FFRI Security, Inc.

Company
ProfileFFRI Security, Inc.
https://www.ffri.jp/en/index.htm

Ver2.00.09

FFRI Security, Inc.

Company Profile
Company Name:FFRI Security, Inc.
(TSE Market of High-Growth and Emerging Stocks: 3692)
President and CEO：Yuji, Ukai

Address：

2F Shin-Tokyo Building,
3-3-1, Marunouchi, Chiyoda-ku, Tokyo, JAPAN, 100-0005

Date of Establishment：

July 3, 2007

Capital：¥286,136,500 (as of March 31, 2019)

Scope of business1.Computer security research, consulting, information provision, and education
2.Network system research, consulting, information provision, and education
3.Computer software and computer program planning, development, sales,
leasing, maintenance, management, and operation, and the acquisition,transfer, lending, and management of related property rights such as
copyrights, publishing rights, patent rights, utility model rights, trademark
a rights, design rights
4.All duties related to the above businesses

1FFRI Security, Inc.

Business Overview
Seed based R&D in Cyber Security
Research regarding security vulnerabilities used for targeted attacks, etc. anddevelopment of countermeasure technology
Track record of discovering more than 100 critical vulnerabilities (most in Japan)
Research regarding targeted attack malware and development ofcountermeasure technology
Numerous announcements of research results regarding malware security
measures in recent years, such as for targeted attacks
Built-in security
Numerous announcements of research results regarding security vulnerability
threat analyses of built-in systems

Products• Vulnerability attack protection software• Targeted Attack countermeasure software• Automated malware analysis tool
• MITB Attack countermeasure software• Embedded device security inspection tool
• P2P system security

Services• Targeted attack malware inspection
analysis• Smart device security inspections• Security measures consulting• Contracted research anddevelopment• Black URL provision service• Security technician training

2

FFRI Security, Inc.

Research regarding security vulnerabilities anddevelopment of countermeasure technology
Track record of discovering more than 100 critical vulnerabilities (most in Japan)
Track record of research in security vulnerability
countermeasures• Announcement of research regarding vulnerability analysis atvarious international conferences, such as BlackHat USA/Japan,
RSA Conference, and CanSecWest

Other• First in the world to demonstrate thepossibility of Windows 9x systemstability• Track record of numerous researchannouncements in Japan• Announcement of various research results at
http://www.ffri.jp/research/index.htm

Track record of discovering security vulnerabilities
Track record of discovering more than 100 criticalvulnerabilities
Examples: Microsoft Windows (LSASS vulnerability, wkssvc vulnerability,
animated cursor vulnerability, GDI vulnerability, Office products,
Internet Explorer, etc.), Winny, Ichitaro, QuickTime, Realplayer, etc.

Featured in various articles, magazines, newspapers, and on
NHK news
Example: Discovery of vulnerability in IPv6 stack (included
standard in Windows)
Date reported: March 24, 2010/Date published: August 11, 2010
http://www.ffri.jp/research/index.htm

3FFRI Security, Inc.

Research regarding malware and developmentof countermeasure technology
Numerous announcements of research results regarding malware security
measures in recent years, such as for targeted attacks
Contracted by the Information-technology Promotion Agency (IPA):
Research regarding targeted attacks in recent years
Comprehensive reverse engineering and behavioral analysis was performed on all codes fromseveral samples regarding malware, vulnerability exploitation techniques, and targeted attacks
in recent years.The countermeasures are presented.
http://www.ipa.go.jp/security/fy19/reports/sequential/index.html

Research Results announced at international conferences and in the media
Examples:"Facts Discovered from an Analysis of Targeted Attack Malware -- Yuji Ukai, FFRI" (builder)
http://builder.japan.zdnet.com/news/story/0,3800079086,20367832,00.htm

Research announcement by FFRI engineers at MWS 2014 (Asahi Shinbun DIGITAL)
http://www.asahi.com/and_M/information/pressrelease/Cdpress000101109.html

SLIME: Automated Anti-sandboxing disarmament system (Black Hat Asia)
https://www.blackhat.com/asia-15/briefings.html#slime-automated-anti-sandboxing-disarmament-system

FREEZE DRYING FOR CAPTURING ENVIRONMENT SENSITIVE MALWARE ALIVE (Black Hat Europe)
https://www.blackhat.com/eu-14/briefings.html#freeze-drying-for-capturing-environment-sensitive-malware-alive

TENTACLE: Envirnment Sensitive Malware Palpation (Pacsec 2014)
http://www.asahi.com/and_M/information/pressrelease/Cdpress000102746.html

4FFRI Security, Inc.

Built-In Security
Numerous announcements of research results regarding security
vulnerability threat analyses of built-in systems
Private built-in security measures promoted by IPA
Private built-in security measures are promoted by IPA.

"New-Generation Information Security Research and Development
Projects" by the Ministry of Economy, Trade, and Industry
Research conducted regarding automatic detection technology for unknown vulnerabilities in devices
other than computers, such as information appliances, smart grids, and mobile devices.

Numerous announcements regarding IoT security threat analysis
Examples:"A security assessment study and trial of TriCore-powered automotive ECU" (Code Blue)
http://www.ffri.jp/assets/files/research/research_papers/Code_Blue_Tricore_assessment_slides_ja.pd f"How Security Broken?" (PacSec2011)
http://www.ffri.jp/assets/files/research/research_papers/how-security-broken-pacsec2011.ja.pdf"Yet Another Android Rootkit - /protecting/system/is/not/enough" (Black Hat Abu Dahi 2011)
http://www.ffri.jp/assets/files/research/research_papers/yet-another-android-rootkit.pdf"Android: Technical Design Issues" (Internet Week 2011)
http://www.ffri.jp/assets/files/research/research_papers/InternetWeek2011_s10-02.pdf"Windows Phone 7 Internals and Exploitability" (Black Hat USA 2012)
http://www.ffri.jp/assets/files/research/research_papers/wp7-internals-and-exploitability.pdf

Other

Conducted numerous analyses of threats to automotive systems and diagnoses of vulnerabilities inrouters, network devices, etc.

5

FFRI Security, Inc.

Products, Services Lineup- Corporate Targeted Attack Protection
Protection against targeted attack malware, known
malware, known and unknown security vulnerability
attacks, without reliance on patterns.

Targeted Attack Malware Inspection Service

Targeted Attack Malware
Inspection Service

Investigation for invasion by targeted attack malware.
Analysis of malware and actual damage. Support forreactive measures, including measure planning andexternal reporting.

Automatic Malware Analysis Tool
Useful in a variety of malware analysis scenarios, suchas inspection for malware infection before software
products are shipped and initial analysis of malware
damage.
In addition to the functions provided in FFR yarai
analyzer, FFR yarai analyzer Professional allows
automatic extraction and reporting of more advanced
level of information.

6

FFRI Security, Inc.

Products, Services Lineup- Personal / SOHO Security Protection for Personal and SOHO Environments
New-generation security software for protection
against malicious attackers with a multi-faceted
approach.

- Personal Security Protection for Personal Environments (Smartphones)
FFRI Secure Application
Checker

Security application that can easily diagnosevulnerabilities in applications running on Android
smartphones and tablets.

7

FFRI Security, Inc.

Products, Services Lineup
Security Inspection of IoT Devices
IoT device and systemsecurity countermeasure
support service

Our research team, which has conducted numerous
security threat analyses and published international
research results, analyzes security threats to IoT
devices and systems before they are shipped, andsupports countermeasures.

Security Consulting Service
Provision of consulting services for APT malware
investigation, Android device security analysis,
vulnerability threat analysis, patch analysis, malware
analysis, emergency briefings, etc.

List of Risky URLs that Distribute Malware
Information is provided regarding risky URLs extracted
from malware samples obtained with our malware
capture system.

8

FFRI Security, Inc.

