Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have...

33
‹#› Nick Ross Sales Engineering [email protected] Cybercrime What you need to know to keep your data safe

Transcript of Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have...

Page 1: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Nick Ross Sales Engineering [email protected]

Cybercrime What you need to know to keep your data safe

Page 2: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

8 new internet users added every second Pingdom

Page 3: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

7 Billion People Current best estimates

Page 4: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

4

Page 5: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Page 6: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Why protect the data?

No longer a nice to have, it’s a must have!

1. It’s the lifeblood of most organizations

1. Compliance regulations require it be protected

1. Customers are demanding their personal data is secure

Page 7: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

CyberCrime – illegal activities undertaken by criminals for financial gain Cabinet office

Page 8: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Mal ware icious Soft

Page 9: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

All Time Number of Unique Malware Samples

79,000,000

Page 10: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

60 – 70% of malware is directly monetized US Federal Board of Trade

Page 11: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Page 12: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Page 13: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• Your computing power

• Your personal and corporate information

• Your online identity

What is the target?

Page 14: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Email

• Social engineering

• Links to malicious sites

• Data stealing forms

Page 15: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• A new malicious URL every 2 -3 seconds

• User actively looking for something

• Silent ‘drive-by’ downloads

Web

Page 16: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

350,000 new malicious URLs are detected every day, and 80% are legitimate

SophosLabs

Page 17: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

What’s Trending?

Page 18: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Browse via search engine

Browse direct

Compromised Website

Page 19: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Page 20: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• www.sophos.com

• nakedsecurity.sophos.com

Want to know more?

Page 21: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Malware Myth #1: I’m too small to be a target

• Large organizations often work with a supply chain of smaller companies

• Fewer IT resources = easier to target

• Malware used in APTs targeting specific organizations/industries has appeared years later

Page 22: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Malware Myth #2: I have no data worth stealing

• What about your competitors?

• Do you deal with data on behalf of others?

￮ You may have liability for other people’s data

￮ You certainly have liability for your own employee’s data

Page 23: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Malware Myth #3: So what? I have desktop AV

• Protecting the desktop is a good start

• Macs aren’t immune

• Need to assess and where necessary, block, incoming and outgoing traffic

• The web is the no. 1 source of malware

• 70% of email traffic is spam but not all is harmless

Page 24: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Do the Basics

Do the Basics

Educate your users

Enforce the right

policies

Patching

Layered Protection

Desktop anti-malware no

longer enough on its own

Protect at the

gateway as well as the endpoint

Protect your online assets

Make sure your

website is secure

Think about your social media

presence

Mobile Security

Install AV

Manage

Don’t allow Jailbreaking or

rooting

Stick to Google Play store

So what can I do?

Page 25: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Do the Basics

Do the Basics

Educate your users

Enforce the right

policies

Patching

• Think about physical security

• Don’t plug in strange USB drives / CDs

• Think before clicking links / attachments

• Implement and enforce good passwords

• Only allow access to the data that’s required

• Remove old users

• Limit the amount of software installed

• Keep it up to date and patched

• ENCRYPT YOUR DATA

So what can I do?

Page 26: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• Desktop AV is a must

• This includes Macs, and Android Mobile

• Keep it up to date, monitor it.

• The gateway is the first point of entry to the network and should be controlled

• A basic firewall isn’t enough

• Invest in a security device that can also scan into traffic in depth – Unified Threat Management

• Filter Spam and web traffic

Layered Protection

Desktop anti-malware no

longer enough on its own

Protect at the

gateway as well as the endpoint

So what can I do?

Page 27: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• Who needs mobile access?

• Android is vulnerable – use AV

• Use a proper MDM or EMM solution

• Enforce policies on Jailbreaking and Rooting

Control Apps

• Think about network access in the office

• Consider how you make use of public WiFi

Mobile Security

Install AV

Manage

Don’t allow Jailbreaking or

rooting

Stick to Google Play store

So what can I do?

