Moderne Honigtöpfe im Zeitalter · 2015-11-10 · Advisor for information security Expert for the...

Version: 1.0

Date: 2015-11-03

Author: Avi Kravitz

Responsible: Avi Kravitz

Confidentiality Class: Public

Moderne Honigtöpfe im Zeitalter scheiternder Prävention

Title: [--Title--] | Responsible: [--Responsible--]

Version / Date: [--VX.X / YYYY-MM-DD--] | Confidentiality Class: [--Confidentiality Class--]

Title: CybeDefence | Responsible: Avi Kravitz

Version / Date: V1.0 / 2015-10-08 | Confidentiality Class: public

whoami

Bernhard

Schildendorfer | b.schildendorfer@sec-consult.com

Security Consultant | SEC Consult

… IT / Information Security in St. Pölten

… SEC-Consult since 02/2010

… Penetration Tester, Project Leader, …

… Responsible for Operations @ CyberTrap

… and some other interests

SEC Consult – Who we are (1)

Vienna (HQ) | AT

Wiener Neustadt | AT

Vilnius | LT

Berlin| DE

Montreal | CA

Singapore | SG

Moscow | RUFrankfurt | DE

Founded 2002

50+ Security Experts

350+ Security Audits per year

Globally operating SEC ConsultVulnerability Lab

Zurich| CH

Advisor for information security

Expert for the implementation of security processes and policies(ISO 27001, BS 25999, GSHB)

Leading company for technical security audits

Specialist for web application security according to ONR 17700

Independent of product manufacturers

Our customers are public authorities, financial institutions and well-

known leading companies all over the world

Sectoral orientation (defence, public, finance, industry, SW development)

SEC Consult – Who we are (2)

Case #1

a fraud.

Hey Phil!

Did u already take

care of the invoice?

It‘s important!

Frank, which invoice

are you talking

about?

Ohhh damn!!

It‘s attached to this

mail. Please take

care of it.

3 hours later…

Frank, I initiated the

transfer!What are you talkin

about?

Fraudster

WHAT IF

you could identify the fraudster?

Later the same day…

Beispielbild - Optisches Auftreten des Einsatzteams kann abweichen

Frank, find

attached the

confirmation!

20 minutes later…

Intercepted Data

10/09/2015 05:28:33 PM - [SMB] NTLMv2-SSP Client : 5.31.128.11

10/09/2015 05:28:33 PM - [SMB] NTLMv2-SSP Username : TROUBLEMARS\arad

10/09/2015 05:28:33 PM - [SMB] NTLMv2-SSP Hash :

ARAD::TROUBLEMARS:1122334455667788:BF291E57152648994XXXX5FFC34EA6F3:01

01000000000000CB222026A702XXXXX80245F1155C1780000000002000A0073006D006

2003100320001001400530045005200560045005200320030003000380004001600730

06D006200310032002E006C006F00630061006C0003002CXXXXX450052005600450052

0032003000300038002E0073006D006200310032002E006C006F<snip>

Cracked password: moneymaker1982

30 minutes later…

Intercepted Data

10/09/2015 05:55:56 PM - [SMB] NTLMv2-SSP Client : 41.58.80.176

10/09/2015 05:55:56 PM - [SMB] NTLMv2-SSP Username : MicrosoftAc-

count\my-cool-nickname@outlook.com

10/09/2015 05:55:56 PM - [SMB] NTLMv2-SSP Hash : my-cool-

nickname@outlook.com::MicrosoftAccount:1122334455667788:D2CEXX0DABBBC3

FD08A6XXXXX89B00B:0101000000000000649CEDE9AXXXXX10108C9D7355FB6CA3D000

0000002000A0073006D006200310032000100140053004500520056004500520032003

000300038000400160073006D006200310032002E<snip>

Cracked password: homersimpson7

some days later…

Case #2

an APT.

“The account of a user that was on vacation was locked due to failed logins”

- a SEC Consult client

Anatomy of a Targeted Attack

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

Initial Recon Complete Mission

Initial Recon

let‘s steal

the crown

jeweles

EstablishFoothold

let‘s plant

some remote

controllable

malware• Critical Vulnerabilities in

Web Applications

• Spear Phishing

• Drive-By Downloads

• etc.

Initial Compromise

let‘s find a way

into the company

information

gathering

• Weak Passwords

• Misconfigurations

• Bad Patchmanagement

• etc.

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

Complete Mission

let‘s plant new

backdoors

let‘s move from system

to system until we find

what we‘re looking for

look for the

diamonds!

we got the

crown jeweles,

let’s deliver it to

our client

Version / Date: V1.0 / 2015-10-08 | Confidentiality Class: public Foto: Fotolia 62727991, Westend61

They will come back

! Information security can no longer

prevent advanced targeted attacks

!Too much spending is focused on

the prevention

!Too little is spent on security monitoring

and response

!Tailored security breaches are inevitable

Conclusio

What to do?

Security is all about

knowing & preparation!

WHAT IF you are able to…

get their motivation?

get their TTP‘s

identify the attacker(s)?

Knowing - Global Threat Intelligence?

Indicators of compromise (IOCs)/ Signature feeds

Malicious IPs

Malicious domains

Malware hashes

Phishing e-mails

Misc. fingerprints

The Art of Deception

We know your enemies

Look in the Mirror…

CyberTrap

CyberTrap is a weak link in the exposed infrastructure

Application 1 Application 2 Application 3 Application 4 Application 5 Entry Point Application 7 Application 8 Application 9

SQL Injection

Fileshare

Default Passwords

File Uploads

0 Day Vulnerability

Outdated Software

Be close to your enemies with CyberTrap!

Find out where they come into your system

Find out what tools they are using

Find out what they are after

Find out what their motivation is

CyberTrap gives you unique

LOCAL THREAT INTELLIGENCE

Know Your Enemy

Hello!CyberTrap detected 4103 IOCs on the following units:

websrv01.wbdmz.local: 3122dbsrv01.wbdmz.local: 981

Click here to access the CyberTrap Dashboard.CyberTrap Notification System

13.04.2015

Connection Atlas

Activity Graph

Live Alerts

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

StealthVulnerbility

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

• SQL Injection

• Broken File Upload

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

• RAT Malware

• Valid mcsync.exe

• DLL Hijacking

• Misc. Tools

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

Dump cached passwords

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

Network Scan

Initial Compromise

Establish

Foothold

Escalate

Privileges

Internal Recon

Move Laterally

MaintainPresence

• Windows commands

• Remote cronjob

Conclusio

Working time:

~ 3am - ~ 2pm (CET)

Identified motivation

Attributed infrastructure

Generation of signatures

Takeaways

Prevention fails

Preparation is key

Improve monitoring & detection capabilities

Know your enemies

Increase time to defend

Homefield advantage

Do the homework

Takeaways

„If you know your enemies and know yourself, you will not be imperiled in a hundred battles“

- Sun Tzu, The Art of War

Contact

GERMANY

SEC Consult Unternehmensberatung Deutschland GmbH

Ullsteinstraße 118

D-12109 Berlin

Email office-berlin@sec-consult.com

LITHUANIA

UAB Critical Security, a SEC Consult company

Sauletekio al. 15-311

10224 Vilnius

Tel +370 5 2195535

Email office-vilnius@sec-consult.com

RUSSIA

CJCS Security Monitor

5th Donskoy proyezd, 15, Bldg. 6

119334, Moscow

Tel +7 495 662 1414

Email info@securitymonitor.ru

SINGAPORE

SEC Consult Singapore PTE. LTD

4 Battery Road

#25-01 Bank of China Building

Singapore (049908)

Email office-singapore@sec-consult.com

CANADA

i-SEC Consult Inc.

100 René-Lévesque West, Suite 2500

Montréal (Quebec) H3B 5C9

Email office-montreal@sec-consult.com

AUSTRIA

SEC Consult Unternehmensberatung GmbH

Komarigasse 14/1

2700 Wiener Neustadt

Tel +43 1 890 30 43 0

Email office@sec-consult.com

THAILAND

SEC Consult (Thailand) Co.,Ltd.

