hello everyone
it's a pleasure to be here welcome to my
temporal blue team village weather
studio
um in the next 30 minutes i'll be
sharing with you
what we all thought would happen in 2021
every year and more specifically the
beginning of each year a lot of
companies publish their understanding of
what they believe will happen in the
upcoming 12 months
this includes vendors consultancy firms
etc
and today i'm going to share with you
what happens if you do a meta-analysis
on
all these understandings verified
against the present
and a personal outlook for the second
half of
2021.
i've been doing these analysis for a
long time
yet mostly for clients to support them
in either their security program
develop their threat management
capability or create threat scenarios
for them to actually test
now for me this has been very useful
and i basically take all this published
content
and actually think about how i can make
better assessments on using new upcoming
future risk or threat scenarios
so that being said you know let's let's
dive into it a bit more
so when we're doing when doing this
analysis
three main elements came up the first
one is there
you know there's all sorts of forecasts
and predictions each year
but is it any good is it on point the
second thing i
actually thought of was when folks
create these products how are they
created and more importantly how can
these products influence our thinking
about risk and threats to our
organization
thirdly are there any surprises let me
be clear
no there are no surprises in specific
themes or topics
what was interesting though is how
publishers delivered and emphasized
everything
we will dive into these three data the
goal of this exercise is basically
first of all changes the norm folks have
to do with predictions
and second provide in-house teams
some guidance on how they can deal with
this
now before we get into those details
just an example
mostly because things are shown in front
of us that's what we know that's what we
care about that's what we think about
and if you have
for example if you have certain network
telemetry but like host based telemetry
then your view and priority will mostly
be dictated by that
this then translates into budget and
eventually can lead you having a limited
understanding of
other risks or areas of risks that are
outside of your
viewpoint and i will refer to this
metaphor
a couple times throughout the
presentation
first of all i would like to introduce
you to the concept of forecasting
technically speaking forecasting is the
process of making predictions
based on past and present data and most
commonly by analysis of trends
now prediction is something else it's
basically the process
of estimating outcomes of unseen data
and forecasting is just a sub-discipline
of prediction
but why would you bother about
forecasting since we all have thousands
of things
to do right now well this goes a long
way to help you shape your response
strategy in the face of an uncertain
future
an example could be being prepared for
specific ransomware trends
or preemptively checking your supply
chain
it will help you answer not just you
know the why and the how and what
questions but it will also help you
shape the answers to the when question
finally there's also the concept of
super forecasting and this comes from a
great study performed by philip e
tedlock
various others i simply said that a lot
of people do forecasts or specific
questions
and there are some people that excel
basically performing better than a
random selection
aka a dart throwing chimp and he
explained i explored
why now there are multiple interesting
pieces to this study
um besides the monkey of course
one of the outcomes was that the average
of everyone's forecast was generally
true
and this inspired me to do a little
experiment on what everyone thought that
would happen
in 2021
so once you think about an experiment
you
also think about the analytical
techniques and it's basic it's important
to understand the basics of forecasting
analysis
basically you have two types a
qualitative and a quantitative type
quantitative breaks into time series and
causal models
where time series are trend lines we all
recognize
and causal models represent complex
complex models
for which can for example compute
which compute where rain is going to
fall
now a qualitative approach emphasizes
the human telling what's up
and this is what we're going to be
focusing on
so the experiment so if you're
interested in the details reach out to
me
through the contact details on the last
page happy to discuss this
the essence of what i did was i grabbed
all the thread prediction third
landscapes
i could find through open sources in q1
321
i did the same thing for q2 i analyzed
it based on recent events
and assessed what direction the next
half 2021
will take and full disclosure
there was so much to unpack and too much
to unpack
that i basically kept it to the most
impactful components
now let's get into some of the details
i've broken it down into four main
topics publishers document
themes and topics
first of all i looked into 44 unique
pieces
that's documents and articles it's
important to note that i
found four that were actually released
before 2021 and i excluded them from
the upcoming contents and slides you
will see
most of them were reports published in
q1
and the highest release moments were
january and april
and of the total 67 percent was a report
and the remainder online articles all of
them accumulating to a whopping 1100
pages
smallest was two pages the biggest one
22
and with an average of 27.5 pages per
document
it was a lot of documents a lot of pages
