Botnets Die Hard Owned and Operated
|
|
|
- Marjorie Owens
- 10 years ago
- Views:
Transcription
1 Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University
2 Aditya K Sood About Us PhD Candidate at Michigan State University Working with isec Partners Founder, SecNiche Security Labs Worked previously for Armorize, Coseinc and KPMG Active Speaker at Security conferences LinkedIn - http :// Website: Blog: Dr. Richard J Enbody Associate Professor, CSE, Michigan State University Since 1987, teaching computer architecture/ computer security / mathematics Co-Author CS1 Python book, The Practice of Computing using Python. Patents Pending Hardware Buffer Overflow Protection 2
3 Disclaimer This research relates to my own efforts and does not provide the view of any of my present and previous employers. 3
4 Bot Spreading Mechanisms POST Exploitation Agenda Browser Exploit Packs Drive-by-Download frameworks Spreaders Demonstration Understanding Ruskill DNS Changer in Action Other System Manipulation Tactics Demonstration Exploiting Browsers/HTTP Conclusion Man in the Browser Formgrabbing Web Injects Demonstration 4
5 Rise of Third Generation Botnets (TGB) Zeus SpyEye Andromeda Smoke NGR Upas
6 TGB Infections started with Zeus! 6
7 Bot Spreading Mechanisms Widely Deployed 7
8 Browser Exploit Packs Browser Exploit Packs (BEPs) Overview Automated frameworks containing browser exploits Implements the concept of Drive-by-Download attacks Exploits are bundled as unique modules Mostly written in PHP + MySQL PHP code is obfuscated with Ion Cube encoder Successfully captures the statistics of infected machine Widely used BEPs are BlackHole / Nuclear / Phoenix etc. How is the exploit served? Fingerprinting browser s environment User-Agent string parameters Plugin detection module Java / PDF / Flash Custom JavaScripts for extracting information from the infected machine 8
9 Browser Exploit Packs Obfuscated JavaScripts used in BlackHole Infections Hiding the infected domain Obfuscated Script Deobfuscated Script 9
10 Plugin Detection Code Browser Exploit Packs Scripts code taken from real world case studies PDF ActiveX Detection PDF Plugin Detection 10
11 Demonstration 11
12 Drive-by-Download Attacks Drive-by-Download Victim s browser is forced to visit infected website IFrame redirects browser to the BEP Exploit is served by fingerprinting the browser environment Browser is exploited successfully using JavaScript Heap Spraying BEP silently downloads the malware onto the victim machine 12
13 Drive-by-Download Frameworks Drive-by-Download Frameworks Java Drive-by Generator 13
14 Demonstration 14
15 Spreaders USB Spreading (Upas Bot - Case Study) Inside USB Spreader Widely used technique in bot design for infecting USB devices Win 32 Implementation Bot calls RegisterDeviceNotificationW function» It can also be implemented as a windows service GUID for Raw USB Device 15
16 Spreaders USB Spreading (Upas Bot - Case Study) Plug and Play (PnP) Devices have unique set of different GUIDs Device interface GUID» Required for dbcc_classguid DEV_BROADCAST_DEVICEINTERFACE Device class GUID» Defines wide range of devices Defines WindowProc as follows» WM_DEVICECHANGE notification message in DEV_BROADCAST_HDR» dbch_devicetype DBT_DEVTYP_DEVICEINTERFACE Wait for the USB device and triggers device-change event as follows: wparam in WindowProc» DBT_DEVICEARRIVAL DBT_DEVICEREMOVALCOMPLETE Fetches drive letter of the USB devices as follows» dbcv_unitmask in _DEV_BROADCAST_VOLUME Logical drive information Continued. 16
17 Spreaders USB Spreading (Upas Bot - Case Study) On successful detecting the USB, bot execute function as follows; CopyFileW to copy malicious executable in the USB drive CreateFileW to create autorun.inf file in the USB root directory SetFileAttributesW to apply required files attribute Autorun.inf infection 17
18 Spreaders USB Spreading (Upas Bot - Case Study) Infecting USB devices using Malicious.LNK file infection.lnk infection 18
19 Spreaders USB Spreading (Upas Bot - Case Study) Upas bot in action 19
20 Spreaders Upas Bot Network Behavior Detection Writing signature specific to USB infection 20
21 POST Exploitation Subverting System Integrity 21
22 What is Ruskill? Understanding Ruskill A termed coined in Russia It refers to the group of warriors who demonstrate their skill in the battle Typically used by Diablo game players to demonstrate their strength and power How does Ruskill relate to bots? Ruskill module is used to demonstrate the capability of bots Removing traces of malware in the system after successful reboot 22
