CrowdCasts Monthly: When Pandas Attack
3 likes4,662 views
This document summarizes a CrowdStrike webinar on detecting advanced malware-free intrusions. It describes three speakers from CrowdStrike - Dmitri Alperovitch, Chris Scott, and Adam Meyers. The webinar then discusses how adversaries like China and various state-sponsored and criminal groups are adapting their tactics to evade detection, and how security teams must also adapt detection methods to focus on real-time monitoring rather than indicators of compromise. The webinar includes a case study of detecting a webshell attack in near real-time using CrowdStrike Falcon Host and concludes with a demonstration of its endpoint protection capabilities.
CrowdCasts Monthly: When Pandas Attack
- 1. WHEN PANDAS ATTACK HOW TO DETECT, ATTRIBUTE, AND RESPOND TO MALWARE-FREE INTRUSIONS Dmitri Alperovitch - Chris Scott - Adam Meyers
- 2. TODAY’S SPEAKERS 2014 CrowdStrike, Inc. All rights reserved. 2 @DMITRICYBER @CROWDSTRIKE | #CROWDCASTS DMITRI ALPEROVITCH | CO-FOUNDER & CTO Dmitri Alperovitch is the Co-Founder and CTO of CrowdStrike. A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft. Prior to founding CrowdStrike, Dmitri was a Vice President of Threat Research at McAFee, where he led the company’s global internet threat intelligence analysis and investigations. In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions, and gave thoses incidents their names.
- 3. TODAY’S SPEAKERS 2014 CrowdStrike, Inc. All rights reserved. 3 @NETOPSGURU @CROWDSTRIKE | #CROWDCASTS CHRIS SCOTT | DIRECTOR, SERVICES Christoper Scott has over 15 years of Fortune 500/DoD/DIB business proficiency, including more than 7 years of targeted threat detection and prevention expertise. As a Director at CrowdStrike Services, Christopher supports a variety of engagements that include: security reviews, incident response, data loss prevention, insider threat analysis and engineering threat detection systems, business continuity and disaster recovery processes. In addition, Christopher assists in building risk recognition systems and advancing the CrowdStrike Services practice.
- 4. TODAY’S SPEAKERS 2014 CrowdStrike, Inc. All rights reserved. 4 @ADAM_CYBER @CROWDSTRIKE | #CROWDCASTS ADAM MEYERS | VP, INTELLIGENCE Adam Meyers has over a decade of experience within the information security industry. He has authored numerous papers that have appeared at peer reviewed industry venues and has received awards for his dedication to the field. At CrowdStrike, Adam serves as the VP of Intelligence. Within this role it is Adam’s responsibility to oversee all of CrowdStrike’s intelligence gathering and cyber-adversarial monitoring activities. Adam’s Global Intelligence Team supports both the Product and Services divisions at CrowdStrike and Adam manages these endeavors and expectations.
- 5. @CROWDSTRIKE | #CROWDCASTS ADVANCED ATTACKERS EVADE IOC-BASED DETECTION HOW CAN YOU FIND AN ATTACK WHEN THERE IS NO MALWARE, NO COMMAND AND CONTROL, AND NO FILE-BASED ARTIFACTS? 2014 CrowdStrike, Inc. All rights reserved. 5
- 6. REAL-WORLD CASE STUDIES 2014 CrowdStrike, Inc. All rights reserved. 6
- 7. @CROWDSTRIKE | #CROWDCASTS 2014 CrowdStrike, Inc. All rights reserved. 7 LET’S DIVE IN… WHO’S BEHIND THE ATTACK?
- 8. UNCOVER THE ADVERSARY @CROWDSTRIKE | #CROWDCASTS RUSSIA Energetic Bear: Oil and Gas Companies HACTIVIST/TERRORIST 2014 CrowdStrike, Inc. All rights reserved. 8 CHINA Comment Panda: Commercial, Government, Non-profit Deep Panda: Financial, Technology, Non-profit Foxy Panda: Technology & Communications Anchor Panda: Government organizations, Defense & Aerospace, Industrial Engineering, NGOs Impersonating Panda: Financial Sector Karma Panda: Dissident groups Keyhole Panda: Electronics & Communications Poisonous Panda: Energy Technology, G20, NGOs, Dissident Groups Putter Panda: Governmental & Military Toxic Panda: Dissident Groups Union Panda: Industrial companies Vixen Panda: Government IRAN INDIA Viceroy Tiger: Government, Legal, Financial, Media, Telecom NORTH KOREA Silent Chollima: Government, Military, Financial Magic Kitten: Dissidents Cutting Kitten: Energy Companies CRIMINAL Singing Spider: Commercial, Financial Union Spider: Manufacturing Andromeda Spider: Numerous Deadeye Jackal: Commercial, Financial, Media, Social Networking Ghost Jackal: Commercial, Energy, Financial Corsair Jackal: Commercial, Technology, Financial, Energy Extreme Jackal: Military, Government
- 9. PARCEL ISLANDS Disputed Territory • 16°40′N 112°20′E • Claimed by: – Vietnam (Hoàng Sa Archipelago) – Peoples Republic of China (Xisha Islands) – Taiwan • Originally occupied by French in 1938, the islands were taken by Japan and then China post World War II • In 1974 armed conflict saw the occupation of the islands by victorious PLA forces over ARVN. Unified Socialist Vietnam renewed claims 2014 CrowdStrike, Inc. All rights reserved. 9
