Tim Davidson System Engineer Malware Pandemic? Sometimes getting a shot only treats the symptoms and not the cause… Tim Davidson System Engineer

Agenda Changing Threat Landscape Why Traditional Defenses Fail? Introducing the FireEye Platform FireEye Advantage

Changing Threat Landscape

Changing Threat Landscape – Advanced Persistent Threats (APTs) Leverages spectrum of exploits Well-known and zero-day vulnerabilities Multi-pronged Advanced Goal oriented rather than opportunistic Targeted attacks Well-planned – low and slow Persistent Organized, well-funded adversaries Nation-states, cyber-espionage groups Stealthy and camouflaged attacks Threats The New Threat Landscape There is a new breed of attacks that are advanced, zero-day, and targeted MODERN Stealthy Unknown and Zero Day Targeted Persistent Well-funded syndicates Advanced Persistent Threats Open Known and Patchable Broad One Time Individuals LEGACY

High Profile Targeted Attacks 3 minutes On average, malware activities take place once every 3 minutes 184 countries, 41% Over the past year, FireEye captured callbacks to 184 countries, a 41% rise 46% Asia (China, Korea, India, Japan, Hong Kong) accounts for 24% callbacks Eastern Europe (Russia, Poland, Romania, Ukraine, Kazakhstan, Latvia) accounts for 22% Technology companies Technology companies experienced highest rate of callback activity 89% 89% of callback activities linked with APT tools made in China or Chinese hacker groups Source: FireEye Advanced Threat Report, March 2013

Significant Compromise Still Exists! Percent of Deployments Infections/Weeks at Normalized Bandwidth 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% 98.5% of deployments see at least 10 incidents*/week/Gbps 1 Gbps Average is about 221 incidents*/week 20% of deployments have thousands of incidents*/week 100,000 10,000 1,000 100 10 Source: FireEye Advanced Threat Report, March, 2013 221 Average Net New Incidents Per Week at Only 1 Gbps! * An incident is beyond inbound malware – it includes an exploit and callback

Why Traditional Defenses Fail

What’s causing the compromise? Dynamic, Polymorphic Malware Coordinated Persistent Threat Actors NEW THREAT LANDSCAPE Multi-Vector Attacks Multi-Staged Attacks

The Attack Life Cycle – Multiple Stages Compromised Web server, or Web 2.0 site 1 Callback Server 1 Exploitation of system 4 Exploit detection is critical All subsequent stages can be hidden or obfuscated 2 Malware executable download 3 Callbacks and control established File Share 2 IPS 5 4 Data exfiltration File Share 1 2 3 5 Malware spreads laterally

Traditional Defenses Don’t Work The new breed of attacks evade signature-based defenses IPS Anti-Spam Gateways Firewalls/ NGFW Secure Web Gateways And what do they all have in common? The attacks are targeted, persistent and unknown, enabling them to evade traditional signature-based defenses. Traditional or next generation firewalls, IPS, gateways or AV. It doesn’t matter. They are all completely defenseless in the face of these new attacks. Desktop AV

The Enterprise Security Hole Attack Vector NGFW FW Web-Based Attacks IPS SECURITY HOLE Spear Phishing Emails Malicious Files SWG AV

Legacy Pattern-Matching Detection Model New Virtual Execution Model A New Model is Required Legacy Pattern-Matching Detection Model New Virtual Execution Model MATCH 100100111001010101010110 MATCH 100100111001010101010110 101011010101101000101110001101010101011001101111100101011001001001001000 100100111001010101010110 110100101101011010101000 Signature-Based Reactive Only known threats Many false negatives Signature-less Dynamic, real-time Known/unknown threats Minimal false positives

Introducing the FireEye Platform

FireEye Platform: Next Generation Threat Protection Dynamic Threat Intelligence (CLOUD) Multi-Vector Virtual Execution engine Dynamic Threat Intelligence (ENTERPRISE) Technology Interoperability Ecosystem Partners

FireEye Platform: Multi-Vector Virtual Execution (MVX) Email MPS 2 Inbound 1 SMTP CMS 3 MVX 6 Outbound 4 HTTP 5 Callback Server 1 – Email with weaponized pdf 2 – Executed in MVX (Email MPS) – phish suspected 3 – Web MPS notified via CMS 4 – Callback over HTTP to C&C server 5 – Callback detected by Web MPS and blocked 6 – End user defended from multi-vector attack Web MPS Multi-vector blended attack

FireEye Platform: Multi-Flow Virtual Execution File-oriented sandboxing can be easily evaded by malware Lack of virtually executing flows vs. file-based approach Lack of capturing and analyzing flows across multiple vectors FireEye uses multi-vector, multi-flow analysis to understand the full context of today’s cyber attacks Stateful attack analysis shows the entire attack life cycle Enables FireEye to disrupt each stage and neutralize attack Callback Server Infection Server Malware Executable Data Exfiltration Exploit Callbacks Downloads

FireEye Platform: Dynamic Threat Intelligence Anonymized Malware Metadata Anonymized Malware Metadata DTI Cloud Enterprise 2 DTI Enterprise Ecosystem Partners Enterprise 1 Ecosystem Partners DTI Enterprise Enterprise 3 Ecosystem Partners DTI Enterprise

FireEye Advantage

FireEye Platform Advantage 1. Thousands of Permutations (files, OS, browser, apps) 2. Multi-flow analysis 3. Multi-vector analysis 4. Correlation of information 5. Cloud Sharing 6. Time to protection Local Loop MVX MVX Dynamic Threat Intelligence (DTI) Threat Protection Fabric Single Enterprise Cross Enterprise

Sandbox Approach (Cloud) File-oriented sandbox - evasion 1. Thousands of Permutations (files, OS, browser, apps) 2. Multi-flow analysis 3. Multi-vector analysis 4. Correlation of information 5. Cloud Sharing 6. Time to protection Single file Sandbox in the cloud Privacy violation Compliance and regulation violation Latency issues Single vector partial hours or days

Sandbox Approach (On-Premises) File-oriented sandbox 1. Thousands of Permutations (files, OS, browser, apps) 2. Multi-flow analysis 3. Multi-vector analysis 4. Correlation of information 5. Cloud Sharing 6. Time to protection Sandbox (On-Premises) Malware can easily circumvent generic sandbox File-based sandbox misses the exploit detection phase No flow causes lack of stateful malware analysis Single file Single vector Hashes: limited value Non-realtime

Key Takeaways Changing Threat Landscape Advanced Persistent Threats Traditional Defenses Fall Short Exploit Detection is Critical File-oriented sandboxing does not detect exploits FireEye Platform MVX architecture DTI Cloud DTI Enterprise

Thank You