• Home

  • Business

  • Anatomy of a Malware Attack: The New Malware Ecosystem
24
Copyright 2008. All Rights Reserved. 1 April 29, 2008 Copyright 2008. All Rights Reserved. 1 April 29, 2008 Anatomy of a Malware Attack The New Malware Ecosystem Tom Bowers Senior Security Evangelist April 29, 2008

Anatomy of a Malware Attack: The New Malware Ecosystem

Embed Size (px)

DESCRIPTION

Today the threat has changed. Hackers are no longer kids trying to create a name for themselves; they're professionals with a vast network and are capable of increasingly sophisticated and highly targeted attacks. In fact, many of today's attacks are so stealth that the victims may not even realize their systems have been compromised for days, weeks or even months. So how do organizations address malware attacks as part of their overall risk management program? What steps can you take to ensure that your organization is not the next TJX or Ameritrade? This presentation provides an overview of the attacks targeting the enterprise today and an insider's look into how a malware attack is executed and what tools are needed to respond effectively. Get statistics on malware from the Kaspersky Anti-Virus Research Lab in Moscow and the specific business risks they represent. Learn about risk analysis, virus dissection and recommended mitigation frameworks.

Citation preview

Page 1: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 1April 29, 2008 Copyright 2008. All Rights Reserved. 1April 29, 2008

Anatomy of a Malware AttackThe New Malware Ecosystem

Tom Bowers

Senior Security Evangelist

April 29, 2008

Page 2: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 2April 29, 2008

• Malware growth rates

• Evolution from nuisance to monetized threat

• Malware as a business

• Malware Ecosystem

Introduction

Page 3: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 3April 29, 2008

Malware Samples per Year

Source: The Kapsersky Internet Security Lab

Page 4: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 4April 29, 2008

Distribution of Malware Categories in the First Half of 2007

What We Are Seeing

Source: The Kapsersky Internet Security Lab

Page 5: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 5April 29, 2008

Jeffrey Lee ParsonAge 18 (USA)

Arrested August 29, 2003

for the Lovesan.b virus

Sven JaschanAge 18 (Germany)

Arrested May 7, 2004 for

NetSky and Sasser viruses

Chen Ing-Hau Age 24 (Taiwan)

Arrested September 21, 2000

for the CIH virus

The Rogues’ Gallery –

The Script Kiddies

Page 6: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 6April 29, 2008

Jeanson James AnchetaAge 20 (USA)

Arrested November 3,2005 for creating zombie networks and leasing them for spam mailing and DDoS attacks on

websites

Farid EssebarAge 18 (Morocco)

Arrested on August 26,2005 for creating zombie networks using Mytob

and Zotob (Bozori) worms

The Rogues’ Gallery –

Two-Bit Thieves

Atilla EkiciAge 21 (Turkey)

Page 7: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 7April 29, 2008

The Rogues’ Gallery –

Big Business

• Yaron Bolondi, aged 32 (Israel)

• Attempted to withdraw £220 million (more than $420 million in 2005) from the bank's accounts the network of a London branch of Sumitomo Bank

• Arrested March 16, 2005

Page 8: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 8April 29, 2008

Criminal Attacks on the Rise

Source: The Kapsersky Internet Security Lab

Page 9: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 9April 29, 2008

A Great Low Risk Business

Cybercriminals feel relatively safe because:

– There are gaps in legislation

– Law enforcement understaffed and under-equipped

– Victims rarely inform police about crimes.

– Insignificant damages –incidents are not interesting to police (despite the huge number of these crimes)

– The crimes are international

Page 10: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 10April 29, 2008

Malware Ecosystem

Page 11: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 11April 29, 2008

Chinese Underground

Source: TR-2007-011: Reihe Informatik. December 3, 2007

Page 12: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 12April 29, 2008

Malware Business Portal

Offers:

•Specific node counts

•Guaranteed infection rates

•SLAs

•Technical Support

Page 13: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 13April 29, 2008

Malware Control Console

Storm Worm

Page 14: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 14April 29, 2008

Targeted Attacks• Los Alamos and Oak Ridge Spear Phishing attack

– Visitor database only

– 12 different attackers, 7 emails to 1000's of employees

– 11 emails opened

• What about your business?

– Specific companies being targeted

– Specific groups within a company

• Denotes social engineering skill

• Solid research (competitive intelligence) skills

– Job sites

– User forums…

Page 15: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 15April 29, 2008 Copyright 2008. All Rights Reserved. 15April 29, 2008

Hunting Malware

Page 16: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 16April 29, 2008

Virus Hunting Protocol

Page 17: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 17April 29, 2008

Wireshark

• What

– Network communications

• Why

– Infection mechanism, bot and data dump communications

• When

– Anytime though before infection is preferable

Page 18: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 18April 29, 2008

Regmon

What– What registry

changes are made

Why– Covers all registry

entries

When– Setup before

infection, measurement afterward

Page 19: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 19April 29, 2008

Filemon

What

– What files are changed, added, deleted…from a system

Why

– Typical Windows XP system has 50,000 to 100,000 files

When

– Setup before infection, measure afterward

Page 20: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 20April 29, 2008

Other Tools

• Netcat – the Swiss Army Knife

– Monitor Port 80 communications

– Create Log files of that communication

• B64Dec – Base 64 decoder

• Process Explorer – View Tasks and Task Trees

Page 21: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 21April 29, 2008

PinchPasswordstealer

Page 22: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 22April 29, 2008

Pinch Highlights

• Infection Vectors

– ICQ

– Email

• Purpose

– Collect victim system information

– Collect cached passwords

– Send collected data to Internet server

Page 23: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 23April 29, 2008

Conclusions

• Malware has evolved

• Highly organized, profitable, low risk business

• Organized ecosystem

• Basic incident response tools

Page 24: Anatomy of a Malware Attack: The New Malware Ecosystem

Copyright 2008. All Rights Reserved. 24April 29, 2008

Questions?

