From AV to Internetized Security Solution 马杰 Jeffrey Beijing Rising Tech. Co., Ltd. --- The Analysis Report of Malware Technology in China in 2005
Travel
Agenda Background –Overview of the security industry –Overview situation of viruses and spam Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
Internet Statistics Data from: CNNIC
Security Industry Revenue Data from: CCID Consulting
Product Dispersal Data from: CCID Consulting
AV Market Share Distribution Data from: IDC 2005
Agenda Background –Overview of the security industry –Overview situation of viruses and spam Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
Virus Statistics new definitions added to virus database –From Jan. 1 st to Nov. 15 th, 2005 Data from: RISING
Most Active Top 10 Data from: RISING
Top 10 Worst Spam Countries (Jan ) Top 10 Worst Spam CountriesNumber of Current Listed Spam Issues 1 United States China South Korea Brazil Canada Taiwan Russia Japan Argentina Italy 92
Top 10 Worst Spam Countries (Nov ) Top 10 Worst Spam CountriesNumber of Current Listed Spam Issues 1 United States China South Korea Russia Taiwan Japan Canada Brazil Hong Kong United Kingdom 98
Agenda Background –Overview of the security industry –Overview situation of viruses Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
Changes of the purpose of virus creation Gain economic benefits –Virtual property –Bank accounts Increase website hits Show off Skills Gain Economic Benefits
Viruses have an Economic Purposes Total: 4163 found till Nov. 15th, 2005 Economic Purpose Numbers of viruses Stealing online game passwords2763 Bring more Page Views to websites967 Stealing QQ (or MSN) Passwords427 Stealing online banking passwords6 Data from: RISING
Agenda Background –Overview of the security industry –Overview situation of viruses Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
Changes to Anti-Detection The economic benefits by improving anti- detection technology Methods used for anti-detection –Root Kit –Entry Point Obscuring –Source code level morphing
Root Kits Hooks Native API Hides Processes – ZwQuerySystemInformation() Hides Files – ZwQueryDirectoryFile() etc… Many Open Source Code
The Viruses Using Root Kit Technology CategoryAmount Hooking System Ring3 API191 Hooking System Ring0 API53 Patching Kernel81 Viruses using root kit technology found in 2005: 325 Data from: RISING
Agenda Background –Overview of the security industry –Overview situation of viruses Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
Other Threats Rogue software –Ad-ware –Spy-ware –Browser hijack and ActiveX controls –Track-ware –Malicious shareware –… Fishing etc…
Rogue software 22.72%22.72% 13.87%13.87% 19.53%19.53% 9.74%9.74% Data from: UNB
How Rogue Software Avoid Being Deleted? Make themselves automatically launch Install drivers to get a higher privilege Create mutually protecting threads Inject DLLs or threads into another process Rubbish Files
To remove or not to remove… It’s hard to make the decision. To remove ： –Annoys the users. Not to remove ： –Free –Provides some useful features.
Agenda Background –Overview of the security industry –Overview situation of viruses Changes of viruses –Changes of purpose –Changes if anti-detection Other threats on the internet –Unauthorized software (Rogue software) Summary
The situation of viruses in 2005 Economic purposes significantly lead to the increase of new viruses and virus technologies. Weaknesses of a system is the major reason of virus infection. Network is still the most commonly used media though which viruses spread. IM tools are utilized by viruses to spread over internet. New platforms are becoming the target of viruses –mobile phones –PDAs –and etc… Open source is still the origin of lots of viruses
Diary
Job
File System openomy project
earth
People Internetized A lot of things around us getting internetized –Job Web office Instance Message –Life Blog Online Game Online Movie
Threats Internetized Attack on internet Gain from internet Threat s
Protection Needs to be Internetized! Virus Spam Hack Spy-ware Browser hijack Fishing
Protect Users Online Security An internetized security solution provides: –Antivirus –Anti-spam –Firewall –Password protect –Anti browser hijack –Anti fishing
The Hardest Part I wish that I could work it out … Thank you!