23 Inside Ruskill Module Found in NGR (Dorkbot) Remote file downloading and execution Ruskill allows the bot to fetch any executable from third-party resource and execute it in the compromised system Restoring System Understanding Ruskill Ruskill monitors all the changes performed by the malicious executable in the system Ruskill restores the registry, files ad network settings to the same state ( before the execution of malicious binary) after reboot Deletes the malicious executable after successful execution in the system 23
24 Inside Ruskill Module Understanding Ruskill Ruskill Detecting File, DNS and Registry modifications 24
25 Demonstration 25
26 Critical Problem - DNS Changer 26
27 DNS Changer Exploiting the DNS resolution functionality of the infected machine What it works for? DNS Changer in Action Blocking security providers websites (Implementing blacklists) Blocking microsoft.com updates website to restrict the downloading of updates Restricting the opening of anti-virus vendors websites Redirecting the browser to the malicious domain Forcing the infected machine to download updates from malicious domain Triggering chain infection for downloading another set of malware onto the infected system 27
28 DNS Changer How this works? DNS Changer in Action Replacing the DNS server entries in the infected machine with IP addresses of the malicious DNS server Adding rogue entries in the hosts configuration file Executing DNS amplification attack by subverting the integrity of LAN devices such as routers and gateways It results in DNS hijacking at a large scale in the network Hooking DNS libraries The preferred method is Inline hooking in which detour and trampoline functions are created to play with DNS specific DLLs. 28
29 DNS Changer DNS Changer in Action Inside DNS hooking Hooking DNS API Hooking DNSQuery (*) function calls in dnsapi.lib/dnsapi.dll Implemented by creating a blacklist Bot hijacks the DNS resolution flow by filtering all the incoming DNS requests Hooking DNS Cache Resolver Service Cache resolver service is used for DNS caching Bot hooks sendto function in ws2_32.dll to verify the origin of DNS query to validate if sendto function is called by dnsrsslvr.dll 29
30 DNS Changer DNS Changer in Action Implementation in NGR bot DNS Blocking DNS Redirection 30
31 Demonstration 31
32 Certificate Deletion Certificate Deletion Removing all instances of private certificates from the infected machine ICE IX bot - certificate deletion module 32
33 Cryptovirology Cryptovirology in Action Exploiting the Built-in Windows Crypto APIs Cryptovirology allows malware authors to build robust malware How Cryptovirology is used in designing bots? Generating random filenames for bots Creating registry entries with random keys Highly used for generating random DNS server entries All DNS entries maps to the same IP address Of course, encrypted communication between infected machine and C&C server Verifying the integrity of malicious files downloaded in the system Scrutinizing the bots 33
34 Cryptovirology Cryptovirology in Action An instance from ICE IX bot Windows Crypto API misuse 34
35 Exploiting Browsers Data Exfiltration Over HTTP 35
36 Downgrading Browser Security Removing Protections Nullifying browser client side security to perform stealthy operations Internet Explorer Tampering zone values in the registry Firefox \Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones Manipulating entries in user.js file user_pref("security.warn_submit_insecure",false);» Browser does not raise an alert box when information in sent over HTTP while submitting forms. user_pref("security.warn_viewing_mixed",false);» Remove the warning of supporting mixed content over SSL. OLD School trick but works very effectively. Several other techniques of subverting the browser security also exists. 36
37 Inside MitB Man-in-the-Browser (MitB) MitB typically refers to a userland rootkit that exploits the browser integrity 37
38 What Lies Beneath? Note: The Pop up is triggered in user s active session. So what it is actually? No doubt it is a Popup, but the technique is termed as Web Injects not phishing or something like that. 38
39 Web Injects Web Injects Based on the concept of hooking specific functions in the browser DLLs On the fly infection tactic Execution flow Bot injects malicious content in the incoming HTTP responses Injections are based on the static file named as webinjects.txt Rules are statically defined by the botmaster Bot fetches rules from the webinjects.txt file and injects in the live webpages Information stealing in a forceful manner Exploits user ignorance 39
