Doha - 19/08/2014 Alessandro Scarafile Field Application Engineer Lorenzo Invernizzi Field Application Engineer Emad Shehata Key Account Manager Key Account Manager
The Building Blocks
Remote Agent Secure Frontend Scalable Backend Infection Vectors
Complete solution, not a toolkit Totally developed by us
Remote agent Your personal 007
What can we collect?
Camera Messages Chat Microphone Contacts Calendars Calls Location Keystrokes Documents Passwords Visited websites And much more…
Runs on an event-driven logic Autonomous
Events When crossing the border Every day at midnight On hidden SMS On voice call Actions Start microphone recording Destroy the device Send collected data Take a camera snapshot
Many different events and actions Combine them to suit your needs
What if my target is security aware?
Invisible to target user Invisible to antivirus and anti-rootkits Anti-forensic measures
Evidence on remote device How can we collect it?
Internet connection Firewalls and proxies are passed through
WiFi Open and saved networks
GPRS / UMTS / 3G+ Avoid billing the target with custom APN
Where can I install the Agent?
Secure Frontend An invisible barrier
Agent is connecting to your servers Your identity must be kept secret
Configurable on-the-fly Evidence stays encrypted
Scalable Backend Your data vault
Scalable by design
Agents Collector Database x 300
Database Shard 1 Shard 2 Collector 1 Collector 2 Agents … … Collector N … … Shard N x 10000
Scale when you need Adding servers is transparent Load balancing is automatic
No database administration required Set & Forget backups Fast restore in 5 minutes
Real-time alerting Be informed on interesting events
Polished graphical console The whole system from a single point
Infection Vectors Deploy your forces
How can I deploy my agent?
When the target opens a document
0-day exploits pack Always up to date
While the target browses the web
Inject into downloaded applications Inject into web pages
Bob’s laptop Web site Internet Network Injector
Send your target an SMS
And many more…
Third-party Integration Combine your weapons
Easily integrate with your monitoring center
Demo time!