Other service achievements
業種

カテゴリ
Entrusted development

Government Agency

Education/Training

内容
Development of additional functions for anti-cyber attack products andporting to other operating systems
Malware dynamic analysis training
Malware static analysis training
Creating a system to analyze malware connections

Telecommunications

Surveys and research

Research and development on inspection technology for threats to control
systems

Education/Training

Education and training for security engineer development

Surveys and research

Research and evaluation support for security mechanisms

Education/Training

Support for training of security engineers for control systems
Malware research for control systems

Industrial
Infrastructure/Services

Surveys and research

Threat analysis for control systems
Survey of fuzzing methods for control systems

Investigation/Diagnosis

Support for creating a secure development guide for Android applications
Testing network devices for security features
Consulting on secure development

Automobile

Investigation/Diagnosis

Consulting on testing methods for ECUs
Penetration testing for IVI devices on complete vehicles

Surveys and research

Assessment of requirements specifications

9

FFRI Security, Inc.

Security Solutions for Malware andVulnerability Attacks
DMZ

In-house
LAN

Internet

Attacker

MalwareDistribution Site

C&C Server

Understand Damage due to Targeted Attack Malware
In addition to initial malware analysis, this tool uses our"targeted attack malware inspection service" to visualize adetailed range of effect and provide support for
countermeasures.

Release from Operational Load for Endpoint
Security• Use of 5 heuristic detection engines allows
protection from unknown attacks without
relying on pattern files.
• A secure environment can be maintainedeven in a closed environment, because
detection is not dependent on pattern files.
• Generic mechanisms can be used to protect
against arbitrary code execution vulnerability
attacks, and therefore the frequency of
security patches can be reduced.

10

FFRI Security, Inc.

Next-Generation Endpoint Security

FFRI yarai

FFRI Security, Inc.
https://www.ffri.jp/en/index.htm
Ver 3.00.07

FFRI Security, Inc.

Requirements To Protect From Malicious Programs
No Dependent on Signatures

Behavioral Detection

Progressive heuristic
technology using
proactive detection
logic without
depending on
signatures

Detect malware bydetermining its
malicious
characteristics andbehaviors

Fileless Malware Protection

Multi-Layer Protection

Block fileless malware
such as malware
using a script file ateach phase of an
attackMulti-layer endpoint
protection with the
combination of 5protection engines toprotect from known
threats

12

FFRI Security, Inc.

Limitation With Signature Based Protection
Signature based protection requires lead time before detecting attacks!!
DiscoverAttackConventional
Antivirus
SoftwareCreateSignature

Distribute
Signature

Cannot Detect Attacks

Apply
Signature

Detect Attacks

Protect From Attacks
with Progressive Heuristic Detection Technology
Time

13

FFRI Security, Inc.

Five Behavioral Detection Engines of FFRI yarai
ZDP Engine(Dynamic Analysis)

Protects against virus attacks that target known and unknown vulnerabilities
such as attacks when viewing emails or Web pages.
Protects against arbitrary code execution vulnerability attacks by use of ouroriginal API-NX technology (Patent No. 4572259).

Static Analysis Engine(Static Analysis)
Analysis performed without program operation.
Detection is performed by using N-Static Analysis thatincorporates numerous analysis methods including PE
Structure Analysis, Linker Analysis, Packer Analysis, andSpeculated Operation Analysis.

HIPS Engine(Dynamic Analysis)
Monitors the behavior of currently running programs.
Our unique D-HIPS Logic detects behavior such as
program intrusion, unusual network access, keylogger
and backdoor access behavior.

Sandbox Engine(Semi-Dynamic Analysis)
Runs programs on a virtual environment that includes avirtual CPU, virtual memory and virtual Windows
subsystems.
Detection is based on a combination of commands
based from our unique U-Sandbox Detection Logic.

Machine Learning Engine(Dynamic Analysis)
Monitors running programs based on big data related tomalware that has been captured by FFRI Security.
Behavioral characteristics in big data are extracted todetect malicious behavior in systems by using machinelearning to analyze such characteristics.

14

FFRI Security, Inc.

Behavioral Detection
Provide real-time monitoring for unauthorized access and writing by malicious
programs without depending on signatures to stop execution
Protect Application From

Block Malware

Block Malware“Vulnerability Attacks”“Intrusions”“Activities”

Block vulnerability attacks (memory
corruption attacks) and prevent
arbitrary code executions andprogram executions

ZDP Engine

Prevent program
executions by staticallyanalyzing the programarchitecture anddetecting malware
affecting OS, memory andregistry

Prevent program
executions by executing
the program on thevirtual environment anddetecting malware affecting
OS, memory and registry

Static Analysis
EngineSandboxEngineMonitor behaviors ofexecuting programs andblock execution in casefinding malicious accessor writing to OS,
memory or registry

HIPS
EngineMonitor behaviors ofexecuting programs andblock execution in casefinding malicious accessor writing to OS,
memory or registry

MachineLearning
Engine15

FFRI Security, Inc.

Fileless Malware Protection
Detect fileless malware such as malware using scripts for attack and preventthe execution
Fileless Malware Attack

Fileless Malware Attack Targeting Restaurants
All Over The United States (June 2017)

Attack executed on memory
without using an executable file

Dropper
Shortcut file (.lnk) drops a JavaScript
code

Sending EmailAttaching a WordPad file including
a fileless attack

HIPS Engine

PowerShell
Loading a payload from C&C serverand execute it(Dynamic Analysis)
Power
Shell

Static Analysis Engine(Static Analysis)

WordPad File (.rtf)
LNK file is dropped when an
image in the file body isdouble clicked

JavaScript
Malicious
JavaScript is
executed to startPowershell

ZDP (Dynamic)
Engine■Verification Environment
Windows 7 x FFRI yarai 2.9.0 (Released in May 2017)■Hash value of sample verified (SHA-256)
2781526f6b302da00661b9a6a625a5a6ecf4ffccafa61202e9b0e9b61b657867

16

FFRI Security, Inc.

Endpoint “Multi-Layer Protection”
Windows 10 includes “Windows Defender” by default
Make your protection more robust by adding unknown threat protection
Unknown Threats

Known Threats

Pattern Matching
Antivirus Software

Vulnerability
Attack Begins

Malware Intrudes
Into System

Malware Attack
BeginsZDP
EngineProtect

Pattern
File

Static Sandbox
Analysis Engine
EngineHIPSEngineMachineLearning
EngineProtect
Protect
Protect
Protect

17

FFRI Security, Inc.

FFRI yarai vs ”Emotet” Malware
In July 2018, "Emotet", malware that selfOccurrence propagates like a warm, is in prevalent/ Reported affecting government institutions andDatecompanies, and a warning has been
issued around the world.

Overview"Emotet" malware was first reported asbanking malware in 2014, however, it has
been modified since to play the role of aloader to download other malware.

AttackDetails"Emotet" first uses a macro in a Word
document. Microsoft Office disables
macros by default, however, the malware
infection starts when a user disregards
the security warning and enables macros.

Detected with Sandbox
engine released 4 months
prior to the occurrence

FFRI yarai blocking “Emotet” Malware■Verification Environment

Windows ７ × FFRI yarai 2.11.4 (Released in March 2018)■ Hash value of sample verified (SHA-256)48fedd8eb8fd95b1c3f3a43fe0ed4ff6e769902b1b7db1f07953455b5ff2c662

18

FFRI Security, Inc.

Track Record of FFRI yarai Protection (Unknown Malware)
Eliminating Malware Threats In Versions Released Before Exploitation In The Wild
Occurrence/
Report Date

Protection Engine
Release Date

Unknown Threat (at the time)and Targeted Attack

July 2019

January 2019

“Sodin” ransomware

HIPS Engine

April 2019

May 2017

Malicious Excel File Impersonating Invoice or Delivery Slip

HIPS Engine

January 2019

March 2018

"Anatova" Ransomware

HIPS Engine

August 2018

March 2018

Malware using Windows task scheduler

July 2018

March 2018

“Emotet” malware

Sandbox Engine

April 2018

June 2017“Satan” ransomware

Static Analysis Engine

April 2018

June 2017“GandCrab” ransomware

HIPS Engine

March 2018

June 2017“Panda Banker” banking malware

HIPS Engine

January 2018

May 2017“SpriteCoin” ransomware

HIPS Engine

January 2018

May 2017“Rapid” ransomware

December 2017

May 2017“CoinMiner” cryptocurrency mining malware

HIPS Engine

December 2017

May 2017

Malware impersonating “Rakuten Card Co., Ltd”

