# Presentation: 223105

## Slide 1

## Our Products

**Our Products**
**80% of world’s critical infrastructures**
**Determined, resourceful, global adversaries**

**Our Resources**
**Attacked > 4,000 times a day**
**At least one DDoS a day**
**Logged attacks from every country**

**Our Business**
**Subject to Phishing, Bots, Root-kits, ...**

## The World Today
Threats 
Bad Guys
How We Got There
Legacy 
Crime
Evolving the Solution
Security Strategy
A Look Ahead

**Threats **
**Bad Guys**
**How We Got There**
**Legacy **
**Crime**
**Evolving the Solution**
**Security Strategy**
**A Look Ahead**

## Emanations

**Emanations**
**Tempest**
**Insiders**
**TCSEC, Common Criteria**

**Eavesdropping**
**DES, AES, IPSec**
**Network Protocols**
**Sync flood, DNS spoofing**
**Network Stacks**
**“****Ping of death”**

**Operating System Services**
**Buffer overruns, XSS**
**Web spoofs, worms**
**Application Services**
**SQL injection, SQL Slammer**
**Media players**

## Rarely discovered

- Attacks occur here

- Why does this gap exist?

## Days From Patch To Exploit

- Have decreased so that patching is not a defense in large organizations
- Average 6 days for patch to be reverse engineered to identify vulnerability

- Source: Microsoft

## Exploitability
Defined - the publication of exploit and/or proof-of concept code for a known vulnerability, or where the exploit is trivial or no code is required to leverage
Current state 
1 of 2 vulnerabilities are exploited, regardless of platform
6.5% improvement over 2004
Average: 6 days from disclosure to exploitation

**Defined - the publication of exploit and/or proof-of concept code for a known vulnerability, or where the exploit is trivial or no code is required to leverage**
**Current state **
**1 of 2 vulnerabilities are exploited, regardless of platform**
**6.5% improvement over 2004**
**Average: 6 days from disclosure to exploitation**

| Year | Number of 
MS Vulnerabilities corrected by bulletin | Exploited |  |  | % of exploits to vulnerabilities |
| --- | --- | --- | --- | --- | --- |
|  |  | No | Trivial | Yes |  |
| 2005* | 40 | 21 | 3 | 15 | 46.2 % |
| 2004 | 91 | 43 | 3 | 45 | 52.7% |
| 2003 | 79 | 31 | 4 | 44 | 60.8% |
| 2002 | 150 | 70 | 6 | 61 | 48.9% |

**Thru May 31, 2005**

## Blaster shows the complex interplay between security researchers, software companies, and hackers

- Source: Microsoft

## “Less than 24 hours after Microsoft released its Security Bulletins for August, exploit code was made publicly available for the vulnerabilities addressed in Microsoft Security Bulletin MS05-038 and MS05-041. The postings, titled ‘Microsoft Internet Explorer COM Objects Instantiation Exploit (MS05-038)’ and ‘Microsoft Windows Remote Desktop Protocol DoS Exploit (MS05-041),’ were published by the French security firm FrSIRT. A second piece of code was published on August 11th for MS05-038.”

- “Less than 24 hours after Microsoft released its Security Bulletins for August, exploit code was made publicly available for the vulnerabilities addressed in Microsoft Security Bulletin MS05-038 and MS05-041. The postings, titled ‘Microsoft Internet Explorer COM Objects Instantiation Exploit (MS05-038)’ and ‘Microsoft Windows Remote Desktop Protocol DoS Exploit (MS05-041),’ were published by the French security firm FrSIRT. A second piece of code was published on August 11th for MS05-038.”

- “Three pieces of exploit code targeting the Windows Plug and Play issue (MS05-039) have been made publicly available. These are listed as the ‘Microsoft Windows Plug and Play Remote Buffer Overflow Exploit (MS05-039)’, ‘Microsoft Windows 2000 Plug and Play Universal Remote Exploit (MS05-039)’ and ‘Microsoft Windows 2000 Plug and Play Universal Remote Exploit #2 (MS05-039)’ on the FrSIRT Web site. One of which has also been included as an exploit module in the Metasploit Framework.”

## Answers “Where are the greatest risks?”
Exploits written in 2005 for 6 popular Operating Systems
Win32
Linux (4 distributions)

**Exploits written in 2005 for ****6 popular Operating Systems**
**Win32**
**Linux (4 distributions)**

**Exploits written 2005 YTD - all platforms**

|  | Vulns | Exploitable | Trivial |
| --- | --- | --- | --- |
| Total | 344 | 96 | 61 |

**2005 Vulns and Exploits (YTD)**

**Thru May 31, 2005**

## Network service

**Thru May 31, 2005**

## Script-Kiddy

- HobbyistHacker

- Expert

- Specialist

**Vandal**

**Thief**

**Spy**

**Trespasser**

**Tools created by experts now used by less skilled attackers and criminals**

**Fastest **
**growing **
**segment**

**Author**

## 16-bit 100 MHz processor

**16-bit 100 MHz processor**
**10 GByte disk**
**20 MByte ram**
**CD drive**
**13” VGA monitor**

**Windows 95**
**FAT FS**
**IPX and NetBIOS**
**Open networking**

**32-bit 2.5 GHz processor**
**250 GByte disk**
**3 GByte ram**
**DVD R/W drive**
**21” digital monitor**

**Windows XP SP2**
**ICF**
**USB**
**UPnP**
**Windows Update**

**Legacy creates**
**security **
**issues**

## The security kernel of Windows NT was written:
Before there was a World Wide Web
Before TCP/IP was the default communications protocol

The security kernel of Windows Server 2003 was written:
Before buffer overflow tool kits were available
Before Web Services were widely deployed

**Before there was a World Wide Web**
**Before TCP/IP was the default communications protocol**
**The security kernel of Windows Server 2003 was written:**
**Before buffer overflow tool kits were available**
**Before Web Services were widely deployed**

## Six computers attached to Internet
Different versions of Windows, Linux and Mac OS
Over the course of one week
Machines were scanned 46,255 times
4,892 direct attacks
No up-to-date, patched operating systems succumbed to a single attack
All down rev systems were compromised 
Windows XP with no patches
Infested in 18 minutes by Blaster and Sasser 
Within an hour it became a "bot"

**Different versions of Windows, Linux and Mac OS**
**Over the course of one week**
**Machines were scanned 46,255 times**
**4,892 direct attacks**
**No up-to-date, patched operating systems succumbed to a single attack**
**All down rev systems were compromised **
**Windows XP with no patches**
**Infested in 18 minutes by Blaster and Sasser **
**Within an hour it became a "bot"**

- Source: StillSecure,
- see http://www.denverpost.com/Stories/0,1413,36~33~2735094,00.html

## Mass unsolicited email
For commerce
Direct mail advertisement
For Web traffic
Artificially generated Web traffic
Harassment
For fraud
Phishing
Identity theft
Credential theft

**For commerce**
**Direct mail advertisement**
**For Web traffic**
**Artificially generated Web traffic**
**Harassment**
**For fraud**
**Phishing**
**Identity theft**
**Credential theft**

## “Our first program pays you $0.50 for every validated free-trial registrant your website sends to [bleep]. Commissions are quick and easy because we pay you when people sign up for our three-day free-trial. Since [bleep] doesn't require a credit card number or outside verification service to use the free trial, generating revenue is a snap.The second program we offer is our pay per sign-up plan. This program allows you to earn a percentage on every converted (paying) member who joins [bleep]. You could make up to 60% of each membership fee from people you direct to join the site.Lastly, [bleep] offers a two tier program in addition to our other plans.  If you successfully refer another webmaster to our site and they open an affiliate account, you begin earning money from their traffic as well!  The second tier pays $0.02 per free-trial registrant or up to 3% of their sign-ups.”

## SoBig spammed over 100 million inboxes
If 10% read the mail and clicked the link 
= 10 million people
If 1% of people who went to site signed up for 3-days free trial
= (100,000 people) x ($0.50) = $50,000
If 1% of free trials sign up for 1 year
= (1,000 people) x ($144/yr) = $144,000/yr

**If 10% read the mail and clicked the link **
**= 10 million people**
**If 1% of people who went to site signed up for 3-days free trial**
**= (100,000 people) x ($0.50) = $50,000**
**If 1% of free trials sign up for 1 year**
**= (1,000 people) x ($144/yr) = $144,000/yr**

## Filed 97 lawsuits in US against spammers 
11 defendants were on the Register of Known Spam Operations (ROKSO) 
5 of the 11 included on ROKSO’s top 10 list 
More than 120 worldwide legal actions
Over $100m in judgments 
Total US Spam Judgments: $79 Million
Referral of over 30 cases to LE
One of nation’s most notorious spammers recently declared bankruptcy as a result of joint MS-government pressure

**11 defendants were on the Register of Known Spam Operations (ROKSO) **
**5 of the 11 included on ROKSO’s top 10 list **
**More than 120 worldwide legal actions**
**Over $100m in judgments **
**Total US Spam Judgments:** **$79 Million**
**Referral of over 30 cases to LE**
**One of nation’s most notorious spammers recently declared bankruptcy as a result of joint MS-government pressure**

## Faking 
An e-mail that seems to be from a legitimate source
Spoofing
A Web site that appears to be “official”
Phishing
Luring users to provide sensitive data

**An e-mail that seems to be from a legitimate source**
**Spoofing**
**A Web site that appears to be “official”**
**Phishing**
**Luring users to provide sensitive data**

## Slide 21

## 3 Subpoenas identified ISP in Austria

**5**** ****Subpoena to Qwest and investigations identified Jayson Harris in Iowa, US**

**1**** ****MS filed John Doe lawsuit in WA**

**6**** ****Referred to FBI and obtained $3 million Default Judgment**

**2**** ****Issued  subpoenas to web hosts in CA**

**4**** ****Austrian ISP identified IP address registered to Qwest in the US**

## Most people are spoofed
Over 60% have visited a fake or spoofed site
People are tricked 
Over 15% admit to having provided personal data 
Target for spoofing attacks
Banks, credit card companies, Web retailers, online auctions (E-bay) and mortgage companies.
Economic loss
1.2 million U.S. adults  have lost money
The total dollar impact: $929 million 

**Over 60% have visited a fake or spoofed site**
**People are tricked **
**Over 15% admit to having provided personal data **
**Target for spoofing attacks**
**Banks, credit card companies, Web retailers, online auctions (E-bay) and mortgage companies.**
**Economic loss**
**1.2 million U.S. adults  have lost money**
**The total dollar impact: $929 million**** **

- Source: TRUSTe & Gartner

## Active Phishing Sites by Week November 04 to February 05

| Active phishing sites in February | 2625 |
| --- | --- |
| Average monthly growth rate | 28% |
| Number of hijacked brands | 64 |
| Average time online for site | 5.7 days |
| Longest time online for site | 30 days |

- Source APWG February 2005

**March 2005 partnered with the FTC and National Consumers League to file 117 lawsuits against phishers**
**Issued over 1500 takedown notices for Phishing sites since Sept 2003**
**Referred >30 cases to LE**
**Coordination with LE to create Operation “Digital Phishnet”**

## Viagra spammers being put out of action San Jose Mercury News EditorialSunday, February 13, 2004

**Viagra spammers being put out of action** San Jose **Mercury News Editorial**Sunday, February 13, 2004

**Tech Firms, FBI to Fight 'Phishing' Scams Together**
- By Andy Sullivan
- December 8, 2004

**Shhh, they're hunting cybercrooks; **
**Sleuths hunker down to catch Net's most-wanted**** **
- By Jon Swartz
- 9/21/04

**Pfizer, Microsoft Sue Viagra Spammers**
- February 10, 2004

**Internet Giants File 7 Suits Aimed at Stopping Spam**
- October 29, 2004
- By Laurie J. Flynn

**Technology And The Fight Against Child Porn **
- By John Foley,  February 14, 2005

**February 14, 2005, Newsweek, U.S. Edition** *By Steven Levy*
**How to Hook the Elusive Phisher**

**Microsoft attacks spam in courts**
**By Brandon Sprague** August 2, 2004

**Microsoft Takes Stands Against Spam, Sanctions**
- By Jonathan Krim
- Thursday, September 23, 2004; Page E01

**Amazon, Microsoft team for spam suits**
- By Matt Hines Staff Writer, CNET News.com
**September 28, 2004,**

**A Collective Net to**
** ****Catch Phishers**
- By Sarah Lacy
- December 20, 2004

**Houston Chronicle**
**Day after AG suit, Microsoft sues UT student **
- By Associated Press, January 14, 2005

## Software that:
Collects personal information from you 
Without your knowledge or permission
Privacy
15 percent of enterprise PCs have a keylogger
Source: Webroot's SpyAudit
Number of keyloggers jumped three-fold in 12 months
Source: Sophos
Reliability
Microsoft Watson
~50% of crashes caused by spyware
Support Costs
Dell, HP, IBM: Spyware causes ~30% of calls
Estimated support costs at $2.5m+ / year

**Collects personal information from you **
**Without your knowledge or permission**
**Privacy**
**15 percent of enterprise PCs have a keylogger**
**Source: Webroot's SpyAudit**
**Number of keyloggers jumped three-fold in 12 months**
**Source: ****Sophos**
**Reliability**
**Microsoft Watson**
**~50% of crashes caused by spyware**
**Support Costs**
**Dell, HP, IBM: Spyware causes ~30% of calls**
**Estimated support costs at $2.5m+ / year**

## Israel Spyware

- “Dubbed "Trojangate," the incident resulted in nearly 20 arrests, with some reports
- indicating that there were hundreds -- perhaps thousands -- of documents stolen from multiple Israeli firms. About 100 servers containing stolen data have been seized and are being investigated.”   *BBC*

- “In 2004, MessageLabs came upon a Trojan horse created for the purpose of attacking
- a type of software used in airplane design.”  *AP*

- “Someone placed surveillance software on sheriff's office computers, apparently enabling unauthorized access to sensitive information about prisoner movements, confidential homeland security updates and private personnel files.”   *AP*

## UK police foil massive bank theft 

**UK police foil massive bank theft**** **
- “Police in London say they have foiled one of the biggest attempted bank thefts in Britain. The plan was to steal £220m ($423m) from the London offices of the Japanese bank Sumitomo Mitsui. Computer experts are believed to have tried to transfer the money electronically after hacking into the bank's systems. A man has been arrested by police in Israel after the plot was uncovered by the National Hi-Tech Crime Unit. Unit members worked closely with Israeli police ...” *Story from BBC NEWS: http://news.bbc.co.uk/go/pr/fr/-/1/hi/uk/4356661.stm*

## Growth in the root kit population
Technical challenge in the community
Defeats current anti-spyware products
Financial motivation to support adware & spyware
Takes several hours to walk customer through removal & recovery
Ongoing support cost for Microsoft is high
http://support.microsoft.com/?id=894278
More than 12 steps for safemode removal!
Can no longer detect the latest version of LODMEDUD_A
New malicious drivers moving to boot drivers

**Technical challenge in the community**
**Defeats current anti-spyware products**
**Financial motivation to support adware & spyware**
**Takes several hours to walk customer through removal & recovery**
**Ongoing support cost for Microsoft is high**
_**[http://](http://support.microsoft.com/?id=894278)**__**[support.microsoft.com](http://support.microsoft.com/?id=894278)**__**[/?id=894278](http://support.microsoft.com/?id=894278)**_
**More than 12 steps for safemode removal!**
**Can no longer detect the latest version of LODMEDUD_A**
**New malicious drivers moving to boot drivers**

## Slide 31

| Driver | Characteristic | Instance count |
| --- | --- | --- |
| Delprot.sys | Deletion protection for iSearch adware/spyware. | 81870
1.03% |
| “LoadMeDude”
TROJ_LODMEDUD_A | Randomly named driver that hides processes, registry, files.
Auto-update capability.
Bundled with Comedy Central adware/spyware. | 25496
0.32% |
| winik.sys | Protects CommonName adware/spyware. | 13583
0.17% |
| iesprt.sys
TROJ_BANKER.W | Steals banking passwords. | 2386
0.03% |
| Hxdefdrv.sys
“Hacker Defender” | Public domain source rootkit.
Resource hiding and backdoor capability.
 | 1323
0.02% |