Anatomy of Attacks. Dmitry Samosseiko, SophosLabs
|
|
|
- Ruth Lester
- 8 years ago
- Views:
Transcription
1 Anatomy of Attacks Dmitry Samosseiko, SophosLabs
2 SophosLabs Team One global team UK, US, Canada, Australia 24/7, 365 days/year ~100 Researchers and Developers globally Threat Operations Systems Development Advanced Research and Detection Development Highly trained ~6 month training program for new hires Strong focus on Software Reverse Engineering Broad skills set malware, spam, web, exploits 2
3 3 WHO WRITES COMPUTER VIRUSES?
4 The good old days 4
5 Today s motives 5
6 Monetizing on malware? Spam bots Spyware (keyloggers, phishing password stealers) Ransomware Scareware Denial of service attacks Corporate data theft 6
7 The value of zombie PC Source: krebsonsecurity.com
8 Exponential growth 8 Source: av-test.org
9 Variants and volumes SophosLabs sees 200,000 samples per day And 20,000 new malicious URLs 33% more than in % were compromised legitimate sites 9
10 10 MALWARE DIVERSITY
11 Viruses Spread by infecting other files, executables Parasitic Not as common today as other forms of malware May require a special cleanup approach
12 Worms Spread via network connection Attack network shares, weak passwords/security
13 Trojan horses The most prevalent kind of malware today Often relies on social engineering Needs to be disguised as something normal
14 Bankers Steal banking account information Prevalent in South America Attempt to bypass online banking security measures
15 Rootkits Stealthy, avoid detection Subverts the OS operations Hard to detect and remove Bootkits rootkits attacks MBRs, loads before OS kernel Examples: TDSS/TDL ZeroAccess Alureon
16 Botnets Botnets for: 1. spam Grum ~ 200,000 PCs Rustock ~ 815,000 PCs 2. Web spam 3. DDoS 4. Installs 5. Info stealers (Zeus, Citadel) 16 Picture source:
17 Scareware / FakeAV #1 threat today by prevalence Fake anti-virus Fake anti-spyware System optimizers Videos at 17
18 Scareware for Macs 18
19 Ransomware Encrypts documents or Blocks screen/mouse/keyboard access Demands money to unlock (SMS, e-currency, prepaid cards) 19
20
21 Main vectors Web spam Removable media (USB, phones) 21
22 Spam for malware distribution messages containing malicious attachments Spam often used to distribute threats Attachments to the message Links in the message body Executable often in ZIP or RAR HTML attachments. Social engineering throughout 22
23 Social engineering You need to install this codec to watch that video You are infected! Install XP Antivirus 2012! OMG! Your private video is online. Watch it here. Open the attachment to see your pay raise details! You ve got a PayPal payment. Open to see there is one for everybody Forces you to act, not think 23
24 24 Ok, we re too smart to fall for this
25 Software has bugs Bugs create vulnerabilities Vulnerabilities get exploited It may take weeks to patch a hole Exploit packs are sold online 25
26 They also have holes 26 Browsers & browser plugins: Java Flash PDF Quicktime Media players ActiveX Office documents Even images
27 Exploit packs = Silent installs drive-by infections Adpack Exploit Pack Armitage Exploit Pack Bleeding Life CrimePack Cry Exploit Pack Datalife Exploit Pack Eleonore Fiesta Exploit Pack Fire Pack Exploit Fragus Exploit Pack Gpack Ice Exploit Pack Impact (aka 'seo sploit') Infector Exploit Pack Mpack Exploit Pack Multi Exploit Pack Ninja Phishing Framework Phoenix Exploit Pack Poly Exploit Pack Red Exploit Pack SEO Exploit Kit (Numerous, names unknown) Siberia Pack Smart Exploit Pack Target Exploit Pack Tors Exploit Pack Unique Exploit Pack Yes Exploit Pack Zero Exploit Pack Zeus Exploit Pack 27
28 BlackHole The most successful and prevalent exploit kit $1500 per year or from $50 a day PHP/MySQL backend Management console Version 2 (Oct 2012) includes Windows8 and mobile devices
