webinar: insights from cyren's 2015 q2 cyber threats report

1©2014. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential. This document and the contents therein are the sole property of CYREN and may not be transmitted or reproduced without CYREN’s express written permission.

CYREN CyberThreat ReportAugust 2015Avi Turiel

2©2014. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.

• Hacking Team Breach • Java zero‐day• Phishing targets businesses• Spam trickery

Agenda

3©2014. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential. 3©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.

About CYREN

THE BEST KEPT SECRET IN INFORMATION SECURITY FOR MORE THAN A DECADEFounded in 1991, CYREN (NASDAQ and TASE: CYRN) is a long‐time innovator of cyber intelligence solutions. CYREN provides web, email, endpoint, and roaming cybersecurity solutions that are relied upon by the world’s largest IT companies to protect them and the billions of customers they serve from today’s advanced threats. CYREN collects threat data and delivers cyber intelligence through a unique global network of over 500,000 points of presence that processes 17 billion daily transactions and protects 600 million users.

3©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.


CYREN Powers the World’s Security

Our Cyber Intelligence forms the security backbone of many of the world’s largest and most influential information technology and Internet security brands.


Hacking Team Breach

&New Flash Malware


• Provides “easy‐to‐use offensive technology“• Includes spyware and other surveillance software• Sold to law enforcement and intelligence agencies

• 400 GB ‐ internal emails, documents and other data were stolen• Included malware code and zero‐day exploits

(undisclosed and uncorrected security vulnerabilities)

• Zero‐days: Flash (3), Windows (2), IE• Android fake news app, BIOS rootkit

Hacking Team


• Easily embed movies and animated content into websites• HTML5 now preferred method

• Flash V4 (1999) added ActionScript programming language• Used to execute arbitrary code

containing malicious functions

• More than 500 known vulnerabilities (CVE database)

Adobe Flash Player


• Flash Zero days provided as POCsource code

• Easily modified to execute a malicious program instead of calc.exe

Hacking Team “Proof of Concept” (POC)


• “exp2.swf” After exploit, further malware downloaded• W32/Poisonivy.FF

• Gives the attacker complete control over the infected computer. • File operations• Uploading and downloading• Viewing, suspending, or stopping the

running of processes or services;• Editing the registry;

Flash Exploit Downloads “PoisonIvy”

• Starting a remote command shell; • Keylogging and taking screenshots of

the desktop and recording audio or webcam footage.


• Update Flash• Use Web Security• Script blocking tools

• Usually include Java, JavaScript, Flash, and others• Result in very technical questions about website functionality• Video or audio may not work, ads might be blocked, comments may

not show up or images may not be displayed• The average user is not equipped with enough knowledge to use them

effectively

Protecting Users


Do you use a script blocker in your browser?• Yes• No – But considering it• No – Tried it and got too many messages• No – Not for me

(choose one)

Poll Question #1


• Cloud‐based secure web gateway• Innovative detection technologies

• Custom sandbox arrays used on a global basis• Automatically investigates IPs, domains, hosts, and files associated

with suspicious behavior and maintains risk scores• Inline antimalware and URL filtering

• Comprehensive protection for business users – whether office‐based, remote, or roaming

• Also protects users of Guest WiFi or Public WiFi services

CYREN WebSecurity


JavaZero‐DayMalware


• More than 375 known vulnerabilities (CVE database)

• July 2015 Critical Patch Update• Fixes a new zero‐day vulnerability

Java Vulnerabilities


• Hosted on several malicious sites• Spread as a link in an email targeting specific organizations • Reported similar campaigns targeted the White House and members of NATO• Contacts C&C server and Installs additional malware after exploit

• Uploads data about infected system

Java/Downloader.BM


• Chrome V42 disables NPAPI support• “improve Chrome’s security, speed, and stability as well as reduce

complexity in the code base”

• Still supported by Firefox and IE

Chrome drops Java Support


• Cumbersome for businesses• Updates are essential• Not integrated in browser updates

• Update includes “sponsor offers” (bundleware)

• Ask toolbar• Browser hijacker• Blocked by Microsoft

• Oracle dropping Ask and replacing with Yahoo

Java Update Issues


Have you ever installed a toolbar or “sponsor offer” by mistake?• Yes – so frustrating! • No – but came close once or twice!• No – I’m super ultra careful!

Poll Question #2


Phishing targeting business


• Aim for login credentials for actual business systems• Q2 – multiple examples of Outlook phishing

Phishing Businesses – Direct Attacks

• Credentials frequently used for domain logins• Provides attacker with the tools to

access far more than just email.

• Other cloud‐based services, such as Dropbox, or Salesforce can also provide an attacker with direct access to precious company internal data


• Series of attacks that add up to a successful phishing campaign• Example 1: Employee using their own Apple device

Phishing Businesses – Indirect Attacks

• iTunes credentials are phished• Contact and calendar information• Helps Attacker build picture of the

organizational structure

• Example 2: Cloud email• Platform for sending malicious emails

from “within” the company


What anti‐phishing solution(s) do you have? (Select up to 5) 1. Web content filtering2. Web security appliance3. Web security in the cloud4. Email security5. UTM appliance

Poll Question #3


Phishing targeting business

Spam Trickery


• Spammers automate sending • Billions of emails/day

• Example 1: Links in compromised destination sites

Randomized Spam – Easier Spam Detection (1)


• Example 2: X‐Mailer header• E.g.: legitimate messages from iPhones “X‐Mailer: iPhone Mail (12A405)”• X‐Mailer: R3JTLM MZ4LYAC NB2P5WF HM4FHNGNEI• X‐Mailer: R31TCF 210CYAS NB2N53F TA4GHZCFFK• X‐Mailer: B5LTDN 410CYCC NB2NH2F XE4HG3E3ML• X‐Mailer: Z5LTCN 4L0DQAS NAUPP3V TE4HHZCFFK• X‐Mailer: VF4NDF 2LSKZCS FB2FTJP GOK50YS5NJ

Randomized Spam – Easier Spam Detection (2)


Applied Cyber Intelligence


Q2 Android Threats


Q2 Phishing


Q2 Spam

31©2014. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.

You can also find us here:

www.CYREN.com

twitter.com/cyreninc

linkedin.com/company/cyren

©2015. CYREN Ltd. All Rights Reserved. Proprietary and Confidential.

Thank You. Any Questions or Thoughts?

webinar: insights from cyren's 2015 q2 cyber threats report

Technology

cyren nasdaqandtase

gb internalemails

biosrootkit hackingteam

teambreach newflash