CanSecWest: Let’s talk about non-targeted attacks

Today is the last day of CanSecWest – a security conference taking place in Vancouver, Canada.
On Wednesday I filled in for Costin Raiu and talked about our forensics work into Duqu’s C&C servers.

As I’m writing this, Google Chrome just got popped. Again. The general feeling is that $60k, even with a sandbox escape, isn’t a whole lot of money for a Chrome zero-day.
So, to see multiple zero-days against Chrome is quite the surprise, especially when considering the browser’s Pwn2Own track record.

Separately, I found the Q&A session following Facebook’s Alex Rice’s presentation immensely intriguing.

Alex presented on Facebook’s social CAPTCHA, a secondary authentication step that uses friends’ photographs that kicks in when Facebook suspects a compromised/phished account.

The introduction of this system has meant that mass Facebook phishing attacks have gone away. They’ve become ineffective.

However, during the Q&A, there were a lot of comments about how this system can be circumvented in a targeted attack.

Clearly, any system which simply eradicates an entire ‘class’ of attack, while not really impacting user experience, should be considered a huge success.

Facebook should be applauded for their solution, but instead they mostly got criticism from the audience.

Seeing so much criticism is extremely worrisome. We shouldn’t be dismissing ideas or systems simply because they’re not particularly effective against targeted attacks. It’s not always black or white.

After all, the vast majority of (cyber-)crime is not targeted. Let’s not forget that.

CanSecWest: Let’s talk about non-targeted attacks

Your email address will not be published.



The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox