1. THE THREAT LANDSCAPE FROM CYBERCRIME TO CYBER-WAR David Emm Global Research and Analysis Team

2. CONTENTS 2 What kind of malware? Who’s writing it and why? What do we do about it? 3 2 1

3. THE SCALE OF THE THREAT 1 NEW VIRUS EVERY HOUR 1994 1 NEW VIRUS EVERY MINUTE 2006 1 NEW VIRUS EVERY SECOND 2011 315,000 NEW SAMPLES EVERY DAY 2013

4. THE GROWING MALWARE THREAT

5. HOW MALWARE SPREADS 5 People Technology … and how people use it

6. VULNERABILITIES AND EXPLOITS 6

7. 7

8. ‘DRIVE-BY DOWNLOADS’ 8

9. SOCIAL NETWORKS 9

10. E-MAIL 10

11. REMOVABLE MEDIA 11

12. DIGITAL CERTIFICATES 12

13. SOPHISTICATED THREATS 13 Code obfuscation Rootkits Hide changes made by malware Installed files Running processes Registry changes Advanced technologies £k1_ s”+gr!pl;7&

14. NEW TACTICS 14 All kinds of information Not just bank data Steal everything! Sophisticated Carefully selected targets Well-defined aims Targeted attacks

15. 0.1 % 9.9 % 90 % THE NATURE OF THE THREAT Traditional cybercrime Targeted threats to organisations Cyber-weapons

16. POLITICAL, SOCIAL OR ECONOMIC PROTEST

17. THEFT OF SENSITIVE DATA “There’s no such thing as ‘secure’ any more. The most sophisticated adversaries are going to go unnoticed on our networks. We have to build our systems on the assumption that adversaries will get in. We have to, again, assume that all the components of our system are not safe, and make sure we’re adjusting accordingly.” Debora Plunkett, NSA Director Quoted in “NSA Switches to Assuming Security Has Always Been Compromised” “There’s no such thing as ‘secure’ any more. The most sophisticated adversaries are going to go unnoticed on our networks. We have to build our systems on the assumption that adversaries will get in. We have to, again, assume that all the components of our system are not safe, and make sure we’re adjusting accordingly.” Debora Plunkett, NSA Director Quoted in “NSA Switches to Assuming Security Has Always Been Compromised”

18. CYBER-WEAPONS “… cyber weapons are: a) effective; b) much cheaper than traditional weapons; c) difficult to detect; d) difficult to attribute to a particular attacker …; e) difficult to protect against …; f) can be replicated at no extra cost. What’s more, the seemingly harmless nature of these weapons means their owners have few qualms about unleashing them, with little thought for the consequences. Eugene Kaspersky June 2012 http://eugene.kaspersky.com/2012/06/14/the-flame-that-changed-the-world/ “… cyber weapons are: a) effective; b) much cheaper than traditional weapons; c) difficult to detect; d) difficult to attribute to a particular attacker …; e) difficult to protect against …; f) can be replicated at no extra cost. What’s more, the seemingly harmless nature of these weapons means their owners have few qualms about unleashing them, with little thought for the consequences. Eugene Kaspersky June 2012 http://eugene.kaspersky.com/2012/06/14/the-flame-that-changed-the-world/

19. CYBER-WEAPONS: NUMBER OF VICTIMS OVER 100K OVER 300K 2,500 10K 700 5-6K 20 50-60 10-20 50-60 StuxnetGaussFlameDuquminiFlame Known number of incidentsAdditional number of incidents (approximate) 300K 100K 10K 1K 50 20 Source: Kaspersky Lab

20. TARGETED ATTACKS 20 Google RSA Lockheed Martin Sony Comodo DigiNotar Some of the victims: Saudi Aramco LinkedIn Adobe Syrian Ministry of Foreign Affairs The New York Times Tibetan activitists

21. 21

22. MOBILE MALWARE 22 10,000,509 unique installation packs

23. WHY TARGET MOBILE DEVICES? Mobile devices contain lots of interesting data: SMS messages Business e-mail Business contactsPersonal photosGPS co-ordinatesBanking credentialsInstalled appsCalendar The evolving threat landscape23

24. PLATFORMS 24

25. WHAT SORT OF MALWARE? 25

26. THE GEOGRAPHY OF MOBILE MALWARE 26

27. MOBILE DEVICES AND TARGETED ATTACKS 27

28. WHAT DO WE DO ABOUT IT? 28

29. WHAT DO WE DO ABOUT IT? 29

30. WHAT DO WE DO ABOUT IT? 30

31. QUESTIONS David Emm Global Research and Analysis Team