36
From Traditional Malware to Targeted Attacks Raimund Genes Chief Technology Officer Trend Micro

Raimund genes from traditional malware to targeted attacks

Embed Size (px)

DESCRIPTION

 

Citation preview

Page 1: Raimund genes from traditional malware to targeted attacks

From Traditional Malware

to Targeted Attacks

Raimund Genes

Chief Technology Officer

Trend Micro

Page 2: Raimund genes from traditional malware to targeted attacks
Page 3: Raimund genes from traditional malware to targeted attacks

Internet

PC

PC

PC

Internet

Gateway

Exchange

Server

150 infected Mails

Page 4: Raimund genes from traditional malware to targeted attacks

CRIMEWARE

D

amag

e ca

use

d b

y C

yber

crim

e

2001 2003 2004 2005 2007 2010

Vulner abi l i t i es W orm

Outbreaks

Spam

Mass Mai lers

Spyware

Intel l igent

Botnets

W eb

Threats

Evolution to Cybercrime

2011+

Targeted At tacks

Mobi le At tacks

Page 5: Raimund genes from traditional malware to targeted attacks

Trustwave 2013 Global Security Report:

Average time from initial breach to detection was 210 days, more than 35 days longer than in 2011.

Page 6: Raimund genes from traditional malware to targeted attacks

Malware / Bot / APT Behavior Comparison Table APT Bot Malware

Distribution With organized planning Mass distribution over regions Mass distribution over regions

Services interruption No No Yes

Attack Pattern Targeted (only a few groups/organizations)

Not targeted (large area spread-out)

Not targeted (large area spread-out)

Target Audience Particular Organization/Company Individual credentials including online banking account information

Random

Frequency of attacks Many times Once Once

Weapon -Zero-day exploit -Drop embedded RAT -Dropper or Backdoor

Multiple-Exploits, All in one By Malware design

Detection Rate Lower than 10% within one month Around 86% within one month Around 99% within one month

Page 7: Raimund genes from traditional malware to targeted attacks

Some Documented Advanced Persistent Threat Campaigns (Real-world Examples)

• LURID – threat actors launched around 300 campaigns targeting different industries in different countries

• Luckycat – threat actors used diverse infrastructure (from throwaway free hosting to dedicated VPSs)

• Taidoor – threat actors primarily targeted government organizations located in Taiwan

• IXESHE – threat actors used compromised computers inside the network to evade network detection

http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_dissecting-lurid-apt.pdf
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_dissecting-lurid-apt.pdf
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf
Page 8: Raimund genes from traditional malware to targeted attacks

Advanced Persistent Threat

Targeted Attacks

Page 9: Raimund genes from traditional malware to targeted attacks

The attacker knows what he’s looking for!

Page 10: Raimund genes from traditional malware to targeted attacks

South Korea – Hacktivism, Cyber Sabotage, or Cyberterrorism?

Page 11: Raimund genes from traditional malware to targeted attacks

Sometimes an “unusual” targets

Page 12: Raimund genes from traditional malware to targeted attacks

Typical Industrial Control System (ICS)

Page 13: Raimund genes from traditional malware to targeted attacks

• In a small city in US with 8000 citizens

• It has to look like a real system

• And by “accident” the system has a link to the Internet

Let’s simulate a Water Pressure Control station

Page 14: Raimund genes from traditional malware to targeted attacks

Building a SCADA Honeypot…

Page 15: Raimund genes from traditional malware to targeted attacks
Page 16: Raimund genes from traditional malware to targeted attacks

Attacks from

US, 9

LAOS, 6

UK, 4 CHINA, 17

NETHERLANDS, 1

JAPAN, 1

BRAZIL, 2

POLAND, 1

VIETNAM, 1

RUSSIA, 3

PALESTINE, 1 CHILE, 1 CROATIA, 1 NORTH KOREA, 1

Page 17: Raimund genes from traditional malware to targeted attacks
Page 18: Raimund genes from traditional malware to targeted attacks

What to expect next?

Page 19: Raimund genes from traditional malware to targeted attacks
Page 20: Raimund genes from traditional malware to targeted attacks

Your phone as your wallet

Page 21: Raimund genes from traditional malware to targeted attacks

Android Malware

120,000 350,000

Page 22: Raimund genes from traditional malware to targeted attacks

Vehicle past and now TOYOTA'S Vehicle(1955)

TOYOTA'S Hybrid Vehicle(2011)

None of

computers included over 70 of

computers included

Page 23: Raimund genes from traditional malware to targeted attacks

Tire Pressure

Monitoring System

UNAUTHORIZED

APPS, Multimedia File

Smartphone,

USB

Immobilizer

Cutter

DOOR LOCKS

Smart Key

CHAdeMO : Quick charging method for battery

powered electric vehicles

KEY

FOB

TELEMATICS

SYSTEM

OBDII , CAN, ECU

Vehicle Area Network

Page 24: Raimund genes from traditional malware to targeted attacks
Page 25: Raimund genes from traditional malware to targeted attacks

iVehicle

Page 26: Raimund genes from traditional malware to targeted attacks

Embedded OS selected by car industry

SELECTED

IVI Standard Organization

Page 27: Raimund genes from traditional malware to targeted attacks

Security Assessment

Kernel > 2.6.35.3

Gain Privilege > 18

Page 28: Raimund genes from traditional malware to targeted attacks

• All the ECU turned into Fail-Safe-Mode.

• Engine fan and headlamp kept working.

• Meter(e.g. speed) needle keeps wobbling

Overflow attack to CAN bus

Page 29: Raimund genes from traditional malware to targeted attacks
Page 30: Raimund genes from traditional malware to targeted attacks

If someone wants to get in, he get’s in!

Page 31: Raimund genes from traditional malware to targeted attacks
Page 32: Raimund genes from traditional malware to targeted attacks

So do we do a lot of stuff just to satisfy the auditors?

Page 33: Raimund genes from traditional malware to targeted attacks
Page 34: Raimund genes from traditional malware to targeted attacks
Page 35: Raimund genes from traditional malware to targeted attacks

LATIN AMERICA

EUROPE

APAC

NORTH AMERICA

GLOBAL

Page 36: Raimund genes from traditional malware to targeted attacks

Thank You


From Malware Signatures to Anti-Virus Assisted Attacks · From Malware Signatures to Anti-Virus Assisted Attacks Christian Wressnegger, Kevin Freeman, Fabian Yamaguchi, and Konrad

From Malware Signatures to Anti-Virus Assisted Attacks · From Malware Signatures to Anti-Virus Assisted Attacks Christian Wressnegger, Kevin Freeman, Fabian Yamaguchi, and Konrad

Documents
Protecting from Zero-Day Malware Attacks - Idosi.org

Protecting from Zero-Day Malware Attacks - Idosi.org

Documents
Review Exam 2 Spring 2014. Targeted Break-in, DoS, & Malware attacks (I)

Review Exam 2 Spring 2014. Targeted Break-in, DoS, & Malware attacks (I)

Documents
Quantum of Surveillance - media.kasperskycontenthub.comQuantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns Malware attacks targeting the Syrian

Quantum of Surveillance - media.kasperskycontenthub.comQuantum of Surveillance: Familiar Actors and Possible False Flags in Syrian Malware Campaigns Malware attacks targeting the Syrian

Documents
On defending against label flipping attacks on malware

On defending against label flipping attacks on malware

Documents
Defeating Ransomware with Isla Web Malware Isolationinterchangegroup.com/files/IC_Cyberinc-ransomware-white_paper.pdfThe Isla Web Malware Isolation System ... Phishing attacks generally

Defeating Ransomware with Isla Web Malware Isolationinterchangegroup.com/files/IC_Cyberinc-ransomware-white_paper.pdfThe Isla Web Malware Isolation System ... Phishing attacks generally

Documents
Malware propagation & attacks trends

Malware propagation & attacks trends

Documents
Analysing Phishing & Malware Attacks for Neither Fun nor Profit

Analysing Phishing & Malware Attacks for Neither Fun nor Profit

Technology
Defending Web Infrastructures from Malware Attacks Giorgio ... · Document Banking Malware Attacks OWASP AppSecEU09 Poland Model and Evaluate exposure of Banking provided security

Defending Web Infrastructures from Malware Attacks Giorgio ... · Document Banking Malware Attacks OWASP AppSecEU09 Poland Model and Evaluate exposure of Banking provided security

Documents
Malware & Targeted Attacks: 8 Step Defense Plan

Malware & Targeted Attacks: 8 Step Defense Plan

Technology
Malware Propagation in Fully Connected Networks: A Netflow ... · Abstract—Malware attacks have become ubiquitous in mod-ern large data-centric networks. Therefore advanced malware

