Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World)...

55
Security in a Borderless World Finding Unknown Risks, 0day Threats and Measurable Enforcement Elias Manousos CTO RiskIQ

Transcript of Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World)...

Page 1: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Security  in  a  Borderless  World  

Finding  Unknown  Risks,  0-­‐day  Threats  and  Measurable  Enforcement  

Elias  Manousos  CTO  RiskIQ  

Page 2: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Session  Overview  

•  Online  Risk  Overview    •  MarkeGng  Risks  

– Trademark  Abuse,  Lead  Diversion,  Partner/Agent/Affiliate  Compliance  

•  Security,  Trust  &  Safety  Risks  – Account  Hijacking,  Malware,  Phishing,  MalverGsements    

•  Specific  Examples  

Page 3: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Overview    

Today’s  a)acks  exploit  vulnerabili7es  in  brands,  marke7ng  programs  and  online  business  rela7onships  

     

+      =    $  

Page 4: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Online  Threats  

Target  organiza7ons  across  3  vectors    Brand  –    AWach  to  it  or  use  as  vehicle    Customer  –  exploit  the  customer  or  idenGty    Extended  Enterprise  –  the  weakest  link:  Vendors,  Partners,  Infrastructure  

 

Page 5: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Staying  under  the  radar  

Less  risky  to  “bad  guys”  and  generates  significant  monthly  income  

Difficult  to  prove  -­‐  Requires  “Big  Picture”  to  make  the  case  -­‐  Seemingly  Unconnected:  High  Frequency,  Low  Impact  Risks  

Civil  policy  viola7ons  vs.  Criminal  Inexpensive  to  Operate  

-­‐  Automated,  cookie-­‐cuWer  

Page 6: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Layers  of  Complexity  

In  most  cases,  US  companies  fund  fraud  by  purchasing  data  from  the  bad  guys  through  a  series  of  middlemen  who  also  benefit  

 -­‐  Traffic  Generators  :  Source  of  new  users  daily    -­‐  Buyers  :    MoneGzaGon  Sources  -­‐  SpecializaGon:  Outsourcing  lowers  the  bar  

Page 7: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

OrganizaGons  Suffer  

•  Stuck in Fire-Fighting Mode

•  Operational and Enforcement Costs Increase

•  Revolving Door due to Lack of Attribution “who are they?”

Page 8: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

The  Extended  Enterprise  

   “The  related  companies,  customers,  suppliers,  service  providers,  markeGng  partners  and  other  organizaGons  with  which  your  organizaGon  relies  on  to  conduct  business.”  

Page 9: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Extended  Enterprise  Examples  The  Systems  and  Partners  you  can’t  live  without…..    •  Cloud  Providers  such  as  Salesforce,  Amazon  

•  Key  Services:  Ex.  Payroll  

•  Hosted  Web  ApplicaGons  

•  MarkeGng  ApplicaGons:  Web  Ads,  3rd  Party  Email  Systems  

•  Web  2.0  Services  –  LinkedIn,  Facebook,  TwiWer  

Page 10: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Brand  Examples  

•  Paid  Search  ViolaGons  

•  Trademark  Infringement  to  aide  Lead  Diversion  

•  Partner  Compliance  /  Misleading  Statements  

Page 11: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Paid  Search  Enforcement  

Unauthorized  adverGsers  use  your  trademark  in  ad  copy  to  lure  visitors  to  their  website.  

Your  brand  is  leveraged  to  drive  targeted,  brand-­‐conscious  traffic  through  adverGsements,  blogs  and  search  results.  

 COMPANY  SPECIFC  CONTENT  REMOVED  

Presented  on  November  11,  2010   ©2009  RiskIQ  Inc.  

Page 12: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Lead  Aggregators  

Your  trademark  is  used  within  the  website  to  build  user  confidence  and  trust.  

Customers  are  misled  to  believe  that  the  website  has  an  official  relaGonship  with  your  business.  

 COMPANY  SPECIFC  CONTENT  REMOVED  

 

Presented  on  November  11,  2010  ©2010  RiskIQ  Inc.  

Page 13: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Anyone  Can  Use  Your  Trademark  

       Your  brand  provides  credibility  to  otherwise  suspect  websites.  

