ZeuS: God of All Cyber-Theft

Slides:

Advertisements

Similar presentations

Intrusion Prevention anno 2012: Widening the IPS concept.

Advertisements

HQ in Israel Threat research, security operations center 24/7. In-depth understanding and insight into how cyber crime works. Over 10 million online identities.

The Threat Landscape Jan Threat Report 2.

Supplied on \web site. on January 10 th, 2008 Customer Security Management Reducing Internet fraud June 1 st, 2008 eSAC Walk Thru © Copyright Prevx Limited.

7 Effective Habits when using the Internet Philip O’Kane 1.

Security for Today’s Threat Landscape Kat Pelak 1.

Social media threats. Warning! May contain mild peril.

Facebook Security and Privacy Issues Brian Allen Network Security Analyst Washington University December 2, 2010 Alumni House.

Security for Internet Every Day Use Standard Security Practices and New Threats.

Online Banking Fraud Prevention Recommendations and Best Practices This document provides you with fraud prevention best practices that every employee.

 Malicious or unsolicited mail sent to a mailbox without the option to unsubscribe  Often used as a catch-all of any undesired or questionable mail.

From AV to Internetized Security Solution 马杰 Jeffrey Beijing Rising Tech. Co., Ltd. --- The Analysis Report of Malware Technology in China in 2005.

8.1 © 2007 by Prentice Hall 8 Chapter Securing Information Systems.

Copyright 2011 Trend Micro Inc. Trend Micro Web Security- Overview.

What Are Malicious Attacks? Malicious Attacks are any intentional attempts that can compromise the state of your computer. Including but not limited to:

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.

Norman SecureTide Powerful cloud solution to stop spam and threats before it reaches your network.

Security Liaisons Information Presentation. Introduction  What’s the big deal with computer security? Don’t we have an IT security department to take.

Norman SecureSurf Protect your users when surfing the Internet.

Threats and ways you can protect your computer. There are a number of security risks that computer users face, some include; Trojans Conficker worms Key.

Lecture 11 Electronic Business (MGT-485). Recap – Lecture 10 Transaction costs Network Externalities Switching costs Critical mass of customers Pricing.

SHASHANK MASHETTY security. Introduction Electronic mail most commonly referred to as or e- mail. Electronic mail is one of the most commonly.

First Community Bank Prevx Safe Online Rollout & Best Practice Presentation.

11 The Ghost In The Browser Analysis of Web-based Malware Reporter: 林佳宜 Advisor: Chun-Ying Huang /3/29.

Lecture # 34 Privacy and Security. Passwords Spam Scams Viruses and Worms (Malware) Intellectual Property and Copyright Cookies Encryption Back-Ups.

Information Security 2013 Roadshow. Roadshow Outline  Why We Care About Information Security  Safe Computing Recognize a Secure Web Site (HTTPS) How.

The State of Social Networks in Vietnam Joe Nguyen Vice President, SEA & India | comScore, Inc. ( NASDAQ:SCOR) hp |

資安新聞簡報報告者：劉旭哲、曾家雄. Spam down, but malware up 報告者：劉旭哲.

Cyber crime on the rise. Recent cyber attacks How it happens? Distributed denial of service Whaling Rootkits Keyloggers Trojan horses Botnets Worms Viruses.

B OTNETS T HREATS A ND B OTNETS DETECTION Mona Aldakheel

UNDERSTANDING THE RISKS & CHALLENGES OF Cyber Security DAVID NIMMO InDepth IT Solutions DAVID HIGGINS WatchGuard NEIL PARKER BridgePoint Group A BridgePoint.

APT29 HAMMERTOSS Jayakrishnan M.

Malware  Viruses  Virus  Worms  Trojan Horses  Spyware –Keystroke Loggers  Adware.

Security Awareness ITS SECURITY TRAINING. Why am I here ? Isn’t security an IT problem ?  Technology can address only a small fraction of security risks.

1 All Your iFRAMEs Point to Us Mike Burry. 2 Drive-by downloads Malicious code (typically Javascript) Downloaded without user interaction (automatic),

Jonell Baltazar, A Trend Micro Research Paper (Retrieved May 2010).

Adam Soph, Alexandra Smith, Landon Peterson. Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details.

Malicious Attack Corporate Awareness and Walk through Date 29 September 2011.

WEBSENSE ® SECURITY LABS™ 2006 Semi-Annual Web Security Trends Report OWASP Presentation November 9, 2006 Jim Young (301)

 Two types of malware propagating through social networks, Cross Site Scripting (XSS) and Koobface worm.  How these two types of malware are propagated.

Symantec Targeted Attack Protection 1 Stopping Tomorrow’s Targeted Attacks Today iPuzzlebiz

10/14/2015 Introducing Worry-Free SecureSite. Copyright Trend Micro Inc. Agenda Problem –SQL injection –XSS Solution Market opportunity Target.

