Quantitative Security Colorado State University Yashwant K Malaiya - PowerPoint PPT Presentation

Quantitative Security Colorado State University Yashwant K Malaiya CS 559 Vulnerability Life Cycle CSU Cybersecurity Center Computer Science Dept 1 1

Topics • Vulnerability Life Cycle • Vulnerability Discovery models 2

Vulnerability Lifecycle Exploit code (“exploit”) : usually available after disclosure 3 3

Timeline Attack timeline. These events do not always occur in this order, but ta > tp ≥ td > tv and t0 ≥ td. • The relation between td and te cannot be determined in most cases. For a zero- • day attack t0 > te. Before We Knew It An Empirical Study of Zero-Day Attacks In The Real World 4

Vulnerability Lifecycle Vulnerability introduced . A bug is introduced in software (time = t v ). • Exploit released in the wild. Actors in the underground economy discover • the vulnerability, create a working exploit and use it to conduct stealth attacks against selected targets (time = t e ) Vulnerability discovered by the vendor. The vendor learns about the • vulnerability, assesses its severity, assigns a priority for fixing it and starts working on a patch (time = t d ). Vulnerability disclosed publicly. The vulnerability is disclosed, either by the • vendor or on public forums and mailing lists. A CVE identifier (e.g., CVE- 2010-2568) is assigned to the vulnerability (time = t 0 ). Anti-virus signatures released. Once the vulnerability is disclosed, anti-virus • vendors release new signatures (time = t s ), Patch released. On the disclosure date, or shortly afterward the software • vendor releases a patch for the vulnerability. After this point, the hosts that have applied the patch are no longer susceptible to the exploit (time = t p ) Patch deployment completed. All vulnerable hosts worldwide are patched • and the vulnerability ceases to have an impact (time = t a ). 5

Stochastic Modeling For a single vulnerability, the cumulative risk in a specific system at time t can be expressed as probability of the vulnerability being in State 3 at time t • multiplied by • the consequence of the vulnerability exploitation. • Joh and Malaiya, "A Framework for Software Security Risk Evaluation using the Vulnerability Lifecycle and CVSS Metrics" 2010 6

Zero-day attacks • A zero-day attack is a cyber attack exploiting a vulnerability that has not been disclosed publicly. • There is almost no defense against a zero-day attack: while the vulnerability remains unknown, the software affected cannot be patched and • anti-virus products cannot detect the attack through signature-based scanning • Notable zero-day attacks include (Bilge, Dumitras) • • the 2010 Hydraq trojan, also known as the “Aurora” attack • the 2010 Stuxnet worm, which combined four zero-day vulnerabilities to target Exploit code (“exploit”) : usually available after disclosure industrial control systems and • the 2011 attack against RSA. • 7 7

Zero day attacks • Source: Leyla Bilge and Tudor Dumitraş. Before we knew it: an empirical study of zero-day attacks in the real world. In Proceedings of the 2012 ACM conference on Computer and communications security (CCS '12). ACM, New York, NY, USA, 833-844. 8 8 September 29, 2020

An Empirical Study of Zero-Day Attacks In The Real World • Field-gathered data for 11 million real hosts around the world. • Searching this data set for malicious files that exploit known vulnerabilities indicates which files appeared on the Internet before the vulnerabilities were disclosed. • They identify 18 vulnerabilities exploited before disclosure, of which 11 were not previously known to have been employed in zero-day attacks. • They also find that a typical zero-day attack lasts 312 days on average • After vulnerabilities are disclosed publicly, the volume of attacks exploiting them increases by up to 5 orders of magnitude. 9

Summary of findings 10

Impact of discosure 11

Time to exploit 12

Duration of zero-day attacks The zero-day attacks they identify lasted between • 19 days (CVE-2010-0480) and 30 months (CVE-2010-2568), and • the average duration of a zero-day attack is 312 days. Before We Knew It An Empirical Study of Zero-Day Attacks In The Real World 13

Qualys “Laws of Vulnerabilities” Gerhard Eschelbeck of Qualys • 14 million Vulnerability scans performed with the QualysGuard vulnerability management service • Centralized knowledge base with signatures for more than 4000 unique vulnerabilities. • V2 2008 • 200 external (Internet)scanners and 5000+ internal (Intranet) scanners • Data is anonymous and non traceable • Interesting though somewhat outdated 14

