What are the most sophisticated techniques used by intruders you have found in the wild?

Question

I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat).

Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the techniques I've found used by intruders are for the most network break-ins, malware based break in through emails sended to employees of the company or and then steal passwords and break in managed exploiting very old vulnerability on unpatched server.

I've never found Covert Channel or Kernel Rootkit. And for the most part all the backdoors and tools used by the intruders were left in clear on the file system.

What is your experience with incident? Have you found some advanced techniques used by intruders or for the most all break in are maded by using simple and old techniques?

Answer 1

Bog standard virus outbreaks have rootkits, backdoors and covert channels. It's hard to tell if anyone is even utilizing them since the encrypted communications to the command and control is mysterious enough, and the depth at which you'd have to research it puts that kind of analysis outside of practical security.

Oddly, the IDS didn't pick it up, nor did the traffic pattern analysis... which is IMHO, shameful. The AV picked it up when the healthy systems got updates and saw infected files on shares.

It would be embarrassing... if the problems were in my control. I was only responsible for cleanup and documenting the problem. My recommendations were mostly ignored, but it was executive risk assessment which made that call and I respect it.

I was of course put in front of the firing squad to explain to executives why the IDS system didn't detect anything when a toddler with wireshark could see that all hell was breaking loose.