Attacker Math 101
Professor Dai Zovi Institute for the Advancement of Memory Corruption
What is this all about?
Thinking like an attacker Modeling their choices Predicting future behavior Making better defense decisions
Attacker Math
If the cost to attack is less than the value of your information to the attacker, you will be attacked Mass malware must be financially profitable for the profit-driven attackers APT campaigns must scale according to the resources at the attackers disposal
Attack Graphs
Informal tool to visualize and analyze how to attack a system (software, network, etc) Nodes represent levels of access/positions or actions to perform Nodes can be weighted with a cost, calculated in terms of capital, skill, risk, opportunity, or time/effort required Actors can be modeled in similar terms
Adversary Modeling
Different groups/types of attackers have different intents, capabilities, strategies, and tactics Most organizations are not concerned with all of them Mass malware APT ZFO / Anonymous / LulzSec Stuxnet
Conjecture
Attackers will take the least cost path through an attack graph from their start node to their goal node, where: Cost is a multi-variable equation Start nodes represent some level of access or position Goal nodes represent a consequence that is good for attacker, bad for defender
Mass Malware
Internet Access
???
Prot
Mass compromise and infect Internet Access Malicious Ads SEO Malicious HTML/JS
Drive-by Download Social Engineering
Banking Creds Installations Stolen CC# Stolen PII Prot
WebKit Vulnerability Chrome 10 Malicious HTML/JS Execution IE Vulnerability
ASLR Bypass
DEP Bypass
Sandboxed Low Integrity Native Code Execution Low Integrity Native Code Execution Medium Integrity Native Code Execution
IE 8/9
ASLR Bypass
DEP Bypass
FF 4
Firefox Vulnerability
ASLR Bypass
DEP Bypass
WebKit Vulnerability Chrome 10 Malicious HTML/JS Execution IE Vulnerability Java Vulnerability FF 4 Firefox Vulnerability
ASLR Bypass
DEP Bypass
Sandboxed Low Integrity Native Code Execution Low Integrity Native Code Execution Medium Integrity Native Code Execution
IE 8/9
ASLR Bypass
DEP Bypass
ASLR Bypass
DEP Bypass
Sandboxed Low Integrity Native Code Execution
Sandbox escape
Medium Integrity Native Code Execution
Local Privilege Escalation
Admin User RCE M-H Integrity Escalation High Integrity Privileged RCE
Integrity Escalation
Low Integrity Native Code Execution
Install Rootkit
Privileged Host Persistence
Sandboxed Low Integrity Native Code Execution
Sandbox escape
Medium Integrity Native Code Execution
Local Privilege Escalation
Admin User RCE M-H Integrity Escalation High Integrity Privileged RCE
Integrity Escalation
Low Integrity Native Code Execution
Kernel exploit
Install Rootkit
Privileged Host Persistence
Attacker Math
Cost(Medium Integrity RCE) = Min( .10 * (WebKit vuln + ASLR/DEP + Sandbox), .60 * (IE vuln + ASLR/DEP + IE PM), .20 * (FF vuln + ASLR/DEP), .95 * (Flash vuln + ASLR/DEP + IE PM), .75 * (Java vuln) )
Exploits are Hard
Mass malware wants to go from injected content to installations at the least cost If drive-by downloads become unprofitable, they will increasingly shift to social engineering (self-signed applets, rogue AV, etc) If no one published exploits, they would just repurpose exploits captured from targeted attacks (they are already doing this)
Lessons
Exploiting Java is the cheapest path to Medium Integrity Native Code Execution or User-privileged Remote Command Execution Therefore, attackers will prefer exploiting Java over browser vulnerabilities Exploiting the kernel is the cheapest path from Unprivileged Native Code Execution to Privileged Code/Command Execution Therefore, attackers will deploy kernel exploits before sandbox evasions (and already have)
JailbreakMe 2.0
iOS 4.0 Runtime Security Features
