Endpoint security is where it all starts. The client is the target most attackers go after. Once you have access there (let’s say by emailing cute cat videos), you are in. Compromised systems are the daily routine of information security. Even without contact with the outside world, you have to think about what happens next. Thomas Fischer has thought a lot about scenarios concerning the endpoint, and he presented his findings at the DeepSec 2015 conference. To quote from the talk: This presentation will demonstrate that one of the most complete sources of actionable intelligence resides at the end point, and that living as close as possible to Ring 0 makes it possible to see how a malicious process or party is acting and the information being touched. There you go. Have a look!
The information technology world is full of fancy words that re-invent well-known and well-understood terms. Everyone is talking about the endpoint these days. Endpoint is the trusty old client in disguise. Plus the end in endpoint doesn’t means that something ends there. From the information security point of view all your troubles actually start there. So the client is the start of all your endpoint problems. Why? Because attacks start at the endpoint, regardless how you call it. At DeepSec 2015 Matthias Deeg held a presentation on how malicious software (a.k.a. malware, the good old virus/trojan horse/worm) can deactivate endpoint protection software (a.k.a. anti-virus software) in order to turn your endpoint into a startpoint. Enjoy!
Your infrastructure is full of endpoints. Did you know that? You even have endpoints if you use your employees’ devices (BYOD!) or the „Cloud“ (YMMV!). Can’t escape them. Since the bad girls and guys knows this, they will attack these weak points first. How are your endpoints (a.k.a. clients in the old days) protected? In case you use software to protect these vulnerable systems, then you should attend Matthias Deeg’s talk. He will show you the art of Deactivating Endpoint Protection Software in an Unauthorized Manner: Endpoint protection software such as anti-virus or firewall software often have a password protection in order to restrict access to a management console for changing settings or deactivating protection features to authorized users only. Sometimes the protection can only be deactivated temporarily for a few minutes, sometimes it