Advanced Techniques in Modern Banking Trojans
|
|
|
- Eugenia Blake
- 10 years ago
- Views:
Transcription
1 Advanced Techniques in Modern Banking Trojans Thomas Siebert Manager System Security
2 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures 2
3 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures 3
4 Regular Bank Transfer 4
5 Authentication First factor: Authenticate login Username / Password Account Nr. / Password Second factor: Authenticate transactions TAN / itan / itanplus chiptan smstan 5
6 Bank Transfer MITM-Attack
7 Simple Webinject Image: Sparkasse
8 Simple Webinject
9 Webinject function AddReplacerArrayItem(account_name_value,account_number_value,transfer_me mo_value,transfer_amount_value,betrag_amount_value,tan_value,tan_info_va lue,last_date_value,new_date_value,transfer_date_value){ var index = replacer_array.length; } replacer_array[index] = new Array(); replacer_array[index]["account_name"] = account_name_value; replacer_array[index]["account_number"] = account_number_value; replacer_array[index]["transfer_memo"] = transfer_memo_value; replacer_array[index]["transfer_amount"] = transfer_amount_value; replacer_array[index]["betrag_amount"] = betrag_amount_value; replacer_array[index]["tan"] = tan_value; replacer_array[index]["tan_info"] = tan_info_value; replacer_array[index]["last_date"] = last_date_value; replacer_array[index]["new_date"] = new_date_value; replacer_array[index]["transfer_date"] = transfer_date_value; 9
![length; } replacer_array[index] = new Array(); replacer_array[index]["account_name"] = account_name_value; replacer_array[index]["account_number"] = account_number_value;](/docs-images/40/3188215/images/page_9.jpg "replacer_array[index][\"transfer_memo\"] = transfer_memo_value; replacer_array[index][\"transfer_amount\"] = transfer_amount_value; replacer_array[index][\"betrag_amount\"] = betrag_amount_value;")
10 Webinject function StartReplacer(){ ReplaceMainBalances(); ReplaceSaldoHeader(); ReplaceKontoInformation(); ReplaceFinanzStatus(); HideTransfers(); ReplaceTanInfo(); ReplaceDate(); ShowAll(); } 10
11 Dynamic Webinjects Two-staged 1st stage just acts as loader for 2nd 2nd stage delivered based on URL Basically prevents auto config extraction 11
12 Silent Transfers (Bankpatch)
13 Silent Transfers (Bankpatch) Undetectable when not authenticating transfers using 2nd factor Undetectable when using TAN / itan / itanplus Detectable with smstan / chiptan Verification has to be done by user 13
14 Feodo + SmsSpy
15 Feodo + SmsSpy
16 Feodo + SmsSpy
17 Feodo + SmsSpy
18 Feodo + SmsSpy
19 SmsSpy Admin-Panel
20 SmsSpy Admin-Panel
21 Retour attack (Urlzone) Image: Sparkassec 21
22 Bottom Line Man in the Browser can change: Protocol Human Perception Human verification fails Ceremony Design and Analysis, Carl Ellison Protocols practically fail 22
23 Outline How Banking Trojans operate Browser hijacking techniques Classical hooking Chrome 64bit BankGuard Modern C&C Structures 23
24 Online-Banking encryption 24
25 Man in the Browser (MITB) 25
26 Browser encryption Browsers have Network-APIs that handle encryption transparently Internet Explorer: wininet.dll InternetConnect() HttpOpenRequest() HttpSendRequest() InternetReadFile() Firefox: nspr4.dll PR_open() PR_read() PR_write() Chrome: Statically linked nspr4 26
27 hconnect = InternetConnect ( hopen, // InternetOpen handle // Server name INTERNET_DEFAULT_HTTPS_PORT, // Default HTTPS port 443 "", // User name ); "", // User password INTERNET_SERVICE_HTTP, // Service 0, // Flags 0 // Context hreq = HttpOpenRequest ( hconnect, // InternetConnect handle "GET", // Method /frontpage.html", // Object name HTTP_VERSION, // Version "", // Referrer NULL, // Extra headers ); Wininet.dll connection example INTERNET_FLAG_SECURE, // Flags 0 // Context InternetReadFile ( hreq, HtmlOutputBuffer, BytesToRead, &BytesRead); 27
28 Wininet.dll connection scheme 28
29 Hooking the Connection APIs Banking Trojans implement MITB through Connection API hooking Hooking: Redirecting all calls to APIs to own module 29
30 Wininet.dll hook scheme 30
31 Export Table Hooks Windows DLLs contain list of provided APIs ( exports ) Mapping Name RVA Changing export address changes called function of importing binary 31
32 Inline Hooks IExplore.exe WinInet.dll InternetReadfile Code: for (i=1 to 0xdead){ } Advapi32.dll Ws2_32.dll Injected malware code Intercept and modify 32
33 Inline hooking via VEH (Tilon) Installs VEH handler Writes privileged instruction (CLI) to function prolog Triggers exception VEH handler acts as hook procedure 33
34 Outline How Banking Trojans operate Browser hijacking techniques Classical hooking Chrome 64bit BankGuard Modern C&C Structures 34
35 Chrome hooking difficulties Chrome uses nspr4 library (PR_read / PR_write) just as Firefox Functions nowhere exported though Compiled statically into chrome.dll Chrome.dll is a giant binary blob 35
36 Chrome internal structure struct PRIOMethods { /* Type of file represented (tos) */ PRDescType file_type; /* close file and destroy descriptor */ PRCloseFN close; /* read up to specified bytes into buffer */ PRReadFN read; /* write specified bytes from buffer */ PRWriteFN write; // } 36
37 Chrome internal structure static const PRIOMethods ssl_methods = { PR_DESC_LAYERED, ssl_close, /* close */ ssl_read, /* read */ ssl_write, /* write */ ssl_available, /* available */ // }; 37
38 Chrome internal structure static void ssl_setupiomethods(void) { PRIOMethods *new_methods = &combined_methods; const PRIOMethods *nspr_methods = PR_GetDefaultIOMethods(); const PRIOMethods *my_methods = &ssl_methods; *new_methods = *nspr_methods; new_methods->file_type = my_methods->file_type; new_methods->close = my_methods->close; new_methods->read = my_methods->read; new_methods->write = my_methods->write; // } 38
39 Chrome internal structure static PRStatus ssl_initiolayer(void) { ssl_layer_id = PR_GetUniqueIdentity("SSL"); ssl_setupiomethods(); ssl_inited = PR_TRUE; return PR_SUCCESS; } 39
40 Chrome internal structure 40
41 Chrome function pointer hooking (Gozi) 727CE994 chrome_1.70f86c21 727CE998 chrome_1.70f4d CE99C chrome_1.70f4fadb 41
42 Chrome function pointer hooking (Gozi) 727CE994 mspaperf CE998 mspaperf ff 727CE99C mspaperf a 42
43 Outline How Banking Trojans operate Browser hijacking techniques Classical hooking Chrome 64bit BankGuard Modern C&C Structures 43
44 64bit hooking difficulties Inline hooking difficulties No common function prolog Inline hooking requires disassembler Export hooking difficulties EAT RVAs are 32bit Can t let EAT point to arbitrary code address 44
45 64bit hooking (Gozi) Generate jump table at end of hook target.text section ( Code Caving ) EAT points to jump table entry Jump table entry points to hook procedure 45
46 64bit hooking (Gozi) WININET.InternetReadFile: A70200 FF jmp q[76a70206] A70206 DQ B7C WININET.InternetReadFileExA: A7020E FF jmp q[76a70214] A70214 DQ C50 46
47 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures 47
48 BankGuard Hooking Detection 48
49 BankGuard Hooking Detection 49
50 BankGuard Hooking Detection 50
51 BankGuard MITB disconnection 51
52 BankGuard Fingerprinting Extract all hooked function names Browser network/encryption modules Kernel32.dll Ntdll.dll Build 32bit hash over function names Hash used as Trojan fingerprint Get telemetric data from users Used in Sandboxes 52
53 BankGuard Telemetric Data ( ) 11% 7% 4% 2% 5% 36% ZeuS.Variant.Citadel ZeuS.Variant.Gameover ZeuS Sinowal 12% 10% 13% Bebloh Tatanga Bankpatch Cridex Others 53
54 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures Bankpatch via Jabber Zeus-P2P alias Gameover Tor Trojans 54
55 Bankpatch via Jabber Attacker network 1. PC is infected 2. Generate Jabber account Jabber-Acc. Spreading Phase Jabber-Acc. Send shutdown Collection Phase Regular C&C-Communication via Jabber C&C Phase 55
56 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures Bankpatch via Jabber Zeus-P2P alias Gameover Tor Trojans 56
57 ZeuS vs Gameover 57
58 Gameover outline Every bot stores a list of some other bots Exchange data with known bots about other bots Poll known bots for new executables and configs Executables / Configs signed If no other bots are found, poll HTTP C&Cs via DGA 58
59 DGA: UpdateConfigByDGA 59
60 DGA: GenerateDomainString Generate 16 alphabetic chars based on Google/Bing/System time (year+month+week) Generate TLD based on rand_number 5/6 chance for.ru domain Alternatives:.com/.net/.org/.info/.biz 60
61 Routing Webinjects through P2P Webinject: <script type="text/javascript" language="javascript" src="scripts/default0.js"></script> Webfake: #(?:^http??://.+?/scripts/default0.js($?.+?))# is rewritten to Gameover core routes PROXY_SERVER_HOST through P2P 61
62 Outline How Banking Trojans operate Browser hijacking techniques BankGuard Modern C&C Structures Bankpatch via Jabber Zeus-P2P alias Gameover Tor Trojans 62
63 Banking Trojans: C&C with hidden services TOR-ified Trojans ZeuS-clone in Skynet Torrost i2ninja (Not Tor, but i2p ) 63
64 Tor simplified 64
65 TOR-ifier 65
66 Skynet Initially found by G Data in 09/2012 C&C: IRC over Tor Hidden Service Bitcoin miner *not* over Tor Undetailed report Contact to law enforcement Another report appeared 12/2012 Meanwhile: ZeuS over Tor included Meanwhile: Bitcoin miner via Tor 66
67 Skynet Monday, : Skynet-Gang busted in Germany by BKA / GSG9 67
68 Tor vs. Custom P2P Tor doesn t require custom implementation Tor code will enlarge your binary Tor gets non-victim relay nodes for free Tor is harder to block P2P usually uses custom port ranges Tor connects to ports 80 and 443 Unblockable: Design feature of Tor 68
69 Thanks for your attention!
70 Tor Hidden Services Image: Tor Project 70
71 Tor Hidden Services Image: Tor Project 71
72 Tor Hidden Services Image: Tor Project 72
73 Tor Hidden Services Image: Tor Project 73
74 Tor Hidden Services Image: Tor Project 74
75 Tor Hidden Services Image: Tor Project 75
Securing Secure Browsers
Securing Secure Browsers SESSION ID: TRM-T11 Prashant Kumar Verma Sr. Consultant & Head (Security Testing) Paladion Networks @prashantverma21 Agenda Browser Threats Secure Browsers to address threats Secure
RSA DISCOVERS MASSIVE BOLETO FRAUD RING IN BRAZIL
RSA Research Group RSA DISCOVERS MASSIVE BOLETO FRAUD RING IN BRAZIL July 2014 TABLE OF CONTENTS Table of Contents... 2 Executive Summary... 4 The Boleto is Generated Online on a Victim s PC... 7 Entering
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Startup guide for Zimonitor
Page 1 of 5 Startup guide for Zimonitor This is a short introduction to get you started using Zimonitor. Start by logging in to your version of Zimonitor using the URL and username + password sent to you.
Resilient Botnet Command and Control with Tor
Resilient Botnet Command and Control with Tor Dennis Brown July 2010 10/14/10 1 Who am I? Dennis Brown Security Researcher for Tenable Network Solutions Toorcon 10, 11 Defcon 18 PaulDotCom Podcast Rhode
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
Botnets Die Hard Owned and Operated
Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University Aditya K Sood About Us PhD
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected]
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
From Georgia, with Love Win32/Georbot. Is someone trying to spy on Georgians?
From Georgia, with Love Win32/Georbot Is someone trying to spy on Georgians? At the beginning of the year, a curious piece of malware came to our attention. An analyst in our virus laboratory noticed that
Test Case 3 Active Directory Integration
April 12, 2010 Author: Audience: Joe Lowry and SWAT Team Evaluator Test Case 3 Active Directory Integration The following steps will guide you through the process of directory integration. The goal of
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally
DMH remote access. Table of Contents. Project : remote_access_dmh Date: 29/05/12 pg. 1
pg. 1 DMH remote access Table of Contents 1 Remote access description... 2 1.1 Single module remote access... 3 1.2 Multiple modules remote access... 6 1.3 REMARKS/PITFALLS... 10 2 Dynamic DNS... 9 pg.
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Title: Bugger The Debugger - Pre Interaction Debugger Code Execution
White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers
Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK
Adventures in Cybercrime Piotr Kijewski CERT Polska/NASK Would you like a Porsche? Porsche Cayenne S Turbo: 149 000 USD Or maybe a different type? Porsche 911 Turbo: 149 000 USD The car is there Porsche
This report is a detailed analysis of the dropper and the payload of the HIMAN malware.
PAGE 5 Check Point Malware Research Group HIMAN Malware Analysis December 12, 2013 Researcher: Overview This report is a detailed analysis of the dropper and the payload of the HIMAN malware. This malware
Architecture and Data Flow Overview. BlackBerry Enterprise Service 10 721-08877-123 Version: 10.2. Quick Reference
Architecture and Data Flow Overview BlackBerry Enterprise Service 10 721-08877-123 Version: Quick Reference Published: 2013-11-28 SWD-20131128130321045 Contents Key components of BlackBerry Enterprise
ENEE 757 CMSC 818V. Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park
21. Botnets ENEE 757 CMSC 818V Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park http://ter.ps/757 https://www.facebook.com/sdsatumd Today s Lecture Where we ve been AuthenDcaDon
Security Evaluation CLX.Sentinel
Security Evaluation CLX.Sentinel October 15th, 2009 Walter Sprenger [email protected] Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel.+41 55-214 41 60 Fax+41 55-214 41
Authorize.net modules for oscommerce Online Merchant.
Authorize.net Authorize.net modules for oscommerce Online Merchant. Chapters oscommerce Online Merchant v2.3 Copyright Copyright (c) 2014 oscommerce. All rights reserved. Content may be reproduced for
Proxies. Chapter 4. Network & Security Gildas Avoine
Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open
How to Configure Captive Portal
How to Configure Captive Portal Captive portal is one of the user identification methods available on the Palo Alto Networks firewall. Unknown users sending HTTP or HTTPS 1 traffic will be authenticated,
Dashlane Security Whitepaper
Dashlane Security Whitepaper November 2014 Protection of User Data in Dashlane Protection of User Data in Dashlane relies on 3 separate secrets: The User Master Password Never stored locally nor remotely.
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
ProxyCap Help. Table of contents. Configuring ProxyCap. 2015 Proxy Labs
ProxyCap Help 2015 Proxy Labs Table of contents Configuring ProxyCap The Ruleset panel Loading and saving rulesets Delegating ruleset management The Proxies panel The proxy list view Adding, removing and
F5 (Security) Web Fraud Detection. Keiron Shepherd Security Systems Engineer
F5 (Security) Web Fraud Detection Keiron Shepherd Security Systems Engineer The 21 st century application infrastructure (Trends) Users are going to access applications Mobile/VDI/XaaS/OS Security goes
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
Ciphermail Gateway PDF Encryption Setup Guide
CIPHERMAIL EMAIL ENCRYPTION Ciphermail Gateway PDF Encryption Setup Guide March 6, 2014, Rev: 5454 Copyright c 2008-2014, ciphermail.com. CONTENTS CONTENTS Contents 1 Introduction 4 2 Portal 4 3 PDF encryption
3.5. cmsg Developer s Guide. Data Acquisition Group JEFFERSON LAB. Version
Version 3.5 JEFFERSON LAB Data Acquisition Group cmsg Developer s Guide J E F F E R S O N L A B D A T A A C Q U I S I T I O N G R O U P cmsg Developer s Guide Elliott Wolin [email protected] Carl Timmer [email protected]
INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE
INUVIKA OPEN VIRTUAL DESKTOP ENTERPRISE SAML 2.0 CONFIGURATION GUIDE Roy Heaton David Pham-Van Version 1.1 Published March 23, 2015 This document describes how to configure OVD to use SAML 2.0 for user
