DOCSLIB.ORG

I N F O R M a T I O N I N F O R M a T I

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
I N F O R M a T I O N I N F O R M a T I THE BANKING MALWARE SCOURGE | INSIDE WINDOWS 7 SECURITY INFORMATIONINFORMATION ECURITY ® S MAY 2010 DATA: Do You Know Where It’s Going? Database activity monitoring keeps watch over your data INFOSECURITYMAG.COM Database protection and compliance made simple. Guardium, an IBM Company, provides the simplest, most robust solution for continuously monitoring access to high-value databases and automating compliance controls for heterogeneous environments – assuring the integrity of trusted information and enabling enterprises to drive smarter business outcomes. • Gain 100% visibility and control over your entire DBMS infrastructure. • Reduce complexity with a single set of cross-DBMS auditing and access control policies. • Enforce separation of duties and eliminate overhead of native DBMS logs. • Monitor privileged users, detect insider fraud and prevent cyberattacks. • Automate vulnerability assessment, data discovery, compliance reporting and sign-offs. For more information, visit www.guardium.com/SearchSecurity Copyright © 2010 Guardium, an IBM company. All rights reserved. Information is subject to change without notice. IBM, and the IBM logo are trademarks of International Business Machines Corporation in the United States, other countries or both. MAY 2010 contentsVOLUME 12 NUMBER 4 FEATURES 19 Data in Check DATABASE ACTIVITY MONITORING Database activity monitoring keeps watch over your data. BY ADRIAN LANE 26 Under Attack MALWARE Cybercriminals are using increasingly stealthy and sophisticated malware to hijack online business banking accounts. BY MARCIA SAVAGE 37 Target: Security and Simplicity OPERATING SYSTEM SECURITY With Windows 7, Microsoft aims to improve security in the enterprise but without the headaches of Vista. BY BETH QUINLAN ALSO 5 EDITOR’S DESK Lacking Details The Cybersecurity Act of 2010 has potential but raises a lot of questions. BY MARCIA SAVAGE 12 SCAN n OWASP Adds Risk to the Equation 9 PERSPECTIVES Organization aims to make Top 10 list of coding errors easier to use by adding risk to the methodology. The Real Risk Equation BY ROBERT WESTERVELT A simplified risk equation helps translate risk to users and allows 14 SNAPSHOT security to partner with the business. BY RON WOERNER Avalanche of Patches 16 INFOSEC LEADERS CAREER ADVICE Take Four Steps Toward an Information Security Career Plan Experts Lee Kushner and Mike Murray explain how having a long-term information security career goal isn’t enough. BY LEE KUSHNER AND MIKE MURRAY 46 Advertising Index 3 INF ORMATION SECURITY May 2010 Courion helps organizations manage risk and demonstrate compliance through: Access certification and compliance management Role management User provisioning Password management Courion’s Access Assurance strategy ensures that only the right people have the right access to the right resources and are doing the right things. This approach increases operational efficiency and trans- parency, strengthens security, and improves compliance, while delivering the industry’s fastest time to value and lowest total cost of ownership. To see how Gartner and Burton recognize Courion, visit: www.courion.com EDITOR’S DESK Lacking Details The Cybersecurity Act of 2010 has potential but raises a lot of questions. BY MARCIA SAVAGE TABLE OF CONTENTS THE ROCKEFELLER-SNOWE cybersecurity legislation is promising on several fronts, but if you actually plow through the bill’s text, you’ll find some questionable provisions and EDITOR’S DESK parts that beg for clarification. To be sure, the new draft of the Cybersecurity Act of 2010 (S. 773) is an improvement over last year’s version, which included an infamous “kill switch” that would give the PERSPECTIVES president the authority to shut down the Internet in the event of a massive cyberattack. The idea went over like a lead balloon and Sen. Jay Rockefeller, who co-sponsored the revised legislation with Sen. Olympia Snowe (R-Maine), was careful to note that it SCAN “does not give any new or broader authority to the president.”However, it does allow tthe president to declare a cybersecurity emergency—without defining what would constitute a cybersecurity emergency. SNAPSHOT Rockefeller says the legislation is designed Rockefeller says the legislation to prepare the U.S. for a major cyberattack by providing a framework for private-public is designed to prepare the CAREERS sector collaboration. Among other things, U.S. for a major cyberattack the bill would support major new R&D into cybersecurity, establish a certification program by providing a framework DATABASE ACTIVITY MONITORING for security professionals, initiate a new cyber- for private-public sector security public awareness campaign, and call on the private sector and government to share collaboration. BANKING MALWARE threat and vulnerability information. Certainly, the bill takes several positive steps. With new threats emerging all the time, more cybersecurity R&D and increased efforts to develop and recruit the next generation WINDOWS 7 of information security pros are critical. And the bill addresses a long-standing sore spot SECURITY in the security industry by supporting research into integrating secure coding into core computer science curriculum. But here’s where it gets sketchy. The legislation also includes a plan for “positive SPONSOR RESOURCES recognition” for critical infrastructure companies that report compliance with cyber- security risk measurement techniques and best practices. NIST is designated as the body to recognize and promote these best practices, but it’s unclear what they would be. Moreover, how many companies would be eager to publicly proclaim themselves secure? What about a company that doesn’t receive the positive recognition? Either way, a company could become a target for hackers based on public disclosure about the state of their security, says Paul Rohmeyer, a faculty member in the graduate school at Stevens Institute of Technology and consultant. “It’s a bad idea all around,”he says. The legislation also doesn’t account for differences between industries and doesn’t 5 INFORMATION SECURITY May 2010 describe how it relates to existing mandates such as Gramm-Leach-Bliley, Sarbanes- Oxley and HIPAA, Rohmeyer says. Also, the creation of a training and certification program for critical infrastructure security pros will create a huge market for trainers, he adds, but there’s no provision for how the trainers themselves would be qualified. Other parts of the bill—like the call for public-private collaboration on cyber- security and information sharing—are nothing new. Perhaps giving cleared private sector executives access to classified threat information, as the legislation proposes, TABLE OF CONTENTS would make a difference. However, as industry analyst Richard Stiennon points out, the FBI’s InfraGard already provides businesses with threat information. Ultimately, how much the Cybersecurity Act would prepare the country for a EDITOR’S DESK cyberattack is anybody’s guess. Rohmeyer for one isn’t convinced it would help. He’s hesitant to be too critical—cybersecurity legislation is needed and this bill is generally headed in the right direction, he says—but it leaves too many unanswered questions. PERSPECTIVES “If I’m a compliance officer in a company that’s in one of the critical infrastructure industries, I don’t know what my obligations are under this law,”he says. The Rockefeller-Snowe cybersecurity legislation is a good start but needs some SCAN work to truly address the country’s pressing cybersecurity needs and not create more compliance headaches for businesses.w SNAPSHOT Marcia Savage is editor of Information Security. Send comments on this column to [email protected]. CAREERS DATABASE ACTIVITY MONITORING BANKING MALWARE WINDOWS 7 SECURITY SPONSOR RESOURCES 6 INFORMATION SECURITY May 2010 COMING IN JUNE Endpoint Cloud Governance, Risk TABLE OF CONTENTS Encryption Computing Risks and Compliance EDITOR’S DESK PERSPECTIVES Increasingly mobile workforces Business managers are eager Governance, risk and compli- mean more sensitive customer to move enterprise operations ance is a term that’s been SCAN and corporate data floating to a cloud computing model hyped in the industry to the around on laptops outside the in order to cut costs. However, point where it’s become a enterprise. A lost or missing security managers remain catch-all phrase for most infor- SNAPSHOT laptop could have costly and wary of the risks associated mation security strategies and damaging consequences. But with cloud computing. In this various products. The promises CAREERS organizations can protect data feature, we’ll examine how of GRC—reduced risk and on laptops — and avoid breach enterprise risks change with streamlined compliance—were notification requirements - with cloud computing, what use obscured. This feature will look DATABASE ACTIVITY encryption. This feature will cases are best suited for the at how an organization can MONITORING examine the different types of cloud, and what information successfully develop a GRC laptop encryption available, security pros should do to program to achieve those goals. BANKING MALWARE including full disk, file/folder, prepare for moving into the It will offer strategic advice for and pre-encrypted drives. It cloud. We’ll also look at enterprise security managers also will cover deployment emerging standards for and include an examination of WINDOWS 7 SECURITY options (key management cloud computing. tools and frameworks in the and policy management) and GRC market. look at
Load more

Recommended publications
  • Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G
    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines.
    [Show full text]
  • Éric FREYSSINET Lutte Contre Les Botnets
    THÈSE DE DOCTORAT DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Spécialité Informatique École doctorale Informatique, Télécommunications et Électronique (Paris) Présentée par Éric FREYSSINET Pour obtenir le grade de DOCTEUR DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Sujet de la thèse : Lutte contre les botnets : analyse et stratégie Présentée et soutenue publiquement le 12 novembre 2015 devant le jury composé de : Rapporteurs : M. Jean-Yves Marion Professeur, Université de Lorraine M. Ludovic Mé Enseignant-chercheur, CentraleSupélec Directeurs : M. David Naccache Professeur, École normale supérieure de thèse M. Matthieu Latapy Directeur de recherche, UPMC, LIP6 Examinateurs : Mme Clémence Magnien Directrice de recherche, UPMC, LIP6 Mme Solange Ghernaouti-Hélie Professeure, Université de Lausanne M. Vincent Nicomette Professeur, INSA Toulouse Cette thèse est dédiée à M. Celui qui n’empêche pas un crime alors qu’il le pourrait s’en rend complice. — Sénèque Remerciements Je tiens à remercier mes deux directeurs de thèse. David Naccache, officier de réserve de la gendarmerie, contribue au développement de la recherche au sein de notre institution en poussant des personnels jeunes et un peu moins jeunes à poursuivre leur passion dans le cadre académique qui s’impose. Matthieu Latapy, du LIP6, avec qui nous avions pu échanger autour d’une thèse qu’il encadrait dans le domaine difficile des atteintes aux mineurs sur Internet et qui a accepté de m’accueillir dans son équipe. Je voudrais remercier aussi, l’ensemble de l’équipe Réseaux Complexes du LIP6 et sa responsable d’équipe actuelle, Clémence Magnien, qui m’ont accueilli à bras ouverts, accom- pagné à chaque étape et dont j’ai pu découvrir les thématiques et les méthodes de travail au fil des rencontres et des discussions.
    [Show full text]
  • The Botnet Chronicles a Journey to Infamy
    The Botnet Chronicles A Journey to Infamy Trend Micro, Incorporated Rik Ferguson Senior Security Advisor A Trend Micro White Paper I November 2010 The Botnet Chronicles A Journey to Infamy CONTENTS A Prelude to Evolution ....................................................................................................................4 The Botnet Saga Begins .................................................................................................................5 The Birth of Organized Crime .........................................................................................................7 The Security War Rages On ........................................................................................................... 8 Lost in the White Noise................................................................................................................. 10 Where Do We Go from Here? .......................................................................................................... 11 References ...................................................................................................................................... 12 2 WHITE PAPER I THE BOTNET CHRONICLES: A JOURNEY TO INFAMY The Botnet Chronicles A Journey to Infamy The botnet time line below shows a rundown of the botnets discussed in this white paper. Clicking each botnet’s name in blue will bring you to the page where it is described in more detail. To go back to the time line below from each page, click the ~ at the end of the section. 3 WHITE
    [Show full text]
  • Symantec White Paper
    QUARTERLY REPORT: SYMANTEC ENTERPRISE SECURITY SYMANTEC REPORT: QUARTERLY Symantec Intelligence Quarterly July - September, 2009 Published October 2009 Technical Brief: Symantec Enterprise Security Symantec Intelligence Quarterly July - September, 2009 Contents Introduction . 1 Highlights . 2 Metrics. 2 Meeting the Challenge of Sophisticated Attacks . 8 Timeline of a zero-day event . 8 How secure are security protocols?. 11 Why attackers use packers. 14 Protection and Mitigation . 16 Appendix A—Best Practices . 18 Appendix B—Methodologies. 20 Credits . 24 Symantec Intelligence Quarterly July - September, 2009 Introduction Symantec has established some of the most comprehensive sources of Internet threat data in the world through the Symantec™ Global Intelligence Network. More than 240,000 sensors in over 200 countries monitor attack activity through a combination of Symantec products and services such as Symantec DeepSight™ Threat Management System, Symantec™ Managed Security Services and Norton™ consumer products, as well as additional third-party data sources. Symantec also gathers malicious code intelligence from more than 130 million client, server, and gateway systems that have deployed its antivirus products. Additionally, the Symantec distributed honeypot network collects data from around the globe, capturing previously unseen threats and attacks and providing valuable insight into attacker methods. Spam data is captured through the Symantec probe network, a system of more than 2.5 million decoy email accounts, Symantec MessageLabs™ Intelligence, and other Symantec technologies in more than 86 countries from around the globe. Over 8 billion email messages, as well as over 1 billion Web requests, are scanned per day across 16 data centers. Symantec also gathers phishing information through an extensive antifraud community of enterprises, security vendors, and more than 50 million consumers.
    [Show full text]
  • Ilomo Botnet a Study of the Ilomo / Clampi Botnet
    Ilomo A study of the Ilomo / Clampi botnet Ilomo Botnet A study of the Ilomo / Clampi Botnet by Alice Decker: Network Analysis David Sancho: Reverse Engineering Max Goncharov: Network Analysis Robert McArdle: Project Coordinator Release Date: 20 August 2009 Classification: Public Ilomo A study of the Ilomo / Clampi botnet Table of Contents Introduction ........................................................................................................................................................... 3 Ilomo Analysis ....................................................................................................................................................... 4 Stage 1: Dropper ....................................................................................................................................... 4 Stage 2: Main Executable ........................................................................................................................ 7 Stage 3: Injected Code ............................................................................................................................ 12 VMProtect Obfuscator ........................................................................................................................................ 17 Background Information .......................................................................................................................... 17 Technical Information .............................................................................................................................
    [Show full text]
  • Ronald L. Chichester*
    30990-txb_44-1 Sheet No. 4 Side A 02/01/2012 14:53:16 ZOMBIES (DO NOT DELETE) 10/27/2011 12:39 PM SLAYING ZOMBIES IN THE COURTROOM:TEXAS ENACTS THE FIRST LAW DESIGNED SPECIFICALLY TO COMBAT BOTNETS Ronald L. Chichester* I. INTRODUCTION ............................................................................................... 2 II. WHAT IS A BOTNET? ...................................................................................... 2 III. ZOMBIFICATION—CREATING THE BOTNET ............................................ 3 IV. OTHER CURRENT COMPUTER MISUSE STATUTES ................................. 4 V. A SHORT DESCRIPTION OF THE FIRST ANTI-BOTNET STATUTE ........ 6 VI. UTILIZING S.B. 28—THE CAUSE OF ACTION ............................................ 8 VII. GATHERING THE EVIDENCE ........................................................................ 9 VIII. FINDING THE PERPETRATOR(S) .................................................................. 9 IX. CONCLUSIONS ............................................................................................... 10 X. APPENDIX A ................................................................................................... 10 30990-txb_44-1 Sheet No. 4 Side A 02/01/2012 14:53:16 * Ron Chichester is an attorney, a certified computer forensic examiner, and an Adjunct Professor at the University of Houston Law Center, where he teaches “Digital Transaction” (www.digitaltransactions.info). Ron is admitted to practice in the State of Texas, the U.S. Courts for the Southern District of
    [Show full text]
  • The Customer As a Target Risks of Phishing and Trojans
    The Customer as a Target Risks of Phishing and Trojans Gijs Hollestelle | Deloitte Netherlands January 31, 2012 © 2012 Deloitte Touche Tohmatsu History of Computer Crime (1/2) •1980‟s • First worm: Morris Worm • Phone Phreaking • BBS Hacking boards • Movie: Wargames • Computer hacking was primarily done by people in universities to find out how things worked •1990‟s: • Real start of computer crime, targeting financial institutions • Succesful hacks of various banks, phone companies, etc • Kevin Mitnick convicted • 2000‟s / Today • Early 2000‟s examples of „Hobby‟ projects, everyone can be a hacker. I love You/Kournikova Virus • Late 2000‟s Professionalization of computer crime • Internet banking and online shopping become popular, leading to increased incentive to use computer crime for financial gain • Avanced trojans • Shift of hacking companies to hacking consumers • Sophisticated trojans/virusses such as Zeus and Stuxnet 2 © 2012 Deloitte Touche Tohmatsu History of Computer Crime (2/2) 3 © 2012 Deloitte Touche Tohmatsu The Underground Economy (1/2) Some recent figures • Dutch Association of Banks (NVB) released information that in 2012 Internet banking fraud was 9.8 mln euro. • In first half of 2011 alone, this has increased to 11.2 mln euro. • In Germany Internet banking fraud is estimated at 17mln euro in 2012 • In the UK 60mln pounds in Internet Crime in 2009 4 © 2012 Deloitte Touche Tohmatsu The Underground Economy (2/2) Where are these identities sold? Source: krebsonsecurity.com 5 © 2012 Deloitte Touche Tohmatsu The Logic of the Cyber Criminal • Stricter regulations such as PCI have forced companies have forced companies to further increase their security measures.
    [Show full text]
  • Understanding and Analyzing Malicious Domain Take-Downs
    Cracking the Wall of Confinement: Understanding and Analyzing Malicious Domain Take-downs Eihal Alowaisheq1,2, Peng Wang1, Sumayah Alrwais2, Xiaojing Liao1, XiaoFeng Wang1, Tasneem Alowaisheq1,2, Xianghang Mi1, Siyuan Tang1, and Baojun Liu3 1Indiana University, Bloomington. fealowais, pw7, xliao, xw7, talowais, xm, [email protected] 2King Saud University, Riyadh, Saudi Arabia. [email protected] 3Tsinghua University, [email protected] Abstract—Take-down operations aim to disrupt cybercrime “clean”, i.e., no longer involved in any malicious activities. involving malicious domains. In the past decade, many successful Challenges in understanding domain take-downs. Although take-down operations have been reported, including those against the Conficker worm, and most recently, against VPNFilter. domain seizures are addressed in ICANN guidelines [55] Although it plays an important role in fighting cybercrime, the and in other public articles [14, 31, 38], there is a lack of domain take-down procedure is still surprisingly opaque. There prominent and comprehensive understanding of the process. seems to be no in-depth understanding about how the take-down In-depth exploration is of critical importance for combating operation works and whether there is due diligence to ensure its cybercrime but is by no means trivial. The domain take-down security and reliability. process is rather opaque and quite complicated. In particular, In this paper, we report the first systematic study on domain it involves several steps (complaint submission, take-down takedown. Our study was made possible via a large collection execution, and release, see SectionII). It also involves multiple of data, including various sinkhole feeds and blacklists, passive parties (authorities, registries, and registrars), and multiple DNS data spanning six years, and historical WHOIS informa- domain management elements (DNS, WHOIS, and registry tion.
    [Show full text]
  • Symantec Intelligence Report: June 2011
    Symantec Intelligence Symantec Intelligence Report: June 2011 Three-quarters of spam send from botnets in June, and three months on, Rustock botnet remains dormant as Cutwail becomes most active; Pharmaceutical spam in decline as new Wiki- pharmacy brand emerges Welcome to the June edition of the Symantec Intelligence report, which for the first time combines the best research and analysis from the Symantec.cloud MessageLabs Intelligence Report and the Symantec State of Spam & Phishing Report. The new integrated report, the Symantec Intelligence Report, provides the latest analysis of cyber security threats, trends and insights from the Symantec Intelligence team concerning malware, spam, and other potentially harmful business risks. The data used to compile the analysis for this combined report includes data from May and June 2011. Report highlights Spam – 72.9% in June (a decrease of 2.9 percentage points since May 2011): page 11 Phishing – One in 330.6 emails identified as phishing (a decrease of 0.05 percentage points since May 2011): page 14 Malware – One in 300.7 emails in June contained malware (a decrease of 0.12 percentage points since May 2011): page 15 Malicious Web sites – 5,415 Web sites blocked per day (an increase of 70.8% since May 2011): page 17 35.1% of all malicious domains blocked were new in June (a decrease of 1.7 percentage points since May 2011): page 17 20.3% of all Web-based malware blocked was new in June (a decrease of 4.3 percentage points since May 2011): page 17 Review of Spam-sending botnets in June 2011: page 3 Clicking to Watch Videos Leads to Pharmacy Spam: page 6 Wiki for Everything, Even for Spam: page 7 Phishers Return for Tax Returns: page 8 Fake Donations Continue to Haunt Japan: page 9 Spam Subject Line Analysis: page 12 Best Practices for Enterprises and Users: page 19 Introduction from the editor Since the shutdown of the Rustock botnet in March1, spam volumes have never quite recovered as the volume of spam in global circulation each day continues to fluctuate, as shown in figure 1, below.