29 Source:
30 30 IT S ALL ABOUT WEB TRAFFIC
31 Web traffic generation Black SEO (doorways, content farms) Traffic hijacking Malvertizing 31
32 SEO How they do it? Doorway A web page that is designed to attract traffic from a search engine and then redirect it to another site or page Google results Googlebot sees Firefox/Chome/IE 32
33 Social networking malware 33
34 Myth: I m a safe surfer Do you ever visit these sites? 34
35 Even those we trust most 35
36 Website infections FTP account hacking cpanel exploits SQL Injections Vulnerable webservers, CMS (Wordpress, Drupal, ), PHP,
37 Pharma profitability This affiliate used 66 unique domains referencing his AffID 124 orders per day Average sale = $160 40% commission 124*160 = $19840 * 40% = $7936/day Date Orders Average sales per day
38 Fake anti-virus profitability Statistics from topsale2.ru 38
39 Fake AV recruitment Topsale.ru light exe that 10% referral wouldn t hurt PROMO: and kill your Fake scanner golden US to redirect bots Exe + Exploit traffic pack for IFRAME 25$ per traffic AV sale 39
40 Top fake anti-virus affiliates 40 Affiliate ID Affiliate Username Account Balance (USD) 4928 nenastniy $158, krab $105, rstwm $95, newforis $93, slyers $85, ultra $82, cosma2k $78, dp322 $75, iamthevip $61, dp32 $58,160.20
41 Ransomware profitability
42 Arms Race 42
43 Evasion Techniques IP/network blocking HTTP_REFERRER/cookie check Time attacks JavaScript obfuscations for redirect chain Browser detection Delays DOM tricks Click to download images 43
44 JavaScript Obfuscation 44
45 Exploit Code 45
46 Evasion Techniques Everything is a moving target Binaries repackaged every 20 min (!) and AV tested + server side polymorphism 100s of payload domains created daily + payload sites hosted on free TLDs (.cz.cc ) 10,000s of new infected websites stealing legitimate traffic, found daily TDS domain turn over (relatively slow) IP hopping 46
47 AV Scanners for Virus writers
48 Crypto services for virus writers Meant to hide the payload behind a layer of packer/crypto Could include multiple layers, i.e. a VB malware wrapped in a C packer Service model + Legitimate commercial packers
49 SSP SSP - Server-side polymorphism New binary for every download
50 Non-traditional malware APTs State-sponsored cyber weapons (Duqu, Stuxnet, Flame)
51 APT What does it mean? Advanced Persistent Threat A fancy name for targeted attacks A term describing the daily onslaught of digital assaults launched by attackers who are considered highly-skilled, determined and possessed of a long-term perspective on their mission (Wikipedia) 51
52 APT highlights for 2010/11 Threats left undiscovered for months, even years: Nov 2010 operation Aurora Google Jan 2011 Canadian government organizations Feb Knight Dragon energy industries Mar RSA Jun 2011 Northrop Grumman (RSA hack) Jun IMF Aug ShadyRat MANY governments and corporations worldwide Sept 2011 Mitsubishi (nuclear plant, defense secrets) 52
53 Intellectual property is the new gold Zero day Flash vulnerability Inadequate monitoring Victims of their own success Zero day IE6 vulnerability All systems trustworthy Allowed intruders too much privilege 53
54 What can be done? Awareness Security measures Legal actions 54
55 Legal actions and takedown efforts Takedown highlights Nov 2009 Mega-D (30-35% of spam). Arrested Feb 2010 Mariposa botnet, 12M PCs. Arrested. Mar 2010 Zeus botnet. Arrested Oct 2010 Bredolab botnet, 30M PCs! Sep 2011 Kelihos botnet Mar 2011 Rustock botnet. On the run. Nov 2012 Nitol 55
56 Anatomy of Defences 56
57 Modern AV Not just about viruses Not just about signatures Not just about executables
58 Multi-layer defenses Static and runtime protection Behavioral malware profiles Malicious scripts, PDFs, Flash, Java, docs, exploits, packers, Emulation, unpacking Cloud -based reputation services.
59 A typical web attack 59 Doorways / Infected Set the trap for users and draw them in Traffic Distribution Directs victims to selected attacks Penetration Getting around environmental defenses Infection Binary threats downloaded and installed Execution The threat is doing its dirty work
60 Layered protection Stop attacks and breaches
61 AV Lab Tasks Threat Visibility Sample Collection Analysis Protection 61
62 Threat Discovery Threat Visibility Sample Collection Analysis Protection Through SophosLabs systems and products Product feedback Web crawling Spam traps Industry sharing 62
63 URL Analysis Threat Visibility Sample Collection Analysis Protection Website URLs URL Patterns Domain age Popularity Location Network reputation Name servers (DNS) Scan results from various content engines Sources Manual analysis 63
64 File Analysis Threat Visibility Sample Collection Analysis Protection Dynamic Files Analysis Samples executed Behavior observed, recorded and analyzed Dropped samples submitted for analysis Outbound network traffic (URLs, domains) captured and sent for analysis All analysis results are sent to correlation system for decision making 64
65
66 Static Analysis Threat Visibility Sample Collection Analysis Protection Human Analysis Reverse Engineering with IDAPro Many internal tools JS unpacking File entropy Strings extraction File format handling, i.e. PDF tools 66
67 Reversing 67
68 Automation is key Big data problems Fast turn around time Anti-anti-anti-* techniques
69 Attack Examples A typical web attack and levels of protection offered 69
70 Doorways Doorway TDS Redirector Promo Payload Filled with keywords Look different to Googlebots (cloaking) SEO Kits Detection: Template detection, i.e. Mal/SEORed-* Install Payment 70
71 Typical FakeAV Doorway TDS Doorway page Redirector Promo Payload Install Redirect sites Payment Payload site 71
72 Doorway TDS Redirector Promo Payload Install Payment 72
73 Typical FakeAV Doorway TDS Redirector Promo Payload SutraTDS, SimpleTDS, Run on dedicated domains Redirecting traffic based on: country/city, browser, OS, search keywords, etc Detection: TDS domain blocking Install Payment 73
74 Typical FakeAV Doorway TDS Redirector Promo Payload Just another obfuscation layer Detection: Domain/URL blocking JavaScript detection Mal/ObfJS Mal/JSRedir Install Payment 74
75 Typical FakeAV Doorway TDS Redirector Promo Payload Fake My Computer (or Finder) scanner page Detection: URL/domain blocking HTML/JS content: Mal/FakeAvJS Install Payment 75
76 Typical FakeAV Doorway TDS Redirector Often hosted on the same page as promo Hard to get to SSP Promo Payload Install Payment Detection: URL/domain blocking Binary detection Mal/FakeAvJS EnkPack Cloud 76
77 Typical FakeAV Doorway TDS Redirector Promo On endpoints: Context based detection correlating registry keys, file names with binary genes HIPS runtime behavior analysis Payload Install Payment 77
78 Thank you! Some recommended resources
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess By Richard Wang, Manager, SophosLabs U.S. Over the last few years the volume of malware has grown dramatically, thanks mostly to automation and
Using big data analytics to identify malicious content: a case study on spam emails
Using big data analytics to identify malicious content: a case study on spam emails Mamoun Alazab & Roderic Broadhurst Mamoun.alazab@anu.edu.au http://cybercrime.anu.edu.au 2 Outline Background Cybercrime
Security A to Z the most important terms
Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare
Beyond Aurora s Veil: A Vulnerable Tale
Beyond Aurora s Veil: A Vulnerable Tale Derek Manky Cyber Security & Threat Research FortiGuard Labs October 26th, 2010: SecTor 2010 Toronto, CA Conficker: April Doomsday.. Meanwhile JBIG2 Zero Day PDF/SWF
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection Trend Micro, Incorporated Marco Dela Vega and Norman Ingal Threat Response Engineers A Trend Micro Research Paper I November
Advanced Persistent Threats
Emilio Tonelli Senior Sales Engineer South Europe WatchGuard Technologies, Inc. Advanced Persistent Threats the new security challenge Are you protected? Current Threat Landscape 2 Global Threat Landscape:
Cloud Services Prevent Zero-day and Targeted Attacks
Cloud Services Prevent Zero-day and Targeted Attacks WOULD YOU OPEN THIS ATTACHMENT? 2 TARGETED ATTACKS BEGIN WITH ZERO-DAY EXPLOITS Duqu Worm Causing Collateral Damage in a Silent Cyber-War Worm exploiting
