1. International Telecommunication Union Geneva, 9(pm)-10 February 2009 Fighting cybercrime in 2009 Magnus Kalkuhl, Senior Virus Analyst Kaspersky Lab ITU-T Workshop on “New challenges for Telecommunication Security Standardizations" Geneva, 9(pm)-10 February 2009

2. International Telecommunication Union Geneva, 9(pm)-10 February 2009 2 Number of signatures 1998 - 2008

3. International Telecommunication Union Geneva, 9(pm)-10 February 2009 3 Cybercrime business Malware is written for one goal: Making money Cybercrime business is organized, but more as “crime that is organized” rather than “organized crime” There is no centralized control by a “Dr no” character

4. International Telecommunication Union Geneva, 9(pm)-10 February 2009 4 The dirty approach

5. International Telecommunication Union Geneva, 9(pm)-10 February 2009 5 The silent approach After infection a computer is used for... Sending spam mails Performing DDoS attacks Fast flux networks Proxy computer Stealing the owner's credit card data, bank account or “World of Warcraft” password

6. International Telecommunication Union Geneva, 9(pm)-10 February 2009 6 Example: Drive by download Browser Exploit: Small program that breaks the barriers of a browser (or other program) and executes own code

7. International Telecommunication Union Several systems available: MPack, Icepack etc. Offered for 500 – 1.000 EUR Example: Drive by download

8. International Telecommunication Union Several systems available: MPack, Icepack etc. Offered for 500 – 1.000 EUR Example: Drive by download

9. International Telecommunication Union

11. Shadow botnet

12. International Telecommunication Union Geneva, 9(pm)-10 February 2009 12 Botnet CPU performance

13. International Telecommunication Union Geneva, 9(pm)-10 February 2009 13 Botnet CPU performance

14. International Telecommunication Union Geneva, 9(pm)-10 February 2009 14 Botnet CPU performance

15. International Telecommunication Union Geneva, 9(pm)-10 February 2009 15 What can AV companies do? Protecting servers and client computers against initial infection Education: Teaching security awareness Monitoring botnets – without touching them Information exchange with CERTs, authoriries and other researchers

16. International Telecommunication Union Geneva, 9(pm)-10 February 2009 16 What else could be done Separation of the internet into virtual islands International cyberspace police who is able to act quickly in cases of emergency New law that allows authorities to notifiy botnet victims after gaining control over a botnet control center

17. International Telecommunication Union Geneva, 9(pm)-10 February 2009 17 The limits of control There will always be uncontrolled networks (with lots of malware) Usage of “savage nets” will be prohibited by some governments – but that won't stop its existence The only place for people who have been banned from the “official” Internet

18. International Telecommunication Union Geneva, 9(pm)-10 February 2009 18 Conclusion AV companies can prevent initial infections International botnets require international cooperations “Virtual islands” and more control will lead to a fragmenation of the internet as we know it today

19. International Telecommunication Union Geneva, 9(pm)-10 February 2009 19 Thank you very much!