fighting malware
play

Fighting Malware Luis Corrons PandaLabs Technical Director 1 Who - PowerPoint PPT Presentation

Mar 23, 2023 •245 likes •777 views

Fighting Malware Luis Corrons PandaLabs Technical Director 1 Who is behind this? Who is behind this? Yesterday s Bad Guys s Bad Guys Yesterday Blaster.B Nestky / Sasser CIH 29-A Jeffrey Lee Parson

  1. Fighting Malware Luis Corrons PandaLabs Technical Director 1

  5. Who is behind this? Who is behind this?

  6. Yesterday’ ’s Bad Guys s Bad Guys Yesterday Blaster.B Nestky / Sasser CIH 29-A Jeffrey Lee Parson Sven Jaschan Chen Ing-Hau Benny

  7. Today’ ’s Bad Guys s Bad Guys Today Spam Phishing Spam James Ancheta Andrew Schwarmkoff Jeremy Jaynes

  8. Jeanson James Ancheta Plead guilty to four felony charges of violating United States Code Section 1030, Fraud and Related Activity in Connection with Computers Penalty: 57 months in prison

  9. Adam Botbyl The government claimed that the crime could have caused more than $2.5 million in damages. Penalty: 26 months in prison

  10. Cameron Lacroix Plead guilty to hacking into the cell-phone account of celebrity Paris Hilton and participated in an attack on data-collection firm LexisNexis Group that exposed personal records of more than 300,000 consumers. Penalty: 11 months in a Massachusetts juvenile detention facility

  11. Ehud Tenenbaum Admitted to cracking US and Israeli computers, and plead guilty to conspiracy, wrongful infiltration of computerized material, disruption of computer use and destroying evidence. Penalty: Six months of community service (in 2001) August 2009: Pleaded guilty to a single count of bank-card fraud for his role in a sophisticated computer-hacking scheme that federal officials say scored $10 million from U.S. banks.

  12. A Real Case A Real Case

  14. The “ “Infected Team Infected Team” ” The MPack MPack Dream Downloader Dream Downloader Limbo Limbo Total Investment: 1,500$ Total Investment: 1,500$

  15. The “ “Infected Team Infected Team” ” The

  16. The “ “Infected Team Infected Team” ” The Let Let’ ’s do some maths s do some maths… … China, Korea, Japan: China, Korea, Japan: $0.01 * 70,300 = $703 $0.01 * 70,300 = $703 Finland, Norway Finland, Norway… …: : $0.05 * 70,300 = $3,515 $0.05 * 70,300 = $3,515 UK, France UK, France… …: : $0.20 * 70,300 = $14,060 $0.20 * 70,300 = $14,060 USA, Canada: USA, Canada: $0.40 * 70,300 = $28,120 $0.40 * 70,300 = $28,120 And the same numbers in 30 days… … And the same numbers in 30 days China, Korea, Japan: $0.01 * 70,300 * 30 = $21,090 China, Korea, Japan: $0.01 * 70,300 * 30 = $21,090 Finland, Norway… …: : $0.05 * 70,300 * 30 = $105,450 Finland, Norway $0.05 * 70,300 * 30 = $105,450 UK, France… …: : $0.20 * 70,300 * 30 = $421,800 UK, France $0.20 * 70,300 * 30 = $421,800 USA, Canada: $0.40 * 70,300 * 30 = $843,600 USA, Canada: $0.40 * 70,300 * 30 = $843,600

  17. The “ “Infected Team Infected Team” ” The Who’ ’s paying the s paying the “ “Infected Team Infected Team” ”? ? Who

  20. Rogueware Infected Computers � 3.50% Computers worldwide � 1 billion (Forrester) 35,000,000 infected computers / monthly 35 million computers ≠ 35 million users Let’s take just half: 17.5 million people Phishing victims (Gartner) � 3.30% 557,500 rogueware buyers / monthly

  22. Rogueware Average Price � $59.95 $59.95 * 557,000 = $34,621,125 PER MONTH $415,453,500 PER YEAR

  24. $81,388 USD in 6 days!

  39. Malware figures Malware figures

  41. Malware figures Malware figures

  42. Malware figures Malware figures

  44. SEO attack against Ford Motor Company • 1,000,000 malicious links indexed by Google • 3,000,000 legitimate search terms hijacked • Targeted users looking for instructions (E.g. How to loosen a tension belt) • Served 100 new MSAntiSpyware2009 binaries in 24 hours

  45. Comments on Digg.com leading to Rogueware • 500,000+ comments leading to Rogueware • Comments targeted news submission title and content

  46. Twitter trending topics lead to Rogueware • Messages (tweets) targetting trending topics on Twitter.com • 27,000 tweets per 24 hours • 60 unique samples detected over 72 hour period

  47. Rogueware exploits Wordpress vulnerability to facilitate Blackhat SEO attack • Affected Ned.org and TheWorkBuzz.com • Targeted a security vulnerability in an old version of Wordpress • Redirected all links to point to Rogueware servers

  50. Conclusion Conclusion

  52. Thanks! Thanks! Luis Corrons luis.corrons@pandasecurity.com PandaLabs Blog: http://www.pandalabs.com 52

Recommend

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
Fighting Malware With GPUs In Real Time Peter Kovac kovac@avast.com www.avast.com Introduction

Fighting Malware With GPUs In Real Time Peter Kovac kovac@avast.com www.avast.com Introduction

Fighting Malware With GPUs In Real Time Peter Kovac kovac@avast.com www.avast.com Introduction Sensor network Few hundred million of user machines Hundreds of thousands new files every day Most of them clean files Thousands

1.5k views • 25 slides
BRO BEFRIENDS SURICATA SURICATA AND BRO FIGHTING MALWARE TOGETHER Created by Michal Purzynski

BRO BEFRIENDS SURICATA SURICATA AND BRO FIGHTING MALWARE TOGETHER Created by Michal Purzynski

Bro Befriends Suricata 23/09/16 20 : 23 BRO BEFRIENDS SURICATA SURICATA AND BRO FIGHTING MALWARE TOGETHER Created by Michal Purzynski @michalpurzynski / Scripts are here - https://github.com/michalpurzynski

894 views • 47 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Ruth Batson By Dan Hernan When we fight about education, were fighting for our lives.

Ruth Batson By Dan Hernan When we fight about education, were fighting for our lives.

Ruth Batson By Dan Hernan When we fight about education, were fighting for our lives. Were fighting for what that education will give us. Were fighting for a job. Were fighting to eat. Were fighting to pay our medical bills.

111 views • 8 slides
Is UFC Fighting Ethical? Angeli Leong Contextual Background The Ultimate Fighting

Is UFC Fighting Ethical? Angeli Leong Contextual Background The Ultimate Fighting

Is UFC Fighting Ethical? Angeli Leong Contextual Background The Ultimate Fighting Championship (UFC) is an American promotional company for mixed martial arts that shows matches pay-per-view or by watching in the stadium seats (max.

52 views • 4 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
World War I Outcome: The Fighting Ends The Fighting Ends 1. The German War Machine a. Germany

World War I Outcome: The Fighting Ends The Fighting Ends 1. The German War Machine a. Germany

World War I Outcome: The Fighting Ends The Fighting Ends 1. The German War Machine a. Germany faced troubles in 1918 A home front revolution forced the Kaiser into exile i. Shortage of soldiers ( Iron Youth was gone); mutiny in Navy ii. iii.

583 views • 15 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
Nutrition and Cancer: Fighting Cancer With Food Fighting Cancer With Food Living a healthy

Nutrition and Cancer: Fighting Cancer With Food Fighting Cancer With Food Living a healthy

Nutrition and Cancer: Fighting Cancer With Food Fighting Cancer With Food Living a healthy lifestyle is important in todays world and when cancer is diagnosed, it becomes even more crucial. Cancer takes a large toll on ones body

1.31k views • 22 slides
Fighting Inflammation with Nutrition Presented by: Anar Allidina MPH, RD ALI 338: Fighting

Fighting Inflammation with Nutrition Presented by: Anar Allidina MPH, RD ALI 338: Fighting

1 Fighting Inflammation with Nutrition Presented by: Anar Allidina MPH, RD ALI 338: Fighting Inflation 2 Objectives What is inflammation? Diseases that result from inflammation and identify the markers for inflammatory diseases

400 views • 26 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides

More recommend