40 Web Injects What is meant by GPH flags? Exploitation and infection metrics G - injection will be made only for the resources that are requested by the GET P - injection will be made only for the resources that are requested by the POST L - is a flag for grabbing content between the tags data_before and data_after inclusive H similar as L except the ripped content is not included and the contents of tags data_before and data_after 40
41 Web Injects Real Time Cases (1) Forceful Cookie Injection in Citibank s website to manipulate the user s session 41
42 Web Injects Real Time Cases (2) Injecting HTML content in Bank of America s webpages to steal the ATM number and the Pass code. Injecting HTML content in Wells Fargo bank to steal user s ATM code. 42
43 Form Grabbing Form Grabbing It is an advanced technique of capturing information present in forms 43
44 Why Form Grabbing? Form Grabbing Keylogging produces plethora of data Form grabbing extracting data from the GET/POST requests Based on the concept of hooking and DLL injection No real protection against malware 44
45 Form Grabbing Harvested Data Harvested data from POST requests. Kaspersky s anti virus license key entered by the user 45
46 Demonstration 46
47 This Data is Not Yours! All Browsers! 47
48 Conclusion Botnets have become more robust and sophisticated Significant increase in exploitation of browsers HTTP has been used for data exfiltration Botnets die hard 48
49 Questions 49
50 Thanks DEF Con crew SecNiche Security Labs
Advancements in Botnet Attacks and Malware Distribution
Advancements in Botnet Attacks and Malware Distribution HOPE Conference, New York, July 2012 Aditya K Sood Rohit Bansal Richard J Enbody SecNiche Security Department of Computer Science and Engineering
SOCIAL NETWORKS AND INFECTION MODEL
Feature Chain Exploitation Social Networks Malware Aditya K. Sood has more than five years of experience in computer security and has worked in the security domain for Armorize, COSEINC and KPMG. He is
MALWARE ANALYSIS 1. STYX EXPLOIT PACK: INSIDIOUS DESIGN Aditya K. Sood & Richard J. Enbody Michigan State University, USA COMMUNICATION DESIGN
MALWARE ANALYSIS 1 STYX EXPLOIT PACK: INSIDIOUS DESIGN Aditya K. Sood & Richard J. Enbody Michigan State University, USA Rohit Bansal Independent Security Researcher, India In this paper, we discuss the
Exploiting Fundamental Weaknesses in Command and Control (C&C) Panels
Exploiting Fundamental Weaknesses in Command and Control (C&C) Panels What Goes Around Comes Back Around! Aditya K Sood Senior Security Researcher and Engineer 1 Dr. Aditya K Sood About the Speaker! Senior
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
From Georgia, with Love Win32/Georbot. Is someone trying to spy on Georgians?
From Georgia, with Love Win32/Georbot Is someone trying to spy on Georgians? At the beginning of the year, a curious piece of malware came to our attention. An analyst in our virus laboratory noticed that
Securing Secure Browsers
Securing Secure Browsers SESSION ID: TRM-T11 Prashant Kumar Verma Sr. Consultant & Head (Security Testing) Paladion Networks @prashantverma21 Agenda Browser Threats Secure Browsers to address threats Secure
Transaction Anomaly Protection Stopping Malware At The Door. White Paper
Transaction Anomaly Protection Stopping Malware At The Door White Paper Table of Contents Overview 3 Programmable Crime Logic Alter Web Application Flow & Content 3 Programmable Crime Logic Defeats Server-Side
Security Evaluation CLX.Sentinel
Security Evaluation CLX.Sentinel October 15th, 2009 Walter Sprenger [email protected] Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel.+41 55-214 41 60 Fax+41 55-214 41
Protect Your Business and Customers from Online Fraud
DATASHEET Protect Your Business and Customers from Online Fraud What s Inside 2 WebSafe 5 F5 Global Services 5 More Information Online services allow your company to have a global presence and to conveniently
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com 2 Fraud Prevention for Endpoints KASPERSKY FRAUD PREVENTION 1. Ways of Attacking The prime motive behind cybercrime is making money, and today
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected]
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS
Trend Micro Incorporated Research Paper 2012 Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS By: Jon Oliver, Sandra Cheng, Lala Manly, Joey Zhu, Roland
Honeypots & Honeynets Overview. Adli Wahid Security Specialist, APNIC.net [email protected]
Honeypots & Honeynets Overview Adli Wahid Security Specialist, APNIC.net [email protected] 1 Contents 1. ObjecCves 2. DefiniCon of Honeypot & Honeynets 3. Benefits & Risk consideracon 4. Example of Honeypot
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized with
Spyware. Summary. Overview of Spyware. Who Is Spying?
Spyware US-CERT Summary This paper gives an overview of spyware and outlines some practices to defend against it. Spyware is becoming more widespread as online attackers and traditional criminals use it
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
"Charting the Course... ... to Your Success!" MOC 50331 D Windows 7 Enterprise Desktop Support Technician Course Summary
Description Course Summary This course provides students with the knowledge and skills needed to isolate, document and resolve problems on a Windows 7 desktop or laptop computer. It will also help test
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips Agenda Overview W32/Xpaj analysis Overview of a virtual machine Software protection trends W32/Winemmem analysis W32/Induc
Shellshock. Oz Elisyan & Maxim Zavodchik
Shellshock By Oz Elisyan & Maxim Zavodchik INTRODUCTION Once a high profile vulnerability is released to the public, there will be a lot of people who will use the opportunity to take advantage on vulnerable
Introduction: 1. Daily 360 Website Scanning for Malware
Introduction: SiteLock scans your website to find and fix any existing malware and vulnerabilities followed by using the protective TrueShield firewall to keep the harmful traffic away for good. Moreover
CSE 3482 Introduction to Computer Security. Denial of Service (DoS) Attacks
CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Windows 7, Enterprise Desktop Support Technician
Course 50331D: Windows 7, Enterprise Desktop Support Technician Page 1 of 11 Windows 7, Enterprise Desktop Support Technician Course 50331D: 4 days; Instructor-Led Introduction This four-day instructor-ledcourse
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
Web Maniac Hacking Trust. Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security
![Web Maniac Hacking Trust. Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security](/thumbs/27/11695993.jpg "Web Maniac Hacking Trust. Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security")
Web Maniac Hacking Trust Aditya K Sood [adi_ks [at] secniche.org] SecNiche Security Disclaimer Web Maniac - Hacking Trust Pentesting web applications in a hacker s way. Attack surface varies from application
Windows 7, Enterprise Desktop Support Technician Course 50331: 5 days; Instructor-led
Lincoln Land Community College Capital City Training Center 130 West Mason Springfield, IL 62702 217-782-7436 www.llcc.edu/cctc Windows 7, Enterprise Desktop Support Technician Course 50331: 5 days; Instructor-led
How To Protect A Network From Attack From A Hacker (Hbss)
Leveraging Network Vulnerability Assessment with Incident Response Processes and Procedures DAVID COLE, DIRECTOR IS AUDITS, U.S. HOUSE OF REPRESENTATIVES Assessment Planning Assessment Execution Assessment
LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages
LASTLINE WHITEPAPER Large-Scale Detection of Malicious Web Pages Abstract Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and,
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchange
GlobalSign Malware Monitoring
GLOBALSIGN WHITE PAPER GlobalSign Malware Monitoring Protecting your website from distributing hidden malware GLOBALSIGN WHITE PAPER www.globalsign.com CONTENTS Introduction... 2 Malware Monitoring...
EyjafjallajöKull Framework (aka: Exploit Kits Krawler Framework)
EyjafjallajöKull Framework (aka: Exploit Kits Krawler Framework) Seeking Exploit Kits at Large Scale Made Easy By Sébastien Larinier / @Sebdraven & Guillaume Arcas / @y0m This Slide Intentionally Left
Spyware Doctor Enterprise Technical Data Sheet
Spyware Doctor Enterprise Technical Data Sheet The Best of Breed Anti-Spyware Solution for Businesses Spyware Doctor Enterprise builds on the strength of the industry-leading and multi award-winning Spyware
Spyware Analysis. [email protected]. Security Event - April 28, 2004 Page 1
Spyware Analysis [email protected] Security Event - April 28, 2004 Page 1 Content Definition & types of spyware Statistics Hooks Static vs. dynamic software analysis Test environment for spyware Analysis
This report is a detailed analysis of the dropper and the payload of the HIMAN malware.
PAGE 5 Check Point Malware Research Group HIMAN Malware Analysis December 12, 2013 Researcher: Overview This report is a detailed analysis of the dropper and the payload of the HIMAN malware. This malware
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
Cloud Services Prevent Zero-day and Targeted Attacks
Cloud Services Prevent Zero-day and Targeted Attacks WOULD YOU OPEN THIS ATTACHMENT? 2 TARGETED ATTACKS BEGIN WITH ZERO-DAY EXPLOITS Duqu Worm Causing Collateral Damage in a Silent Cyber-War Worm exploiting
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK
Adventures in Cybercrime Piotr Kijewski CERT Polska/NASK Would you like a Porsche? Porsche Cayenne S Turbo: 149 000 USD Or maybe a different type? Porsche 911 Turbo: 149 000 USD The car is there Porsche
Protect Your IT Infrastructure from Zero-Day Attacks and New Vulnerabilities
Protect Your IT Infrastructure from Zero-Day Attacks and New Vulnerabilities Protecting a business s IT infrastructure is complex. Take, for example, a retailer operating a standard multi-tier infrastructure
UNMASKCONTENT: THE CASE STUDY
DIGITONTO LLC. UNMASKCONTENT: THE CASE STUDY The mystery UnmaskContent.com v1.0 Contents I. CASE 1: Malware Alert... 2 a. Scenario... 2 b. Data Collection... 2 c. Data Aggregation... 3 d. Data Enumeration...
Using a Malicious Proxy to Pilfer Data & Wreak Havoc. Edward J. Zaborowski [email protected]
Using a Malicious Proxy to Pilfer Data & Wreak Havoc Edward J. Zaborowski [email protected] Abstract...3 Malicious Web Proxy...3 Becoming the Proxy...3 ARP Spoofing...3 Static Configuration...3 Web Proxy
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
RIA SECURITY TECHNOLOGY
RIA SECURITY TECHNOLOGY Ulysses Wang Security Researcher, Websense Hermes Li Security Researcher, Websense 2009 Websense, Inc. All rights reserved. Agenda RIA Introduction Flash Security Attack Vectors
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
DATA SHEET. What Darktrace Finds
DATA SHEET What Darktrace Finds Darktrace finds anomalies that bypass other security tools, due to the uniqueness of the Enterprise Immune System, capable of detecting threats without reliance on rules,
WildFire Reporting. WildFire Administrator s Guide 55. Copyright 2007-2015 Palo Alto Networks
WildFire Reporting When malware is discovered on your network, it is important to take quick action to prevent spread of the malware to other systems. To ensure immediate alerts to malware discovered on
Adobe Flash Player and Adobe AIR security
Adobe Flash Player and Adobe AIR security Both Adobe Flash Platform runtimes Flash Player and AIR include built-in security and privacy features to provide strong protection for your data and privacy,
Device Fingerprinting and Fraud Protection Whitepaper
Device Fingerprinting and Fraud Protection Whitepaper 1 of 6 Table Of Contents 1 Overview... 3 2 What is Device Fingerprinting?... 3 3 Why is Device fingerprinting necessary?... 3 4 How can Device Fingerprinting
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Detecting the One Percent: Advanced Targeted Malware Detection
Detecting the One Percent: Advanced Targeted Malware Detection Tomer Teller Check Point Software Technologies Session ID: SP02-T19 Session Classification: Intermediate Antivirus 20 th+ Anniversary The
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Module 3: Resolve Software Failure This module explains how to fix problems with applications that have problems after being installed.
CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! 50331 - Windows 7, Enterprise Desktop Support Technician Duration: 5 days About this Course This five-day
HackAlert Malware Monitoring
HackAlert Malware Monitoring Understanding the reselling opportunity for Online Security Services GlobalSign. A GMO Internet Inc group company. Reselling Malware Monitoring The GlobalSign Partner Program
INFORMATION SECURITY REVIEW
INFORMATION SECURITY REVIEW 14.10.2008 CERT-FI Information Security Review 3/2008 In the summer, information about a vulnerability in the internet domain name service (DNS) was released. If left unpatched,
Web Intrusion Detection with ModSecurity. Ivan Ristic <[email protected]>
Web Intrusion Detection with ModSecurity Ivan Ristic Aim of This Talk Discuss the state of Web Intrusion Detection Introduce ModSecurity Introduce an open source web application
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis [email protected] 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
Getting Ahead of Malware
IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,
McAfee Network Security Platform Administration Course
McAfee Network Security Platform Administration Course Intel Security Education Services Administration Course The McAfee Network Security Platform Administration course from McAfee Education Services
LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains
LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary...3 2 Certifications...6 3 Test methodology...7 3.1 Source of exploits...9 3.2 False positive test... 10 3.3 0-day
Lectures 9 Advanced Operating Systems Fundamental Security. Computer Systems Administration TE2003
Lectures 9 Advanced Operating Systems Fundamental Security Computer Systems Administration TE2003 Lecture overview At the end of lecture 9 students can identify, describe and discuss: Main factors while
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
How To Protect Yourself From A Web Attack
Five Stages of a Web Malware Attack A guide to web attacks plus technology, tools and tactics for effective protection By Chris McCormack, Senior Product Marketing Manager Today s web attacks are extremely
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection Trend Micro, Incorporated Marco Dela Vega and Norman Ingal Threat Response Engineers A Trend Micro Research Paper I November
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for
by New Media Solutions 37 Walnut Street Wellesley, MA 02481 p 781-235-0128 f 781-235-9408 www.avitage.com Avitage IT Infrastructure Security Document
Avitage IT Infrastructure Security Document The purpose of this document is to detail the IT infrastructure security policies that are in place for the software and services that are hosted by Avitage.
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam
JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router
Five Tips to Reduce Risk From Modern Web Threats
Five Tips to Reduce Risk From Modern Web Threats By Chris McCormack, Senior Product Marketing Manager and Chester Wisniewski, Senior Security Advisor Modern web threats can infect your network, subvert
Chapter 4 Application, Data and Host Security
Chapter 4 Application, Data and Host Security 4.1 Application Security Chapter 4 Application Security Concepts Concepts include fuzzing, secure coding, cross-site scripting prevention, crosssite request
Exploring the Black Hole Exploit Kit
Exploring the Black Hole Exploit Kit Updated December 20, 2011 Internet Identity Threat Intelligence Department http://www.internetidentity.com http://www.internetidentity.com 12/29/11 Page 1/20 Summary
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Course Description. Course Audience. Course Outline. Course Page - Page 1 of 12
Course Page - Page 1 of 12 Windows 7 Enterprise Desktop Support Technician M-50331 Length: 5 days Price: $2,795.00 Course Description This five-day instructor-led course provides students with the knowledge
Advanced Administration for Citrix NetScaler 9.0 Platinum Edition
Advanced Administration for Citrix NetScaler 9.0 Platinum Edition Course Length: 5 Days Course Code: CNS-300 Course Description This course provides the foundation to manage, configure and monitor advanced
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
Prevent Malware attacks with F5 WebSafe and MobileSafe. Alfredo Vistola Security Solution Architect, EMEA
Prevent Malware attacks with F5 WebSafe and MobileSafe Alfredo Vistola Security Solution Architect, EMEA Malware Threat Landscape Growth and Targets % 25 Of real-world malware is caught by anti-virus Malware
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures
Enterprise Incident Response: Network Intrusion Case Studies and Countermeasures Eric J. Eifert Vice President, Cyber Defense Division ManTech s Mission, Cyber, & Technology Solutions Presentation Overview
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary... 3 2 Certifications... 6 3 Test methodology... 7 3.1 Source of exploits... 9 3.2 False positive test... 10 3.3
The Key to Secure Online Financial Transactions
Transaction Security The Key to Secure Online Financial Transactions Transferring money, shopping, or paying debts online is no longer a novelty. These days, it s just one of many daily occurrences on
Symantec enterprise security. Symantec Internet Security Threat Report April 2009. An important note about these statistics.
Symantec enterprise security Symantec Internet Security Threat Report April 00 Regional Data Sheet Latin America An important note about these statistics The statistics discussed in this document are based
Security Intelligence Services. Cybersecurity training. www.kaspersky.com
Kaspersky Security Intelligence Services. Cybersecurity training www.kaspersky.com CYBERSECURITY TRAINING Leverage Kaspersky Lab s cybersecurity knowledge, experience and intelligence through these innovative
The Fundamental Failures of End-Point Security. Stefan Frei Research Analyst Director [email protected]
The Fundamental Failures of End-Point Security Stefan Frei Research Analyst Director [email protected] Agenda The Changing Threat Environment Malware Tools & Services Why Cybercriminals Need No 0-Days