1. Update your Software or Die! Wolfgang Kandek Qualys, Inc. RMISC 2012 Denver - May 18, 2012

2. Advanced Persistent Threat(APT)

3. Or Mass Malware Attacks

9. Attack Example #1

10. ExploitKits

11. CVE-2006-0003 (MDAC)

12. ExploitKits CVE-2006-0003 (MDAC)… CVE-2011-3544 (Rhino)

13. Website

14. ExploitKit Server

15. Website ExploitKit Server C&C Server

16. Website ExploitKit Server C&C Server Has Traffic Was exploited to plant links

17. Website ExploitKit Server C&C Server Serves Exploits Browser/ Plug-in vulnerabilities Has Traffic Was exploited to plant links

18. Controls malware Website ExploitKit Server C&C Server Serves Exploits Browser/ Plug-in vulnerabilities Has Traffic Was exploited to plant links

19. Live Demo

23. Patching

26. CVE-2011-3544 Java Rhino CVE-2011-2140 Flash 10 CVE-2011-2100 Adobe Reader CVE-2011-0611 Flash 10 CVE-2010-3971 IE8 …

28. Patching Apps

29. Patching Apps and Browser

30. Patching Apps and Browser and OS

31. Attack Example #2

32. CVE-2011-0611

33. Flash 0-day

34. Attack Vector E-Mail

35. Live Demo planned- Similar to slides that follow

37. The Attachment

40. Flash 0-day running

41. The Embedded Attachment

43. The Malware

44. Poison Ivy  mincesur.com

46. DEP Data Execution Prevention XP SP2 forward

47. Live Demo

49. Attack Example #3

50. Java Applet Attack Pentest Special

55. Uninstall Java

56. Restrict Java

57. Internet Explorer

58. 1C00 to 0 In Zone 3

60. Google Chrome

62. Mozilla Firefox

64. Mac OS X

66. Made it now simpler

67. Mac OS X Made it now simpler Java 1.6U31 will autodisable if Not used in 35 days

68. Restrict Java IE – trusted sites

69. Attack Example #4

70. CVE-2011-2462

71. Adobe Reader 0-day

77. No JavaScript in Adobe Reader

78. Live Demo

80. Counter-measures

81. Latest Patches DEP Restrict Java JavaScript in Adobe Reader

82. Non-admin User

84. Flash 0-day Adobe Reader 0-day

85. Microsoft Office 2010 Protected View Sandbox

88. Flash 0-day

89. Autorun off

90. NoDriveTypeAutoRun -> FF

91. MSFT SIR: Malware propagation

92. Latest Software

93. Win 7 > XP

94. Office 2010 > 2007

95. Adobe Reader X > 9

96. IE9 > 8,7,6

97. How to apply what you have seen  Configure for Safety  Force DEP On  Whitelist Java on the Internet  No Javascript in Adobe Reader  Non Admin User  Autorun off

99. How to apply what you have seen  Run latest software  Office 2010  Adobe Reader X  Be fully patched  Applications  OS

100. Questions? 100

101. Thank you. wkandek@qualys.com @wkandek http://laws.qualys.com

102. Bonus Slides

103. No Javascript in Adobe Reader

104. 1C00 -> 0 in Zone 3