HIPS Engine

October 2017

January 2017

“Bad Rabbit” ransomware

Static Analysis Engine

May 2017

October 2016

“WannaCry/WannaCrypt”ransomware

Static Analysis Engine

January 2017

September 2016

“Mirai”IoTmalware

Static Analysis Engine

June 2015

August 2014

"Emdivi" malware targeting the Japan Pension Service

FFRI yarai Detection &Protection Engine

Static Analysis Engine

Static Analysis Engine(Not published)※The release dates for protection engines are approximately 1 month to 1 year before the unknown threats or targeted attacks occurred. This means that"proactive technology" was used to detect and protect against future threats with a protection engine developed before such threats were even known.
※This protection record was obtained internally based on the results of verification against samples and does not guarantee the detection of all variants.

19

FFRI Security, Inc.

FFRI yarai vs VBScript Vulnerability (CVE-2018-8174)
On May 9th, 2018, Microsoft released a
security update for Windows VBScript
Occurrence Engine Remote Code Execution/ Reported Vulnerability "CVE-2018-8174". Microsoft
Dateannounced the confirmed exploitation in
the wild and urged users to apply the
hotfix immediately.

Overview

This vulnerability allows the remote code
execution when VBScript engine handles
objects in memory.

AttackDetails

In case this vulnerability is exploited, an
attacker could cause various damages
such as:・unexpected termination of application
programs
・an attacker takes control of an affected
systemDetected with ZDP engine
released 5 months prior tothe occurrence

FFRI yarai blocking the vulnerability attack using CVE-2018-8174■Verification Environment

Windows ７ × FFRI yarai 2.11.0 (Released in December 2017)20

FFRI Security, Inc.

Track Record of FFRI yarai Protection (0-day Attacks)
Eliminating Vulnerability Attacks In Versions Released Before Exploitation In The Wild
Occurrence/Report Date

Protection Engine
Release Date

Unknown Threat (at the time)and Targeted Attack

FFRI yarai
Detection & Protection
EngineDecember 2018

March 2018

Adobe Flash Player 0-Day Vulnerability (CVE-201815982)

ZDP Engine

May 2018

December 2017

VBScript Vulnerability (CVE-2018-8174)

ZDP Engine

May 2018

December 2017

Adobe Acrobat, Adobe Reader Vulnerability (CVE2018-4990)

ZDP Engine

January 2018

June 2017

Adobe Flash Player Vulnerability (CVE-2018-4878)

ZDP Engine

January 2017

July 2015

Firefox Vulnerability (CVE-2017-5375)

ZDP Engine

July 2015

November 2013

Adobe Flash Player Vulnerability (CVE-2015-5119,
CVE-2015-5122)

ZDP Engine

June 2015

November 2013

Adobe Flash Player Vulnerability (CVE-2015-3113)

ZDP Engine

January 2015

December 2014

Adobe Flash Player Vulnerability (CVE-2015-0311)

ZDP Engine

November 2014

August 2014

Ichitaro 0-day Vulnerability (CVE-2014-7247)

ZDP Engine

February 2014

November 2013

IE 0-day Vulnerability (CVE-2014-0322)

ZDP Engine* The release dates for protection engines are approximately 2 months to 20 months before the unknown threats or targeted attacks occurred. This means that "proactive technology"
was used to detect and protect against future threats with a protection engine developed before such threats were even known.

21

FFRI Security, Inc.

FFRI yarai License Track Record
Case Studies⚫ Sony Bank Incorporated⚫ Tokushima Prefectural Government⚫ Kanagawa Chuo Kotsu Co., Ltd.
⚫ Hanshin Expressway Company
Limited⚫ Hanshin Expressway R&D Company
Limited⚫ Fujikura Ltd.
⚫ SMBC Nikko Securities(Hong Kong)
Limited
⚫ DENSO Products and Services North
America, Inc.
⚫ Aoyama Gakuin University

Number of Contract Licenses by business

PublicOther67,33823,304
CentralGovernment
Ministries

Telecommu
nication

42,229Industrial
Infrastructure &Services

182,640

747,181

53,948Transportation

Finance Services

102,853

146,556

Other Government Agencies

128,313

Source: <https://ssl4.eir-parts.net/doc/3692/ir_material14/121473/00.pdf>

Academic licenses and OEM product achievements arealso available on the FFRI Security website.
https://www.ffri.jp/products/yarai/example.htm

Trusted to Protect Government &Critical Infrastructure

22

FFRI Security, Inc.

