Advanced Persistent Threats (APT)

1. Advanced Persistent Threats(APT) Sasha Browning

2. Breakdown • Advanced • Combination of attack methods and tools • Persistent • Continuous monitoring and interaction • “Low-and-slow” approach • Threat • Attacker is skilled, motivated, organized and well funded

3. What is an APT? • Definition • Sophisticated attack that tries to accessand stealinformation from computers • Requirement • Remain invisible for as long as possible

4. Why are APTs Important? • Then • Just because • Demonstrate their skills • Now • Attacks have evolved • Specific targets • Intend to maintain a long term presence

5. Problem with APTs • File size is small • File names don’t raise any red flags • Almost always are successful • Undetectable until it's too late • More frequent • No one is immune

6. Targets • .mil and .govsites • Department of Defense contractors • Infrastructure companies • power and water • CEOs or leaders of powerful enterprise or gov. agencies

7. Stages of an APT Attack • Reconnaissance • Intrusioninto the network • Establishing a backdoor • Obtaining user credentials • Installing multiple utilities • Data exfiltration • Maintaining persistence

8. Step 1: Reconnaissance • Research and identify targets • Using public search or other methods • Obtain email addresses or IM handles

9. Step 2: Intrusion into the Network • Spear-phishing emails • Target specific people • Spoofed emails • include malicious links or attachments • Infect the employee's machine • Gives the attacker a foot in the door

10. Step 3: Establishing a Backdoor • Try to obtain domainadmin credentials • grab password hashes from network DCs • Decrypt credentials to gain elevated user privileges • Move within the network • Installbackdoors here and there • Typically install malware

11. Step 4: Obtaining User Credentials • Use valid user credentials • Average of 40 systems accessed using these credentials • Most common type of credentials: • Domain admin

12. Step 5: Installing Multiple Utilities • Utility programs conduct system admin. • Installing backdoors • grabbing passwords • getting emails • Typically found on systems without backdoors

13. Step 6: Data Exfiltration • Grab emails, attachments, and files • Funnel the stolen data to staging servers • Encrypt and compress • Delete the compressed

14. Step 7: Maintaining Persistence • Use any and all methods • Revamp malware if needed

15. Problems with APTs • Self-destructingmalware • Erases if it fails to reach its destination • Nobody monitors outbound traffic • Can look legitimate • Sniffers • Dynamically create credentials to mimic communication

16. Disguising Activity • Process injections • introduce malicious code into a trusted process • Conceals malicious activity • Stub malware • Code with only minimal functionality • Remotely add new capabilities • Runs in the network’s virtual memory

17. Stopping APTs • Weakness • Interactive access • Solution • Find the link between you and the attacker • Block it • Afterwards • Attacker will have to re-infectanew host

18. Summary • Targets are carefully selected • Persistent • Will not leave • Changes strategy/attack • Control focused • Not financially driven • Crucial information • It's automated, but on a small scale • Targets a few people

19. Questions

20. Sources • Wired http://www.wired.com/threatlevel/2010/02/apt-hacks/ • Dark Reading http://www.securityweek.com/anatomy-advanced-persistent-threat • Damballa http://www.damballa.com/knowledge/advanced-persistent-threats.php