An inconvenient Zeus: The rise of Saas targeted malware
Talkat AppSec California 2014 · on Monday, 2014-01-27· at 11:45· Track 1, Annenberg Community Beach House, East Pacific Coast Highway·
summary
A new Zeus variant targeting Salesforce sits dormant on unpatched home machines waits for the user to log in then piggybacks the session to scrape records and uploads exfiltrated data to Dropbox, leaving no Salesforce log of the theft. A second exploit steals Office 365 tokens by masquerading as SharePoint, giving persistent access without code execution. Demonstrations show tools work in the wild and vendors patch after coordinated disclosure.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:23SaaS has become mainstream
- 3:42SaaS is a new attack vector
- 5:10Thought experiment: your inner SaaS organization
- 8:31Attack 1: The landmine attack A Zeus malware targeting SFDC Plant landmine - Attack vector was unmanaged unpatched pc, belonging to employee's spouse. A Zeus malware was installed on the
- 13:02Zeus for SFDC: Demo
- 14:41Attack 2: The Ice Dagger attack
- 19:08The Ice Dagger attack: Demo
- 21:09What makes it so easy? (2)
- 23:38The rise of SaaS targeted attacks
related talks
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
27mSalesforce Snafus: Unveiling and Exploiting Security Misconfigurations Using ...
52mLessons Learned from the Summer of Supply Chain Attacks
44mWhen you can't afford 0days: Client-side exploitation for the masses
47mPain in the Apps — Three Attack Scenarios Attackers Are Using to PWN SaaS
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks