lessons learned: can alerting the public about ... · microsoft malware protection center attack...

43
Lessons Learned: Can alerting the public about exploitation do more harm than good?

Upload: others

Post on 02-Jan-2021

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Lessons Learned: Can alerting the public about

exploitation do more harm than good?

Page 2: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

About Us

• Tom Cross, IBM X-Force – Vulnerability tracking, analysis, and response – IPS signature delivery – MAPP (Microsoft Active Protections Program) partner – X-Force Trend and Risk Report

• Holly Stewart, Microsoft Malware Protection Center (MMPC) – Coordination for MMPC as a MAPP partner – Communication and response for emerging issues (exploits, malware,

etc.) – Intelligence reports – Not a part of Microsoft Security Response Center (MSRC)

Page 3: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Overview

• Exploitation disclosure – Define exploitation disclosure

– How is it different from vuln disclosure?

• What are the risks associated with disclosing exploitation too early?

• What impact does in the wild exploitation have on vulnerability disclosure timing?

• Use cases, examples, lessons learned

• Guidance

Page 4: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

A lot of ink has been spilled on Vulnerability Disclosure.

• Vulnerability Disclosure is public disclosure of the fact that a vulnerability exists.

• In general, its preferable if vulnerability disclosure happens in coordination with the vendor of the vulnerable product, in conjunction with the release of fix information.

• In some rare cases, it may be necessary to disclose a vulnerability before a fix is available… – One such case may be the case where there is

exploitation in the wild.

Page 5: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

What is exploitation disclosure?

Public disclosure of the fact that a vulnerability is being exploited in the wild.

Danger Danger!

0

500

1,000

1,500

2,000

2,500

3,000

3,500

4,000

11 12 1 2 3 4

2010 2011

Badness is Happening

Page 6: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Why is Exploitation Disclosure important?

• Software vendors and IT professionals need to understand how to prioritize vulnerability remediation – Exploitation can motivate faster remediation.

• Security product vendors need access to real world exploit samples so they can validate coverage.

• Network managers need to know what attacks are taking place in real time, so they can be prepared and focus their attention on the right warning signs and mitigations.

• End users need to know what the overall threat environment is on the Internet

Page 7: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

-

5,000

10,000

15,000

20,000

25,000

30,000

-

500

1,000

1,500

2,000

2,500

3,000

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1 2 3 4 5 6 7 8 9 10 11 12 13

June July

Cu

mu

lati

ve

Dai

ly

Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT)

Daily Attack Attempts New Machines Cumulative Unique Machines

Jun. 10 – Full Disclosure + PoC

Mid June– Researchers testing PoCs

Jun. 15– Limited exploitation

Example: Public knowledge of exploitation can motivate

faster deployment of mitigations

CVE-2010-1885

Jul 13 – Update released in MS10-042 Additional MMPC blog post to show increase in the threat environment and urge users to apply the update

Jun. 30 – MMPC blog post to inform users

about threat landscape and encourage use of

workarounds Late Jun.– Non-

discriminant exploitation

Page 8: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example: Coordinated disclosure helps the affected vendor prioritize the update

CVE-2011-0611

-

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

4 5

2011

Co

mp

ute

rs p

er

Day

Total Japan South Korea China United States

Apr. 11 – Adobe Advisory APSA11-02 Mila posts samples MMPC's receives

first public sample

Apr. 12 – MMPC signature released

Pastebin PoC Apr. 8 – First private

reports of exploitation (Mila

Parkour – Contagio)

Apr. 21 – Adobe Reader/Acrobat updates

Apr. 15 – Flash Player update

Page 9: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example: Real-world samples sometimes evade security product coverage

CVE-2010-3333

Endpoints Reporting Detections

Hotmail Detections

0

500

1,000

1,500

2,000

2,500

3,000

3,500

4,000

11 12 1 2 3 4

2010 2011

CVE-2010-3333

Late Dec.– MMPC noticed targeted attacks

Nearly all vendors missing attacks

Dec. 5– First

malicious sample

Nov. 9– MS10-087 update released Dec. 29 – MMPC Blog

post with hashes to help other vendors with

protection

Page 10: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

When to disclose exploitation?