Page 28: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

• Who hosts your website?

• Think also about things like Outlook Anywhere and SharePoint

• Use a Web Application Firewall

• Use 2FA for remote access

• Who has access to the corporate Facebook/Twitter accounts?

Protect your online assets

Make sure your

website is secure

Think about your social media

presence

So what can I do?

Page 29: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Today’s security approach is falling behind

INCOMPLETE Always one more thing to deploy and manage

COMPLICATED Too hard to configure, too much to monitor

INEFFECTIVE Not keeping up with advanced threats

Page 30: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

Complex solutions aren’t solutions. We make security for the real world.

Simple security is better security

Kris Hagerman, CEO Sophos

Page 31: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

AT HOME AND ON THE MOVE

Mobile Control Endpoint Security SafeGuard Encryption

HEADQUARTERS

Endpoint Security SafeGuard Encryption

REMOTE OFFICE 1

NextGen Firewall

Secure Wi-Fi

Endpoint Security SafeGuard Encryption

Secure Wi-Fi

Secure VPN Client

Mobile Control

Reputation Data • Active Protection SophosLabs Correlated intelligence • Content Classification

Administration

SOPHOS CLOUD

Web Application Firewall

Secure Email Gateway

Secure Web Gateway

Mobile Control

Network Storage Antivirus Server Security

Guest Wi-Fi

UTM NextGen Firewall

Secure Web Gateway Secure Email Gateway

Web Application Firewall

REMOTE OFFICE 2

Secure Wi-Fi

Endpoint Security SafeGuard Encryption

Mobile Control

Secure VPN RED

Page 32: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#›

36

Page 33: Anatomy of an attack Smarter, Shadier, Stealthier Malware · Malware Myth #3: So what? I have desktop AV •Protecting the desktop is a good start •Macs aren’t immune •Need

‹#› © Sophos Ltd. All rights reserved.

[email protected]


Deep Malware Analysis - Joe Sandbox Sandbox Desktop Feature... · Sample: b19411d.js Startdate: 29/03/2016 Architecture: WINDOWS Score: 100 ... Sandbox Desktop Deep Malware Analysis

Deep Malware Analysis - Joe Sandbox Sandbox Desktop Feature... · Sample: b19411d.js Startdate: 29/03/2016 Architecture: WINDOWS Score: 100 ... Sandbox Desktop Deep Malware Analysis

Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Virtual desktop malware defence - DennisTechnologyLabs · 2011-07-06 · Virtual desktop malware defence A WEB THREAT PROTECTION TEST OF ANTI-MALWARE PRODUCTS RUNNING IN VIRTUAL DESKTOP

Virtual desktop malware defence - DennisTechnologyLabs · 2011-07-06 · Virtual desktop malware defence A WEB THREAT PROTECTION TEST OF ANTI-MALWARE PRODUCTS RUNNING IN VIRTUAL DESKTOP

CSCD 303 Essential Computer Security Spring 2013 Lecture 9 - Desktop Security,Malware Reading: Chapter 5 Hacker.

CSCD 303 Essential Computer Security Spring 2013 Lecture 9 - Desktop Security,Malware Reading: Chapter 5 Hacker.

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Malware & Anti-Malware

Malware & Anti-Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

The Definitive Guide to Controlling Malware, Spyware ... · Macro viruses can infect any desktop application that supports macros, not just Microsoft Word. Several macro viruses infect

The Definitive Guide to Controlling Malware, Spyware ... · Macro viruses can infect any desktop application that supports macros, not just Microsoft Word. Several macro viruses infect

Android Malware Clustering through Malicious Payload Mining · Clustering has been well studied for desktop malware analysis as an e ective triage method. Conventional similarity-based

Android Malware Clustering through Malicious Payload Mining · Clustering has been well studied for desktop malware analysis as an e ective triage method. Conventional similarity-based

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with