October 2015 The Evolving Malware Threat Past Present

October 2015 The Evolving Malware Threat (Past, Present, & Future) Larry G. Wlosinski, Company CISSP, CAP, CCSP, CISM, CISA, CRISC, CBCP, CDP, ITIL v 3 L_Wlosinski@Hotmail. com LOGO 1

Larry G. Wlosinski CISSP, CAP, CCSP, CISM, CISA, CRISC, CBCP, CDP, ITIL v 3 § Federal Government Experience (25+ yrs) EPA, NIH, CMS, DOJ, DHS, DOE, DIA, NOAA, SSA § Commercial Industry Experience (14 yrs) Insurance, International & Interstate Banking, Collections, Small Business § Consulting Experience Veris Group, LLC – Senior Associate Computer Sciences Corp. (CSC) – Section Manager Lockheed Martin – IT Security Manager Booz Allen Hamilton (BAH) – Associate And others – Sr. IT Security Engineer, Project Manager, etc. § IT Security Expertise (16+ yrs) Cybersecurity IT Security Assessments (C&A/A&A, Risk, Audit) Continuity Planning (OEP, BIA, ISCP, COOP, DRP, Devolution, etc. ) Cloud Security Policy, Procedures, Guidance, Standards, Templates, Checklists Incident Response & Planning 2

Agenda § § § § § Malware – Past Types of Viruses Malware Hiding Places Types of Trojan Horses Type of Botnet Attacks Recent Examples - Present Takedowns - Past Trends and Predictions - Future Threats & Countermeasures – Past & Present Malware as a Service (Maa. S) – Future? 3

Sample Infection Process 4

Malware - Past Company LOGO 5

Cyber Attack Sophistication Continues To Evolve* Cross site scripting High packet spoofing bots “stealth” / advanced scanning techniques Tools Staged attack distributed attack tools www attacks automated probes/scans denial of service sniffers Intruder Knowledge sweepers GUI back doors network mgmt. diagnostics disabling audits hijacking burglaries sessions Attack Sophistication exploiting known vulnerabilities password cracking self-replicating code Low Source: CERT Attackers password guessing 1980 1985 1990 1995 *Secure Science Corporation 2006 2000+ 6 6

Types of Malicious Code § § § § Virus Trojan Horse Worm Logic Bomb Trap Door Keylogger Rootkit Spyware § § § Adware Scareware Crimeware Malicious Apps Command & Control (C&C) § Bots & Botnets § Data Proximity Copier 7

Top 10 File Types Associated With Distributed Malware 8

Top 10 ISPs Hosting Malware Compared (Hosting Providers) 9

Top 10 Malware Sites 10

11 11

12

Distribution of Mobile Malware by Type, Q 1 2015 13

Banking Trojan Evolution 14

Number of Mobile Banker Trojans Detected (Q 1 2014 – Q 1 2015) 15

Vulnerable Word. Press Versions Discovered 16

Word. Press Exploited § Word. Press is a Content Management System (CMS) used extensively to create business web sites. § “Thousands of Word. Press sites host Neutrino Exploit Kit” http: //securityaffairs. co/wordpress/39495/cyber-crime/neutrino-exploit-kitwordpress. html? utm_source=hs_email&utm_medium=email&utm_content=21503522 &_hsenc=p 2 ANqtz-8 kt. T 2 A_up. Od. Piu. C 3 FONJq 68 HSe. KCAsb 22 S 8 h. Wsbg 4 Dn_qk. X 5 c. Fle. XABXz 741 mh. RC 8 i. Eco. Mv 2 t. Sh. BOMb. YAHb 0 JOLXQA&_hsmi=21503522 § “Solving Word. Press Security Weaknesses for 10 Million+ Websites” http: //www. verisgroup. com/wp-content/uploads/2015/06/Securing-Word. Press-whitepaper. pdf 17

Types of Viruses Multipartite Appending Overwriting Companion Cluster Polymorphic Company LOGO Tunneling Stealth Bimodal Self-garbling Memory Resident Proof of Concept 18

Virus Types § Multipartite – a multi-part virus, a virus that attempts to attack both the boot sector and the executable, or program, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system�� s files, and when the virus attaches to the files, it will in turn infect the boot sector. § Appending - A virus that inserts a copy of its malicious code at the end of the file. The goal of an appending virus is not to harm the host program, but to modify it to hold the virus code and then be able to run itself. § Overwriting - A type of computer virus that will copy its own code over the host computer system's file data, which destroys the original program. After your computer system has been cleaned using an antivirus program, users will need to install the original program again. http: //www. webopedia. com/TERM/V/virus. html 19

Virus Types § Companion - A type of computer virus that compromises a feature of DOS that enables software with the same name, but different extensions, to operate with different priorities. For example you may have program. exe on your computer, and the virus may create a file called program. com. When the computer executes program. exe, the virus runs program. com before program. exe is executed. In many cases, the real program will run so users believe that the system is operating normally and aren't aware that a virus was run on the system. § Cluster - A type of computer virus that associates itself with the execution of programs by modifying directory table entries to ensure the virus itself will start when any program on the computer system is started. If infected with a cluster virus it will appear as if every program on the computer system is infected; however, a cluster virus is only in one place on the system. http: //www. webopedia. com/TERM/V/virus. html 20

Virus Types § Polymorphic - A virus that changes its virus signature (i. e. , its binary pattern) every time it replicates and infects a new file in order to keep from being detected by an antivirus program. § Tunneling – A type of virus that attempts installation beneath the antivirus program by directly intercepting the interrupt handlers of the operating system to evade detection. § Stealth – A computer virus that actively hides itself from antivirus software by either masking the size of the file that it hides in or temporarily removing itself from the infected file and placing a copy of itself in another location on the drive, replacing the infected file with an uninfected one that it has stored on the hard drive. http: //www. webopedia. com/TERM/V/virus. html 21

Virus Types § Bimodal - Also called a Boot Sector Infector, a bimodal virus is one that infects both boot records and files on the computer system. § Self-garbling - A type of computer virus that will attempt to hide from an antivirus program by garbling its own code. When a self-garbling virus propagates it will change the encoding of its own code to trick antivirus programs and stay hidden on the computer system. § Memory resident - A virus that stays in memory after it executes and after its host program is terminated. In contrast, non-memory-resident viruses only are activated when an infected application runs. http: //www. webopedia. com/TERM/V/virus. html 22

Virus Types § Proof of Concept - A proof of concept virus is written by an individual with advanced programming skills, usually to 'show off' their programming talents or to point out a vulnerability in a specific software. Usually authors of proof-of-concept viruses will send these programs to an anti-virus software developer, and the programmer would be more apt to produce a blueprint on how the virus would work, rather than launching the virus maliciously. http: //www. webopedia. com/TERM/V/virus. html 23

Malware Hiding Places Executables Word Excel Power. Point Company Obfuscation Techniques LOGO 24 24

Malware Hiding Places File Type Description bat DOS batch file ohm HTML Help Compiled Help File cmd com cpl css exe hlp hta jar js Executed by shell 32. dll hh. exe Category Executable script Execution through built-in OS application Command File shell 32. dll Executable script DOS command file shell 32. dll Executable binary Windows Control Panel rundll 32. exe Execution through built-in OS Extension application Hypertext Cascading Style Sheet shell 32. dll Execution through built-in OS application Executable file Directly executed Executable binary Windows Help File shell 32. dll Execution through built-in OS application Hypertext Application mshta. exe Execution through built-in OS application Java Archive JRE Executable binary Java. Script Source Code WScript. exe Executable script 2525

Malware Hiding Places (2) File Type Description Executed by Category jse JScript Encoded Script File WScript. exe Executable script lnk msc rundll 32. exe mmcbase. dll msi msp pif Windows Shortcut File Microsoft Management Console Snap-in Control File Windows Installer Patch Windows Program Information reg Registry Data File msiexec. exe File Directly executed regedit. exe Executable reference file Execution through built-in OS application Executable binary Executable reference file scr Windows Screen Saver rundll 32. exe shs vbe vbs wsf wsh Shell Scrap Object File VBScript Encoded Script File VBScript File Windows Scripting File Windows Script Host Settings File shscrap. dll WScript. exe Execution through built-in OS application Executable binary Executable script Executable reference file 2626

Hiding Places - Word File Type doc Description Word document docm Word macro document docx Word document dot Word template dotm Word macro template dotx Word template iqy Word template rtf Word Rich Text Format wbk Word back-up file wiz Word wizard 2727

Hiding Places - Excel File Type csv odc Slk xlam xlk xll xlm xlsb xlsm xlsx xltm xltx xlw Description Excel comma-separated variables Excel data connector Excel data exchange file Excel add-in Excel macro add-In Excel backup Excel add-in Excel macro document Excel binary project Excel macro document Excel template Excel macro template Excel workspace 2828

Hiding Places - Power. Point File Type odp potm potx ppam ppsm ppsx pptm pptx pwz sldm sldx Description Powerpoint Open. Document (Ver 2) Presentation Powerpoint template Powerpoint macro template Powerpoint add-in Powerpoint macro add-in Powerpoint slideshow file Powerpoint slideshow macro file Powerpoint slideshow file Powerpoint presentation file Powerpoint macro presentation file Powerpoint wizard Powerpoint slideshow macro file Power. Point slideshow file 2929

Obfuscation Techniques: [MPack] § Utilizes the Javascript escape function to convert ASCII characters to hexadecimal equivalents. § Uses a simple rotation cipher § Utilizes Javascript to split strings apart § Saves the payload to execute as a partially random filename, starting with ‘sys’ on the victim machine 3030

Types of Trojan Horses Company LOGO 31

Trojan Types § § § § Backdoor Exploit Rootkit Trojan-Banker Trojan-DDo. S Trojan-Downloader Trojan-Dropper § § § § Trojan-Fake. AV Trojan-IM Trojan-Ransom Trojan-SMS Trojan-Spy Trojan-Mailfinder Inception Trojan 32

Trojan Types § Backdoor Gives malicious users remote control over the infected computer. Enables the author to do anything they wish on the infected computer – including sending, receiving, launching, and deleting files, displaying data, and rebooting the computer. Often used to unite a group of victim computers to form a botnet or zombie network that can be used for criminal purposes. § Exploit - Exploits are programs that contain data or code that takes advantage of a vulnerability within application software that’s running on your computer. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 33

Trojan Types § Rootkit - Rootkits are designed to conceal certain objects or activities in your system. Often their main purpose is to prevent malicious programs being detected – in order to extend the period in which programs can run on an infected computer. § Trojan-Banker - Trojan-Banker programs are designed to steal your account data for online banking systems, e-payment systems, and credit or debit cards. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 34

Trojan Types § Trojan-DDo. S - These programs conduct Do. S (Denial of Service) attacks against a targeted web address. By sending multiple requests – from your computer and several other infected computers – the attack can overwhelm the target address… leading to a denial of service. § Trojan-Downloader - Can download and install new versions of malicious programs onto your computer – including Trojans and Adware. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 35

Trojan Types § Trojan-Dropper – Used to install Trojans and/or viruses, or to prevent the detection of malicious programs. § Trojan-Fake. AV - Simulates the activity of antivirus software. Designed to extort money from you for the detection and removal of threats even though the threats they report are actually non-existent. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 36

Trojan Types § Trojan-IM - Steal your logins and passwords for instant messaging programs (e. g. , ICQ, MSN Messenger, AOL Instant Messenger, Yahoo Pager, Skype). § Trojan-Ransom - Can modify data on your computer so that your computer doesn’t run correctly, or you can no longer use specific data. The criminal will only restore your computer’s performance or unblock your data, after you have paid them the ransom money that they demand. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 37

Trojan Types § Trojan-SMS - Can cost you money by sending text messages from your mobile device to premium rate phone numbers. § Trojan-Spy - Can spy on how you’re using your computer (e. g. , tracking the data you enter via your keyboard, taking screen shots, or getting a list of running applications). § Trojan-Mailfinder - Can harvest email addresses from your computer. https: //usa. kaspersky. com/internet-security-center/threats/trojans#. VYb. KY 1 KPuv 0 38

Inception Trojan The ‘Inception’ trojan can respond to 14 commands: 1. photo - uploads photo from your gallery 2. contact - uploads phone contacts 3. call_log - uploads call history 4. upload_message - uploads text messages 5. location - uploads location of the user's device 6. send_message - send text message 7. phone - uploads phone info including phone number 8. list_file - uploads file paths of files on external storage 9. upload_file - uploads file from device by path 10. delete_file - delete file by file path 11. download - download file 12. call_number - makes phone call 13. record - record microphone for designated period of time, and upload it 14. combine - combination of four commands (phone, contact, call_log, upload_message) commands 39

DDo. S Adware Spyware E-mail Spam Click Fraud Fast Flux Brute Force Worms Scareware Game Types of Botnet Attacks Company LOGO 40

Types of Botnet Attacks § Distributed Denial-of-Service (DDo. S) - Multiple systems submit as many requests as possible to a single Internet computer or service, overloading it and preventing it from servicing legitimate requests. An example is an attack on a victim's phone number. The victim is bombarded with phone calls by the bots, attempting to connect to the Internet. § Adware - Advertises a commercial offering actively and without the user's permission or awareness. For example by replacing banner ads on web pages with those of another advertiser. 41

Types of Botnet Attacks § Spyware - Software which sends information to its creators about a user's activities (e. g. , passwords, credit card numbers, and other information that can be sold on the black market. § Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential corporate information (e. g. , Aurora botnet). 42

Types of Botnet Attacks § E-mail spam - E-mail messages disguised as messages from people, but are either advertising, annoying, or malicious. § Click fraud - When the user's computer visits websites without the user's awareness to create false web traffic for personal or commercial gain. § Fast Flux - DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies. 43

Types of Botnet Attacks § Brute-forcing remote machines services such as FTP, SMTP and SSH. § Worms - The botnet focuses on recruiting other hosts. § Scareware - Software that is marketed by creating fear in users. Once installed, it can install malware and recruit the host into a botnet. For example users can be induced to buy a rogue antivirus to regain access to their computer. § Exploiting systems by observing users playing online games such as poker and see the players' cards. 44

Recent Examples - Present Company LOGO 45

Zeus Virus § Zeus, Zeu. S, or Zbot is a Trojan horse malware package that runs on versions of Microsoft Windows. While it is capable of being used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the Crypto. Locker ransomware. Zeus is spread mainly through drive-by downloads and phishing schemes. § Zeus is very difficult to detect even with up-to-date antivirus and other security software as it hides itself using stealth techniques. It is considered that this is the primary reason why the Zeus malware has become the largest botnet on the Internet: some 3. 6 million PCs are said to be infected in the U. S. alone. https: //en. wikipedia. org/wiki/Zeus_%28 malware%29 46

Malware News Date 9/15/15 Category DDo. S Headline The Rise in Repeated 'Low and Slow' DDo. S attacks 9/10/15 Ransomware PIN-changing, screen-locking Android ransomware 9/9/15 Russian hacking group uses satellites to hide C&C servers DD 4 BC extortionist group launched over 140 DDo. S attacks: DDo. S Akamai. Zimperium releases exploit code for testing against Stagefright Exploit Kit vulnerability 9/8/15 Malware 9/9/15 C&C Turla Malware Group Hid C&C Traffic in Satellite Links Verified Play Store apps found to be spreading MKero malware Ransomware risk from over 140 million websites, researchers 9/7/15 Ransomware warn 47

Malware News Date 8/31/15 Category Bot Headline IBM warns of new Core. Bot stealer 8/31/15 i. OS Malware Key. Raider’ i. OS malware targets jailbroken devices Web Hackers linked to Russian government impersonate EFF Web 8/31/15 infection site to spread malware 8/26/15 Malvertising Zero-day, Angler kit exploits help drive up malvertising by 325%. 8/26/15 Researchers uncover new Italian RAT u. Warrior 8/26/15 RAT Sales Malware 8/25/15 RATs Auto. It used in targeted attacks to move RATs 8/25/15 Tor increasingly used by malicious actors: IBM 8/24/15 RAT Alien. Spy. RAT resurfaces as Jsocket 8/24/15 Trojan New Zeus variant “Sphinx” offered for sales Dyre trojan uses semi- random file names to evade detection 48

Malware News Date Category Headline 8/13/15 Ransomware Android ransomware locks up devices, has additional features 8/12/15 Malware Blacklists miss 90% of malware blogged IP love Angler EK exploits recently patched IE bug to deliver 8/11/15 Ransomware ransomware 8/4/15 Exploit Kit RIG Exploit Kit 3. 0 succeeded in infecting 1. 25 million machines 8/4/15 Malvertising hits Yahoo! ad network 7/28/15 Malvertising Over 10 million Web surfers possibly exposed to malvertising POS Explooit 7/28/15 Kit Cybercriminals use Angler exploit kit to target Po. S systems Flash zero-day monster Angler dominates exploit kit crime 7/23/15 Exploit Kit market. 7/22/15 Malware Bartalex variants spotted dropping Pony, Dyre malware 7/16/15 Malware New Gama. Po. S malware targets U. S. companies 49

Malware News Date Category 7/15/15 Malware 7/13/15 Trojan 7/6/15 Malware 7/3/15 Trojan 7/1/15 Malware 6/25/15 Malware Headline Hacking Team malware hides in UEFI BIOS to survive PC reinstalls Tesla. Crypt 2. 0 makes it impossible to decrypt affected files HTML 5 can be used to hide malware in drive-by download attacks APT group uses Seaduke trojan to steal data from high-value targets KINS malware toolkit leaked online Ad fraud trojan Kovter patches Flash player, IE to keep other malware out 4, 900 new Android malware strains discovered every day Click-fraud attack morphs into ransomware risk in a couple of 6/26/15 Ransomware hours U. S. healthcare companies hardest hit by ‘Stegoloader’ malware 50

Malware News Date Category Headline 6/25/15 Trojan that hides inside images infects healthcare organizations 6/24/15 Macros Cyber-crime economy triggers rise in malicious macros 6/24/15 Malware Dyre an Emerging Threat - Targets 1, 000 banks 6/24/15 Malware Dyre banking malware uses 285 command control servers 6/23/15 Malware Android malware dominates mobile threat landscape 6/12/15 Malware 6/11/15 Malware Fileless malware makes almost 200, 000 victims mostly in the U. S. 6/10/15 Malware Stuxnet still a threat to critical infrastructure 6/9/15 Malware Cyber-thieves cash in from malware 44. 5 million new malware variants recorded in 1 month Malvertising campaign hits Bejeweled Blitz game on Facebook, 6/11/15 Malvertising CNN Indonesia 51

Malware News Date Category Headline 6/8/15 Malware 6/5/15 Trojan Zeus banking trojan variant goes completely undetected 6/4/15 Botnet Adware-laden Skype botnet disrupted 6/3/15 Malware 5/29/15 5/20/15 Vawtrak banking malware found to use Tor 2 Web Point-of-sale (POS) malware (Malum. POS) can be configured to target nearly any POS system Cloud providers hit hard by DDo. S attacks in Q 1: Veri. Sign Russian crypto-malware encrypts files completely Angler Exploit Kit exploiting new Adobe vulnerability, dropping Exploit Kit Crypto. Wall 3. 0 Non-sophisticated malware steals thousands of credentials from Malware targeted SMBs Amount of new malware strains more than doubled in second Malware half of 2014 52

Malware News Date Category 5/4/15 Malware 4/28/15 Malware Headline Malware known as Rombertik goes to great lengths to evade analysis Malware delivered via malicious macro in Word document embedded in PDF 4/26/15 Botnets Banking botnets persist despite takedowns 4/22/15 Malware uses invisible command line argument in shortcut file 4/21/15 Exploit Kit Fake antivirus delivered to users in the US via Fiesta exploit kit 4/21/15 Malware New fileless malware (Phasebot) found in the wild 4/21/15 Malvertising Zero-day malvertising attack went undetected for two months 4/20/15 Ransomware New ransomware "Threat Finder" delivered by Angler exploit kit 4/20/15 Botnet 4/20/15 Malware Pushdo spamming botnet gains strength again New variant of Upatre malware downloader integrates full SSL encryption 53

Takedowns – Past Company LOGO 54

Takedowns & Sentencing Date Category Title 7/15/15 Takedown More Than 70 Arrests accompany Darkode Takedown 7/9/15 Conviction Estonian man pleads guilty to role in DNSChanger botnet scheme 6/25/15 Takedown The downfall of a major cybercrime ring exploiting banking trojans 6/23/15 Sentencing Black. Shades Purveyor Sentenced to Prison 6/23/15 Extradition 5/29/15 Sentencing Silk Road Mastermind Sentenced to Life in Prison Most-wanted cybercriminal extradited to U. S. from Germany 55

Botnets & Takedowns Date created Date dismantled Name Ramnit Estimated no. of bots Aliases 2011 or earlier 2015 -02 2009 (May) 2010 -Oct (partial) Bredo. Lab 30, 000 2008 (around) 2009 -Dec Mariposa 12, 000 Conficker 10, 500, 000+ Ramnit 3, 000 TDL 4 4, 500, 000 Zeus 3, 600, 000 (US only) 2007 (Around) Cutwail 1, 500, 000 2008 (Around) Sality 1, 000 Sector, Kuku Grum 560, 000 Tedroo 2008 (November) 2011 or earlier 2015 -02 2010 (around) 2009 (Around) 2012 -07 -19 3, 000 https: //en. wikipedia. org/wiki/Botnet) Oficla Down. Up, Down. And. Up, Down. Ad. Up, Kido TDSS, Alureon Zbot, PRG, Wsnpoem, Gorhax, Kneber Pandex, Mutant (related to: Wigon, Pushdo) 56

