The threat Landscape From cybercrime to cyber-war

1. David Emm • Global Research and Analysis Team The threat LandscapeFrom cybercrime to cyber-war

2. CONTENTS What kind of malware? Who’s writing it and why? What do we do about it? 3 2 1

3. The scale of the threat 1994 2006 2011 2013 1 new virus every hour 1 new virus every minute 1 new virus every second 315,000 new samplesEVERY DAY

4. The growing malware threat

5. How mALWAre spreads • People • Technology • … and how people use it

6. Vulnerabilities and Exploits

7. Vulnerabilities and exploits

8. ‘Drive-by downloads’

9. Social networks

10. E-mail

11. Removable media

12. Digital certificates

13. Sophisticated threats • Code obfuscation • Rootkits • Hide changes made by malware • Installed files • Running processes • Registry changes • Advanced technologies • £k1_ s”+gr!pl;7&

14. New tactics • All kinds of information • Not just bank data • Steal everything! Targeted attacks • Sophisticated • Carefully selected targets • Well-defined aims

15. The nature of the threat Cyber-weapons 0.1% Targeted threats to organisations 9.9% Traditional cybercrime 90%

16. Political, social or economic protest

17. Theft of sensitive data “There’s no such thing as ‘secure’ any more. The most sophisticated adversaries are going to go unnoticed on our networks. We have to build our systems on the assumption that adversaries will get in. We have to, again, assume that all the components of our system are not safe, and make sure we’re adjusting accordingly.” Debora Plunkett, NSA Director Quoted in “NSA Switches to Assuming Security Has Always Been Compromised”

18. Cyber-weapons “… cyber weapons are: a) effective; b) much cheaper than traditional weapons; c) difficult to detect; d) difficult to attribute to a particular attacker …; e) difficult to protect against …; f) can be replicated at no extra cost. What’s more, the seemingly harmless nature of these weapons means their owners have few qualms about unleashing them, with little thought for the consequences. Eugene Kaspersky June 2012 http://eugene.kaspersky.com/2012/06/14/the-flame-that-changed-the-world/

19. Cyber-weapons: Number of victims 300K 100K 10K OVER 300K 1K 50 OVER 100K 20 10K 5-6K Stuxnet Gauss Flame Duqu miniFlame 2,500 700 50-60 50-60 Source: Kaspersky Lab 20 10-20 Known number of incidents Additional number of incidents (approximate)

20. Targeted attacks • Google • RSA • Lockheed Martin • Sony • Comodo • DigiNotar • Some of the victims: • Saudi Aramco • LinkedIn • Adobe • Syrian Ministry of Foreign Affairs • The New York Times • Tibetan activitists

22. Mobile malware 10,000,509 unique installation packs

23. Why target MOBILE devices? Mobile devices contain lots of interesting data: SMS messages GPS co-ordinates Banking credentials Business e-mail Business contacts Calendar The evolving threat landscape Personal photos Installed apps

24. PLATFORMS

25. What sort of malware?

26. The geography of Mobile malware

27. Mobile devices and targeted attacks

28. What do we do about it?

29. What do we do about it?

30. What do we do about it?

31. questions David Emm Global Research and Analysis Team