1. From viruses to theft Joakim von Braun Security Consultant von Braun Security Consultants Uppsala universitet 2006-10-03

2. Joakim von Braun Born 1955 B.A. In Political Sciences Professionell work in security for 35 years Advisor and consultant to SÄPO for 25 years Work for Military Intelligence Timbro 1979 - 1988 Private business during 13 years Security advisor Symantec 2001 - 2005 Consultant and advisor Professional speaker Journalist and writer

3. Crime on the Internet

4. Todays changing threats  variables  Threat posture 2006-2007  Botnets – spam and blackmail  Phishing  Crimeware

6. Knowledge?

7. Vulnerabilities easy to use

8. Threat posture 2006  From 450 to 10.800 new threats in three years  The difference between worm and trojan is gone  Huge increase of botnets (Zombie networks)  Botnets with more than 100.000 computers  1.000 new botnet worms every month  4.000 new vulnerabilties  6 days to patch an exploit  Hackers and coders are working for money!!!

9. Botnets can be rented

10. Money is everything  Botnets can be rented for 6, 24 hours or a week  Botnets are used to propagate Spam  Botnets are used for DoS attacks + blackmail  More than 20.000 Phishing attacks per month  Crimeware has increased from 20 to 6.500 in 3,5 years  A new unknown trojan can be bought for 1.000 kronor

11. 75 new worms per day!!!

12. More botnets

13. Blackmail more common

14. Phishing  HTML formatted e-mail sent to bank customers  An URL points to the bank homepage  The homepage is a copy of the original  Homepages are hidden on hacked computers  Customers reveal important economic data  USA, UK and Australia the first targets  350 % increase during 2004  Swedes customers in US companies targeted  Eurocard in Sverige first 22/11 2004  At least 7 Swedish attacks during 2005

15. November 2003

16. November 2005

17. Obfuscated Web adresses

18. Vulnerability in Internet Explorer Visible link: https://cgi1.ebay.com/aw-cgi/ebayISAPI.dll? Called link : http://cgi1.ebay.com.awcgiebayISAPI.dll%00@210. 93.131.250/my/index.htm Website: http://210.93.131.250/my/index.htm

19. AOL Billing Center

21. Hacked once again

22. Infected computers used – port 4444

23. Dramatic increase of maliciouse code

24. Worms and trojans steals information

25. Crimeware targets bank and CC customers  Increase from 20 to 6.500 trojans in 3,5 years  Brasil, Australia, USA and UK mostly targeted  Germany and Scandinavia is next  Remote Access and Keylogging  Kills AV and personal firewalls  Logs everythin in certain open windows  Sniffs encrypted HTTPS traffic

26. Trojan Stawin

27. Trojan Bizex

28. Questions Joakim von Braun von Braun Security Consultants joakim.von_braun@bredband.net 0709-56 16 42 (cell) 08-649 19 69 (home) 08-659 54 78 (fax)