 COMPANY  SPECIFC  CONTENT  REMOVED  

 

Presented  on  November  11,  2010   ©2010  RiskIQ  Inc.  

Fine  print  on  this  page  aWempts  to  explain  how  they  will  save  you  50%    on  naGonwide  insurance.    This  site  replaces  “naGonwide”  with  any  insurance  company  the  user  places  in  the  search  on  the  preceding    page.  

Page 14: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

The  Bo)om  Line  

It’s  up  to  you,  the  trademark  owner,  to  police  the  use  and  abuse  of  your  trademarks  across  the  web.  

 COMPANY  SPECIFC  CONTENT  REMOVED  

 Presented  on  November  11,  2010   ©2010  RiskIQ  Inc.  

Page 15: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Social  Media  

•  Social  Media  represents  a  new  source  of  traffic  •  BeWer  TargeGng  =  beWer  conversions  

•  COMPANY  SPECIFC  CONTENT  REMOVED  

 

Page 16: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Purpose  of  the  Tweet  

 Paid  Ads  Running      on  low  quality  website    A  form  of  web  spam    Your  Trademark  and  AD  BUDGET  provides  the  moneGzaGon            COMPANY  SPECIFC  CONTENT  REMOVED    

Page 17: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Partner  Compliance  

•  False  or  Misleading  Statements  •  Using  Prizes  or  IncenGves  •  Kickbacks  •  Territory  issues  –  for  example  offering  a  service  in  another  state  

Page 18: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Card  Affiliates  

Online  Partners    Debit  Cards  should  not  be      marketed  as  Credit    Instant  Approval  Credit  Cards  Are  someGmes  marketed  as      cash  advances    Many  Affiliate  sell  customer    informaGon  several  Gmes    =  idenGty  thel    

Page 19: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Traffic  Sources  

Search  is  the  single  largest  traffic  source  followed  by  social  media  

   

Search  Engine  

• Google  • Yahoo  • Bing  

Paid  Ads  

• Paid  Search  • Contextual  • Banner  • 3rd  Party  

Affiliate  Networ

ks  

• Commission  JuncGon  • Linkshare  • GAN  -­‐  Google  • ClickBank  

Hacked  Legit  Sites  

• Major  Brands  • Mom  &  Pop  • UniversiGes  • Non  Profits  • Abandoned  Domains  Social  

Media  

• Blogs/RSS    • Facebook  • TwiWer  • Digg  • Social  Bookmarks  

Mobile  Apps  

• iPhone  • Blackberry  

Page 20: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Funnel  to  Capture  Users  

Engage  User  

Make  Offer  

Click?  

$  

Branded  Content  is  the  most  effec7ve  lure  to  a)ract  users  

1M  Impressions  

1%    have  interest  

10%  Click  

1,000  targets  

This  Funnel  is  True  for  Good  And  Bad  Traffic.    It  is  also  accurate    for  different  schemes:    Phish,  Malware,  Lead  Diversion,  Affiliate  Fraud….  

Example  

Page 21: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

RecommendaGons  

•  Do  you  have  Policies  and  Procedures  in  place?  •  Monitor  High  Traffic  Areas:    Search,  Social  •  Develop  a  scored  whitelist  of  authorized  partners  

•  Understand  the  financial  mechanics  of  your  organizaGon,  how  can  someone  make  $  off  your  brand  

•  Develop  countermeasures  which  increase  aWackers  costs,  lower  your  enforcement  costs  

Page 22: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Badware  

ApplicaGon  acts  decepGvely  or  irreversibly.    ApplicaGon  engages  in  potenGally  objecGonable  behavior  without:  First,  prominently  disclosing  to  the  user  that  it  will  engage  in  such  behavior,  in  clear  and  non-­‐technical  language,  and  then,  obtaining  the  user's  affirmaGve  consent  to  that  aspect  of  the  applicaGon.  [1]  

Page 23: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Badware  Problem  

Malware  such  as  Zeus  variants  and  other  coordinated  scams  are  cosGng  Financial  

