Why Depending On Malware Prevention Alone Is No Longer An Option

Download PPTX Report

Upload
seculert
View
186
Download
0

Tags:

Embed Size (px)

DESCRIPTION

Over the last few years Seculert and other leading security companies have discovered many advanced malwares lurking on company networks that have gone undetected by standard advanced threat prevention solutions. Enterprises are now realizing that they need to find alternative solutions to protect their network. Learn why depending on malware prevention alone is no longer an option. Join Seculert’s CTO Aviv Raff for an in-depth webinar. Aviv Raff will address: - How recent malware such as Dexter and Shamoon entered company networks despite their APT prevention systems - How Seculert discovered Shamoon - Why your peers are moving to malware detection instead of prevention - How Big Data is an indispensable tool to fight Advanced Persistent Threats Raff is responsible for the fundamental research and design of Seculert’s core technology. Don’t miss out on hearing from the expert.

Citation preview

Why Depending On Malware Prevention Alone Is No Longer An Option

WEBINAR

July 18, 2013

Page 2: Why Depending On Malware Prevention Alone Is No Longer An Option

Welcome

Aviv RaffChief Technology Officer

Debbie Cohen-AbravanelVP Online Marketing

Are you on Twitter? Use #seculertjuly2013 to connect with us during and after the presentation.

Page 3: Why Depending On Malware Prevention Alone Is No Longer An Option

Advanced Threats in the News

Page 4: Why Depending On Malware Prevention Alone Is No Longer An Option

Define Target

Create/Acquire Malware

Researchthe Target

"QA" for Detection

Infect the Target"Call ..Home"

ExpandAccess

ExtractData

EnhancePresence

Stay Undetected .

How Advanced Threats Work

1. Preparation

2. Infection

3. Deployment

4. Persistence

AdvancedPersistent

Threat

Page 5: Why Depending On Malware Prevention Alone Is No Longer An Option

Define Target

Create/Acquire Malware

Researchthe Target

"QA" for Detection

Infect the Target"Call ..Home"

ExpandAccess

ExtractData

EnhancePresence

Stay Undetected .

Traditional Defenses

• Focus on prevention:– Endpoint products– Firewalls– IPS / IDS

• Is 100% prevention really feasible?– 0-day exploits– Spear-phishing– Remote access (VPN)

– BYOD– Partners– Physical access

AdvancedPersistent

Threat

Page 6: Why Depending On Malware Prevention Alone Is No Longer An Option

• Shamoon is a 2-stage attack targeting Oil & Energy companies

• Comprised of 3 modules– Dropper– Reporter– Wiper

• Extracting data via an internal infected machine proxy

Shamoon Targeted Attack

Page 7: Why Depending On Malware Prevention Alone Is No Longer An Option

• Spreading itself on the local network via Scheduled Tasks

• Abuse a legitimate & signed RawDisk driver to wipe MBR

• Wiper module Time Bomb– Wipe drive and MBR at

specified dates and times– Others copycat this capability

Shamoon Targeted Attack

Page 8: Why Depending On Malware Prevention Alone Is No Longer An Option

• Initial attack vector is still unknown– Physical access / Insider– Partner– Spear phishing

• Time based attack (time bomb)• Worm spreading in local network• Using local machine as a proxy• Most of the victim companies were using

solutions which are focused on prevention

Shamoon – Why It Wasn’t Prevented?

Page 9: Why Depending On Malware Prevention Alone Is No Longer An Option

• A customer uploaded a suspicious file to the Seculert Elastic Sandbox

• Malware behavioral profile was automatically created

• Shamoon was detected on another customer using Big Data analysis of their gateway traffic logs

• Customers use Seculert API to enhance their on-premises security devices to protect against Shamoon

How Seculert Identified Shamoon?

Page 10: Why Depending On Malware Prevention Alone Is No Longer An Option

From Prevention to Protection

Persistent attacks require a new approach

Big Data analytics

Long-term analysis

Advanced malware profiling

Automated expertise

Page 11: Why Depending On Malware Prevention Alone Is No Longer An Option

Don’t forget to use

#seculertjuly2013 on Twitter!

Visit us at: TT17

Page 12: Why Depending On Malware Prevention Alone Is No Longer An Option

Q & A

Page 13: Why Depending On Malware Prevention Alone Is No Longer An Option

Thank Youseculert.com/signup

Don’t forget to use

#seculertjuly2013 on Twitter!

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents

Reversing & malware analysis training part 8 malware memory forensics

Technology

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Technology

Malware: Malicious Softwarecs.armstrong.edu/rasheed/ITEC2010/Slides7.pdf · Viruses, Worms, Trojans, Rootkits • Malware can be classified into several categories, depending on propagation

Documents

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Documents

Defending Hardware-based Malware Detectors against … · 2020. 7. 28. · optimization and performance tuning of the cyber-physical system. The number of accessible HPCs varies depending

Documents

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Documents

Reversing malware analysis training part8 malware memory forensics

Technology

Grace Alone Faith Alone Christ Alone Scripture Alone God’s Glory Alone

Documents

Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Technology

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents

RICHLAND COUNTY ADMINISTRATION & FINANCE COMMITTEE … · project, there will be two remaining, stand-alone phases available for constructionin the future, depending upon the future

Documents

Evaluating Open Source Malware Sandboxes with Linux malware

Documents

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Documents

Intrusion Detection and Malware Analysis - Malware collection

Documents

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents

Metamorphic Malware 1 Metamorphic Malware Research

Documents

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents

Analisis dan Deteksi Malware Menggunakan Metode Malware

Documents

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents

Windows Malware Firewall: Remove Windows Malware Firewall

Technology

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents

Malware and Anti-Malware Seminar by Benny Czarny

Technology