IBM X-Force: Insights from the 1Q 2015 X-Force Threat Intelligence Quarterly
•
4 gefällt mir•1,864 views
"2014 Year in Review: From Designer Vulns to Made-to-Order Malware" The year 2014 brought a surge in the disclosure of critical vulnerabilities to foundational frameworks branded with logos and catchy names, but what were the real reasons behind vulnerability disclosures reaching the highest rate in recorded history last year? Attackers tailored the Citadel malware to infiltrate new targets, making it imperative for organizations to defend themselves with more than just a single layer of protection. Attend this webinar to learn more about these and other key trends from the Q1 IBM X-Force Threat Intelligence Quarterly. View on-demand recording: https://attendee.gotowebinar.com/recording/8127444082863896065
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie IBM X-Force: Insights from the 1Q 2015 X-Force Threat Intelligence Quarterly
Ähnlich wie IBM X-Force: Insights from the 1Q 2015 X-Force Threat Intelligence Quarterly (20)
Mehr von IBM Security
Mehr von IBM Security (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
IBM X-Force: Insights from the 1Q 2015 X-Force Threat Intelligence Quarterly
- 1. © 2012 IBM Corporation IBM Security Systems 1© 2015 IBM Corporation IBM X-Force: Insights from the 1Q 2015 X-Force Threat Intelligence Quarterly
- 2. © 2015 IBM Corporation IBM Security 2 is the foundation for advanced security and threat research across the IBM Security Framework.
- 3. © 2015 IBM Corporation IBM Security 3 IBM X-Force® Research and Development Vulnerability Protection IP Reputation Anti-Spam Malware Analysis Web Application Control URL / Web Filtering The IBM X-Force Mission Monitor and evaluate the rapidly changing threat landscape Research new attack techniques and develop protection for tomorrow’s security challenges Educate our customers and the general public Integrate and distribute Threat Protection and Intelligence to make IBM solutions smarter Expert analysis and data sharing on the global threat landscape Zero-day Research
- 4. © 2015 IBM Corporation IBM Security 4 IBM X-Force monitors and analyzes the changing threat landscape 20,000+ devices under contract 15B+ events managed per day 133 monitored countries (MSS) 3,000+ security related patents 270M+ endpoints reporting malware 25B+ analyzed web pages and images 12M+ spam and phishing attacks daily 96K+ documented vulnerabilities 860K+ malicious IP addresses Millions of unique malware samples
- 5. © 2015 IBM Corporation IBM Security 5 For the vast majority of security leaders, the world has dramatically changed in the last three years 5 Source: 2014 IBM Chief Information Security Officer Assessment $
- 6. © 2015 IBM Corporation IBM Security 66 Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015 and 2014 IBM Chief Information Security Officer Assessment 83% of CISOs say that the challenge posed by external threats has increased in the last three years Near Daily Leaks of Sensitive Data 40% increase in reported data breaches and incidents Relentless Use of Multiple Methods 800,000,000+ records were leaked, while the future shows no sign of change “Insane” Amounts of Records Breached 42% of CISOs claim the risk from external threats increased dramatically from prior years.
