EternalBlue: Exploit Analysis and Beyond
|
|
|
- Rosanna Cunningham
- 5 years ago
- Views:
Transcription
1 EternalBlue: Exploit Analysis and Beyond
2 WHO AM I? Emma McCall Cyber Security Riot on Twitter
3
4 JUST A LITTLE HISTORY Black Market Intelligence Auc1on Approx. August 2016 No bites April 14 th 2017 Group calling themselves Shadowbrokers Equa1on Group (NSA) Tools and Exploits dumped onto GitHub
5 THE DUMP Overall ~35 Exploits and tools SMB SendMail Kerberos IIS Windows XP -> 10
6 THE DUMP Of particular note were: Fuzzbunch Exploita1on Framework DanderSpritz Command and Control Solu1on DoublePulsar Backdoor Trojan EternalBlue SMB Exploit
7 ETERNALBLUE Where has EternalBlue been seen? WannaCry Ransomware Adylkuzz Viral Crypto Miner Zealot - Apache Struts Lateral movement in ALL cases
8 JUST SOMETHING THAT POPPED UP Slight segue to look at this one: Exploit for MDaemon pre v9.5.6 v9.5.6 was Released in October 2006 Shodan check on 16 th April 2017 Lets have a closer look at that number.
9 ETERNALBLUE Exploit for Windows Server Message Block (SMB) Affected both versions v1 and v2 Remote Code Execu1on on vic1m machine HOW WHAT Exploita1on targeted the following services TCP 445 (Microsof Domain Service) TCP 139 (NetBIOS Session Service) THEN WHAT
10 ETERNALBLUE First things first: How does SMB data transfer work? WHAT HOW THEN WHAT
11 ETERNALBLUE First things first: How does SMB data transfer work? Data larger than SMB MaxBufferSize in Trans2 WHAT HOW THEN WHAT
12 ETERNALBLUE Exploits Non-Paged Pool Overflow in srv2.sys Fills NT Trans with Zeros Malformed Trans2 packet containing shellcode and Encrypted Payload WHAT HOW THEN WHAT
13 ETERNALBLUE Ini1al Payload: DoublePulsar Non-Persistent Customisable Process Name / Command Line Code Execu1on via.dll or raw shellcode upload WHAT HOW Ini1ally Uploaded DLLs came from 2 sources Created via Danderspritz Via Metasploit (Meterpreter) THEN WHAT
14 Attacker Victim Attacker
15 ETERNALBLUE TCP 445 On the internet? what about on your LAN?
16 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
17 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
18 Run it. NETWORK ANALYSIS.. In a lab! hnps://medium.com/@xnymia For all your lab crea1on needs Sysinternals and Wireshark are your best friends Comparison against known good SMB traffic Look for irregulari1es and panerns in mul1ple samples Check protocol docs
19 NETWORK ANALYSIS
20 NETWORK ANALYSIS
21 NETWORK ANALYSIS Interes1ng Mul1plex ID
22 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
23 DETECTION CREATION We have 4 indicators now Mul1plex ID 64/65 Mul1plex ID 81/82 Lets flex our learnings Suricata IDS Rules Snort IDS Rules alert tcp $HOME_NET any -> any any (msg:"exploit Possible ETERNALBLUE SMB Exploit Anempt Stage 1/2 - Tree Connect AndX Mul1plexID = 64 - MS17-010"; flow:to_server,established; content:" FF SMB "; offset:4; depth:9; content:" "; distance:21; within:23; flowbits: set, SMB.v1.AndX.MID.64; classtype:trojan-ac1vity; sid: ; rev:1;)
24 DETECTION CREATION SMB Packet 0010 <... Frame / TCP / IP Headers...> FF 53 4D C FF FE FF C 00 5C E NetBios Header SMB Structure - " FF SMB " Multiplex ID - " " SMB Content
25 DETECTION CREATION alert tcp $HOME_NET any -> any any (msg:"exploit Possible ETERNALBLUE SMB Exploit Anempt Stage 1/2 - Tree Connect AndX Mul1plexID = 64 - MS17-010"; flow:to_server,established; content:" FF SMB "; offset:4; depth:9; content:" "; distance:21; within:23; flowbits: set, SMB.v1.AndX.MID.64; classtype:trojan-ac1vity; sid: ; rev:1;)
26 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
27 IMPACT IDENTIFICATION What is actually vulnerable? Run it. In lots of labs!
28 IMPACT IDENTIFICATION What has already been compromised? Scan the internet?
29 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
30 MITIGATION ADVICE How can we help others mi1gate? Patching can be difficult What other op1ons can we offer? Disable SMBv1? What did Riot do? Suricata detec1ons No external SMB Firewalled Inbound SMB on worksta1ons
31 WHAT CAN I DO? NETWORK ANALYSIS DETECTION CREATION IMPACT IDENTIFICATION MITIGATION ADVICE BINARY ANALYSIS
32 BINARY ANALYSIS Some1mes worthwhile disassembling Simplest things right under your nose.
33 AND BEYOND So shits going down, what can I do? Get a lab setup Grab a sample Run it. Don t be too afraid What can I do with this data? Blogging, Twee1ng, IRC / Slack / Discord A few don'ts for good measure: Don t work in a silo, talk to people Don t run dodgy files on your main machine Be Heard
34 THE GANG Dan Kevin Emma
35
Defending Computer Networks Lecture 12: NIDS. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 12: NIDS Stuart Staniford Adjunct Professor of Computer Science Logis;cs Quiz 2 next Tuesday (10/13/15) Quiz 1 graded (in CMS, papers in front) Range 5-11, mean 9.4
Defending Computer Networks Lecture 13: More NIDS. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 13: More NIDS Stuart Staniford Adjunct Professor of Computer Science Logis;cs HW2 48 hour extension to tomorrow midnight. HW3 Aiming to have it out next ;me Project
All Your Cloud Are Belong to Us. Hunting Compromise in Azure Nate Warfield Microsoft Security Response Center
All Your Cloud Are Belong to Us Hunting Compromise in Azure Nate Warfield Microsoft Security Response Center DISCLAIMER The views, images and tools expressed and referenced in this presentation are my
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
Network Traffic Exploration Application. Presented By Grant Vandenberghe. (613)
Network Traffic Exploration Application Presented By Grant Vandenberghe Grant.Vandenberghe@drdc-rddc.gc.ca (613) 991-6464 Defence Research and! Development Canada Recherche et développement! pour la défense
Training for the cyber professionals of tomorrow
Hands-On Labs Training for the cyber professionals of tomorrow CYBRScore is a demonstrated leader in professional cyber security training. Our unique training approach utilizes immersive hands-on lab environments
Module 1: Penetration Testing Planning and Scoping. Module 2: Basic Usage of Linux and its services
Following topics will be covered: Module 1: Penetration Testing Planning and Scoping - Types of penetration testing and ethical hacking projects - Penetration testing methodology - Limitations and benefits
James Culverhouse AusCERT General Manager Mike Holm Operations Manager Protecting Organisations from cyber threats since 1993
Making a Day in the Life of a University Sys-Admin Easier James Culverhouse AusCERT General Manager Mike Holm Operations Manager Protecting Organisations from cyber threats since 1993 About AusCERT AusCERT
Lab 8: Firewalls & Intrusion Detec6on Systems
Lab 8: Firewalls & Intrusion Detec6on Systems Fengwei Zhang Wayne State University CSC Course: Cyber Security Prac6ce 1 Firewall & IDS Firewall A device or applica6on that analyzes packet headers and enforces
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security No part of this publication, in whole or in part, may
Intrusion Detection System (IDS) IT443 Network Security Administration Slides courtesy of Bo Sheng
Intrusion Detection System (IDS) IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response:
Covering the global threat landscape
Covering the global threat landscape ETERNALBLUE: A PROMINENT THREAT ACTOR OF 2017 2018 Pradeep Kulkarni, Sameer Patil, Prashant Kadam & Aniruddha Dolas Quick Heal Security Labs, India IN TRODUCTION Last
WannaCryptor Ransomware Analysis
WannaCryptor Ransomware Analysis In-depth analysis of Trojan/Win32.WannaCryptor 220, Pangyoyeok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, South Korea, 13493 Tel: 031-722-8000 Fax: 031-722-8901 www.ahnlab.com
Intrusion Detection - Snort
Intrusion Detection - Snort Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 Sometimes, Defenses Fail Our defenses aren t perfect Patches aren t applied promptly enough AV signatures
UTM 5000 WannaCry Technote