ZeroAccess. James Wyke. SophosLabs UK
ZeroAccess James Wyke SophosLabs UK Abstract ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the most widespread threats in the current malware ecosystem. ZeroAccess ability
Stopping zombies, botnets and other email- and web-borne threats
Stopping zombies, botnets and other email- and web-borne threats Hijacked computers, or zombies, hide inside networks where they send spam, steal company secrets, and enable other serious crimes. This
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology
WEBTHREATS. Constantly Evolving Web Threats Require Revolutionary Security. Securing Your Web World
Securing Your Web World WEBTHREATS Constantly Evolving Web Threats Require Revolutionary Security ANTI-SPYWARE ANTI-SPAM WEB REPUTATION ANTI-PHISHING WEB FILTERING Web Threats Are Serious Business Your
Web 2.0 and Data Protection. Paul Tsang Security Consultant McAfee
Web 2.0 and Data Protection Paul Tsang Security Consultant McAfee Criminal Motivators For Profit Targeted Attacks Cyber Warfare (Credit Cards, PII, Criminal Infrastructure) (Nation-State Secrets, Trade
Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion
Internet Security Seminar 2013 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion An overview of the paper In-depth analysis of fake Antivirus companies
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
Spyware: Securing gateway and endpoint against data theft
Spyware: Securing gateway and endpoint against data theft The explosion in spyware has presented businesses with increasing concerns about security issues, from data theft and network damage to reputation
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
Cyber liability threats, trends and pointers for the future
Cyber liability threats, trends and pointers for the future Tim Smith Partner, BLM t: 020 7865 3313 e: tim.smith@blm-law.com February 2013 Cyber liability threats, trends and pointers for the future The
Advanced Persistent Threats
Advanced Persistent Threats George R Magee~ FCNSA, FCNSP, Fortinet Larry Cushing~ CEO, Unified Technologies Visit us at Booth #11 1 May 27, 2014 2 Threat landscape An Internet Minute 7 7 Fortinet Confidential
How To Protect Yourself From A Web Attack
Five Stages of a Web Malware Attack A guide to web attacks plus technology, tools and tactics for effective protection By Chris McCormack, Senior Product Marketing Manager Today s web attacks are extremely
Advanced Persistent Threats
White Paper INTRODUCTION Although most business leaders and IT managers believe their security technologies adequately defend against low-level threats, instances of (APTs) have increased. APTs, which
Top 10 Data Security Threats Plaguing Credit Unions
Top 10 Data Security Threats Plaguing Credit Unions (2H 2013 Threat Report) Andrew Jaquith CTO & SVP, Cloud Strategy Grace Zeng, SilverSky Labs February 20, 2014 Housekeeping rules Everyone s phone is
Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013
Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a
Advancements in Botnet Attacks and Malware Distribution
Advancements in Botnet Attacks and Malware Distribution HOPE Conference, New York, July 2012 Aditya K Sood Rohit Bansal Richard J Enbody SecNiche Security Department of Computer Science and Engineering
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
white paper Malware Security and the Bottom Line
Malware Security Report: Protecting Your BusineSS, Customers, and the Bottom Line Contents 1 Malware is crawling onto web sites everywhere 1 What is Malware? 2 The anatomy of Malware attacks 3 The Malware
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
Security Engineering Part III Network Security. Intruders, Malware, Firewalls, and IDSs
Security Engineering Part III Network Security Intruders, Malware, Firewalls, and IDSs Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer
Information Security Threat Trends
Talk @ Microsoft Security Day Sep 2005 Information Security Threat Trends Mr. S.C. Leung 梁 兆 昌 Senior Consultant 高 級 顧 問 CISSP CISA CBCP M@PISA Email: scleung@hkcert.org 香 港 電 腦 保 安 事 故 協 調 中 心 Introducing
GlobalSign Malware Monitoring
GLOBALSIGN WHITE PAPER GlobalSign Malware Monitoring Protecting your website from distributing hidden malware GLOBALSIGN WHITE PAPER www.globalsign.com CONTENTS Introduction... 2 Malware Monitoring...
One Minute in Cyber Security
Next Presentation begins at 15:30 One Minute in Cyber Security Simon Bryden Overview Overview of threat landscape Current trends Challenges facing security vendors Focus on malware analysis The year? The
Current Threat Scenario and Recent Attack Trends
Current Threat Scenario and Recent Attack Trends Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Objectives Current Cyber space Nature of cyberspace and associated risks
24/7 Visibility into Advanced Malware on Networks and Endpoints
WHITEPAPER DATA SHEET 24/7 Visibility into Advanced Malware on Networks and Endpoints Leveraging threat intelligence to detect malware and exploitable vulnerabilities Oct. 24, 2014 Table of Contents Introduction
Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS
Trend Micro Incorporated Research Paper 2012 Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS By: Jon Oliver, Sandra Cheng, Lala Manly, Joey Zhu, Roland
Cybercrime myths, challenges and how to protect our business. Vladimir Kantchev Managing Partner Service Centrix
Cybercrime myths, challenges and how to protect our business Vladimir Kantchev Managing Partner Service Centrix Agenda Cybercrime today Sources and destinations of the attacks Breach techniques How to
Current counter-measures and responses by CERTs
Current counter-measures and responses by CERTs Jeong, Hyun Cheol hcjung@kisa.or.kr April. 2007 Contents I. Malware Trends in Korea II. Malware from compromised Web sites III. Case Study : Malware countermeasure
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
MALWARE THREATS AND TRENDS. Chris Blow, Director Dustin Hutchison, Director
MALWARE THREATS AND TRENDS Chris Blow, Director Dustin Hutchison, Director WHAT IS MALWARE? Malicious Software Viruses Worms Trojans Rootkits Spyware Ransomware 2 MALWARE ORIGINS Users bring it from home
Targeted attacks begin with spearphishing
Targeted attacks begin with spearphishing Jasper Evertzen jevertzen@proofpoint.com Sales Director Benelux & Nordics Charles Rami crami@proofpoint.com SE Manager France Benelux& Nordics threat protection
Penetration Testing The Red Pill
Penetration Testing The Red Pill Mehis Hakkaja, Mait Peekma www.clarifiedsecurity.com Agenda What is security testing, penetration testing (pen-testing)? Why pentest? Threat landscape Web application attacks
Integrated Protection for Systems. João Batista Joao_batista@mcafee.com Territory Manager
Integrated Protection for Systems João Batista Joao_batista@mcafee.com Territory Manager 2 McAfee Overview Proven Expertise And what it means to you Proof of Expertise Impact of Expertise 1 17 100 300
CIT 480: Securing Computer Systems. Malware
CIT 480: Securing Computer Systems Malware Topics 1. Anti-Virus Software 2. Virus Types 3. Infection Methods 4. Rootkits 5. Malware Analysis 6. Protective Mechanisms 7. Malware Factories 8. Botnets Malware
Social Media as a Vector for Cyber Crime April 7, 2015. Sarah Ackerman, Kyle Schutte Clark Schaefer Consulting
Social Media as a Vector for Cyber Crime April 7, 2015 Sarah Ackerman, Kyle Schutte Clark Schaefer Consulting Presentation Overview As social networking becomes more a part of our daily lives, individuals
Almost 400 million people 1 fall victim to cybercrime every year.
400,000000 Almost 400 million people 1 fall victim to cybercrime every year. A common way for criminals to attack people is via websites, unfortunately this includes legitimate sites that have been hacked
INDUSTRY OVERVIEW: FINANCIAL
ii IBM MSS INDUSTRY OVERVIEW: FINANCIAL RESEARCH AND INTELLIGENCE REPORT RELEASE DATE: NOVEMBER 5, 2014 BY: JOHN KUHN, SENIOR THREAT RESEARCHER iii TABLE OF CONTENTS EXECUTIVE OVERVIEW... 1 MAJOR FINANCIAL
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY EXPLOIT KITS UP 75 PERCENT The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent
Exploring the Black Hole Exploit Kit
Exploring the Black Hole Exploit Kit Updated December 20, 2011 Internet Identity Threat Intelligence Department http://www.internetidentity.com http://www.internetidentity.com 12/29/11 Page 1/20 Summary
Botnets Die Hard Owned and Operated
Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University Aditya K Sood About Us PhD
THREAT VISIBILITY & VULNERABILITY ASSESSMENT
THREAT VISIBILITY & VULNERABILITY ASSESSMENT Date: April 15, 2015 IKANOW Analysts: Casey Pence IKANOW Platform Build: 1.34 11921 Freedom Drive, Reston, VA 20190 IKANOW.com TABLE OF CONTENTS 1 Key Findings
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary...3 2 Certifications...6 3 Test methodology...7 3.1 Source of exploits...9 3.2 False positive test... 10 3.3 0-day
Spyware. Michael Glenn Technology Management Michael.Glenn@Qwest.com. 2004 Qwest Communications International Inc.
Spyware Michael Glenn Technology Management Michael.Glenn@Qwest.com Agenda Security Fundamentals Current Issues Spyware Definitions Overlaps of Threats Best Practices What Service Providers are Doing References
MRG Effitas Real World Enterprise Security Exploit Prevention March 2015. Real World Enterprise Security Exploit Prevention Test.
Real World Enterprise Security Exploit Prevention Test March 2015 1 1 Executive summary... 3 2 Certifications... 6 3 Test methodology... 7 3.1 Source of exploits... 9 3.2 False positive test... 10 3.3
Cyber Security Presentation Cyber Security Month Curtis McNay, Director of IT Security
Cyber Security Presentation Cyber Security Month Curtis McNay, Director of IT Security The IT Security Office (ITSO) What We Do? Risk Assessment Network and System Security Monitoring Vulnerability Scanning
Cloud Services Prevent Zero-day and Targeted Attacks Tom De Belie Security Engineer. [Restricted] ONLY for designated groups and individuals
![Cloud Services Prevent Zero-day and Targeted Attacks Tom De Belie Security Engineer. [Restricted] ONLY for designated groups and individuals](/thumbs/36/17592960.jpg "Cloud Services Prevent Zero-day and Targeted Attacks Tom De Belie Security Engineer. [Restricted] ONLY for designated groups and individuals")
Cloud Services Prevent Zero-day and Targeted Attacks Tom De Belie Security Engineer Facts 2 3 WOULD YOU OPEN THIS ATTACHMENT? 4 TARGETED ATTACKS BEGIN WITH ZERO-DAY EXPLOITS 5 Check Point Multi-Layered
for Zero-day Threat Advanced Malware: Preparing for Zero-day Threat Channel Manager Baltics & Finland Cyberoam A Sophos Company Our Products
Advanced Malware: Preparing for Zero-day Threat Advanced Justinas Valentukevicius Malware preparing Channel Manager Baltics & Finland for Zero-day Threat Cyberoam A Sophos Company Our Products Network
CITADEL TROJAN OUTGROWING ITS ZEUS ORIGINS
CITADEL TROJAN OUTGROWING ITS ZEUS ORIGINS May 2012 As of April 30th, 2012 the Citadel Trojan was at its fourth upgrade with Version 1.3.4.0 already in the hands of its customers. Citadel s features, bug
Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK
Adventures in Cybercrime Piotr Kijewski CERT Polska/NASK Would you like a Porsche? Porsche Cayenne S Turbo: 149 000 USD Or maybe a different type? Porsche 911 Turbo: 149 000 USD The car is there Porsche
Modern Cyber Threats. how yesterday s mind set gets in the way of securing tomorrow s critical infrastructure. Axel Wirth
Modern Cyber Threats how yesterday s mind set gets in the way of securing tomorrow s critical infrastructure Axel Wirth Healthcare Solutions Architect Distinguished Systems Engineer AAMI 2013 Conference
TECHNICAL REPORT. An Analysis of Domain Silver, Inc..pl Domains
TECHNICAL REPORT An Analysis of Domain Silver, Inc..pl Domains July 31, 2013 CONTENTS Contents 1 Introduction 2 2 Registry, registrar and registrant 3 2.1 Rogue registrar..................................
The Hillstone and Trend Micro Joint Solution
The Hillstone and Trend Micro Joint Solution Advanced Threat Defense Platform Overview Hillstone and Trend Micro offer a joint solution the Advanced Threat Defense Platform by integrating the industry
How Attackers are Targeting Your Mobile Devices. Wade Williamson
How Attackers are Targeting Your Mobile Devices Wade Williamson Today s Agenda Brief overview of mobile computing today Understanding the risks Analysis of recently discovered malware Protections and best
SOLUTION CARD WHITE PAPER
WHITE PAPER Why Education is Among the Worst Affected Industries by Malware The Contradiction Between Perceived Anti-Virus Readiness and Actual Malware Infection Rates in the Education Industry About This
Trends in Malware DRAFT OUTLINE. Wednesday, October 10, 12
Trends in Malware DRAFT OUTLINE Presentation Synopsis Security is often a game of cat and mouse as security professionals and attackers each vie to stay one step ahead of the other. In this race for dominance,
Combating the Next Generation of Advanced Malware
Peter McNaull Director of Technical Marketing WatchGuard Combating the Next Generation of Advanced Malware Surviving APT Attacks Current State of AV Solutions Nearly 88% of malware morphs to evade signature-based
WHITE PAPER: Cyber Crime and the Critical Need for Endpoint Security
WHITE PAPER: Cyber Crime and the Critical Need for Endpoint Security A World of Constant Threat We live in a world on constant threat. Every hour of every day in every country around the globe hackers
Property of Secure Network Technologies-Do Not Distribute or Post Without Written Permission-Copyrights and Trademark Apply
Malware - Mules & Money Mobile Edition v2.0 By Steve Stasiukonis What We Do Security Assessments & Penetration Tests Incident Response Digital Investigation & Forensic Services Technical Surveillance Countermeasure
Anti-exploit tools: The next wave of enterprise security
Anti-exploit tools: The next wave of enterprise security Intro From malware and ransomware to increasingly common state-sponsored attacks, organizations across industries are struggling to stay ahead of
Secure Your Mobile Workplace
Secure Your Mobile Workplace Sunny Leung Senior System Engineer Symantec 3th Dec, 2013 1 Agenda 1. The Threats 2. The Protection 3. Q&A 2 The Mobile Workplaces The Threats 4 Targeted Attacks up 42% in
Protecting Data From the Cyber Theft Pandemic. A FireEye Whitepaper - April, 2009
Protecting Data From the Cyber Theft Pandemic A FireEye Whitepaper - April, 2009 Table of Contents Executive Summary Page 3 Today s Insider Threat Is Stealth Malware Page 3 Stealth Malware Attacks Are
The Underground Economy of the Pay-Per-Install (PPI) Business
The Underground Economy of the Pay-Per-Install (PPI) Business Kevin Stevens, Security Researcher SecureWorks Counter Threat Unit (CTU) History of the PPI Business The Pay-Per-Install business model (PPI)
PC & Internet Security
PC & Internet Security Hello, my name is Charles Prince and I am a spokesperson for Avast Software whose home office is in Prague, the Czech Republic. I am not a salesman and I am not here to try to sell
Attacks 2011: How Complexity Evaded Defenses and Strategies for Prevention TOMER TELLER CHECK POINT SOFTWARE TECHNOLOGIES. Session Classification:
Attacks 2011: How Complexity Evaded Defenses and Strategies for Prevention TOMER TELLER CHECK POINT SOFTWARE TECHNOLOGIES Session ID: SPO1-303 Session Classification: General Interest Welcome to RSA 2013.
Unknown threats in Sweden. Study publication August 27, 2014
Unknown threats in Sweden Study publication August 27, 2014 Executive summary To many international organisations today, cyber attacks are no longer a matter of if but when. Recent cyber breaches at large
CS 356 Lecture 9 Malicious Code. Spring 2013
CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive,
BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL
BOTNETS Douwe Leguit, Manager Knowledge Center GOVCERT.NL Agenda Bots: what is it What is its habitat How does it spread What are its habits Dutch cases Ongoing developments Visibility of malware vs malicious
Computer Viruses: How to Avoid Infection
Viruses From viruses to worms to Trojan Horses, the catchall term virus describes a threat that's been around almost as long as computers. These rogue programs exist for the simple reason to cause you
ACS-3921/4921-050 Computer Security And Privacy. Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security
ACS-3921/4921-050 Computer Security And Privacy Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security ACS-3921/4921-050 Slides Used In The Course A note on the use of these slides: These
Student Tech Security Training. ITS Security Office
Student Tech Security Training ITS Security Office ITS Security Office Total Security is an illusion security will always be slightly broken. Find strategies for living with it. Monitor our Network with
Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies
Cyber Security in Taiwan's Government Institutions: From APT To Investigation Policies Ching-Yu, Hung Investigation Bureau, Ministry of Justice, Taiwan, R.O.C. Abstract In this article, we introduce some
User Documentation Web Traffic Security. University of Stavanger
User Documentation Web Traffic Security University of Stavanger Table of content User Documentation... 1 Web Traffic Security... 1 University of Stavanger... 1 UiS Web Traffic Security... 3 Background...
