Anatomy of an Attack
So you got hacked now what? Chris Catanzaro Blue Coat Systems Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 1 We Live In A Post Prevention World Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 2 Answering the Most Dreaded Questions from the CISO Who did this to us? How did they do it? What systems and data were affected? Can we be sure it is over? Can it happen again? Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 3 Anatomy of an Attack § First things First • When talking about indicators of compromise and how one might find them, we need to first step back and fully understand the steps of an attack or attack cycle so we know what to look for. • This attack cycle is often referred to as a Kill Chain • Understanding the concepts that are described in the Kill Chain will help you correlate events of seemingly uninteresting data to solve incident response type conditions. • It is important when you get an indicator of compromise to know what phase of the Kill Chain you are looking at, this will help you understand what to look for next in your investigation. Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 4 Anatomy of an Attack § Definitions • Threat – An agent or human actor that might attempt to compromise or violate the security of a system • Vulnerability – Existence of a design or implementation error or weakness that could lead to an unexpected or an undesirable compromise of the system • Exploit – A defined way to take advantage of a vulnerability • Attack – An attempt to compromise or gain access to systems and/or data • Attack Surface – The summation of all exposed services, drivers, software, input fields, protocols, and interfaces (including people) through which a threat may attack Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 5 Anatomy of an Attack § Understanding The Threats • Insider Threats • Cybercriminals • Nation States • Hacktivists § Why They Do It • Financially Motivated • Politically Motivated • Nationalistically Motivated • Industrial Espionage / Stealing Trade Secrets Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 6 Anatomy of an Attack § Understanding The Kill Chain • What is it? – The Kill Chain is a military model that was applied to information security by Hutchins, Cloppert, and Amin of Lockheed Martin in 2009, and recently re-popularized by John “Four” Flynn from the Facebook security team in his Blackhat presentation “Intrusion Along the Kill Chain”. • Why is it important? – The basic idea of a Kill Chain is that there is a sequence of elements that must occur in order for an attack to succeed. By understanding each of the elements in a Kill Chain, we can use attributes of those elements, as well as combinations of elements, to better predict future threats. • Why do analysts often over look it? – The basic problem is analysts often filter out the events and alerts that seem uninteresting, common, or minor. And while it is true, by themselves, they are some what meaningless and unimportant, however, if you put them in context with other events, you begin to see a much larger picture of what is going on, gain more clarity, and understand where to focus your efforts. Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 7 Anatomy of an Attack § Reconnaissance • The first phase in an attackers Kill Chain is reconnaissance. • Sometimes this includes detectable but seemingly innocuous activity such as visiting your public website, conference proceedings, mailing lists, clicking on the “About Us” page to learn about the management team, or the “Investors” or “Directors” page to learn about those close to and well trusted by management. • More often, this kind of activity occurs undetectably, using the endless supply of social network, open source, and doxing sites that are available today. • Goals of the Attacker – Define target, find and organize accomplices – Research target infrastructure and employees – Gather all public information – Identify potential attack vectors Recon Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 8 Anatomy of an Attack § Weaponize • This involves the automated creation of a Trojan infected file, that looks like a normal PDF or a Word or Excel doc that has some sort of interesting or enticing title, something like “Executive Salaries” or “Q4 Termination List”. • Pirated software and hacked versions of the latest most popular games are also high susceptible. • Other forms are off-the-shelf exploit kits and the variety of tools that are used to promote stealthy program execution. • Goals of the Attacker – Find and use good exploit kits – Create seemingly normal files that are embedded with malicious payloads – Use packed / encrypted EXEs to avoid detection and analysis Recon BHE Weaponize WHE Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 9 Anatomy of an Attack § Delivery • The most common methods of delivery are still links and attachments in email and social media, infected flash based banner ads, and “found” removable media. • There is no network filter known than can protect against a user pulling an email out of his SPAM or PHISHING folder and viewing the attached PDF file. • USB removable media can also be used to get malicious software in to a specific organization via the autorun.ini. • Goals of the Attacker – Create unique and interesting email messages and posts in social media sites and various message boards and classifieds (Craigslist) – Use disguised HTTP links or infected attachments – Litter infected removable media around company site or targeted user’s home Recon Weaponize Delivery Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 10 Anatomy of an Attack § Exploitation / Initial Intrusion • This is the area that we tend to be most obsessed with, often to the effect of blindness to the others. • Exploitation targets a vulnerability, either behavioral or technological. • As you would expect, attackers want to have the greatest chance of success at this phase, so they focus on applications that are most likely to be present on a target’s machine: Acrobat, Java, Microsoft Office, Internet Explorer, and 32bit operating systems (this last one will shift over time). • Goals of the Attacker – Targets vulnerable user behavior and client applications – Attack unpatched Java, Flash, Acrobat, IE, Office, etc – Need to make sure once it is delivered to an end machine that it has a high probability of working. Recon Weaponize Delivery Exploitation Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 11 Anatomy of an Attack § Persistence • This is where a successful exploit installs a remote access tool that allows the attacker to interact with the victim’s machine, and to have a persistent connection to the network. • These connections are generally outbound by nature to avoid dealing with firewalls, and somewhat invert the client/server paradigm where the victim machine becomes a server, and the attacker’s client is the console that can connect to any number of victim servers. • RATs (Remote Access Tool / Trojan) are somewhat different to botnets in that botnets tend to be programmatically controlled en masse whereas RATs are usually much more personalized. • Goals of the Attacker – Establish a tenacious foothold by installing a RAT Recon Weaponize Delivery Exploitation Persistence Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 12 Anatomy of an Attack § Command and Control • The system is being controlled by the attacker at this point • C&C generally uses legitimate protocols to avoid anomaly detection, and is often encrypted with OS-provided SSL channels. • Other forms of C&C involve the use of hiding in plain site in HTLM, social networks, or even legitimate image files. • Recently Google Docs has proven as a successful method to allow remote “hands on the keyboard” access inside the target environment. • Goals of the Attackers – Create outbound connection – Uses stealthy but benign channels Recon Weaponize Delivery Exploitation Persistence C2 Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 13 Anatomy of an Attack § Extension • Extension refers to additional movement within an infiltrated environment since it is unlikely that the victim machine contains the specific asset that the attacker is looking for. • Involves gathering credentials from the victims machine, discovering higher-value assets (such as servers, domain controllers) through internal reconnaissance, moving laterally to these machines via RDP or Windows APIs, and escalating privileges using additional exploits. • Weak security once inside – Organizations suffer from escargot model of security – “hard and crunchy on the outside, soft and chewy on the inside” • Goals of the Attacker – Expand access and obtain credentials through lateral movement – Exploit credentials with every jump and increase persistence Recon Weaponize Delivery Exploitation Persistence C2 Extension Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 14 Anatomy of an Attack § Damage • Only now, after progressing through the first seven phases, can intruders take actions to achieve their original objectives. • Typically, this objective is data exfiltration which involves collecting, encrypting and extracting information from the victim environment; violations of data integrity or availability are potential objectives as well. • This can also include any form of compromise to the confidentiality, integrity, or availability of any information system assets. • Goals of the Attacker – Covert exfiltration of data to a collection point – Compromise or destruction of assets Recon Weaponize Delivery Exploitation Persistence C2 Extension Damage Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 15 Anatomy of an Attack § Understanding The Kill Chain • Need complete visibility, every step of the way or you loose ability to put the pieces back together – When we filter out some alerts and events and do not view them in the context of the entire Kill Chain, we are effectively looking at seemingly random events. Tracing the Kill Chain, at this point, is nearly impossible, which makes finding the really bad stuff even that much more difficult. Recon Weaponize Delivery Exploitation Persistence C2 Extension Damage Risk and Cost to Contain/Remediate Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 16 How did we find out we were Hacked? § Outside source • FBI • Your information posted on a Malnet • The Hackers themselves (Hacktavists) § Internal detection • Tools Catch – SIEM, DLP, Sandbox • Data Exfiltration – Proxy SG Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 17 Now we have some Options § Option A - Hire and investigation company • Very Expensive • Don’t know your systems and network environment • Are they good? Do they really know what they are doing? § Option B - Investigate yourself • Your network your systems your access • Still expensive • Are you looking in the right places? • Do you have enough data? Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 18 POST-PREVENTION SECURITY GAP KnownAttacks Files Targeted Insider-Threats Known IPs/URLs Modern Tactics & Techniques Web Application Firewall Hactivists DLP Known Malware Zero-Day Threats Email Gateway Cybercriminals SIEM Known Threats Novel Malware Web Gateway Nation States Host AV Traditional Advanced Threats IDS / IPS Threat Actors NGFW Advanced Threat Protection • Content • Detection • Analytics • Context • Visibility • Analysis • Intelligence SIGNATURE-BASED DEFENSE-IN-DEPTH TOOLS SSL Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 19 INVESTIGATE & REMEDIATE Security Analytics Platform Full Security Visibility of All Network Traffic Forensic Details Before, During and After an Alert Reduce Time-to-Resolution and Breach Impact The Security Camera for Your Network Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 20 Security Analytics Platform THE SECURITY CAMERA FOR YOUR NETWORK Turing Complexity into Context Records, classifies and indexes all packets and flows up to 10Gbps Providing realtime analysis and full visibility of everything going in and out of your network DPI classification of over 2,000 applications and thousands of meta attributes On the wire, real-time visibility and analysis of data exfiltration & infiltration Security Context – including reputation, user and social personas, artifacts The ‘Black Box’ for incident response, forensics, root cause and impact analysis Solera is the Security Camera for your Network Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 21 Security Camera for your Network 1 Ongoing Operations 2 Incident Containment 3 Incident Resolution • Know what happened before, during and after an alert, with complete, clear supporting evidence • Multiple sources for real-time integrity & reputation of URL, IP address, file hash or email address • Trace back and discover Tactics, Techniques & Procedures and identify Indicators of Compromise Forensic Details Before, During and After an Alert • Integrated workflows with leading network security tools to add context and improve effectiveness Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 22 THANK YOU! Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 23 Thank You Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved. 24
© Copyright 2024