Upload File

malware in the 21 st century – is your identity secure? jason bruce, detection development manager...

  • Home
  • Documents
  • Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005
35
Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Upload: laureen-may

Post on 29-Jan-2016

216 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Malware in the 21st Century – Is your identity secure?Jason Bruce, Detection development manager

SophosLabs UK

December 2005

Page 2: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Contents

• Introduction

• The scale of the threat

• The changing landscape

• Bots and botnets

• Combined Threats

• Sophos’ response

• Conclusion

Page 3: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Company background

• Sophos started in computer security in 1985

• We were first to market anti-virus with monthly updates (1989)

• We were first to offer 24/7/365 technical support (1991)

• We extended cover to a wide range of desktop/server platforms

• We established technology partnerships with leading managed

service providers

• We launched our own email virus protection in 2000

• We acquired anti-spam company, ActiveState, in 2003

Page 4: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

The scale of the threat

Page 5: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

There are over 114,000 viruses in existence. SophosLabs analyses over 1000 new viruses, Trojans and worms every month

0

20000

40000

60000

80000

100000

120000

Jan-96

Jan-97

Jan-98

Jan-99

Jan-00

Jan-01

Jan-02

Jan-03

Jan-04

Jan-05

Page 6: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Number of new virusesVirus count increases per month

0

200

400

600

800

1000

1200

1400

1600

1800

2000

Feb-99 Aug-99 Feb-00 Aug-00 Feb-01 Aug-01 Feb-02 Aug-02 Feb-03 Aug-03 Feb-04 Aug-04 Feb-05 Aug-05

Page 7: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

The changing landscape

Page 8: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

The threat landscape changes…

Freeweb and webmail abusers

Bulletproofing hosting services

Address providers

Guaranteed delivery -

filterproofing services

Spamming software and

hardware providers

Zombie Networks

(anonymous spam

senders)

Exploited Host

Networks

Spammer

Message tracking services

Page 9: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

The threat landscape changes…

Freeweb and webmail abusers

Bulletproofing hosting services

Address providers

Guaranteed delivery -

filterproofing services

Virus writing Gangs

Spamming software and

hardware providers

Hackers

Zombie Networks

(anonymous spam

senders)

Exploited Host

Networks

Spammer

Phisher

Credit Card Gangs

For-hireCorporate Espionage

Message tracking services

Page 10: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

The profile of a virus writer is changing...

• Virus writers now have a financial motive

(phishing, stealing confidential data, denial of

service extortion attempts, spam)

• More organized criminals see that viruses and

Trojan horses can help them make money

• They are less likely to make the mistakes that

the “old school” virus writers make of needing to

show off to their friends

• Law enforcement coordination required to stop

international virus writing gangs

Page 11: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

…targeted attacks

• Although large outbreaks make the

headlines, there are also attacks

targeted on specific sites or business

rivals

• Less likely to be noticed than a large

outbreak

• “Hacked to order” to steal information

or resources

• Large outbreaks typically target

Windows PCs (the great unwashed

public), but not necessary for

targeted attacks

Page 12: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Bots and botnets

Page 13: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Definitions

• Bot (Zombie, Drone)

• A piece of code developed to emulate human behavior on a

network, in computer security used to describe network

spreading viruses with payload that allows remote attacker to

control resources owned by the infected machine

• Control most frequently over IRC (TCP 6667 default port)

Page 14: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Definitions

• Botnet (Zombie army)

• A group of bots controlled by a single originator/hacker

• The botnet owner usually sets up an IRC server that allows

authenticated access for specific IRC bot clients bundled with

network spreading worms

• Botnet server often connected with other IRC botnet servers

Page 15: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Botnet originator(owner)

SpammingKeylogging Identity/funds theftSniffing

Botnets Botnet 2Botnet 1

Botnet user(customer)

Page 16: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Bots – spreading methods

• Direct

• Network shares

• RPC DCOM

• LSSAS

• Upgrading mechanisms of previous worms

• P’n’P

• Indirect

• Rogue websites

• Email seeding

Page 17: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Bots – payload

• Install spyware

• Spam relays/proxies

• DDOS attacks

• Credit card number theft

• Password sniffing

• Bandwidth utilisation

• Rootkit technology (stealth)

• Backdoor (FTP, HTTP servers)

• Screen capture

• Update mechanisms

Page 18: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Case study – Zotob - timeline

• 9 Aug – Microsoft releases patch for P’n’P vulnerability

(MS05-039)

• 10-11 Aug – first exploits developed

• 14 Aug – W32/Zotob-A released, no major impact

• 17 Aug – W32/Tpbot-A takes off-line a number of large

corporations, naming confusion

• 18 Aug – new variants, bot wars

Page 19: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Combined threats

Page 20: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Financially motivated malware

As well as traditional phishing websites and spam we’re also seeing more and more Trojan horses designed to steal bank account details

Attackers target financial and government institutions

Viruses include backdoors and functionality to steal confidential information

Page 21: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Virus-spam-spyware cooperation

•Viruses used to harvest email addresses to be used by spammers

•Viruses infect networks using bots (Zombienets) and virus writers sell the details to spammers to use for email proxies

