Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries...

26
Martin Rehak, CEO www.cognitive- security.com

Transcript of Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries...

Page 1: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

Martin Rehak, CEO www.cognitive-security.com

mailto:[email protected]
Page 2: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-2- 15. února 2012

1. Advanced Persistent Threats

2. Proliferation of advanced attacks

3. Professional black markets for higher malware efficiency

4. Polymorphic malware

5. Mobile malware

Advanced

Persistent

Threats

Poly-morphic Malware

Criminal Black eMarket-place

Mobile Malware

Proliferation

Page 3: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-3- 15. února 2012 Information Week - Strategic Security Survey '11

Page 4: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-4- 15. února 2012

―Given enough time… …criminals can breach virtually any single organization‖ - Verizon

Symantec – Internet Security Threat Report ‗11.Apr

*Verizon – ‗11 Data Breach Investigations Report

Page 5: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-5- 15. února 2012

―In looking at computer systems of consequence — in government, Congress, at the Department of Defense, aerospace, companies with valuable trade secrets — we‘ve not examined one yet that has not been infected by an advanced persistent threat.‖

Mike McConnell, (NY Times, Feb 11, 2012)

Page 6: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-6- 15. února 2012

―The key to these intrusions is that the adversary is motivated by a massive hunger for secrets and intellectual property‖

―[If] you‘re not seeing APT attacks in your organization, it is probably not that they are not occurring or that you‘re safe. It‘s more likely that you may need to rethink your detection capabilities.‖

McAfee – Revealed, Operation Shady RAT

Cisco - Global Threat Report 2Q11

Page 7: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-7- 15. února 2012

―…every company in every conceivable industry with significant size & valuable intellectual property & trade secrets has been compromised (or will be shortly)…‖ - McAfee

McAfee – Revealed, Operation Shady RAT

Page 8: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-8- 15. února 2012

Strategically motivated Compromise of specific info & processes

Confidentiality - Intellectual Property (IPR) compromise

Integrity • Industry processes

• Trading systems

Targeted Single/few targets

Original malware/exploit/attack techniques

Unique proxy/com. channels

Professional infiltration (social engineering, web, email, business partners)

Defined information scope

Page 9: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-9- 15. února 2012 Source: Damballa

Page 10: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-10- 15. února 2012

―…Before the intrusions were discovered nearly three years ago, Chinese hackers actually sat in on what were supposed to have been secure, online program-progress conferences, the officials say…‖

‖Defense analysts note that the JSF‘s information system was not designed with cyberespionage, now called advanced persistent threat, in mind. Lockheed Martin officials now admit that subcontractors (6–8 in 2009 alone, according to company officials) were hacked and ―totally compromised.‖ In fact, the stealth fighter program probably has the biggest ―attack surface‖ or points that can be attacked owing to the vast number of international subcontractors.‖

Aviation Week, via. Defense.org

Page 11: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-11- 15. února 2012

March ‗11: RSA Compromise ―Our investigation also

revealed that the attack resulted in certain information being extracted from RSA‘s systems. Some of that information is specifically related to RSA‘s SecurID two-factor authentication products…‖, ―…this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.‖ RSA/EMC SEC filling

April: L3 compromise discovered: ―L-3 Communications has been

actively targeted with penetration attacks leveraging the compromised information,‖ (Internal L3 email)

Lockheed Martin: ―Unknown hackers have broken

into the security networks of Lockheed Martin Corp & several other U.S. military contractors‖

―They breached security systems designed to keep out intruders by creating duplicates to "SecurID" electronic keys from EMC Corp's (EMC.N) (Reuters, May 27)

Raytheon/Boeing: …immediate companywide actions in March … "As a result of these actions, we prevented a widespread disruption of our network," he said.

Boeing […] had a "wide range" of systems in place to detect and prevent intrusions of its networks. "We have a robust computing security team that constantly monitors our network,"

http://www.reuters.com/finance/stocks/overview?symbol=EMC.N
Page 12: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-12- 15. února 2012

Together, the attacks suggest the RSA intruders obtained crucial information — possibly the encryption seeds for SecurID tokens — that they‘re using in targeted intelligence-gathering missions against sensitive U.S. targets.

Wired, May 2011

Page 13: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-13- 15. února 2012

―…But the scope of the problem is illustrated by an incident at the United States Chamber of Commerce in 2010.

The chamber did not learn that it — and its member organizations — were the victims of a cybertheft that had lasted for months until the Federal Bureau of Investigation told the group that servers in China were stealing information from four of its Asia policy experts, who frequent China. By the time the chamber secured its network, hackers had pilfered at least six weeks worth of e-mails with its member organizations, which include most of the nation‘s largest corporations. Later still, the chamber discovered that its office printer and even a thermostat in one of its corporate apartments were still communicating with an Internet address in China.‖

NY Times, 11.2.2012

Page 14: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-14- 15. února 2012

Target

• Select target, budget

• Operational & Tech planning

Exploit

• Deliver the exploit code

• Infiltrate targeted system

Operate

• Gather confidential data

• Integrity compromise

C&C

• Report the results

• Receive new orders

Clean

• Remove all traces

• Remove itself

Massive Virtualization, remote execution of suspicious files, behavioral inspection

- FireEye

Honeypot

(FireEye)

―[Using NetFlow]… security professionals can improve their ability to spot intrusions and other potentially dangerous activity. (Cisco)

- Cognitive Security, RSA, Damballa,…

Network Behavior Analysis (COSE)

Page 15: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-15- 15. února 2012

Line X Line X - targeted technology ―transfer‖ program managed by KGB to steal western technology

Closing approx. 10 years gap in application of research results

Analogous to current Asian-country originated threats

Farwell program CIA/NATO activity countering 1980‘s APT

Targeted disinformation and deception

Biggest-ever non-nuclear explosion credited to program

https://www.cia.gov/library/center-for-the-study-

of-intelligence/csi-publications/csi-

studies/studies/96unclass/farewell.htm

Page 16: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-16- 15. února 2012

Trend: Increasing size of network warfare units in non-NATO militaries

Results in mass of trained professionals on the market

Malware frameworks: From code libraries to malware-as-a-service model

Support, ticketing, charge-back,…

Widespread sophisticated malware used by ―common criminals‖

Improved malware due to better revenues

Perimeter defenses less effective

Antivirus is ineffective

Coping with increasing variety of original malware

Page 17: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-17- 15. února 2012 *Verizon – ‗10 Data Breach Investigations

Report

Page 18: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-18- 15. února 2012

% breaches / % records *Verizon – ‗11 Data Breach

Investigations Report

Page 19: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-19- 15. února 2012

Global technology base Exploits, malware, software frameworks and resources are developed and shared globally

High technical quality, functional specialization, global competition

Local targeting & exploitation Botnet operation, information harvesting from exploited PC‘s, information dissemination is performed locally

Monetization through hands-off markets Risk minimization for key players

Commoditization of technologies and intermediary products

1. Increasing technology level defined by global competition

2. Specialized, local command & control structures for specific exploits

3. Increasing competition between the attackers: botnets attacking each other, lawsuits…,

Page 20: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-20- 15. února 2012

Page 21: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-21- 15. února 2012

Polymorphism: self-modification of malware during lifetime

Syntactic polymorphism Packers, obfuscation: hiding from detection by IDS/IPS and AV

Semantic Modification of the malware behavior at runtime

Managed by C2, upgrades

Result of environmental conditions and local decision • Stuxnet

Use of genetic programming/algorithms to:

Learn the evasion techniques from individual IDS instances

Identify novel exploits by fuzzy testing-like approaches

Research & government use… for now

Page 22: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-22- 15. února 2012

Mobile devices hold a rich set of personal information: Location details

browsing & call history

contact lists & phone numbers

SMS, email & Facebook

Calendar details

Stored Passwords in clear text

Premium-rate calling

Internet Access remains a large vulnerability hole

Up-In-Coming Threats Micro-payment vulnerabilities

Access to corporate server

―LikeJacking‖

LookOut - Mobile Threat Report (11.Aug)

McAfee - Mobility and Security Dazzling

Opportunities, Profound Challenges (11.May)

Page 23: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-23- 15. února 2012

Recent Issues… iPhone ―Root-kitting‖ • Bypassing device security

Theft of smartphones, & tablets • sensitive records compromised

Spoofed ActiveSync policy apps • Reporting higher security than what is actually available

―Co-mingling‖ • Mixing private & corporate data

Malware • Stealing data & bandwidth

• Uncertified apps with malware

• Capturing info & forwarding J. Gold - A Heuristic Approach to

Mobile Security, ‗11

Page 24: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-24- 15. února 2012 LookOut - Mobile Threat Report (11.Aug)

Page 25: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-25- 15. února 2012

―If a company has significant intellectual property that the Chinese and Russians are interested in, and you go over there with mobile devices, your devices will get penetrated,‖ said Joel F. Brenner, formerly the top counterintelligence official in the office of the director of national intelligence.

NY Times, 11.2.2012

Page 26: Martin Rehak, CEO security · 2016-01-18 · Antivirus is Malware frameworks: From code libraries to malware-as-a-service model Support, ticketing, charge-back,… Widespread sophisticate

-26- 15. února 2012

Modern threats are immune to reactive defense posture: AV, IDS, anti-malware, DLP,…

Protecting company‘s business operations instead of the network

Security teams need to adopt to a more proactive, forward looking approach to cyber-security...

Based on initiative and business relevance


Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Boutique Polarised Sunglasses - Cloudinaryres.cloudinary.com/ddmbp4xnw/image/upload/v1513770577/LOCELL… · Boutique Polarised Sunglasses. Locello is a classic and sophisticate range

Boutique Polarised Sunglasses - Cloudinaryres.cloudinary.com/ddmbp4xnw/image/upload/v1513770577/LOCELL… · Boutique Polarised Sunglasses. Locello is a classic and sophisticate range

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Roman Rehak: 24/7 Database Administration + Database Mail Unleashed

Roman Rehak: 24/7 Database Administration + Database Mail Unleashed

HOSPITALITY - SICO · EVENT TABLES Sophisticate Plus True to its name, our Sophisticate catering table is a classy combination of style, mobility and durability. Ideal for any upscale

HOSPITALITY - SICO · EVENT TABLES Sophisticate Plus True to its name, our Sophisticate catering table is a classy combination of style, mobility and durability. Ideal for any upscale

Urbane Sophisticate Travel

Urbane Sophisticate Travel

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Metamorphic Malware 1 Metamorphic Malware Research.

Metamorphic Malware 1 Metamorphic Malware Research.

Alexandra Rehak

Alexandra Rehak

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges