DOCSLIB.ORG

Antimalware to the Rescue

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Antimalware to the Rescue MARCH 2014 INFORMATION EDITOR’S DESK: AS MALWARE ADVANCES, SO MUST ECURITY ANTIMALWARE S Insider Edition DEFENSE PLANS FEATURE: PROTECTION FROM ADVANCED MALWARE: WHAT ANTIMALWARE WORKS BEST? TO THE RESCUE InfoSec pros know they must detect and repel advanced FEATURE: HOW malware—but TO PUMP UP YOUR do they know ANTIMALWARE how? DEFENSES EDITOR’S DESK As Malware Advances, So Must HOME EDITOR’S DESK Antimalware Defense Plans WHY YOU MUST Stomping out malware would be lots easier if it just sat still. This Insider REVAMP YOUR BY BRENDA L. HORRIGAN ANTIMALWARE Edition helps make the fight against it more fair. STRATEGY WHAT ADVANCED MALWARE PROTECTION WORKS BEST? PUMPING UP YOUR ANTIMALWARE DEFENSE T’S GETTING HARDER for IT security pros to identify, offers insights on how to best assess the antimalware much less stop, the bad stuff trying to break into products currently on the market, which must include their enterprise. Modern malware is a shape-shifter, a careful weighing of costs and benefits. Finally, Spyro continually changing as it tries to squeeze past the Malaspinas demonstrates how to pump up your antimal- malware protection an enterprise already has in ware arsenal with supplemental products and tactics. place. Lately it’s even grown octopus legs, reaching up to It’s a sad fact of the modern world that, even as more Ithe highest levels of corporate networks but also down enterprises come to depend on antimalware products, into the smartphone of the newest entry-level employee. that protection’s effectiveness is steadily declining. But Advanced malware and its hacker-creators are prob- this doesn’t mean antimalware efforts are for naught: ing your system defenses right now; a revamp of your en- Rather, like modern malware, your efforts must shift and terprise’s antimalware strategies and systems can’t wait. stretch to keep your enterprise security intact. n That’s the message of this Insider Edition, which opens with emerging-technology expert Lisa Phifer on why we must think and strategize differently in order to defeat BRENDA L. HORRIGAN is the associate managing editor for the malware. In part two, Pete Lindstrom of Spire Security Security Media Group. 2 INFORMATION SECURITY INSIDER EDITION / ANTIMALWARE n MARCH 2014 COVER STORY: REVAMP STRATEGY HOME REQUIRED: EDITOR’S DESK WHY YOU MUST A REVAMPED REVAMP YOUR ANTIMALWARE STRATEGY ANTIMALWARE WHAT ADVANCED WHILE IT CONTINUES to fight increasingly clever attacks MALWARE PROTECTION against on-site enterprise infrastructure, new malware is WORKS BEST? STRATEGY taking aim at lower-hanging fruit: under-secured smart- PUMPING UP YOUR Increasingly sophisticated phones, mobile applications, social media and other cloud ANTIMALWARE services. As workers make more extensive use of such DEFENSE malware can divert the perimeter-less platforms, they create rich targets that re- attention of IT departments quire new antimalware protection strategies to mitigate from low-level security gaps. these multifaceted new malware threats. Here’s why you need a Enterprises can defend themselves by understanding these new malware vectors, enforcing application poli- strategy that works on cies, implementing new device-resident and cloud-based all levels. antimalware techniques, and leveraging other security tools. FOLLOWING THE MONEY Far more than fame or hacktivism, the malware industry is driven by financial gain and drawn to low-cost, high- profit attacks. This has been repeatedly proven, as mal- ware migrated from floppy to USB drives, email to Web, By Lisa Phifer browser to PDF, abandoning old haunts to seek out more vulnerable monocultures. 