Upload File

malware most wanted: security ecosystem

28

Upload: cyphort

Post on 12-Jul-2015

321 views

Category:

Technology


1 download

Report

Tags:

TRANSCRIPT

Page 1: Malware Most Wanted: Security Ecosystem
Page 2: Malware Most Wanted: Security Ecosystem

It Takes An EcosystemTo Defend Against APT

Fengmin Gong

Chief Strategy Officer

Page 3: Malware Most Wanted: Security Ecosystem

Your speakers today

Dr. Fengmin GongChief Strategy Officer and

Co-Founder

Anthony JamesVP of Products & Marketing

Page 4: Malware Most Wanted: Security Ecosystem

Agenda

o Open Secret: Malware is winning

o Orientation: What’s going on?

o Decision: New defense paradigm

o Action: Building a secure ecosystem

o Tell – The only promise for us to win the war against modern threats is to build an effective security ecosystem of defenders!

o Show – How ecosystem approach works by examples

o Wrap-up and Q&A

Cyp

ho

rt L

abs

T-sh

irt

Page 5: Malware Most Wanted: Security Ecosystem

Threat Monitoring & Research team

________

24X7 monitoring for malware events

________

Assist customers with their Forensics and Incident Response

We enhance malware detection accuracy

________

False positives/negatives________

Deep-dive research

We work with the security ecosystem

________

Contribute to and learn from malware KB

________

Best of 3rd Party threat data

Page 6: Malware Most Wanted: Security Ecosystem

6

Page 7: Malware Most Wanted: Security Ecosystem

Open Secret, Sad Reality

Cyber bad actors are winning

Well known direct victimso Sony: PlayStation network, DDoS, & Sony Pictures breacho Target, 40milion cards+70milion other accounts, CEO oustedo “Nemanja” POS botnets of 1478 hosts in 36 countries

Indirect victimso Card issuers, merchants & consumers

Why So Sad & Bado Too late: discovered after many monthso Too much: name, address, DOB, SSN & driver’s license #o Too little: “Will help you monitor your credit reports!”o Too easy: most attacks did not even use 0-day exploit

7

Page 8: Malware Most Wanted: Security Ecosystem

Not Only The Naïve Fall Victim

What: March 17, 2011, RSA warned of SecurID threats

What’s Stolen: RSA One-Time-Password Sensitive Info

Conclusion: It probably made Rivest, Samir, and Adleman want to withdraw their names from RSA

8

Spear-phising Attack“2011 Recruitment plan.xls”

RSA Pre Office 2010

Flash pre 3/21Patch

RAT

2

Adobe FlashPlayer 0-Day

2-FACTORSECRETS

3

1

Page 9: Malware Most Wanted: Security Ecosystem

Threat Life Cycle – Generic Kill Chain

9

ActionManual and/or auto mitigation and policy enforcement.

ReconnaissanceAttacker analyzes potential targets.Command & Control

Malware misses mom and calls home.

WeaponizeMalware is groomed for success.

InstallMalware installs exploitive features on

system.

DeliverMalware payload infiltrates host system.

ExploitMalware finds access point.

ThreatPotential threat is born or reborn.

.

Page 10: Malware Most Wanted: Security Ecosystem

Exfiltrate:DataTheft

SpamPhishing

DDoSInstall:HTTP

SocialNetP2P

Threat Life Cycle – Detection Insights

10

Download:HTTP

FileShareFTPP2P

• Traffic anomaly• Exec anomaly• Content anomaly• Exploit sig

• App anomaly• Attack sig• Traffic anomaly• Reputation

• Behavior anomaly• Reputation• Malware sig

• CnC sig• Traffic anomaly• Reputation

• App anomaly• CnC sig• Traffic anomaly• Reputation

Infect:Exploit Pack Drive-By

Social EngineeringEmail Target

Page 11: Malware Most Wanted: Security Ecosystem

Modern Threats TTP (Technique, Tactic, & Procedure)

11

o Web Based + Social Engineering

o Multiple Infection Vector

o Obfuscated & Encrypted

o Multi-Component Delivery

o Anti-static analysis & sandboxing

o Network Distributed – Botnets

o Polymorphism & Self Update

1. Hard To Capture Using Simple Sigs

2. Hard To Detect Using Single Approach

3. Impossible To Prevent From A Single Point

Page 12: Malware Most Wanted: Security Ecosystem

Many Actors: Context Is Important

12

CnC

Servers

Upload/

Download

Servers

Legit

Merchants

Financial

Institutions

Consumers

Legit

Corporations

Questionable

Providers

Malware

Writers

Bot

Herders

Spam/Phish

Pushers

Questionable

Advertisers/

Merchants

Illegal

merchants

Pushers

ID/Account

Stealers

Infection

Servers

Espionage

Direct

(Infect)

Victim

Indirect

(Fraud)

Victim

Cri

me

Va

lue

Ch

ain

Page 13: Malware Most Wanted: Security Ecosystem

Users Are A Critical Success Factor

13

Enterprise Security

Challenges

• Advanced TTP• Industrialized cyber crime• Corporate & nation state

actors

• Problems on the ground• Urgency for tools• Expectation for “fit”

• Global• Mobile• Consumerization• Big Data• SaaS Cloud

• Blurred Intra-Extra-Internet

• Virtualization & cloud delivery

• Unified business infrastructure: ERP, ICS & IoT

• SD-X: Software-defined X

Page 14: Malware Most Wanted: Security Ecosystem

SQL Injection

Cross-Site Script

Web plugIn/Apps

Exploit

Social Engineering

User-Gen Content

Malvertizing

Lost Generation, Lost Paradigm

14

SaaSMsg Security

Web Security

Sig

Heuristics

Reputation

Sandboxing

NetworkSMG

SWG

IPS

UTM

NGFW

Sig

Anomaly

Sandboxing

HostAV

IPS

UTM

Sig

Heuristics

MemProt

Virus

OS/Server Exploit

Client Exploits

Network Worm

Mail Worm

Industrialized

Production of

Exploits/Packer/

Coder/Malware

Corporate

Nation State

Multi-vector, targeted, multi-component, network-enabled, & automated AGAINST largely single-method, blind, siloed, & manual

Page 15: Malware Most Wanted: Security Ecosystem

Quick Poll Break

Page 16: Malware Most Wanted: Security Ecosystem

New Paradigm - Security Ecosystem

o An environment in which all security devices & applications can share actionable threat intelligence (ATI) across IT infrastructure, locations, and organization boundaries, to mitigate security threats.

o We must focus on minimizing the attack consequences!

16

Page 17: Malware Most Wanted: Security Ecosystem

Practicing Ecosystem Defense

o All solutions support some Threat Intelligence Sharing protocols/APIs

o All access will be controlled with Strong Authentication

o The Access Control in operation still resides with the Owner, i.e. customer participating the ecosystem

Security Products Can Support Ecosystem Without Losing Their Competitive Edge, Customers Will Benefit From All The

Best Of Breed Solutions!

17

Page 18: Malware Most Wanted: Security Ecosystem

Quick Poll Break

Page 19: Malware Most Wanted: Security Ecosystem

Ecosystem Actions By Example

1. BackOff: CnC gen, infection detection, & exfiltration preventiono First sight, one store; benefit more stores, to stop any infiltration by the

same family

2. Sony Wiper: fingerprinting <dst-IP, initiator-MD5> for forensic analysis, containment, & cleanupo First sight, one infected machine; identify & protect all infected in the

organization

3. Infection Site Discovery: advanced warning & threat campaign trackingo Early detection of infected site, exploit pack (EP) analysis, global

protection, & campaign trending

19

Page 20: Malware Most Wanted: Security Ecosystem

Backoff: Reliable Snort CnC Rule

20

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:”BackOff HTTP Callback"; flow:established,to_server; content:”POST”; http_method; content:”$op=”; http_uri; content:”&id=”; http_uri; content:”&ui=”; http_uri; content:”&wv=“; http_uri; content:”&gr=“; http_uri; content:”&bv=“; http_uri; content:”/windebug/updcheck.php”; http_uri; classtype:trojan-activity; sid:891000; rev:2;)

Page 21: Malware Most Wanted: Security Ecosystem

Backoff: Reliable System IOC

o Unique Persistencyo Existence of mutex named “nUndsa8301nskal”o Existence of file “%APPDATA%\nsskrnl”, RC4 encrypted with the

password “Password”o Existence of clear text file “%APPDATA%\OracleJava\Log.txt” for

keystrokes

o ATI Extract & share…o Verify infiltration of a POS machine by checking the above persistent

artifactso Detect & block CnC using the simple Snort ruleo Anyone, anywhere, thereafter shall be protected

21

Page 22: Malware Most Wanted: Security Ecosystem

Sony Wiper: Seeing Once Is Enough

22

Page 23: Malware Most Wanted: Security Ecosystem

Static & Dynamic IOCs

o strings (D1C27EE7CE18675974EDF42D4EEA25C6)o calc.exeo 88.53.215.64o 217.96.33.164o 203.131.222.102o igfxtrayex.exeo net_ver.dat

o process (760c35a80d758f032d02cf4db12d3e55) behavioro Igfxtrayex.exe creates files “taskhost%random%.exe”o Igfxtrayex.exe is identical to “taskhost%random%.exe”

o Any EXE with those strings output is suspect; dropped EXE with the process behavior must be removed!

23

Page 24: Malware Most Wanted: Security Ecosystem

From IOC To Threat Fingerprints

o IOCs so far focus on detecting & verifying any infectiono Threat fingerprinting puts more emphasis on identifying

specifics of particular infectiono Specific TTPo Malware familyo Actors & intent

o ATI extract & share…o Host-X: HTTP_connections to dst

{203.131.222.102|217.96.33.164|88.53.215.64}, initiated by process {Y}, created from image {filename=“igfxtrayex.exe“|md5=“760c35a80d758f032d02cf4db12d3e55”}

24

Page 25: Malware Most Wanted: Security Ecosystem

Global Discovery & Sharing – Better Defense

o Cyphort Crawler Network

o Discovering 1684 infected sites

o Collected 421 bad IPs serving malware

o Collected hundreds of pcaps for web exploit pack

o Sharing ATI, power to all defenders!

25

Infected list for site owners, site visitors, SWGs,

threat researchers

IP blacklist for FW/IPS/NGFW users, threat researchers

What EP is active, used by whom,

targeting whom, for all defenders

Page 26: Malware Most Wanted: Security Ecosystem

Q and A

o Information sharing and advanced threats resources

o Blogs on latest threats and findings

o Tools for identifying malware

Page 27: Malware Most Wanted: Security Ecosystem

Thank You!

Page 28: Malware Most Wanted: Security Ecosystem

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware's Most Wanted: Linux and Internet of Things Malware

H1 2016 Global and Regional Trends of the ‘Most Wanted' Malware · PDF fileH1 2016 GLOBAL AND REGIONAL TRENDS OF THE ‘MOST WANTED’ MALWARE INTRODUCTION The malware world continues

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

HELP WANTED HELP WANTED HELP WANTED HELP WANTED

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware's Most Wanted: The Many Faces of Malware

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Malware infographic jpMalware_infographic_jp Subject A .ai of an infographic about the Top 5 Least Wanted Malware. Created Date 7/26/2016 11:27:54 AM

Metamorphic Malware 1 Metamorphic Malware Research

Intrusion Detection and Malware Analysis - Malware collection

Presentation title goes here - Open Reality · Automated content categorization, advanced machine learning, content analysis; advanced malware research team WebPulse ECOSYSTEM PacketShaper

The Malware Ecosystem - STALLION - 23 aastat Küberturbe ... · Malware that scares users into purchasing fake anti- ... largest spamming botnet of 2008, ... hrdogan-ironport.ppt

Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis trainingpart9 advanced malware analysis

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Malware and Anti-Malware Seminar by Benny Czarny

Ecosystem Services and Municipal Planning: …...Question 5 –Priority topic What services/support are currently available to assist local groups if they wanted to adopt an ecosystem

Evaluating Open Source Malware Sandboxes with Linux malware

Practical Malware Analysis: Ch 11: Malware Behavior

Malware & Anti-Malware

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware's Most Wanted (MMW): Backoff POS Malware

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Advanced malware analysis training session6 malware sandbox analysis

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Anatomy of a Malware Attack: The New Malware Ecosystem

ROBUST TELCO DIGITAL ECOSYSTEM - Comviva Digita… · TELCO DIGITAL ECOSYSTEM . A leading telecom company in Myanmar, with a 50% share of the total subscriber base, wanted to bring

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’