UTM 5000 WannaCry Technote The news is full of reports of the massive ransomware infection caused by WannaCry. Although these security threats are pervasive, and ransomware has been around for a decade,
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
Reliably Determining the Outcome of Computer Network Attacks
Reliably Determining the Outcome of Computer Network Attacks 18 th Annual FIRST Conference Capt David Chaboya Air Force Research Labs Anti-Tamper and Software Protection Initiative (AT-SPI) Technology
Intrusion Detection - Snort
Intrusion Detection - Snort 1 Sometimes, Defenses Fail Our defenses aren t perfect Patches aren t applied promptly enough AV signatures not always up to date 0-days get through Someone brings in an infected
Anti-Virus Comparative
Anti-Virus Comparative Advanced Endpoint Protection Test Language: English November 2017 Last Revision: 23 rd March 2018 Commissioned by Bitdefender - 1 - Table of Contents Executive Summary 3 Tested products
Snort 初探. Aphyr Lee
Snort 初探 Aphyr Lee aphyr@www.elites.org 2004.11.20 Outline How to IDSs detect intrusions Snort s Inner Workings Playing by the Rules Conclusion How to IDSs detect intrusions (1/6) Any way they can Specialized
Cisco Advanced Malware Protection against WannaCry
Cisco Advanced Malware Protection against WannaCry "A false sense of security is worse than a true sense of insecurity" Senad Aruc Consulting Systems Engineer Advanced Threats Group Nils Roald Advanced
Overview Intrusion Detection Systems and Practices
Overview Intrusion Detection Systems and Practices Chapter 13 Lecturer: Pei-yih Ting Intrusion Detection Concepts Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy
NIDS: Snort. Group 8. Niccolò Bisagno, Francesco Fiorenza, Giulio Carlo Gialanella, Riccardo Isoli
NIDS: Snort Group 8 Niccolò Bisagno, Francesco Fiorenza, Giulio Carlo Gialanella, Riccardo Isoli 1 Summary NIDS Snort Syn Flood Attack Exploit Kit Detection: Bleeding Life Packet Level Evasion Snort as
THREAT LANDSCAPE AT THE UW
THREAT LANDSCAPE AT THE UW JAMES POLAND, CYBER THREAT ANALYST (jwpoland@uw.edu) AND REBEKAH SKIVER THOMPSON, INCIDENT RESPONSE & THREAT INTELLIGENCE MANAGER (bskiver@uw.edu) OFFICE OF THE CHIEF INFORMATION
Metasploit Unleashed. Class 1: Metasploit Fundamentals. Georgia Weidman Director of Cyberwarface, Reverse Space
Metasploit Unleashed Class 1: Metasploit Fundamentals Georgia Weidman Director of Cyberwarface, Reverse Space Acknowledgments Metasploit Team Offensive Security/Metasploit Unleashed Hackers for Charity
JARGON ALERT! VULNERABILITY SCAN PENETRATION TEST RED TEAM/BLUE TEAM
root@ssh1:~#whoami DIRECTOR OF TECHNOLOGY AND INFORMATION SYSTEMS 20+ YEARS CERTIFIED INFORMATION SYSTEMS SECURITY PROFESSIONAL (CISSP) CERTIFIED GIAC SYSTEM AND NETWORK AUDITOR (GSNA) CERTIFIED GIAC INCIDENT
Incorporating Network Flows in Intrusion Incident Handling and Analysis
Regional Visualization and Analytics Center Incorporating Network Flows in Intrusion Incident Handling and Analysis John Gerth Stanford University gerth@stanford.edu FloCon 2008 1 EE/CS Network Infrastructure
CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker. Upcoming Dates. Course Description. Course Outline
CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker Learn to find security vulnerabilities before the bad guys do! The Certified Ethical Hacker (CEH) class immerses students in an interactive environment
Intrusion Detection - Snort. Network Security Workshop April 2017 Bali Indonesia
Intrusion Detection - Snort Network Security Workshop 25-27 April 2017 Bali Indonesia Issue Date: [31-12-2015] Revision: [V.1] Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied
Practice Labs Ethical Hacker
Practice Labs Ethical Hacker Lab Outline The Ethical Hacker Practice Lab will provide you with the necessary platform to gain hands on skills in security. By completing the lab tasks you will improve your
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
Base64 The Security Killer
Base64 The Security Killer Kevin Fiscus NWN Corporation Session ID: DAS-203 Session Classification: Intermediate A Short (Made Up) Security Story Helix Pharmaceuticals is concerned about security Industrial
All Your Cloud Are Belong to Us
All Your Cloud Are Belong to Us Hunting Compromise in Azure Nate Warfield Microsoft Security Response Center The opinions expressed are my own and do not necessarily reflect those of Microsoft Corporation.
Russian Cyber Attack Warning and Impact on AccessEnforcer UTM Firewall
Russian Cyber Attack Warning and Impact on AccessEnforcer UTM Firewall 1 U.S. and U.K. authorities last week alerted the public to an on-going effort to exploit network infrastructure devices including
Threat Centric Vulnerability Management
Threat Centric Vulnerability Management Q. Which vulnerabilities should I address first? A. Your EXPOSED vulnerabilities AND the ones criminals are using. Agenda Understanding exploited vulnerabilities
CSCI 454/554 Computer and Network Security. Topic 8.4 Firewalls and Intrusion Detection Systems (IDS)
CSCI 454/554 Computer and Network Security Topic 8.4 Firewalls and Intrusion Detection Systems (IDS) Outline Firewalls Filtering firewalls Proxy firewalls Intrusion Detection System (IDS) Rule-based IDS
Advanced Network Troubleshooting Using Wireshark (Hands-on)
Advanced Network Troubleshooting Using Wireshark (Hands-on) Description This course is a continuation of the "Basic Network Troubleshooting Using Wireshark" course, and comes to provide the participants
Massive Attack WannaCry Update and Prevention. Eric Kwok KL.CSE
Massive Attack WannaCry Update and Prevention Eric Kwok KL.CSE Wannacry Q: After patch ms17-010, your computer A: YES / NO won't be infect wannacry ransomware Wannacry Q: In order to against Wannacry attack,
ANATOMY OF AN ATTACK!
ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable
Outline. Internet Security Mechanisms. Basic Terms. Example Attacks
Outline AIT 682: Network and Systems Security Topic 8.4 Firewalls and Intrusion Detection Systems (IDS) Firewalls Filtering firewalls Proxy firewalls Intrusion Detection System (IDS) Rule-based IDS Anomaly
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Topic 8.4 Firewalls and Intrusion Detection Systems (IDS) Instructor: Dr. Kun Sun Firewalls Filtering firewalls Proxy firewalls Outline Intrusion Detection System
Advanced Diploma on Information Security
Course Name: Course Duration: Prerequisites: Course Fee: Advanced Diploma on Information Security 300 Hours; 12 Months (10 Months Training + 2 Months Project Work) Candidate should be HSC Pass & Basic
Overview of Firewalls. CSC 474 Network Security. Outline. Firewalls. Intrusion Detection System (IDS)
CSC 474 Network Security Topic 8.4 Firewalls and Intrusion Detection Systems (IDS) 1 Outline Firewalls Filtering firewalls Proxy firewalls Intrusion Detection System (IDS) Rule-based IDS Anomaly detection
Performance Rules Creation. Part 2: Rules Options and Techniques
Performance Rules Creation Part 2: Rules Options and Techniques What madness today? Learn by reviewing actual VRT published rules Highlight potential issues with certain rule options Break down some common
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS 1 FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN ooding: attacker
FORCEPOINT RESEARCH REPORT JOHN BERGBOM, SENIOR SECURITY ANALYST, FORCEPOINT
DanderSpritz/PeddleCheap Traffic Analysis FORCEPOINT RESEARCH REPORT JOHN BERGBOM, SENIOR SECURITY ANALYST, FORCEPOINT Table of Contents Introduction... 1 Configuration and setup... 1 PeddleCheap and implant
Reconstructing the Scene of the Crime
Reconstructing the Scene of the Crime Who are they? STEVE DAVIS PETER SILBERMAN Security Consultant / Researcher at MANDIANT Engineer / Researcher at MANDIANT Agenda ½ Demo Pop it like its hotttt Problem
Outsmarting Ransomware: Hints and Tricks. Netwrix Corporation Adam Stetson System Engineer
Outsmarting Ransomware: Hints and Tricks Netwrix Corporation Adam Stetson System Engineer How to Ask Questions Type your question here Click Send Agenda Ransomware Trends 9 Hints and Tricks: How to Outsmart
Endpoint Protection : Last line of defense?
