the spread of Stuxnet Malware
technical datasheet Application Note Using Tofino to control the spread of Stuxnet Malware This application note describes how to use the Tofino Industrial Security Solution to prevent the spread of the
THE SECURITY EXPOSURE
Secunia Whitepaper - February 2010 THE SECURITY EXPOSURE OF SOFTWARE PORTFOLIOS An empirical analysis of the patching challenge faced by the average private user In this paper, we examine the software
Windows XP Pro Service Pack 3 Approved Window Update Description Update. XP Service Pack 3 (KB936929) Windows Internet Explorer 7 for Windows XP
Windows XP Pro Service Pack 3 Approved Window Update Description Update Windows XP Windows Windows XP Windows XP Service Pack 3 XP Service Pack 3 (KB936929) Windows Internet Explorer 7 for Windows XP Internet
The Stuxnet Worm and Options for Remediation
The Stuxnet Worm and Options for Remediation Andrew Ginter, Chief Security Officer, Industrial Defender Last updated: August 23, 2010 We encourage distribution of the information in this document to support
Beyond Aurora s Veil: A Vulnerable Tale
Beyond Aurora s Veil: A Vulnerable Tale Derek Manky Cyber Security & Threat Research FortiGuard Labs October 26th, 2010: SecTor 2010 Toronto, CA Conficker: April Doomsday.. Meanwhile JBIG2 Zero Day PDF/SWF
Windows XP Pro Service Pack 3
Windows XP Pro Service Pack 3 If Windows Service Pack 3 has to be installed: It is recommended that the Windows Service Pack 3 be installed on a freshly ghosted machine before the installation of the NeuroWorks
Anatomy of a Breach: A case study in how to protect your organization. Presented By Greg Sparrow
Anatomy of a Breach: A case study in how to protect your organization Presented By Greg Sparrow Agenda Background & Threat landscape Breach: A Case Study Incident Response Best Practices Lessons Learned
Sandbox Roulette: Are you ready for the gamble?
Sandbox Roulette: Are you ready for the gamble? Rafal Wojtczuk rafal@bromium.com Rahul Kashyap rahul@bromium.com What is a sandbox? In computer security terminology, a sandbox is an environment designed
MCAFEE FOUNDSTONE FSL UPDATE
MCAFEE FOUNDSTONE FSL UPDATE 2012-JUN-13 To better protect your environment McAfee has created this FSL check update for the Foundstone Product Suite. The following is a detailed summary of the new and
Using Vulnerable Hosts to Assess Cyber Security Risk in Critical Infrastructures
Workshop on Novel Approaches to Risk and Security Management for Utility Providers and Critical Infrastructures Using Vulnerable Hosts to Assess Cyber Security Risk in Critical Infrastructures Xiaobing
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND LOG MANAGER
DEFENSE THROUGHOUT THE VULNERABILITY LIFE CYCLE WITH ALERT LOGIC THREAT AND Introduction > New security threats are emerging all the time, from new forms of malware and web application exploits that target
Post-Stuxnet Industrial Security: Zero-Day Discovery and Risk Containment of Industrial Malware
Post-Stuxnet Industrial Security: Zero-Day Discovery and Risk Containment of Industrial Malware A White Paper presented by: Torsten Rössel Director of Business Development Innominate Security Technologies
76% Secunia Vulnerability Review. Key figures and facts from a global IT-Security perspective. Published February 26, 2014. secunia.
Secunia Vulnerability Review 2014 Key figures and facts from a global IT-Security perspective Published February 26, 2014 76% Browser Vulnerabilities 7540 893 7540 731 7540 727 7540 441 7540 208 7540 207
Vulnerability-Focused Threat Detection: Protect Against the Unknown
Vulnerability-Focused Threat Detection: Protect Against the Unknown Vulnerabilities and threats are being discovered at a pace that traditional exploit-based attack detection technology cannot meet. Vulnerability-focused
Choosing Between Whitelisting and Blacklisting Endpoint Security Software for Fixed Function Devices
Choosing Between Whitelisting and Blacklisting Endpoint Security Software for Fixed Function Devices McAfee* application whitelisting combined with Intel vpro technology can improve security, increase
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION
INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer
Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices
350 PIERS Proceedings, Cambridge, USA, July 5 8, 2010 Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices Dung Vu Pham 1, Malka N. Halgamuge 2, Ali Syed 1, and Priyan
TIME TO LIVE ON THE NETWORK
TIME TO LIVE ON THE NETWORK Executive Summary This experiment tests to see how well commonly used computer platforms withstand Internet attacks in the wild. The experiment quantifies the amount of time
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
Install this update to increase the performance of web sites that use Ajax. After you install this item, you may have to restart your computer.