• [email protected]

• Search engine query: “Tom Bowers” “information security”


BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Documents
Science of Security: Cyber Ecosystem Attack Analysis Methodology

Science of Security: Cyber Ecosystem Attack Analysis Methodology

Presentations & Public Speaking
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series

Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series

Technology
Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

Documents
1 The Attack and Defense of Computers Dr. 許 富 皓. 2 Malware

1 The Attack and Defense of Computers Dr. 許 富 皓. 2 Malware

Documents
THINK APP SECURITY FIRST HOW MALWARE CAN STEAL YOUR … · HOW MALWARE CAN STEAL YOUR DATA—AND WHAT YOU CAN DO TO STOP IT MALWARE MITM ATTACKS In this specialized attack, a user

THINK APP SECURITY FIRST HOW MALWARE CAN STEAL YOUR … · HOW MALWARE CAN STEAL YOUR DATA—AND WHAT YOU CAN DO TO STOP IT MALWARE MITM ATTACKS In this specialized attack, a user

Documents
Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Documents
BLADE : An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

BLADE : An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Documents
Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Documents
2013 m sc econstructing the cryptanalytic attack behind the flame malware

2013 m sc econstructing the cryptanalytic attack behind the flame malware

Technology
Malware Most Wanted: Security Ecosystem

Malware Most Wanted: Security Ecosystem

Technology
BLADE, An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

BLADE, An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Documents
Mobile Malware Visual Analytics and Similarities of Attack ... · WHITE PAPER • Mobile Malware Visual Analytics and Similarities of Attack Toolkits Page 4. We chose DroidKungFu

Mobile Malware Visual Analytics and Similarities of Attack ... · WHITE PAPER • Mobile Malware Visual Analytics and Similarities of Attack Toolkits Page 4. We chose DroidKungFu

Documents
Analysis of Malware Dns Attack on the Network Using Domain

Analysis of Malware Dns Attack on the Network Using Domain

Documents
CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow I: Attack Introduction Cliff Zou Spring 2012

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow I: Attack Introduction Cliff Zou Spring 2012

Documents
The Malware Attack "Fan-out" Effect in the Cloud

The Malware Attack "Fan-out" Effect in the Cloud

Technology
QUARTER 4, 2019 · 07 Malware Trends 08 Overall Malware Trends 09 Most-Widespread Malware 13 Geographic Attack Distribution 14 Zero Day vs Known Malware 15 Network Attack Trends 17

QUARTER 4, 2019 · 07 Malware Trends 08 Overall Malware Trends 09 Most-Widespread Malware 13 Geographic Attack Distribution 14 Zero Day vs Known Malware 15 Network Attack Trends 17

Documents
Advanced Systems Security: Malware Detectiontrj1/cse544-s18/slides/cse544-malware.pdfSystems and Internet Infrastructure Security (SIIS) Laboratory Page Malware • Attack code supplied

Advanced Systems Security: Malware Detectiontrj1/cse544-s18/slides/cse544-malware.pdfSystems and Internet Infrastructure Security (SIIS) Laboratory Page Malware • Attack code supplied

Documents
Forcepoint Advanced Malware Detection Appliance 3 · Forcepoint Advanced Malware Detection Appliance has an extensive ecosystem leveraging ... SANDBOX ThINK behavioral analysis is

Forcepoint Advanced Malware Detection Appliance 3 · Forcepoint Advanced Malware Detection Appliance has an extensive ecosystem leveraging ... SANDBOX ThINK behavioral analysis is

Documents
Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization

Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization

Documents
Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Documents
ATTACK LANDSCAPE H1 2020 - blog-assets.f-secure.com...Attack Landscape H1 2020 5 Malware distribution methods 7 Email

ATTACK LANDSCAPE H1 2020 - blog-assets.f-secure.com...Attack Landscape H1 2020 5 Malware distribution methods 7 Email

Documents
CYBER-ATTACK AGAINST UKRAINIAN POWER PLANTS...malicious software (malware) had been introduced into three Ukrainian power utilities via explicitly-targeted spear phishing attack (FBI,

CYBER-ATTACK AGAINST UKRAINIAN POWER PLANTS...malicious software (malware) had been introduced into three Ukrainian power utilities via explicitly-targeted spear phishing attack (FBI,

Documents
Forensic Challenge 2010: Scan 1: Attack Trace Solution€¦ · INCIDENT OVERVIEW The network traffic captured in the file attack-trace.pcap relates to an automated malware attack

Forensic Challenge 2010: Scan 1: Attack Trace Solution€¦ · INCIDENT OVERVIEW The network traffic captured in the file attack-trace.pcap relates to an automated malware attack

Documents
MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

Documents
Genetic Malware Analysis for Threat Intelligence · Malware Family Classification Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Genetic Malware Analysis for Threat Intelligence · Malware Family Classification Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Documents
Maximum Damage Malware Attack in Mobile Wireless Networks

Maximum Damage Malware Attack in Mobile Wireless Networks

Documents
Financial Aspects of Network Security: Malware and Spam › en › ITU-T › Workshops-and... · Malware attack trends Overall increases Monthly growth ¾Trojans, rootkits slowing

Financial Aspects of Network Security: Malware and Spam › en › ITU-T › Workshops-and... · Malware attack trends Overall increases Monthly growth ¾Trojans, rootkits slowing

Documents
An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents