making architectural decisions to disrupt the economics of ... · let’s do some math… • cyber...

Making Architectural Decisions to Disrupt the Economics of Cyber Attacks

Mike Viscuso

CTO at Carbon Black

March 7, 2017

Security products built by security experts

Michael Viscuso

Co-founder & SVP Products

Co-founded Carbon Black in 2011 to

defend against offensive attacks he

personally used

Business-minded technologist with

significant offensive security

experience

Roles at the NSA / defense contractors

• Pentesters

• Incident Responders

• Architecture & Operations

• Malware Analysis & Forensics

• Offensive security

33% of product team have

practitioner experience

I © 2016 Carbon Black. All Rights Reserved. 2

1

2

3

4

5

How Criminals Think About Crime

Business is Booming

Shifting Market Trends

Put Your Black Hat On

Architectural Changes You Can Make

AGENDA

How Do Criminals Think About Crime?


The Criminal Equation


The Criminal Equation

What do I get by committing this crime?


What do I stand to lose if I get caught?

What are the chances I’ll get caught and convicted?

In other words…

What are the net benefits of entering a new market or building a new product?


What are the opportunity costs of staying with our existing portfolio?

What is the probability of success?

You should start thinking of these people…


Like these people…


2

1

Cybercriminals think just like businesses do


How do I increase revenue potential?

How do I decrease costs and risk?


Source: RAND / Juniper

To get some perspective…



Google’s Income Sheet


Source: Yahoo Finace

Google Employs 57,000+ Employees

Source: Business Insider


http://www.businessinsider.com/google-has-57000-employees-2015-7

Let’s do some math…

• Cyber Crime (CC) is more profitable than the illicit drug trade ($2.1T)

CC > $2,100,000,000,000

• Cocaine (Coc) is $85B of that illicit drug trade

Coc = $85B

• Google (GOOG) brought in “just over” $90B in revenue in the last 12 months and

employed 57,000 people. Google’s profit (GOOGp) per employee would be:

GOOGp = $90,000,000,000 / 57,000 employees = $1.5M / employee

• Using this info, we can estimate how many people are involved in Cyber Crime

Size of CC (in people) > $2,100,000,000,000 / $1,500,000 = 1,400,000 people


~1.4 million people involved in cybercrime

It’s more than a business…


It’s an economy




2

1There are more attacks

today than ever

Attacks today are more

sophisticated

Specialization in the cyber black market drives thisSource: Verizon DBIR, 2016

The economics are changing for developers

"You’re basically selling commercial software, like anything else. It needs to be polished and come with documentation. The only difference is that you only sell one license, ever, and everyone calls you evil.“

GrugqBangkok-based security

researcher and exploit broker


Source: Forbes.com

Approximate pricing, 2012

https://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/#149cf6b32660

Android Remote Code Execution (RCE) 0-day


Source: Forbes.com

Posted June, 2015

12.0455 Bitcoin =

~$7,000 US


Windows Local Privilege Escalation 0-day


Source: Forbes.com

Posted June, 2015

12.0451 Bitcoin =

~$7,000 US


Like in any market, current trends fade and new ones take their place


Radamant Ransomware Kit


One month rental price: $1,000 USD

Average malware price: $10 USDSource: bleepingcomputer.com

https://www.bleepingcomputer.com/news/security/radamant-ransomware-kit-for-sale-on-exploit-and-malware-sites/


Service Price

Botnet rentals

Direct denial of service (DDoS) $535 for 5 hours a day for one week

Email spam $40 / 20K emails

Web spam $2 / 30 posts

Onshore and offshore hosting - virtual private

servers$6 per month

Bulletproof/fast flux hosting

(VPNs and reverse proxies)$3 per month

Complex Botnets: Features include broadcast

command and control, keylogging, download, and

spam

Examples include…

Zeus/Zbot: $700 for old version, $3,000 for new

Butterfly: $900

Simplified botnets: Features include download and

execute malicious code.

Used primarily for rentals/crime-as-a-service

Examples include…

Bredolab: Starts at $50

Source: Infosec Institute

http://resources.infosecinstitute.com/cybercrime-as-a-service/#gref

Botnet rentals




Look familiar?


Product packaging and

tiered pricingSource: Infosec Institute


Look familiar?


Upgrades and add-on

featuresSource: Infosec Institute


Look familiar?


Bulk discounting



How do you make money from a $450 botnet rental?


Get your notebooks out now


It’s This Easy


Pick a Target


For the lazy: Automation through LinkedIn APIs


Source: LinkedIn Developers Page

https://developer.linkedin.com/docs/fields/full-profile

Send a Request!


This isn’t any ordinary request…


Domain Registration

Valid-Looking Domains


Domain Registration

For the cost of a Big Mac


Login to “LinkedIn”


Enumerate for a Vulnerability I Can Leverage….


Exploit Executed...


No vulnerabilities? No problem.


If I Can Access Your Email….


I Can Access Your Bank Account...


And I Most Likely Can Access...


Reality


Changing Disruption Methodology


The traditional economics literature on crime has suggested that increasing the punishment for crime or increasing the probabilities of arrest and conviction would reduce the frequency of crime… [Deterrence] has not, however, exhibited a great deal of historical impact…

“

Case Study: Credit Card Fraud Detection


2007

Source: Rolling Stone Magazine

http://www.rollingstone.com/culture/news/sex-drugs-and-the-biggest-cybercrime-of-all-time-20101111

Case Study: Credit Card Fraud Detection


2007

2015

Source: Rolling Stone Magazine

Source: McAfee

98.3%Reduction in price per

credit card number

http://www.rollingstone.com/culture/news/sex-drugs-and-the-biggest-cybercrime-of-all-time-20101111

https://www.mcafee.com/us/resources/reports/rp-hidden-data-economy.pdf


We’ve all experienced why.

Evaluates each transaction

relative to all past activity,

identifying unusual

attributes

Contacts user or denies

card in real time if activity is

suspicious

Records every transaction and

runs through a central

analytics engine

Correlation occurs across all

cards with similar attributes to

preempt future fraud

EVENT

STREAM

PROCESSING

The TECHNOLOGY Behind Fraud Detection


How it was done before…


Agents sift through a daily report to uncover fraud

Source: StreamBase Blog

http://streambase.typepad.com/streambase_stream_process/2012/04/streambase-liveview-10-3-stories-from-the-trenches.html

How it happens today


Fraud is detected within milliseconds

Source: StreamBase Blog

http://streambase.typepad.com/streambase_stream_process/2012/04/streambase-liveview-10-3-stories-from-the-trenches.html


This is exactly how you are going to change your architecture to prevent cybercrime.

OLD SYSTEM

Scanning through a daily report to spot fraud

NEW SYSTEM

Real-time fraud detection and response


Traditional

Antivirus

• Point-in-time prevention

• Evaluates individual files

• Stops known malware only

Next-Generation

Antivirus

• Streaming prevention

• Evaluates event sequences

• Stops malware and non-malware


MACHINE-LEARNING AV

FILES ONLY

STREAMINGPREVENTION

FILES + ATTACKS

LEGACY AV

FILES ONLY


MALWARE + NON-MALWARE PROTECTION

NON-MALWARE ATTACKS ON THE RISE

47%OF BREACHES USE

MALWARE

53%OF BREACHES ARE

NON-MALWARE

MALWARE ATTACKS NON-MALWARE ATTACKS

KNOWN UNKNOWN RANSOM OBFUSCATED MEMORY MACROS REMOTE

LOGIN

POWERSHELL


SANS: Defining Next-Generation Antivirus (NGAV)

1. Prevent malware attacks

2. Prevent non-malware attacks

3. Detection and response

4. Context and visibility


Gartner Agrees


Competitive Landscape: Endpoint Detection and Response ToolsJanuary 5, 2017Note: Graphic was created using data from Gartner’s 3Q16 information security Forecast and Competitive Landscape estimates.

Source: Gartner (January 2017)

EPP with EDR

Next-Generation Antivirus

VISIBILITYRecords every endpoint event and analyzes event sequences in real time



DETECTIONIdentifies irregular event sequences by matching against “normal” ones; collates data from every endpoint to increase accuracy



PREVENTIONAlerts admins of suspicious behaviors; automatically prevents any event when its risk exceeds acceptable thresholds



RESPONSEVisualizes the attack chain to uncover point-of-entry; helps you identify and implement patches or compensating controls


OUR VIEWPOINTCb Defense converges prevention, detection and response

1. Prevent malware attacks

2. Prevent non-malware attacks

3. Detection and response

4. Context and visibility



What you can expect


Acceleration in

time to respond

Prevention

coverage

Reduction in time

to detect a breach

Reduction in

re-imaging needs

98.8% 99% 99.3% 100%

THANKS

Follow us!

@MichaelViscuso

@CarbonBlack_Inc


making architectural decisions to disrupt the economics of ... · let’s do some math… • cyber...

Documents