1 / 19

The changing threat landscape: 2010 and beyond

The changing threat landscape: 2010 and beyond. Chester Wisniewski – Sophos Eamonn Medlar - WPP Moderator: Eric Green, Program Director, SC World Congress. Threat landscape splitting in two. Opportunistic. Targeted. 2. What is an opportunistic attack?. Affiliate marketing Conficker

michael-warren
Download Presentation

The changing threat landscape: 2010 and beyond

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The changing threat landscape: 2010 and beyond • Chester Wisniewski – Sophos • Eamonn Medlar - WPP • Moderator: Eric Green, Program Director, SC World Congress

  2. Threat landscape splitting in two Opportunistic Targeted 2

  3. What is an opportunistic attack? • Affiliate marketing • Conficker • Fake-AV • Spam • Phishing • Social media • SEO poisoning

  4. Fake anti-virus: Latest tricks

  5. ДОРВЕЙ (Doorway) “A web page that is designed to attract traffic from a search engine and then redirect it to another site or page.”

  6. Black hat SEO

  7. Social network malware

  8. Koobface - Multilingual

  9. Koobface – What can it do? • Steal software keys • Upload stored passwords • Web server • Search hijacking • Captcha busting • PPC fraud • Fake AV • Soc Net Spambot Screenshot courtesy of abuse.ch

  10. Targeted attacks have diverged • Unknown exploit(s) • Unknown malware • Nearly silent • Used for espionage/cyberwarfare MS Advisory for “Aurora” exploit How do we react to this new branch of attack?

  11. MS10-046 Shortcut exploit • 15 year old bug • Stuxnet, Chymin, etc • Multiple rootkits

  12. Silent, but deadly • Signatures • Tiny • P2P Comms • Exploits (RCE and EoP) • Small (without packers)

  13. The new blended threat – Step 1

  14. The new blended threat – Step 2

  15. Zeus takes the 3rd step • Law enforcement crackdown • Widely decentralized Image courtesy of krebsonsecurity,com

  16. Challenges to the protector • “It’s mine” • Portability • Regulation • Chain of trust • Legacy increases attacksurface Creative Commons image courtesy of thetechbuzz's Flickr photostream.

  17. Evolving with the threat • AV good for basic threat • Behavior is key • Collective intelligence • Event correlation • Defense in depth • Data protection is key

  18. Q&A Discussion with Eamonn Medlar, WPP

  19. Summary Proven: 25+ years of experience Integrated threat detection SophosLabs 24/7/365 Anti-Malware Email Protection Web Filtering Encryption Device/App Control NAC Email: chesterw@sophos.com Twitter: @chetwisniewski Blog: http://nakedsecurity.sophos.com Contact: 19

More Related