Qualys Vulnerabilities, Statistics and… Malware ? Wolfgang Kandek CTO Qualys, Inc. http://null.co.in/ http://nullcon.net/ http://nullcon.net/

Qualys Basics Founded to automate Vulnerability Assessments Software as a Service (SaaS) with: Internet based shared scanners Scanner Appliances for internal scanning Webportal for data access http://nullcon.net/ http://null.co.in/

VIP 2-factor or Client certificate strong authentication options http://nullcon.net/ http://null.co.in/

VIP 2-factor or Client certificate strong authentication options http://nullcon.net/ http://null.co.in/

Qualys Basics Founded to automate Vulnerability Assessments Software as a Service (SaaS) with: Internet based shared scanners Scanner Appliances for internal scanning Webportal for data access 270 employees (140 in Engineering) 5000+ customers http://nullcon.net/ http://null.co.in/

http://nullcon.net/ http://null.co.in/

IDC 2011 Report http://nullcon.net/ http://null.co.in/

Frost & Sullivan 2010 Report Frost & Sullivan: Vulnerability Management Market Leadership Report - Nov 2010 http://nullcon.net/ http://null.co.in/

Laws of Vulnerabilities 2004 - 3M IPs scanned, 2M vulnerabilities Half-life – 30 days Prevalence – 50 % renewal annually Persistence – unlimited for some Exploitation – 80 % available with 60 days 2009 - 80M IPs scanned, 680M vulnerabilities, 72M+ vulnerabilities of critical severity http://nullcon.net/ http://null.co.in/

Laws of Vulnerabilities Half-Life = 29.5 days http://nullcon.net/ http://null.co.in/

Laws of Vulnerabilities 2004 - 3M IPs scanned, 2M vulnerabilities Half-life – 30 days Prevalence – 50 % renewal annually Persistence – unlimited for some Exploitation – 80 % available with 60 days 2009 - 80M IPs scanned, 680M vulnerabilities, 72M+ vulnerabilities of critical severity Difference by OS and Application http://nullcon.net/ http://null.co.in/

Laws of Vulnerabilities 12 http://nullcon.net/ http://null.co.in/

Laws of Vulnerabilities 13 http://nullcon.net/ http://null.co.in/

New Services Policy Compliance Web Application Scanning Configuration checks Password length, installed SW, access rights 20 technologies, 2000 controls Web Application Scanning Web Application Catalog Batch oriented production scanning http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection Scanner Browsercheck – Light-weight, end-user VA IronBee – Web Application Firewall SSL Labs – World-wide SSL usage statistics Dissect – Malware Exchange/Analysis Portal HoneyNet Research Portal http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter Fingerprint common web applications by analyzing source code Blogs, Forums, Wikis, etc http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter Fingerprint common web applications by analyzing source code Blogs, Forums, Wikis, etc Goals: accuracy, speed, low resource usage Results http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter 1 Million “.com” domains http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter http://nullcon.net/ http://null.co.in/

Blind Elephant Web App Fingerprinter Fingerprint common web applications by analyzing source code Blogs, Forums, Wikis, etc Goals: accuracy, speed, low resource usage Results Available at: blindelephant.sourceforge.net http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection System http://nullcon.net/ http://null.co.in/

Neptune Malware Detection System Visit/crawl web site with: Virtualized Machine Vulnerable, but instrumented OS Vulnerable, but instrumented Browser Configuration VMware Internet Explorer 6 on Windows XP Detours + Custom Hooks Log everything Detect malicious intent early, avoid infection http://nullcon.net/ http://null.co.in/

Neptune Malware Detection System Static Detection Analyze inputs for known exploit patterns, signature based Pro: efficient and fast, signatures easily updated and shared Con: false positives, defeated by obfuscation, known threats only Behavioral Detection Monitor the browser process, check for anomalous activity Pro: false positives low, immune to obfuscation and detect new threats Con: success required, false negatives, expensive Reputation and AV checks (pluggable: Google, Trend) http://nullcon.net/ http://null.co.in/

Neptune Malware Detection System UI version Focus on end-user, website owner Daily scheduled scans, alerts http://nullcon.net/ http://null.co.in/

Neptune Malware Detection System UI version Focus on end-user, website owner Daily scheduled scans, alerts http://null.co.in/ http://nullcon.net/

Neptune Malware Detection System UI version Focus on end-user, website owner Daily scheduled scans, alerts API version Focus on bulk user, integration, research Single URLs, Maps, or site with crawling http://nullcon.net/ http://null.co.in/

Neptune Malware Detection System UI version Focus on end-user, website owner Daily scheduled scans, alerts API version Focus on bulk user, integration, research Single URLs, Maps, or site with crawling Available: qualys.com/stopmalware Contact: pthomas@qualys.com for API access http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection Scanner Browsercheck – Light-weight, end-user VA http://nullcon.net/ http://null.co.in/

BrowserCheck https://browsercheck.qualys.com Security check for Browsers and Plug-ins End user focus, free and easy to use http://nullcon.net/ http://null.co.in/

BrowserCheck http://nullcon.net/ http://null.co.in/

BrowserCheck https://browsercheck.qualys.com Security check for Browsers and Plug-ins End user focus, free and easy to use 200,000 visits – Jul 2010 / Jan 2011 IE, Firefox, Safari, Chrome, Opera Windows, Mac OS X and Linux http://nullcon.net/ http://null.co.in/

BrowserCheck http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats Operating System: Browser: Plug-in: ? Country: Windows XP – 47 % Windows 7 – 32 % Browser: IE 8 – 36 % Firefox 3.6 – 34 % Plug-in: ? Country: http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

BrowserCheck Stats http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection Scanner Browsercheck – Light-weight, end-user VA IronBee – Web Application Firewall http://nullcon.net/ http://null.co.in/

Ironbee – Web App Firewall Open source effort led by Ivan Ristic Author of mod_security WAF technology renewed Focus on accuracy and usability WAS and MDS (neptune) integration Available at: www.ironbee.com SSL Labs – SSL usage statistics V2 is coming http://ssllabs.com http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection Scanner Browsercheck – Light-weight, end-user VA IronBee – Web Application Firewall SSL Labs – World-wide SSL usage statistics Dissect – Malware Exchange/Analysis Portal http://nullcon.net/ http://null.co.in/

Dissect – Malware portal Led by Rodrigo Branco - www.kernelhacking.com Team in Brazil, Malware and Vulnerability Research Malware exchange system up and running Malware analysis in alpha Static analysis Runtime analysis on virtual and real machines Integration with Neptune MDS coming in Community oriented effort Contact: rbranco@qualys.com http://nullcon.net/ http://null.co.in/

New Research Activities Blind Elephant – Web Application Fingerprinter Neptune – Malware Detection Scanner Browsercheck – Light-weight, end-user VA IronBee – Web Application Firewall SSL Labs – World-wide SSL usage statistics Dissect – Malware Exchange/Analysis Portal HoneyNet Research Portal http://nullcon.net/ http://null.co.in/

Honeynet Nemean Networks acquisition University of Wisconsin research team Paul Barford - http://pages.cs.wisc.edu/~pb/publications.html Honeynet/Signature/IDS system Global Honeynet Effort Centralized Signature generation – open-source Snort/Suricata plug-ins – open-source http://null.co.in/ http://nullcon.net/

Contacts Wolfgang Kandek – wkandek@qualys.com Amit Deshmukh – adeshmukh@qualys.com http://nullcon.net/ http://null.co.in/