Targeted Attacks: The New Age of Cybercrime

Click to edit Master title style

• Click to edit Master text styles
– Second level
• Third level
– Fourth levelAutomated Targeted Attacks:
The New Age of Cybercrime
» Fifth level

Stefan Tanase
Senior Security Researcher
Global Research and Analysis Team
Kaspersky Lab

IDC IT Security Roadshow 2010 – Bucharest, Romania
March 9 th, 2010
June 10th , 2009 Event details (title, place)

Overview

•
•
About Kaspersky text styles
Click to edit Master
Lab
• The evolution of malware
– Second level
• • Third level
Motivation: how cybercriminals make money
– Fourth level
• Targeted» attacks: threats to SMBs & enterprises
Fifth level

• So, how do they do it?
• Social experiment
• Targeted attacks becoming mainstream
• Mitigation techniques

June 10th , Roadshow 2010 – Bucharest, Romania
IDC IT Security2009 Event details (title, place)

About Kaspersky Lab

• •Foundedto edit Master text styles
Click in 1996
• Largest privately owned
– Second level
IT security company
• Third level
• 2000+ employees,level hiring 
– Fourth still
• 26 local offices Fifth level
»

• United States, Russia, United Kingdom, Germany,
France, Romania, Dubai, South Africa, Japan, China etc.
• Global Research and Analysis Team
• Researchers working around the clock and around the world
• Protecting more than 250 million users
• 40,000 new malicious programs and 3,500 new signatures daily



– Second level
• Third level
– Fourth level
» Fifth level

The (R)evolution of malware

Clickevolution of malware
The to edit Master title style

• 1992 – 2007: about 2M unique malware programs
• But in 2008 alone: 15M
– Second level
• End of 2009 leveltotal of about 33,9 M unique malicious
• Third
–a
files in the Kaspersky Lab collection
– Fourth level
» Fifth level



– Second level
• Third level
– Fourth level
» Fifth level

Motivation: how cybercriminals make money

Click to edit how cybercriminals make money
Motivation: Master title style

• By stealing, of course
– Stealing directly from the user
– Second level
• Online banking accounts, credit card
• Third level
numbers, electronic money, blackmailing.
– Fourth level
– What if I don’tlevel money?
» Fifth
have
– Providing IT resources to other
cybercriminals
• Creating botnets, sending spam, launching
DDoS attacks, pay-per-click fraud, affiliate
networks, renting computing power,
collecting passwords etc.



– Second level
• Third level
– Fourth level
» Fifth level

Targeted attacks: threats to SMBs & enterprises

Targeted attacks: threats to SMBs & enterprises

– Second level
• Third level
– Fourth level
» Fifth level


Click to edit Master title stylemalware
Targeted attacks vs. classic

Lethal injection vs. a round of bullets
• Click to• edit Master text styles epidemics
Targeted attacks are not
– Second • One email is enough, instead of tens of thousands
level
• Third level
• Targeted organizations are either not aware,
– Fourth level
or don’t publicly disclose information
» Fifth level

• It is hard to get samples for analysis
• Classic signature-based AV is useless
• New defense technologies
• Much higher stakes
• Intellectual property theft,
corporate espionage



– Second level
• Third level
– Fourth level
» Fifth level

So, how do they do it?

Click to edit Master 4 steps
Targeted attacks in title style

1. Profiling the employees
– Choosing most vulnerable targets
– Second level
2. Developing a new and
• Third level
unique – Fourth level program
malicious
» Fifth level

– Doesn’t have to bypass all AVs,
just the one used by the victim
3. Mixing the malicious payload with a perfectly
tailored social engineering strategy
4. Delivering the attack


A targeted attack demo

– Second level
• Third level
– Fourth level
» Fifth level



– Second level
• Third level
– Fourth level
» Fifth level

Social experiment

Click – let’s stand up! style
Intro to edit Master title

• “White”, “black”, “pink”… “not wearing any” 
– Second level
• Third level
– Fourth level
» Fifth level



– Second level
• Third level
– Fourth level
» Fifth level

Targeted attacks becoming mainstream

Click to edit Master title style public
Personal information becoming

• So much personal
information becomes
– Second level
public Third level
• on social
networksFourth level
– right now
» Fifth level

• Advertisers are
already doing it:
targeted ads
– Age, gender, location,
interests, work field,
browsing habits,
relationships etc.

Targeted attacks becoming mainstream

• Targeted ads? Targeted
attacks arelevel
– Second
already out there
• SocialThird level are enabling
• networks
– Fourth level
cybercriminalslevel start delivering
» Fifth
to
automated targeted attacks
• The personal data is there. Next step? Automation.
• Geographical IP location has been around for a while
• Automatic language translation services are becoming better
• Personal interests & tastes are public (ie: trending topics)


Click targeting example style
Geo to edit Master title

– Second level
• Third level
– Fourth level
» Fifth level


Language targeting example

– Second level
• Third level
– Fourth level
» Fifth level


Click to edit Masterexample
Interests targeting title style

– Second level
• Third level
– Fourth level
» Fifth level


Click to edit Masterattacks
Surviving targeted title style

• • Click to edit Master text styles
Security tips
• Patch
– Second level
• Third level
• Patch everything
– Fourth level
• Patch everything level
» Fifth twice

• …including the human mind
• A highly sophisticated targeted attack will eventually succeed
• Proactive measures (PDM, HIPS, Sandbox, heuristics, emulation)
• Proper security mindset
• User education and awareness


Targeted attacks become mainstream

– Second level
• Third level
– Fourth level
» Fifth level



– Second level
• Third level
– Fourth level
Thank you! Questions?
» Fifth level

stefant@kaspersky.ro
twitter.com/stefant
Stefan Tanase
Senior Security Researcher
Global Research and Analysis Team
Kaspersky Lab

IDC IT Security Roadshow 2010 – Bucharest, Romania
March 9th, 2010

Targeted Attacks: The New Age of Cybercrime

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (11)

Similar to Targeted Attacks: The New Age of Cybercrime

Similar to Targeted Attacks: The New Age of Cybercrime (11)

Recently uploaded

Recently uploaded (20)

Targeted Attacks: The New Age of Cybercrime