Page 22: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Spammer Methods (thru 2003)

Reality was, spammers weren’t that tricky after all

Able to proactively identify the obfuscations, forged headers, and other mistakes2 to 3 new obfuscation techniques per week Updates were every 2 weeks

Focused on content obfuscation and source rotation

• 85% contained HTML “cloaking”

• 35% referenced web images

• freemail sites (Yahoo, Hotmail) and

open proxies most common

spam sources

Page 23: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Spammer Methods (2004 to date)

Rapid randomizing of source, content and destination

• Sources now include spam zombies (virus payloads)

• Content uses less obvious obfuscations (mis-spelling)

• Destinations are disposable

Page 24: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Sophos’ response

Page 25: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Multiple response mechanisms

• Threat innovation is targeted

• Most borrow from previous

efforts…

• But significantly vary one characteristic to

evade detection

• Multiple response mechanisms

• SophosLabs™ “race-horse” different

approaches

• Deploy using the fastest mechanism

• Earliest possible detection

Getting detection deployed at your site as quickly as possible

Virus update – code characteristics

Virus update – code characteristics3.Spam rule

(Genotype) – campaign characteristics

Spam rule (Genotype) – campaign characteristics

2.Policy rule – message characteristics

Policy rule – message characteristics

1.

e.g. Bofra-B

The email distributed by W32/Bofra-B creates fake email headers to pretend it was created by a number of different legitimate email clients and also that it has been checked for viruses.

Page 26: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Survival time - 11 minutes

Page 27: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Genotype spam definitions

• New class of spam

techniques emerging

• Driven by zombie usage and

domain rotating

• Reputation and URL filtering

don’t react quickly enough

• Genotype spam definitions

• Campaigns are identified by a

common set of “static genes”

• Detects complex randomized

campaigns

• Delivers effective protection

against evolving campaigns

Campaign-based detection for more consistent catch rates

Messages missed

Average catch rate

46647

43%

Reputation URI filtering

Genotype

57568606

29%99.8%

e.g. Porn campaign (Nov/Dec 2004)

Genotype vs. reputation and URI filtering

0

20

40

60

80

100

120

Time (days)

Cat

ch R

ate

per

Day

(%

)

Genotype

Reputation

URI blacklist

Page 28: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Proportion of spam detected by Genotype

Page 29: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

• Pro-active protection method

• Protection against yet unknown variants

• Optimised for enterprise environment

• Linked with ability to unpack run-time packers

(UPX,ASPack,Morphine)

Genotype virus detection

Page 30: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Genes

• Genes

• could copy itself to Windows system folder

• could send itself by email

• could contain a backdoor

• could terminate Anti-virus software

• Genes are inherited in a family

• New members of a virus family “evolve” but most of

genes usually stay

Page 31: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Genotype

Page 32: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Genotype detection rate

Genotype detection rates

0.00

20.00

40.00

60.00

80.00

100.00

120.00

Agobot Rbot Sdbot Bobax Spybot Korgo BagleDL MyDoom Mytob Forbot

Page 33: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Conclusion

Page 34: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Conclusion

• Today’s threat is more organised

• Your identity and personal details are at risk

• There have been some notable wins

• There is a desire for legitimacy amongst those on the fringe

• We are winning the fight

• Only agility will keep security companies ahead of the game

Page 35: Malware in the 21 st Century – Is your identity secure? Jason Bruce, Detection development manager SophosLabs UK December 2005

Thank you

Jason Bruce, Detection development manager

SophosLabs UK

December 2005


The PlugX malware revisited: introducing “Smoaler” · PDF fileThe PlugX malware revisited: introducing “Smoaler” By Gabor Szappanos, Principal Researcher, SophosLabs July 2013

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Android Malware Exposed-Evolution of Android Malware

Advanced malware analysis training session6 malware sandbox analysis

SophosLabs 2018 Malware Forecast - netcetera.ca · The malware we protect customers from transcends operating systems. Ransomware in particular targets Android, Mac, Windows and Linux

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

ZeroAccess James Wyke SophosLabs UK

A Holistic Approach to Malware Defense Bruce Cowper Senior Program Manager; Security Initiative Microsoft Canada

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Evaluating Open Source Malware Sandboxes with Linux malware

Defining rules for acceptable adware - Virus Bulletin rules for acceptable adware Jason Bruce - SophosLabs ... • Subsidise own or third party products and services. ... turning a

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

SOPHOSLABS 2019 THREAT REPORT · 4 2019 Threa These technologies materially hinder the effectiveness of commodity malware. The result has been something to simultaneously relish and

Anatomy of Attacks - University of British Columbia...Anatomy of Attacks Dmitry Samosseiko, SophosLabs . SophosLabs Team •One global team – UK, US, Canada, Australia ... Adpack

Malware and Anti-Malware Seminar by Benny Czarny

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Reversing malware analysis trainingpart9 advanced malware analysis

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware & Anti-Malware

Boris Lau, Vanja Svajcer Sophoslabs, Journal in Computer Virology, 2008