\documentclass{beamer}

%     Copyright (c)  2001,2002,2003,2004,2005  Alexandre Dulaunoy <adulau@foo.be>
%     Permission is granted to copy, distribute and/or modify this document
%     under the terms of the GNU General Public License, Version 2.0
%     or any later version published by the Free Software Foundation;
%

%\usetheme{PaloAlto}
%\usetheme{Goettingen} %%OK
\usetheme[compress]{Dresden} %%OK
\usecolortheme{crane}

\usepackage[english]{babel}
\usepackage[latin1]{inputenc}
\setbeamertemplate{blocks}[rounded][shadow=true]
\setbeamercovered{transparent}


%
% The following info should normally be given in you main file:
%


\title{Learning from the attackers}
\subtitle {What's the attacker teach us on how to improve our information systems ?}
\keywords {free software security honeynet honeypot}
\subject {Learning from the attackers - how to improve our information systems ?}
\author{Alexandre Dulaunoy}
\institute{
  ASBL CSRRT-LU (Computer Security Research and Response Team Luxembourg)\\
  http://www.csrrt.org/
}


\begin{document}


\frame{\titlepage}

\section*{Learning from the attackers}
\subsection{Introduction}

\frame[containsverbatim]{
  \nameslide{Introduction or Disclaimer}
  \frametitle{Introduction or Disclaimer}

\begin{itemize}
\item After a deep analysis of the data captured in a honeypot, we discovered a lot of attackers tools and tactics (sometimes their motives)
\item What could we learn from such information ? Can we build conclusion recommendations about security ? or is it so empirical or focused 
that we'll recommend wrong paths at the end ? 
\item At least, we'll make a partial bridge between theory and practice in "computer/network" security
\end{itemize} 

\tiny{Terminology : users are running information systems and attackers are the one trying to attack them.}\\
\tiny{An user can become an attacker and an attacker can become an user}

}

\subsection{Attackers perspective}

\frame[containsverbatim]{
  \nameslide{Attackers exist}
  \frametitle{Attackers exist}


\begin{itemize}
\item There was an old myth : "There is no such thing as attackers in cyberspace"
\item They exists and looking at the kind of interaction within the honeypot, they are human
\item Thinking and implementing security on your information system is not worthless
\item A collateral law, they often don't target countries but just the cyberspace and its big potential of vulnerable systems 
\end{itemize} 

}

\frame[containsverbatim]{
  \nameslide{Attackers discover and exploit vulnerabilities}
  \frametitle{Attackers discover and exploit vulnerabilities}


\begin{itemize}
\item Attackers use known or unknown vulnerabilities
\item Attackers often use vulnerabilities before their are falling into the known category (e.g. ssh exploit, ptrace bug,...)
\item Protecting information systems on only known vulnerabilities is just covering a part (e.g. IDS or malware patterns)
\item Implementing Least privilege is important to better contain unknown and known vulnerabilities ('''The principle of least privilege states that a subject
should be given only those privileges that it needs in order to complete its task''')
\end{itemize} 

}

\frame[containsverbatim]{
  \nameslide{Attackers discover and exploit vulnerabilities (2)}
  \frametitle{Attackers discover and exploit vulnerabilities (2)}


\begin{itemize}
\item In recent web security issues, the permissions on the /tmp or /temp directory are very important and must follow least privilege principle 
\item Implementing Fail-Safe principle in software and in their implementation (in other words ''' In doubt, a none access is given.''' or avoid default allow from software to network configuration.)
\item Attackers monitor security advisory and you ? (e.g. RSS security feeds are nice and free, they just need a bit of time)
\end{itemize} 

}

\frame[containsverbatim]{
  \nameslide{Attackers innovate}
  \frametitle{Attackers innovate}


\begin{itemize}
\item Some years ago, we already discovered a lot of attackers using tunneling protocols like ipv6 over ipv4 to just hide their activities
\item Attackers innovate just to pursue their objective 
\item Don't minimize their ability of adaptation
\item Innovating don't mean "buying bleeding edge devices" but more "what are the (bad \& good) potential use of a technology ?"
     
\end{itemize} 

}

\frame[containsverbatim]{
  \nameslide{Attackers innovate (2)}
  \frametitle{Attackers innovate (2)}
\begin{itemize}
\item The innovation process of an attacker is often a "thinking out of the box approach" :
 \begin{itemize}
  \item User trying to protect their system : "What are the risks ?"
  \item Attackers trying to attack a system : "How to attack the system ? nice the service X or Y is running, I'll give a try"
  \item Each perspective are valid but sometime user should take the hat of an attacker against their own system
  \item It will better refine the risks and where to focus
 \end{itemize} 
\end{itemize} 
}

\frame[containsverbatim]{
  \nameslide{Attackers communicate}
  \frametitle{Attackers communicate}
\begin{itemize}
\item Attackers communicate just like human
\item Attackers communicate (very) well :
 \begin{itemize}
  \item They will use any channel of communication available including covered channel (e.g. from IRC to ICMP tunnelling)
  \item They exchange information with other attackers and non-attackers (e.g. the announce of a compromised)
  \item They often integrate the system in a larger network of compromised systems (e.g. IRC interface to your own credit card verification process)
 \end{itemize}
\item and you ? are you communicating with colleagues, suppliers or competitors having the same security troubles ?
\end{itemize} 
}

\frame[containsverbatim]{
  \nameslide{Attackers communicate (2)}
  \frametitle{Attackers communicate (2)}
\begin{itemize}
\item When implementing access or remote services, think twice before enabling it as it will be used as a communication channel by the attackers :
 \begin{itemize}
  \item Does the machine in a DMZ really need an Internet access ? often it's not required and helps the potential attackers to communicate (e.g. using the system to launch other attacks, download toolbox like root-kit, being part of a larger network of compromised system, ...)
  \item Don't forget a lot of protocols are full-duplex and encapsulation of non-legitimate traffic is possible (and often easy)
  \item A end-user can be a communication layer without knowing to be one (e.g. p2p protocol) 
 \end{itemize} 
\end{itemize} 
}

\frame[containsverbatim]{
  \nameslide{Attackers have toolboxes}
  \frametitle{Attackers have toolboxes}
\begin{itemize}
 \item As seen in the Honeypot, attackers use toolboxes to ease their work
 \item Sometimes they compile or execute their toolboxes on your compromised machine :
 \begin{itemize}
  \item Do you really need a C compiler on your machine ? do you need a C\# virtual machine or web browser on a server ?
  \item Follow the rule of "if you don't need it, don't install it or remove it"
  \item If an attacker is able to install software, are my permissions correct ? do I follow the principle of least privilege ? separation of privilege ? do you control regularly file integrity ?
 \end{itemize}
 \item and you ? do you have your toolbox to analyze a compromised system ? and do you know how to use it ? 
\end{itemize} 
}

\frame[containsverbatim]{
  \nameslide{Attackers love any services}
  \frametitle{Attackers love any services }
\begin{itemize}
 \item A common myth in information security : "I'm using a so obscure protocol that no one is interested"
 \item Some experiment in Honeypot with obscure protocol shows an interest and exploit from the attackers (e.g. the mbus case)
 \item User often forget that the cost of testing large set of information system on Internet is low
 \item User must apply the "Principle of Open Design" ('''The principle of open design states that the security of a mechanism should not depend on the secrecy of its design or implementation''')
\end{itemize} 
}


\frame[containsverbatim]{
  \nameslide{Attackers share}
  \frametitle{Attackers share}
\begin{itemize}
 \item Attackers share :
 \begin{itemize} 
 \item Compromised systems with other known (sometimes with unknown) attackers
 \item Toolboxes and idea with the other attackers (e.g. root-kits are often trojaned by others attackers)
 \item Services available on your nice compromised systems (e.g. a CC validation system)
 \item and extend your compromised with new services (e.g. from a sniffer to a phishing website) 
 \end{itemize} 
 \item Monitoring your systems for detecting not-known services is important
 \item Do you share tips about security ?
\end{itemize} 
}

\frame[containsverbatim]{
  \nameslide{Attackers are sexy}
  \frametitle{Attackers are sexy}
\begin{itemize}
 \item We don't know... no experiment where done until now
 \item Collateral point : When analyzing something on a compromised system, everything is a perception
 \item We learn everyday and security is a never ending process
\end{itemize} 
}


\section{Bibliography}

\frame {

\nameslide {Bibliography}
 \frametitle {Bibliography}

\begin{itemize}
\item Know Your Enemy, The Honeynet project - various, (second edition) Addison Wesley, ISBN 0-321-16646-9
\item Computer Security, Art and Science, Matt Bishop, Addison Wesley, ISBN 0-201-44099-7
\end{itemize}


%%\includegraphics[scale=0.50]{Hack2005lu-banner.png}
}

\section*{Q and A}

\frame {

\nameslide {Q and A}
 \frametitle {Q and A}

\begin{itemize}
\item Thanks for listening.
\item adulau@foo.be
\end{itemize}


%%\includegraphics[scale=0.50]{Hack2005lu-banner.png}
}

\end{document}


