“the trick is to stop thinking of it as ‘your’ money” -...
TRANSCRIPT
1 © Copyright 2011 EMC Corporation. All rights reserved.
“The trick is to stop thinking
of it as ‘your’ money” - IRS
Technion Security Summer School 2012
Etay Maor
Research Lab Manager
2 © Copyright 2011 EMC Corporation. All rights reserved.
1 2
6 5
RDP MITM Attack Scheme
3 © Copyright 2011 EMC Corporation. All rights reserved.
VNC/RDP
4 © Copyright 2011 EMC Corporation. All rights reserved.
What Else Are Fraudsters Up To?
• Citadel – THE latest version of Zeus
• Acknowledge the community’s requests
• Modules include: – All previous Zeus components – Video recorder – Auto CMD (“This is a good feature to have when analyzing a
company’s internal structure”) – DNS redirection (“AVs, Banks”) – “Important: Our software does not work on Russian-language systems.
If a Russian or Ukrainian layout is detected, the bot terminates. This is done to prevent installs on CIS systems. You may disagree, but that’s taboo for us.”
5 © Copyright 2011 EMC Corporation. All rights reserved.
Citadel
6 © Copyright 2011 EMC Corporation. All rights reserved.
Citadel + Ransomware
7 © Copyright 2011 EMC Corporation. All rights reserved.
Mobile Vulnerabilities (POC)
– Insecure data storage
– HTML Injection
– Sensitive information disclosure
– Broken Cryptography
– And more…
• Source: OWASP Mobile Security Project
8 © Copyright 2011 EMC Corporation. All rights reserved.
Portals, Redirectors and ATMs…O My…
9 © Copyright 2011 EMC Corporation. All rights reserved.
Citadel Mobile Malware
10 © Copyright 2011 EMC Corporation. All rights reserved.
Citadel Mobile Malware
11 © Copyright 2011 EMC Corporation. All rights reserved.
Citadel Mobile Malware
12 © Copyright 2011 EMC Corporation. All rights reserved.
Trojan Evasion
13 © Copyright 2011 EMC Corporation. All rights reserved.
Trojan Evasion
14 © Copyright 2011 EMC Corporation. All rights reserved.
XaaS
15 © Copyright 2011 EMC Corporation. All rights reserved.
Security Awareness 101