Malware Propagation in Fully Connected Networks: A Netflow ... · Abstract—Malware attacks have become ubiquitous in mod-ern large data-centric networks. Therefore advanced malware

Documents
Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Documents
Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

Turning on network protections for Web Fraud · F5 Agility 2014 2 Fraud and malware remains a challenge Malware/Fraud Statistics Mobile Malware (MM) Phishing attacks 15% increase

Documents
Securing Web Applications from malware attacks …eprints.rclis.org/33271/1/1219.pdfSecuring Web Applications from malware attacks using hybrid feature extraction Subramaniyaswamy

Securing Web Applications from malware attacks …eprints.rclis.org/33271/1/1219.pdfSecuring Web Applications from malware attacks using hybrid feature extraction Subramaniyaswamy

Documents
Using Massively Distributed Malware in APT-Style Attacks

Using Massively Distributed Malware in APT-Style Attacks

Technology
Botnets, malware and network attacks

Botnets, malware and network attacks

Technology
Deobfuscating Embedded Malware using Probable-Plaintext ... · Deobfuscating Embedded Malware using Probable-Plaintext Attacks Christian Wressnegger1; 2, Frank Boldewin3, and Konrad

Deobfuscating Embedded Malware using Probable-Plaintext ... · Deobfuscating Embedded Malware using Probable-Plaintext Attacks Christian Wressnegger1; 2, Frank Boldewin3, and Konrad

Documents
Is Your Business Safe From Malware And Targeted Attacks

Is Your Business Safe From Malware And Targeted Attacks

Technology
How Targeted APT and Advanced Malware Attacks Evade Anti-virus Software

How Targeted APT and Advanced Malware Attacks Evade Anti-virus Software

Technology
6 Ways to Prevent Oklahoma City Home Healthcare Malware Attacks (SlideShare)

6 Ways to Prevent Oklahoma City Home Healthcare Malware Attacks (SlideShare)

Technology
Targeted Defense for Malware & Targeted Attacks

Targeted Defense for Malware & Targeted Attacks

Technology
Review Exam 2 Spring 2015. Targeted Break-in, DoS, & Malware attacks (I)

Review Exam 2 Spring 2015. Targeted Break-in, DoS, & Malware attacks (I)

Documents
Protecting Your POS System from PoSeidon and Other Malware Attacks

Protecting Your POS System from PoSeidon and Other Malware Attacks

Technology
New Malware Attacks 600 Merchants

New Malware Attacks 600 Merchants

Documents
Web Malware Protection System - FireEye Products & Solutions | …Web Malware Protection System Next-Generation Web Security to Combat Advanced Targeted Attacks The FireEye Web Malware

Web Malware Protection System - FireEye Products & Solutions | …Web Malware Protection System Next-Generation Web Security to Combat Advanced Targeted Attacks The FireEye Web Malware

Documents
OWN YOUR DEFENSE - NETSource Secure...MALWARE Think of malware as the umbrella policy for all other cybersecurity attacks. In its most basic definition, “malware” is shorthand

OWN YOUR DEFENSE - NETSource Secure...MALWARE Think of malware as the umbrella policy for all other cybersecurity attacks. In its most basic definition, “malware” is shorthand

Documents
Malware Attacks Around the World - Entrust Datacard · 2018-11-13 · MALWARE ATTACKS AROUND THE WORLD Ever since malware hit the scene in the late 1980s, these threats have proven

Malware Attacks Around the World - Entrust Datacard · 2018-11-13 · MALWARE ATTACKS AROUND THE WORLD Ever since malware hit the scene in the late 1980s, these threats have proven

Documents
SECURE, PREVENT AND PROTECT - NCR · Typically, these attacks fall into three major categories: • Black box attacks • Malware in the network • Malware installed on the ATM In

SECURE, PREVENT AND PROTECT - NCR · Typically, these attacks fall into three major categories: • Black box attacks • Malware in the network • Malware installed on the ATM In

Documents
Hypervisor-Based Systems for Malware Detection …...Anti-malware software is effective to detect and/or prevent attacks of malware But, the anti-malware approach has several problems

Hypervisor-Based Systems for Malware Detection …...Anti-malware software is effective to detect and/or prevent attacks of malware But, the anti-malware approach has several problems

Documents
How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Documents