3 INFORMATION SECURITY INSIDER EDITION / ANTIMALWARE n MARCH 2014 COVER STORY: REVAMP STRATEGY “As technology trends such as Web and mobile come development. Attackers are experimenting with what HOME to the forefront, that’s where malware refocuses,” says In- they can do, inside and outside the enterprise. We haven’t EDITOR’S DESK trepidus Group Principal Consultant Zach Lanier. “Mo- yet seen massive self-replicating mobile malware, but we bile convergence creates an interesting opportunity: one think that’s mostly because nobody has hit on a business WHY YOU MUST device that delivers [non-stop] network, Web, media and model for untargeted attacks, beyond toll fraud,” he says. REVAMP YOUR ANTIMALWARE application access. Because there are only so many play- Symantec tracked mobile malware monetization, in- STRATEGY ers—Apple, Google, the WebKit browser engine—a sin- cluding premium-rate SMS trojans, tracking spyware, WHAT ADVANCED gle bug can be leveraged to attack millions of users.” search engine poisoning, pay-per-install/click schemes, MALWARE PROTECTION In fact, cloud services like Google Apps “are a very repackaged adware, and identity theft. According to Prod- WORKS BEST? large data repository for a wide range of companies and uct Manager John Engels, “We used to see these for Sym- PUMPING UP YOUR people,” Cisco Senior Threat Researcher Mary Landes- bian. When iOS changed the landscape, Apple did a good ANTIMALWARE man says. “Rather than trying to penetrate one [business] job of building in [malware deterrents] such as sandbox- DEFENSE at a time, cloud is an avenue of attack to penetrate many. ing and AppStore review. Now Android is picking up Increased return on investment means making money where Symbian left off because it’s open, with alternative with less effort—cloud attacks are a natural progression distribution paths that are a recipe for more challenging of that.” malware.” Similar trends have been seen in malicious activity on LOOKING FOR LOOPHOLES: social networks such as Facebook. “[Social media] mal- MOBILE MALWARE AND SOCIAL MEDIA ware tends to be user-focused: looking to gain access to Size and popularity are not the only draws. Commingled the user’s account or credentials,” Cisco’s Landesman personal and business use, real-time communication, says. “Today’s biggest enterprise threats don’t evolve from bring-your-own consumerization, and little or no IT con- social networks, but at some point, those could morph trol combine to make any discovered vulnerabilities more into more targeted attacks.” readily exploitable. For now, social media attacks tend to be untargeted. Lookout Principal Engineer Tim Wyatt has examined M86 Security Labs reports that Facebook scams surged in thousands of mobile applications from Apple’s AppStore, recent years as attackers searched for new ways to con- Google’s Android market and unofficial markets. “We’re vince thousands to click on malicious links. From “like- still seeing the start-up phase of smartphone malware jacking” and “comment-jacking” to photo tagging and 4 INFORMATION SECURITY INSIDER EDITION / ANTIMALWARE n MARCH 2014 COVER STORY: REVAMP STRATEGY rogue applications, social engineering tricks snared users thousands of victims. Shortened links, trend tags, and HOME into pay-per-click or pay-per-install scams—some lead- direct messaging further increase the odds of following EDITOR’S DESK ing to malware like the Koobface botnet Trojan. Facebook tweets to malware. itself scans over a trillion clicks per day, blocking more As more businesses use Twitter to track industry WHY YOU MUST than 200 million posts and messages carrying malicious news and communicate with customers, associated risk is REVAMP YOUR ANTIMALWARE links. growing. Not only do less than one-quarter of enterprises STRATEGY block Twitter, but “companies cannot assume they don’t WHAT ADVANCED SOCIAL MEDIA SECURITY RISKS have a social networking presence,” Cisco’s Landesman MALWARE PROTECTION For IT groups scrambling to stop malware on so many says. “Nothing from a technology standpoint will solve WORKS BEST? different fronts, deciding which threats to tackle can be this. You’re better off having practices in place to deter- PUMPING UP YOUR a challenge. The best place to begin is by understanding mine what’s being said about your company and your ANTIMALWARE emerging malware: targeted platforms, exploited vulner- tone and action plan should a social networking crisis DEFENSE abilities, and jeopardized business assets. develop.” Such practices might involve rapidly detecting “Recently, the biggest threats have not attacked com- and reporting tweets that reference your brand but carry puters—they’ve attacked people,” says Symantec Security links leading to malware. Response Director Kevin Haley. “We’re seeing [email] Facebook too has been plagued by phishing attacks. spam drop as attackers move to social media. Factors in- However, Facebook tends to be more personal, result- clude shutdown of major botnets, growing ineffectiveness ing in individual rather than business risk. But millennial of spam, and natural migration to new vectors. Technol- expect to use Facebook and other social networks 24/7: ogy itself hasn’t changed that much; social engineering Over half of surveyed college students said they would not got better and toolkits made malware easier.” even consider taking a job with an employer that banned To date, social media malware has gotten the big- access. Rampant password reuse and bring-your-own de- gest bang by aiming at Facebook, Twitter, and YouTube. vices also mean credentials gleaned by Facebook malware For example, Twitter’s brevity, anonymity, and real-time could well play a role in corporate account break-ins. communication have fostered many hacks since 2007— some involving account compromise, others malware WORKFORCE AND MALWARE MOBILITY dissemination. The two are intertwined, as legitimate In fact, consumer mobile network attack rates are sky- and fraudulent top-followed accounts are used to phish rocketing, driven largely by employee-owned devices. 5 INFORMATION SECURITY INSIDER EDITION / ANTIMALWARE n MARCH 2014 COVER STORY: REVAMP STRATEGY According McAfee Senior Architect Igor Muttik, these four percent, compared to risk of clicking on a phishing HOME unmanaged smartphones and tablets pose real enterprise link at 36 percent. EDITOR’S DESK risk. Tim Armstrong, a researcher for Kaspersky, believes “Mobile devices are no longer just phones; they are a tipping point has been reached for Android malware.
Load more

Recommended publications
  • The Use of the Modern Social Web by Malicious Software
    Malicious software thrives in the richness of the social web ecosystem, which incorporates mobile devices, reliable networks, powerful browsers and sociable users. Modern malware is programmed to take full advantage of these elements, which are especially potent in the context of social media and social networking websites. As the result, we’re seeing malware exhibit the following characteristics: • Using social networking sites to remotely direct malicious tools and attackers' actions • Controlling social media site content to provide attackers with financial rewards • Distributing links on websites with social capabilities to for autonomous malware propagation • Defrauding participants of the social web by using chat bots and other techniques Read this briefing to understand how malicious software makes use of these techniques to thrive on the social web and to offer lucrative benefits to malware authors and operators. Together, we can better understand such emerging threat vectors and devise defenses. Copyright 2011‐2012 Lenny Zeltser 1 Social capabilities of modern websites and applications are changing how people communicate with each other and how businesses interact with customers. The social web incorporates sites that allow people to easily publish content and distribute public, private and semi‐private messages. This includes traditional blogging platforms such as Blogger, micro blogs such as Tumblr, photo sharing sites such as Flickr and social networking sites such as Facebook. We increasingly rely on the social web for both routine and crisis‐related interactions. The attackers are also paying attention to this medium. Copyright 2011‐2012 Lenny Zeltser 2 Authors and operators of malware are paying increasing attention to social media and social networking sites for conducting malicious activities.
    [Show full text]
  • MALWARE PROPAGATION in ONLINE SOCIAL NETWORKS: MODELING, ANALYSIS and REAL-WORLD IMPLEMENTATIONS
    MALWARE PROPAGATION IN ONLINE SOCIAL NETWORKS: MODELING, ANALYSIS and REAL-WORLD IMPLEMENTATIONS Mohammad Reza Faghani A DISSERTATION SUBMITTED TO THE FACULTY OF GRADUATE STUDIES IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY GRADUATE PROGRAM IN ELECTRICAL ENGINEERING AND COMPUTER SCIENCE (EECS) YORK UNIVERSITY TORONTO, ONTARIO June 2017 c Mohammad Reza Faghani, 2017 Abstract The popularity and wide spread usage of online social networks (OSNs) have attracted hackers and cyber criminals to use OSNs as an attack platform to spread malware. Over the last few years, Facebook users have experienced hundreds of malware attacks. A successful attack can lead to tens of millions of OSN accounts being compromised and computers being infected. Cyber criminals can mount massive denial of service attacks against Internet infrastructures or systems using compromised accounts and computers. Malware infecting a user's computer have the ability to steal login credentials and other confidential information stored on the computer, install ransomware and infect other computers on the same network. Therefore, it is important to understand propagation dynamics of malware in OSNs in order to detect, contain and remove them as early as possible. The objective of this dissertation is thus to model and study propagation dynamics of various types of malware in social networks such as Facebook, LinkedIn and Orkut. In particular, we propose analytical models that characterize propagation dynamics of cross-site • scripting and Trojan malware, the two major types of malware propagating in OSNs. Our models assume the topological characteristics of real-world social networks, namely, low average shortest distance, power-law distribution of node degrees and high cluster- ing coefficient.
    [Show full text]
  • Cisco 2017 Midyear Cybersecurity Report
    Cisco 2017 Midyear Cybersecurity Report 1 Executive Summary Table of Contents Executive Summary ..........................................................03 Vulnerabilities update: Rise in attacks following key disclosures ................................................................ 47 Major Findings ..................................................................05 Don’t let DevOps technologies leave the Introduction ......................................................................07 business exposed ............................................................ 50 Attacker Behavior .............................................................09 Organizations not moving fast enough to patch Exploit kits: Down, but not likely out ................................. 09 known Memcached server vulnerabilities ......................... 54 How defender behavior can shift attackers’ focus ...........11 Malicious hackers head to the cloud to shorten the path to top targets ..................................................... 56 Web attack methods provide evidence of a mature Internet ............................................................. 12 Unmanaged infrastructure and endpoints leave organizations at risk ......................................................... 59 Web block activity around the globe ................................ 13 Security Challenges and Opportunities Spyware really is as bad as it sounds............................... 14 for Defenders ...................................................................61
    [Show full text]
  • Cisco Midyear Cybersecurity Report 2017
    Cisco Midyear Cybersecurity Report 2017 1 Inhalt Zusammenfassung .........................................................3 Veröffentlichung von Schwachstellen führt Wichtigste Erkenntnisse ................................................5 zu vermehrten Angriffen ...............................................47 Einleitung ........................................................................7 Setzen Sie Ihr Geschäft keinem Risiko durch DevOps-Technologien aus ............................................50 Verhalten von Angreifern ...............................................9 Organisationen führen Patches für bekannte Exploit-Kits: viele inaktiv, aber nicht alle .........................9 Schwachstellen von Memchached-Servern Der Einfluss des Verhaltens der Verteidiger nicht schnell genug durch .............................................54 auf die Nutzung anderer Angriffsstrategien ................. 11 Hacker wenden sich der Cloud zu, um attraktive Web-Angriffsmethoden entwickeln sich gemeinsam Ziele schneller zu attackieren ........................................56 mit dem Internet ...........................................................12 Nicht verwaltete Infrastrukturen und Endpunkte Weltweite Blockierungsaktivität im Web ........................13 stellen Risiken für Organisationen dar ...........................59 Spyware ist wirklich so schlimm, wie sie klingt .............14 Herausforderungen in puncto Sicherheit und Möglichkeiten für Verteidiger ...............................61 Rückgang der Exploit-Kit-Aktivität wirkt
    [Show full text]
  • Social Media As an Attack Vector for Cyber Threats
    Social Threats – Social Media as an Attack vector for Cyber Threats Stewart Cawthray General Manager, Enterprise Security Products & Solutions February 10, 2017 1 #WHOAMI • General Manager Security Products – Rogers Enterprise • 15 Year Security Veteran • Industry Speaker & Cybersecurity Evangelist • Devoted Father & Field Hockey Coach • Twitter: @StewartCawthray 2 Confidential & Proprietary #WhatWeDo Rogers Security Services Enterprise Cybersecurity Protection for Businesses of All Sizes 3 Confidential & Proprietary THE SOCIAL REVOLUTION 4 Confidential & Proprietary GLOBAL SCALE OF SOCIAL MEDIA 95% 3/4 US WORKING AGE ARE ACTIVE ON WORLDWIDE INTERNET USERS SOCIAL MEDIA HAVE ACTIVE SOCIAL PROFILES 5 Confidential & Proprietary IMPACT ON DAILY LIVES 27% 3 HOURS INTERNET TIME SPENT EVERY DAY SPENT ON ON SOCIAL MEDIA SOCIAL MEDIA 6 Confidential & Proprietary IMPACT ON ECONOMY 50% 25% OF AMERICAN’S LEVERAGE IS PINTEREST’S SHARE OF FACEBOOK FOR PURCHASE INTERNET RETAIL REFERRAL DECISIONS TRAFFIC 7 Confidential & Proprietary SOCIAL MEDIA THE BUSINESS PLATFORM Confidential & Proprietary 8 SOCIAL CREATES BUSINESS VALUE 40% Increase in performance for social brands vs. S&P 500 60% buying decisions made on perception of brand vs. product or service quality 9 Confidential & Proprietary MASSIVE INVESTMENT INTO SOCIAL Enterprise CMOs to spend 10.8% of marketing budget on social in next 12 months growing to 22.4% in five years. 57.5% are worried that use of online customer data could raise questions about privacy. Source – Duke Fuqua School of Business
    [Show full text]
  • Hacking Social Media – Zerofox
    HACKING SOCIAL Driving Visibility to Support Monitoring & Incident Response CSO – SOCIAL IS A TOP 5 CONCERN CYBER ATTACK NO. 4: SOCIAL MEDIA THREATS “Our online world is a social world led by Facebook, Twitter, LinkedIn or their country-popular counterparts. Social media threats usually arrive as a rogue friend or application install request…Many of today’s worst hacks started out as simple social media hacking. Don’t underestimate the potential.” SLIDE / 2 FORBES – TARGETED ATTACKS VIA SOCIAL “The lovely and disarming ‘Mia Ash’ is a fictional female created by the highly- active hacker crew known as OilRig, which… SecureWorks believes is sponsored by the Iranian regime. In July 2016, Mia's puppeteers targeted a Deloitte cybersecurity employee, engaging him through [Facebook] in conversations about his job.” SLIDE / 3 CISCO – SOCIAL IS #1 SOURCE OF MALWARE “Facebook is now the #1 source of malware…Unsurprisingly, ‘social media’ saw the largest jump from last year’s report on the list of top 24 concerns; social is now ranked #3 overall…Facebook malware is just one example of this dangerous new confluence.” SLIDE / 4 BUSINESS.COM – DON’T FORGET TO SECURE SOCIAL “Businesses already know how important security and protection is in today’s digital world. However they often leave out social media not realizing how porous [social media] can be when it comes to hacks and breaches. There are several ways in which things can go wrong. ” SLIDE / 5 SOCIAL & SOCIAL COLLABORATIO DIGITAL IMPACT BUSINESSES N IMPACT 83% 200 Million 80% Global organization’s
    [Show full text]
  • Trends and Lessons from Three Years Fighting Malicious Extensions
    Trends and Lessons from Three Years Fighting Malicious Extensions Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas, Google https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/jagpal This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Trends and Lessons from Three Years Fighting Malicious Extensions Nav Jagpal Eric Dingle Jean-Philippe Gravel Panayiotis Mavrommatis Niels Provos Moheeb Abu Rajab Kurt Thomas Google nav, ericdingle, jpgravel, panayiotis, niels, moheeb, kurtthomas @google.com { } Abstract injected rogue phishing forms into banking webpages or the ZeroAccess bot that tampered with page advertise- In this work we expose wide-spread efforts by crimi- ments [27, 34]—extensions bridge the semantic gap be- nals to abuse the Chrome Web Store as a platform for tween binaries and browsers, trivializing broad access to distributing malicious extensions. A central compo- complex web interactions. nent of our study is the design and implementation of In this paper we expose wide-spread efforts by crim- WebEval, the first system that broadly identifies mali- inals to abuse the Chrome Web Store as a platform for cious extensions with a concrete, measurable detection distributing malicious extensions. Our evaluation cov- rate of 96.5%. Over the last three years we detected ers roughly 100,000 unique extensions submitted to the 9,523 malicious extensions: nearly 10% of every ex- Chrome Web Store over a three year span from January tension submitted to the store.
    [Show full text]
  • Management Devising a New Strategy to Tackle Today's Cyberattacks
    INFORMATION SECURITY ESSENTIAL GUIDE THREAT Management Devising a new strategy to tackle today's cyberattacks INSIDE Antimalware Cybercrime Social Engineering Incident Response Can your network security stop APTs? FireEye can. Over 95% of networks are compromised as advanced attacks easily evade traditional and next generation signature-based firewalls, IPSs, AV and gateways. APT The best and brightest across every industry are protecting themselves from zero-day and APT attacks Targeted with FireEye. FireEye… the leader in stopping Zero-day zero-day and APT attacks! Contact FireEye now for a free assessment. www.FireEye.com/StopAPTs Join FireEye at the online Threat Management Summit Wednesday, March 14, 2012 10:00 – 11:00 AM PST REGISTER NOW www.fireeye.com | [email protected] | 877.FIREEYE (347.3393) EDITORIAL p MARCIA SAVAGE Battling on All Fronts Organizations are preparing to defend themselves from growing malware threats and targeted attacks in 2012. UFFICE TO SAY, an information security pro’s job never gets any easier. The threat environment is constantly changing and growing more complex as criminals continue to find new ways to attack companies Sand their users. Security pros have to battle on multiple fronts, from increasingly sophisticated malware that’s spreading to mobile platforms to stealthy social engineering and targeted attacks. According to Information Security and SearchSecurity.com’s 2012 Priorities survey, 34 percent of survey participants rate preventing worms and viruses as a top security challenge for their organization. Almost 28 percent view preventing spam and spyware as a major problem and 17 percent say detecting targeted, persistent attacks is a top challenge.
    [Show full text]
  • Pwc Weekly Security Report
    Threats and Backdoor Malware Top stories vulnerabilities PwC Weekly Security Report This is a weekly digest of security news and events from around the world. Excerpts from news items are presented and web links are provided for further information. Threats and vulnerabilities Beware! You can get hacked just by opening a ‘JPEG 2000’ image Backdoor Throw your backdoored D-Link router in the bin, urges security researcher Malware Brad Pitt death hoax story on Facebook is a malware masquerading as Fox news report Top stories NGT website hacked as ‘revenge’ against surgical strike Music, latest weapon in Pak arsenal J&J warns diabetic patients: Insulin pump vulnerable to hacking World’s largest 1 Tbps DDoS attack launched from 152,000 hacked smart devices Threats and Backdoor Malware Top stories vulnerabilities Beware! You can get hacked just by opening a ‘JPEG 2000’ image Researchers have disclosed a critical zero-day The team reported the zero-day flaw to OpenJPEG vulnerability in the JPEG 2000 image file format developers in late July, and the company patched parser implemented in OpenJPEG library, which the flaw last week with the release of version 2.1.2. could allow an attacker to remotely execute arbitrary code on the affected systems. The vulnerability has been assigned a CVSS score of 7.5, categorizing it as a high-severity bug. Discovered by security researchers at Cisco Talos group, the zero-day flaw, assigned as TALOS-2016- Source: 0193/CVE-2016-8332, could allow an out-of-bound http://thehackernews.com/2016/10/openjp heap write to occur that triggers the heap eg-exploit-hack.html corruption and leads to arbitrary code execution.