Windows XP Pro Service Pack 2 Approved Window Update Windows XP (KB896423) Update Description A security issue has been identified in the Print Spooler service that could allow an attacker to compromise
IN10A. MICROSOFT WINDOWS CRITICAL UPDATES October 2014
IN10A MICROSOFT WINDOWS CRITICAL UPDATES October 2014 The following list of security patch updates have been tested and approved for IN10A R1.0 Imaging and Workflow Management System compatibility. Prior
Post-Stuxnet Industrial Security
Post-Stuxnet Industrial Security Zero-Day Discovery and Risk Containment of Industrial Malware with Innominate mguard Technology Introduction Following its discovery in June 2010, the Stuxnet worm triggered
More Than A Microsoft World. Marc Maiffret Co-Founder Chief Hacking Officer
More Than A Microsoft World Marc Maiffret Co-Founder Chief Hacking Officer The eeye Marketing Slide We Make Security Software Retina Network Security Scanner Blink Host Based Security REM Enterprise Vulnerability/Threat
Software Vulnerability Assessment
Software Vulnerability Assessment Setup Guide Contents: About Software Vulnerability Assessment Setting Up and Running a Vulnerability Scan Manage Ongoing Vulnerability Scans Perform Regularly Scheduled
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
Agenda. 3 2012, Palo Alto Networks. Confidential and Proprietary.
Agenda Evolution of the cyber threat How the cyber threat develops Why traditional systems are failing Need move to application controls Need for automation 3 2012, Palo Alto Networks. Confidential and
W32.Stuxnet Dossier. Security Response. Introduction. Nicolas Falliere, Liam O Murchu, and Eric Chien
Version 1.4 (February 2011) Nicolas Falliere, Liam O Murchu, and Eric Chien Contents Introduction... 1 Executive Summary... 2 Attack Scenario... 3 Timeline... 4 Infection Statistics... 5 Stuxnet Architecture...
Discovering passwords in the memory
Discovering passwords in the memory Abhishek Kumar (abhishek.kumar@paladion.net) November 2003 Escalation of privileges is a common method of attack where a low privileged user exploits a vulnerability
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak Capture Link Server V1.00
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak Capture Link Server V1.00 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011
NYS LOCAL GOVERNMENT VULNERABILITY SCANNING PROJECT September 22, 2011 Executive Summary BACKGROUND The NYS Local Government Vulnerability Scanning Project was funded by a U.S. Department of Homeland Security
Egress Switch Best Practice Security Guide V4.x
Egress Switch Best Practice Security Guide V4.x www.egress.com 2007-2013 Egress Software Technologies Ltd Table of Contents Introduction... 4 Best Practice Installation... 4 System Administrators... 5
Windows Remote Access
Windows Remote Access A newsletter for IT Professionals Education Sector Updates Issue 1 I. Background of Remote Desktop for Windows Remote Desktop Protocol (RDP) is a proprietary protocol developed by
EXPLORING VULNERABILITIES IN NETWORKED TELEMETRY
EXPLORING VULNERABILITIES IN NETWORKED TELEMETRY Authors: Felix Shonubi, Ciara Lynton, Joshua Odumosu, Daryl Moten Advisors: Dr. Richard Dean, Dr. Farzad Moazzami and Dr. Yacob Astatke Department of Electrical
Managed Services Agreement. Hilliard Office Solutions, Ltd. PO Box 52510 Phone: 432-617-4677 Midland, Texas 79710 Fax: 432-617-3043
Managed Services Agreement Hilliard Office Solutions, Ltd. PO Box 52510 Phone: 432-617-4677 Midland, Texas 79710 Fax: 432-617-3043 SERVICE DESCRIPTIONS By purchasing these Services from Hilliard Office
Cyber security and critical national infrastructure
120 Dr Richard Piggin Manager Defence, Aerospace & Communications Atkins Cyber security and critical national infrastructure Abstract Cyber security is an all-embracing term, meaning different things to
Securing your Virtual Datacenter. Part 1: Preventing, Mitigating Privilege Escalation
Securing your Virtual Datacenter Part 1: Preventing, Mitigating Privilege Escalation Before We Start... Today's discussion is by no means an exhaustive discussion of the security implications of virtualization
6. Exercise: Writing Security Advisories
CERT Exercises Toolset 49 49 6. Exercise: Writing Security Advisories Main Objective Targeted Audience Total Duration Time Schedule Frequency The objective of the exercise is to provide a practical overview