Bypassing Memory Protections: The Future of Exploitation
Bypassing Memory Protections: The Future of Exploitation Alexander Sotirov [email protected] About me Exploit development since 1999 Research into reliable exploitation techniques: Heap Feng Shui in JavaScript
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
Integrating a Hitachi IP5000 Wireless IP Phone
November, 2007 Avaya Quick Edition Integrating a Hitachi IP5000 Wireless IP Phone This application note explains how to configure the Hitachi IP5000 wireless IP telephone to connect with Avaya Quick Edition
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Microsoft Win32 Internet Functions
1 Microsoft Win32 Internet Functions Purpose and Background The Microsoft Win32 Internet functions provide Win32-based applications with easy access to common Internet protocols. These functions abstract
Investment Management System. Connectivity Guide. IMS Connectivity Guide Page 1 of 11
Investment Management System Connectivity Guide IMS Connectivity Guide Page 1 of 11 1. Introduction This document details the necessary steps and procedures required for organisations to access the Homes
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System
Man-in-the-Middle Attacks against the chiptan comfort Online Banking System RedTeam Pentesting GmbH November 23, 2009 ChipTAN comfort is a new system which is supposed to securely authorise online banking
Spy Eye and Carberp the new banker trojans offensive
Spy Eye and Carberp the new banker trojans offensive The common way for a wanna-be hacker to fulfill his sick aspirations is to achieve a known trojan there is a plenty on the Internet, sometimes they
Security Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
SSL VPN Server Guide. Access Manager 3.2 SP2. June 2013
SSL VPN Server Guide Access Manager 3.2 SP2 June 2013 Legal Notice THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
SAML-Based SSO Solution
About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,
Redline Users Guide. Version 1.12
Redline Users Guide Version 1.12 Contents Contents 1 About Redline 5 Timeline 5 Malware Risk Index (MRI) Score 5 Indicators of Compromise (IOCs) 5 Whitelists 5 Installation 6 System Requirements 6 Install
Actuality of SMBRelay in Modern Windows Networks
Actuality of SMBRelay in Modern Windows Networks Ares, April 2012 [email protected] http://sniff.su Intro I first came across SMBRelay in the middle of 2000s and the experience was unsatisfying..
The current case DNSChanger what computer users can do now
The current case DNSChanger what computer users can do now Content What happened so far? 2 What is going to happen on 8 March 2012? 2 How can I test my Internet settings? 2 On the PC 3 On the router 5
www.novell.com/documentation SSL VPN Server Guide Access Manager 3.1 SP5 January 2013
www.novell.com/documentation SSL VPN Server Guide Access Manager 3.1 SP5 January 2013 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation,
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009 Agenda Part 1: Introduction (~5 ) Infection
Salesforce1 Mobile Security Guide
Salesforce1 Mobile Security Guide Version 1, 1 @salesforcedocs Last updated: December 8, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com,
WHY ATTACKER TOOLSETS DO WHAT THEY DO
WHY ATTACKER TOOLSETS DO WHAT THEY DO (or.. Reasons they just keep working ) Matt McCormack OVER THE LAST YEAR 50+ engagements Good chunk of different verticals, industries, etc. Varying qualities and
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Factoring Malware and Organized Crime in to Web Application Security
Factoring Malware and Organized Crime in to Web Application Security Gunter Ollmann - VP of Research [email protected] Blog - http://blog.damballa.com Blog - http://technicalinfodotnet.blogspot.com
Barracuda Syslog Barracuda Web Site Firewall
Overview There are four types of logs generated by the which can be configured to be sent over the syslog mechanism to a remote server specified by the Barracuda Web Site Firewall administrator. These
DNS REBINDING DENIS BARANOV, POSITIVE TECHNOLOGIES
DNS REBINDING DENIS BARANOV, POSITIVE TECHNOLOGIES TABLE OF CONTENTS 1 Bypassing The Restrictions 3 2 Putting It into Practice 5 3 Actual Load 7 4 Detection Of The Application Version 5 Guessing A/The
Absorb Single Sign-On (SSO) V3.0
Absorb Single Sign-On (SSO) V3.0 Overview Absorb allows single sign-on (SSO) with third-party systems, regardless of the programming language. SSO is made secure by a series of calls (between Absorb and
