Raimund genes from traditional malware to targeted attacks

From Traditional Malware

to Targeted Attacks

Raimund Genes

Chief Technology Officer

Trend Micro

Internet

Gateway

Exchange

Server

150 infected Mails

CRIMEWARE

2001 2003 2004 2005 2007 2010

Vulner abi l i t i es W orm

Outbreaks

Mass Mai lers

Spyware

Intel l igent

Botnets

Threats

Evolution to Cybercrime

Targeted At tacks

Mobi le At tacks

Trustwave 2013 Global Security Report:

Average time from initial breach to detection was 210 days, more than 35 days longer than in 2011.

Malware / Bot / APT Behavior Comparison Table APT Bot Malware

Distribution With organized planning Mass distribution over regions Mass distribution over regions

Services interruption No No Yes

Attack Pattern Targeted (only a few groups/organizations)

Not targeted (large area spread-out)

Target Audience Particular Organization/Company Individual credentials including online banking account information

Random

Frequency of attacks Many times Once Once

Weapon -Zero-day exploit -Drop embedded RAT -Dropper or Backdoor

Multiple-Exploits, All in one By Malware design

Detection Rate Lower than 10% within one month Around 86% within one month Around 99% within one month

Some Documented Advanced Persistent Threat Campaigns (Real-world Examples)

• LURID – threat actors launched around 300 campaigns targeting different industries in different countries

• Luckycat – threat actors used diverse infrastructure (from throwaway free hosting to dedicated VPSs)

• Taidoor – threat actors primarily targeted government organizations located in Taiwan

• IXESHE – threat actors used compromised computers inside the network to evade network detection

Advanced Persistent Threat

Targeted Attacks

The attacker knows what he’s looking for!

South Korea – Hacktivism, Cyber Sabotage, or Cyberterrorism?

Sometimes an “unusual” targets

Typical Industrial Control System (ICS)

• In a small city in US with 8000 citizens

• It has to look like a real system

• And by “accident” the system has a link to the Internet

Let’s simulate a Water Pressure Control station

Building a SCADA Honeypot…

Attacks from

LAOS, 6

UK, 4 CHINA, 17

NETHERLANDS, 1

JAPAN, 1

BRAZIL, 2

POLAND, 1

VIETNAM, 1

RUSSIA, 3

PALESTINE, 1 CHILE, 1 CROATIA, 1 NORTH KOREA, 1

What to expect next?

Your phone as your wallet

Android Malware

120,000 350,000

Vehicle past and now TOYOTA'S Vehicle(1955)

TOYOTA'S Hybrid Vehicle(2011)

None of

computers included over 70 of

computers included

Tire Pressure

Monitoring System

UNAUTHORIZED

APPS, Multimedia File

Smartphone,

Immobilizer

Cutter

DOOR LOCKS

Smart Key

CHAdeMO : Quick charging method for battery

powered electric vehicles

TELEMATICS

SYSTEM

OBDII , CAN, ECU

Vehicle Area Network

iVehicle

Embedded OS selected by car industry

SELECTED

IVI Standard Organization

Security Assessment

Kernel > 2.6.35.3

Gain Privilege > 18

• All the ECU turned into Fail-Safe-Mode.

• Engine fan and headlamp kept working.

• Meter(e.g. speed) needle keeps wobbling

Overflow attack to CAN bus

If someone wants to get in, he get’s in!

So do we do a lot of stuff just to satisfy the auditors?

LATIN AMERICA

EUROPE

NORTH AMERICA

GLOBAL

Thank You

Raimund genes from traditional malware to targeted attacks

News & Politics

Hypervisor-Based Systems for Malware Detection …...Anti-malware software is effective to detect and/or prevent attacks of malware But, the anti-malware approach has several problems

THE CURRENT STATE OF CYBERCRIME 2014: … REPORT THE CURRENT STATE OF CYBERCRIME 2014: GLOBAL MALWARE OUTLOOK April 2014 APT ATTACKS REMAIN UNABATED AND POS MALWARE ATTACKS BECOME

Replacement Attacks: Automatically Impeding Behavior-based Malware … · 2015-05-07 · Replacement Attacks: Automatically Impeding Behavior-based Malware Speci cations Jiang Ming

Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

New Malware Attacks 600 Merchants

BillGates Botnet Malware Used in Large DDoS Attacks | Threat

Quantum of Surveillance - media.kasperskycontenthub.comQuantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns Malware attacks targeting the Syrian

Prevent Malware attacks with F5 WebSafe and MobileSafe

Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

One Step Ahead Of Advanced Attacks and Malware · PDF fileOne Step Ahead Of Advanced Attacks and Malware . SPO2-W02 . ... Web Exploitation continues as key vector . 10 ... advanced

Weaponised Malware & APT Attacks: Protect Against Next-Generation Threats

Review Exam 2 Spring 2015. Targeted Break-in, DoS, & Malware attacks (I)

6 Ways to Prevent Oklahoma City Home Healthcare Malware Attacks (SlideShare)

Review Exam 2 Spring 2014. Targeted Break-in, DoS, & Malware attacks (I)

Malware Propagation in Fully Connected Networks: A Netﬂow ... · Abstract—Malware attacks have become ubiquitous in mod-ern large data-centric networks. Therefore advanced malware

Botnets, malware and network attacks

Defending Web Infrastructures from Malware Attacks Giorgio ... · Document Banking Malware Attacks OWASP AppSecEU09 Poland Model and Evaluate exposure of Banking provided security

SECURE, PREVENT AND PROTECT - NCR · Typically, these attacks fall into three major categories: • Black box attacks • Malware in the network • Malware installed on the ATM In

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour