Upload File

the malware monetization machine

47
SESSION ID: SESSION ID: #RSAC Tony Anscombe The Malware Monetization Machine VP and Senior Security Evangelist at Avast

Upload: avast

Post on 21-Feb-2017

256 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: The Malware Monetization Machine

SESSION ID:SESSION ID:

#RSAC

Tony Anscombe

The Malware Monetization Machine

VP and Senior Security Evangelist at Avast

Page 2: The Malware Monetization Machine

The Malware Monetization MachineTony Anscombe ***********

Page 3: The Malware Monetization Machine

#RSAC

Malware Inc. The Business

Page 4: The Malware Monetization Machine

#RSAC

Malware Inc. The Business

30 employeesHealthcare, vacation, lunch, gym membership

Goal: grow distribution and use of software increasing LTV and ROI

2 offices located anywhere

Revenue 2015 - $25m2016 - $1bn2017 - >2x growth?

Page 5: The Malware Monetization Machine

#RSAC

Malware Inc. Products and Services

Software distributionData storage and encryptionData collection and salesSupport services

Page 6: The Malware Monetization Machine

#RSAC

Malware Inc. Software Distribution Q4 Recap

Q4 software distribution campaigns

Email delivery• 20m emails delivered to 12m

unique users• Open rate• Execution of the software package• Conversion rates to paying

customer

Page 7: The Malware Monetization Machine

#RSAC

Malware Inc. Software Distribution Q4 Recap

Q4 software distribution campaignsHosted website downloads

• Automated - drive by download• Unique users vs actual

delivery/installation • User initiated - click jacking

• CTR - Click Through Rate 0.5%

Page 8: The Malware Monetization Machine

#RSAC

Malware Inc. Q4 Data Business

Q4 data collectionMobile App distributionCollected from 3rd partiesService redirectionEmail campaigns

Page 9: The Malware Monetization Machine

#RSAC

Malware Inc. Bonus Payments

Over achievement on goalsRevenue exceeded targetAll staff will receive a 110% bonusWe shutdown for the holidays early, congratulations!

Page 10: The Malware Monetization Machine

#RSAC

Malware Inc. Bonus Payments

Over achievement on goalsRevenue exceeded targetAll staff will receive a 110% bonusWe shutdown for the holidays early, congratulations!January 17, 2017

Locky down as cybercrime takes a brief December holiday

Page 11: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Target Markets

Page 12: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Target Markets

High monetizing countries

Page 13: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Initiatives

A/B testing of offer screens

Page 14: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Testing Payment Methods

Page 15: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Translation

12 Languages to be offered

Page 16: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Time Sensitive Offers

Early purchase discounts

Page 17: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Detecting Fraud

Page 18: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Legacy Customers

Page 19: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Software Sales

Product sales security software

Page 20: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Identity Duplication

Stealing login details

Page 21: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Identity Duplication

X

Page 22: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Mobile

Page 23: The Malware Monetization Machine

#RSAC

Malware Inc. EOL Products

Banking Trojans Premium rate SMS

Page 24: The Malware Monetization Machine

#RSAC

Affiliate/Partner Sales

Victims

Affiliates

The boss

Page 25: The Malware Monetization Machine

#RSAC

Malware Inc. Q1 Outsourced Engineering

Bot nets/herdersExploit writersMalware writersInfrastructure/tool providers

Page 26: The Malware Monetization Machine

#RSAC

Malware Inc. The Competition

Page 27: The Malware Monetization Machine
Page 28: The Malware Monetization Machine
Page 29: The Malware Monetization Machine

How do we combat?

Page 30: The Malware Monetization Machine

#RSAC

Overall security threat is growing in complexity

Mobile threats are also accelerating

People’s Security Needs are Growing

Total malware threats, millions

(Cumulative malware threat attacks, million)

2010 2011 2012 2013 2014 2015

4765

470

183

100

326

0.35

1.01

4.26

10.6

585

2016

17.0Mobile malware threats, millions

(Cumulative malware threat attacks, million)

Page 31: The Malware Monetization Machine

#RSAC

Probability of Attack - The Americas

Page 32: The Malware Monetization Machine

#RSAC

Probability of Attack - The Americas

CA: 15%

US: 14%

MX: 21%

BR: 20%

PE: 27%

FR: 16%

PT: 18%

MA: 29%

SN: 28%

…

Page 33: The Malware Monetization Machine

#RSAC

Probability of Attack - Most of ROW

Page 34: The Malware Monetization Machine

#RSAC

Probability of Attack - Most of ROW

CZ: 27%

EG: 25%

RU: 25%

ET: 41%

KZ: 27%

SA: 14%

TZ: 23%

IN: 28%

LK: 29%

…

Page 35: The Malware Monetization Machine

#RSAC

How do we combat?

Incidents per day

23.7 million

Page 36: The Malware Monetization Machine

#RSAC

How do we combat?

Incidents - rolling 30

687.0 million

Page 37: The Malware Monetization Machine

#RSAC

Where do threats hide?

Page 38: The Malware Monetization Machine

#RSAC

Ransomware - 2016

#1 Threat150 new strains of ransomware

128,108,948 x $500 = (detections)(average ransom)

Page 39: The Malware Monetization Machine

#RSAC

Ransomware - 2016

#1 Threat150 new strains of ransomware

128,108,948 x $500 =

$ 64,054,474,000

105% growth year on year

(detections)(average ransom)

Page 40: The Malware Monetization Machine

#RSAC

Ransomware Hotspots

1. US

2. Brazil

3. Russia

4. UK

5. Mexico

6. Italy

7. Spain

8. Canada

9. Poland

10. Australia

11. India

Page 41: The Malware Monetization Machine

#RSAC

Combatting Ransomware

Many different forms

Scareware, screen lockers, crypto lockers, Doxingware

Ransomware is detected on every protection layer, including behavioral analysis

14 ‘Free’ decryption tools available

Decryption is a last resort

Not De-cryptable;

0.565

Decryptable; 0.3785

Plausible Decryption ; 0.0565

Page 42: The Malware Monetization Machine

#RSAC

Connected devices estimated to reach up to 50 billion by 2020Source: Cisco IBSG Report

Internet of Things is Exploding

Avast Confidential

Page 43: The Malware Monetization Machine

#RSAC

Enslaved IoT Devices

IoT attacks more frequent:

• DDoS attack on Dyn• 900,000 Telekom routers attacked

• 2016: from more than 4.3 million routers scanned, 48% had some security vulnerability

• More than 50% of all home routers use default passwords

• 2 out of 5 people are unaware that their router has an administrative interface where they can log in to view and change their settings

• 1 out of 7 log into their router’s admin interface weekly or monthly to check for updates

Page 44: The Malware Monetization Machine

#RSAC

Avast Confidential

Over 400M endpoints acting as sensors. Allow us to detect and neutralize threats fast.Largest, most sophisticated, most geographically dispersed threat detection network.World’s largest security-centric machine-learning network.

About Avast

Leveraging data analytics to improve customers online lifestyle. 8,524 virtual, 2,527 physical

and 443 AWS servers

82,600 simultaneous VPN connections

2.1m DNS requests (normal and secure) per second

3.6tr URLs processed per year

45.8m concurrent connections

Pushed 110pb of data in last three months

Page 45: The Malware Monetization Machine

#RSAC

Best Practices for a Ransomware Defense:

Ensure your systems, applications and devices are fully updated and patched

Ensure you have strong layered anti-malware security solutionEducate employees not to open suspicious attachmentsDisable Microsoft Office macros by default as a policyKeep recent backup copies, disconnected and offsite

Page 46: The Malware Monetization Machine

#RSAC

Summary

Anti-Malware is a passionate business

Malware is a business X

Page 47: The Malware Monetization Machine

#RSAC

Tony [email protected]

mailto:[email protected]

Survey of Machine Learning Techniques for Malware Analysis · Survey of Machine Learning Techniques for Malware Analysis Daniele Uccia,, Leonardo Aniellob, Roberto Baldonia aResearch

Generic and Static Detection of Mobile Malware Using Machine … · 2018-09-05 · Our system classifies all Android malware, but especially effective against social engineering malware

Malware Detection via Virtual Machine Monitoring Wenke Lee

Malware Detection - A Machine Learning Perspective

Android Malware Detection Based on System Calls · B. Machine Learning Our malware detection problem is an instance of a classi-cation problem in machine learning, and is solved using

When Malware is Packin’ Heat; Limits of Machine …When Malware is Packin’ Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features Hojjat Aghakhani , Fabio

Citadel Trojan Malware Analysis - Bot Net Legal Notice · Citadel Trojan Malware Analysis ... company will use a virtual machine or sandbox to analyze the malware. Figure 5. Portion

Duping the machine: malware strategies, post Sandbox detection · Duping the machine: malware strategies, post Sandbox detection VB2014. 2 ... ￮IP address of Sandbox machine appears

Malicious PDF Documents Detection using Machine …...Keywords: PDF, Malware, JavaScript, Machine Learning, Malware Detection. Abstract: PDF has been historically used as a popular

An approach to fast malware classi cation with machine ... · An approach to fast malware classi cation with machine learning technique With the rapid increase of malware, it is important

MALWARE DETECTION USING MACHINE LEARNING … › 4b09 › 6fe2fc78328adb7c31e0e2f… · malware detection using machine learning algorithms and reverse engineering of android java

Bot vs. Bot: Evading Machine Learning Malware Detection€¦ · Bot vs. Bot: Evading Machine Learning Malware Detection ... • create ‘.text’ and populate with ‘.text from

Malware Analysis Machine Learning for Andrew Davison-demand.gputechconf.com/gtc/...machine-learning-for-malware-analysis.pdf · Scaling Malware Detection - Previously mentioned approaches

MACHINE LEARNING METHODS FOR MALWARE DETECTION AND

Malware Detection Using Machine Learning Techniques

Android Malware Classification using Parallelized Machine Learning …lxu/resources/dissertation-lifan.pdf · ANDROID MALWARE CLASSIFICATION USING PARALLELIZED MACHINE LEARNING METHODS

Machine Learning for Malware Detection · Anti-malware companies turned to machine learning, an area of computer science that had been used successfully in image recognition, searching

Malware Analysis Machine Learning Approach - DeepSec · Malware Analysis Machine Learning Approach ... malware activities Memory Analysis the act of analyzing a dumped memory image

Machine Learning for Malware Detection Learning for Malware Detection ... Machine learning has a broad variety of approaches that it takes to a ... of their manual labeling by experts

N-gram Opcode Analysis for Android Malware Detection · malware samples. Machine learning based Android malware detection approaches have also been proposed that use static features

THE IMPORTANCE OF MACHINE LEARNING TECHNIQUES IN MALWARE …

EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning ·  · 2017-04-03EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning Mohammed K. Alzaylaee

Fighting advanced malware using machine learning - PacSec

A Machine Learning Approach to Android Malware Detection

Malware Analysis on Android Using Supervised Machine ... · malware. 1. Introduction . In the last decade, a lot of machine learning and data mining based methods applied to detect

Empirical Assessment of Machine Learning-Based Malware

Automatic Analysis of Malware Behavior using Machine Learning · Automatic Analysis of Malware Behavior using Machine Learning Konrad Rieck1, Philipp Trinius2, Carsten Willems2, and

Malware Image Classification using Machine Learning with

Android Malware Detection through Machine Learning on

Intelligente Medizingeräte und Applikationen monetarisieren und … · 2016-11-11 · Monetization Opportunities Ecosystem Monetization Services Monetization Data Monetization Device

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Machine Learning for Malware Classification and Clustering

Machine Learning for Analyzing Malware

Automatic Analysis of Malware Behavior using Machine Learningcavazos/cisc850-spring... · Automatic Analysis of Malware Behavior using Machine Learning Konrad Rieck, Philipp Trinius,

Automatic Analysis of Malware Behavior using Machine Learning Analysis of... · Automatic Analysis of Malware Behavior using Machine Learning ... Internet worms and Trojan ... the