malware world 2010

Malware World 2010 Beware the Predators Toralv Dirro McAfee Labs - PowerPoint PPT Presentation

Jan 04, 2024 •112 likes •543 views

Malware World 2010 Beware the Predators Toralv Dirro McAfee Labs EMEA Security Strategist $70mio International Cybercrime Ring Busted October 1st 2010: Operation Trident Breach Investigations began in May 2009 60 criminals

  1. Malware World 2010 Beware the Predators Toralv Dirro McAfee Labs EMEA Security Strategist

  2. $70mio International Cybercrime Ring Busted • October 1st 2010: Operation Trident Breach – Investigations began in May 2009 – 60 criminals charged, 10 arrested – International Partnership with SBU and other authorities • The Federal Bureau of Investigation, including the New York Money Mule Working Group, the Newark Cyber Crime Task Force, the Omaha Cyber Crime Task Force, the Netherlands Police Agency, the Security Service of Ukraine, the SBU, and the United Kingdom’s Metropolitan Police Service participated in the operation. – The cyber thieves targeted small- to medium-sized companies, municipalities, churches, and individuals, infecting their computers using a version of the Zeus Botnet. The malware captured passwords, account numbers, and other data used to log into online banking accounts. This scheme resulted in the attempted theft of $220 million, with actual losses of $70 million from victims’ bank accounts 2 Confidential McAfee Internal Use Only

  3. FOCUS 09 Anatomy of a scareware company Using more than 63 gigabytes of information culled from querying the company's own portal servers and other publicly available data, Dirk Kollberg, from McAfee Labs, unearthed some astonishing operational details including the following: • Innovative Marketing used more than 34 different production servers in less than six months and used as many as six different servers at a time to infect, advertise and sell their illicit wares. • In one 10-day stretch, the company received more than 4 million download requests, meaning that at least 4 million people tried to buy the worthless applications. • Internal documents report that the URLs used to hawk the scareware are only valid for 15 minutes, making it all but impossible for federal, state or international law enforcement agencies to yank the offending URLs before they've moved on to new addresses. • It used multiple customer call centers, including at least one in Poland and one in India, to service unsuspecting customers calling via VoIP connections to buy, remove or question the need for the unnecessary scareware. And, believe it or not, they recorded and saved these bogus customer service calls. More incredibly, 95 percent of callers exited were "happy" when the call concluded. • Because they needed an extensive network of ISPs to pull off the scam, Innovative Marketing kept detailed spreadsheets with all the ISPs pertinent data including price, location and, most telling, a column that rate the ISPs "abuseability"—essentially an assessment of which ISPs would play ball and not ask questions as they went about their business. • The company added a whopping 4.5 million order IDs, essentially new purchases, in 11 months last year. With most of the phony applications selling for $39.95, that's more than $180 million in less than a year. http://www.internetnews.com/security/article.php/3842936/McAfee+FOCUS+09+Anatomy+of+a+Scareware+Scam.htm Confidential McAfee Internal Use Only

  4. FTC vs. Innovative Marketing „ The FTC succeeded in persuading a U.S. federal judge to order Innovative Marketing and two individuals associated with it to pay $163 million it had scammed from Americans. Neither individual has surfaced since the government filed its original suit more than a year ago. But Ethan Arenson, the FTC attorney who handled the case, warned: "Collection efforts are just getting underway."“ (Source: Reuters) Confidential McAfee Internal Use Only

  5. Price Estimates for Credit and Debit Card Dumps Dumps are information electronically copied from the magnetic stripe on the back of credit and debit cards. Prices for these data vary, depending on the inclusion of the card’s PIN. Confidential McAfee Internal Use Only

  6. The Malware Market Trojan and Exploit Kits easily available Confidential McAfee Internal Use Only

  7. Zeus: Development of a Trojan Kit Confidential McAfee Internal Use Only

  8. Mergers and Accquisitions: SpyEye & Zeus Confidential McAfee Internal Use Only

  9. Cyber Crime Altering Threat Landscape Virus and Bots PUP Trojan 500,000 400,000 300,000 200,000 100,000 2000 2001 2002 2003 2004 2005 2006 2007 Malware Growth (Main Variations) 9 November 25, 2010 Confidential McAfee Internal Use Only 9 Source: McAfee Labs 9

  10. Cyber Crime Altering Threat Landscape Virus and Bots PUP Trojan 2,200,000 2,000,000 1,800,000 1,600,000 1,400,000 1,200,000 1,000,000 800,000 600,000 400,000 200,000 2008 2000 2001 2002 2003 2004 2005 2006 2007 Malware Growth (Main Variations) November 25, 2010 Confidential McAfee Internal Use Only 10 Source: McAfee Labs 1

  11. Cyber Crime Altering Threat Landscape Virus and Bots PUP Trojan 3,200,000 3,000,000 2,800,000 2,600,000 2,400,000 2,200,000 2,000,000 1,800,000 1,600,000 1,400,000 1,200,000 1,000,000 800,000 600,000 400,000 200,000 2008 2009 Malware Growth (Main Variations) 11 November 25, 2010 Confidential McAfee Internal Use Only 11 Source: McAfee Labs 1

  12. Malware still growing strong  New pieces of malware per day: Number of malware samples in our database 2007: 16,000 50,000,000 2008: 29,000 2009: 46,000 40,000,000 Q1/2010: 40.000 Q2/2010: 55.000 30,000,000 Q3/2010: 60.000 20,000,000 10,000,000 0 Q108 Q208 Q308 Q408 Q109 Q209 Q309 Q409 Q110 Q210 Q310 Confidential McAfee Internal Use Only

  13. Top 10 Malware Globally Two notable adware 1) Generic! Atr Generic removable-device malware programs have joined the top ten list, both spread 2) Generic.dx Generic downloaders and Trojans via malicious websites. 3) W32/Conficker.worm!inf Removable-device Conficker worm 4) FakeAlert-FakeSpy!env.a Legitimate-looking fake anti-virus scam 5) Exploit-CVE2008-5353 A JRE exploit that downloads a Trojan 6) GameVance Online gaming software that collects stats anonymously 7) Generic PUP.x General-purpose potentially unwanted programs 8) Adware-Hotbar.b Adware program 9) Exploit-ByteVerify Java applet Trojan 10) Adware-URL.gen Adware program Confidential McAfee Internal Use Only

  14. Botnet Infections Held Steady We have seen new botnet Overall Botnet Infections Per Day infections hold steady at 3,000,000 around six million per 2,500,000 month. 2,000,000 1,500,000 1,000,000 500,000 - Oct-09 Feb-10 Mar-10 Apr-10 Sep-09 Nov-09 Dec-09 Jan-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Overall Botnet Infections Per Month 12,000,000 10,000,000 8,000,000 6,000,000 4,000,000 2,000,000 - Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Confidential McAfee Internal Use Only

  15. AutoRun And Koobface Level Off 700,000 600,000 500,000 Unique AutoRun Samples Discovered 400,000 300,000 200,000 100,000 0 Sep-08 Oct-08 Nov-08 Dec-08 Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 30,000 25,000 Unique Koobface Samples 20,000 Discovered 15,000 10,000 5,000 0 Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Confidential McAfee Internal Use Only

  16. Fake Security Software Peaked in ’09 But Remains High for This Lucrative Form of Cybercrime 450,000 400,000 Unique FakeAlert Samples Discovered 350,000 300,000 250,000 200,000 150,000 100,000 50,000 0 Sep-08 Oct-08 Nov-08 Dec-08 Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 400,000 Unique Password Stealers Samples Discovered 350,000 300,000 250,000 200,000 150,000 100,000 50,000 0 Sep-08 Oct-08 Dec-08 Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Nov-08 Nov-09 Confidential McAfee Internal Use Only

  17. Zeus Is In a Class All By Itself Zeus (Zbot or PWS-Zbot) is spread via download or phishing sites. Some Zeus campaigns switched from text to graphics in emails to avoid anti-spam technologies. Confidential McAfee Internal Use Only

  18. Websites Hosting Zeus McAfee Labs is finding URLs dedicated to hosting Zeus. 2,500 2,000 1,500 1,000 500 - Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Confidential McAfee Internal Use Only

  19. Zeus Goes Mobile Zeus intercepts so it can validate its own transactions User User logs Tries to Bank asks Code sent enters onto online make for to user’s code to banking money additional phone via validate website transfer code SMS transaction Then Zeus can send a message to the user’s phone directing them to a malicious website Confidential McAfee Internal Use Only

  20. Cybercriminals Are Optimizing Their Threats for Search Engines This quarter’s most poisoned search topics: • Haiti earthquake • Chile earthquake/Hawaii tsunami warning • Toyota recall • Apple iPad • 2010 NCAA bracket/March Madness • Tiger Woods apology • Shamu attack/Florida shark attack • Olympic luge tragedy • Groundhog Day • U.S. Health Care Reform Bill Confidential McAfee Internal Use Only

Recommend

Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%)

Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%)

Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%) 80% of new malware are packed with various packers Malware Obfuscation Techniques: Packing 2 Malware and packing Not packed (20%) 80%

985 views • 51 slides
Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd Paul Rascagnres from Malware.lu Linux malware presentation Plan - Presentation - Darkleech/Chapro - Cdorked - Wirenet

426 views • 31 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
StealthWare Social Engineering Malware Running malware for Social Engineering and Covert

StealthWare Social Engineering Malware Running malware for Social Engineering and Covert

StealthWare Social Engineering Malware Running malware for Social Engineering and Covert Operations By: Joey Dreijer StealthWare Social Engineering Malware Social Engineering and Covert Operations Introduction Research Security

403 views • 21 slides
Tien Phan Malware Manipulation 2019-08-26 2 Pokemon Fusion Con - Fusion Malicious Malware

Tien Phan Malware Manipulation 2019-08-26 2 Pokemon Fusion Con - Fusion Malicious Malware

Tien Phan Malware Manipulation 2019-08-26 2 Pokemon Fusion Con - Fusion Malicious Malware + = Softicious X Software Tien Phan Malware Manipulation 2019-08-26 3 Reverse Engineering More time consuming Dynamic Analysis

555 views • 22 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu

Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu

Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu Faou | Malware Researcher Jean-Ian Boutin Matthieu Faou Senior Malware Researcher Malware Researcher @jiboutin @matthieu_faou Agenda 1.

2.05k views • 138 slides
Research: Threat Intelligence & Malware Infrastructures Andrea Lanzi: andrea.lanzi@unimi.it

Research: Threat Intelligence & Malware Infrastructures Andrea Lanzi: andrea.lanzi@unimi.it

Malware Analysis Research: Threat Intelligence & Malware Infrastructures Andrea Lanzi: andrea.lanzi@unimi.it May, 3 2017 Andrea Lanzi: andrea.lanzi@unimi.it Malware Analysis Malware Analysis Malicious Infrastruture Who am I? My

380 views • 18 slides
Finite Mathematics MAT 141: Chapter 3 Notes Graphing Linear Inequalities Linear Programming

Finite Mathematics MAT 141: Chapter 3 Notes Graphing Linear Inequalities Linear Programming

MAT 141 Chapter 3 Finite Mathematics MAT 141: Chapter 3 Notes Graphing Linear Inequalities Linear Programming David J. Gisch Linear Inequalities Graphing with Intercepts Find the -intercept. Substitute 0 and solve for

322 views • 14 slides
South Asia Earthquake Fact Sheet #33, Fiscal Year (FY) 2006 January 6, 2006 BACKGROUND

South Asia Earthquake Fact Sheet #33, Fiscal Year (FY) 2006 January 6, 2006 BACKGROUND

U.S. AGENCY FOR INTERNATIONAL DEVELOPMENT BUREAU FOR DEMOCRACY, CONFLICT, AND HUMANITARIAN ASSISTANCE (DCHA) OFFICE OF U.S. FOREIGN DISASTER ASSISTANCE (OFDA) South Asia Earthquake Fact Sheet #33, Fiscal Year (FY) 2006 January 6, 2006

440 views • 4 slides
Emergency Preparedness Planning for Housing Counseling Agencies Office of Housing Counseling

Emergency Preparedness Planning for Housing Counseling Agencies Office of Housing Counseling

Emergency Preparedness Planning for Housing Counseling Agencies Office of Housing Counseling October 21, 2014 Emergency Preparedness Planning Audio available only via conference call. To join: Call: (800) 260-0712 Participant Access Code:

681 views • 51 slides
promote connection, empathy and wellbeing Robbie Sherman MD Medical Director for the Patient

promote connection, empathy and wellbeing Robbie Sherman MD Medical Director for the Patient

Providing Safe Spaces for Providers that promote connection, empathy and wellbeing Robbie Sherman MD Medical Director for the Patient Experience and Physician Development The Polyclinic Loss of Meaning Impoverished Relationships Increasing

511 views • 29 slides
Introducing 2) Develop skills to utilize the online GENIE GENIE checklist and become familiar

Introducing 2) Develop skills to utilize the online GENIE GENIE checklist and become familiar

3/18/2014 The Guide for Effective Nutrition Interventions and Education Learning Objectives 1) Explain the process used in developing and validating the Guide for Effective Nutrition Interventions and Education (GENIE). Introducing 2) Develop

500 views • 10 slides
Putting C/C++ on a Macro Diet (as in eat more macros, not abstain from macros) Matvey Soloviev

Putting C/C++ on a Macro Diet (as in eat more macros, not abstain from macros) Matvey Soloviev

Putting C/C++ on a Macro Diet (as in eat more macros, not abstain from macros) Matvey Soloviev (Cornell University) Graduate Seminar 1 Sliding Scale of Expressivity Expressivity: What programs can you express? How hard is it to express a given

807 views • 54 slides
2018 MOC Part II Self Assessment: Obesity Prevention in Primary Care: Amy Sternstein, MD,

2018 MOC Part II Self Assessment: Obesity Prevention in Primary Care: Amy Sternstein, MD,

2018 MOC Part II Self Assessment: Obesity Prevention in Primary Care: Amy Sternstein, MD, FAAP May 5, 2018 CME Disclosure No relevant financial relationship to disclose. No off-label products will be discussed in this presentation.

1.86k views • 153 slides
How food & drink choices influence mood Name: Amy McDonald BDA Work Ready Accredited

How food & drink choices influence mood Name: Amy McDonald BDA Work Ready Accredited

How food & drink choices influence mood Name: Amy McDonald BDA Work Ready Accredited Dietitian Date: 12 October 2016 Background We are what we eat Food & drink choices affect Our health How we think, feel &

548 views • 10 slides

More recommend