Demonstration af et malware-angreb. Torben Nissen Ernst Tirsdag den 5. Oktober 2015

Transkript

1 Demonstration af et malware-angreb Torben Nissen Ernst Tirsdag den 5. Oktober 2015

2 : : Mobil : tne@conscia.dk :

3

4 Agenda Cisco 2015 Midyear Security Report Exploit kits - Angler og Nuclear SophosLabs Threat Analysis Live Demo - Cisco AMP for Endpoint Cisco ThreatGRID - Malware Analysis and Threat Intelligence NSS Labs - Breach Detection Systems Comparative Report

5 What is the most common malware vector?

6 What is the most common malware vector?

7 Flash Exploits Fire Up in First Half of 2015 Flash exploits are being integrated regularly into the latest versions of widely used exploit kits such as Angler Although Adobe frequently updates its Flash Player, many users are simply not quick enough to apply updates that would protect them from exploits targeting the vulnerability being patched

8 Requests Made Per Version of Flash, by Date

9 Distribution of exploit kit activity as measured by detection telemetry based on a week s worth of data in September 2014, January 2015 and May Landing pages May 2015, we uncovered thousands of new web pages booby-trapped with Angler using exploits for HTML, JavaScript, Flash, Silverlight, Java and more Exploits kits need a good volume of incoming traffic in order to have a steady stream of potential victims to infect. Using Fast Flux and Domain Shadowing Attackers have been phishing for domain accounts to create large amounts of malicious subdomains for some time. Source: Fraser Howard, Sophos

10 Using Fast Flux and Domain Shadowing Source: Fraser Howard, Sophos

11 Successful Flash Exploits, April 2015 Angler: Running in the Shadows

12 Angler named malware-market leader Focus on flash gives angler a significant edge over competitors

13 :20:00 4/56 (4 of 56 antivirus engines deployed detected the payload) :14:32 32/57 (32 of 57 antivirus engines deployed detected the payload) :25:00 42/57 (42 of 57 antivirus engines deployed detected the payload)

14 Ransomware: Cryptowall Ransomware encrypts users files targeting everything from financial files to family photos and provides the keys for decryption only after users pay a ransom. Cryptowall emerged after the original variant, Cryptolocker, was taken down by law enforcement in mid The malware is typically delivered through a number of vectors including and exploit kits. The exploit kit Angler, for example, is known to drop the Cryptowall payload. Payment between $300 and $500 is required

15 Ransomware: Cryptowall Need help?! Many ransomware operators have established elaborate customer support operations.

16 Questions?

17 Microsoft Office Macros make a comeback as vehicle for launching Exploits Trojans are macros attached in Microsoft Office products such as Microsoft Word. Using social engineering techniques, bad actors can persuade users to turn on macros, thereby adding a new tactic to their toolboxes.

18 Microsoft Office Macros make a comeback as vehicle for launching Exploits In some campaigns that we observed, instructions were included to tell the user how to enable macros

19 Microsoft Office Macros make a comeback as vehicle for launching Exploits

20 Microsoft Office Macros make a comeback as vehicle for launching Exploits Behind the scenes, a macro used cmd.exe and PowerShell to download a malicious executable from a hardcoded IP address

21 Microsoft Office Macros make a comeback as vehicle for launching Exploits Source: Verizon 2012 Data Breach Investigation Report

22 Questions?

23 Rombertik: Malware that not only can steal data but also destroy it Source: Verizon 2012 Data Breach Investigation Report

24 Rombertik: Malware that not only can steal data but also destroy it Source: Cisco Security Research

25

26 Questions?

27 Cisco Advanced malware protection - Retrospectives Security Retrospectives, Mean time to detection, and Median time to detection, December 2014 May 2015

28 Cisco Advanced malware protection - Retrospectives Security In December 2014, the median time to detection meaning when analysis revealed an unknown file to be a threat was about two days (50 hours) The current industry standard for time to detection is 100 to 200 days, an unacceptable level, given how rapidly today s malware authors are able to innovate Source: Verizon 2012 Data Breach Investigation Report

29 Questions?

30 NSS Labs - Breach Detection Systems Comparative Report Hvem er markedsledende inden for Avanceret Malware beskyttelse?

31

32 NSS Labs - Breach Detection Systems Comparative Report Hvem er markedsledende inden for Avanceret Malware beskyttelse?

33 Questions?

34 Spam Volume Remains Consistent Source: Verizon 2012 Data Breach Investigation Report

35 25 major industries and their relevant block activity as a proportion of normal network traffic. A ratio of 1.0 means the number of blocks is proportional to the volume of observed traffic. Anything above 1.0 represents higherthan-expected block rates, and anything below 1.0 represents lowerthan-expected block rates.

36 Stram nettet med Conscia og Cisco Integrér sikkerhedsindsatsen i virksomhedens netværk Omfattende hackerangreb på virksomheder med værdifuld data er blevet dagligdag, og traditionel perimeter-beskyttelse kan ikke længere alene håndtere de nye sikkerhedsudfordringer, disse virksomheder står overfor. For at kunne beskytte virksomheden bedre er det nødvendigt at have en robust og skalérbar infrastruktur, som ikke alene adresserer sårbarheder, men også løbende giver et overblik over netværkets tilstand. Threat Grid og simuleret malware-angreb Vi inviterer til seminar, hvor vi først giver en status på udviklingen i sikkerhedsteknologier, inklusive en præsentation af Threat Grid, og derefter fremhæver de vigtigste dele af Cisco Annual Security Report Tilmelding:

37 Mange tak for jeres tid! : : Mobil : tne@conscia.dk :