3 ms·

There are so many mitigation techniques out there to protect against any execution takeover attacks.. and I wonder how exploiters survive through them. I forec

There are so many mitigation techniques out there to protect against any execution takeover attacks.. and I wonder how exploiters survive through them. I forecast it would get impossible to hack a personal computer in 10 years. Maybe there would be some vulnerability left on IOT devices

badrabbit 7y ago
I have to disagree with that. In my experience, attackers have been relying much less on exploits. A software exploit is one "initial access" tactic , there are those that use target exploits, zero-day exploits and most commonly exploit kits but setting those aside phishing is the number one technique, web driveby downloads are common too (e.g.: "flash update for your pc" ) in other words social engineering attacks, there are also logical flaws,misconfigurations, bad architecture (e.g.:rdp is exposed on the intranet and it so happens another compromised host can reach the computer). Let's say you have really good security hygeine, apps and sites are whitelisted, no exploits are possible, things can't execute from removable drives,etc... What happens when someone you know sends you an email containing a link to a whitelisted service (say onedrive,dropbox,etc...) and that link downloads a zip file with a malicious jar,javascript,mshta,macro enabled document basically any thing that uses a whitelisted app to run some code? Let's say your email security is top notch, are you gonna ban peoplr from accessing their personal email? Let's say you do,what if a whitelisted site has XSS used to inject JS that tells the user "you need to download and install this font to view this site" (something I have seen) even if you whitelist everything there are bypass techniques,code signing certs get compromised, a new technique to use some existing known app to run code may exist,etc... I think initial access will get a lot more difficult but not impossible. Up to the point someone can run code,it will be very difficult to lock down well,but there is a lot that is being done to harden systems and monitor events to catch when someone does something afterwards. I personally think endpoint software and technology continues to get more and more complicated. I can see big companies being resilient to many types of attacks but consumers in general are too denseless. Take something as simple as a usb worm, a company might make a calculated decision to block usb exexution but what laptop will ship with that turned off? A windows shortcut (lnk) running a whitelisted executor will continue to be abused for at least 5 more years but I dare not speculate as far as 10 years.

badrabbit 7y ago

I have to disagree with that. In my experience, attackers have been relying much less on exploits. A software exploit is one "initial access" tactic , there are those that use target exploits, zero-day exploits and most commonly exploit kits but setting those aside phishing is the number one technique, web driveby downloads are common too (e.g.: "flash update for your pc" ) in other words social engineering attacks, there are also logical flaws,misconfigurations, bad architecture (e.g.:rdp is exposed on the intranet and it so happens another compromised host can reach the computer). Let's say you have really good security hygeine, apps and sites are whitelisted, no exploits are possible, things can't execute from removable drives,etc... What happens when someone you know sends you an email containing a link to a whitelisted service (say onedrive,dropbox,etc...) and that link downloads a zip file with a malicious jar,javascript,mshta,macro enabled document basically any thing that uses a whitelisted app to run some code? Let's say your email security is top notch, are you gonna ban peoplr from accessing their personal email? Let's say you do,what if a whitelisted site has XSS used to inject JS that tells the user "you need to download and install this font to view this site" (something I have seen) even if you whitelist everything there are bypass techniques,code signing certs get compromised, a new technique to use some existing known app to run code may exist,etc... I think initial access will get a lot more difficult but not impossible. Up to the point someone can run code,it will be very difficult to lock down well,but there is a lot that is being done to harden systems and monitor events to catch when someone does something afterwards. I personally think endpoint software and technology continues to get more and more complicated. I can see big companies being resilient to many types of attacks but consumers in general are too denseless. Take something as simple as a usb worm, a company might make a calculated decision to block usb exexution but what laptop will ship with that turned off? A windows shortcut (lnk) running a whitelisted executor will continue to be abused for at least 5 more years but I dare not speculate as far as 10 years.