    [Show full text]
  • UNIVERSITY of CALIFORNIA SAN DIEGO Addressing Device
    UNIVERSITY OF CALIFORNIA SAN DIEGO Addressing Device Compromise from the Perspective of Large Organizations A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science (Computer Engineering) by Louis Floyd DeKoven Committee in charge: Professor Stefan Savage, Co-Chair Professor Geoffrey M. Voelker, Co-Chair Professor Kirill Levchenko Professor Ramesh R. Rao Professor Alex Snoeren 2019 Copyright Louis Floyd DeKoven, 2019 All rights reserved. The Dissertation of Louis Floyd DeKoven is approved and it is acceptable in quality and form for publication on microfilm and electronically: Co-Chair Co-Chair University of California San Diego 2019 iii DEDICATION To my parents: Beverly and Benjamin and to my family: Florence, Melissa, Chris, Ezra, and, Leron iv EPIGRAPH The important thing is to not stop questioning. Curiosity has its own reason for existing. Albert Einstein v TABLE OF CONTENTS Signature Page . iii Dedication . iv Epigraph . v Table of Contents . vi List of Figures . viii List of Tables . x Acknowledgements . xii Vita........................................................................ xiv Abstract of the Dissertation . xv Introduction . 1 Chapter 1 Malicious Browser Extensions at Scale . 6 1.1 Introduction . 6 1.2 Background . 9 1.3 Collecting Browser Malware . 10 1.3.1 Detecting Compromised User Accounts . 11 1.3.2 Malware Scanner and Cleanup . 12 1.3.3 Static Analysis . 13 1.4 Browser Extension Labeling . 14 1.4.1 Automated Extension Labeling. 15 1.4.2 Manual Labeling . 17 1.4.3 A Real World Example . 18 1.5 System Evaluation . 19 1.5.1 Extensions Collected . 20 1.5.2 Malicious Extensions Detected .
    [Show full text]
  • Trends and Lessons from Three Years Fighting Malicious Extensions
    Trends and Lessons from Three Years Fighting Malicious Extensions Nav Jagpal Eric Dingle Jean-Philippe Gravel Panayiotis Mavrommatis Niels Provos Moheeb Abu Rajab Kurt Thomas Google fnav, ericdingle, jpgravel, panayiotis, niels, moheeb, [email protected] Abstract injected rogue phishing forms into banking webpages or the ZeroAccess bot that tampered with page advertise- In this work we expose wide-spread efforts by crimi- ments [27, 34]—extensions bridge the semantic gap be- nals to abuse the Chrome Web Store as a platform for tween binaries and browsers, trivializing broad access to distributing malicious extensions. A central compo- complex web interactions. nent of our study is the design and implementation of In this paper we expose wide-spread efforts by crim- WebEval, the first system that broadly identifies mali- inals to abuse the Chrome Web Store as a platform for cious extensions with a concrete, measurable detection distributing malicious extensions. Our evaluation cov- rate of 96.5%. Over the last three years we detected ers roughly 100,000 unique extensions submitted to the 9,523 malicious extensions: nearly 10% of every ex- Chrome Web Store over a three year span from January tension submitted to the store. Despite a short window 2012–2015. Of these, we deem nearly one in ten to of operation—we removed 50% of malware within 25 be malicious. This threat is part of a larger movement minutes of creation— a handful of under 100 extensions among malware authors to pollute official marketplaces escaped immediate detection and infected over 50 mil- provided by Chrome, Firefox, iOS, and Android with lion Chrome users.
    [Show full text]
  • Social Networks Used As an Attack Vector for Targeted Attacks
    Social networks used as an attack vector for targeted attacks Handbook, Document for teachers September 2014 European Union Agency for Network and Information Security www.enisa.europa.eu Social networks used as an attack vector for targeted attacks Handbook, Document for teacher September 2014 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Acknowledgements Contributors to this report We would like to thank all our ENISA colleagues who contributed with their input to this report and supervised its completion, especially Lauri Palkmets, Cosmin Ciobanu, Andreas Sfakianakis, Romain Bourgue, and Yonas Leguesse. We would also like to thank the team of Don Stikvoort and Michael Potter from S-CURE, The Netherlands, Mirosław Maj and Tomasz Chlebowski from ComCERT, Poland, and Mirko Wollenberg from PRESECURE Consulting, Germany, who produced
    [Show full text]