Advanced Persistent Response - CanSecWest

Advanced Persistent Response P l Peleus Uhl Uhley | Pl Platform tf S Security it St Strategist t i t

© 2012 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential.

Outline 

Background



Analyzing threat



Finding resources



Planning a response



Tool release



Conclusion


2

Advanced Persistent Threat

“usually refers to a group with both the p y and the intent to p persistently y and capability effectively target a specific entity” - Wikipedia


3

Flash Player 0-days

4 SWF in PDF attacks 4 SWF in Office document attacks 3 XSS attacks


4

Flash Player 0-days – Alternative measurement


5

Advanced Persistent Response

The strategy necessary to inhibit or reduce a y or entities’ capabilities p to malicious entity repeatedly conduct attacks leveraging a p p platform or against g a specific p target. g specific


6

Information Gathering


7

Know your adversary 

Who are they?



Why are they upset?



Does it change over time?


8

CVE-2011-0609


9

CVE-2011-0611


10

yuange1975


11

Beware of false positives


12

Technical Analysis 

Their sources?



Their targets?



Their skill?


13

Data Source Analysis 

Series of attacks based on SWFs from flashandmath.com



Indicates the areas of code that are being attacked



Learn from mimicking their approach


14

Targets 

Reports from government customers



Document based spear Document-based phishing attacks



Most exploits are never widely deployed


15

Payload Analysis 

Symantec studied payloads from 2006 -> 2011



Attacks grouped based on the malware installed (Sykipot)



L Large command d & control t l botnet b t t



Mostly used zero-day attacks within several different products to install


16

Sykipot

“Thus, the Sykipot attackers are likely to be an g and skilled g group p of individuals. organized Given their persistence and their long-running p g , the attackers are likely y to have campaigns, consistent funding for their efforts.” - Symantec Blog, December 08, 2011


17

Changes in the field 

A change in targets will require changes to security feature strategy



Exploit kits recently started using SWFs.



Exploit E l it kit kits use attacks tt k that th t are att least l t 2 months th old


18

Effect of exploit kits


19

Everything is relative


20

Evolution of attacks 

Attackers gain skill with practice



Hackers will utilize published research



Makes signature development more difficult


21

CVE-2009-1862 

Simple bit flip of existing SWF from the web



A second SWF was used for the heap spray



Both SWFs were inside a PDF



Flash was a means to an end


22

2010 Improvements 

Eventually moved to a single file approach Parent SWF

Initialization & Heap Spray

Crashing Child SWF


23

Trying new research


24

CVE-2011-2110 

Dynamically passing obfuscated data main.swf?info=02E6B1525353CAA8AD555555AD31B3D73034B657AA3 1B4B5AFB5B2B537AF55543549AEB550AC55303736B337AF51D3527 B7AF4C66B7E



Targeting specific versions if ((((((Capabilities.version.toLowerCase() == "win 10,3,181,14")) || ((Capabilities version toLowerCase() == "win ((Capabilities.version.toLowerCase() win 10 10,3,181,22 3 181 22")))) )))) || ((Capabilities.version.toLowerCase() == "win 10,3,181,23")))){



Return orientated programming


25

Conversion to logic based attacks 

CVE-2011-2107, CVE-2011-2444 & CVE-2012-0757 were XSS attacks



Required ActionScript programming knowledge



Trial & error methods used to identify vulnerabilities


26

Overall Advancements

2009 2010 2011

• Dumb fuzzing • Brute force memory tricks

• Modularizing code • Experimenting with research techniques • Full language understanding • ROP exploitation • Bypassing mitigation strategies


27

Resourcing a response plan


28

All you need is… 

More time



More money



More hardware



More people



More…


29

Balancing the load 

Security teams should focus on larger, high value projects



Any developer should be able to fix a software crash


30

Training 

Minimum security training level for everyone



Everyone within the Flash Runtime team has at least a white belt security certification



B Brown belt b lt projects j t allow ll th the entire ti company to assist!


31

Adobe training results Zero Day Response Over Time 60

50

40

Zero Day Response p Over Time

30

20

10

0 2008

2009


2010

2011 32

Make friends!

“It is easy enough to be friendly to one's friends. But to befriend the one who regards himself as your enemy is the quintessence of true religion The other is mere religion. business.” ― Mahatma Gandhi


33

Types of friends 

Researchers



Business partners



Defensive software companies



Victims of attacks



Tool vendors


34

Planning a response strategy


35

Secure Product Lifecycle?


36

Goals

1.

Increase the difficultly y of exploitation. p

2.

Limit the window of opportunity for use.


37

Killing bugs

VS


38

Fuzzing at scale 

Partnered with Google on FP fuzzing effort



2,000 CPUs



Corpus distillation of 2 TB of SWFs into 20,000 files (1 week)



3 weeks of fuzzing



Bit flipping fli i approach h



1 fuzzing guru (Tavis Ormandy)


39

“Patching at scale” 

400 files distilled into 80 unique issues



Used fuzzers to reproduce and classify issues



Authored app to auto-file bugs



Created tiger team to address the issues



Majority of issues addressed within 60 days


40

Fuzzing results

!exploitable 5

6

10 Exploitable Probably Exploitable Unknown Probably Not Exploitable

59


41

Alternative measurement

“This is completely unfair competition and unfair practices vis vis-a-vis a vis other security researchers (or fuzzer enthus). … You guyz killed couple of my bugs. bugs ” - TestFuzzer, TestFuzzer August 16 16, 2011


42

Lessons learned 

Bugs were spread across the entire code base



Eliminated some low hanging fruit



1 code change per 12,600 CPU hours (1.44 years)


43

Using fuzzing as hints 

1 good dev == CPU years of fuzzing effort



Fuzzing can provide hints of where to focus code review.



F Focus on code d cleanup l rather th th than b bug fi fixing. i


44

And, of course…

There is always one more to find… © 2012 Adobe Systems Incorporated. All Rights Reserved. Adobe Confidential.

45

Integrating security defenses


46

Holistic mitagations 

Work smarter, not harder.



More effective at deterring attacks



Require experienced resources



Require q longer g p periods of development p time.


47

Standard White Background Bullet Slide 

JavaScript blacklist



Improved updater



Reader X Sandbox 

Dedicated team for over 1 year of effort



Additional engineers for misc. support



External consultants


48

Cause and effect

Reader JavaScript blacklist introduced

PDF O l attack PDF-Only tt k PDF w/ SWF attack

PDF attacks switch from JS to SWF


49

Effect of sandboxing

Reader X sandbox launched

CVE20091862

CVE20103654

CVE20101297


CVE20110611

CVE20110609

50

CVE20110627

Sandboxing in Flash Player 

Currently sandboxed in Chrome



Firefox currently in beta



Researching: 

Chrome pepper sandbox



IE improvements


51

Other minor improvements 

Safe unlinking in garbage collection



Random function alignment



Random NOP insertion



Constant folding*


52

Other minor improvements 

Safe unlinking in garbage collection



Random function alignment



Random NOP insertion



Constant folding*


53

Updating end-users


54

Update Goals 

Work with AV and IDS vendors to create accurate signatures that will protect end-users until they get the patch (MAPP)



Reduce the time to update the majority of end-users to minimize the window of opportunity for the exploit


55

We have a background updater!!




New updater will allow us to do silent updates for zero-day patches



Updates both IE and opensource browsers



Complete technical details will be posted with the launch!

56

Handling response


57

Incident response strategies 

Be prepared to triage duplicates, triplicates, quadruplicates, etc….



Set a response timeline goal



Have a regular update schedule



Be willing to shift launch dates



A dh And have ttools…. l


58

Adobe SWF Investigator 

Open-source AIR application



View SWF tags, disassembly and binary



Test AMF services and check for XSS



Inspect LSOs and settings files



Execute the SWF in various contexts



Available TODAY!!!!!


59

Summary


60

Advanced Persistent Response 

Understand your threats



Advanced, holisitic security features are needed to ward off future threats



Need to utilize both internal and external resources to accomplish goals



Start early because the best defenses require time to develop


61

Looking ahead 

Mac auto-updater



Improved IE Sandboxing



Yet more fuzzing 


62

References



Security portal: (customer & channel partners) http://adobe.com/security



Advisories and updates: http://www.adobe.com/support/security/



ASSET blog: http://blogs.adobe.com/asset



PSIRT blog: http://blogs.adobe.com/psirt



Documentation Wiki: http://learn.adobe.com/wiki/display/security/Home



Adobe Security on Twitter: @AdobeSecurity



Peleus Uhley on Twitter: @PeleusUhley


63


Advanced Persistent Response - CanSecWest

Advanced Persistent Response - CanSecWest

Suggest Documents

Advanced Persistent Response - CanSecWest

Charlie Miller - CanSecWest

Smart COM Fuzzing - CanSecWest

Advances in Exploit Technology - CanSecWest

Apple Graphics Is Compromised! - CanSecWest

MAGS TRIP EMAD NESS - CanSecWest

Diagnosing Advanced Persistent Threats: A ... - Semantic Scholar

Advanced Persistent Threats: Hijacking Insider Credentials - NetIQ

Advanced Persistent Threat - SANS Technology Institute

Real-time detection of Advanced Persistent Threats

Defense Against Advanced Persistent Threats: A ...

Advanced Persistent Threats - COMMAND FIVE PTY LTD

Protect Against Advanced Persistent Threats: Configuration Guidelines

Advanced-Persistent-Threat-Hacking-Organization-0071828362 ...

How Advanced Persistent Threats Exploit Humans - International ...

Critical Analysis on Advanced Persistent Threats - International ...

Advanced Persistent Threats: Hijacking Insider ... - Micro Focus

Post-Mortem RAM Forensics - CanSecWest

Large memory management vulnerabilities - CanSecWest

Exploitation 280 Days Later - CanSecWest

Exploiting Unicode-enabled software - CanSecWest

Exploiting Unicode-enabled software - CanSecWest

Phototaxis beyond turning: persistent accumulation and response ...

Persistent suboptimal molecular response in a