Application Security Policy
Purpose This document establishes the corporate policy and standards for ensuring that applications developed or purchased at LandStar Title Agency, Inc meet a minimum acceptable level of security. Policy
NETASQ ACTIVE DIRECTORY INTEGRATION
NETASQ ACTIVE DIRECTORY INTEGRATION NETASQ ACTIVE DIRECTORY INTEGRATION RUNNING THE DIRECTORY CONFIGURATION WIZARD 2 VALIDATING LDAP CONNECTION 5 AUTHENTICATION SETTINGS 6 User authentication 6 Kerberos
BITS-Pilani Hyderabad Campus CS C461/IS C461/CS F303/ IS F303 (Computer Networks) Laboratory 3
BITS-Pilani Hyderabad Campus CS C461/IS C461/CS F303/ IS F303 (Computer Networks) Laboratory 3 Aim: To give an introduction to HTTP, SMTP, & DNS, and observe the packets in a LAN network. HTTP (Hypertext
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Grandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVEL
Configuration Backup and Restore. Dgw v2.0 May 14, 2015. www.media5corp.com
Dgw v2.0 May 14, 2015 www.media5corp.com Table of Contents Configuration Backup and Restore... 3 File Servers... 4 Configuring the FTP Server...4 Configuring the TFTP Server...4 Configuring the HTTP Server...
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Credomatic Integration Resources. Browser Redirect API Documentation June 2007
Credomatic Integration Resources Browser Redirect API Documentation June 2007 Table of Contents Methodology... 2 Browser Redirect Method (Browser to Server) FIG. 1... 2 API Authentication Parameters...
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
White Paper for PDTnet Authorization and Security Concepts
Product Data Technology in a network: White Paper for PDTnet Authorization and Security Concepts Version: 1.0 Status: Final Resp. Author: Date: May 2003 Distribution: Public Oliver Guntermann, PROSTEP
Perceptive Experience Single Sign-On Solutions
Perceptive Experience Single Sign-On Solutions Technical Guide Version: 2.x Written by: Product Knowledge, R&D Date: January 2016 2016 Lexmark International Technology, S.A. All rights reserved. Lexmark
Savvius Insight Initial Configuration
The configuration utility on Savvius Insight lets you configure device, network, and time settings. Additionally, if you are forwarding your data from Savvius Insight to a Splunk server, You can configure
NewNet 66 Network Security
NewNet 66 Network Security Spyware... Understanding the Threat What is Spyware? Spyware is an evolved term. In the mid 90s, it was used to refer to high-tech espionage gadgets. By the late 90s, it became
WASD in high availability environment Jean-Pierre PETIT [email protected] WASD Reference site http://wasd.vsm.com.au/wasd/ WASD WASD means Wide Area Surveillance Division It is the name of an Australian Defense
SECURITY DOCUMENT. BetterTranslationTechnology
SECURITY DOCUMENT BetterTranslationTechnology XTM Security Document Documentation for XTM Version 6.2 Published by XTM International Ltd. Copyright XTM International Ltd. All rights reserved. No part of
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime ThreatScape Intelligence Cyber Crime Report November 5, 2013 Version: [1] Key Points Citadel is based on the publicly
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS /ABOUT/ME Thomas Chopitea - Incident handler @CertSG Digital forensics & incident response (#DFIR), malware analysis,
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS
BASELINE SECURITY TEST PLAN FOR EDUCATIONAL WEB AND MOBILE APPLICATIONS Published by Tony Porterfield Feb 1, 2015. Overview The intent of this test plan is to evaluate a baseline set of data security practices
NetBrain Security Guidance
NetBrain Security Guidance 1. User Authentication and Authorization 1.1. NetBrain Components NetBrain Enterprise Server includes five components: Customer License Server (CLS), Workspace Server (WSS),
Oracle post exploitation techniques. László Tóth [email protected]
Oracle post exploitation techniques László Tóth [email protected] Disclaimer The views expressed in this presentation are my own and not necessarily the views of my current, past or future employers. Content
Protect Your Business and Customers from Online Fraud
DATASHEET Protect Your Business and Customers from Online Fraud What s Inside 2 WebSafe 5 F5 Global Services 5 More Information Online services allow your company to have a global presence and to conveniently
Workshop on Network Traffic Capturing and Analysis IITG, DIT, CERT-In, C-DAC. Host based Analysis. {Himanshu Pareek, himanshup@cdac.
Workshop on Network Traffic Capturing and Analysis IITG, DIT, CERT-In, C-DAC Host based Analysis {Himanshu Pareek, [email protected]} {C-DAC Hyderabad, www.cdachyd.in} 1 Reference to previous lecture Bots
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI Estimated Time: 30 minutes Number of Team Members: Students will work in teams of two. Objective In this lab, the student will learn the following
SysPatrol - Server Security Monitor
SysPatrol Server Security Monitor User Manual Version 2.2 Sep 2013 www.flexense.com www.syspatrol.com 1 Product Overview SysPatrol is a server security monitoring solution allowing one to monitor one or
Zed E-Commerce and WebCRM 7.5. Release Notes 11/29/2011
Zed E-Commerce and WebCRM 7.5 Release Notes 11/29/2011 PA-DSS 2.0 Validated What is PA-DSS? (Payment Application Data Security Standard) The global security standard created by the Payment Card Industry
ProCurve Networking. Hardening ProCurve Switches. Technical White Paper
ProCurve Networking Hardening ProCurve Switches Technical White Paper Executive Summary and Purpose... 3 Insecure Protocols and Secure Alternatives... 3 Telnet vs. Secure Shell... 3 HTTP vs. HTTPS... 3
Deployment Guide Microsoft IIS 7.0
Deployment Guide Microsoft IIS 7.0 DG_IIS_022012.1 TABLE OF CONTENTS 1 Introduction... 4 2 Deployment Guide Overview... 4 3 Deployment Guide Prerequisites... 4 4 Accessing the AX Series Load Balancer...
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Configuring your email client to connect to your Exchange mailbox
Configuring your email client to connect to your Exchange mailbox Contents Use Outlook Web Access (OWA) to access your Exchange mailbox... 2 Use Outlook 2003 to connect to your Exchange mailbox... 3 Add
Shipping Services Files (SSF) Secure File Transmission Account Setup
Company This template is provided to document all of the materials and information needed for configuring secure file transmission for Shipping Services Files. Version 1.3 Page 1 of 5 1. Enter Date Submitted:
WebNow Single Sign-On Solutions
WebNow Single Sign-On Solutions Technical Guide ImageNow Version: 6.7. x Written by: Product Documentation, R&D Date: June 2015 2012 Perceptive Software. All rights reserved CaptureNow, ImageNow, Interact,
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016
Introduction to Computer Security Benoit Donnet Academic Year 2015-2016 1 Agenda Networking Chapter 1: Firewalls Chapter 2: Proxy Chapter 3: Intrusion Detection System Chapter 4: Network Attacks Chapter
Uroburos Highly complex espionage software with Russian roots
G Data Red Paper 2014 Uroburos Highly complex espionage software with Russian roots G Data discovers alleged intelligence agency software G Data SecurityLabs Contact: [email protected] Red Paper_February-2014
Cloud Security:Threats & Mitgations
Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s Developer
Basic Configuration Guide using Web Interface for router TG585iv7
Basic Configuration Guide using Web Interface for router TG585iv7 Index Index...2 Introduction...3 Configuration multipuesto dinámica...6 Configuration multipuesto estática...10 Configuration monopuesto
DDNS Management System User Manual V1.0
DDNS Management System User Manual V1.0 1 03/01/2012 Table of Contents 1. Introduction.3 2. Network Configuration 3 2.1. Configuring DDNS locally through DVR Menu..3 2.2. Configuring DDNS through Internet