Presented at
BruCON 0x0A (2018),
Oct. 5, 2018, 2 p.m.
(60 minutes).
For years and years, anti-malware solutions, across many levels of the network, have been assisted by online anti-virus aggregation services and online sandboxes to extend their detection level and identify unknown threats. But this power booster comes with a price tag. Even today, enterprises all over the world are using security solutions that instead of protecting the data, are suspecting it as malicious and sharing it with online multi-scanners. The result is drastic. What separates a hacker from extracting all that data on a daily basis is a couple of hundreds euros, monthly. A price which could be covered easily if that hacker finds a man of interest. In just a couple of days, one skilled hacker can build an intelligence platform that could be sold in 10 times the money they invested.
The data is being leaked daily and the variety is endless. In our research, we dived into these malware-scanning giants and built sophisticated Yara rules to capture non-malicious artifacts and dissect them from secrets you've never thought possible of getting out of their chamber. But that’s not all.
We will show the audience how we built an intelligence tool, that upon insertion of an API key, will auto-dissect a full dataset. In our talk we reveal the awful truth about allowing internally installed security products to be romantically involved with online scanners.
Presenters:
-
Dani Goland
Dani Goland is a 23 year old coding machine. At the age of 20 he founded his own boutique company for innovative software and hardware solutions. While gaining experience in the business field, Dani did not neglect his hands-on capabilities. In just a short while he won two coding competitions, one of which was held by eBay. Dani recently relocated from Israel to the United States to study Data Science at the prestigious UC Berkeley. During his studies, Dani found VirusBay, a collaborative malware research community which skyrocket amongst the global security community with over 1300 researchers. After serving in the Israeli Defense Forces as a commander of a Field Intelligence unit, Dani went on an 8-month journey across South America. He loves snowboarding, music concerts, and having crazy, breathtaking experiences such as spending 5 days in the Bolivian Jungle with no food or water.
-
Ido Naor
Ido Naor is a Senior Security Researcher at GReAT, a team of researchers who've been tasked by Kaspersky Lab to investigate the most prolific APT incidents, ransomware distribution, banking heists and other type of internet hacking monsters. Ido's focusing on threats in the middle east and is actively following groups of hackers who aim to demolish the ordinary lives of citizens and public/gov institutes. During his work at Kaspersky, Ido found VirusBay, a collaborative malware research community which skyrocket amongst the global security community with over 1300 researchers. Ido is 31 years old, a martial arts experts and a father of 3, lives in Tel Aviv, Israel. He served at one of the most notorious intelligence special ops military unit, as a combatant, commander and later on as a Krav Maga instructor.
Links:
Similar Presentations: