SlideShare a Scribd company logo
From Traditional Malware
to Targeted Attacks
Raimund Genes
Chief Technology Officer
Trend Micro
Internet
PC
PC
PC
Internet
Gateway
Exchange
Server
150 infected Mails
CRIMEWARE
DamagecausedbyCybercrime
2001 2003 2004 2005 2007 2010
Vulnerabilities
W orm
Outbreaks
Spam
Mass Mailers
Spyware
Intelligent
Botnets
Web
Threats
Evolution to Cybercrime
2011+
Targeted
Attacks
Mobile
Attacks
Trustwave 2013 Global Security Report:
Average time from initial breach to
detection was 210 days, more than 35
days longer than in 2011.
Malware / Bot / APT Behavior Comparison Table
APT Bot Malware
Distribution With organized planning Mass distribution over regions Mass distribution over regions
Services interruption No No Yes
Attack Pattern Targeted (only a few
groups/organizations)
Not targeted (large area spread-
out)
Not targeted (large area spread-
out)
Target Audience Particular Organization/Company Individual credentials including
online banking account
information
Random
Frequency of attacks Many times Once Once
Weapon -Zero-day exploit
-Drop embedded RAT
-Dropper or Backdoor
Multiple-Exploits,All in one By Malware design
Detection Rate Lower than 10% within one month Around 86% within one month Around 99% within one month
Some Documented Advanced Persistent Threat Campaigns
(Real-world Examples)
• LURID – threat actors launched around 300 campaigns
targeting different industries in different countries
• Luckycat – threat actors used diverse infrastructure
(from throwaway free hosting to dedicated VPSs)
• Taidoor – threat actors primarily targeted government
organizations located in Taiwan
• IXESHE – threat actors used compromised computers
inside the network to evade network detection
Advanced Persistent Threat
Targeted Attacks
The attacker knows
what he’s looking for!
South Korea – Hacktivism, Cyber Sabotage, or Cyberterrorism?
Sometimes an “unusual” targets
Typical Industrial Control System (ICS)
• In a small city in US with 8000 citizens
• It has to look like a real system
• And by “accident” the system has a link to the
Internet
Let’s simulate a Water Pressure Control station
Building a SCADA Honeypot…
Attacks from
US, 9
LAOS, 6
UK, 4
CHINA, 17
NETHERLANDS, 1
JAPAN, 1
BRAZIL, 2
POLAND, 1
VIETNAM, 1
RUSSIA, 3
PALESTINE, 1 CHILE, 1 CROATIA, 1 NORTH
KOREA, 1
What to expect next?
Your phone as your wallet
Android Malware
120,000 350,000
Vehicle past and now
TOYOTA'S
Vehicle(1955)
TOYOTA'S
Hybrid Vehicle(2011)
None of
computers included
over 70 of
computers included
Tire Pressure
Monitoring System
UNAUTHORIZED
APPS, Multimedia File
Smartphone,
USB
Immobilizer
Cutter
DOOR LOCKS
Smart Key
CHAdeMO :
Quick charging method for battery
powered electric vehicles
KEY
FOB
TELEMATICS
SYSTEM
OBDII , CAN, ECU
Vehicle Area Network
iVehicle
Embedded OS selected by car industry
SELECTED
IVI Standard
Organization
Security Assessment
Kernel > 2.6.35.3
Gain Privilege > 18
• All the ECU turned into
Fail-Safe-Mode.
• Engine fan and
headlamp kept working.
• Meter(e.g. speed)
needle keeps wobbling
Overflow attack to CAN bus
If someone wants to
get in, he get’s in!
So do we do a lot of
stuff just to satisfy the
auditors?
LATIN AMERICA
EUROPE
APAC
NORTH AMERICA
GLOBAL
Thank You

More Related Content

What's hot

Bitdefender mobile security for android
Bitdefender mobile security for androidBitdefender mobile security for android
Bitdefender mobile security for android
Kazi Sarwar Hossain
 
Cyber crime and cyber security
Cyber crime and cyber  securityCyber crime and cyber  security
Cyber crime and cyber securityKeshab Nath
 
The Consumerisation of Corporate IT
The Consumerisation of Corporate ITThe Consumerisation of Corporate IT
The Consumerisation of Corporate IT
Peter Wood
 
State of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and SolutionsState of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and Solutions
Goutama Bachtiar
 
Mobile Security 101
Mobile Security 101Mobile Security 101
Mobile Security 101
Lookout
 
Cyber terrorism
Cyber terrorismCyber terrorism
Cyber terrorism
Raheela Patel
 
Hot Cyber Security Technologies
Hot Cyber Security TechnologiesHot Cyber Security Technologies
Hot Cyber Security Technologies
RuchikaSachdeva4
 
Security models of modern mobile systems
Security models of modern mobile systemsSecurity models of modern mobile systems
Security models of modern mobile systems
Divya Raval
 
CTO Cybersecurity Forum 2013 David Turahi
CTO Cybersecurity Forum 2013 David TurahiCTO Cybersecurity Forum 2013 David Turahi
CTO Cybersecurity Forum 2013 David Turahi
Commonwealth Telecommunications Organisation
 
Attacks on Mobiles\Cell Phones
Attacks on Mobiles\Cell PhonesAttacks on Mobiles\Cell Phones
Attacks on Mobiles\Cell Phones
Faizan Shaikh
 
CYBER TERRORISM
     CYBER TERRORISM     CYBER TERRORISM
CYBER TERRORISM
Tejesh Dhaypule
 
Why Your Mobile Device Isn’t As Secure As You Think
Why Your Mobile Device Isn’t As Secure As You ThinkWhy Your Mobile Device Isn’t As Secure As You Think
Why Your Mobile Device Isn’t As Secure As You Think
Blue Coat
 
Basics of System Security and Tools
Basics of System Security and ToolsBasics of System Security and Tools
Basics of System Security and ToolsKaran Bhandari
 
Mobile security
Mobile securityMobile security
Mobile security
Naveen Kumar
 
The Evolution of Cyber Attacks
The Evolution of Cyber AttacksThe Evolution of Cyber Attacks
The Evolution of Cyber Attacks
Venafi
 
Digital Security
Digital Security Digital Security
Digital Security
MCMAUP01
 
Smart phone and mobile device security
Smart phone and mobile device securitySmart phone and mobile device security
Smart phone and mobile device security
CAS
 
Cybersecurity Series - Cyber Defense for Internal Auditors
Cybersecurity Series - Cyber Defense for Internal AuditorsCybersecurity Series - Cyber Defense for Internal Auditors
Cybersecurity Series - Cyber Defense for Internal Auditors
Jim Kaplan CIA CFE
 
NormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk BriefNormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk Brief
NormShield
 

What's hot (20)

Bitdefender mobile security for android
Bitdefender mobile security for androidBitdefender mobile security for android
Bitdefender mobile security for android
 
Cyber crime and cyber security
Cyber crime and cyber  securityCyber crime and cyber  security
Cyber crime and cyber security
 
The Consumerisation of Corporate IT
The Consumerisation of Corporate ITThe Consumerisation of Corporate IT
The Consumerisation of Corporate IT
 
State of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and SolutionsState of Cyber Crime in Banking Sector Today: Threats and Solutions
State of Cyber Crime in Banking Sector Today: Threats and Solutions
 
Mobile Security 101
Mobile Security 101Mobile Security 101
Mobile Security 101
 
Cyber terrorism
Cyber terrorismCyber terrorism
Cyber terrorism
 
Hot Cyber Security Technologies
Hot Cyber Security TechnologiesHot Cyber Security Technologies
Hot Cyber Security Technologies
 
Security models of modern mobile systems
Security models of modern mobile systemsSecurity models of modern mobile systems
Security models of modern mobile systems
 
CTO Cybersecurity Forum 2013 David Turahi
CTO Cybersecurity Forum 2013 David TurahiCTO Cybersecurity Forum 2013 David Turahi
CTO Cybersecurity Forum 2013 David Turahi
 
Attacks on Mobiles\Cell Phones
Attacks on Mobiles\Cell PhonesAttacks on Mobiles\Cell Phones
Attacks on Mobiles\Cell Phones
 
CYBER TERRORISM
     CYBER TERRORISM     CYBER TERRORISM
CYBER TERRORISM
 
Why Your Mobile Device Isn’t As Secure As You Think
Why Your Mobile Device Isn’t As Secure As You ThinkWhy Your Mobile Device Isn’t As Secure As You Think
Why Your Mobile Device Isn’t As Secure As You Think
 
Basics of System Security and Tools
Basics of System Security and ToolsBasics of System Security and Tools
Basics of System Security and Tools
 
Mobile security
Mobile securityMobile security
Mobile security
 
The Evolution of Cyber Attacks
The Evolution of Cyber AttacksThe Evolution of Cyber Attacks
The Evolution of Cyber Attacks
 
Digital Security
Digital Security Digital Security
Digital Security
 
Smart phone and mobile device security
Smart phone and mobile device securitySmart phone and mobile device security
Smart phone and mobile device security
 
Cybersecurity Series - Cyber Defense for Internal Auditors
Cybersecurity Series - Cyber Defense for Internal AuditorsCybersecurity Series - Cyber Defense for Internal Auditors
Cybersecurity Series - Cyber Defense for Internal Auditors
 
NormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk BriefNormShield 2018 Cyber Security Risk Brief
NormShield 2018 Cyber Security Risk Brief
 
Tt 06-ck
Tt 06-ckTt 06-ck
Tt 06-ck
 

Similar to Raimund genes from traditional malware to targeted attacks

7 mike-steenberg-carlos-lopera-us-bank
7 mike-steenberg-carlos-lopera-us-bank7 mike-steenberg-carlos-lopera-us-bank
7 mike-steenberg-carlos-lopera-us-bankshreemala1
 
Hunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systemsHunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systems
Fidelis Cybersecurity
 
APT in the Financial Sector
APT in the Financial SectorAPT in the Financial Sector
APT in the Financial Sector
LIFARS
 
What is the Cybersecurity plan for tomorrow?
What is the Cybersecurity plan for tomorrow?What is the Cybersecurity plan for tomorrow?
What is the Cybersecurity plan for tomorrow?
Samvel Gevorgyan
 
Safer Technology Through Threat Awareness and Response
Safer Technology Through Threat Awareness and ResponseSafer Technology Through Threat Awareness and Response
Safer Technology Through Threat Awareness and Response
Stephen Cobb
 
The Role of Application Control in a Zero-Day Reality
The Role of Application Control in a Zero-Day RealityThe Role of Application Control in a Zero-Day Reality
The Role of Application Control in a Zero-Day Reality
Lumension
 
Cyber Defense Automation
Cyber Defense AutomationCyber Defense Automation
Cyber Defense Automation
♟Sergej Epp
 
E security and payment 2013-1
E security  and payment 2013-1E security  and payment 2013-1
E security and payment 2013-1Abdelfatah hegazy
 
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Denis Gorchakov
 
TC160_PowerPoint_presentation_gbraga
TC160_PowerPoint_presentation_gbragaTC160_PowerPoint_presentation_gbraga
TC160_PowerPoint_presentation_gbragaGeorge Braga
 
Security in e-commerce
Security in e-commerceSecurity in e-commerce
Security in e-commerce
SensePost
 
Cyber security with ai
Cyber security with aiCyber security with ai
Cyber security with ai
Burhan Ahmed
 
External threats-to-information-system
External threats-to-information-systemExternal threats-to-information-system
External threats-to-information-system
Souman Guha
 
Malware
MalwareMalware
Information security
Information securityInformation security
Information security
Appin Faridabad
 
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docxThe uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
arnoldmeredith47041
 
Netop Remote Control Embedded Devices
Netop Remote Control Embedded DevicesNetop Remote Control Embedded Devices
Netop Remote Control Embedded Devices
Netop
 
Information security in todays world
Information security in todays worldInformation security in todays world
Information security in todays world
Sibghatullah Khattak
 

Similar to Raimund genes from traditional malware to targeted attacks (20)

7 mike-steenberg-carlos-lopera-us-bank
7 mike-steenberg-carlos-lopera-us-bank7 mike-steenberg-carlos-lopera-us-bank
7 mike-steenberg-carlos-lopera-us-bank
 
Hunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systemsHunting for cyber threats targeting weapon systems
Hunting for cyber threats targeting weapon systems
 
APT in the Financial Sector
APT in the Financial SectorAPT in the Financial Sector
APT in the Financial Sector
 
What is the Cybersecurity plan for tomorrow?
What is the Cybersecurity plan for tomorrow?What is the Cybersecurity plan for tomorrow?
What is the Cybersecurity plan for tomorrow?
 
Safer Technology Through Threat Awareness and Response
Safer Technology Through Threat Awareness and ResponseSafer Technology Through Threat Awareness and Response
Safer Technology Through Threat Awareness and Response
 
The Role of Application Control in a Zero-Day Reality
The Role of Application Control in a Zero-Day RealityThe Role of Application Control in a Zero-Day Reality
The Role of Application Control in a Zero-Day Reality
 
Cyber Defense Automation
Cyber Defense AutomationCyber Defense Automation
Cyber Defense Automation
 
E security and payment 2013-1
E security  and payment 2013-1E security  and payment 2013-1
E security and payment 2013-1
 
C3
C3C3
C3
 
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
Countering mobile malware in CSP’s network. Android honeypot as anti-fraud so...
 
Brooks18
Brooks18Brooks18
Brooks18
 
TC160_PowerPoint_presentation_gbraga
TC160_PowerPoint_presentation_gbragaTC160_PowerPoint_presentation_gbraga
TC160_PowerPoint_presentation_gbraga
 
Security in e-commerce
Security in e-commerceSecurity in e-commerce
Security in e-commerce
 
Cyber security with ai
Cyber security with aiCyber security with ai
Cyber security with ai
 
External threats-to-information-system
External threats-to-information-systemExternal threats-to-information-system
External threats-to-information-system
 
Malware
MalwareMalware
Malware
 
Information security
Information securityInformation security
Information security
 
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docxThe uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
The uniqueness of the text61.5SHOW ALL MATCHESPage addre.docx
 
Netop Remote Control Embedded Devices
Netop Remote Control Embedded DevicesNetop Remote Control Embedded Devices
Netop Remote Control Embedded Devices
 
Information security in todays world
Information security in todays worldInformation security in todays world
Information security in todays world
 

More from Graeme Wood

TechCatalyst free assessment
TechCatalyst free assessment TechCatalyst free assessment
TechCatalyst free assessment
Graeme Wood
 
TechCatalyst Corporate Overview
TechCatalyst Corporate Overview TechCatalyst Corporate Overview
TechCatalyst Corporate Overview
Graeme Wood
 
How does semantic technology work?
How does semantic technology work? How does semantic technology work?
How does semantic technology work?
Graeme Wood
 
AI and the Financial Service Segment
AI and the Financial Service SegmentAI and the Financial Service Segment
AI and the Financial Service Segment
Graeme Wood
 
Ai and Legal Industy - Executive Overview
Ai and Legal Industy - Executive OverviewAi and Legal Industy - Executive Overview
Ai and Legal Industy - Executive Overview
Graeme Wood
 
Semantic Computing Executive Briefing
Semantic Computing Executive Briefing Semantic Computing Executive Briefing
Semantic Computing Executive Briefing
Graeme Wood
 