29/1 Piyaplace Langsuan Building 16th Floor, 16B

Soi Langsuan, Ploen Chit Road

Lumpini, Patumwan | Bangkok 10330

Email office-vilnius@sec-consult.com

www.sec-consult.com

SWITZERLAND

SEC Consult (Schweiz) AG

Turbinenstrasse 28

8005 Zürich

Tel +41 44 271 777 0 | Fax +43 1 890 30 43 15

Email office-zurich@sec-consult.com

AUSTRIASEC Consult Unternehmensberatung GmbH

Mooslackengasse 17

1190 Vienna

Tel +43 1 890 30 43 0 | Fax +43 1 890 30 43 15

Email office@sec-consult.com

Moderne Honigtöpfe im Zeitalter · 2015-11-10 · Advisor for information security Expert for the...

Documents

Transcript of Moderne Honigtöpfe im Zeitalter · 2015-11-10 · Advisor for information security Expert for the...

Business Continuity Management and BS 25999 - · PDF fileBusiness Continuity Management and BS 25999 by Steve Chan, Head of Training - HK, BSI Management Systems 9 April, 2008

Cyber Security solutions · † Business Continuity – BS 25999-2 † Safety – OHSAS 18001 † LSR18.6E Certified Datacentre Infrastructure (Lampertz Room) † Resilient Infrastructure

ISO 22301, ISO 27031 (BS 25999-1 and BS 25999-2) …kemal.bhsearch.com/wp-content/uploads/2012/10/05_BCP.pdf · ISO 22301, ISO 27031 (BS 25999-1 and BS 25999-2) Business Continuity

BS 25999-2: BUSINESS CONTINUITY MANAGEMENT SYSTEM

Essentials des Onlinemarketings im Google-Zeitalter · Essentials des Onlinemarketings im Google-Zeitalter Prof. Dr. Eduard Heindl. 2 Der Autor ... seybold.de I. Grundlagen: SEO –Was

25999 Best Movie 2000-2005€¦ · Title: 25999 Best Movie 2000-2005.indd Created Date: 20060803121941Z

Business Continuity BS 25999 - Information Security Services

Intelligente Vernetzung im Zeitalter von Smart Country ... · Intelligente Vernetzung im Zeitalter von Smart Country & Smart City ... Intelligently connecting People, Thingsand Businesses

INNOVATIVE GESCHÄFTSMODELLE IM ZEITALTER DER DIGITALEN ... · PDF fileuniversitÄt universitÄt innsbruck | 1 innovative geschÄftsmodelle im zeitalter der digitalen transformation

Web Application Management im digitalen Zeitalter · 5 Web Application Management im digitalen Zeitalter 2015 Die Zusammenarbeit mit Dienstleistern wird neu justiert – bei hoher

Warum Frauen alles mitbringen, um im digitalen Zeitalter … · WARUM FRAUEN ALLES MITBRINGEN, UM IM DIGITALEN ZEITALTER ERFOLGREICH ZU GRÜNDEN. Prof. Dr. Martina Schraudner. Fraunhofer

Information Security Group BCP & BS 25999 – Awareness & Understanding.

[BSI] BS 25999-1 Code of Practice for Business Continuity Management

Bibliotheken im Web 2.0 Zeitalter€¦ · Bibliotheken im Web 2.0 Zeitalter Anwendungsszenarien Ronald Kaiser/Wolfgang Ratzek Bibliothekartag 2008 Mannheim, 6. Juni 2008. 2 • Library

How to Deploy BS 25999 Second Edition

Tier 4 Certified Offering 99.995% Uptime SLA BS-25999 Certified

Performance Measurement im Zeitalter der Digitalisierung ... · Performance Measurement im Zeitalter der Digitalisie-rung: Eine Balanced Scorecard für die Industrie 4.0 Matthias

SI Fachgruppe Networks and Cloud Services - Dr. Sebastian … · 2015. 3. 24. · Cyber Security im Industrie 4.0 Zeitalter Charakteristisch für Industrie 4.0: Massive Vernetzung

freiwilligenmanagement im social media zeitalter - startsocial

Technical Briefing: Business Impact Analysis: understanding what is required for BS 25999