Types of Electronic Infection

Week 10-11c Attacks and Malware III. Remote Control Facility distinguishes a bot from a worm distinguishes a bot from a worm worm propagates itself and.

By: Gloria Watkins.  Use antivirus software and keep it up-to-date. You should check for new definition updates daily. Most antivirus software can.

Copyright ©2005 CNET Networks, Inc. All rights reserved. Practice safety Learn how to protect yourself against common attacks.

What is Spam? d min.

Social Engineering © 2014 Project Lead The Way, Inc.Computer Science and Software Engineering.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. State of Network Security.

LESSON 5-2 Protecting Your Computer Lesson Contents Protecting Your Computer Best Practices for Securing Online and Network Transactions Measures for Securing.

Speaker: Hom-Jay Hom Date:2009/10/20 Botnet Research Survey Zhaosheng Zhu. et al July 28-August

1 Law, Ethical Impacts, and Internet Security. 2 Legal Issues vs. Ethical Issues Ethics — the branch of philosophy that deals with what is considered.

Safe Computing Practices. What is behind a cyber attack? 1.

Zeus Virus By: Chris Foley. Overview  What is Zeus  What Zeus Did  The FBI investigation  The virus for phones  Removal and detection  Conclusion.

On the Analysis of the Zeus Botnet Crimeware Toolkit H. Binsalleeh, T. Ormerod, A. Boukhtouta, P. Sinha, A. Youssef, M. Debbabi, and L. Wang Presented.

Outline of this module By the end of this module, you will be able to: Understand the benefits that internet banking provides; Name the different dangers.

Protecting Against Cyber Attacks PLEASE TAKE A MINUTE TO LOOK AT THIS IMPORTANT MESSAGE. THIS IS HAPPENING HERE AND NOW! LET US SAVE YOU AND YOUR INFORMATION.

Trend Micro Consumer 2010 Easy. Fast. Smart.

Done by… Hanoof Al-Khaldi Information Assurance

Learn how to protect yourself against common attacks

ISYM 540 Current Topics in Information System Management

I S P S loss Prevention.

Data Compromises: A Tax Practitioners “Nightmare”

Explaining Bitcoins will be the easy part: Borne Attacks and How You Can Defend Against Them Michael Bird Team Lead, Account Executive.

Cybersecurity Awareness

IT Security awareness Training.

4 ways to stay safe online 1. Avoid viruses and phishing scams

Risk of the Internet At Home

Cybersecurity Simplified: Phishing

Presentation transcript:

ZeuS: God of All Cyber-Theft Read malware battle card ZeuS: God of All Cyber-Theft Roland Dela Paz and Jasper Manuel Threat Researchers Classification 4/15/2017

Greek Mythology Read malware battle card Classification 4/15/2017 2

Virtual Landscape Read malware battle card Classification 4/15/2017 3

Commercial crimeware for stealing online banking credentials Fast Facts on ZeuS Commercial crimeware for stealing online banking credentials Authored by “Slavik”/“Monstr” Has been in the wild since late 2005

The ZeuS Infection Chain via spammed messages

The ZeuS Infection Chain via spammed messages via malicious websites

ZeuS and Spam

ZeuS and Spam

ZeuS and Spam

ZeuS: The How ZeuS is configured to target a list of bank-related websites or financial institutions from which they try to steal sensitive online banking information

ZeuS: The How

ZeuS: The How

ZeuS: The How

ZeuS: The How

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS – a Cyber-Theft God

ZeuS Toolkit Components ZeuS Builder Web Panel Configuration Files

ZeuS Toolkit Components Zeus Builder

ZeuS Toolkit Components Web Panel

ZeuS Toolkit Components Web Panel

Configuration Files ZeuS Toolkit Components Config.txt: Webinjects.txt:

Configuration Files ZeuS Toolkit Components Config.txt: Webinjects.txt:

Configuration Files ZeuS Toolkit Components Config.txt: Webinjects.txt:

Configuration Files ZeuS Toolkit Components Config.txt: Webinjects.txt:

Gathering Intelligence Downloaded configuration file

Gathering Intelligence Downloaded configuration file

Where is the decryption key??? Gathering Intelligence Breaking the encryption Where is the decryption key???

ZeuS 1.x encryption algorithm Gathering Intelligence Breaking the encryption ZeuS 1.x encryption algorithm

Gathering Intelligence Breaking the encryption Finding the key stream

Encryption key in config.txt Gathering Intelligence Breaking the encryption Encryption key in config.txt

RC4 function used by ZeuS Gathering Intelligence Breaking the encryption RC4 function used by ZeuS

ZeuS builder - key stream generation Gathering Intelligence Breaking the encryption ZeuS builder - key stream generation

ZeuS 2.x encryption algorithm Gathering Intelligence Breaking the encryption ZeuS 2.x encryption algorithm

Gathering Intelligence Breaking the encryption Finding the key stream

Gathering Intelligence Breaking the encryption Finding the key stream

Gathering Intelligence Breaking the encryption Finding the key stream

Encrypted HTTP traffic Gathering Intelligence Breaking the encryption Encrypted HTTP traffic

Decryption key in ZeuS CP Gathering Intelligence ZeuS POST data decryption Decryption key in ZeuS CP

Gathering Intelligence ZeuS POST data decryption

Gathering Intelligence ZeuS POST data decryption

What to do with gathered intelligence? Use to source and monitor ZeuS binaries for detection, malware development, and solution creation Use to source and monitor malicious ZeuS domains for blocking Share with law enforcement agencies to help in investigations, arrests, C&C take-downs, etc. Use to identify target (financial) firms and country

What makes financial firms attractive targets? Volume of customers Online security measures Availability of webinject scripts

What makes a country/region an attractive target? Internet population Online banking population Value of money Locality

Geographic Distribution data taken from Trend Micro Smart Protection Network

Is the Philippines safe from ZeuS?

Is the Philippines safe from ZeuS? Online Banking Category Visitation by Market January 2011 vs. January 2010 Total Audience, Age 15+ - Home & Work Locations* Source: comScore Media Metrix Total Unique Visitors (000) Country Jan-2010 Jan-2011 % Change Malaysia 2,360 2,746 16% Hong Kong 1,304 1,543 18% Vietnam 701 949 35% Singapore 779 889 14% Indonesia 435 749 72% Philippines 377 525 39% statistics taken from

Is the Philippines safe from ZeuS? Top 3 Online Banking Sites by Unique Visitors for Individual Markets January 2011 Total Audience, Age 15+ - Home & Work Locations* Source: comScore Media Metrix Country 1st Online Banking Destination 2nd Online Banking Destination 3rd Online Banking Destination Malaysia Maybank Group Cimbclicks.com.my Pbebank.com Hong Kong HSBC Bochk.com Standard Chartered Vietnam Vietcombank.com.vn Acb.com.vn Dongabank.com.vn Singapore DBS.com.sg United Overseas Bank Group Citigroup Indonesia Bankmandiri.co.id BNI.co.id Philippines Bpiexpressonline.com statistics taken from

TrendLabs encountered at least two ZeuS binaries that Is the Philippines safe from ZeuS? TrendLabs encountered at least two ZeuS binaries that target online banking sites in the Philippines

So what can I do?

Prevention is still key Keep machines up-to-date by regularly patching software and operating systems. Do not click on links or open attachments in email messages, instant messages, or messages that arrive via social media. Organizations should likewise cascade pertinent information to employees to prevent ZeuS from penetrating network security. Dear All, There has been increased concern on news of a massive system compromise that recently hit the headlines. The attack, which involves thousands of computers and organizations, was found to be result of work of a specific ZeuS botnet compromise dubbed as the Kneber botnet. As some of you know, the ZeuS botnet has been around for years and is best known for its crimeware tactics. It is primarily designed for data theft or to steal account information related to online banking transactions. Everyone is thus advised to exercise caution in opening email messages. Avoid downloading suspicious attachments and clicking on URLs, especially those from unknown senders. Since the ZeuS malware perpetrators are constantly finding new ways to attack users, it would be wise to maintain safe computing practices. Be wary of phishing pages that purport to be legitimate websites, as these are primarily designed to fool unwitting users into handing over their personal information. The absence of visible infection markers makes it challenging to detect a ZeuS compromise. As such, should you receive suspicious messages via email or instant messaging, please report them immediately. Your cooperation and vigilance would be extremely valuable in ensuring the continued security of our network.

data taken from Trend Micro Smart Protection Network What’s next for ZeuS? Slavik/Monstr halted ZeuS’ development in late 2010. What now? data taken from Trend Micro Smart Protection Network

What’s next for ZeuS? Source code was leaked Effect of the leak: Improved SpyEye, LICAT(Murofet), RAMNIT, Ice IX Bot, and a few others

Demo

CONCLUSION

Questions?

Thank you. Classification 4/15/2017

Backup slide Classification 4/15/2017

ZBOT related Spam Blocked (2010 Data) Most ZBOT related spam detections came from Brazil – 39% with India following in second place at 8% USA followed in 3rd place with 3.25% This is consistent with

ZBOT related URLs Blocked (2010 Data) Most ZBOT related URL detections came from the United States (54%) How the threat travels virtually across the globe (spam on one side of the world, URL on the other)

ZBOT Files Blocked (2010 Data) US clients had the highest no. of ZBOT file detections (61%)