Introduction to Semantic Computing
Introduction to Semantic ComputingIntroduction to Semantic Computing
Introduction to Semantic Computing
Graeme Wood
 
AIIA_DataAnalytics_Project_External_20160721
AIIA_DataAnalytics_Project_External_20160721AIIA_DataAnalytics_Project_External_20160721
AIIA_DataAnalytics_Project_External_20160721Graeme Wood
 
CSA Introduction 2013 David Ross
CSA Introduction 2013 David RossCSA Introduction 2013 David Ross
CSA Introduction 2013 David Ross
Graeme Wood
 
Jd sherry howard a. schmidt cyber crime, cyberspy, cyberwar - taking the le...
Jd sherry howard a. schmidt   cyber crime, cyberspy, cyberwar - taking the le...Jd sherry howard a. schmidt   cyber crime, cyberspy, cyberwar - taking the le...
Jd sherry howard a. schmidt cyber crime, cyberspy, cyberwar - taking the le...Graeme Wood
 
andrew milroy - top security trends and takeaways for 2013
andrew milroy - top security trends and takeaways for 2013andrew milroy - top security trends and takeaways for 2013
andrew milroy - top security trends and takeaways for 2013
Graeme Wood
 
Anz campaign creative 11 sept 2010
Anz campaign creative 11 sept 2010Anz campaign creative 11 sept 2010
Anz campaign creative 11 sept 2010
Graeme Wood
 
Anz cloud thought leadership 16 mar
Anz cloud thought leadership 16 marAnz cloud thought leadership 16 mar
Anz cloud thought leadership 16 mar
Graeme Wood
 
Vmware Seminar Security & Compliance for the cloud with Trend Micro
Vmware Seminar Security & Compliance for the cloud with Trend MicroVmware Seminar Security & Compliance for the cloud with Trend Micro
Vmware Seminar Security & Compliance for the cloud with Trend Micro
Graeme Wood
 
Trend Micro VForum Agentless Scanning Presentation
Trend Micro VForum Agentless Scanning PresentationTrend Micro VForum Agentless Scanning Presentation
Trend Micro VForum Agentless Scanning PresentationGraeme Wood
 

More from Graeme Wood (15)

TechCatalyst free assessment
TechCatalyst free assessment TechCatalyst free assessment
TechCatalyst free assessment
 
TechCatalyst Corporate Overview
TechCatalyst Corporate Overview TechCatalyst Corporate Overview
TechCatalyst Corporate Overview
 
How does semantic technology work?
How does semantic technology work? How does semantic technology work?
How does semantic technology work?
 
AI and the Financial Service Segment
AI and the Financial Service SegmentAI and the Financial Service Segment
AI and the Financial Service Segment
 
Ai and Legal Industy - Executive Overview
Ai and Legal Industy - Executive OverviewAi and Legal Industy - Executive Overview
Ai and Legal Industy - Executive Overview
 
Semantic Computing Executive Briefing
Semantic Computing Executive Briefing Semantic Computing Executive Briefing
Semantic Computing Executive Briefing
 
Introduction to Semantic Computing
Introduction to Semantic ComputingIntroduction to Semantic Computing
Introduction to Semantic Computing
 
AIIA_DataAnalytics_Project_External_20160721
AIIA_DataAnalytics_Project_External_20160721AIIA_DataAnalytics_Project_External_20160721
AIIA_DataAnalytics_Project_External_20160721
 
CSA Introduction 2013 David Ross
CSA Introduction 2013 David RossCSA Introduction 2013 David Ross
CSA Introduction 2013 David Ross
 
Jd sherry howard a. schmidt cyber crime, cyberspy, cyberwar - taking the le...
Jd sherry howard a. schmidt   cyber crime, cyberspy, cyberwar - taking the le...Jd sherry howard a. schmidt   cyber crime, cyberspy, cyberwar - taking the le...
Jd sherry howard a. schmidt cyber crime, cyberspy, cyberwar - taking the le...
 
andrew milroy - top security trends and takeaways for 2013
andrew milroy - top security trends and takeaways for 2013andrew milroy - top security trends and takeaways for 2013
andrew milroy - top security trends and takeaways for 2013
 
Anz campaign creative 11 sept 2010
Anz campaign creative 11 sept 2010Anz campaign creative 11 sept 2010
Anz campaign creative 11 sept 2010
 
Anz cloud thought leadership 16 mar
Anz cloud thought leadership 16 marAnz cloud thought leadership 16 mar
Anz cloud thought leadership 16 mar
 
Vmware Seminar Security & Compliance for the cloud with Trend Micro
Vmware Seminar Security & Compliance for the cloud with Trend MicroVmware Seminar Security & Compliance for the cloud with Trend Micro
Vmware Seminar Security & Compliance for the cloud with Trend Micro
 
Trend Micro VForum Agentless Scanning Presentation
Trend Micro VForum Agentless Scanning PresentationTrend Micro VForum Agentless Scanning Presentation
Trend Micro VForum Agentless Scanning Presentation
 

Recently uploaded

2024 is the point of certainty. Forecast of UIF experts
2024 is the point of certainty. Forecast of UIF experts2024 is the point of certainty. Forecast of UIF experts
2024 is the point of certainty. Forecast of UIF experts
olaola5673
 
AI and Covert Influence Operations: Latest Trends
AI and Covert Influence Operations: Latest TrendsAI and Covert Influence Operations: Latest Trends
AI and Covert Influence Operations: Latest Trends
CI kumparan
 
01062024_First India Newspaper Jaipur.pdf
01062024_First India Newspaper Jaipur.pdf01062024_First India Newspaper Jaipur.pdf
01062024_First India Newspaper Jaipur.pdf
FIRST INDIA
 
Do Linguistics Still Matter in the Age of Large Language Models.pptx
Do Linguistics Still Matter in the Age of Large Language Models.pptxDo Linguistics Still Matter in the Age of Large Language Models.pptx
Do Linguistics Still Matter in the Age of Large Language Models.pptx
Slator- Language Industry Intelligence
 
Resolutions-Key-Interventions-28-May-2024.pdf
Resolutions-Key-Interventions-28-May-2024.pdfResolutions-Key-Interventions-28-May-2024.pdf
Resolutions-Key-Interventions-28-May-2024.pdf
bhavenpr
 
Preview of Court Document for Iseyin community
Preview of Court Document for Iseyin communityPreview of Court Document for Iseyin community
Preview of Court Document for Iseyin community
contact193699
 
Codes n Conventionss copy (1).paaaaaaptx
Codes n Conventionss copy (1).paaaaaaptxCodes n Conventionss copy (1).paaaaaaptx
Codes n Conventionss copy (1).paaaaaaptx
ZackSpencer3
 
03062024_First India Newspaper Jaipur.pdf
03062024_First India Newspaper Jaipur.pdf03062024_First India Newspaper Jaipur.pdf
03062024_First India Newspaper Jaipur.pdf
FIRST INDIA
 
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdfSharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
bhavenpr
 
What Ukraine Has Lost During Russia’s Invasion
What Ukraine Has Lost During Russia’s InvasionWhat Ukraine Has Lost During Russia’s Invasion
What Ukraine Has Lost During Russia’s Invasion
LUMINATIVE MEDIA/PROJECT COUNSEL MEDIA GROUP
 
Hogan Comes Home: an MIA WWII crewman is returned
Hogan Comes Home: an MIA WWII crewman is returnedHogan Comes Home: an MIA WWII crewman is returned
Hogan Comes Home: an MIA WWII crewman is returned
rbakerj2
 
Hindustan Insider 2nd edition release now
Hindustan Insider 2nd edition release nowHindustan Insider 2nd edition release now
Hindustan Insider 2nd edition release now
hindustaninsider22
 
Draft-1-Resolutions-Key-Interventions-.pdf
Draft-1-Resolutions-Key-Interventions-.pdfDraft-1-Resolutions-Key-Interventions-.pdf
Draft-1-Resolutions-Key-Interventions-.pdf
bhavenpr
 
Letter-from-ECI-to-MeiTY-21st-march-2024.pdf
Letter-from-ECI-to-MeiTY-21st-march-2024.pdfLetter-from-ECI-to-MeiTY-21st-march-2024.pdf
Letter-from-ECI-to-MeiTY-21st-march-2024.pdf
bhavenpr
 
31052024_First India Newspaper Jaipur.pdf
31052024_First India Newspaper Jaipur.pdf31052024_First India Newspaper Jaipur.pdf
31052024_First India Newspaper Jaipur.pdf
FIRST INDIA
 

Recently uploaded (15)

2024 is the point of certainty. Forecast of UIF experts
2024 is the point of certainty. Forecast of UIF experts2024 is the point of certainty. Forecast of UIF experts
2024 is the point of certainty. Forecast of UIF experts
 
AI and Covert Influence Operations: Latest Trends
AI and Covert Influence Operations: Latest TrendsAI and Covert Influence Operations: Latest Trends
AI and Covert Influence Operations: Latest Trends
 
01062024_First India Newspaper Jaipur.pdf
01062024_First India Newspaper Jaipur.pdf01062024_First India Newspaper Jaipur.pdf
01062024_First India Newspaper Jaipur.pdf
 
Do Linguistics Still Matter in the Age of Large Language Models.pptx
Do Linguistics Still Matter in the Age of Large Language Models.pptxDo Linguistics Still Matter in the Age of Large Language Models.pptx
Do Linguistics Still Matter in the Age of Large Language Models.pptx
 
Resolutions-Key-Interventions-28-May-2024.pdf
Resolutions-Key-Interventions-28-May-2024.pdfResolutions-Key-Interventions-28-May-2024.pdf
Resolutions-Key-Interventions-28-May-2024.pdf
 
Preview of Court Document for Iseyin community
Preview of Court Document for Iseyin communityPreview of Court Document for Iseyin community
Preview of Court Document for Iseyin community
 
Codes n Conventionss copy (1).paaaaaaptx
Codes n Conventionss copy (1).paaaaaaptxCodes n Conventionss copy (1).paaaaaaptx
Codes n Conventionss copy (1).paaaaaaptx
 
03062024_First India Newspaper Jaipur.pdf
03062024_First India Newspaper Jaipur.pdf03062024_First India Newspaper Jaipur.pdf
03062024_First India Newspaper Jaipur.pdf
 
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdfSharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
Sharjeel-Imam-Judgement-CRLA-215-2024_29-05-2024.pdf
 
What Ukraine Has Lost During Russia’s Invasion
What Ukraine Has Lost During Russia’s InvasionWhat Ukraine Has Lost During Russia’s Invasion
What Ukraine Has Lost During Russia’s Invasion
 
Hogan Comes Home: an MIA WWII crewman is returned
Hogan Comes Home: an MIA WWII crewman is returnedHogan Comes Home: an MIA WWII crewman is returned
Hogan Comes Home: an MIA WWII crewman is returned
 
Hindustan Insider 2nd edition release now
Hindustan Insider 2nd edition release nowHindustan Insider 2nd edition release now
Hindustan Insider 2nd edition release now
 
Draft-1-Resolutions-Key-Interventions-.pdf
Draft-1-Resolutions-Key-Interventions-.pdfDraft-1-Resolutions-Key-Interventions-.pdf
Draft-1-Resolutions-Key-Interventions-.pdf
 
