No Silver Bullet How Malware Defeats Security Measures and What You Can Do About it

1. No Silver BulletHow Malware Defeats Security Measures and What You Can Do About it Ziv Cohen – Director, EMEA April 2012

2. Malware Attacks Are on the Rise • Malware incidents increased more than 30% between 2008 and 2011,causing significant damage • 54millionU.S. adults said they had incidents of malware on their desktops in 2011 Research - Use a Layered Security Approach to Combat Phishing and Malware-Based Attacks Published: 26 March 2012

3. Online Banking Fraud is Happening Online Banking Fraud Losses Estimated at 1B$ in US and Europe

4. New Online Banking Services Adoption Hindered by Security Concerns What are the main reasons you have decided not to use mobile banking? Federal Survey - Consumers and Mobile Financial Services March 2012

5. The Cost of Advanced Malware Attack 40% of CIOs report malware related internal breaches 2010 Deloitte-NASCIO Cyber Security Study 49% of data breaches incorporated malware Verizon 2010 Data Breach Report 760 companies attacked with the same resources as RSA Almost 20% of the Fortune 100 are on this list. Krebsonsecuirty.com, “Who else was hit by RSA Attackers”?”

6. The end point is the weak link • Perimeter Security  • Firewall • End Point Security  • Intrusion Prevention System • Anti-Virus Gateway • Encryption • Anti Virus End Point User Sensitive Data and Apps Difficult Easy Easy Cyber Criminals

7. Anatomy of Malware attack Execute Fraud / Information Theft User Target Malware Infection Attack Launch • Phishing, Drive-by-Download • Credentials theft, Web injection, Social engineering • Human and Automated • System exploit, Malicious Code install

8. Attack Setup, Execute Fraud:Man-in-the-Browser, Web Injection Login: Password: **** PII Theft Credentials Theft Social Engineering

9. Keeping Banks In the Dark - Change Phone User Access site 1 MalwareUpdate user’s phone number MalwareInform user that the bank has issued a FREE SIM CARD for security reasons, user enters code to accept offer` 4 2 1800TrueNum 1800ToFraud BankSends a confirmation SMS to previous phone, with code and new phone number Fraudster “Enters conformation code and redirects all future bank SMS/Calls to 1800ToFraud 3 5 Confirmation Code: 1234 For number 1800ToFraud

10. Confirmation Emails - Hidden 1 2 3 Malware Transfer Money Bank Sends Confirmation Email Malware Hide Confirmation Email Zeus code for hiding emails if( document.getElementById("datatable").rows[i].innerHTML.indexOf( "Faster Payment Confirmation" ) != -1 || document.getElementById("datatable").rows[i].innerHTML.indexOf( "Payment Created" ) ) { //Faster Payment Confirmation | Payment Created document.getElementById("datatable").rows[i].style.display = "none"; }

11. Keeping Banks In the Dark - DDoS FBI warning about Banking Trojan “GAMEOVER” “After the accounts are compromised, the perpetrators conduct a Distributed Denial of Service (DDoS) attack on the financial institution”

12. Facebook/Ukash – Cross Channel Attack To confirm verification you have to enter 20 euro UKash voucher. Ukash vouchers are sold by UKash.com website and Ukash.com is not affiliated with Facebook company. 20 euro will be added to your Facebook main account balance. This verification is used to confirm your age and country of origin. The UKash Voucher consists of 19 numbers and face value (sum), begins on “633”. For example 6337757575757

13. MITMO/ZITMO 8 Transaction approved using stolen SMS Malware Command & Control 1 4 User Accesses Site Download Malware 5 7 Malware forwards approval SMS 2 “Please provide your mobile phone number” 5 Malware transfers funds (PC is proxy) 3 SMS with link to Mobile malware (“install new certificate”) Legitimate Website 6 Transaction Approval SMS

14. FFIEC Recognizes Malware as the Root Causeof Most Cybercrime Activities “Controls implemented in conformance with the Guidance several years ago have become less effective..” “Malware can compromise some of the most robust online authentication techniques”

15. The Challenge: No Silver Bullet Device Identification Challenge Questions Malware OTP Devices Man in the Browser,Real Time Phishing TransactionVerification Man in the Mobile TransactionSigning x Social Engineering Malware Bypassed Virtual Browser on Stick Memory Injection Malware Clickstream Detection Malware adopts Human-like behavior

16. Intelligent, Adaptive, Automated Sustainable CybercrimePrevention Threat Intelligence Adaptive Protection 16

17. Crime Logic vs. Files and Signatures Threat Intelligence Adaptive Protection Trusteer: What it does? Crime Logic (100s) Legacy: What it is? Files and Signatures (1000000s) Anti-Virus ? ?

18. First to Discover New Forms of Malware Threat Intelligence Adaptive Protection Tens of Millions of Endpoints Endpoints Detect and stop Crime Logic OddJob SpitMo for Android Ramnit goes financial Torpig v2 Shylock Sunspot

19. Ready, Before the Threat Reaches You Threat Intelligence Adaptive Protection Tens of Millions of Endpoints Endpoints Detect and stop Crime Logic OddJob SpitMo for Android Ramint goes financial Torpig v2 Shylock Sunspot

20. Process, People, Products Threat Intelligence Adaptive Protection Cybercrime Intelligence Fraud Alert Crime Logic Corp Trusteer Intelligence Center Analytics & Management Crime Logic RiskAssessment   Knowncrime logic Adaptive Protection Unknowncrime logic Online Threats

21. Trusteer Cybercrime Prevention Architecture:Industry leading solution for Online Cybercrime Activities Detect malware-infected users, devices Detect and Stop real-time phishing • Intelligence-based risk assessment • Multi-layer protection against malware • No malware = Transaction anomaly prevention Trusteer Pinpoint for Malware Detection Trusteer Pinpoint for Phishing Detection Layer 1: Endpoint-Threat Protection Layer 2: Fraudulent Activity Detection Stop and remove financial malware, phishing Protect against mobile malware, high risk devices Trusteer Rapport for PC/Mac Trusteer Rapport for Mobile Less Cost, Less Complexity

22. Thank You