Management Console “FFRI AMC”
"FFRI AMC “ (free of charge) allows to centrally manage clients, log collection,
incidents, malware sample collection and policy distribution
Support Multi-Tenant Environment
ABC
Holdings
ABC
Engineering

ABC Holdings

ABC Engineering

ABC
Services
ABC Services

Effective Data Breach Protection & Security
Monitoring/Operation for Whole Organization•Multiple organizations
can be managed by asingle server•No need to purchaseand configure a server
for each organization saving server cost

Communication/Management
PC•Policy Distribution(including Whitelist)•License•Hash Calculation/Search•Scan

No burdening a network(Periodic communication isapprox. 6KB/every 15 minutes)•Machine Quarantine•Malware Removal•UpdateFFRI AMC•Installation• Sending Logs
• Sending Samples

License CostFree

*Requires FFRI
yarai License

Number of
Clients toManage~30,000

Scalability

SMB toEnterprise

23

FFRI Security, Inc.

EDR (Endpoint Detection and Response) Feature
Bundles EDR features required for operation (no additional charge)
Specializing on simple features such as "Threat Search", "Removal" and “Isolation"
Allows operation without a security specialist
Output Result As Report

Hunting Feature
Investigate if threat exists within
an organization by entering
threat information (malware
hash value) into FFRI AMC andmatching it with hash values infiles on devices

Response Feature
For malware found by the hunting
feature:・Malware Removal
・Isolate device confirmed withmalware infection

Malware Hash Value(SHA256)

Register
Hash Value

FFRI AMC

Search Hush Value
Response• Turn On/Off Hunting Feature
Isolate Device• Hash Value Search
Malware Removal• Isolate Device / Cancel Isolation• Report Generation

EDR
License Cost0

SimpleConfiguration/
Operation

Store Hash Value
Information In Files On
Devices

Shorter Incident
Response Time

*Requires FFRI
yarai License

24

FFRI Security, Inc.

Operating Environment
FFRI yarai
OS

Windows 7
Windows 8.1
Windows 10

Windows Server 2012/2012 R2
Windows Server 2016
Windows Server 2019

■CPU

HardwareEnvironment

1 GHz or higher (Dual Core Required)■Memory
2 GB or higher■Hard Disk
More than 1 GB free space■File System
System and installation drives require NTFS
■Virtual Environment
Supported

FFRI AMC
Windows Server 2012 R2
Windows Server 2016
Windows Server 2019■CPU
4 cores or more
■Memory
8 GB or higher■Hard Disk
At least 100 GB of free space■NIC
GbE* Terms of Use• This is the minimum requirements for a management console server tooperate. The maximum number of clients that AMC is able to handle
depends on the network configuration and server environments.
• Above requirements are approximately for 30,000 clients, and it might
require more than the above depending on the number of clients tomanage.

*Refer to FFRI Security website for further details regarding the operating environments for FFRI yarai and FFRI AMC: https://www.ffri.jp/products/yarai/requirement.htm

Antivirus Software that can co-exist with FFRI yarai (vendor names)
Microsoft, Symantec, McAfee, F-Secure, Sophos, TrendMicro, ESET,*Refer to FFRI Security website for details such as product names and version information: https://www.ffri.jp/products/yarai/requirement.htm*TrendMicro and ESET can coexist only on Japanese OS.

25

FFRI Security, Inc.

Thanks.
2022.11.08
ASEAN-Cyber Business Platform Project Networking Session @Bangkok
Taked by Norihiko MAEDA (norihiko.maeda@ffri.jp)
Director of CEO Office
FFRI Security, Inc.
https://www.ffri.jp/en/index.htm