Upload File

sans cyber threat intelligence summit · pdf fileransomware 10 the fastest growing category of...

  • Home
  • Documents
  • SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves
14
McAfee Confidential—Internal Use Only SANS Cyber Threat Intelligence Summit Recent Threat Trend Analysis Scott Montgomery VP, CTO Public Sector [email protected] +1 240 498 2941 m

Upload: doxuyen

Post on 06-Mar-2018

218 views

Category:

Documents


5 download

Report

TRANSCRIPT

Page 1: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

McAfee Confidential—Internal Use Only

SANS Cyber Threat Intelligence Summit Recent Threat Trend Analysis

Scott Montgomery

VP, CTO Public Sector

[email protected]

+1 240 498 2941 m

Page 2: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

McAfee Confidential—Internal Use Only

A nasty math problem

SERVERS

PC

LAPTOP

EMAIL

DATABASE

USB

SMART

PHONE

ROUTING/

SWITCHING CLOUD

VIRTUAL

ENVIRONMENT

SAN

VOIP

TABLET

EMBEDDED

DEVICES

WIRELESS

APPS

1 BILLION DEVICES

15 BILLION CONNECTED DEVICES

BY 2015

Security Challenges:

469,000 unique malware

samples discovered

weekly

83% organizations hit by

Advanced Persistent

Threats

Flat to down IT/IS budgets

Flat number of trained

practitioners

100 BILLION CONNECTED DEVICES

BY 2020

Page 3: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

McAfee Confidential—Internal Use Only

Industrial Attacks Will Mature

Siemens

PLCs

Nuclear

Enrichment

Centrifuges

Stuxnet Proliferation

Stuxnet proved that malicious code can create a real world, kinetic response. Recent incidents directed at water utilities in the United States show that these facilities

are of increasing interest to attackers. The more attention is focused on SCADA and infrastructure systems, the more insecurity seems to come to light. We expect to

see this insecurity lead to greater threats through exploit toolkits and frameworks as well as the increased targeting of utilities and energy ICS systems in particular.

Page 4: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Things to Come

4

Page 5: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Threats Moving To Mobile Devices

Source: McAfee Labs, Q1, 2013

McAfee Confidential

2 billion

new mobile

endpoints in 2013!!

Page 6: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Storage Stack Attacks

6

As operating systems and applications have become more “hardened” against attack, cybercriminals have turned their attention to more

vulnerable subsystems. The “storage stack” is an increasingly popular target as a successful Master Boot Record attack allows the

target to be rooted and either added to a botnet or otherwise compromised.

Page 7: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Rootkit Attacks

7

Page 8: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Subverting Digital Signature Authentication

8

New Signed PC Malware

0

200,000

400,000

600,000

800,000

1,000,000

1,200,000

1,400,000

1,600,000

1,800,000

Q3 2011 Q4 2011 Q1 2012 Q2 2012 Q3 2012 Q4 2012 Q1 2013 Q2 2013 Q3 2013

Page 9: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Autorun Detection

9 February 2012

Page 10: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

Ransomware

10

The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves encrypting a

user’s hard drive and “ransoming” the key to unlock it. When used against an enterprise it typically involves extorting money in

exchange for not releasing confidential data that has been previously stolen.

New Ransomware Samples

0

50,000

100,000

150,000

200,000

250,000

Q1 2010 Q2 2010 Q3 2010 Q4 2010 Q1 2011 Q2 2011 Q3 2011 Q4 2011 Q1 2012 Q2 2012 Q3 2012 Q4 2012

Page 11: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

The leading network threat this quarter came via Microsoft remote procedure calls. This was followed by a very close race between

SQL-injection and cross-site scripting attacks. These two attacks are very much remote in nature, meaning they can be launched at

selected targets around the globe.

Network Threat Trends

11

Browser 15%

CGI Command Execution 12%

Cross-Site Scripting 19%

Remote Procedure Call 26%

Others 7%

SQL Injection 21%

Top Network Threat by Type

Page 12: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

APT Network Security Attack

Internet

USERS &

PARTNERS

SaaS

BRANCH

OFFICE

CORPORATE LAN

Maintain Persistence • Revamp Malware to avoid detection

• Utilize other attack methods to maintain presence

• Continue monitoring networks, users, data

Complete Objectives • Ex-filitrate Intellectual Property, Trade Secrets

• Install Trojans in source code

• Control critical systems

Establish Command & Control Infrastructure •Install system admin tools (Keyloggers, Trojans, etc.)

•Establish encrypted SSL tunnel

Establish Covert Backdoor • Gain elevated user privileges

• Laterally move within network & establish backdoors

• Inject additional Malware

Social Engineering Targeted Malware • Phishing email (malicious PDF, DOC, etc. w/shellcode) • Candy drops around blgd (Thumb drives, DVD’s) • Gain physical access (impersonate cleaning crew, etc.)

Reconnaissance •Map org chart (Identify attack targets)

•Social reconnaissance (acquire email, IM, etc.)

