From viruses to theft Joakim von Braun Security Consultant von Braun Security Consultants Uppsala universitet

Joakim von Braun Born 1955 B.A. In Political Sciences Professionell work in security for 35 years Advisor and consultant to SÄPO for 25 years Work for Military Intelligence Timbro Private business during 13 years Security advisor Symantec Consultant and advisor Professional speaker Journalist and writer

Crime on the Internet

Todays changing threats  variables  Threat posture  Botnets – spam and blackmail  Phishing  Crimeware

Knowledge?

Vulnerabilities easy to use

Threat posture 2006  From 450 to new threats in three years  The difference between worm and trojan is gone  Huge increase of botnets (Zombie networks)  Botnets with more than computers  new botnet worms every month  new vulnerabilties  6 days to patch an exploit  Hackers and coders are working for money!!!

Botnets can be rented

Money is everything  Botnets can be rented for 6, 24 hours or a week  Botnets are used to propagate Spam  Botnets are used for DoS attacks + blackmail  More than Phishing attacks per month  Crimeware has increased from 20 to in 3,5 years  A new unknown trojan can be bought for kronor

75 new worms per day!!!

More botnets

Blackmail more common

Phishing  HTML formatted sent to bank customers  An URL points to the bank homepage  The homepage is a copy of the original  Homepages are hidden on hacked computers  Customers reveal important economic data  USA, UK and Australia the first targets  350 % increase during 2004  Swedes customers in US companies targeted  Eurocard in Sverige first 22/  At least 7 Swedish attacks during 2005

November 2003

November 2005

Obfuscated Web adresses

Vulnerability in Internet Explorer Visible link: Called link : /my/index.htm Website:

AOL Billing Center

Hacked once again

Infected computers used – port 4444

Dramatic increase of maliciouse code

Worms and trojans steals information

Crimeware targets bank and CC customers  Increase from 20 to trojans in 3,5 years  Brasil, Australia, USA and UK mostly targeted  Germany and Scandinavia is next  Remote Access and Keylogging  Kills AV and personal firewalls  Logs everythin in certain open windows  Sniffs encrypted HTTPS traffic

Trojan Stawin

Trojan Bizex

Questions Joakim von Braun von Braun Security Consultants (cell) (home) (fax)