DATA SHEET. What Darktrace Finds
DATA SHEET What Darktrace Finds Darktrace finds anomalies that bypass other security tools, due to the uniqueness of the Enterprise Immune System, capable of detecting threats without reliance on rules,
Mobile Malware Network View. Kevin McNamee : Alcatel-Lucent
Mobile Malware Network View Kevin McNamee : Alcatel-Lucent Agenda Introduction How the data is collected Lies, Damn Lies and Statistics Windows PC Malware Android Malware Network Impact Examples of malware
UNCLASSIFIED. Briefing to Critical Infrastructure Sector Organizations on the Canadian Cyber Incident Response Centre (CCIRC)
Briefing to Critical Infrastructure Sector Organizations on the Canadian Cyber Incident Response Centre (CCIRC) Cyber in the News 1 Tactics, Techniques and Procedures These observed tactics, techniques
Spyware. Summary. Overview of Spyware. Who Is Spying?
Spyware US-CERT Summary This paper gives an overview of spyware and outlines some practices to defend against it. Spyware is becoming more widespread as online attackers and traditional criminals use it
The Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
ZNetLive Malware Monitoring
Introduction The criminal ways of distributing malware or malicious software online have gone through a change in past years. In place of using USB drives, attachments or disks to distribute viruses, hackers
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
Cisco & Big Data Security
Cisco & Big Data Security 巨 量 資 料 的 傳 輸 保 護 Joey Kuo Borderless Networks Manager hskuo@cisco.com The any-to-any world and the Internet of Everything is an evolution in connectivity and collaboration that
EyjafjallajöKull Framework (aka: Exploit Kits Krawler Framework)
EyjafjallajöKull Framework (aka: Exploit Kits Krawler Framework) Seeking Exploit Kits at Large Scale Made Easy By Sébastien Larinier / @Sebdraven & Guillaume Arcas / @y0m This Slide Intentionally Left
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]
![Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]](/thumbs/40/20589514.jpg "Malware. Björn Victor 1 Feb 2013. [Based on Stallings&Brown]")
Malware Björn Victor 1 Feb 2013 Ask Sofia if anything is unclear/too difficult with the lab. Coordinate meetings between you? BadStore: demo version New York Times, Wall Street Journal attacks from China,
Advanced Persistent Threats
Advanced Persistent Threats Craig Harwood Channel Manager SADC and Indian Ocean Islands 1 Agenda Introduction Today s Threat landscape What is an Advance persistent Threat How are these crimes perpetrated
Introduction: 1. Daily 360 Website Scanning for Malware
Introduction: SiteLock scans your website to find and fix any existing malware and vulnerabilities followed by using the protective TrueShield firewall to keep the harmful traffic away for good. Moreover
Surviving and operating services despite highly skilled and well-funded organised crime groups. Romain Wartel, CERN CHEP 2015, Okinawa
Surviving and operating services despite highly skilled and well-funded organised crime groups Romain Wartel, CERN CHEP 2015, Okinawa 1 Operation Windigo (2011 - now) 30,000+ unique servers compromised
Endpoint & Server Protection. Brent Biernat First Vice President Network Services May 13, 2014
Endpoint & Server Protection Brent Biernat First Vice President Network Services May 13, 2014 The Evolution of Cyber Crime 1878 Bell Telephone Teenage Switchboard Operator Disconnected calls, eavesdropped,
Breaking the Cyber Attack Lifecycle
Breaking the Cyber Attack Lifecycle Palo Alto Networks: Reinventing Enterprise Operations and Defense March 2015 Palo Alto Networks 4301 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for