- 10. HAIYANG SHIYOU 981 May 2, 2014 • Owned by: CNOOC Group – Displacement: 30,670 tons – Length: 114 meters – Beam: 90 meters – Speed: 8 knots – Crew: 160 • Mission: Evaluate potential for Oil Reserves • In theater 2 May – 16 Jul 2014 CrowdStrike, Inc. All rights reserved. 10
- 11. CHINESE INTRUSION ACTIVITY May/June 2014 CrowdStrike, Inc. All rights reserved. 11 CHINESE INTRUSION ACTIVITY Increasing activity as conflict escalates
- 12. Increasing tensions and intrigue 2014 CrowdStrike, Inc. All rights reserved. 12 HD981 OPERATIONS MAY - JULY 2 May HD981 deployed near Parcel Islands 26 May Vietnamese fishing boat sinks after confrontation with Chinese vessels June tensions continue to rise as HD981 moves closer to Parcel Islands and conducts drilling 16 July HD981 leaves the Parcel Islands in advance of typhoon season and to ‘review data’ from drilling operations
- 13. Mid June 2014 • Sunni extremists from the ISIS begin advance on key Iraqi industrial city Baiji • 12 June, ISIS vehicles and personnel burn down courthouse and police station, and release prisoners from jail • 18 June ISIS insurgents begin attacking Baiji refinery the largest in Iraq, this has the capability to refine over 300,000 barrels of oil per day 2014 CrowdStrike, Inc. All rights reserved. 13 ISLAMIC STATE OF IRAQ AND SYRIA (ISIS) Baiji
- 14. Top Oil Imports 2014 CrowdStrike, Inc. All rights reserved. 14 CHINA OIL AT RISK
- 15. 2014 CrowdStrike, Inc. All rights reserved. 15 WHAT HAPPENED? THIS IS A STORY OF THE INCIDENT… @CROWDSTRIKE | #CROWDCASTS
- 16. 2014 CrowdStrike, Inc. All rights reserved. 16 CASE STUDY: WEBSHELL ATTACK • Suspicious Logins Detected within Environment • Falcon Host Deployed to the Network with CSOC Monitoring – Deployment Time is now Hours not Days – The Cloud Allows Rapid Deployment and Increased Visibility • Not Dependent on Hardware • No Infrastructure to Standup • Visibility on Adversary Actions – Webshell Deployments and Usage – Usage of Sticky Keys – Usage of PowerShell with Custom Encryption
- 17. 2014 CrowdStrike, Inc. All rights reserved. 17 CASE STUDY: WEBSHELL ATTACK • Watching the Adversary Change TTPs in Real-time – Uploading New Tools, Monitoring for Logons • Security Teams able to Respond within Minutes – Removal of Infected Machines – Memory Capture with Attacker Tools Running • Reduction in Incident Response Timing – Remediate Quicker – Reduce the Need for Deep Dive Forensics – Reduce the Cost of Incident Response • Continued Visibility Going Forward – Detections Allowing Security Teams to Prevent Attacker Foothold
- 18. @CROWDSTRIKE | #CROWDCASTS 2014 CrowdStrike, Inc. All rights reserved. 18 ADVERSARIES ADJUSTING TTPS Changes to Persistence • Moving from Workstations back to Servers • Reducing Footprint Forensic Evidence Reduction • Utilizing Memory for Execution, Compression, Exfiltration • Automated Cleanup Processes Simplified Toolsets and Communication Webshells • Compiled on the Fly, Direct to Memory • Utilize SSL Certificates on External Accessible Sites • Utilize Custom Encryption within Microsoft PowerShell
- 19. 2014 CrowdStrike, Inc. All rights reserved. 19 SECURITY TEAMS MUST ADJUST @CROWDSTRIKE | #CROWDCASTS New Detection Methods • Must be Realtime or Near-Realtime, Sweeping for IOCs is a Losing Proposition • Must Detect Credential Theft as it Happens • Must Capture Adversaries Commands as Forensics are Being Reduced Benefits of Detection Methods • Able to Respond Quicker • Reduce Exposure and Loss • Allow Security Teams to Adjust to Adversary TTPs on the Fly • Increasing Costs to the Adversary
- 20. 2014 CrowdStrike, Inc. All rights reserved. 20 NOW WHAT? HOW DID WE DETECT AND ATTRIBUTE THIS MALWARE-FREE INTRUSION? @CROWDSTRIKE | #CROWDCASTS
- 21. TECHNOLOGY COMPONENTS FALCON HOST CORE COMPONENTS 2014 CrowdStrike, Inc. All rights reserved. 21 FALCON HOST TECH OVERVIEW CLOUD-BASED APPLICATION HOST-BASED DETECTION SENSOR DETECT: STATEFUL EXECUTION INSPECTION RECORD: ENDPOINT ACTIVITY MONITORING INTELLIGENCE: ATTRIBUTION ENGINE
- 22. REAL-TIME STATEFUL EXECUTION INSPECTION Email Received Process Silently Executed Executable Hides Itself From Task Manager Executable Call Out to the Internet Email Attachment Opened in Acrobat Reader Executable Saved in Windows/System32 Folder Executable Modifies Windows Registry to Autostart 1 2 3 4 5 6 7 2014 CrowdStrike, Inc. All rights reserved. 22
- 23. 2014 CrowdStrike, Inc. All rights reserved. 23 LET’S TAKE A LOOK… ENDPOINT PROTECTION DEMO @CROWDSTRIKE | #CROWDCASTS
- 24. Q&A @CROWDSTRIKE | #CROWDCASTS Please enter all questions in the Q&A panel of GoToWebinar For information on the CrowdStrike Falcon Platform or CrowdStrike Services, contact sales@crowdstrike.com Q&A 2014 CrowdStrike, Inc. All rights reserved. 24