Gli ultimi ritrovati in termini di attacchi alle aziende e furti di dati, come combatterli. Roma 18 Giugno 2014 Maurizio Martinozzi

Transcript

1 Gli ultimi ritrovati in termini di attacchi alle aziende e furti di dati, come combatterli Roma 18 Giugno 2014 Maurizio Martinozzi

2 Gli ultimi ritrovati in termini di attacchi alle aziende e furti di dati Degli Advanced Persistent Threats (APT) non solo se ne parla ma ad oggi se ne cominciano a contare i danni: è possibile contrastarli ma la difesa deve essere personalizzata e tagliata su misura dell infrastruttura dell azienda. Una ricerca del Ponemon Institute ha rilevato che il 67% delle aziende ammette che le proprie soluzioni sicurezza adottate non sono sufficienti a bloccare un attacco mirato. Ma il dato è tragico se consideriamo che il 55% delle aziende non viene nemmeno a conoscenza delle intrusioni subite e, una percentuale bassissima, è in grado di valutare la portata dell attacco e, ancora più importante, chi lo ha sferrato. Per contrastare gli attacchi mirati è necessario adottare tecnologie si sicurezza evolute, quelle tradizionali non garantiscono più un adeguato livello di protezione. Di fatto le nuove tecnologie devono essere in grado di gestire la tipologia di attacco, rilevando e analizzando le minacce costanti evolute, ma anche di adattando rapidamente la protezione e reagendo in maniera proattiva ad attacchi specifici. La tecnologia deve essere in grado di integrare correttamente software, informazioni globali sulle minacce, strumenti e servizi specializzati per offrire nozioni personalizzate sulla minaccia specifica e sui criminali coinvolti. I recenti progressi nella gestione di comando e controllo (C&C) contribuiscono a bloccare i comportamenti sospetti prima ancora che riescano a compromettere l obiettivo individuato. Ma non allarmiamoci: oggi sono disponibili specifiche soluzioni preventive e noi ve le racconteremo: vi spiegheremo perchè le soluzioni di sicurezza tradizionali non riescono a combattere queste nuove tipologie di minacce e di attacchi, vi spiegheremo le caratteristiche di queste recenti attività illecite dei cybercriminali e, soprattutto, vi mostreremo le più recenti e efficienti soluzioni ad oggi disponibili sul mercato per combattere questi nuovi crimini informatici.

3 What We Do Trend Micro How We Do It Who We Are Recognized global leader in server, virtualization and cloud security Innovative security solutions Protecting the exchange of digital information for businesses and consumers 1,200 threats experts in 12 TrendLabs locations around the globe; 1492 R&D engineers $400M USD and 500 engineers invested over last 4 years to develop cloud-related solutions Global Threat Intelligence Eva Chen: CEO and Founder Co-founded: 1988 Offices: 36 Global Employees: 4942 Revenue: $1.2B USD Cash Assets: $1.65B USD Operating Income: $330M USD Headquarters: Tokyo 3

4 Gli investimenti in Software 6/23/2014 4

5 Gli investimenti in Infrastrutture IT 6/23/2014 5

6 Cyber crime or war?? It does not matter!! 1 new threat each second 1 1 cyber-intrusion each 5 minutes 2 67 % of infrastructure can t block a custom & targeted attack 3 55 % of companies didn t detected the breach 1 More frequent More targeted More money More sophiticated Source : 1: Trend Micro, 2 : US-Cert 2012, 3 : Ponemom Institute 2012

7 Cyber crime or war?? It does not matter!!

8 Cyber crime or war?? It does not matter!!

9 Cyber crime or war?? It does not matter!!

10 Le minacce interne 80% of data breaches Authorized Insiders Ponemon Institute Study Insider Autorizzati Threat Accidental or malicious breach Scopo Monitor, log, prevent breaches Assess risk - continuously Educare gli impegati Outsider Non-Autorizzati Threat Dati rubati o persi Scopo Impedire l uso dei dati a personale non autorizzato 10

