1. Evolving Threats Paul A. Henry MCP+I, MCSE, CCSA, CCSE, CISSP-ISSAP, CISM, CISA, CIFI, CCE Florida PI License C2800597 Forensics & Recovery LLC Florida PI Agency License A2900048 Paul A. Henry MCP+I, MCSE, CCSA, CCSE, CISSP-ISSAP, CISM, CISA, CIFI, CCE Florida PI License C2800597 Forensics & Recovery LLC Florida PI Agency License A2900048

2. Welcome To My World Conficker update Risk of banking via cell phone rising Backdoor in a box –Covert channels on a budget Obfuscation wins again –Adobe issues not going away Wireless network tap –Sniffing a network from 300 meters What’s that light at the end of the tunnel –Patch that Mac Old Malware never dies

3. Conficker Update Upgrades –No longer limited to 250 domains for updates 50,000 domains Peer to peer updates Blocks access to larger range of security sites –First nefarious use of conficker bot net detected More sure to come

4. Conficker Update

7. Big Money 1.8M unique users were redirected to the rogue Anti-Virus software during 16 consecutive days Members of the affiliate network were rewarded for each successful redirection with 9.6 cents “a piece”, which totals $ 172,800 or $ 10,800 per day

8. Introducing Gumblar - Son of Conficker In 2008 one website was compromised every 5 sec –Now it is one every 4.5 sec End game is the same – deliver malware Gumblar is building two botnets –First botnet is made up of compromised web servers and is used to distribute “drive-by” malware across web servers –Second botnet is made up of PCs that visit the web sites and become infected These PCs become part of a spam spewing botnet

9. Introducing Gumblar - Son of Conficker Gumblar is now found on 42% of all discovered compromised websites

10. Root Cause… Really drives home the underlying problem with network security today.. One of the most successful vulnerabilities being exploited today is RDS (MDAC) This one vulnerability is responsible for over 70% of compromises from automated toolkits Did I mention that the vulnerability was patched 3 years ago……

11. Most Popular Toolkit

12. Pinch Lives On… Even while the authors sit in prison Pinch continues to infect users

13. It’s Not Rocket Science… It is common knowledge that you can eliminate 90% of your risk by applying patches in a timely manner It was recently reported by IBM that over 70% of Microsoft vulnerabilities in 2008 could be mitigated by simply enforcing the “rule of least privilege”

14. Now This Is Interesting… For Sale Used Nokia 1100 $30,000 A software issue in the Nokia 1100 makes is easily re-programmable –Assume any identity –Actively being used in UK to capture banking PIN sent via SMS

15. Pogo Plug – Backdoor in a box Allows anything connected via USB to be easily shared across the Internet –Hard drive –Ethernet adapter –Wireless adapter

16. Pogo Plug – Backdoor in a box Yes there are a few good uses but….

17. Signatures Are Obsolete

19. Obfuscation wins again

21. Well it started as a good idea

24. 20,000 Illegal Downloads…. Pirated copy of iWorks contained malware

25. First Mac BotNet First use of iBotnet was a DDoS Attack

26. First Mac BotNet Apple is currently associated with 57 different software products and numerous hardware platforms A search on reported vulnerabilities of OSX shows 128 Secunia Advisories and 866 reported Vulnerabilities –http://secunia.com/advisories/product/96/http://secunia.com/advisories/product/96/ That light at the end of the tunnel is an on coming train…

27. Windows RC7 – Botnet

28. Summary We have yet to feel the impact of Conficker – more to come Cell phones are becoming a viable target Pogo Plug demonstrates the need to re evaluate access to 80/443 outbound We need to rethink signatures the current model is doomed to fail Wireless network taps will play a part in data leakage Security by obscurity is over for Mac Obfuscation brings new life to old malware

29. Forensics & Recovery LLC Florida PI License A 29004 www.forensicsandrecovery.com Paul A. Henry MCP+I, MCSE, CCSA, CCSE, CISSP-ISSAP, CISM, CISA, CIFI, CCE Florida PI License C2800597 25 SE 69 th Place Ocala, Fl 34480 Telephone (954) 854 9143 phenry@forensicsandrecovery.com