• The hard part isn’t deciding whether to disclose, but when.

• Disclosure can happen in one of three ways: – Before disclosure of the vulnerability.

– In conjunction with disclosure of the vulnerability.

– After the vulnerability has been disclosed.

• Let’s consider each case…

Page 11: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Exploitation disclosure BEFORE vulnerability disclosure

Page 12: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Before

• Many breaches are disclosed without indicating whether or not a new vulnerability was involved.

– Breaches involving APT or other sophisticated attackers are often associated with 0-day vulnerabilities but this may not be explicitly stated to the general public.

– This isn’t terribly useful…

Page 13: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Before

• Saying “there is a bad vulnerability and people are exploiting it but we won’t tell you what it is” can create PANIC.

– People know there is a problem

– They don’t know what to do about it

– So they freak out…

Page 14: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Before

• Breaches disclosed with actionable information about what happened are helpful to security practitioners. – Pilots regularly read NTSB accident reports. Do most

IT security pros regularly read breach post mortums?

• Your mitigation advice might not be trusted if you aren’t planning to disclose the vulnerability in the future. – People have a legitimate need to know why you are

suggesting the mitigations you are suggesting, so that they can evaluate whether or not your mitigations make sense in their environment.

Page 15: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Therefore…

• It probably doesn’t make sense to disclose that a new vulnerability is being exploited BEFORE vulnerability disclosure unless some actionable advice can be provided.

• The more specific the advice, the closer this is to plain old vulnerability disclosure.

Page 16: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Exploitation disclosure IN CONJUNCTION with vulnerability

disclosure

Page 17: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

OK, we’re going to simultaneously disclose both the fact that a new vulnerability exists and the fact that it is being exploited in the wild.

The question is, when?

Page 18: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Immediately?

• Usually, if we knew about a new vulnerability, we’d wait for the vendor to release updates before disclosing it, but if exploitation is going on in the wild, that changes things.

• People need to know that they might be hit with these attacks.

• The bad guys already have the information, so

disclosing the vulnerability right away only helps the good guys, right?

Page 19: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Why Wait?

• The “bad guys” are not all working together!

• General publicity about a vulnerability without actionable information can attract more attackers to the opportunity.

• Scope of attacks can move from targeted to limited to broad.

Page 20: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Defining Exploitation Levels

• Real Exploitation can be…

– Targeted – Focused on a specific organization or perhaps a small collection of specific entities.

– Limited – Low in number, could be predominantly affecting one region or industry.

– Broad – Indiscriminate targets crossing geolocations

Page 21: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

0-day Examples

Page 22: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example: Publicity and PoC details draw attention to lucrative targets

CVE-2009-0658

0

10

20

30

40

50

60

70

0

1000

2000

3000

4000

5000

6000

7000

12 13 14 15 16 17 18 19 20 22 23 24 25 26 27 28 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

2 3

IBM

X-F

orc

e -

Exp

lloit

Att

tem

pts

MM

PC

- E

xplo

it A

tte

mp

ts

CVE-2009-0658 (Adobe JBIG2)

MMPC IBM X-Force

Feb. 19 - Adobe confirms JBIG2 vulnerability

Feb. 20 - PoC details released on a security blog

Feb. 13 - Reports of targeted exploits

Mar. 15 - IBM MSS notices spambot integration Mar. 18 - Adobe

Acrobat/Reader 7.x & 8.x updates released

Mar 10- Adobe Acrobat/Reader 9.x updates released

Page 23: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

0

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

9,000

28 29 30 31 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

10 11 12

CVE-2010-3962 Attack Attempts Computers Per Day by Target OS as of 12/8/2010 midnight GMT

Windows 7 Windows XP

Example: Coordination helps good guys. Exploit details may not (CVE-2010-3962)

Oct 28 – First report of targeted attack

Dec 14– MS10-090 update released

Nov 3 - Microsoft Advisory (coord. with Symantec) MAPP guidance

VUPEN PoC

Nov 9– News reports that exploit is integrated into Eleonore exploit

toolkit

Nov 5– Exploit-DB PoC

0

1,000

2,000

3,000

4,000

6 7 8 9 101112131415161718192021222324252627282930 1 2 3 4 5 6 7 8 9 1011121314151617181920212223242526272829

11 12

South Korea China Others United States

Page 24: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example: Quiet coordination for targeted attack may delay copycat attacks

(CVE-2011-0094)

• One reported target in Jan.

• All quiet until weekend before update

0

20

40

60

80

100

120

140

160

180

14 16 21 31 8 17 19 2 6 9 8 9 10 11 12 13 14 15 16 17 18 19 20 22 23 24 25 26

1 2 3 4

Co

mp

ute

rs p

er

Day

CVE-2011-0094 Attack Attempts

South Korea Others

Jan 10 – First report of targeted attack

Jan 11 – PoC posted to researcher website

Mar 14 – Murmurs in security research

community about IE 0-day

Apr. 12 – MS11-018 update released

Page 25: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Why Coordinate?

• The point of disclosing is to provide actionable advice to potential victims.

• Even if you can’t wait for a long time, the software vendor can help develop higher quality advice.

• The vendor is best positioned to ensure that the users of the product are informed about that advice.

• The vendor may be best positioned to ensure that the exploitation is real.

Page 26: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Real Exploitation is NOT…

• Researchers testing PoCs

• Unintentional exploitation

– Malformed packets

– Malformed documents

– Fuzzed files found to exploit the vulnerability

– Poorly-written code

Page 27: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example (Non-Malicious): the Unintentional Exploit

• “Exploit” was the result of bad code, didn’t execute code

• Paired with successful, but older vulnerability (update already available)

0

20

40

60

80

100

120

140

160

180

5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

1

Nitpik Daily Attacks and Unique Computers by

Geography

Brazil Others United States Attacks

Page 28: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Exploitation disclosure AFTER vulnerability disclosure

Page 29: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Hey, the vulnerability has already been disclosed, so disclosing the fact that exploitation is occurring can’t hurt, can it?

Page 30: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

If a fix is not yet available, reports of exploitation may draw attention to a vulnerability.

Page 31: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example (Non-Malicious): Researchers

• CVE-2010-3970

– “Public disclosure” of a vulnerability sometimes results in little or no exploitation because the disclosure wasn’t prominent enough.

– “If a tree falls in a forest…”

0

1

2

3

4

5

6

7

8

9

10

14 15 16 17 18 19 20 21 22 23 27 28 29 30 5 7 10 13 14 16 17 18 19 20 21 22 24 25 27 28 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

12 1 2

2010 2011

Co

mp

ute

rs P

er

Day

R

ep

ort

ing

On

e o

r M

ore

De

tect

ion

CVE-2010-3970 Dec. 14 – Disclosure

at Power of Community

Conference (Korea)

Dec. 23 – 28 Researchers (including MS

internals) testing PoCs

Feb. 8– MS11-006 update released

Page 32: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

When a fix IS available, coordination can help ensure that public reports make reference to the correct fix information.

Page 33: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Example: Coordination is beneficial even when vulns are well-known

• Analysis of security intelligence data revealed large spike

• Journalists had noted success rate of Java exploits in some toolkits

• Exploits were for known, updated Java vulnerabilities

• There is a need to include the right update information in exploitation reports.

Page 34: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Got a Workaround instead of a fix? Is it really actionable?

• Sometimes it makes sense to disclose a workaround when a fix is not yet available, in particular when exploitation is taking place.

• Consider – How easy is it for organizations of different sizes to

deploy? – Does it cripple functionality?

• If its hard to deploy or breaks something, some organizations won’t be able to deploy it.

• Premature disclosure could increase the risks faced by those organizations.

Page 35: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Conclusions

Page 36: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

When to disclose exploitation?

• Disclosure can accelerate exploitation.

• Disclosure is most beneficial when it is coupled with actionable information.

• The moment to disclose is when the benefit of attracting attention to that actionable information exceeds the harm of attracting attention to the opportunity represented by the vulnerability.

Page 37: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Balancing the Exploitation Disclosure Variables

– Vulnerability is known or unknown? – Availability of an update or workaround? – Is the workaround widely actionable? – Level of exploitation

• Targeted – Focused on a specific organization or perhaps a small collection of specific entities.

• Limited – Low in number, could be predominantly affecting one region or industry.

• Broad – Indiscriminate targets crossing geolocations

– Exploitation is confirmed malicious and not just a POC circulating

– Detection levels associated with circulating exploits

Page 38: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Computers Reporting Detections of Stuxnet and CVE-2010-2568 (CplLnk)

CVE-2010-2568

Stuxnet

0

1,000

2,000

3,000

4,000

5,000

6,000

7,000

8,000

9,000

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

July 2010

Jul 14 - VirusBlokAda contacts MS about shortcut 0-day

Example: Variables can be complicated CVE-2010-2568

Jul 16 - MS releases advisory and MAPP guidance for 2010-2568

Jul 29 - MS OOB update for shortcut vuln

Jul 26 - Shortcut vuln copycats escalate

Small numbers of Zlob-related .lnk exploits

Jan ‘09 - Jan ‘10

Page 39: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

General Guidelines for Exploitation Disclosure

These are general guidelines but the specifics of a particular situation may require different actions, particularly in cases where only a workaround is available and depending on how actionable that workaround really is.

0-Day (Vuln Unknown, No Update)

Known, No Update or Workaround

Known, Workaround available but no Update

Known, Update available

Targeted Coordinate and wait for updates

Coordinate and wait for updates

Coordinate and wait for updates

Coordinate, but don’t wait

Limited Coordinate and confirm it

Coordinate, maybe wait

Coordinate, maybe wait

Coordinate, but don’t wait

Broad Coordinate, but don’t wait

Coordinate, but don’t wait

Coordinate, but don’t wait

Coordinate, but don’t wait

Page 40: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Vendor coordination is always beneficial

• Talk to the affected vendor before you post – They may provide remediation and workaround information you

don’t have. – They can be prepared to provide guidance to their customers. – Your telemetry data helps prioritize updates

• Be patient – Some vulnerabilities can be difficult to remediate – There are many factors influencing prioritization of remediation – Vendors can build trust by

• Communicating the factors impacting their remediation schedule • Publicly crediting organizations who cooperate with them in

coordinating vulnerability and exploitation disclosure

Page 41: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

When you publish

– Put hashes (MD5, SHA1, etc…) of the malware samples you’ve seen in blog posts to help vendors with identifying samples and sample detection

– Avoid providing exploit details that might help copycat attackers

– Include the CVE or go back and add it later if it is not assigned at the time that you publish

– Reference the specific product updates or workaround information for the vulnerabilities in question

Page 42: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Call to Action

• If you are or work with researchers – Coordinate!

• If you were the target of an 0-day – Coordinate! (and urge any involved security vendors

to do the same)

• If you are blogging, writing, publishing details about exploitation – Coordinate!

– Include all the relevant details in your post (hashes, CVEs, availability of updates)

Page 43: Lessons Learned: Can alerting the public about ... · Microsoft Malware Protection Center Attack Attempts on CVE-2010-1885 as of midnight July 13, 2010 (GMT) Daily Attack Attempts

Thank You

• Questions?