Flashcards
Volume 4 - End Point Protection
Cards in this deck (74)
- 1What is EPP?Software installed on devices:
-Application whitelisting
-Disk-encryption
-Anti-virus - 2Disk EncryptionCryptographic protection of a logical part of the disk (or whole disk)
Protects from physical access:
-If device is lost/stolen/seized
-Digital forensics
-Securely discarding - 3Disk Encryption attacksInstalling a camera
Direct Memory Access
Cold boot attacks
Evil Maid attacks
Bootkit that bypasses encryption - 4Evil Maid AttackBoots device using a live CD
Changes the boot loader to a hacked version
If the boot loader is compromised - the encryption is compromised - 5Providers of DEVeraCrypt, CipherShed, DiskCryptor, BitLocker
- 6Defending against DE attacksPrevent phyiscal access
If the device has been tampered with, do not use it
Use WDE over partition encryption
Use secure boot
Prevent memory dumping - 7Nesting crypto systemsOS hidden within encrypted containers and volumes
- 8FUDFully un-detectable -
by using crypting services to obsfuscate the code making it unrecognisable to AV - 9Traditional AVUsed signature analysis to detect malware - AV had to have a signature (hash value) of the malware in order to stop it
-AV share these signatures but attackers automate the re-encryption of a variant to bypass it again - 10Heuristic DetectionAnalyses the overall structure of malware
-evaluates the coded instructions and boolean functions in the code
-Assesses the likelihood of code being malicious - 11Problens with Heuristic DetectionDeep scanning slows the system
Hackers write the malware to avoid heuristic detection methods - 12Two categories of sandbox detectionStand alone solution - requires that the user sets the programs to run in the sandbox (e.g sandboxie)
Integrated into the AV - AV scans to spot potential threats, then places them inside the sandbox - 13Behaviour BlockingAllows malware to operate in the OS, monitors the behaviour (e.g watches for formating the drives, encrypting files etc)
But malware can detect the AV and delay its malicious activity based on its knowledge of the AV product - 14Reputation SystemsThis is effectively trust crowdsourcing
Can check reputation based on digital signature (e.g virus check) - 15Angular Exploit TechniqueInjects payload into the exploited programs memory - avoids dropping a file on the disk
- 16Ransomware Facts$1 billion this year
No need to escalate permissions
No need to tunnel network connections
Easy to obtain, modify, and distribute - 17Perimiter Security - Coconut ModelWeak core, hard shell - strong perimeter security is no longer sufficient.
Good EPP is needed - security needs to travel with the asset - 18Virus TotalOnline virus scanner
- 19Application and Execution ControlAttempt to stop malicious code executing, mainly using a form of white listing
- 20White Listing Helps Mitigate:Unpatched systems
When malware is executed
When attacks use other command injection tricks
Phishing that installs malware
LNK attacks (e.g Stuxnet) - 21White Listing WeaknessesExploiting the OS
Java, JS, Flash
Browser extensions
Root access
Exploiting a white listed application - 22EMETWindows Exploit Prevention
Blocks exploit techniques commonly used to exploit memory corruption vulnerabilities - 23Memory Corruption Vulnerability ExploitsBuffer overflow
Exception handler overwrite
Stack bugger overflow
Heap overflow
NOP slide
BUffer over-read
Buffer underrun - 24EMET TechniquesData Execution Prevention ( memory segments marked as non-executable)
Structured Exception Handler Overwrite Protection (SEHOP) - 25EMET Techniques cont.Address Space Layout Randomization (ASLR) - randomizes addresses so memory is more difficult to access
Certificate pinning - 26Exploitation Prevention SoftwareHitman Pro Alert
Regular malware detection
Cloud assisted scanning
Address SSpace Layout Randomization (ASLR)
Data Execution Prevention (DEP) - 27Three Main Strategies for EPPContainment - isolation
Deception Based - Decoy honeypots, servers, honey tokens
Algorithmic techniques and AI - 28Cylance & Next-Gen AVUsed machine learning to determine the probability of maliciousness
Can detect 0 days
Lightweight on network as no need for signature database or daily update
Other techniques (whitelisting, vulnerability analysis, EDR) have to managed sepearetly - 29A Failure to Detect ThreatsCurrently under utilised e.g Snowden
Breaches are inevitable
Detection times are huge - 30Two Types of HoneypotsResearch
Detection - 31Canary TokenAlerts you if someone accesses a chosen file
Either work by HTTP where a unique URL is assigned to my email, or a DNS method:
DNS query to the unique token server, you get alerted - 32OpenCanary and HoneyDriveBoth open source honepots with low false positives.
OpenCanary can fake a Linux, widnows, MySQL or MSSQL server
HoneyDrive supplies graphs etc - 33Intrusion Detection System IntroRequires many man hours - suitable for large businesses
NIDS (Network IDS)
HIDS (Host IDS) e.g OSSEC or OSquery - 34IDS MethodsSignature based
Heuristic / behaviour based
Rule-based: If - then rules within expert systems - 35Other Types of IDSApplication-Based IDS
Intrusion Prevention System (IPS)
Wireless IPS (WIPS)
Network behaviour analysis (NBA) for e.g DDOS - 36IDS ExamplesSnort, Suricata, BroIDS, OpenWIPS
HIDS - OSSEC
Network Analysis - Sguil, Xplico, Network Miner - 37Three Approaches to Malware HuntingOnline - Monitor and record what the threat is actually doing
Offline - code not executing - could boot off a live CD then examine the file system
Hybrid / Active VM - clone system and place on a VM - 38Two Approaches to Clean the SystemSystem Rebuild - complete wipe and restore (easy if using a VM snapshot)
System Clean - Deleting the executables and autorun locations (preventing it from being persistent) - 39Farbar Recovery ScannerWhen first ran, creates a snapshot of 'healthy' system so it can compare to later snapshots.
- 40Live Rescue OSIf unable to boot / run tools, can boot from another OS and mount the file system
- 41Automated Malware Removal ToolsHitman Pro
Malware Bytes
Kappersky Virus Removal Tool - 42Winows Process ExplorerMuch more advanced task manager
-Shows parent and child processes
-Can check CPU, memory usage
-Process description, version, certificate, virus total
-autostart locations to see how it is persistent
-TCP / IP endpoints of command and control - 43Process MonitorSysinternals tool
Similar to process explorer, but monitors and makes a log of all the activity that is going on in the system - 44Malware Hunting - Network Connection ToolsNetstat - displays all connections and listening ports, and process name
Whois lookup - online tools - 45OSqueryAllows you to question your OS as if it was a database (SQL)
Query lots of systems to understand their state - 46Firmware Rootkits and mitigationFirmware is a small amount of code that runs on hardware
UEFI and BIOS protection:
-Enable secure boot
-Update BIOS
-UEFI SecureFlash enabled - 47Encrypted Backup and Cloud StorageQNAP NAS - local backup
Integrate Dropbox with boxcryptor
or Seafile - can host your own server - 48Definition of HardeningTaking something from its default state to a more secure state by reducing the attack surface and vulnerabilities
- 49Source for Hardning StandardsCentre for Internet Security (CIS)
- 50SCAPSCAP = Security Content Automation Protocol - is a NIST standard which is a set of human readable standards that are also machine readable
- 51NISTNational Institute of Standards in Technology
- 52OpenSCAPAn automated tool to implement the security policies
- 53SCMSecurity Compliance Manager
Allows editing of group policies which allows for configuration of system and user account environments
Provides security baselines - 54Mechanical Drives File DeletionWhen deleting, to save time, the computer marks the section as 'unused'
Remains recoverable until the 'unused' sector is overwritten (seconds or years) - 55Mechanical Drives Secure File DeletionEraser tool - deletes over it using pseudorandom data (n passes)
Single pass should be sufficient - 56Solid State Drives File DeletionWhen you delete a file from an SSD, marked as 'unused'.
TRIM command can wipe space clean. - 57Wear LevellingDistributes writes evenly across all the flash blocks - constantly moving them around as erasing and re-writing the same block causes physical wear. Prolongs the service life.
10-20% capacity set aside for wear levelling - 58SSD Secure File Deletion Reccommendations-Use secure deletion tools
-Only use a single binary 0 overwrite pass (anyting more unnecessary and prematurely shortens life)
-Use whole-disk encryption, partition encryption, and self-encrypting drives
-much less effective on SSD than mech - 59Evidence Elimination and Anti-Forensics 5 useful measures1. Avoid creating evidence
2. Use encryption
3. Run OS from memory (e.g Tails)
-no disk storage
4. Use Virtual Machines
5. Use portable apps in encrypted containers - 60CCleaner and BleachKitTools for wiping free space
- 61Virtual Memory or SwapAllows for computers to compensate for shortages in physical memory by temporarily transfering pages of data from RAM to disk storage. Evidence can reamin in virtul or swap memory
WDE will encrypt swap memory - 62Memory dumpsMost OS can be configured to write debugging info and contents of system memory to 'memory dump files' which may contain sensitive info.
-can disable - 63Mechanical Drives Disk WipingIdeally WDE
Use data wiping softtware (DBAN)
Then can destroy physically, deGauss hard drive, or encrypt and destory key - 64SSD Disk Wiping-Encryption based - WDE, self-encrypting drives, CryptoErase
-ATA Secure Erase
-Block erase
-Destruction
-Secure Deletion Tools - 65EXIF and MetadataFound in many types of files - can see locations (geo-tagging), data modifications etc
- 66EXIF ToolFree tool for removing and analysing EXIF
- 67Email Ports and ProtocolIMAP Port 143 (unencrypted)
POP Port 100 (unencrypted)
IMAP Port 993 (SSL/TLS encrypted)
-synced on clients and server
POP3 Port 995 (SSL/TLS encrypted)
-stored on client only - 68PGPPretty Good Privacy - hybrid crypto system that prevents emails being read except by the intended recipient
Both need it installed (GPG - GNU Privacy Guard) is open and source and most widely used versino - 69PGP and GPG weaknessesDoes not solve problems with:
-Guaranteed delivery
-Quality of service
-Anonymity /psuedoanonymity concerns
-Security bugs in PGP
-No session key - 70Improving OpenPGPPrimary key - for certification - if subkey is lost, primary key can generate new one. Create offline (e.g live CD, or smart card / Yubikey)
Subkey - seperte key pair, associated with the primary key, used for encryption - 71Email TrackingWhen HTML, text, scripts, header fields etc are rendered, 3rd party elements can reach out to remote servers to attempt to track you (assume web mail tracks you).
- 72Email Anonymity / PseudoanonymityUse or chain anonymizing services
Disposable email - Geurillamail
Remailers - 73Good email solution if only concerned with hackersGmail offers:
-2FA
-Spam filters
-Malware protection
-Login notifications
-Storage and transport encryption - 74Instant Messengers priorities:1. Encryption in transit
2. Supplies non-repudiation / authentication
3. Perfect forward secrecy
4. Has the code had a security audit?
Signal is good.
Information
- Description
- Flashcards on Volume 4 - End Point Protection, created by Tim Jelly on 08/07/2017.
- Created by
- Tim Jelly
- Views
- 1
- Rating