some interesting things that popped up
on my end
only 10 incorporated might attack
framework this actually told me
something about
how actionable a certain report or
fender actually is or at least the
content they produce
twenty percent of that includes explicit
forecasts
and this usually tells me what are the
parties that are looking ahead
and thinking about the future 45 percent
used proprietary
telemetry as far as i could actually dig
up
and the remainder basically applied
expert analysis
finally 49 of all the con the documents
and
articles i reviewed build their piece
with
explicit company and service marketing
now when comparing all these documents
it seems like publishers sometimes have
an identity crisis
most of the content is used as marketing
and sometimes they want actually
a full-fledged research paper you know
in essence this is also visible
in the average structure they differ
across all documents
with pros and cons to various topics one
can add in
just breaking them now first of all you
know
everybody understands that these kind of
products are actually marketing and this
is okay
but just remember to keep your third
landscape factual
keep marketing separate from any
produced intelligence value
i'd like to hear your take not your
pitch second observation focuses on
creativity more creativity can be put in
structuring your messaging
it doesn't have to be the good old
academic paper approach
and a great example of that is the
verizon's
where data is at large and tone of voice
is at times comical
and this makes reading a joy in my
opinion
i know obviously also incorporate time
stamps in your documents
white papers and blogs without dates and
citation info
makes it very difficult for researchers
to track that
thirdly machine readable text structure
text versus unstructured text
well this is actually an uncharted
territory for most and examples of that
could be
the area of attack framework or
sticks-enabled
document structures this is actually one
of the areas i'm looking into to develop
that further
all right to be honest i haven't figured
out the answer quite yet myself
finally the use of forecasting language
most companies look back but one do we
look forward
isif's threat horizon report is an
excellent example how one can do this
i believe this is the area where you see
the most differences in themes and
topics
and mature and the maturity of the
threat intelligence teams
another element obviously of mature
third intelligence teams
is that they will also do a recap of
their anticipatory statements
to continuously improve and adjust which
gives in my opinion them massive street
creds
and the final tip ties into the
last point as well
so first of all it's good to mention
that i made the distinction when diving
into
the content between themes and topics
themes are more or less overarching
concepts where topics are
well topics the dominant themes
give no surprises all of them are on
point
per the first half check we've all seen
them by the way i think
the outlier themes or the themes that
are not as vocal as others
that's where the differences were an
example
is iot that was certainly a thing
combined with botnets and ddos
one thing i actually missed this year
was the hardware and processor
discussions
for example in addition to that macos
security is not a theme as well
that is being vocalized often and the
same goes for
5g and artificial intelligence
both concepts which are regularly in the
news but not yet manifested itself in
the mainstream
yet
now if we look into specific topics the
five most reference topics
mostly imperial in front of us are
ransomware phishing
the supply chain vulnerabilities and
details
let's take a quick look into all of them
before i start same as a weather
forecast i'm looking at the moment of q1
as the reporting on monday our check
today is wednesday
and the end of the year is saturday
saturday is my personal analysis a cyber
weatherman
for the next half based on the check
done today
obviously this will come to no one as a
surprise
we had major runs from berenson globally
and in addition
we saw an increase to take down the big
players
biggest change to me was that ransomware
finally became a topic of geopolitics
now for the rest of the year i believe
we will witness a small activity drop
over the summer
following the the legislative crackdown
an actress will pop a backup in q4 once
the new status quo has been established
and they know what they can and can do
as two evolutions
and techniques and procedures i'm
anticipating one being victim pressuring
this could for example be double
extortion
social media naming and shaming and ddos
all designed to pressure victims into
paying more and
faster second thing
which is actually something that has
been done in the last 20 years and that
was the ability for malware to evade
defenses
i think this we can surely expect this
to still be the case
and one pro tip i'd like to highlight
here
is the the use of the so-called cis
keyboard layouts and these reference
languages of the former sovereigns
soviet states basically off-limits to
most eastern
europe-based groups once malware hits
pcs with these layouts
it doesn't detonate and there's actually
a fun article from brian krebs
where he explains this concept and
obviously
tying back to my forecast in good
fashion of the evolution of defensive
agent we will then probably see more
creators start integrating time and look
at
english
number two was social engineering
through phishing
and what we like to call business even
compromise bc
phishing subjects have always been what
is trending at the point in time
for now it's coveted in cryptocurrency
who knows what's next