Laws 2.0 – 1. Half-Life of attacks by Industry 15

Laws 2.0 – Persistence 16

Laws 2.0 – Exploitation Window for the availability of an exploit is constantly shrinking • Attackers are professional and driven • 0-day exploits–56 in Qualys knowledgebase • Exploit availability is now measured in single=digit days • Gerhard Eschelbeck, The Laws of Vulnerabilities: Which security vulnerabilities really matter?, Information Security Technical Report, Volume 10, Issue 4, 2005, Pages 213-219. 17

Quantitative Security Colorado State University Yashwant K Malaiya CS 559 Vulnerability Discovery Models CSU CyberCenter 18 18

Modeling Vulnerability Discovery • Quantitative Vulnerability Assessment Alhazmi 2004- 2008 • Seasonality in Vulnerability Discovery Joh 2008,2009 • Discovery in Multi-Version Software Kim 2006,2007 19

Motivation • For defects: Reliability modeling and SRGMs have been around for decades. • Assuming that vulnerabilities are special faults will lead us to this question: – To what degree reliability terms and models are applicable to vulnerabilities and security? [Littlewood et al]. – The need for quantitative measurements and estimation is becoming more crucial. 20

Goal: Modeling Vulnerability Discovery • Developing a quantitative model to estimate vulnerability discovery. • Using calendar time . • Using equivalent effort . • Validate these measurements and models. – Testing the models using available data • Identify security Assessment metrics – Vulnerability density – Vulnerability to Total defect ratio 21

Time – vulnerability discovery model • What factors impact the discovery process? – The changing environment • The share of installed base. • Global internet users. – Discovery effort • Discoverers: Developer, White hats or black hats. • Discovery effort is proportional to the installed base over time. • Vulnerability finders’ reward: greater rewards, higher motivation. – Security level desired for the system • Server or client 22

Time – vulnerability discovery model • Each vulnerability is recorded. – Available [NVD, vender etc]. – Needs compilation and filtering. • Data show three phases for an OS. • Assumptions: Phase 1 Phase 2 Phase 3 Vulnerabilities – The discovery is driven by the rewards factor. – Influenced by the change of market share. Time 23

Time–vulnerability Discovery model dy = - Ay ( B y ) 3 phase model S-shaped dt model. • Phase 1: B = y •Installed base –low. - ABt + BCe 1 • Phase 2: •Installed base–higher and Vulnerability time growth model growing/stable. • Phase 3: Vulnerabilities •Installed base–dropping. Time 24

AML Discovery model dy = - Ay ( B y ) Proposed by Alhazmi and Malaiya: Alhazmi Malaiya. Logistic model dt B = y - ABt + BCe 1 Vulnerability time growth model Vulnerabilities Time 25

Time–based model: Windows 98 Windows 98 Windows 98 Fitted curve Total vulnerabilites 45 A 0.004873 40 35 B 37.7328 30 Vulnerabilities 25 C 0.5543 20 χ 2 7.365 15 10 χ 2critial 60.481 5 0 P-value 1- 7.6x10 -11 Jan-99 Mar-99 May-99 Jul-99 Sep -99 Nov-99 Jan-00 Mar-00 May-00 Jul-00 Sep -00 Nov-00 Jan-01 Mar-01 May-01 Jul-01 Sep -01 Nov-01 Jan-02 Mar-02 May-02 Jul-02 Sep -02 26

Time–based model: Windows NT 4.0 Windows NT 4.0 Windows NT 4.0 Total vulnerabilities Fitted curve 160 140 A 0.000692 120 B 136 Vulnerabilities 100 C 0.52288 80 60 χ 2 35.584 40 χ 2critial 103.01 20 0 P-value 0.9999973 Aug-96 Aug-97 Aug-98 Aug-99 Aug-00 Aug-01 Aug-02 Dec-96 Apr-97 Dec-97 Apr-98 Dec-98 Apr-99 Dec-99 Apr-00 Dec-00 Apr-01 Dec-01 Apr-02 Dec-02 Apr-03 27