Advanced Persistent
Threat
Sachin Deshmanya & Srinivas Matta
© Copyright 2011 EMC Corporation. All rights reserved.
1
Agenda
• Defining APT
• Evolution of threat models
• Intention of such threats
• How to gear up for such a threat
© Copyright 2011 EMC Corporation. All rights reserved.
2
What is APT
• Advanced
– Sophisticated.
– Targeted.
– With a purpose.
• Persistent
– Continued efforts to achieve the goal.
– Month after month, even years.
• Threat
– Are resourceful, capable.
– Are determined to achieve the goals.
© Copyright 2011 EMC Corporation. All rights reserved.
3
Intrusion kill chain
Chain is a series of process such as find, fix, track, target, engage and assess.
So find the targets for engagement, fix their location, track and keep an eye, target with
suitable weapon, engage, assess the effects. This is called a chain because any
interruption breaks the entire process.
Different Stages
Reconnaissance
Research, identification and selection of targets.
Weaponization
Coupling a remote access Trojan with an exploit into a
deliverable payload.
Delivery
Transmission of weapon into the target network.
Exploitation
Once a weapon is delivered, the intruders code
exploits a vulnerability of an application OR operating
system.
Installation
Installation of remote access Trojan, allows backdoor
entry.
Command and Control Compromised host forms a channel to controlled
servers.
Actions on objectives
© Copyright 2011 EMC Corporation. All rights reserved.
Once the above phases are complete, intruders take
actions to achieve original goal.
4
Differentiator, evolution of threats
Traditional Virus/Malware
APT
Target random networks/hosts.
Target specific network/hosts.
Probably of getting detected are
high by AV as their signatures
get detected.
Combination of malware used,
signatures go undetected
because of this.
The effects become visible over
a period of time, as large
network/hosts get infected.
The idea is to lay low over a
significant period of time.
A good firewall OR intrusion
detection system can prevent
entry by signature checking.
Carrier is mostly through
content, which uses well known
ports (80, 443 etc.) and known
protocol http, https etc.
© Copyright 2011 EMC Corporation. All rights reserved.
5
Different techniques used in an APT
• Social engineering
emails
• Spear phishing emails
© Copyright 2011 EMC Corporation. All rights reserved.
6
Different techniques used in an APT
• Zero Day exploits
© Copyright 2011 EMC Corporation. All rights reserved.
7
Am I a APT victim, how to gear up?
• How to figure out you are a victim of APT attack?
• What to look out for?
•
•
•
•
•
•
May get unnoticed by a single AV/IDS.
Analyzing network layered packets is good way to start.
Log analyses from various sources with co-relation should help.
Monitoring end points for suspicious behavior.
Good asset management should be in place, guard critical systems.
Monitoring critical asset’s is very important.
Finding needle in a hay stack.
© Copyright 2011 EMC Corporation. All rights reserved.
8
Am I a APT victim, how to gear up?
• What to look out for?
• Multi layered defense is
needed.
• We are moving towards intelligence driven security
systems.
© Copyright 2011 EMC Corporation. All rights reserved.
9
RSA Security Analytics
RSA Security Analytics gives security teams the ability to unleash their full potential and
stand tall against today’s attackers by evolving from a traditional log-centric approach to
one with better visibility, analysis, and workflow
© Copyright 2011 EMC Corporation. All rights reserved.
10