i mean this was pretty consistent for
the first half and it will probably be
so for the next half
we saw vendors responding to new trends
faster
an example for that is the use of these
fishy microsoft authentication emails
that was actually quickly shut down by
additional authentication methods
despite it all uh macro enabled
documents and zip files
consistently state the main source of
problems
and i believe we will not see a fishing
drop it is just
too effective and we will become it will
just become more and more refined
in addition i also believe that cross
medium integrations will occur
for example pretexting through something
like whatsapp
finally specifically for
business email compromise the dex are
expected to be become a bit more
sophisticated
and for example targeting group
mailboxes to construct
changes of payment details
and i think it's safe to say that
ransomware and this and
phishing slash visit email compromise
are still
the industry's two biggest problems
i'm always surprised actually about this
one the supply chain compromise
especially about volks referencing
supply chain compromises as something
new
this technique was around when i was in
diapers and it will probably exist until
i'm not there anymore
most interestingly major service
providers got hit in the first half and
cloud providers
have been at the crosshairs continuously
that being said
we haven't seen any uh the latest uh
we haven't seen the latest of this big
instance
this will continue to happen and
i'm expecting this to also appeal to the
geopolitical theater
now one element that actually doesn't
get a lot of attention is the
non-technical aspect of gaining initial
access
you really don't need a comprehensive
targeting program when you can just
course people
into clicking a link right by paying
them or
finding them nothing sophisticated about
that
let's see if we see some more on that
vulnerabilities right when it rains it
pours and this is unfortunately the same
for our friends at microsoft
when his vulnerabilities dominated the
last six months with the exclusion of
some vpn
basically anything remote work centric
vulnerabilities
the essence appears to reside in
vulnerabilities in older versions of
windows
which are then weaponized in modern
versions
and this will most likely not change
all this media attention however does
deflect from
security of other voices like mac os
linux
etc another big thing
to keep an eye out on is the new chinese
regulation for vulnerability disclosure
just putting it out there
this regulation forces chinese
researchers to first share
vulnerabilities with the mss
with all consequences you can think of
this is a very in my opinion concerning
development
for our friendly chinese vulnerability
researchers
and finally we have ddos to me ddos came
actually as a surprise when analyzing
the keywords of all the as part of the
meta analysis
but the conclusion today is quite simple
this is still a valid technique in the
arsenal fair the pandemic and the role
of card services needed for work i've
made us vulnerable to peak flooding
and remember that time when slack was
down oh boy
i'm going out on the limit and forecast
that we will see more than 10 million
details attacks this year
and i'm expecting new innovations that
will lead to more effective targeting
thus you know that being more refined
and at this point in time ddos extortion
for example is not the whale
machine and it is that it could be but i
can imagine
people can do that
so that being said these are the five
topics
which are most referenced
now what happens if you take all top
fives threes etc and put that in a chart
then you get something like this what
you see on screen basically what
everyone is thinking
in a chronological order there's a
couple of interesting highlights
the first one is that initial access is
consistent with the main topics we
identify
phishing supply chain vulnerability
expectation
the second is that once inside droppers
take care of dropping
additional malware this could be in for
steelers trojans or ransomware
third one is that ransomware is more
often deployed
at the end of the compromise when the
trojans are in place
the actions on objectives have been
fulfilled for example asks for trading
that
confidential information and the fourth
is the crackdown of law enforcement that
is also clearly visible in this order
my compliments go out to all the people
working day at night to stop this misery
now what makes these kind of overviews
useful in my opinion is that you can
leverage this understanding to prepare
your circuit
program so are we sufficiently equipped
to combat
remote accessories yes so let's check
that
another example could be how well
equipped are we to identify the fan
favorite cobalt strike activity
let me know what you think about this
now there's a couple other themes and
topics
uh you you should be monitoring which
are not let's say
in front of everyone first one is that
risk is great everybody says the overall
risk is becoming greater every year i'm
seeing this area
i think this is [ __ ] they're just
movements
challenge every vendor that tells you
this so for example
the over dominance of ransomware and
phishing articles
does that actually align with real world
activity
in this case it probably does but the
point is to do the work
sometimes forks need a fresh angle which
they didn't think
of another theme is the evolution of
crimeware
especially the business behind that so
imagine this you know
these are the kids that
were growing up in the zeros
excuse me so these are the kids that are
growing up for the zeroes um
who otherwise could have been successful
internet entrepreneurs
unfortunately they now took the dark
route and i think this conversation on
crime drives profit and attracts talent
so we're you know i'm expecting nations
to
further collaborate join forces share
resources to target common enemies
also considering victim vetting and
service modularity
even heard somebody say the dirty word
an apex third actor oh boy
now run for a treat right another
element
to consider is the role of western bias
in arthur landscapes
primary adversaries china iran russia
and north korea
well the east says no it's us it's
israel
the reality is that most countries
actually have developed
powerful capabilities not to mention
foreign versus domestic
actor groups
now we also have the macos based threats
and in the next half
we might even see the development of the
first ever malware to take advantage of
linux visualization streamlined on mac
computers running apple silicon and the
big sur
who knows and finally we have another
big one
is the winner's high ground and what i'm
what i'm saying trying to say with that
is the dominance of the windows terrain
has a big impact on everyone's
landscape mostly the windows user base
and that drives security research
obviously into new attack factors
in that majority and as also
demonstrated by
the recent exchange vulnerabilities but
also the new features
announced related to android signal some
interesting discussions
now if we have some specific topics uh
to
to monitor one the first one could be
um the focus on the old we mentioned
earlier that the research that goes into
old versions of windows and this is a
big thing
another big thing yet simple is attack
web applications between these simple
attacks
but apply a small number of steps or
additional actions after the initial web
application compromise
for extortion we can expect a continued
emphasis on normal extortion attacks
a cri you know this is a low-cost effort
with moderate high return basically a
criminal
sweet spot and it could tie into ddos
could tie into ransomware we could see
it everywhere
third one is dns focused attacks you
know even our phone book should be
considered
one example can be dns over https as
attack factor
everybody's talking about that for use
and even influencing dns is the thing
for use
and for some reason this is pushed again
and i'm actually curious if this is part
of one of the trends i've been seeing in
recent years
that actors move back to the perimeter
because
hosts are sufficiently locked down
now in terms of browser injection
more code has become more flexible than
ever and is able to reach further into
the attack surface
one malware campaign get a wide focus
across different devices platforms
a specific mower for example and
controlling hundreds of thousands of
domain
and the malware itself performs browser
injections in order to seat malicious
search results in the browser once it is
affected
and once you load a minish dll extension
this is essentially game over
and what people don't realize is that a
lot of edge device is also a browser
right
finally we have wire driving uh yeah you
know the the topic we talked about
five to ten years ago well right now it
never been so easy
and commoditization has spurred
solutions that simplify this process
and what is interesting is that you
don't have to build it yourself anymore
yes i know this is what everyone does um
but it evolved from just wifi to also
bluetooth
so traditional skimmers get an upgrade
that allows for more effective
collection of
sensitive information probably see
something more on that
so next steps on my side
first of all i will do this exercise
again by the end of the year
it will be interesting to compare what
people put out there and
if they saw the lessons of this talk
and i will explore more automatic
analysis of reports
maybe me and some friends will hold up
the old algorithm
who knows and it would be really cool if
we can get to some sort of
machine readable format i'm thinking
json sticks
tagging something like that and this
would allow for more
comparison and making everyone's
precious time more effective
finally i'm also a big fan of scenario
creation and more importantly testing of
that
and to determine the actual risk
and i'm anticipating that the industry
can also play its part
in enabling this test the scenario
philosophy
and one good example is for verizon dvr
which includes some specific scenarios
which folks can look into
so concluding the average of what
everyone thought
was on point hypothesis
check and for the in-house teams i have
three main takeaways
one is that basic security hygiene
obviously combats
pre-compromised behavior prepare for the
post-compromise behavior
thirdly report on forecasting however
you can
more specifically what you expect to
happen soon what is happening
right now and what do you think about
the gap between the two
what about the vendors well i want to
challenge all the vendors
to think more in terms of creativity
we will hate you we will not hate you
for trying something new innovative
and fail what what people just don't
like
is complementary marketing briefings
people will reach out to you either way
and finally and most importantly make
actual forecasts instead of the easy
topic x we'll be going trending soon
don't be that
dark throwing infosec
well special thanks to the folks who
helped me create this presentation
i really enjoyed it it was my pleasure
to speak at the blue team village
to wrap it up my contact details are
listed here
and if you're up for custom weather
forecasts or just want to hang out
reach out also the reports
reviewed in this research are uploaded
to my github
the link can be found in the visual
cheers everyone
bye