CanSecWest: Let’s talk about non-targeted attacks

Today is the last day of CanSecWest – a security conference taking place in Vancouver, Canada.
On Wednesday I filled in for Costin Raiu and talked about our forensics work into Duqu’s C&C servers.

As I’m writing this, Google Chrome just got popped. Again. The general feeling is that $60k, even with a sandbox escape, isn’t a whole lot of money for a Chrome zero-day.
So, to see multiple zero-days against Chrome is quite the surprise, especially when considering the browser’s Pwn2Own track record.

Separately, I found the Q&A session following Facebook’s Alex Rice’s presentation immensely intriguing.

Alex presented on Facebook’s social CAPTCHA, a secondary authentication step that uses friends’ photographs that kicks in when Facebook suspects a compromised/phished account.

The introduction of this system has meant that mass Facebook phishing attacks have gone away. They’ve become ineffective.

However, during the Q&A, there were a lot of comments about how this system can be circumvented in a targeted attack.

Clearly, any system which simply eradicates an entire ‘class’ of attack, while not really impacting user experience, should be considered a huge success.

Facebook should be applauded for their solution, but instead they mostly got criticism from the audience.

Seeing so much criticism is extremely worrisome. We shouldn’t be dismissing ideas or systems simply because they’re not particularly effective against targeted attacks. It’s not always black or white.

After all, the vast majority of (cyber-)crime is not targeted. Let’s not forget that.

CanSecWest: Let’s talk about non-targeted attacks

Your email address will not be published. Required fields are marked *



Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

APT trends report Q1 2021

This report highlights significant events related to advanced persistent threat (APT) activity observed in Q1 2021. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Subscribe to our weekly e-mails

The hottest research right in your inbox