    [Show full text]
  • An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers
    applied sciences Article An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers Riaz Ullah Khan 1,* , Xiaosong Zhang 1, Rajesh Kumar 1 , Abubakar Sharif 1, Noorbakhsh Amiri Golilarz 1 and Mamoun Alazab 2 1 Center of Cyber Security, School of Computer Science & Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China; [email protected] (X.Z.); [email protected] (R.K.); [email protected] (A.S.); [email protected] (N.A.G.) 2 College of Engineering, IT and Environment, Charles Darwin University, Casuarina 0810, Australia; [email protected] * Correspondence: [email protected]; Tel.: +86-155-2076-3595 Received: 19 March 2019; Accepted: 24 April 2019; Published: 11 June 2019 Abstract: In recent years, the botnets have been the most common threats to network security since it exploits multiple malicious codes like a worm, Trojans, Rootkit, etc. The botnets have been used to carry phishing links, to perform attacks and provide malicious services on the internet. It is challenging to identify Peer-to-peer (P2P) botnets as compared to Internet Relay Chat (IRC), Hypertext Transfer Protocol (HTTP) and other types of botnets because P2P traffic has typical features of the centralization and distribution. To resolve the issues of P2P botnet identification, we propose an effective multi-layer traffic classification method by applying machine learning classifiers on features of network traffic. Our work presents a framework based on decision trees which effectively detects P2P botnets. A decision tree algorithm is applied for feature selection to extract the most relevant features and ignore the irrelevant features.
    [Show full text]
  • Improving the Effectiveness of Behaviour-Based Malware Detection
    Improving the Effectiveness of Behaviour-based Malware Detection Mohd Fadzli Marhusin BSc. Information Studies (Hons) (Information Systems Management) UiTM, Malaysia Master of Information Technology (Computer Science) UKM, Malaysia A thesis submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy at the School of Engineering and Information Technology University of New South Wales Australian Defence Force Academy Copyright 2012 by Mohd Fadzli Marhusin PLEASE TYPE THE UNIVERSITY OF NEW SOUTH WALES Thesis/Dissertation Sheet Surname or Family name: MARHUSIN First name: MOHD FADZLI Other name/s: Abbreviation for degree as given in the University calendar: PhD (Computer Science) School: School of Engineering and Information Technology (SEIT) Faculty: Title: Improving the Effectiveness of Behaviour-based Malware Detection Abstract 350 words maximum: (PLEASE TYPE) Malware is software code which has malicious intent but can only do harm if it is allowed to execute and propagate. Detection based on signature alone is not the answer, because new malware with new signatures cannot be detected. Thus, behaviour-based detection is needed to detect novel malware attacks. Moreover, malware detection is a challenging task when most of the latest malware employs some protection and evasion techniques. In this study, we present a malware detection system that addresses both propagation and execution. Detection is based on monitoring session traffic for propagation, and API call sequences for execution. For malware detection during propagation, we investigate the effectiveness of signature-based detection, anomaly-based detection and the combination of both. The decision-making relies upon a collection of recent signatures of session-based traffic data collected at the endpoint level.
    [Show full text]
  • Monthly Report on Online Threats in The
    MONTHLY REPORT ON ONLINE THREATS REPORTING PERIOD: IN THE BANKING SECTOR 19.04–19.05.2014 One of the main events during the reporting period was the leakage of payment credentials belonging to eBay users. Details of the incident and other detected threats can be found in the section ‘Key events in the online banking sphere’ below. Overall statistics During the reporting period, Kaspersky Lab solutions blocked 341,216 attempts on user computers to launch malware capable of stealing money from online banking accounts. This figure represents a 36.6% increase compared to the previous reporting period (249,812). This increase in banking malware activity is most likely related to the onset of the vacation season, when customers actively use their payment data to make all types of purchases online. 24 001 - 78 000 16 001 - 24 000 7101 - 16 000 2101 - 7100 1 - 2100 Number of users targeted by banking malware The number of users attacked using these types of programs during the reporting period is shown in the diagram below (Top 10 rating based on the number of users attacked, in descending order): 77,412 27,071 21,801 22,115 13,876 15,651 17,333 5417 6883 7347 France Vietnam Austria India Germany United USA Russian Italy Brazil Kingdom Federation © 1997-2014 Kaspersky Lab ZAO. All Rights Reserved. The table below shows the programs most commonly used to attack online banking users, based on the number of infection attempts: Total notifications of Verdict* Number of users Number of notifications attempted infections by Trojan-Spy.Win32.Zbot 198
    [Show full text]