Mandatory Code Signing All executables must be signed by Apple or a provisioned code signing certificate Code Signing Enforcement All executable memory pages must have a valid signature Runtime sandbox The actions that the app may perform are restricted by the kernel at runtime
MobileSafari HTML
Memory corruption vulnerability
Returnoriented execution
Code signing enforcement bypass
Unprivileged native code execution Sandbox evasion Mandatory code signing evasion Privilege Escalation Privileged native code execution
MobileSafari HTML
Memory corruption vulnerability
Returnoriented execution
Code signing enforcement bypass
Unprivileged native code execution Sandbox evasion Mandatory code signing evasion Privilege Escalation Privileged native code execution
Kernel exploit
Response
Apple released iOS 4.0.1 to patch vulnerabilities within 2 weeks Speed of response discourages similar 0day jailbreaks JB community shifted focus back to boot ROM exploits Press and users largely celebrated the release of the jailbreak What would the response have been if the same techniques were branded as an exploit (bad) rather than jailbreak (good) ? Jailbreak was quickly adapted into a PoC rootkit by Eric Monti
Lessons
Jailbreak developers use of exploits mimics malicious attackers They are resource constrained, just like defenders Desire maximum return on investment for their exploits Deploy exploits strategically Preservation of SHAtter in favor of Limera1n exploit Choose target attack surfaces for maximum return Boot ROM (unpatchable) vs. iOS (quickly patchable)
Conjecture
The level of security offered by a path through an attack graph is measured by the cost required for an attacker to traverse it Measuring the precise cost of a path requires spending exactly that amount to traverse it However, we can estimate or bound costs of some subpaths by proxy or observation
Observable Cost Measurements
Fuzzing statistics Fuzzing stats measure cost to find a crash in a particular product Bug bounties Anonymous ZDI submissions measure cost to find a vulnerability in that product Pwn2Own measures cost to develop an exploit against that product
Lies, Damn Lies, and Fuzzing Statistics
Charlie Millers Fuzzing Stats
Dumb fuzzing 12-25% of unique crashes deemed exploitable 33-50% of unique crashes deemed exploitable or probably exploitable
Miller, Charlie. "Babysitting an Army of Monkeys: An Analysis of Fuzzing 4 Products with 5 Lines of Python". CanSecWest 2010. http://securityevaluators.com/les/slides/cmiller_CSW_2010.ppt
Meditate On These Numbers
300 file format parsers 1,000,000 fuzz iterations 1600 unique bugs 200-800 likely exploitable vulnerabilities
Withers, Stephen. Fuzzing Detected 1600 Ofce 2010 bugs During Development, ITWire, July 15, 2010. http://www.itwire.com/business-it-news/security/40430-fuzzing-detected-1600-ofce-2010-bugs-during-development
Bugs as natural resources
Don't just count quantity of bugs, measure the drilling depth required to extract them Can they be refined (exploited) using current technology and processes? Estimate size of discovered fields
Theorem
Cost to discover a vulnerability in a particular product is less than the sum of a claimed bug bounty for that type of vulnerability plus the value of credit to that particular researcher Cost(Vuln) <= Value(Bounty) + Value(Credit)
Your credit is no good here
The value of credit to different researchers is variable, so lets remove it from the equation: Cost(Vuln) <= Value(AnonBounty)
ZDI/iDefense Anonymous Submissions
No exploit is required, just a verifiable security vulnerability in a product significant enough that ZDI would care to pay for the bug ZDI bounties paid are confidential, but we will assume that they are less than Pwn2Own So we dont actually get Cost(Vuln), just the products for which: Cost(Vuln) <= Value(Anon Bounty)
Anonymous ZDI Advisories in 2011
HP Client Automation/Radia (ZDI-11-105), Cisco Secure Desktop (ZDI-11-092, ZDI-11-091) Microsoft PowerPoint (ZDI-11-125, ZDI-11-124, ZDI-11-123), Excel (ZDI-11-043, ZDI-11-042, ZDI-11-041, ZDI-11-040) WebKit (ZDI-11-104, ZDI-11-101, ZDI-11-097) Adobe Flash (ZDI-11-081), Shockwave (ZDI-11-079), Reader (ZDI-11-075)
Corollary
The cost to discover and reliably exploit a vulnerability in a particular product is less than the sum of a claimed Pwn2Own prize for that product, the value of the laptop, and the value of fame to that researcher Cost(Exploit) <= $15k + Value(Laptop) + Value(Fame) It is harder to remove fame from the equation here, but what can we measure? Time-to-exploit
Chrome 9 Malicious HTML/JS Execution IE 8 FF 3
WebKit Vulnerability IE Vulnerability Firefox Vulnerability WebKit Vulnerability
ASLR Bypass ASLR Bypass
DEP Bypass DEP Bypass
Sandboxed Low Integrity Native Code Execution Low Integrity Native Code Execution Medium Integrity Native Code Execution Native Code Execution
Chrome Sandbox Escape Windows Kernel Exploit IE PM Escape File write access
ASLR Bypass
DEP Bypass
Safari 5
64-bit NX Bypass
Chrome 9 Malicious HTML/JS Execution IE 8 FF 3
WebKit Vulnerability IE Vulnerability Firefox Vulnerability WebKit Vulnerability
ASLR Bypass ASLR Bypass
DEP Bypass DEP Bypass
Sandboxed Low Integrity Native Code Execution Low Integrity Native Code Execution Medium Integrity Native Code Execution Native Code Execution
Chrome Sandbox Escape Windows Kernel Exploit IE PM Escape File write access
ASLR Bypass
DEP Bypass
Safari 5
64-bit NX Bypass
Chrome 9 Malicious HTML/JS Execution IE 8 FF 3
WebKit Vulnerability IE Vulnerability Firefox Vulnerability WebKit Vulnerability
ASLR Bypass ASLR Bypass
DEP Bypass DEP Bypass
Sandboxed Low Integrity Native Code Execution Low Integrity Native Code Execution Medium Integrity Native Code Execution Native Code Execution
Chrome Sandbox Escape Windows Kernel Exploit IE PM Escape File write access
ASLR Bypass
DEP Bypass
Safari 5
64-bit NX Bypass
Lessons
Requiring evasion of mitigations or exploitation of additional vulnerabilities in the chain increases time to develop a full exploit linearly And therefore, it also increases the cost to develop such an exploit linearly
Hypothetical: Browser Exploit Powerball
Once a year, public bounty is posted for reliable enough exploits against dominant desktop configurations Must gain enough privs to accomplish attacker objectives Prices gradually increase until first winning submission is received for a particular target Incentivizes submitting as early as possible Contestants MUST sign NDA on disclosing participation and submission, vulnerability is reported to vendor anonymously Forcibly removes credit and fame from the equation
Armchair APT Analysis
Conjecture
APT attacks must scale according to resources at the attackers disposal Aurora campaign wasnt just against Google, or only 34 targets, but apparently against thousands of organizations (Reuters)
Cloppert's APT Kill Chain Model
Recon Vulnerability weaponization Exploit delivery Host exploitation Host persistence Command and control Actions on Objectives
Does it Scale?
Phase Recon Weaponization Exploit delivery Host exploitation Host persistence Command and control Actions on Objectives
NOT SO MUCH HELL YES HELL YES HELL YES HELL YES HELL YES NOT AT ALL
Does it scale?
Lessons
Focusing defensive countermeasures on the cheapest (for the attacker) phases of the attack is not as effective as focusing on the expensive If your defense is cheaper than their offense, you will gain the advantage
Conclusion
Think like an attacker to predict what they will do and how they will attack you Model your understanding of their intent, capabilities, and constraints Adjust your threat model based on new information on attackers and their capabilities i.e. Anonymous pre- and post-Gawker
Questions?
@dinodaizovi / [email protected] http:/ /blog.trailofbits.com
