I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat).

Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the techniques I've found used by intruders are for the most network break-ins, malware based break in through emails sended to employees of the company or and then steal passwords and break in managed exploiting very old vulnerability on unpatched server.

I've never found Covert Channel or Kernel Rootkit. And for the most part all the backdoors and tools used by the intruders were left in clear on the file system.

What is your experience with incident? Have you found some advanced techniques used by intruders or for the most all break in are maded by using simple and old techniques?

  • 1
    I have suggested an edit to make your question easier to understand, which is here. If you see how you can make your question easier to understand, please click the edit link. – Bryan Field Feb 23 '12 at 22:31
  • 1
    tried to make further improvements, but it is late, and it needs more work... – Rory Alsop Feb 24 '12 at 1:02
  • I will made correction asap. Now the question is no more what I was looking for. – boos Feb 24 '12 at 22:04

Bog standard virus outbreaks have rootkits, backdoors and covert channels. It's hard to tell if anyone is even utilizing them since the encrypted communications to the command and control is mysterious enough, and the depth at which you'd have to research it puts that kind of analysis outside of practical security.

Oddly, the IDS didn't pick it up, nor did the traffic pattern analysis... which is IMHO, shameful. The AV picked it up when the healthy systems got updates and saw infected files on shares.

It would be embarrassing... if the problems were in my control. I was only responsible for cleanup and documenting the problem. My recommendations were mostly ignored, but it was executive risk assessment which made that call and I respect it.

I was of course put in front of the firing squad to explain to executives why the IDS system didn't detect anything when a toddler with wireshark could see that all hell was breaking loose.

  • For every malware founded we made reverse engineering of it, so for the most we know what behaviour every malware have, but we haven't meet any advanced techniques in all of it! – boos Feb 24 '12 at 22:07

While this is not something which directly happened to me, a person I know online shared this story, as well as the payload. He had apparently been targeted with what may be stock TAO malware. It was a BIOS payload which patched the kernel in memory as it started up. It also contained a payload to brick the machine in case it failed to execute correctly. In that case, it would abuse a little known feature in many laptops where the device can be locked to one specific battery serial number. By enabling this feature, and locking the required serial number to a non-existent one, the system will effectively refuse to ever boot again.

Some details are in https://cpunks.org/pipermail/cypherpunks/2015-December/011197.html which I find quite interesting (the battery serial number thing is the PDoS he mentioned).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.