Using Windows Update for Windows Me
Using Windows Update for Windows Me Contents Introduction... 1 Before You Begin... 2 Downloading and Installing the Windows Update Components... 2 Maintaining a Secure Computing Environment... 6 Introduction
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015
Overview Commitment to Energy and Utilities Robert Held Sr. Systems Engineer Strategic Energy August 2015 Tripwire Evolution 18+ Years of Innovation 1997 Tripwire File System Monitoring from open source
Secunia Vulnerability Review
Secunia Vulnerability Review 2015 Key figures and facts on vulnerabilities from a global information security perspective Published March 25, 2015 15,435 13,114 9,878 Index Global Trends All Products 3
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES Ira Winkler Codenomicon Session ID: MBS-W05 Session Classification: Intermediate Zero Day Attacks Zero day attacks are rising in prominence They tend to be
HUNTING ASYNCHRONOUS VULNERABILITIES. James Kettle
HUNTING ASYNCHRONOUS VULNERABILITIES James Kettle THE CLASSICAL CALLBACK From: no- reply@redacted.com To: James Kettle Subject: Order: 103092185 Hi test, Thank you for your recent order Description Quantity
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE
UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE Originator Patch Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Recommended by Director
STAT Scanner Product Guide
STAT Scanner Product Guide Introduction to STAT Scanner The Importance of a Healthy Computer Newspaper headlines contain almost daily reports on companies that have lost substantial time and money from
Trends in Malware DRAFT OUTLINE. Wednesday, October 10, 12
Trends in Malware DRAFT OUTLINE Presentation Synopsis Security is often a game of cat and mouse as security professionals and attackers each vie to stay one step ahead of the other. In this race for dominance,
a Post-Stuxnet World The Future of Critical Infrastructure Security Eric Byres, P.Eng.
SCADA and CIP Security in a Post-Stuxnet World The Future of Critical Infrastructure Security Eric Byres, P.Eng. CTO, Byres Security Inc. What is Stuxnet? The Stuxnet Worm July, 2010: Stuxnet worm was
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchange
Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000
Information Technology Information and Systems Security/Compliance Northwestern University 1800 Sherman Av Suite 209 Evanston, IL 60201 Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000
ANNEXURE-1 TO THE TENDER ENQUIRY NO.: DPS/AMPU/MIC/1896. Network Security Software Nessus- Technical Details
Sub: Supply, Installation, setup and testing of Tenable Network Security Nessus vulnerability scanner professional version 6 or latest for scanning the LAN, VLAN, VPN and IPs with 3 years License/Subscription
Medical Device Security Health Imaging Digital Capture. Security Assessment Report for the Kodak DR V2.0
Medical Device Security Health Imaging Digital Capture Security Assessment Report for the Kodak DR V2.0 Version 1.0 Eastman Kodak Company, Health Imaging Group Page 1 Table of Contents Table of Contents
Security Patch Management
The knowledge behind the network. Security Patch Management By Felicia M. Nicastro Senior Network Systems Consultant International Network Services Security Patch Management March 2003 INS Whitepaper 1
The Fundamental Failures of End-Point Security. Stefan Frei Research Analyst Director sfrei@secunia.com
The Fundamental Failures of End-Point Security Stefan Frei Research Analyst Director sfrei@secunia.com Agenda The Changing Threat Environment Malware Tools & Services Why Cybercriminals Need No 0-Days
Security Vulnerability Management. Mark J Cox
Security Vulnerability Management Mark J Cox Responsibility & Accountability Unique challenges Many vendors all ship the same thing The vulnerabilities are there. The fact that somebody in the middle of
MWR InfoSecurity Security Advisory. Symantec s Altiris Deployment Solution File Transfer Race Condition. 7 th January 2010
al al MWR InfoSecurity Security Advisory Symantec s Altiris Deployment Solution File Transfer Race Condition 7 th January 2010 20010-01-07 Page 1 of 8 Contents Contents 1 Detailed Vulnerability Description...4
Background. How much does EMET cost? What is the license fee? EMET is freely available from Microsoft without material cost.
