SlideShare a Scribd company logo
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




                     Client-Side Security
                                    K. K. Mookhey
                            kkmookhey@niiconsulting.com




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




• Introduction

• Real-world case study
   •   The drop
   •   Malware analysis
   •   Delivery mechanisms


• Lessons learnt




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




 File name
 Loop Mobile Bill Statement Date 08.11.2011.pdf
 Services.doc     The injection attempt
 The Most wanted terrorist by Delhi police.doc




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




                                      Strings




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




                What heritage are they
                     protecting?
                                     Let’s find out




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                      The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                          http://www.owasp.org
http://www.owasp.in
./win7
./win7/exploit.html
./win7/Exploit.jar
./win7/Exploit.class
./moneytime
./moneytime/abc
./moneytime/abc/dsfd.pdf
./moneytime/report.php
./moneytime/aaaa
./moneytime/aaaa/decr.exe
./moneytime/Aminer
./moneytime/Aminer/Utility_installation_step_by_step.doc
./moneytime/Aminer/aMiner2.0.iso
./moneytime/Aminer/aMiner_Installation_Step_by_Step.doc
./moneytime/Aminer/utilities.iso
./moneytime/email list.txt
./moneytime/WinXpcr.py
./moneytime/main.png
./moneytime/demor
./moneytime/demor/application.doc
./moneytime/Appin
./moneytime/Appin/appin.doc
./moneytime/Appin/appin1.pdf
./moneytime/key
./moneytime/key/conhost.exe
./moneytime/key/smse.exe
                     OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




     WHAT IS AMINER.EXE?




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in

 ./chirag/drop/KAMAL0024BEBE0A80/KeyLog.txt
 ./chirag/drop/KAMAL0024BEBE0A80/ip.txt
 ./chirag/drop/INDIA00012E2598D3
 ./chirag/drop/INDIA00012E2598D3/KeyLog.txt
 ./chirag/drop/INDIA00012E2598D3/ip.txt
 ./chirag/drop/BLUE-INTRA-VM000C29D666CE
 ./chirag/drop/BLUE-INTRA-VM000C29D666CE/123.php                       Who is
 ./chirag/drop/GAMCA300248CC9EE30
 ./chirag/drop/GAMCA300248CC9EE30/KeyLog.txt                           Chirag?
 ./chirag/drop/GAMCA300248CC9EE30/ip.txt
 ./chirag/drop/ADMIN-PC005056C00008
 ./chirag/drop/ADMIN-PC005056C00008/KeyLog.txt
 ./chirag/drop/ADMIN-PC005056C00008/ip.txt
 ./chirag/drop/SABI-D00241D9A5C01
 ./chirag/drop/SABI-D00241D9A5C01/KeyLog.txt
 ./chirag/drop/SABI-D00241D9A5C01/ip.txt
 ./chirag/drop/DESIGN20CF309A9453
 ./chirag/drop/DESIGN20CF309A9453/KeyLog.txt
 ./chirag/drop/DESIGN20CF309A9453/ip.txt
 ./chirag/drop/KAMALC0F8DA7AF26C
 ./chirag/drop/KAMALC0F8DA7AF26C/KeyLog.txt
 ./chirag/drop/KAMALC0F8DA7AF26C/ip.txt
               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




         Typical Delivery Mechanisms




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




                                 Scenario 2
                  Un-authorized usage of USB Drives
                     We inserted USB drives on 8 systems
                          2 systems had USB blocked
              Only 1 person objected to us inserting the USB drive




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




                                    Phishing




               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
OWASP InfoSec India Conference 2012
August 24th – 25th, 2012                                 The OWASP Foundation
Hotel Crowne Plaza, Gurgaon                                     http://www.owasp.org
http://www.owasp.in




• APTs are real and here to stay
• It does not take a genius to evade AV
• We need newer solutions – and quick!
• Your end-point defences should be as strong or even
  stronger than the perimeter defences
• In the meanwhile…
    •   Patch all your end-point software
    •   Watch your AV status like a hawk
    •   Constantly propagate security news to your end-users
And
• Be careful, which security vendors you hire!


               OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)

More Related Content

PDF
Fanzine 7 taller 7 no. 7 enpeg comic
PPTX
Curtas.gal
PDF
Gerard Genette Figuras v
DOC
Sinus And Other Troubles Dr. Shriniwas Kashalikar
PDF
Xuño
DOCX
Pour décrire au passé
PDF
International approaches to critical information infrastructure protection ...
PDF
Agosto
Fanzine 7 taller 7 no. 7 enpeg comic
Curtas.gal
Gerard Genette Figuras v
Sinus And Other Troubles Dr. Shriniwas Kashalikar
Xuño
Pour décrire au passé
International approaches to critical information infrastructure protection ...
Agosto

Viewers also liked (12)

PPTX
Eca 14 (1)
PDF
Co-Working Presentation April 2016
PPTX
Φθινόπωρο στα Τρίκαλα
PPTX
Evaluación del aprendizaje leyva barajas
PDF
Ita b2 ms 02 12-15
DOCX
PPS
La casa de los simpsons
PPTX
Herdeiros da Crus
PPT
Nmr Spwla Carbonates
PPTX
30 días de bilingüismo: Episodio 1
PPTX
Juegos de Logica de Ingenio
PPTX
Formation Damage Test.
Eca 14 (1)
Co-Working Presentation April 2016
Φθινόπωρο στα Τρίκαλα
Evaluación del aprendizaje leyva barajas
Ita b2 ms 02 12-15
La casa de los simpsons
Herdeiros da Crus
Nmr Spwla Carbonates
30 días de bilingüismo: Episodio 1
Juegos de Logica de Ingenio
Formation Damage Test.
Ad

Similar to Getting the end point security right! - k. k. mookhey (15)

PDF
The magic of passive web vulnerability analysis lava kumar
PDF
Public exploit held private – penetration testing the researcher’s way tama...
PDF
Real time evaluation of national network exposure to emerging threats - fyodo...
PPTX
Public exploit held private : Penetration Testing the researcher’s way
PPSX
Pinkstar Events Agency [Delhi] Credentials 2016
PDF
Maral overseas pvt ltd,industry visit report by pooja
PDF
Best Event Management Company in Dhaka | Top Event Management Company in Bang...
PPS
Promotion & branding
PDF
2nd Annual Power & Transmission Summit 2015
PDF
Mobile Trends and Innovations
PPTX
Serge Ferrari - India projects
PPT
eScan National marketing
PPTX
Agile Kolkata 2022 - Prashant M J | How to Plan your Agile Career
PDF
Newsletter of the November-December 2017
PDF
District Cooling & Tri-Generation Summit 2014
The magic of passive web vulnerability analysis lava kumar
Public exploit held private – penetration testing the researcher’s way tama...
Real time evaluation of national network exposure to emerging threats - fyodo...
Public exploit held private : Penetration Testing the researcher’s way
Pinkstar Events Agency [Delhi] Credentials 2016
Maral overseas pvt ltd,industry visit report by pooja
Best Event Management Company in Dhaka | Top Event Management Company in Bang...
Promotion & branding
2nd Annual Power & Transmission Summit 2015
Mobile Trends and Innovations
Serge Ferrari - India projects
eScan National marketing
Agile Kolkata 2022 - Prashant M J | How to Plan your Agile Career
Newsletter of the November-December 2017
District Cooling & Tri-Generation Summit 2014
Ad

Recently uploaded (20)

PDF
Getting Started with Data Integration: FME Form 101
PPTX
Spectroscopy.pptx food analysis technology
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
PDF
Electronic commerce courselecture one. Pdf
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
PDF
MIND Revenue Release Quarter 2 2025 Press Release
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
PPTX
Big Data Technologies - Introduction.pptx
PDF
Network Security Unit 5.pdf for BCA BBA.
PPTX
Group 1 Presentation -Planning and Decision Making .pptx
PDF
cuic standard and advanced reporting.pdf
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
PPTX
Tartificialntelligence_presentation.pptx
PPTX
1. Introduction to Computer Programming.pptx
PPTX
A Presentation on Artificial Intelligence
PDF
gpt5_lecture_notes_comprehensive_20250812015547.pdf
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Getting Started with Data Integration: FME Form 101
Spectroscopy.pptx food analysis technology
Accuracy of neural networks in brain wave diagnosis of schizophrenia
Electronic commerce courselecture one. Pdf
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
Digital-Transformation-Roadmap-for-Companies.pptx
Reach Out and Touch Someone: Haptics and Empathic Computing
MIND Revenue Release Quarter 2 2025 Press Release
Per capita expenditure prediction using model stacking based on satellite ima...
Building Integrated photovoltaic BIPV_UPV.pdf
Big Data Technologies - Introduction.pptx
Network Security Unit 5.pdf for BCA BBA.
Group 1 Presentation -Planning and Decision Making .pptx
cuic standard and advanced reporting.pdf
Advanced methodologies resolving dimensionality complications for autism neur...
Tartificialntelligence_presentation.pptx
1. Introduction to Computer Programming.pptx
A Presentation on Artificial Intelligence
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Build a system with the filesystem maintained by OSTree @ COSCUP 2025

Getting the end point security right! - k. k. mookhey

  • 1. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in Client-Side Security K. K. Mookhey kkmookhey@niiconsulting.com OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 2. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in • Introduction • Real-world case study • The drop • Malware analysis • Delivery mechanisms • Lessons learnt OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 3. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 4. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in File name Loop Mobile Bill Statement Date 08.11.2011.pdf Services.doc The injection attempt The Most wanted terrorist by Delhi police.doc OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 5. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 6. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 7. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 8. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 9. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in Strings OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 10. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 11. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 12. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 13. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 14. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 15. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in What heritage are they protecting? Let’s find out OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 16. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in ./win7 ./win7/exploit.html ./win7/Exploit.jar ./win7/Exploit.class ./moneytime ./moneytime/abc ./moneytime/abc/dsfd.pdf ./moneytime/report.php ./moneytime/aaaa ./moneytime/aaaa/decr.exe ./moneytime/Aminer ./moneytime/Aminer/Utility_installation_step_by_step.doc ./moneytime/Aminer/aMiner2.0.iso ./moneytime/Aminer/aMiner_Installation_Step_by_Step.doc ./moneytime/Aminer/utilities.iso ./moneytime/email list.txt ./moneytime/WinXpcr.py ./moneytime/main.png ./moneytime/demor ./moneytime/demor/application.doc ./moneytime/Appin ./moneytime/Appin/appin.doc ./moneytime/Appin/appin1.pdf ./moneytime/key ./moneytime/key/conhost.exe ./moneytime/key/smse.exe OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 17. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 18. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 19. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 20. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in WHAT IS AMINER.EXE? OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 21. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in ./chirag/drop/KAMAL0024BEBE0A80/KeyLog.txt ./chirag/drop/KAMAL0024BEBE0A80/ip.txt ./chirag/drop/INDIA00012E2598D3 ./chirag/drop/INDIA00012E2598D3/KeyLog.txt ./chirag/drop/INDIA00012E2598D3/ip.txt ./chirag/drop/BLUE-INTRA-VM000C29D666CE ./chirag/drop/BLUE-INTRA-VM000C29D666CE/123.php Who is ./chirag/drop/GAMCA300248CC9EE30 ./chirag/drop/GAMCA300248CC9EE30/KeyLog.txt Chirag? ./chirag/drop/GAMCA300248CC9EE30/ip.txt ./chirag/drop/ADMIN-PC005056C00008 ./chirag/drop/ADMIN-PC005056C00008/KeyLog.txt ./chirag/drop/ADMIN-PC005056C00008/ip.txt ./chirag/drop/SABI-D00241D9A5C01 ./chirag/drop/SABI-D00241D9A5C01/KeyLog.txt ./chirag/drop/SABI-D00241D9A5C01/ip.txt ./chirag/drop/DESIGN20CF309A9453 ./chirag/drop/DESIGN20CF309A9453/KeyLog.txt ./chirag/drop/DESIGN20CF309A9453/ip.txt ./chirag/drop/KAMALC0F8DA7AF26C ./chirag/drop/KAMALC0F8DA7AF26C/KeyLog.txt ./chirag/drop/KAMALC0F8DA7AF26C/ip.txt OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 22. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 23. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 24. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in Typical Delivery Mechanisms OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 25. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in Scenario 2 Un-authorized usage of USB Drives We inserted USB drives on 8 systems 2 systems had USB blocked Only 1 person objected to us inserting the USB drive OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 26. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in Phishing OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)
  • 27. OWASP InfoSec India Conference 2012 August 24th – 25th, 2012 The OWASP Foundation Hotel Crowne Plaza, Gurgaon http://www.owasp.org http://www.owasp.in • APTs are real and here to stay • It does not take a genius to evade AV • We need newer solutions – and quick! • Your end-point defences should be as strong or even stronger than the perimeter defences • In the meanwhile… • Patch all your end-point software • Watch your AV status like a hawk • Constantly propagate security news to your end-users And • Be careful, which security vendors you hire! OWASP InfoSec India Conference 2012. Hotel Crowne Plaza, Gurgaon (India)