Endpoint Protection : Last line of defense? First TC Noumea, New Caledonia 10 Sept 2018 Independent Information Security Advisor OVERVIEW UNDERSTANDING ENDPOINT SECURITY AND THE BIG PICTURE Rapid development
Open Source IDS Rules Comparison Report July 2014
Open Source IDS Rules Comparison Report July 2014 DOCUMENT DETAILS Author Created on Internal Reference Simon Wesseldine 15th July 2014 VERSION CONTROL Version Release Date Overview of Changes 1.0 15th
Security report Usuario de Test
Security report Usuario de Test Servidor Cloud Period: 2018/MAY/13-2018/MAY/20 INDEX SUMMARY 2 Overview 3 Comparison with other users 5 Services and IPs included in this report 6 Traffic 7 Inbound and
hidden vulnerabilities
hidden vulnerabilities industrial networks in 30 minutes Cyber Security introduction Frank Kemeling Certified Ethical Hacker [CEH] EC-Council Certified Security Analyst [ESCA] Licensed Penetration Tester
n Describe sniffing concepts, including active and passive sniffing n Describe sniffing countermeasures n Describe signature analysis within Snort
Outline n Describe sniffing concepts, including active and passive sniffing and protocols susceptible to sniffing n Describe ethical hacking techniques for Layer 2 traffic Chapter #4: n Describe sniffing
Firewall Identification: Banner Grabbing
Honey POt Firewall Identification: Banner Grabbing Banners are messages sent out by network services during the connection to the service. Banners announce which service is running on the system. Banner
Intercepting WannaCry
Intercepting WannaCry Sophos Intercept-X Yannick Escudero Sales Engineer June 2017 Exploit Techniques vs Antivirus How (not) to test endpoint security software https://www.youtube.com/watch?v=aq2bucgqzjg
SMB Analysis OPSEC 2016
SMB Analysis http://blogs.technet.com/b/josebda/archive/2013/10/02/windows-server-2012-r2-which-version-of-the-smb-protocol-smb-1-0 If Malware crafts a packet to negotiate only using LanMan v1, then Unlocked
CORPORATE ESPIONAGE. James McFadyen and Jacolon Walker
CORPORATE ESPIONAGE James McFadyen and Jacolon Walker (jtm) (disable) Outline Part I: Intro Corporate Espionage, Corporate Attitude Part II: Enterprise Security Technology The different technology Part
You can find the lab demo here:
Lab 8: Armitage Aim The aim of this lab is to introduce you to Armitage. Armitage developed by Raphael Mudge provides an open source Graphical User Interface (GUI) front end to Metasploit and supports
Pre processors. Detection Engine
Packet Decoder Pre processors Detection Engine Logging and Alerting System Output Modules Filesystem Syslog Database XML Firewall config You should know how the rules are constructed in order to fully
Nmap & Metasploit. Chun-Jen (James) Chung. Arizona State University
Nmap & Metasploit Chun-Jen (James) Chung Nmap recap Nmap uses raw IP packets in novel ways to determine what hosts are available on the network What services (application name and version) those hosts
Audience. Pre-Requisites
T R A N C H U L A S W O R K S H O P S A N D T R A I N I N G S Hands-On Penetration Testing Training Course About Tranchulas Tranchulas is a multinational information security company having its offices
Network Defenses KAMI VANIEA 1
Network Defenses KAMI VANIEA 26 SEPTEMBER 2017 KAMI VANIEA 1 First the news http://arstech nica.com/secu rity/2015/04/ meet-greatcannon-theman-in-themiddleweapon-chinaused-ongithub/ 2 First the news http://arstechni
Hardening the Education. with NGFW. Narongveth Yutithammanurak Business Development Manager 23 Feb 2012
Hardening the Education IT Environment with NGFW Narongveth Yutithammanurak Business Development Manager 23 Feb 2012 Technology Trends Security Performance Bandwidth Efficiency Manageability Page 2 What
Guide to Computer Forensics. Third Edition. Chapter 11 Chapter 11 Network Forensics
Guide to Computer Forensics and Investigations Third Edition Chapter 11 Chapter 11 Network Forensics Objectives Describe the importance of network forensics Explain standard procedures for performing a
Network Defenses 21 JANUARY KAMI VANIEA 1
Network Defenses KAMI VANIEA 21 JANUARY KAMI VANIEA 1 First, the news The Great Cannon of China https://citizenlab.org/2015/04/chinas-great-cannon/ KAMI VANIEA 2 Today Open System Interconnect (OSI) model
n Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test
Chapter Objectives n Explain penetration testing concepts n Explain vulnerability scanning concepts Chapter #4: Threats, Attacks, and Vulnerabilities Vulnerability Scanning and Penetration Testing 2 Penetration
Process Dump Analyses
Process Dump Analyses 1 Process Dump Analyses Forensical acquisition and analyses of volatile data Tobias Klein tk@trapkit.de Version 1.0, 2006/07/22. Process Dump Analyses 2 1 Overview There is a general
Industrial Control Systems (In)Security & Suricata
Industrial Control Systems (In)Security & Suricata Founded in 2013 Headquartered in Denver, Colorado, U.S. Leadership industry veterans from McAfee, Palo Alto Networks, Symantec More than $70 million in
The Protocols that run the Internet
The Protocols that run the Internet Attack types in the Internet Seminarvortrag Sommersemester 2003 Jens Gerken Content Internet Attacks Introduction Network Service Attacks Distributed Denial of Service
Text Crossing the Streams with State Machines in IDS Signature Languages Michael Rash ShmooCon 2014 FireTalks
Text Crossing the Streams with State Machines in IDS Signature Languages Michael Rash ShmooCon 2014 FireTalks http://www.cipherdyne.org/ @michaelrash flowbits Primer flowbits allows multiple Snort rules
Survey of Cyber Moving Targets. Presented By Sharani Sankaran
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of
Computers Gone Rogue. Abusing Computer Accounts to Gain Control in an Active Directory Environment. Marina Simakov & Itai Grady
Computers Gone Rogue Abusing Computer Accounts to Gain Control in an Active Directory Environment Marina Simakov & Itai Grady Motivation Credentials are a high value target for attackers No need for 0-day
Network+ Guide to Networks, Seventh Edition Chapter 2, Solutions
Network+ Guide to Networks, Seventh Edition Chapter 2, Solutions Review Questions 1. Which part of a MAC address is unique to each manufacturer? A. The network identifier B. The OUI C. The device identifier
Defending Computer Networks Lecture 13: NIDS/HTTP. Stuart Staniford Adjunct Professor of Computer Science
Defending Computer Networks Lecture 13: NIDS/HTTP Stuart Staniford Adjunct Professor of Computer Science Logis;cs No lecture Tuesday Quiz 2 next ;me (Thursday 15 th ) Networking through DDOS Midterm November
NETWORK THREATS DEMAN
SELF-DEFENDING NETWORK NETWORK THREATS DEMAN NEW SECURITY: STRATEGIES TECHNOLOGIES Self-Propagating Threats A combination of: self propagating threats Collaborative applications Interconnected environments
Snort Rules Classification and Interpretation
Snort Rules Classification and Interpretation Pop2 Rules: Class Type Attempted Admin(SID: 1934, 284,285) GEN:SID 1:1934 Message POP2 FOLD overflow attempt Summary This event is generated when an attempt
Defending against Polymorphic Attacks: Recent Results and Open Questions
Defending against Polymorphic Attacks: Recent Results and Open Questions mikepo@ics.forth.gr Institute of Computer Science Foundation for Research and Technology Hellas Crete, Greece TERENA Networking
90% 191 Security Best Practices. Blades. 52 Regulatory Requirements. Compliance Report PCI DSS 2.0. related to this regulation
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on April 16, 2018 15:41 PM O verview 1 90% Compliance About PCI DSS 2.0 PCI-DSS is a legal obligation mandated not by government
Security Principles SNORT - IDS
Security Principles SNORT - IDS Intrusion detection What is intrusion detection? Technically, any method that allows you to discover if someone has penetrated or is attempting intrusion into your network,
A Taste of SANS SEC 560: Adventures in High-Value Pen Testing
All Rights Reserved 1 Network Penetration Testing and Ethical Hacking A Taste of SANS SEC 560: Adventures in High-Value Pen Testing SANS Security 560 Copyright 2015, All Rights Reserved Version 2Q15 All
SCALE 15x (c) 2017 Ty Shipman
Please view my linked-in page (under See more) to get a copy of this presenta
CNIT 121: Computer Forensics. 9 Network Evidence
CNIT 121: Computer Forensics 9 Network Evidence The Case for Network Monitoring Types of Network Monitoring Types of Network Monitoring Event-based alerts Snort, Suricata, SourceFire, RSA NetWitness Require
DDoS: Coordinated Attacks Analysis
DDoS: Coordinated Attacks Analysis This article will cover some concepts about a well-known attack named DDoS (Distributed Denial-of-Service) with some lab demonstrations as a Proof of Concept with countermeasures.
SharkFest 16. Advanced Wireshark Display Filters: How to Zoom in on the 10 Packets You Actually Need Download files from tinyurl.
SharkFest 16 Advanced Wireshark Display Filters: How to Zoom in on the 10 Packets You Actually Need Download files from tinyurl.com/tcptraces Wednesday, June 15, 2016 Betty DuBois, betty@netdetect.co Chief
Meeting 40. CEH Networking
Cyber@UC Meeting 40 CEH Networking If You re New! Join our Slack ucyber.slack.com SIGN IN! Feel free to get involved with one of our committees: Content, Finance, Public Affairs, Outreach, Recruitment
* Knowledge of Adaptive Security Appliance (ASA) firewall, Adaptive Security Device Manager (ASDM).
Contents Introduction Prerequisites Requirements Components Used Background Information Configuration Step 1. Configure Intrusion Policy Step 1.1. Create Intrusion Policy Step 1.2. Modify Intrusion Policy
McAfee Certified Assessment Specialist Network
McAfee MA0-150 McAfee Certified Assessment Specialist Network Version: 4.0 Topic 1, Volume A QUESTION NO: 1 An attacker has compromised a Linux/Unix host and discovers a suspicious file called "password"
REMINDER course evaluations are online
REMINDER course evaluations are online http://web.mit.edu/subjectevaluation please fill them out they provide extremely valuable feedback to all instructors 6.033 Spring 2016 Lecture #23 Combating network
Phishing with Office 365. *Minecraft, also a Microsoft product
Phishing with Office 365 *Minecraft, also a Microsoft product Our users? Keep an eye out for a zombie villager, you might win something! Like this guy, but not this one -> Phishing with O365 Environment
Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
Sachin Shetty Old Dominion University April 10, Cyber Risk Scoring and Mitigation(CRISM)
Sachin Shetty Old Dominion University sshetty@odu.edu April 10, 2019 Cyber Risk Scoring and Mitigation(CRISM) Customer Need - Life in the Security Operation Center Intrusion Detection System alerts Prioritized
Handbook. Step by step practical hacking training
HACKING SCHOOL Handbook Step by step practical hacking training Title: Hacking School - Handbook First English Edition, 2010. ISBN: 978-83-923745-3-4 Copyright 2010 by CSH Press. All rights reserved. The
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
Writing Better Intrusion Prevention Signatures: Lessons from Auto-Signature Generation. By Christopher Jordan, CEO, Endeavor Security, Inc.
Writing Better Intrusion Prevention Signatures: Lessons from Auto-Signature Generation By Christopher Jordan, CEO, Endeavor Security, Inc. Outline Automated Signature Approach Quantifying Quality for Signatures
Who s Really Attacking Your!
Who s Really Attacking Your! #WHOAMI Threat Researcher at Trend Micro- research and blogger on criminal underground, persistent threats, and vulnerabili9es. Research Interests: - Malware detec9on/reversing
SINGLE COURSE. NH9000 Certified Ethical Hacker 104 Total Hours. COURSE TITLE: Certified Ethical Hacker
NH9000 Certified Ethical Hacker 104 Total Hours COURSE TITLE: Certified Ethical Hacker COURSE OVERVIEW: This class will immerse the student into an interactive environment where they will be shown how
IDS: Signature Detection
IDS: Signature Detection Idea: What is bad, is known What is not bad, is good Determines whether a sequence of instructions being executed is known to violate the site security policy Signatures: Descriptions
SOLUTION BRIEF REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING
REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS A WEBSHELL? A WebShell is a piece of code or a script
CSC 5991 Cyber Security Prac1ce
CSC 5991 Cyber Security Prac1ce Fengwei Zhang Wayne State University CSC 5991 Cyber Security Prac1ce 1 Who Am I? Fengwei Zhang Assistant Professor of Computer Science Office: Maccabees Building, Room 14109.3
CIDSS: Common Intrusion Detection Signatures Standard
CIDSS: Common Intrusion Detection Signatures Standard Adam Wierzbicki, Jacek Kaliński and Tomasz Kruszona Polish-Japanese Institute of Information Technology Introduction Intrusion Detection Systems (IDS)