Bordless Breaches and Migrating Malware

© 2015 IBM Corporation
How Cybercrime is Breaking Down Barriers to your Data
Etay Maor
Sr. Fraud Prevention
Strategist
March 2016
Borderless Breaches and
Migrating Malware
Limor Kessem
Cybersecurity
Evangelist

2© 2015 IBM Corporation
is the foundation for
advanced security and
threat research across
the IBM Security
Framework.

IBM X-Force® Research
Vulnerability
Protection
IP
Reputation
Anti-Spam
Malware
Analysis
Web
Application
Control
URL / Web
Filtering
The IBM X-Force Mission
 Monitor and evaluate the rapidly changing threat landscape
 Research new attack techniques and develop protection for tomorrow’s security challenges
 Educate our customers and the general public
 Integrate and distribute Threat Protection and Intelligence to make IBM solutions smarter
Expert analysis and data sharing on the global threat landscape
Zero-day
Research

Key Trends from 2015
4

Attacks are focusing on higher value data targets
2013
800,000,000+ records
breached, with no signs of
decreasing in the future
2014
1,000,000,000 records
breached, while CISOs cite increasing
risks from external threats
2015
Healthcare mega-breaches
set the trend for high value targets of
sensitive information
Source: IBM X-Force Threat Intelligence Report - 2016

The number of security incidents involving the leak of healthcare
records doubled from the previous year
Banking /
Financial,
22%
Citizen
Registry,
34%
Creden-
tials, 35%
Health,
10%
2014
Banking /
Financial,
14%
Citizen
Registry,
32%Creden-
tials, 33%
Health,
20%
2015
Source: IBM X-Force Interactive Security Incidents, count by incident based on type of records breached

Attacks on retail companies now include refined POS malware and
niche payment systems

Classic attacks like DDoS and malware continued to be successful
because of a lack of practiced security fundamentals

Breaches of durable PII bring attention to the complex intersection
between digital and physical identities
• 100M healthcare records were exposed in five mega-breaches
• Durable PII is harder to replace
Healthcare
PII
• Breaches at adult dating websites exposed sexual preferences and infidelities
• Opens opportunities for extortion and increased social engineering intelligence
• The breaches were linked to a number of suicides of affected victims
Sensitive
Personal
Data
• Increasing amounts of bandwidth, with the highest reported attack >600Gbps.
• The attack can affect not only the targeted domain, but also other sites and
services managed by the ISP.
DDoS
• The success of ransomware laid the groundwork for other types of cyber-
extortion.
• Bitcoin ransom demands range from a few hundred to tens of thousands of US
dollars.
Cyber-
Extortion

Our predictions on cybercrime for 2015 not only came true, but also
exceeded expectations
 Cybercriminals breaking borders
 Card-not-present (CNP) fraud rise and attacks on EMV
 Escalation of sophistication of mobile threats, including exploit packs and
device takeover
 Widespread use of anonymity networks and stronger encryption
 Burgeoning fraud methods for new payment schemes
 Biometrics as a target

Cybercrime is no longer the domain of amateurs, but rather
organized gangs

Malware is migrating across borders…
Malware leaps across target countries are
indicative of increasing sophistication and
organization in crime rings because they
require more than simple changes to
configuration files.

… indicating growing sophistication needed to organize these new
geographic targets
Develop or buy social engineering emails for the target geography
Rent or pay for localized spam spreading
Study local banks’ authentication requirements
Develop web-injections to correspond with the transaction flow,
language, and look & feel for each target
Have local criminals and money mules ready to use

Malware scaled up by shifting some targets to businesses rather
than consumers
New malware modules, like “pn32”
in Dyre, can harvest user credentials
for enterprise email servers.
BEC fraud initiates credible-looking
email to company accountant to
make large wire transfers.
Extortion and ransom demands are
targeted at company’s or client data.

New malware techniques include overlay malware on the mobile
operating system
Mobile overlay malware offers a one-stop shop for blackhats
– Works with bank apps and other applications that use HTML/JS injections
– Enable credential collection

Cybercrime predictions for 2016
• CNP will grow and increase in sophistication
• Skimming will die out, give way to ATM “shimmers”
• Novel EMV attacks will emerge, such as automated EMV replay attacks
Card Fraud
• Apps run in a compromised OS, creating uncontrollable security gaps
• New Windows 10 app platform enables one app to run on every Windows
device, including phones, tablets, laptops, and Xbox gaming platform
Mobile Malware
• Biometric repositories hacked
• Biometric ID used in fraud and sold or traded by cybercriminals
Biometrics

Many of the incidents we’ve seen could be avoided with a focus on
security basics
Instrument your environment with effective detection.
Keep up with threat intelligence.
Maintain a current and accurate asset inventory.
Maintain identity governance to audit and enforce access rules & permissions.
Have a patching solution that covers your entire infrastructure.
Implement mitigating controls.
Create and practice a broad incident response plan.

130+ countries where IBM delivers
managed security services
25 industry analyst reports rank
IBM Security as a LEADER
No. 1 enterprise security software
vendor in total revenue
12K+ clients protected including…
90% of the Fortune 100
companies
Learn more about IBM X-Force
Visit our web page
ibm.com/security/xforce
Watch our videos
IBM Security YouTube Channel
View upcoming webinars & blogs
SecurityIntelligence.com
Follow us on Twitter
@ibmsecurity
Join IBM X-Force Exchange
xforce.ibmcloud.com

© Copyright IBM Corporation 2015. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any
kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor
shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use
of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or
capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product
or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries
or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside
your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks
on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access.
IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other
systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE
IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
THANK YOUwww.ibm.com/security

Bordless Breaches and Migrating Malware

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (18)

Similar to Bordless Breaches and Migrating Malware

Similar to Bordless Breaches and Migrating Malware (20)

Recently uploaded

Recently uploaded (20)

Bordless Breaches and Migrating Malware