InsGtuGons  over  1B  Annually    

FIs  calculate  losses  @  US  5-­‐15M  each  month    

Financial  InsGtuGons  are  the  main  target  of  web  based  malware  

Page 24: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Current  Approach  is  ReacGve  Malware-­‐based  phishing  is  realized  in  the  form  of  

complaints  and  losses    PrevenGon  is  a  difficult  problem…    

–  Legit  Partners  are  Hacked  or  Fooled  by  Bad  Guys  – Gathering  data  at  Internet  Scale  across  various  web  properGes  

–  Revolving  Door  due  to  lack  of  aWack  aWribuGon  –  “Fire  FighGng  mode”  takes  aWenGon  away  from  big  picture    

Page 25: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Malware-­‐Based  Phishing  Overview    

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  confidenGal;  do  not  distribute  without  prior  approval  

Page 26: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

How  it  happens…  

COMPANY  SPECIFC  CONTENT  REMOVED  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  

confidenGal;  do  not  distribute  without  prior  approval  

INFECTED  SITE  

Page 27: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Infected:  

COMPANY  SPECIFC  CONTENT  REMOVED  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  

confidenGal;  do  not  distribute  without  prior  approval  

Page 28: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

InfecGon  Point  

•  COMPANY  SPECIFC  CONTENT  REMOVED  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  

confidenGal;  do  not  distribute  without  prior  approval  

Page 29: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Paid  Search:    (company)  loan    

•  COMPANY  SPECIFC  CONTENT  REMOVED  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  

confidenGal;  do  not  distribute  without  prior  approval  

INFECTED  SITE  

•  Page  1  on  Google!!!  

•  Possibly  a  coordinated  Adwords  AWack    

•   $11.49  Cost  Per  Click!  

•   Scareware  

Page 30: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Infected:  Fake  AV  Install  

•  COMPANY  SPECIFC  CONTENT  REMOVED  

Page 31: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Infected:  voraceproducGons.com  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  confidenGal;  do  not  distribute  without  prior  approval  

•   Use  of  redirects  through  2  infected  hosts  •   2nd  infected  host  acts  as  the  hackers  ad  server?  •   new-­‐av-­‐scannerr.com  is  the  scareware  host  

Page 32: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Scope  Overview  

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  confidenGal;  do  not  distribute  without  prior  approval  

Brand   Brand  X  

Test  run  Gmeframe      

10  days  

Start  date    

2010-­‐02-­‐22  

End  date   2010-­‐03-­‐05      

Candidate  pages   63,377,746  

Total  pages  picked  for  analysis    

148,543  

Malicious  sites  containing  BofA  brand  with  *reach    

740  

%  of  Malicious  sites   0.5%  

Unique  Malware  resources/URIs  (out  of  the  740)    

353  

Unique  Malware  hosts  (out  of  the  740)   172  

*  Without  reach  =  14,577  

Page 33: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Top  10  DistribuGon  Concepts    

+--------------------------------+---------------+ | concept | incidentCount | +--------------------------------+---------------+ | X routing number | 97 | | bank X loan | 79 | | bank X home loans | 39 | | X privacy guard | 30 | | bank X car loan | 29 | | bank X interest rates | 27 | | X logins | 24 | | bank X routing number | 23 | | bank X online | 21 | +--------------------------------+---------------+

©  2010,  RiskIQ  Inc.  All  Rights  Reserved.  Proprietary  and  confidenGal;  do  not  distribute  without  prior  approval  

Page 34: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Calculating Impact & Defining Metrics

Develop your Malware Weather Report…. Research the groups targeting you.   Calculate users exposed or infected.   Distinguish targeted attacks from untargeted.   Store the hosts/exploits/kits forensically for follow on investigation. Develop metrics to help decide when and what actions to take.

Page 35: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

MalverGsements  

Page 36: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

MalverGsements  MalverGsing  (from  "malicious  adverGsing")  is  the  use  of  online  adverGsing  to  spread  malware  

 Because  adverGsing  content  can  be  inserted  into  high-­‐profile  reputable  websites,  malverGsing  provides  malefactors  an  opportunity  to  "push"  their  aWacks  at  cauGous  web  users  who  would  not  normally  visit  unknown  external  URLs,  by  exploGng  the  reputaGon  of  the  website  and  the  allegedly  adverGsed  brands  to  convince  them  that  they  are  visiGng  legiGmate  adverGsements.  

Page 37: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Why  Worry?  

MalverGsements  expose  vulnerabiliGes  in  cri7cal  infrastructure  

Ability  to  run  MalverGsements  lowers  the  bar  for  Bad  Guys  –  Step  1:  Buy  0day  exploit  code.  –  Step  2:  Buy  Botnet/malware  in  underground  forum  –  Step  3:  Buy  MalverGsements.    Distribute  Malware.  –  Step  4:  Profit.  

Page 38: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

MalverGsements  Status  Ad  Networks  generally  argue  their  networks  are  “clean”.  Networks  

have  liWle  reason  to  publicize  them.    Therefore…..  

•  Metrics  are  Lacking  –  this  is  similar  to  Data  Breach  Events  prior  to  legislaGon  (CA  SB  1386)  

•  Publishers  find  out  via  customer  complaints  (  similar  to  Phishing  )  

•  MalverGsements  don’t  happen  olen,  this  doesn’t  mean  we  don’t  have  a  major  problem  

•  Bad  Guy  success  is  measured  differently  from  our  idea  of  success  –  metrics  expose  their  business  model  

Page 39: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Overall  Trends  

Page 40: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Publisher  Size  

Majority  of  incidents  occur  on  smaller  publisher  sites    •   46%  of  incidents  are  small  pubs  >  1M  Rank  •   32%  are  top  1M  •   2.58%  are  top  1000  •   .93%  are  top  100  

   

Page 41: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

But…  Big  and  Small  Publishers  Impacted  

Publisher   Rank   Publisher   Rank  PhotoBucket   24   Ezlaptop.com   445,506  Huffington  Post   32   Thepetrescue.com   417,966  Digg   62   leechers.info  

   346,826  

Wikia   88   Zippyshare.com   325,469  Accuweather   148   Searchreel.com   297,864  FoxSports   192   glamsham.com   238,705  

 Last.fm   250   sushidaGng.com  

 221,251  

MensHealth   581   Celebwebnews.com   150,000  

Page 42: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Typical  Publisher  Profile  

Page 43: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)
Page 44: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)
Page 45: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)
Page 46: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Incident  Example  

Page 47: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Sequences  

Page 48: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

WHY….  

Page 49: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

PainGng  the  Big  Picture  

•  All  fraudulent  schemes  begin  with  Traffic  

•  The  amount  of  iniGal  traffic  a  bad  guy  can  receive  defines  the  size  of  the  market  

•  Larger  brands  or  brands  that  have  not  been  targeted  recently  face  increased  risk  

Page 50: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Why  these  problems  exist  

•  Zero-­‐hour,  rapidly  changing  infrastructure  and  content  

•  Lack  of  AWribuGon  or  IdenGty  

•  Bad  Guy  Countermeasures  

•  Manipulated  Trust  Metrics  

Page 51: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

The  Zero-­‐Hour  

•  Real-­‐Gme  indexing,  ad  exchanges,  syndicaGon,  Kits  

•  Moves  faster  than  security  filters  

•  “Under  the  radar”  –  Fast  Flux  – High  Frequency,  Low  Impact  –  Targets  large  numbers  of  users  from  many  hosts  

Page 52: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Online  Commerce  -­‐    Trust  Issues  

•  RelaGve  anonymity  •  Churn  -­‐  New  players  have  no  track  record  •  Traffic  Transparency  •  TransacGon  RepudiaGon  /VerificaGon  –  “No  Smoking  Gun”  

Page 53: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Bad  Guys  Manipulate  Trust  Metrics  

•  Maintain  impression  /  click  raGos  •  Blank  or  falsify  referrers  •  Use  “threat  detectors”  to  avoid  crawlers  and  manual  invesGgaGon  

•  Distribute  fraud  across  mulGple  personas/accounts/networks  

•  Operate  legit  sites  &  use  fraud  to  gain  comp  advantage  

•  Purchase  valid  traffic  –  fraud  supported  arbitrage  

Page 54: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Conclusion  •  Take  Ownership  of  your  IP  Online  –  if  you  don’t  someone  else  will  

•  Develop  Policies  –  Have  a  general  plan/Whitelists  

•  Understand  the  Incen7ves  &    Mo7ves  driving  fraud,  policy  violaGons,  Malware  

•  Develop  tests  for  “under  the  radar”  events  

•  Managing  Online  Risks  is  an  opportunity    

Page 55: Security)in)aBorderless)World) Presentation...Mar 10, 2011  · Security)in)aBorderless)World) Finding)Unknown)Risks,)0:day) Threats)and)Measurable)Enforcement Elias)Manousos) CTO)

Thank  you  

•  RiskIQ:  •  123Tenth  Street,  San  Francisco,  Ca  94103  •  [email protected],  [email protected]  


Introduction to Security The World We Live In What is Security?

Introduction to Security The World We Live In What is Security?

Security of Things World 2016 Mobile Security Survey Report

Security of Things World 2016 Mobile Security Survey Report

Security in a SaaS World

Security in a SaaS World

Security in an Uncertain World

Security in an Uncertain World

Security Awareness: Applying Practical Security in Your World Chapter 4: Chapter 4: Internet Security.

Security Awareness: Applying Practical Security in Your World Chapter 4: Chapter 4: Internet Security.

Security Awareness: Applying Practical Security in Your World Chapter 1: Introduction to Security.

Security Awareness: Applying Practical Security in Your World Chapter 1: Introduction to Security.

Cloud Security Summit - InfoSec World 2014

Cloud Security Summit - InfoSec World 2014

Delivering Security in a Changing World Future Capabilitiesarchives.livreblancdefenseetsecurite.gouv.fr › 2008 › ... · Delivering Security in a Changing World Future Capabilities

Delivering Security in a Changing World Future Capabilitiesarchives.livreblancdefenseetsecurite.gouv.fr › 2008 › ... · Delivering Security in a Changing World Future Capabilities

Real-World Web App Security

Real-World Web App Security

WATER SECURITY FOR WORLD HEALTH

WATER SECURITY FOR WORLD HEALTH

Security in a Mobile World

Security in a Mobile World

Advanced threat security - Cyber Security For The Real World

Advanced threat security - Cyber Security For The Real World

WORLD CYBER SECURITY TECHNOLOGY RESEARCH SUMMIT · PDF fileThe fourth World Cyber Security Technology Research ... the Summit Gala Dinner . ... of Belfast and the 4th World Cyber Security

WORLD CYBER SECURITY TECHNOLOGY RESEARCH SUMMIT · PDF fileThe fourth World Cyber Security Technology Research ... the Summit Gala Dinner . ... of Belfast and the 4th World Cyber Security

Nicolas MEGELAS - Garda World Security

Nicolas MEGELAS - Garda World Security

SMIL Manousos Bouloukakis 26/05/2001 What does SMIL mean? Synchronized Multimedia Integration Language Pronounce it "smile" !

SMIL Manousos Bouloukakis 26/05/2001 What does SMIL mean? Synchronized Multimedia Integration Language Pronounce it "smile" !

Personal and Enterprise Security in a Connected World · Personal and Enterprise Security in a Connected World. PwC. 1. PwC. Personal and Enterprise Security in a Connected World.

Personal and Enterprise Security in a Connected World · Personal and Enterprise Security in a Connected World. PwC. 1. PwC. Personal and Enterprise Security in a Connected World.

Network World QuickPulse Web Security Challenges How to Overcome Web Security ... · 2015. 9. 17. · Network World QuickPulse * Web Security Challenges How to Overcome Web Security

Network World QuickPulse Web Security Challenges How to Overcome Web Security ... · 2015. 9. 17. · Network World QuickPulse * Web Security Challenges How to Overcome Web Security

Embrace a Brave New Security World - Trend Micro APACapac.trendmicro.com/.../wp_evachen-a-brave-new-security-world.pdf · A Brave New (Security) World A Brave New (Security) World

Embrace a Brave New Security World - Trend Micro APACapac.trendmicro.com/.../wp_evachen-a-brave-new-security-world.pdf · A Brave New (Security) World A Brave New (Security) World

Security Awareness: Applying Practical Security in Your World Chapter 6: Total Security.

Security Awareness: Applying Practical Security in Your World Chapter 6: Total Security.

Security in serverless world

Security in serverless world