Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat).

Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the techniques I've found used by intruders are for the most network break-ins, malware based break in through emails sended to employees of the company or and then steal passwords and break in managed exploiting very old vulnerability on unpatched server.

I've never found Covert Channel or Kernel Rootkit. And for the most part all the backdoors and tools used by the intruders were left in clear on the file system.

What is your experience with incident? Have you found some advanced techniques used by intruders or for the most all break in are maded by using simple and old techniques?

share|improve this question
1  
I have suggested an edit to make your question easier to understand, which is here. If you see how you can make your question easier to understand, please click the edit link. –  George Bailey Feb 23 '12 at 22:31
1  
tried to make further improvements, but it is late, and it needs more work... –  Rory Alsop Feb 24 '12 at 1:02
    
I will made correction asap. Now the question is no more what I was looking for. –  boos Feb 24 '12 at 22:04
add comment

1 Answer

Bog standard virus outbreaks have rootkits, backdoors and covert channels. It's hard to tell if anyone is even utilizing them since the encrypted communications to the command and control is mysterious enough, and the depth at which you'd have to research it puts that kind of analysis outside of practical security.

Oddly, the IDS didn't pick it up, nor did the traffic pattern analysis... which is IMHO, shameful. The AV picked it up when the healthy systems got updates and saw infected files on shares.

It would be embarrassing... if the problems were in my control. I was only responsible for cleanup and documenting the problem. My recommendations were mostly ignored, but it was executive risk assessment which made that call and I respect it.

I was of course put in front of the firing squad to explain to executives why the IDS system didn't detect anything when a toddler with wireshark could see that all hell was breaking loose.

share|improve this answer
    
For every malware founded we made reverse engineering of it, so for the most we know what behaviour every malware have, but we haven't meet any advanced techniques in all of it! –  boos Feb 24 '12 at 22:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.