Microsoft s Enhanced Mitigation Experience Toolkit (EMET) is an enhancement to the Windows operating system that stops broad classes of malware from executing. EMET implements a set of anti-exploitation
Technical Note. CounterACT: Powerful, Automated Network Protection Inside and Out
CounterACT: Powerful, Contents Introduction...3 Automated Threat Protection against Conficker... 3 How the Conficker Worm Works.... 3 How to Use CounterACT to Protect vs. the Conficker Worm...4 1. Use
MALWARE THREATS AND TRENDS. Chris Blow, Director Dustin Hutchison, Director
MALWARE THREATS AND TRENDS Chris Blow, Director Dustin Hutchison, Director WHAT IS MALWARE? Malicious Software Viruses Worms Trojans Rootkits Spyware Ransomware 2 MALWARE ORIGINS Users bring it from home
How To Create An Ics Network With A Network Of Nodes
A Connection Pattern-based Approach to Detect Network Traffic Anomalies in Critical Infrastructures Béla Genge 1, Dorin Adrian Rusu 2, Piroska Haller 1 1 Petru Maior University of Tîrgu Mureş, Romania
Conficker by the numbers
Conficker by the numbers Sebastián Bortnik Security Analyst at ESET Latin America This is a translation for ESET LLC of a document previously available in Spanish by ESET Latin America (see http://eset-la.com/centro-amenazas/2241-conficker-numeros).
Maximizing customer protections
Maximizing customer protections 8 7 Vista XP XP end of support 8 XP 7 Vista XP What is the risk of continuing to run XP? Attackers will have the advantage over defenders After support ends, when Microsoft
Using Windows Update for Windows 95/98
Using Windows Update for Windows 95/98 Contents Introduction... 1 Before You Begin... 2 Downloading and Installing the Windows Update Components... 2 Maintaining a Secure Computing Environment... 6 Introduction
Honeypots & Honeynets Overview. Adli Wahid Security Specialist, APNIC.net adli@apnic.net
Honeypots & Honeynets Overview Adli Wahid Security Specialist, APNIC.net adli@apnic.net 1 Contents 1. ObjecCves 2. DefiniCon of Honeypot & Honeynets 3. Benefits & Risk consideracon 4. Example of Honeypot
Dealing with the unsupported Windows XP
Dealing with the unsupported Windows XP What Should You Do? A White Paper by: Windows Vulnerabilities XP has substantial and HIPAA design Compliancy vulnerabilities Make that put Upgrading an entire organization
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
SECURITY TERMS: Advisory Backdoor - Blended Threat Blind Worm Bootstrapped Worm Bot Coordinated Scanning
SECURITY TERMS: Advisory - A formal notice to the public on the nature of security vulnerability. When security researchers discover vulnerabilities in software, they usually notify the affected vendor
Applications Life-cycle Management
Windows Desktop Applications Life-cycle Management Sebastien Dellabella, Rafal Otto Internet Services Group IT Department Agenda Components of the Windows application management activity at CERN Application
Implementing Security Update Management
Implementing Security Update Management Wayne Harris MCSE Senior Consultant Certified Security Solutions Business Case for Update Management When determining the potential financial impact of poor update
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare
Malware and Attacks Further reading:
Malware and Attacks Further reading: Dwan B., The Malapropisms of Malware, Computer Fraud & Security, Volume 2004, Number 3 (2004), pp. 13-16 Bradbury, D., The metamorphosis of malware writers, Computers
Are you prepared to be next? Invensys Cyber Security
Defense In Depth Are you prepared to be next? Invensys Cyber Security Sven Grone Critical Controls Solutions Consultant Presenting on behalf of Glen Bounds Global Modernization Consultant Agenda Cyber
CSE331: Introduction to Networks and Security. Lecture 15 Fall 2006
CSE331: Introduction to Networks and Security Lecture 15 Fall 2006 Worm Research Sources "Inside the Slammer Worm" Moore, Paxson, Savage, Shannon, Staniford, and Weaver "How to 0wn the Internet in Your
Protecting productivity with Plant Security Services
Protecting productivity with Plant Security Services Identify vulnerabilities and threats at an early stage. Take proactive measures. Achieve optimal long-term plant protection. siemens.com/plant-security-services
Desktop Security. Overview and Technology Guidance. Michael Ramsey Network Specialist, NC DPI
Desktop Security Overview and Technology Guidance Michael Ramsey Network Specialist, NC DPI Desktop Security Best practices for both the technical type and the typical user Defensive Layering Top Vulnerabilities
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
Year end Report for 2006 *
Year end Report for 2006 * System Access is Top Impact for 2006 The exploit impact possible in the most Secunia advisories published this year is System impact, encompassing system compromise and code
Proactive Vulnerability Management Using Rapid7 NeXpose
WHITE PAPER Proactive Vulnerability Management Using Rapid7 NeXpose RAPID7 Corporate Headquarters 545 Boylston Street Boston, MA 02116 617.247.1717 www.rapid7.com Proactive Vulnerability Management Using
The Sandbox Roulette: are you ready to gamble? Rafal Wojtczuk rafal@bromium.com Rahul Kashyap rahul@bromium.com
The Sandbox Roulette: are you ready to gamble? Rafal Wojtczuk rafal@bromium.com Rahul Kashyap rahul@bromium.com What is a sandbox? Environment designed to run untrusted (or exploitable) code, in a manner
Taking a Proactive Approach to Patch Management. B e s t P r a c t i c e s G u i d e
B e s t P r a c t i c e s G u i d e It s a fact of business today: because of the economy, most organizations are asking everyone, including the IT staff, to do more with less. But tight budgets and the
Elements to a Secure Environment Becoming Resilient Towards Modern Cyberthreats. Windows XP Support Has Ended Why It Concerns You
Elements to a Secure Environment Becoming Resilient Towards Modern Cyberthreats Windows XP Support Has Ended Why It Concerns You Protect Detect Respond 1 02 Windows XP support has ended Windows XP support
Security Intelligence and Analytics in Industrial Systems
Users Group Europe, Middle East and Africa Security Intelligence and Analytics in Industrial Systems Eric D Knapp, About the Presenter Eric D. Knapp Global Director of Cyber Security Solutions and Technology
Next-Generation Penetration Testing. Benjamin Mossé, MD, Mossé Security
Next-Generation Penetration Testing Benjamin Mossé, MD, Mossé Security About Me Managing Director of Mossé Security Creator of an Mossé Cyber Security Institute - in Melbourne +30,000 machines compromised
Is Penetration Testing recommended for Industrial Control Systems?
Is Penetration Testing recommended for Industrial Control Systems? By Ngai Chee Ban, CISSP, Honeywell Process Solutions, Asia Pacific Cyber Security Assessment for Industrial Automation Conducting a cyber-security
CSIS Security Research and Intelligence Advisory Microsoft GDI+ Integer division by zero flaw handling.ico files VU#290961 CVE-2007-2237
CSIS Security Research and Intelligence Advisory Microsoft GDI+ Integer division by zero flaw handling.ico files VU#290961 CVE-2007-2237 Discovered by Dennis Rand rand@csis.dk http://www.csis.dk Table
Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$!%&'(#)*)&'+!,!-./0!.-12!1.03!0045!.567!5895!.467!:;83!-/;0!383;!
Sample Penetration Testing Report Black Box Penetration Testing For GPEN.KM V1.0 Month dd "#$%&'#)*)&'+,-./0.-121.030045.5675895.467:;83-/;0383; th, yyyy A&0#0+4*M:+:#&*#0%+C:,#0+4N:
Microsoft Security Bulletin MS09-053 - Important
Microsoft Security Bulletin MS09-053 - : Vulnerabilities in FTP Service for...page 1 of 28 TechNet Home > TechNet Security > Bulletins Microsoft Security Bulletin MS09-053 - Vulnerabilities in FTP Service
Advanced Endpoint Protection Overview
Advanced Endpoint Protection Overview Advanced Endpoint Protection is a solution that prevents Advanced Persistent Threats (APTs) and Zero-Day attacks and enables protection of your endpoints by blocking
Legal Notes. Regarding Trademarks. 2013 KYOCERA Document Solutions Inc.
Legal Notes Unauthorized reproduction of all or part of this guide is prohibited. The information in this guide is subject to change without notice. We cannot be held liable for any problems arising from
Hands-on Hacking Unlimited
About Zone-H Attacks techniques (%) File Inclusion Shares misconfiguration SQL Injection DNS attack through social engineering Web Server external module intrusion Attack against the administrator/user
Network Monitoring Tool to Identify Malware Infected Computers
Network Monitoring Tool to Identify Malware Infected Computers Navpreet Singh Principal Computer Engineer Computer Centre, Indian Institute of Technology Kanpur, India navi@iitk.ac.in Megha Jain, Payas
WHITE PAPER: TECHNICAL. Using Symantec Critical System Protection for Patch Mitigation and Securing Legacy Out-of- Support Platforms
WHITE PAPER: TECHNICAL Using Symantec Critical System Protection for Patch Mitigation and Securing Legacy Out-of- Support Platforms Case Study: Windows 2000 and Windows NT 4.0 End of Support Symantec Security
Evolution of attacks and Intrusion Detection
Evolution of attacks and Intrusion Detection AFSecurity seminar 11 April 2012 By: Stian Jahr Agenda Introductions What is IDS What is IDS in mnemoic How attacks have changed by time and how has it changed
TECHNICAL VULNERABILITY & PATCH MANAGEMENT
INFORMATION SECURITY POLICY TECHNICAL VULNERABILITY & PATCH MANAGEMENT ISO 27002 12.6.1 Author: Owner: Organisation: Document No: Chris Stone Ruskwig TruePersona Ltd SP-12.6.1 Version No: 1.1 Date: 1 st