Botnets & Takedowns Date created Date dismantled 2007 (March) 2008 (November) 2004 (Early) 2006 (Around) 2011 (March) Name Estimated no. of bots Aliases Mega-D 509, 000 Ozdok Kraken 495, 000 Kracken Srizbi 450, 000 Cbeplay, Exchanger Lethic 260, 000 none Bagle 230, 000 Beagle, Mitglieder, Lodeight Marina Botnet 6, 215, 000 Damon Briant, BOB. dc, Cotmonger, Hacktool. Spammer, Kraken Torpig 180, 000 Sinowal, Anserin Storm 160, 000 Nuwar, Peacomm, Zhelatin Rustock 150, 000 RKRustok, Costrat Donbot 125, 000 Buzus, Bachsoy https: //en. wikipedia. org/wiki/Botnet) 57

Botnets & Takedowns Date created Date dismantled 2012 (Around) 2008 (November) 2008 (Around) 2010 (January) 2010 (March) Name Estimated no. of bots Aliases Chameleon 120, 000 None Waledac 80, 000 Waled, Waledpak Maazben 50, 000 None Onewordsub 40, 000 Gheg 30, 000 Tofsee, Mondera 20, 000 Loosky, Locksky Wopla 20, 000 Pokier, Slogger, Cryptic Asprox 15, 000 Danmec, Hydraflux Spamthru 12, 000 Low. Sec 11, 000+ https: //en. wikipedia. org/wiki/Botnet) Spam-DCom. Serv, Covesmer, Xmiler Low. Security, Free. Money, Ring 0. Tools 58

Botnets & Takedowns Date created Date dismantled 2007 (September) Name Estimated no. of bots d. Bot 10, 000+ (Europe) dentao. Bot, d-net, SDBOT Xarvester 10, 000[27] Rlsloup, Pixoliz 2009 (August) Festi 2008 (Around) Gumblar 2007 Akbot 1, 300, 000[36] 300, 000+ 2010 (Several: 2011, 2012) Kelihos 2013 Boatnet 2013 Zer 0 n 3 t 2014 Aliases Semalt Spamnost 500+ server computers 200+ server computers 300, 000+ https: //en. wikipedia. org/wiki/Botnet) Hlux YOLOBotnet Fiber. Optck, Optck. Fiber, Fib 3 rl 0 g 1 c Soundfrost 59

Trends & Predictions - Future Company LOGO 60

Point of Sale (POS) § Point of Sale devices are essentially endpoints with virtually no embedded security. § Most run Windows XP and outdated Antivirus software. § They were sitting ducks for targeted malware likely developed by hacker groups in the former Soviet Union. § While there isn’t an immediate silver bullet, these threats will slowly be mitigated and phased out over time. 61

Ransomware § These attacks are very lucrative. Since higher infection rates mean more income -- attackers invested in and bolted-on very sophisticated evasion techniques to their core payloads. § The advent of bitcoin has transformed ransomware into a stealthy money making machine anyone can use. § This trend is here to stay - since there are no effective security measures against it today. 62

Targeted, Advanced Evasion § Both Nation States and cyber criminals developed attacks that only execute on a specific machine or set up. § Since they behave like a benign application on the way to the target machine these threats are able to evade layers of detection mechanisms. 63

Government Code Went Mainstream § Government grade malware has been developed for espionage (Gyges) and is being bolted onto ransomware and financial Trojans. § This code enables any type of malware to operate in stealth mode and be completely invisible to all security measures. 64

Attacks as a Service (Aaa. S) § While Malware as a Service (Maa. S) has existed for several years, we predict Attacks as a Service (Aaa. S) will emerge in 2015. § Buyers will no longer need to patch together malware and other individual cyber-crime for hire services to carry out a campaign. § Instead, they will simply visit a website, select the desired malware platform and capabilities to build a Trojan, choose their target assets (online banking credentials, healthcare records, credit card numbers, etc. ), request a specific number of infections, pay with an under-ground money transfer provider or Bitcoin - and be in business. Sentinel. One Labs Advanced Threat Intelligence Report: 2015 Predictions 65

Enterprise Hostageware § The runaway success of ransomware campaigns will emboldened attackers to devise new and even more lucrative attacks. § Ransomware will be used to coordinate a “time bomb” attack on an enterprise. By simultaneously holding hostage multiple resources within an organization, an attacker could temporarily halt operations. § The devastating effects of such an attack on a small enterprise, would force most companies to pay a high price for the release of their systems. § One successful attack of this nature will produce many more copycat incidents. Sentinel. One Labs Advanced Threat Intelligence Report: 2015 Predictions 66

Critical Infrastructure Shut Downs § There have been a few “first spark” attacks on critical infrastructure, including some that shut down power grids for short periods of time (but were not were never publicly disclosed). § The dangerous combination of old, unmaintained technologies and a large attack surface make critical infrastructure especially vulnerable to attacks. § Nation States are building weaponized capabilities to remotely take control of an adversary’s SCADA and other critical infrastructure operational systems. § It is predicted that cyber inflicted power outages and irregularities in assembly operations at large manufacturing facilities will result from attacks on SCADA and ICS systems. Sentinel. One Labs Advanced Threat Intelligence Report: 2015 Predictions 67

New Nation State Threats § Predict that Russia will continue to use cyber-attacks as a political retaliation tool, as it is believed they did in the Home Depot POS attack and numerous attacks on US-based financial institutions. § Expect China to continue to carry out brute force cyber-attacks and espionage campaigns, primarily against the US, Japan, other APAC countries and human rights activists. § Even though their methods are not very stealth and often traceable, law enforcement agencies and governments will not be able to do very much to mitigate Chinese attacks. Primarily because of entangled diplomacy efforts and lack of accountability inside the Chinese regime. § It is believed that Pakistan, will expand its activities, mostly against India, by outsourcing malware creation and using contractors to build out attacks. Sentinel. One Labs Advanced Threat Intelligence Report: 2015 Predictions 68

OS X, Linux in the Cross Hairs § Until now, these two platforms have been relatively “neglected” by attackers. We predict this is about to change. The massive adoption of Linux in enterprise datacenters and the recent uptick in revived variants of Linux malware (i. e. “cdorked”) all indicate that this OS will be targeted. We view the “cdorked” attacks as a proof of concept designed to test the resilience of Linux and the security products used to defend it. § As for Mac OS X, it has experienced a long and slow rise in malware attacks -- if we exclude the enormous “Flashback” campaign a few years ago. However, the recent emergence of zero-day vulnerabilities combined with the platform’s increasing enterprise market share, especially among executives, leads us to believe this will change. § The biggest cause for concern is that because these platforms are generally considered “safe”, there are very few security products available to protect them from advanced attacks. Sentinel. One Labs Advanced Threat Intelligence Report: 2015 Predictions 69

Amazon is a Hornet’s Nest of Malware (1/16/14)* § Of the 10 sites that pump out malware most frequently, four are hosted on Amazon Web Services (AWS) — including the number one site, download-instantly. com, according to a threat report published Wednesday by the IT security firm Solutionary. § The report comes a week after we learned that hackers allegedly used Amazon's cloud hosting solution as a platform for a botnet that scraped personal information from potentially millions of Linked. In subscribers. § AWS was found to be hosting Spy. Eye, a trojan that let hackers gain access to the online accounts of banking customers. § Amazon Vulnerability Reporting web page - https: //aws. amazon. com/security/vulnerability-reporting/ *https: //www. washingtonpost. com/blogs/the-switch/wp/2014/01/16/amazon-is-ahornets-nest-of-malware/ 70

Malware Trends § Malware is becoming increasingly aggressive and evasive § Two-factor authentication is vulnerable § Targeted attacks will give way to mass exploit customization § More consumer and enterprise data leaks via cloud apps § Your refrigerator is running exploits http: //www. tripwire. com/state-of-security/security-data-protection/cybersecurity/top-5 -malware-trends-on-the-horizon/ 71

Threats and Countermeasures STRIDE Network Threats Host Threats Company LOGO 72

STRIDE Threats and Countermeasures Threat Spoofing user identity Tampering with data Repudiation Countermeasures Use strong authentication Do not store secrets (for example, passwords) in plaintext Do not pass credentials in plaintext over the wire Protect authentication cookies with Secure Sockets Layer (SSL) Use data hashing and signing Use digital signatures Use strong authorization Use tamper-resistant protocols across communication links Secure communication links with protocols that provide message integrity Create secure audit trails Use digital signatures 73

STRIDE Threats and Countermeasures Threat Information disclosure Denial of service Elevation of privilege Countermeasures Use strong authorization Use strong encryption Secure communication links with protocols that provide message confidentiality Do not store secrets (for example, passwords) in plaintext Use resource and bandwidth throttling techniques Validate and filter input Follow the principle of least privilege and use least privileged service accounts to run processes and access resources https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 74

Network Threat and Countermeasures Threat Countermeasures Information gathering Configure routers to restrict their responses to footprinting requests. Sniffing Configure operating systems that host network software (for example, software firewalls) to prevent footprinting by disabling unused protocols and unnecessary ports. Use strong physical security and proper segmenting of the network. This is the first step in preventing traffic from being collected locally. Spoofing Encrypt communication fully, including authentication credentials. This prevents sniffed packets from being usable to an attacker. SSL and IPSec (Internet Protocol Security) are examples of encryption solutions. Filter incoming packets that appear to come from an internal IP address at your perimeter. Filter outgoing packets that appear to originate from an invalid local IP address. https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 75

Network Threat and Countermeasures Threat Countermeasures Session Hijacking Use encrypted session negotiation. Use encrypted communication channels. Stay informed of platform patches to fix TCP/IP vulnerabilities, such as predictable packet sequences. Apply the latest service packs. Harden the TCP/IP stack by applying the appropriate registry settings to increase the size of the TCP connection queue, decrease the connection establishment period, and employ dynamic backlog mechanisms to ensure that the connection queue is never exhausted. Use a network Intrusion Detection System (IDS) because these can automatically detect and respond to SYN attacks. Denial of Service https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 76

Host Threats and Countermeasures Threats Countermeasures Viruses, Trojan Stay current with the latest operating system service packs and horses, and software patches. worms Block all unnecessary ports at the firewall and host. Harden weak, default configuration settings. Disable unnecessary protocols. Lock down ports with the appropriate firewall configuration. Use TCP/IP and IPSec filters for defense in depth. Footprinting Disable unused functionality including protocols and services. Configure IIS to prevent information disclosure through banner grabbing. Use an IDS that can be configured to pick up footprinting patterns and reject suspicious traffic. https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 77

Host Threats and Countermeasures Threats Password Cracking Countermeasures Use strong passwords for all account types Arbitrary code execution Apply lockout policies to end-user accounts to limit the number of retry attempts that can be used to guess the password Do not use default account names, and rename standard accounts such as the administrator's account and the anonymous Internet user account used by many Web applications Audit failed logins for patterns of password hacking attempts Configure IIS to reject URLs with ". . /" to prevent path traversal Lock down system commands and utilities with restricted ACLs Stay current with patches and updates to ensure that newly discovered buffer overflows are speedily patched https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 78

Host Threats and Countermeasures Threats Denial of Service Countermeasures Configure your applications, services, and operating system with denial of service in mind Stay current with patches and security updates Harden the TCP/IP stack against denial of service Make sure your account lockout policies cannot be exploited to lock out well known service accounts Make sure your application is capable of handling high volumes of traffic and that thresholds are in place to handle abnormally high loads Review your application's failover functionality Use an IDS that can detect potential denial of service attacks https: //msdn. microsoft. com/en-us/library/aa 302418. aspx 79

Future? Malware as a Service (Maa. S) Company LOGO 80

Professional DDOS Services From Arbor Networks 8181

82

83

Malware”R”Us. com § Malware Selection Menu: O/S: Windows, UNIX, Linux, Apple, etc. O/S Version(s) – xx. x Target Device(s): Firewall, Gateway, Router, Server, Desktop, Laptop, Tablet, PDA, Io. T, etc. Browser (IE, Firefox, Safari, etc. ) Application (e. g. , Saa. S, Office Suite, Adobe, Word. Press) Select Target(s) by IP, IP Range, Phone Number(s) Type of Malware(s): Virus, Worm, Trojan Horse, DDo. S, C&C, Botnet, Macro, Keylogger, Spam, Spyware, Rootkit, Adware, etc. For Custom Work contact 800 number 84

Questions 85