Letter-from-ECI-to-MeiTY-21st-march-2024.pdf
Letter-from-ECI-to-MeiTY-21st-march-2024.pdfLetter-from-ECI-to-MeiTY-21st-march-2024.pdf
Letter-from-ECI-to-MeiTY-21st-march-2024.pdf
 
31052024_First India Newspaper Jaipur.pdf
31052024_First India Newspaper Jaipur.pdf31052024_First India Newspaper Jaipur.pdf
31052024_First India Newspaper Jaipur.pdf
 

Raimund genes from traditional malware to targeted attacks

  • 1. From Traditional Malware to Targeted Attacks Raimund Genes Chief Technology Officer Trend Micro
  • 2.
  • 4. CRIMEWARE DamagecausedbyCybercrime 2001 2003 2004 2005 2007 2010 Vulnerabilities W orm Outbreaks Spam Mass Mailers Spyware Intelligent Botnets Web Threats Evolution to Cybercrime 2011+ Targeted Attacks Mobile Attacks
  • 5. Trustwave 2013 Global Security Report: Average time from initial breach to detection was 210 days, more than 35 days longer than in 2011.
  • 6. Malware / Bot / APT Behavior Comparison Table APT Bot Malware Distribution With organized planning Mass distribution over regions Mass distribution over regions Services interruption No No Yes Attack Pattern Targeted (only a few groups/organizations) Not targeted (large area spread- out) Not targeted (large area spread- out) Target Audience Particular Organization/Company Individual credentials including online banking account information Random Frequency of attacks Many times Once Once Weapon -Zero-day exploit -Drop embedded RAT -Dropper or Backdoor Multiple-Exploits,All in one By Malware design Detection Rate Lower than 10% within one month Around 86% within one month Around 99% within one month
  • 7. Some Documented Advanced Persistent Threat Campaigns (Real-world Examples) • LURID – threat actors launched around 300 campaigns targeting different industries in different countries • Luckycat – threat actors used diverse infrastructure (from throwaway free hosting to dedicated VPSs) • Taidoor – threat actors primarily targeted government organizations located in Taiwan • IXESHE – threat actors used compromised computers inside the network to evade network detection
  • 9. The attacker knows what he’s looking for!
  • 10. South Korea – Hacktivism, Cyber Sabotage, or Cyberterrorism?
  • 13. • In a small city in US with 8000 citizens • It has to look like a real system • And by “accident” the system has a link to the Internet Let’s simulate a Water Pressure Control station
  • 14. Building a SCADA Honeypot…
  • 15.
  • 16. Attacks from US, 9 LAOS, 6 UK, 4 CHINA, 17 NETHERLANDS, 1 JAPAN, 1 BRAZIL, 2 POLAND, 1 VIETNAM, 1 RUSSIA, 3 PALESTINE, 1 CHILE, 1 CROATIA, 1 NORTH KOREA, 1
  • 17.
  • 18. What to expect next?
  • 19.
  • 20. Your phone as your wallet
  • 22. Vehicle past and now TOYOTA'S Vehicle(1955) TOYOTA'S Hybrid Vehicle(2011) None of computers included over 70 of computers included
  • 23. Tire Pressure Monitoring System UNAUTHORIZED APPS, Multimedia File Smartphone, USB Immobilizer Cutter DOOR LOCKS Smart Key CHAdeMO : Quick charging method for battery powered electric vehicles KEY FOB TELEMATICS SYSTEM OBDII , CAN, ECU Vehicle Area Network
  • 24.
  • 26. Embedded OS selected by car industry SELECTED IVI Standard Organization
  • 27. Security Assessment Kernel > 2.6.35.3 Gain Privilege > 18
  • 28. • All the ECU turned into Fail-Safe-Mode. • Engine fan and headlamp kept working. • Meter(e.g. speed) needle keeps wobbling Overflow attack to CAN bus
  • 29.
  • 30. If someone wants to get in, he get’s in!
  • 31.
  • 32. So do we do a lot of stuff just to satisfy the auditors?
  • 33.
  • 34.