Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

Size: px
Start display at page:

Download "Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion"

Transcription

1 Internet Security Seminar 2013

2 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

3 An overview of the paper In-depth analysis of fake Antivirus companies operations and detailed stats Management and infrastructure of fake Antivirus campaigns A financial/mathematical model that describes the refund pattern of this business.

4 The malware problems Malware, short for malicious software, is software used by attackers in order to: disrupt computer operation, gather sensitive information, gain access to private computer systems. Malware types include: viruses, spyware, keyloggers, trojan horses, worms, adware, etc

5 The real Antivirus (AV) economy Antivirus is software used to Prevent, detect and remove malware. So a software industry has been built worldwide to provide users with/without cost a promising antivirus software. The rapid development of antivirus software industry was based on The increasing number of viruses the high demand of users for antivirus ready to pay in order to protect their computer & data

6 The raise of an Underground Economy based on fake AV The base of this economy Use scareware to frighten the user Convince the user to pay for a licence of a software which does nothing Making money from fake software licenses Two basic categories of fake AV 1. Malware that harms victim s computer when installed 2. Usually harmless software that wants to steal money from the user via fake licenses. Is it illegal?

7 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

8 The case study Three large-scale fake AV companies examined ($130 million dollars revenue). Data presentation and analysis from acquired back-end servers. An analysis of the role of different entities that are involved (i.e. payment processors, credit card networks) The suggestion of a mathematical model which defines these businesses

9 Acquiring the servers ANUBIS was used to analyse Windows binaries via runtime analysis Network signatures associated with these fake AVs observed The hosting providers were informed and took the servers down

10 Defrauding the user The fake AV impersonates an antivirus scanner It displays misleading alerts to exploit user s fear of causing damage to the computer Forces the user to buy a licence for a software that will solve the problem

11 Where and How? All of the 3 business were located in Eastern Europe They use affiliate networks (partnenka) to distribute the software The affiliates receive a commission for landing traffic to the malicious pages, or malware installations

12 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

13 Technical Background Technical observations made by acquiring the servers: Infection methods Social Engineering Drive-by-download attacks Botnets Infrastructure General Infrastructure Ways of hiding traces Plethora of domains names as a strategy

14 Infection via Social Engineering Convince the victim to buy a licence JavaScript or Adobe Flash for security alerts Provide links to a fake AV software

15 Infection via drive-by-download attack The malicious page has prepared scripts to exploit vulnerabilities (browser or plug-ins) In a successful exploit the fake AV is installed automatically

16 The role of Blackhat SEO Techniques for higher search rankings in an unethical manner. (i.e. the attacker s site may contain popular keywords that will confuse the search engine) Traffic direction system (TDS): are used as landing pages to direct the traffic to malicious content Time-to-live value defined by TDS are very short which is a constraint for researchers

17 Infection via Botnets Large Botnets (i.e. Koobface, Conficker) distribute fake AV software to machines under their control Probably the most lucrative way of infection

18 The behaviour after installation Advertised as free trials with limited functionality (i.e. only detection) Provide links that connect the users to the webpage where they can buy a licence The licence is sent by and fake alerts are deactivated Some fake AV may lock down system functionality (for victim s own protection) Other fake AV contain backdoor capabilities (enabling DDoS)

19 Security Shield - example

20 General Infrastructure Proxy servers to relay content to back-end servers Separate roles for each proxy Taking down front-end machines doesn t make a big impact

21 Staying in business Hiding traces Multi-tier infrastructure of proxy server to hide the location of the back-end Using many domain names The domain makes the site look legitimate A big number of domains make takedown efforts difficult Some domains will become blacklisted

22 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

23 Data collection Collection for each company 3 months for AV 1, 16 months for AV 2, 30 months for AV 3 Web site source code Samples of fake AV malware Databases Documentation for malware installations, fake AV sales, refunds and technical support (!)

24 The Transaction process

25 Sales Factors Aggressiveness of the fake AV s/w Frequency of alerts Type of threats System s performance The price and subscription of the models offered

26 Sales statistics AV1 AV2 AV3 6- month $ % $ % 1- year $ % $ % $ % 2- years $ % Life?me $ % $ % Installa?ons 8,403,008 6,624,508 1,969,953 Sales 189,342 in 3months 137, months 91,305,640 6 months Total vic?m loss $11,303,494 $5,046,508 $116,941,854 Profit/year (extrapolated) $45,000,000 $3,800,000 $48,400,000

27 Payment Processors (PP) PP are necessary for credit card payments. A PP must maintain a degree of legitimacy A PP risk losing the ability to accept credit cards. Fake AV companies use PP, such as Chronopay, which provide legitimate services to large organizations earning reliability. AV1,AV2 and AV3 used Chronopay for their payment services

28 Tricks of dishonest (dpp) Offer high risk merchant accounts (15% for each transaction) A dpp allow an illicit company to create multiple merchant account where Transactions are periodically rotated through each account. Each account is never flagged for fraudulent activities.

29 Chargebacks and Refunds Payment processors Have to provide a level of protection to the consumers Chargebacks as a problem Many chargeback complaints further transactions PP may prohibit They affect the lifetime of the fake AV operation Brand name as a factor that has an impact After 3-7 days, victim complaints were easy to be found in web forums

30 Affiliate Programs Partners earned from commissions 30-80% from sales Top affiliate for AV 1 Top affiliate for AV 3 2 years $1.8 million in 2 months $3.86 million in less than Not all of the affiliates were paid AV 1 : 44/140 AV 2 : 98/167 AV 3 : 541/1107 Many were involved in multiple groups Payment through WebMoney Anonymous and Irreversible transactions Low transaction fee (0.8%) and many places

31 Shell Companies Used for bank accounts and receiving remittances from PP Help in the cashing-out process Minimize the risk of apprehending a ringleader Alternatively money mules are used Accept deposits, withdraw funds, wire the money back

32 The victims Geographic location US 76.9%, UK, Canada and Australia OS and browsers Windows: XP (54.2%), Vista (30.8%), 7 (14,8%) Internet Explorer (65.6%) addresses Yahoo, Gmail, Hotmail, AOL Two fake online systems Problem submission through specific forms Real-time technical support

33 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

34 Building a Refund Pattern A simple model of refund requests (as a Poisson random variable) is proposed: Where: rq t = λs t-1 - s denotes the number of sales in a given period. - rq denotes the number of refund requests that result from s (in a period t). - λ captures the expected portion of buyers from period t-1 who will issue a refund request (rq) in period t.

35 Interplay of all the factors Chargebacks are limited due to the interaction with the PP A threshold rf = g(rq, cb) is used If then the credit card network will sever ties with a firm. The firm accepts refund requests to avoid the accumulated cb s reach the threshold

36 The generic pattern of refunds Finally the refunds follow the pattern: Where: rf t = the total refunds given α rq t = a standard number of accepted refund requests (α is a constant) β rq t = a varied number of accepted requests (β is a constant again) if {A}>0 returns 0 else returns 1

37 Detecting Fraudulent Firms The pattern could be observed by the Payment Processors if they know: The number of chargebacks against the firm at a particular time The faced by the company The number of refunds offered by the firm The PP receives commission but faces the risk of losing business with a credit card company The risk of firm being caught affects the PP The PP may be forced to pay all the chargebacks

38 Introduction The Case Study Technical Background The Underground Economy The Economic Model Discussion

39 Ethical Considerations A lot of ethical issues because of the sensitive data. Measures for protecting privacy Data encryption Automated program analysis Adopted methods based on literature for Ethical Behaviour in Computer Security Research Approval from Institutional Review Board (UCSB) Information provided to U.S. law enforcement officials

40 Related Work Researchers from Google analysed techniques for driving traffic to malicious site via landing pages leet10.pdf Cova et.al presented an analysis of the fake AV structure and tried to measure the number of victims and profits Techniques to identify drive-by-download attacks monkey-spider.pdf

41 In conclusion A unique research as it was based on real evidence and data This underground economy is described by an economic model The model outlines how these operations have distinct characteristics We can leverage the model to detect such fraudulent firms in the future

The Underground Economy of Fake Antivirus Software

The Underground Economy of Fake Antivirus Software The Underground Economy of Fake Antivirus Software Brett Stone-Gross, Ryan Abman, Richard A. Kemmerer, Christopher Kruegel, Douglas G. Steigerwald, and Giovanni Vigna Department of Computer Science Department

More information

LASTLINE WHITEPAPER. Understanding the Hidden Economy of Fake Anti- Virus Software

LASTLINE WHITEPAPER. Understanding the Hidden Economy of Fake Anti- Virus Software LASTLINE WHITEPAPER Understanding the Hidden Economy of Fake Anti- Virus Software Abstract Fake antivirus (AV) programs have been utilized to defraud millions of computer users into paying as much as one

More information

Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams. May 2014. TrustInAds.org. Keeping people safe from bad online ads

Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams. May 2014. TrustInAds.org. Keeping people safe from bad online ads Bad Ads Trend Alert: Shining a Light on Tech Support Advertising Scams May 2014 TrustInAds.org Keeping people safe from bad online ads OVERVIEW Today, even the most tech savvy individuals can find themselves

More information

Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms

Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.

More information

Security Engineering Part III Network Security. Intruders, Malware, Firewalls, and IDSs

Security Engineering Part III Network Security. Intruders, Malware, Firewalls, and IDSs Security Engineering Part III Network Security Intruders, Malware, Firewalls, and IDSs Juan E. Tapiador jestevez@inf.uc3m.es Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer

More information

Senior Net 4 July Rein van de Vusse

Senior Net 4 July Rein van de Vusse Senior Net 4 July 2014 Rein van de Vusse How does Internet Security work? So if transactions on the internet are safe What to watch out for? Email Scams Infected Websites Telephone Scams From: Inland Revenue

More information

LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages

LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages LASTLINE WHITEPAPER Large-Scale Detection of Malicious Web Pages Abstract Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and,

More information

ACCEPTABLE USE AND TAKEDOWN POLICY

ACCEPTABLE USE AND TAKEDOWN POLICY ACCEPTABLE USE AND TAKEDOWN POLICY This Acceptable Use and Takedown Policy ( Acceptable Use Policy ) of Wedding TLD2, LLC (the Registry ), is to be read together with the Registration Agreement and words

More information

4/20/2015. Fraud Watch Campaign. AARP is Fighting for You. AARP is Fighting for You. Campaign Tactics. AARP can help you Spot & Report Fraud

4/20/2015. Fraud Watch Campaign. AARP is Fighting for You. AARP is Fighting for You. Campaign Tactics. AARP can help you Spot & Report Fraud AARP can help you Spot & Report Fraud Fraud Fighter Call Center: Talk to a volunteer trained in how to spot and report fraud. Call the Fraud Fighter Call Center at (877) 908-3360 Fraud Watch Campaign What

More information

TARGETING THE SOURCE FAKEAV AFFILIATE NETWORKS. Nart Villeneuve. A 2011 Trend Micro White Paper

TARGETING THE SOURCE FAKEAV AFFILIATE NETWORKS. Nart Villeneuve. A 2011 Trend Micro White Paper TARGETING THE SOURCE FAKEAV AFFILIATE NETWORKS g Nart Villeneuve A 2011 Trend Micro White Paper Abstract The underground ecosystem provides everything required to set up and to maintain a malware operation

More information

WHY DOES MY SPEED MONITORING GRAPH SHOW -1 IN THE TOOLTIP? 2 HOW CAN I CHANGE MY PREFERENCES FOR UPTIME AND SPEED MONITORING 2

WHY DOES MY SPEED MONITORING GRAPH SHOW -1 IN THE TOOLTIP? 2 HOW CAN I CHANGE MY PREFERENCES FOR UPTIME AND SPEED MONITORING 2 FAQ WHY DOES MY SPEED MONITORING GRAPH SHOW -1 IN THE TOOLTIP? 2 HOW CAN I CHANGE MY PREFERENCES FOR UPTIME AND SPEED MONITORING 2 WHAT IS UPTIME AND SPEED MONITORING 2 WHEN I TRY TO SELECT A SERVICE FROM

More information

GlobalSign Malware Monitoring

GlobalSign Malware Monitoring GLOBALSIGN WHITE PAPER GlobalSign Malware Monitoring Protecting your website from distributing hidden malware GLOBALSIGN WHITE PAPER www.globalsign.com CONTENTS Introduction... 2 Malware Monitoring...

More information

Computer Security DD2395

Computer Security DD2395 Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare

More information

Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities

More information

Endpoint Security Management

Endpoint Security Management Endpoint Security Management LANDESK SOLUTION BRIEF Protect against security threats, malicious attacks and configuration vulnerabilities through strong endpoint security control and maintenance. Protect

More information

Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013

Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013 Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a

More information

What you need to know to keep your computer safe on the Internet

What you need to know to keep your computer safe on the Internet What you need to know to keep your computer safe on the Internet Tip 1: Always install Operating System updates The most important steps for any computer user is to always install updates, especially security

More information

The Underground Economy of the Pay-Per-Install (PPI) Business

The Underground Economy of the Pay-Per-Install (PPI) Business The Underground Economy of the Pay-Per-Install (PPI) Business Kevin Stevens, Security Researcher SecureWorks Counter Threat Unit (CTU) History of the PPI Business The Pay-Per-Install business model (PPI)

More information

Managing Web Security in an Increasingly Challenging Threat Landscape

Managing Web Security in an Increasingly Challenging Threat Landscape Managing Web Security in an Increasingly Challenging Threat Landscape Cybercriminals have increasingly turned their attention to the web, which has become by far the predominant area of attack. Small wonder.

More information

EXECUTIVE SUMMARY: SYMANTEC ENTERPRISE SECURITY

EXECUTIVE SUMMARY: SYMANTEC ENTERPRISE SECURITY EXECUTIVE SUMMARY: SYMANTEC ENTERPRISE SECURITY Symantec Report on Rogue Security Software July 08 June 09 Published October 2009 Confidence in a connected world. White Paper: Symantec Enterprise Security

More information

white paper Malware Security and the Bottom Line

white paper Malware Security and the Bottom Line Malware Security Report: Protecting Your BusineSS, Customers, and the Bottom Line Contents 1 Malware is crawling onto web sites everywhere 1 What is Malware? 2 The anatomy of Malware attacks 3 The Malware

More information

PC & Internet Security

PC & Internet Security PC & Internet Security Hello, my name is Charles Prince and I am a spokesperson for Avast Software whose home office is in Prague, the Czech Republic. I am not a salesman and I am not here to try to sell

More information

MOBILE MALWARE REPORT

MOBILE MALWARE REPORT TRUST IN MOBILE MALWARE REPORT THREAT REPORT: H2/2014 CONTENTS At a Glance 03-03 Forecasts and trends 04-04 Current situation: 4.500 new Android malware instances every day 05-05 Third-party App-Stores

More information

Corporate Account Takeover & Information Security Awareness

Corporate Account Takeover & Information Security Awareness Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation is for information purposes

More information

The information contained in this session may contain privileged and confidential information. This presentation is for information purposes only.

The information contained in this session may contain privileged and confidential information. This presentation is for information purposes only. The information contained in this session may contain privileged and confidential information. This presentation is for information purposes only. Before acting on any ideas presented in this session;

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks Security+ Guide to Network Security Fundamentals, Third Edition Chapter 2 Systems Threats and Risks Objectives Describe the different types of software-based attacks List types of hardware attacks Define

More information

THE HOME LOAN SAVINGS BANK. Corporate Account Takeover & Information Security Awareness

THE HOME LOAN SAVINGS BANK. Corporate Account Takeover & Information Security Awareness THE HOME LOAN SAVINGS BANK Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation is

More information

Innovations in Network Security

Innovations in Network Security Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.

More information

WEB ATTACKS AND COUNTERMEASURES

WEB ATTACKS AND COUNTERMEASURES WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in

More information

Corporate Account Takeover. presented by Commerce Bank IT & Security Departments 2013

Corporate Account Takeover. presented by Commerce Bank IT & Security Departments 2013 Corporate Account Takeover presented by Commerce Bank IT & Security Departments 2013 Agenda 2 1 What is Corporate Account Takeover? 2 3 4 5 How does it work? Types of Security Threats & Countermeasures

More information

Practical tips for a. Safe Christmas

Practical tips for a. Safe Christmas Practical tips for a Safe Christmas CONTENTS 1. Online shopping 2 2. Online games 4 3. Instant messaging and mail 5 4. Practical tips for a safe digital Christmas 6 The Christmas holidays normally see

More information

Computer Security Maintenance Information and Self-Check Activities

Computer Security Maintenance Information and Self-Check Activities Computer Security Maintenance Information and Self-Check Activities Overview Unlike what many people think, computers are not designed to be maintenance free. Just like cars they need routine maintenance.

More information

F-Secure Anti-Virus for Mac. User's Guide

F-Secure Anti-Virus for Mac. User's Guide F-Secure Anti-Virus for Mac User's Guide F-Secure Anti-Virus for Mac TOC 3 Contents Chapter 1: Getting started...5 What to do after installation...6 Manage subscription...6 Open the product...6 How to

More information

Security Challenges and Solutions for Higher Education. May 2011

Security Challenges and Solutions for Higher Education. May 2011 Security Challenges and Solutions for Higher Education May 2011 Discussion Topics Security Threats and Challenges Education Risks and Trends ACH and Wire Fraud Malware and Phishing Techniques Prevention

More information

Introduction: 1. Daily 360 Website Scanning for Malware

Introduction: 1. Daily 360 Website Scanning for Malware Introduction: SiteLock scans your website to find and fix any existing malware and vulnerabilities followed by using the protective TrueShield firewall to keep the harmful traffic away for good. Moreover

More information

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL BOTNETS Douwe Leguit, Manager Knowledge Center GOVCERT.NL Agenda Bots: what is it What is its habitat How does it spread What are its habits Dutch cases Ongoing developments Visibility of malware vs malicious

More information

Mifflinburg Bank & Trust. Corporate Account Takeover & Information Security Awareness

Mifflinburg Bank & Trust. Corporate Account Takeover & Information Security Awareness Mifflinburg Bank & Trust Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation is

More information

INTERNET & COMPUTER SECURITY March 20, 2010. Scoville Library. ccayne@biblio.org

INTERNET & COMPUTER SECURITY March 20, 2010. Scoville Library. ccayne@biblio.org INTERNET & COMPUTER SECURITY March 20, 2010 Scoville Library ccayne@biblio.org Internet: Computer Password strength Phishing Malware Email scams Identity Theft Viruses Windows updates Browser updates Backup

More information

C&G FLUX MARKET Internet Safety

C&G FLUX MARKET Internet Safety Internet Safety Introduction Viruses, Trojan horses, worms, and spyware are all threats that can damage our computer systems. We know we need to protect our computers, but with so many antivirus programs

More information

Frequent Smart Updates: Used to detect and guard against new infections as well as adding enhancements to Spyware Doctor.

Frequent Smart Updates: Used to detect and guard against new infections as well as adding enhancements to Spyware Doctor. Faqs > Spyware Doctor Q1. What is Spyware Doctor? Ans.: Spyware Doctor is an easy-to-use, award winning, comprehensive software suite designed to protect your computer against stealthy spyware, aggressive

More information

Information Security Threat Trends

Information Security Threat Trends Talk @ Microsoft Security Day Sep 2005 Information Security Threat Trends Mr. S.C. Leung 梁 兆 昌 Senior Consultant 高 級 顧 問 CISSP CISA CBCP M@PISA Email: scleung@hkcert.org 香 港 電 腦 保 安 事 故 協 調 中 心 Introducing

More information

Industry Canada ic.gc.ca

Industry Canada ic.gc.ca Industry Canada ic.gc.ca Questions and Answers Bill C-28: Canada's Anti-Spam Legislation What is spam? Spam can be defined as any electronic commercial message sent without the express or implied consent

More information

Viruses, Trojans and Worms Oh My! 2006 Technology Leadership Presentation Series

Viruses, Trojans and Worms Oh My! 2006 Technology Leadership Presentation Series Viruses, Trojans and Worms Oh My! 2006 Technology Leadership Presentation Series Why is my computer running so slow? What are all of these little windows popping up on my system? Why did my home page change?

More information

Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:

Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details: Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for

More information

Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)

Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology

More information

Don t Fall Victim to Cybercrime:

Don t Fall Victim to Cybercrime: Don t Fall Victim to Cybercrime: Best Practices to Safeguard Your Business Agenda Cybercrime Overview Corporate Account Takeover Computer Hacking, Phishing, Malware Breach Statistics Internet Security

More information

White paper. Phishing, Vishing and Smishing: Old Threats Present New Risks

White paper. Phishing, Vishing and Smishing: Old Threats Present New Risks White paper Phishing, Vishing and Smishing: Old Threats Present New Risks How much do you really know about phishing, vishing and smishing? Phishing, vishing, and smishing are not new threats. They have

More information

Kaspersky Fraud Prevention platform: a comprehensive solution for secure payment processing

Kaspersky Fraud Prevention platform: a comprehensive solution for secure payment processing Kaspersky Fraud Prevention platform: a comprehensive solution for secure Today s bank customers can perform most of their financial operations online. According to a global survey of Internet users conducted

More information

Web Tap: Detecting Covert Web Traffic. Presented By: Adam Anthony

Web Tap: Detecting Covert Web Traffic. Presented By: Adam Anthony Web Tap: Detecting Covert Web Traffic Presented By: Adam Anthony Outline Problem Description Web Tap's Goals Web Tap's Significance Threat Model Implementation Evaluation Future Work Conclusion Typical

More information

The Fundamental Failures of End-Point Security. Stefan Frei Research Analyst Director sfrei@secunia.com

The Fundamental Failures of End-Point Security. Stefan Frei Research Analyst Director sfrei@secunia.com The Fundamental Failures of End-Point Security Stefan Frei Research Analyst Director sfrei@secunia.com Agenda The Changing Threat Environment Malware Tools & Services Why Cybercriminals Need No 0-Days

More information

Koobface on Facebook: How malicious contents sneak into social networking. Mohammad Reza Faghani

Koobface on Facebook: How malicious contents sneak into social networking. Mohammad Reza Faghani Koobface on Facebook: How malicious contents sneak into social networking Mohammad Reza Faghani Outline Introduction Trend of Web malware Social networks malware What is XSS!? Potentials of XSS Worms Social

More information

PROTECT YOUR COMPUTER AND YOUR PRIVACY!

PROTECT YOUR COMPUTER AND YOUR PRIVACY! PROTECT YOUR COMPUTER AND YOUR PRIVACY! Fraud comes in many shapes simple: the loss of both money protecting your computer and Take action and get peace of and sizes, but the outcome is and time. That

More information

Acceptable Use (Anti-Abuse) Policy

Acceptable Use (Anti-Abuse) Policy Acceptable Use (Anti-Abuse) Policy This document describes the Acceptable Use Policy for the Rightside registry. Copyright 2014 Rightside Registry Copyright 2014 Rightside Domains Europe Ltd. Rightside

More information

Stopping zombies, botnets and other email- and web-borne threats

Stopping zombies, botnets and other email- and web-borne threats Stopping zombies, botnets and other email- and web-borne threats Hijacked computers, or zombies, hide inside networks where they send spam, steal company secrets, and enable other serious crimes. This

More information

F-Secure Anti-Virus for Mac 2015

F-Secure Anti-Virus for Mac 2015 F-Secure Anti-Virus for Mac 2015 TOC F-Secure Anti-Virus for Mac 2015 Contents Chapter 1: Getting started...3 1.1 Manage subscription...4 1.2 How to make sure that my computer is protected...4 1.2.1 Protection

More information

DON T BE FOOLED BY EMAIL SPAM FREE GUIDE. Provided by: Don t Be Fooled by Spam E-Mail FREE GUIDE. December 2014 Oliver James Enterprise

DON T BE FOOLED BY EMAIL SPAM FREE GUIDE. Provided by: Don t Be Fooled by Spam E-Mail FREE GUIDE. December 2014 Oliver James Enterprise Provided by: December 2014 Oliver James Enterprise DON T BE FOOLED BY EMAIL SPAM FREE GUIDE 1 This guide will teach you: How to spot fraudulent and spam e-mails How spammers obtain your email address How

More information

Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning

Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning Lee Zelyck Network Administrator Regina Public Library Malware, Spyware, Trojans

More information

ZNetLive Malware Monitoring

ZNetLive Malware Monitoring Introduction The criminal ways of distributing malware or malicious software online have gone through a change in past years. In place of using USB drives, attachments or disks to distribute viruses, hackers

More information

Secure Your Mobile Workplace

Secure Your Mobile Workplace Secure Your Mobile Workplace Sunny Leung Senior System Engineer Symantec 3th Dec, 2013 1 Agenda 1. The Threats 2. The Protection 3. Q&A 2 The Mobile Workplaces The Threats 4 Targeted Attacks up 42% in

More information

HackAlert Malware Monitoring

HackAlert Malware Monitoring HackAlert Malware Monitoring Understanding the reselling opportunity for Online Security Services GlobalSign. A GMO Internet Inc group company. Reselling Malware Monitoring The GlobalSign Partner Program

More information

Software Engineering 4C03 SPAM

Software Engineering 4C03 SPAM Software Engineering 4C03 SPAM Introduction As the commercialization of the Internet continues, unsolicited bulk email has reached epidemic proportions as more and more marketers turn to bulk email as

More information

Emerging Security Technological Threats

Emerging Security Technological Threats Emerging Security Technological Threats Jamie Gillespie Training and Education Team Leader, AusCERT About AusCERT Australia s national CERT Collect, monitor, advise on threats and vulnerabilities Incident

More information

ESET CYBER SECURITY PRO for Mac Quick Start Guide. Click here to download the most recent version of this document

ESET CYBER SECURITY PRO for Mac Quick Start Guide. Click here to download the most recent version of this document ESET CYBER SECURITY PRO for Mac Quick Start Guide Click here to download the most recent version of this document ESET Cyber Security Pro provides state-of-the-art protection for your computer against

More information

WHITE PAPER: Cyber Crime and the Critical Need for Endpoint Security

WHITE PAPER: Cyber Crime and the Critical Need for Endpoint Security WHITE PAPER: Cyber Crime and the Critical Need for Endpoint Security A World of Constant Threat We live in a world on constant threat. Every hour of every day in every country around the globe hackers

More information

A Case Study in Malvertisement

A Case Study in Malvertisement A Case Study in Malvertisement The Shadowserver Foundation Kayne Naughton Drive-By Infections Been around for a long time now Criminals answer to personal firewalls Much bigger attack surface PDFs Java

More information

NewNet 66 Network Security

NewNet 66 Network Security NewNet 66 Network Security Spyware... Understanding the Threat What is Spyware? Spyware is an evolved term. In the mid 90s, it was used to refer to high-tech espionage gadgets. By the late 90s, it became

More information

Thexyz Premium Webmail

Thexyz Premium Webmail Webmail Access all the benefits of a desktop program without being tied to the desktop. Log into Thexyz Email from your desktop, laptop, or mobile phone, and get instant access to email, calendars, contacts,

More information

Buyers Guide to Web Protection

Buyers Guide to Web Protection Buyers Guide to Web Protection The web is the number one source for malware distribution today. While many organizations have replaced first-generation URL filters with secure web gateways, even these

More information

Anti-exploit tools: The next wave of enterprise security

Anti-exploit tools: The next wave of enterprise security Anti-exploit tools: The next wave of enterprise security Intro From malware and ransomware to increasingly common state-sponsored attacks, organizations across industries are struggling to stay ahead of

More information

TRAINING FOR AMERICAN MOMENTUM BANK CLIENTS. Corporate Account Takeover & Information Security Awareness

TRAINING FOR AMERICAN MOMENTUM BANK CLIENTS. Corporate Account Takeover & Information Security Awareness TRAINING FOR AMERICAN MOMENTUM BANK CLIENTS Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This

More information

Phishing Activity Trends Report for the Month of December, 2007

Phishing Activity Trends Report for the Month of December, 2007 Phishing Activity Trends Report for the Month of December, 2007 Summarization of December Report Findings The total number of unique phishing reports submitted to APWG in December 2007 was 25,683, a decrease

More information

Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz

Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Internet Banking Attacks Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Contents Agenda Internet banking today The most common attack vectors The possible countermeasures What protection

More information

Spammer and Hacker, Two Old Friends

Spammer and Hacker, Two Old Friends Spammer and Hacker, Two Old Friends Pedram Hayati, Vidyasagar Potdar Digital Ecosystem and Business Intelligence Institute Curtin University of Technology Perth, WA, Australia pedram.hayati@postgard.curtin.edu.au,

More information

S Y M A N T E C E N T E R P R IS E S E C U R I T Y

S Y M A N T E C E N T E R P R IS E S E C U R I T Y S Y M A N T E C E N T E R P R IS E S E C U R I T Y Symantec Report on Rogue Security Software July 2008 - June 2009 Executive Summary Published October 2009 Marc Fossi Executive Editor Manager, Development

More information

COMPUTER-INTERNET SECURITY. How am I vulnerable?

COMPUTER-INTERNET SECURITY. How am I vulnerable? COMPUTER-INTERNET SECURITY How am I vulnerable? 1 COMPUTER-INTERNET SECURITY Virus Worm Trojan Spyware Adware Messenger Service 2 VIRUS A computer virus is a small program written to alter the way a computer

More information

BE SAFE ONLINE: Lesson Plan

BE SAFE ONLINE: Lesson Plan BE SAFE ONLINE: Lesson Plan Overview Danger lurks online. Web access, social media, computers, tablets and smart phones expose users to the possibility of fraud and identity theft. Learn the steps to take

More information

How Spyware and Anti-Spyware Work

How Spyware and Anti-Spyware Work 22 PART 1 INTERNET SECURITY CHAPTER 3 How Spyware and Anti-Spyware Work 23 THESE days, the biggest danger you face when you go onto the Internet might be spyware a type of malicious software that can invade

More information

Security A to Z the most important terms

Security A to Z the most important terms Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from

More information

The 10 myths of safe web browsing

The 10 myths of safe web browsing Are you suffering from misconceptions about safe web browsing? You might think you re being safe, but with a newly infected webpage discovered every few seconds, it s next to impossible to stay up to date

More information

Integrated Approach to Network Security. Lee Klarich Senior Vice President, Product Management March 2013

Integrated Approach to Network Security. Lee Klarich Senior Vice President, Product Management March 2013 Integrated Approach to Network Security Lee Klarich Senior Vice President, Product Management March 2013 Real data from actual networks 2 2012, Palo Alto Networks. Confidential and Proprietary. 2008: HTTP,

More information

Corporate Account Takeover & Information Security Awareness

Corporate Account Takeover & Information Security Awareness Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation is for information purposes

More information

Protecting your business from fraud

Protecting your business from fraud Protecting your business from fraud KEY TAKEAWAYS > Understand the most common types of fraud and how to identify them. > What to do if you uncover fraudulent activity or suspect you are a victim of fraud.

More information

F-Secure Internet Security 2012

F-Secure Internet Security 2012 F-Secure Internet Security 2012 F-Secure Internet Security 2012 TOC 3 Contents Chapter 1: Getting started...7 How to use automatic updates...8 Check the update status...8 Change the Internet connection

More information

Beyond Aurora s Veil: A Vulnerable Tale

Beyond Aurora s Veil: A Vulnerable Tale Beyond Aurora s Veil: A Vulnerable Tale Derek Manky Cyber Security & Threat Research FortiGuard Labs October 26th, 2010: SecTor 2010 Toronto, CA Conficker: April Doomsday.. Meanwhile JBIG2 Zero Day PDF/SWF

More information

9. Information Assurance and Security, Protecting Information Resources. Janeela Maraj. Tutorial 9 21/11/2014 INFO 1500

9. Information Assurance and Security, Protecting Information Resources. Janeela Maraj. Tutorial 9 21/11/2014 INFO 1500 INFO 1500 9. Information Assurance and Security, Protecting Information Resources 11. ecommerce and ebusiness Janeela Maraj Tutorial 9 21/11/2014 9. Information Assurance and Security, Protecting Information

More information

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft) 1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction

More information

INFOCOMM SEC RITY. is INCOMPLETE WITHOUT. Be aware, responsible. secure!

INFOCOMM SEC RITY. is INCOMPLETE WITHOUT. Be aware, responsible. secure! INFOCOMM SEC RITY is INCOMPLETE WITHOUT Be aware, responsible secure! U HACKER Smack that What you can do with these five online security measures... ANTI-VIRUS SCAMS UPDATE FIREWALL PASSWORD FASTEN UP!

More information

QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY

QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY EXPLOIT KITS UP 75 PERCENT The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent

More information

Spyware. Summary. Overview of Spyware. Who Is Spying?

Spyware. Summary. Overview of Spyware. Who Is Spying? Spyware US-CERT Summary This paper gives an overview of spyware and outlines some practices to defend against it. Spyware is becoming more widespread as online attackers and traditional criminals use it

More information

Cyber Security. Securing Your Mobile and Online Banking Transactions

Cyber Security. Securing Your Mobile and Online Banking Transactions Cyber Security Securing Your Mobile and Online Banking Transactions For additional copies or to download this document, please visit: http://msisac.cisecurity.org/resources/guides 2014 Center for Internet

More information

Topic 1 Lesson 1: Importance of network security

Topic 1 Lesson 1: Importance of network security Topic 1 Lesson 1: Importance of network security 1 Initial list of questions Why is network security so important? Why are today s networks so vulnerable? How does Melissa virus work? How does I love you

More information

24/7 Visibility into Advanced Malware on Networks and Endpoints

24/7 Visibility into Advanced Malware on Networks and Endpoints WHITEPAPER DATA SHEET 24/7 Visibility into Advanced Malware on Networks and Endpoints Leveraging threat intelligence to detect malware and exploitable vulnerabilities Oct. 24, 2014 Table of Contents Introduction

More information

Computer Protection. Computer Protection. Computer Protection 5/1/2013. Classic Battle of Good vs Evil. David Watterson & Ross Cavazos

Computer Protection. Computer Protection. Computer Protection 5/1/2013. Classic Battle of Good vs Evil. David Watterson & Ross Cavazos David Watterson & Ross Cavazos Chief Information Officer IT Director City of Billings Yellowstone County Local Government IT Group Vice-Chairmen Classic Battle of Good vs Evil GOOD EVIL Firewall E-Mail

More information

HACKER INTELLIGENCE INITIATIVE. The Secret Behind CryptoWall s Success

HACKER INTELLIGENCE INITIATIVE. The Secret Behind CryptoWall s Success HACKER INTELLIGENCE INITIATIVE The Secret Behind 1 1. Introduction The Imperva Application Defense Center (ADC) is a premier research organization for security analysis, vulnerability discovery, and compliance

More information

Information Security Awareness

Information Security Awareness Corporate Account Takeover & Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation

More information

Prevent Malware attacks with F5 WebSafe and MobileSafe. Alfredo Vistola Security Solution Architect, EMEA

Prevent Malware attacks with F5 WebSafe and MobileSafe. Alfredo Vistola Security Solution Architect, EMEA Prevent Malware attacks with F5 WebSafe and MobileSafe Alfredo Vistola Security Solution Architect, EMEA Malware Threat Landscape Growth and Targets % 25 Of real-world malware is caught by anti-virus Malware

More information

Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka

Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques

More information

Software Engineering 4C03 Class Project. Computer Networks and Computer Security COMBATING HACKERS

Software Engineering 4C03 Class Project. Computer Networks and Computer Security COMBATING HACKERS Software Engineering 4C03 Class Project Computer Networks and Computer Security COMBATING HACKERS Done By: Ratinder Ricky Gill Student Number: 0048973 E-Mail: gillrr@mcmaster.ca Due: Tuesday April 5, 2005

More information