Fight Back Against Java Exploits, Spear-Phishing, Watering Hole Attacks, Drive-by Downloads, Scare-ware, Ransomware, Social Networking Worms…ah…. CHADD MILTON

Riddle Me This… Hint: Aka – FRAN or STAN

11, 12 and 13 (so far) bloodiest years on record… White House eCard (spear-phishing) HBGary Federal (social engineering) Night Dragon (spear-phishing) London Stock Exchange Website (watering-hole) French Finance Ministry (spear-phishing) Dupont, J&J, GE (spear-phishing) Charlieware (poisoned SEO) Nasdaq (spear-phishing) Office of Australian Prime Minister (spear-phishing) RSA (spear-phishing) Epsilon (spear-phishing) Barracuda Networks (spear-phishing) Oak Ridge National Labs (spear-phishing) Lockheed Martin (spear-phishing) Northrup Grumman (spear-phishing) Gannet Military Publications (spear-phishing) PNNL (spear-phishing) ShadyRAT (spear-phishing) DIB and IC campaign (spear-phishing) Voho campaign (watering-holes and spear-phishing) Mirage campaign (spear-phishing) Elderwood campaign (spear-phishing) White House Military Office (spear-phishing) Telvent compromise (spear-phishing) Council on Foreign Relations (watering hole) Capstone Turbine (watering hole) RedOctober (spear-phishing) Speedtest.net (watering-hole/drive-by) DoE (spear-phishing) Federal Reserve (spear-phishing) Bit9 (TBD) NYT, WSJ, WaPO (spear-phishing) Apple, Microsoft, Facebook (watering-hole) National Journal (watering hole) FemmeCorp (watering holes) South Korea (spear-phishing) 11 Energy Firms (spear-phishing) Cannot keep this slide up to date… A Problem of Pandemic Proportions

Competitive Futures Are at Stake Theirs Ours The good news is…theyre stealing petabytes worth of data… The bad news is…in time, theyll have sorted through it all

The Primary Target – The Unwitting Accomplices The User The #1 Attack Vector = Ubiquitous usage of Internet and has enabled adversaries to shift tactics Prey on human psychology Spear Phishing – The New Black Drive by Downloads Malicious sites Weaponized Attachments Watering Hole Attacks Hijacked trusted sites Trust in social networks Facebook, Twitter, LinkedIn Faith in Internet search engines Poisoned SEO User Initiated Infections Fake A/V and fear mongering

Alarming Malware Statistics 280 million malicious programs detected in April 2012* 80,000+ new malware variants daily ** 134 million web-borne infections detected (48% of all threats) in April 2012* 24 million malicious URLs detected in April 2012* 30,000+ new malicious URLs daily** 95% of APTs involve spear- phishing*** Organizations witnessing an average of 643 malicious URL events per week*** 225% increase from 2012** * Kaspersky April 2012 Threat Report ** Panda Labs Q Internet Threat Report *** FireEye September 2012 Advanced Threats Report ****Both Mandiant and Trend Micro – 2013 Reports

KIA – Mandiant APT-2 Spear-Phish or /02/mandiant-report-spear- phishing-campaign-kia-with- invincea-cve /

Java - Getting Bullied…

Enterprise Security Architecture for Addressing APT Firewalls/Web Proxies Network Controls Anti-Virus Forensics and IR User Training In Use | Confidence* 84% 66% 34% 92% 64% 31% 55% 52% 17% 40% App Whitelisting 22% 49% *Invincea APT Survey Q4 2012

Einsteins Definition of Insanity Patching software as vulnerabilities are made public Detecting intruders and infected systems after the fact Recovering and restoring the infected machines back to a clean state Security Insanity Cycle

Addressing the Critical Vulnerability in Java 7 Uninstall Java…

Addressing the Critical Vulnerability in IE Stop Using IE…

Addressing the Pandemic of Spear-Phishing Dont Click on Links You Dont Trust…

An Alternative to Bad Advice Not quite…but pretty darn close…

Rethink Security If…you could negate user error And…contain malware in a virtual environment And…stop zero-days in their tracks without signatures Then…preventing APTs would be possible Making Prevention Possible Again

Solve the User Problem Protect the User SOC Server Appliance Enterprise Endpoint Application & Data Collection

Contain the Contaminants Prevention Pre-Breach Forensics Protect every user and the network from their error Feed actionable forensic intelligence without the breach Detection Detect zero-day attacks without signatures

Mapping the APT Kill Chain Stage 1: Reconnaissance Research the target Stage 2: Attack Delivery Spearphish with URL links and/or attachment Stage 5: Internal Recon Scan network for targets Stage 3: Client Exploit & Compromise Vulnerability exploited or user tricked into running executable Stage 8: Stage Data & Exfil Archive/encrypt, leak to drop sites Stage 4: C2 Remote Command & Control. Stage 6: Lateral Movement Colonize network Stage 7: Establish Persistence Root presence to re-infect as machines are remediated Stage 9: Incident Response Analysis, remediation, public relations, damage control

Invincea – Breaking the APT Workflow Containment | Detection | Prevention | Intelligence Highly targeted apps run in contained environment Behavioral based detection spots all malware including 0-days Automatic kill and remediation to clean state Forensic intelligence on thwarted attacks fed to broader infrastructure Threat Data Server

Real World Results 0days K.I.A.

KIA – Speedtest.net Drive-by Java 7 CVE Drive-by Download/Watering Hole Attack Thwarted by Invincea Exploit running for days on Speedtest.net website (boasts 4 BILLION+ visits) Whitelisted or blacklisted website? More than likely whitelisted Increasingly common poisoning tactic from adversaries Detected without signatures, immediately killed and forensically analyzed by Invincea or - popular-site-speedtest-net- compromised-by-exploitdrive-by- stopped-by-invincea/

KIA – Adobe Flash CVE Weaponized Office Document (Word) Used to Spread Adobe 0day (CVE ) Spoofed document looking like IEEE as the author (community of interest being targeted) No protection from anti-virus given 0day nature Increasingly common poisoning tactic from adversaries Detected without signatures, immediately killed and forensically analyzed by Invincea or - exploit-down-analysis-and- protection-against-adobe-flash- exploit-cve /

KIA – National Journal Website Drive-by Download/Watering Hole Attack Thwarted by Invincea Exploit running on National Journal website days AFTER initial disclosure (secondary attack?) Whitelisted or blacklisted website? More than likely whitelisted Running Fiesta/ZeroAccess Exploit Kit – attacking 2 Java vulnerabilities Detected without signatures, immediately killed and forensically analyzed by Invincea or - kia-nationaljournal-com-pushing- malware-through-fiesta-ek-killed- with-invincea/

Chadd Milton: Go ahead…spear-phish me! Want a t-shirt? Drop a note to – only one catch, youve got to tweet a pic of you wearing Lets Get Moving