2014 Hack, Exploit and Malware Retrospective ... - RSA Conference

Recommend Documents

2014 Hack, Exploit and Malware Retrospective ... - RSA Conference [PDF]

Page 10. #RSAC. âJames, I'm coming in to town. Please check my itinerary and let me know if you have time for a beer? Jasonâ. 10 ... Android Versions. 35.

rsa smartwatch march 2014 sweepstakes official ... - RSA Conference

02/26 and 02/27, will each receive a Pebble smartwatch with an estimated retail value in US Dollars or “ARV” of $150; aggregate retail value of all prizes is ARV ...

The 2014 Securosis RSA Conference Guide

Securosis, L.L.C. 515 E. Carefree Highway, Suite 766 Phoenix, AZ 85085 T 602-412-3051 .... provides advanced analysis ca

The 2014 Securosis RSA Conference Guide

vendors continue to roll their stuff into VMs and AMIs that can run in public and private clouds. So they are ready to s

Hacking Exposed - RSA Conference

We define malware as âmalicious softwareâ or anything that can run on an endpoint and do bad things. This includes .

Malware and exploit campaign detection system and method

Mar 12, 2015 - vices (BDS) employ virtual âsandboxesâ or âhoney netsâ that operate in a cloud (virtual) ..... sions of OS X, iOS, and Android. One key feature for ...

2014 RSA Conference - the Rhetoric Society of America

technology training, and administrative fellowships in writing program ..... Rearranging Atlanta's B/orders: .... Femini

2014 RSA Conference - the Rhetoric Society of America [PDF]

May 22, 2014 - technology training, and administrative fellowships in ..... Complete College America's Vision of Public ...... Lisa Suter, University of Tampa.

Reversing and Malware Analysis Training Articles [2012] - Exploit-DB

Nov 24, 2012 - DLL INJECTION USING CREATEREMOTETHREAD . ..... Pydbg [Reference 3] is also a pure python based debugger.

Human Hacking Exposed - RSA Conference

Session ID: Session Classification: Christopher Hadnagy. Social-Engineer.Com. Human Hacking Exposed. 6 Preventative Tips. That Can. Save Your Company.

Cyber Security & Aviation - RSA Conference

Cyber Security & Aviation. MASH-F01. Managing ... General Counsel & Managing Director Information. Security. TAL

Application Security Response - RSA Conference

Taking it all In â And Applying It to Scale ... resolve ALL potential vulnerabilities, whether reported from ..... ISO

Optimizing Windows Security Features to Block Malware and Hack ...

and other malicious codes together with USB based hack tools such as Pod Slurp ... focus on the latest Windows operating systems including Windows XP SP2,.

DISSECTING BANKING TROJAN CARBERP - RSA Conference

Ammy.plug: Backdoor component based on Ammyy remote desktop admin ... MAKECAB.EXE. ▻ The cabinet ammyy.plug contains the original Ammyy.

Side Channel Attacks III - RSA Conference

Template Base with 1.000.000 measurements, recorded during 3-4 days ... Independence additional mathematical difficulties (details: paper) ... Dim Interactions.

Hacking Exposed: Day of Destruction - RSA Conference

We modified an existing Apple firmware update for their chip and corrupted it. 26 ... of expensive doorstops in your ent

Hacking Exposed: Day of Destruction - RSA Conference

Co-author of Windows Internals ... Active December 2011-April 2012 ... 50,000 monitor screens are blinking 'System disk

Measuring Change in Human Behavior - RSA Conference

Metrics that measure the deployment of your awareness program. - Are you ... Never embarrass people, no Viagra phishing

Weaponizing Intelligence: Interdiction in Today's ... - RSA Conference

ClamAV Signatures. â¢ IP and domain blacklisting. â¢ Arbitrary IOC tracking and blacklisting. â¢ Ensure you have the

Memory Forensics & Security Analytics: Detecting ... - RSA Conference

Associate Director â Security Research and Analytics. UBS AG. SESSION ID: .... Can be resource intensive, consumes CPU

Science Fiction is Here! - RSA Conference

We have absolutely no permission for citations or quotations, etc. .... The Three Stigmata of Palmer Eldritch (1964), Have Space-Suit - Will Travel (1958), Flatland .

Dissecting Banking Trojan Carberp - RSA Conference

... listening at port 5900. â»RFB (remote framebuffer) protocol signature: ... Interfaces (RBI) in Java: â» E.g. iBank

Securing Today's Online Kids - RSA Conference

when they are 16. Overwhelmed by data / automated reporting. For mobile devices, if you want to monitor your kids Androi

Large Scale Cloud Forensics - RSA Conference

Session ID: Session Classification: Edward L. Haletky. AstroArch Consulting, Inc. Sam Curry. RSA, The Security Division of EMC. Large Scale Cloud Forensics.

2014 Hack, Exploit and Malware Retrospective ... - RSA Conference

Download PDF

0 downloads 141 Views 3MB Size Report

Comment

#RSAC. Factoring In Brokenâ¦ 30. Page 31. #RSAC. So why bother trying hard? It's 2015 people must be smarterâ¦ 31. Pag

SESSION ID: HT-T07R

The Big Hacks, Exploits & Malware of 2014 And What Is To Come… James Lyne Global Head of Security Research Sophos / SANS Institute @jameslyne #RSAC

#RSAC

2

#RSAC

3

#RSAC

Computer virus could bring entire rail network down in seconds. 4

#RSAC

350k /day 5

#RSAC

Millions /day 6

#RSAC

So what changed? 

Interesting shift in deployment tactics



The Old Days: 





E-mail with malware directly attached (.exe/.zip)

The Last Few Years: 

Opportunistic infection via legitimate, but infected websites



Links to exploit pack pages

The Last Few Months? 

… I’ll come to that in a moment 7

#RSAC

Breakdown of Exploit Packs

8

#RSAC

Changes 

Mass use of document based malware 

Macros!



Just open this .exe – seriously, it is legit!



Shift from the basic or trick to PHP insertion (e.g.)



Higher quality simple scams

9

#RSAC

“James, I’m coming in to town. Please check my itinerary and let me know if you have time for a beer? Jason” 10

#RSAC

Would you click this?

11

#RSAC

Or this?

12

#RSAC

Or this?

13

#RSAC

My personal favourite…

14

#RSAC

Exploit Breakdown

15

#RSAC

CyCoomer

16

#RSAC

17

#RSAC

ROP Chains Ahoy!

18

#RSAC

Not As Perfect As It Seems

19

#RSAC

Oops : Inception

20

#RSAC

Decoy Documents

21

#RSAC

Or A Car Advert

22

#RSAC

GoldSun (Pitty Tiger Group)

23

#RSAC

GoldSun Decoy

24

#RSAC

The Family Tree

25

#RSAC

Single Exploit Files

26

#RSAC

Compound Exploit Files

27

#RSAC

The AFRQ Rankings

28

#RSAC

Family Grouping

29

#RSAC

Factoring In Broken…

30

#RSAC

So why bother trying hard? It’s 2015 people must be smarter… 31

#RSAC

Wi-Phishing

32

#RSAC

The UI? 3 Different Models

33

#RSAC

Browsers Connected

Google Chrome Internet Explorer Safari Firefox Other

34

#RSAC

Android Versions 2.40% 1.20% 6.30%

5 18%

4.4 41%

4.3 4.2 4 2.3

23%

35

#RSAC

Average click time?

1.3 seconds 36

#RSAC

Average click time?

2k people 37

#RSAC

Average click time?