•Recruit, blackmail insiders

Page 13: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

McAfee Confidential—Internal Use Only

Whitelisting vs. Blacklisting

AD-HOC STATIC PLANNED

NetBook

Consumer PC

Kiosks

Medical Devices

SCADA

Systems

ATMs

Printer

Servers

Corporate

Desktop

13

Rugged Platforms

Tactical Systems

Page 14: SANS Cyber Threat Intelligence Summit · PDF fileRansomware 10 The fastest growing category of non-mobile malware is ransomware. When used against an individual it generally involves

RANSOMWARE - Europol€¦ · THE MALWARE THAT HOLDS YOUR DATA HOSTAGE FOR A PRICE RANSOMWARE PROTECT YOURSELF INFECTED? WHAT TO DO NEXT HOW DOES IT SPREAD? Ransomware prevents or

Technical Report for “Offline” Ransomware · Technical Report for “Offline” Ransomware Stanislav Skuratovich Malware Reverse Engineering Team 20/10/2015 Overview The ransomware

FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

Best practices for escaping ransomware · Record ransomware volumes in 2017 • According to the Malwarebytes' 2017 State of Malware Report, ransomware attacks against consumers went

How to Protect Your Networks from Ransomare… · Protecting Your Networks from Ransomware . Protecting Your Networks from Ransomware . Ransomware is the fastest growing malware threat,

HC3 Intelligence Briefing Dridex Malware...2020/06/25  · malware, as is DoppelPaymer ransomware, an updated variant of BitPaymer. • WastedLocker ransomware, first detected last

SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Raj Kumar - ITU€¦ · $1.5 to $2 billion $80 to $120 million What does a stealth bomber cost? ... Malware •Malware-as-a-Service •IoT Malware •Mobile Malware •Ransomware

Email keeps getting us pwned - Avoiding Ransomware and malware

Advanced Malware Protection Against ransomware

Ransomware: 2016's Greatest Malware Threat

Carbon Black Threat Report: Non-Malware Attacks and Ransomware Take Center Stage in 2016

WannaCry Ransomware - NKSC · WannaCry Ransomware 3 Malware names Wana Decrypt0r, WCry, WannaCry, WannaCrypt, and WanaCrypt0r Management summary WannaCry is a unique form of ransomware

Advanced Malware Protection Against ransomware//blogs.cisco.com/security/ransomware-the-race-you-dont-want-to-lose ... • Non-native document rendering PDF + Office • Users run

Back to the Future with Document Malware - SANS · Back to the Future with Document Malware SANS DFIR Summit Tyler Halfpop . THANK YOU! PS C:\> Get-Content TylerHalfpop ... FILE:

Detecting Malware With Memory Forensicshal/Detect_Malware_w_Memory_Forensics.pdfDetecting Malware With Memory Forensics Hal Pomeranz SANS Institute . Why Memory Forensics? Everything

WannaCry Ransomware Mitigation Techniques · WannaCry Ransomware Mitigation Techniques Version 0.3 Author: Daniel Card On Friday 12th May 2017 malware was released (still not confirmed

Atasi Seragan Malware Ransomware Wannacryptnews.gunadarma.ac.id/wp-content/uploads/2017/05/Langkah-Mitigasi... · 1 LANGKAH-LANGKAH ASI Atasi Seragan Malware Ransomware Wannacrypt

Stopping Ransomware and Polymorphic Malware Solution Brief · Malware needs an attack vector to establish its presence on an endpoint. After presence is established, malware stays

Cyberbit GmbH München - Infinigate Deutschland GmbH · Malware Prevention |Prevent known and unknown threats 9 EDR Malware Prevention Anti-Ransomware • Block pre-execution •

404427 - Ransomware Campaign Q1 - Infographic-FINALdiscover.zyxel.com/rs/471-TTL-126/images/404427 - Ransomware Ca… · 2015 Begin Security Audit New malware files detected daily

MOBILE MALWARE EVOLUTION 2016 - Securelist · PDF fileMobile ransomware ... This malware simultaneously installs its modules in the system directory, ... to mobile malware products,

Fraud Mitigation Strategies for Business · •Ransomware •Email Account Ransom •Webcam Image Extortion. Ransomware 14 Ransomware is a form of malware that restricts the target

Understanding internal structure of the SNAKE … Ransomware Analysis...MBSD Blog Understanding internal structure of the SNAKE (EKANS) ransomware Takashi Yoshikawa Senior Malware

Ransomware - peakresources.com...•Ransomware is Malware -Malicious software that encrypts and holds data/systems hostage for a ransom payment. •Organizations will use Bitcoin or

Evaluation Metric for Crypto-Ransomware Detection Using ... · Crypto Encryption Evaluation Machine learning Metric Ransomware Detection ABSTRACT Ransomware is a type of malware that

Back to the Future with Document Malware - SANS · Back to the Future with Document Malware SANS DFIR Summit ... Insert -> Object -> Text from File -> HTML file containing ... May

Automated Malware Analysis Sans Fire 2009 2

Benchmarking Deception Technologies - FireCompass · Malware (including ransomware): Deception solutions can help prevent the spread of malware/ransomware by luring the malware to

Ransomware, Malware and Viruses; How to Protect Yourself

Cybersecurity Tips and Best Practices€¦ · Ransomware Attack Threats • Fastest growing malware threat for all users on all types of computers • Multiple types of ransomware

Ransomware Teslacrypt Uncovered - Malware Analysis

Genetic Malware Analysis for Threat Intelligence · Malware Family Classification Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Defeating Ransomware with Isla Web Malware Isolationinterchangegroup.com/files/IC_Cyberinc-ransomware-white_paper.pdfThe Isla Web Malware Isolation System ... Phishing attacks generally