11 Malware as a Service 6/23/

12 Confidential 2013 Trend Micro Inc.

13 December 2010 Cyber attack on Iranian nuclear facilities January year-old George Hotz decrypts Sony PS3 root key February 2011 HBGary hacked by Anonymous and resulted data leakage March 2011 Authentication product related information leaked from RSA April million customers data leakage from Sony PSN users May ,000 US City Group customers data leaked June 2011 Major US defense contractor Lockheed Martin attacked July 2011 leakage of personal data of 35 million users of Korean social network site August 2011 Japanese defense related firms suffered from cyber attacks September 2011 Japanese National Personnel Authority and Cabinet Office sites were temporarily unavailable by DDoS attacks October 2011 PCs in Japanese House of representatives infected by virus; possible data leakage These information are all extracts from news

14 Rivoluzione tecnologica L impatto tecnologico di Virtualizzazione, Cloud, Consumerization sta rivoluzionando il concetto di perimetro, smaterializzando elementi delle architetture IT La crescita del volume di dati creati, scambiati e conservati ha aumentato in modo significativo la complessità della gestione del rischio informatico per aziende e governi La sofisticazione e industrializzazione delle tecnologie Cyber-criminali richiede competenze sempre più specifiche e capacità d intelligence per reagire rapidamente ed efficacemente agli attacchi RIVOLUZIONE: L atto di modificare e rinnovare in modo radicale, profondamente Dizionario Treccani della Lingua Italiana 6/23/

15 Evoluzione del business Necessità di modelli integrati di governance e di gestione del rischio informatico adeguati al nuovo scenario, abilitanti al controllo del processo Valore per il Valore: portare al cliente reali competenze a valore aggiunto, accreditandosi come consulente, broker tecnologico, partner di progetto affidabile Fattori macro-economici attuali e conditio sine qua non di TCO, Riduzione dei Costi misurabili e concreti EVOLUZIONE: Ogni processo di trasformazione, graduale e continuo, per cui una data realtà passa da uno stato all altro quest ultimo inteso generalmente come più perfezionato attraverso cambiamenti successivi Dizionario Treccani della Lingua Italiana 6/23/

16 Evoluzione della Domanda Le tecnologie restano il motore del business della sicurezza, ma non sono più sufficienti da sole a coprire le esigenze di un mercato sempre più complesso Oggi i Clienti richiedono a vendor e partner un miglior supporto per gli impatti organizzativi e di processo 6/23/

17 Cosa vuol dire compromettere una risorsa IT (e come) 17

18 Network Perimeter is Expanding Virtualization, Cloud, Consumerization & Mobility New Perimeter IaaS SaaS Internet Old Perimeter Main Campus Mobile User Remote Office

19 Big Data Everywhere Who is accessing your data from where using what? Public Cloud Desktop Virtualization Private Cloud Server Virtualization

20 The Targeted Attack Process Stage 0 Stage 1 Stage 2 Stage 3 Preparation for attack As a preparation stage before they conduct attacks, the attackers investigate information of target organization. For that, they attack organizations around target to collect platform information for initial intrusion like s exchanges between that organization and the target. Using this information, they conduct attacks which increase the success rate of the initial penetration. Initial penetration Various methods are used in the initial penetration stage. Suspicious (targeted) is one such method. These methods are used to deploy viruses deep within the organization. In this stage, the attack can achieve the goal only when one employee open that . In the initial penetration stage, there is no need for virus to infect many systems. It is thought that the attack methods used at this stage are expected to be detected and cleaned. That mean they are disposable. Establishment of attack platform Once the attackers succeed to get into the system, they quickly establish a backdoor for communication with a server they prepare. Unlike the traditional backdoors, this backdoor is the one that uses HTTP and other communication protocols that are used in the business in the target organization. Thus it cannot be blocked by a firewall. Using this backdoor, they will add functions needed for next system investigation stage, and an attack platform will be established. System investigation Using the attack plat-form established in the prior stage, the attackers search for internal system information. At this time, a back door is used to communicate with the attackers and the search will be continued while confirming system information. Stage 4 Attack on the ultimate target They steal information via the backdoor. In some cases, using information stolen, they repeat attacks. APT is the attack which the attackers keep attack platform which established in the target organizations to repeat penetrations and data thefts. This attack is the one tend to be repeated several times. Source: IPA design/ maintenance guide to aim for the solution against new type of attack. Copyright 2012 Trend Micro Inc. 20

21 Le tecnologie

22 Deep Discovery Deep Discovery provides the visibility, insight and control you need to protect your company against APTs and targeted attacks Deep Discovery Advisor Deep Discovery Inspector Custom scalable threat simulation Deep investigation & analysis Actionable intelligence & results Network traffic inspection Advanced threat detection Real-time analysis & reporting Targeted Attack/APT Detection In-Depth Contextual Analysis Rapid Containment & Response

23 A Custom Defense for a Smart Protection DETECT ANALYZE ADAPT RESPONSE Advanced technologies to analyze low signals Threat profiling Origin? Risk? Channel? Instant protection with dynamic signature Threat infection containement Full visibility with Deep Discovery technologies Advanced monitoring with Network and Host Sensor Next-gen protection against custom threat & targeted attack Sandbox Protocol Inspection Network Reputation File Analysis Behavioral Analysis C&C Identification System Monitoring 6/23/2014

24 What is Deep Discovery? A network & host monitoring solution designed to provide network-wide visibility, insight and control against data breaches and advanced threats. Deep Discovery uniquely detects and identifies evasive threats in real-time, and provides the in-depth analysis and actionable intelligence needed to prevent, discover and contain attacks against corporate data 6/23/

25 Single Appliance for Advanced Protection DETECT Entry point Lateral Movement Deep Discovery Inspector Exfiltration 360 Approach Appliance All-in-One Content Up to 4 Inspection Gbps model Document Bare Metal Emulation & VA available Payload Custom Download sandboxes Behavior embedded Tracing Exploit Can bedetection linked to external SB Network Monitoring Network Content Inspection Engine Advanced Threat Security Engine IP & URL reputation Virtual Analyzer Network Content Correlation Engine All HTTP protocols SMTP analyzed DNS FTP on a single box CIFS SQL P2P Embedded doc exploits Drive-by downloads Dropper Unknown Malware C&C technologies access Data stealing Worms/Propagation Backdoor activities Data exfiltration Detect known, unknown and custom threats Leverage Trend Micro Threat Intelligence Adapts and responds to threats in your unique environment 6/23/2014

26 Deeper Look into Deep Discovery Docode Engine DETECT Advanced File Emulation Win32 DLLs Process Environment Virtual Processor File & Registry Simulation Extraction & Correlation Fast analysis Shellcode Document type Exploit data Microsoft Office Adobe PDF Adobe Flash Doc Analyzer Parser Extractor Emulator Scripts (JS/AS) File Structure Payload... High detection rate 6/23/

27 Deeper Look into Deep Discovery Virtual Analyzer ANALYZE Your Custom Sandbox Custom OS image Execution acceleration Anti-Analysis detection 32 & 64 bits Execute binaries, documents, URL... Live monitoring Kernel integration (hook, dll injection..) Network flow analysis Event correlation WinXP SP3 Filesystem monitor Win7 Base Registry monitor Win7 Hardened Process monitor Isolated Network LoadLibraryA ARGs: ( NETAPI32.dll ) Return value: 73e50000 LoadLibraryA ARGs: ( OLEAUT32.dll ) Return value: 75de0000 LoadLibraryA Modifies file ARGs: with ( WININET.dll infectible) Return type value: : eqawoc.exe 777a0000 key: Inject HKEY_CURRENT_USER\Local processus : 2604 taskhost.exe Settings\MuiCache\48\52C64B7E\LanguageList value: Access suspicious host : mmlzntponzkfuik.biz key: HKEY_CURRENT_USER\Software\Microsoft\Onheem\20bi1d4f Write: path: %APPDATA%\Ewada\eqawoc.exe type: VSDT_EXE_W32 Injecting process API ID: 2604 Inject Fake API: CreateRemoteThread Fake Target process Fake AV ID: 1540 Target Hooks image path: Explorer taskhost.exeserver socket ARGs: ( 2, 2, 0 ) Return value: 28bfe socket ARGs: ( 23, 1, 6 ) Return value:! 28c02 window API Name: CreateWindowExW ARGs: ( 200, 4b2f7c,, , 0, 0, 250, fe, 301b8, f, 4b0000, 0 ) Return value: 401b2 internet_helper API Core Name: Threat InternetConnectA Simulator ARGs: ( cc0004, mmlzntponzkfuik.biz, 10050,,, 3, 0, 0 ) Return value: cc Rootkit scanner Network driver 6/23/

28 Deeper Look into Deep Discovery Mobile Advanced Protection Smart Protection Network ANALYZE Cloud Android Sandbox Crawl & Collect apps from various market (Play, Amazon, SlideMe ) Automatic download of unknown Android app from hosting source High quantity of Android apps catch Detection of suspicious behaviours C&C communications Data leak transfer Malware payload Invalid certificate Privacy abuse Permission APK MARS SANDBOX Static Analyzer Variant Unpack Scanning UI Syscall Trigger hook Smart Protection Permission Check Network Data Behavior Privacy Data Tracking Resource Analysis Dynamic Analyzer Spoofing Logging Log Collector SINCE 2012 Deep Discovery 6/23/

29 Deeper Look into Deep Discovery C&C Callback Protection ADAPT Multi-Source Scoring FTP TCP DNS UDP CIFS ICMP SQL HTTP SMTP Protocol Analyzer Virtual Analyzer Feedback URL Domain Name IP:Port File Signature Global C&C Live Intelligence User-Defined C&C List Content Inspection Rules Blocking capabilities Hidden callback Botnet behavior Trojan identification! TCP Reset HTTP Redirect DNS Spoofing ICMP Code 6/23/

30 Deep Discovery Simple & Efficient Infection & payload Lateral movement C&C callback! Web proxy Dynamic blacklist Storage Mail Server App Server SMTP relay! af12e45b49cd : :80 d4.mydns.cc b1.mydns.cc... Inspector Endpoint!! 6/23/

31 Create your Custom Defense Analyzer External sandbox system Automatic Analysis Labs Manual & API submission tools Multi-box (5 nodes, 100k files/day) Integrated into Trend Micro solutions Threat profil export (IOC, hash) API & scripting Inspector reputation & attachment analysis Embedded URL analysis in VA MTA (inline) or BCC (monitor) mode Up to 2M mails/day per box Threat Intelligence Center Central event dashboards Custom searches & reports Central alerting and reporting Confidential Copyright 2012 Trend 6/23/ Micro Inc.

32 Get a complete picture of targeted attacks Deep Discovery Endpoint Sensor Context-aware endpoint solution designed to speed the discovery, investigation and response to security incidents Accelerate you response process Get a full picture of threats Confirm endpoint infiltration alerts from network security Analyze actual malware behavior and results See which endpoints have specific malware or C&C activity Discover full context and spread of an attack Records detailed system activities Performs multi-level search across endpoints Uses rich search criteria Compatible with any AV security solution

33 Trend Micro Products Integrated Advanced Protection! Web IWSva proxy Dynamic blacklist Storage ScanMail Server App Server SMTP IMSvarelay Analyzer af12e45b49cd : :80 d4.mydns.cc b1.mydns.cc... OfficeScan Deep Security Endpoint! Infection & payload C&C callback 6/23/ ! 3c4çba176915c3ee3df8 7b9c127ca1a1bcçba17 Custom Signature

34 Detect

35 Detect

36 Analyze Human readable

37 React Search summary Individual endpoint flow & drilldown Context and network aware Copyright 2013 Trend Micro Inc. 37

38 Why Deep Discovery? NSS Labs Breach Detection Tests Better detection & 360 protection Proven results for standard HTTP & SMTP Plus detection for 80+ protocols & applications across all ports Detection of Mac and Mobile malware Custom sandboxing Attacker activity detection All at half of the TCO than main competitor 6/23/

39 Why Deep Discovery? Dynamic advanced security Multi-engine for analysis and correlation Leverages Smart Protection Network CustomVirtual Analyzer sandbox Access to TrendLabs Security Expert Plug & Protect High Throughput Network Analysis Flexible architecture: HW, SW, VM Fast forensics & custom signature 6/23/

40 Il cloud DAILY: Collects 1.15B threat samples Correlates 7.2 TB data Protects against 200M threats Whitelisting Network traffic rules Mobile app reputation Vulnerabilities/Exploits Threat Actor Research Enhanced File Reputation Enhanced Web Reputation BIG DATA ANALYTICS-DRIVEN GLOBAL THREAT INTELLIGENCE reputation File reputation Web reputation SIGNATURE BASED ANTI-MALWARE CLOUD BASED GLOBAL THREAT INTELLIGENCE 2008

41