- 7. © 2015 IBM Corporation IBM Security 77 The tone of breaches has shifted, revealing disturbing flaws in the fundamentals of both systems and security practices • End-user password re-use • Leaving default passwords on admin systems • Poor challenge questions for password reset procedures • The same operating systems, open-source libraries and CMS software are prevalent on many websites • Several of these systems and libraries had vulnerabilities disclosed in 2014 • Sensitive photos stored on a cloud service were leaked due to weak passwords • Private email communications at a major Hollywood studio were released Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015
- 8. © 2015 IBM Corporation IBM Security 8 Attackers are applying fundamental attack types in creative, new ways Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015
- 9. © 2015 IBM Corporation IBM Security 9 The 2014 vulnerability forecast shifted drastically when an automated tool identified a class of vulns affecting thousands of Android apps with improper SSL certificate validation Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015
- 10. © 2015 IBM Corporation IBM Security 10 2014 closed with 9,200 new vulns assigned XFIDs, but the total number of vulnerabilities may surge to more than 30,000 Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015
- 11. © 2015 IBM Corporation IBM Security 11 We had our first taste of “designer vulns” in 2014: critical vulnerabilities with clever logos and handles Heartbleed CVE-2014-0160 OpenSSL Shellshock CVE-2014-6271/7169 Unix Bash shell POODLE CVE-2014-3566/8730 SSL 3.0 Protocol GHOST CVE-2015-0235 Linux GNU C Library
- 12. © 2015 IBM Corporation IBM Security 12 Apache Cordova allows mobile app developers to use HTML 5 as single cross-platform development technology Used in 6% of all apps Used in 12% of business, medical and finance apps CVE-2014-3500 Apache Cordova cross-application scripting CVE-2014-3501 Cordova whitelist bypass for non- HTTP URLs CVE-2014-3502 Data leaks to other applications via Android intent URIs
- 13. © 2015 IBM Corporation IBM Security 13 Exploiting the Apache Cordova vulnerability Video goes here
- 14. © 2015 IBM Corporation IBM Security 14 At the time of initial disclosure, 91% of Cordova applications were vulnerable Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015 Despite the availability of patches and warnings of sanctions from Google for non-patched apps,
- 15. © 2015 IBM Corporation IBM Security 1515 What can app designers and the industry do to mitigate threats? Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015 • Be proactive in the measures taken to keep users safe. • Have a process in place for rapid implementation and deployment of security fixes. • Establish PSIRTs responsible for tracking vulns across in-house products. • Maintain backward-compatibility and provide streamlined updates within the build process. • The mobile app industry should investigate complete segregation of framework from application code.
- 16. © 2015 IBM Corporation IBM Security 16 59% of CISOs strongly agree that the sophistication of attackers is outstripping the sophistication of their organization’s defenses $ Particularly troubling is the adaptation of malware toolkits from targeting financial institutions to APT-style attacks on a broader range of industries. Source: 2014 IBM Chief Information Security Officer Assessment Financial Fraud APT-Style Attacks • Targets Consumers • Used for stealing • Bank account credentials • Personal information • Targets Employees • Used for stealing • Corporate credentials • Business and operational data
- 17. © 2015 IBM Corporation IBM Security 17 Massively Malware malware is being used to target industries beyond traditional financial targets Comprehensive Menu of Advanced Capabilities • Keylogging and screen capturing • Remote code execution • Full remote control Highly Evasive • Sophisticated evasion techniques used to bypass detection • Can remain stealthy on the machine for lengthy periods of time Able to be Repurposed • Communicates with a C&C • Receives operational instructions via config file • Config file can be updated with new operational instructions Massively Distributed • Off the shelf malware, not custom designed • Using mass distribution campaigns • Millions of machines already infected! $
- 18. © 2015 IBM Corporation IBM Security 18 Citadel is available for sale on the Russian underground, with new features prioritized by crowdsourcing to target new industries $ Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2015
- 19. © 2015 IBM Corporation IBM Security 19 An average of 1 in 500 machines is infected with a massively distributed malware at any point in time Infection Rates for Massively Distributed APT Malware by Country $ Source: IBM Trusteer, SecurityIntelligence.com
- 20. © 2015 IBM Corporation IBM Security 20 Since traditional security isn’t effective against massively distributed malware, what can you do to mitigate threats from Citadel malware? Employee endpoint protection, including cloud based malware detection Emergency response plans and practice $
- 21. © 2015 IBM Corporation IBM Security 21 Connect with IBM X-Force Research & Development Find more on SecurityIntelligence.com IBM X-Force Threat Intelligence Quarterly and other research reports: http://www.ibm.com/security/xforce/ Twitter @ibmsecurity and @ibmxforce IBM X-Force Security Insights Blog www.SecurityIntelligence.com/topics/x-force IBM X-Force Interactive Security Incidents www.ibm.com/security/xforce/xfisi
- 22. © 2015 IBM Corporation IBM Security 22 www.ibm.com/security © Copyright IBM Corporation 2013. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed or misappropriated or can result in damage to or misuse of your systems, including to attack others. No IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT SYSTEMS AND PRODUCTS ARE IMMUNE FROM THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. www.ibm.com/security © Copyright IBM Corporation 2015. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed or misappropriated or can result in damage to or misuse of your systems, including to attack others. No IT system or product should be considered completely secure and no single product or security measure can be completely effective in preventing improper access. IBM systems and products are designed to be part of a comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT SYSTEMS AND PRODUCTS ARE IMMUNE FROM THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.