Upload
hoangbao
View
223
Download
3
Embed Size (px)
Citation preview
InterceptXisSophosanswertoransomware
JoannaWziątek-ŁadoszSalesEngineer,Sophos
You’rebeinghacked…..
1983199519992001201020112015
“TRUTH IS STRANGER THAN FICTION”
3
MelissaVirus
1998
$1.2B
LoveLetterWorm
$15B
1999
$2.3B
2007
$800M
2014
LockyRansomware
$1.1B
2016
FinFischerSpyware
2003
$780M
ExploitasaService
$500M
2015
TRADITIONAL MALWARE ADVANCED THREATS
TheEvolutionofEndpointThreatsFromMalwaretoExploits
TRADITIONAL MALWARE ADVANCED THREATS
TheEvolutionofSophosEndpointSecurityFromAnti-MalwaretoAnti-ExploittoNext-Generation
ExposurePrevention
URLBlockingWebScripts
DownloadRep
Pre-ExecAnalytics
GenericMatchingHeuristicsCoreRules
File-Scanning
SignaturesKnownMalwareMalwareBits
Run-Time
SignaturelessBehaviorAnalyticsRuntimeBehavior
ExploitDetection
TechniqueIdentification
EXECUTABLEFILES
MALICIOUSURLS
UNAUTHORIZEDAPPS
REMOVABLEMEDIA
EXPLOITPREVENTION
MSFILES&PDF
!
ADVANCEDCLEAN
RANSOMWAREPREVENTION
INCIDENTRESPONSE
DETECT RESPONDPREVENTBEFORE IT REACHES DEVICE BEFORE IT RUNS ON DEVICE
SOPHOS NEXT GENERATION ENDPOINT DETECTION AND RESPONSE
90%OF DATA BREACHES AREFROM EXPLOITS KITS
90%OF EXPLOIT KITS ARE BUILTFROM KNOWN VULNERABILITIES
AND YET…MORE THAN 60%OF ITSTAFFLACK INCIDENT RESPONSE SKILLS
Anatomyofaransomware attack
Andgone
Theransomwarewillthendeleteitselfleavingjusttheencryptedfilesandransomnotesbehind.
Ransomdemand
Amessageappearsontheuser’sdesktop,explaininghowaransom(oftenintheformofbitcoins)canbepaidwithinatimeframe ofe.g.72hourstoenabledecryptionofthedatawiththeprivatekeythatonlytheattacker’ssystemhasaccessto.
Encryptionofassets
Certainfilesarethenencryptedonthelocalcomputerandonallaccessiblenetworkdriveswiththispublickey.AutomaticbackupsoftheWindowsOS(shadowcopies)areoftendeletedtopreventdatarecovery.
Contactwiththecommand&controlserveroftheattacker
TheransomwaresendsinformationabouttheinfectedcomputertotheC&Cserveranddownloadsanindividualpublickeyforthiscomputer.
Installationviaanexploitkitorspamwithaninfectedattachment
Onceinstalledtheransomwaremodifiestheregistrykeys
2mainvectorsofattack
• SPAM (viasocialengineering)○ Seeminglyplausiblesender○ Hasattachmente.g.invoice,parceldeliverynote○ Theattachmentcontainsanembeddedmacro○ Whentheattachmentisopenedthemacrodownloads
andthenexecutestheransomwarepayload○ UsedbyLocky,TorrentLocker,CTB-Locker
• Exploitkits○ Blackmarkettoolsusedtoeasilycreateattacksthat
exploitknownorunknownvulnerabilities(zero-day)○ ClientsidevulnerabilitiesusuallytargettheWebbrowser○ UsedbyAngler,CryptoWall,TeslaCrypt,CrypVault,
ThreatFinder
AcommonLocky attack
• Youreceiveanemailcontaininganattacheddocument.o Thedocumentlookslikegobbledegook.o Thedocumentadvisesyoutoenablemacros“ifthedataencodingisincorrect.”
o Thecriminalswantyoutoclickonthe'Options'buttonatthetopofthepage.
• OnceyouclickOptions,Locky willstarttoexecuteonyourcomputer.• Assoonasitisreadytoaskyoufortheransom,itchangesyourdesktopwallpaper.• Theformatofthedemandvaries,buttheresultsarethesame.
Introducing
IntroducingSophosInterceptX
ADVANCEDMALWARE
ZERODAYEXPLOITS
LIMITEDVISIBILITY
Anti-Exploit
PreventExploitTechniques• SignaturelessExploitPrevention• ProtectsPatient-Zero/Zero-Day• BlocksMemory-ResidentAttacks• TinyFootprint&LowFalsePositives
NoUser/PerformanceImpactNoFileScanningNoSignatures
AutomatedIncidentResponse• ITFriendlyIncidentResponse• ProcessThreatChainVisualization• PrescriptiveRemediationGuidance• AdvancedMalwareClean
Root-CauseAnalysis
FasterIncidentResponseRoot-CauseVisualizationForensicStrengthClean
DetectNext-GenThreats• StopsMaliciousEncryption• BehaviorBasedConviction• AutomaticallyRevertsAffectedFiles• IdentifiessourceofAttack
Anti-Ransomware
PreventRansomwareAttacksRoll-BackChanges
AttackChainAnalysis
AnatomyofaRansomware Attack
ExploitKitorSpamwithInfection
Command&ControlEstablished
LocalFilesareEncrypted
Ransomwaredeleted,Ransom
Instructionsdelivered
CryptoGuard
• SimpleandComprehensive
• UniversallyPreventsSpontaneousEncryptionofData
• RestoresFilestoKnownState
• SimpleActivationinSophosCentralCRYPTOGUARD
CryptoGuard- InterceptingRansomware
Monitorfileaccess• Ifsuspicious filechangesaredetected,filecopiesarecreated
Attackdetected• Malicious processisstoppedandweinvestigatetheprocesshistory
Rollbackinitiated• Originalfilesrestored• Maliciousfilesremoved
Forensicvisibility• User message• Adminalert• Root causeanalysisdetailsavailable
NEW – Anti-ExploitAttackPrevention• Providesadvancedexploitprotectionbyfocusingon
commontechniquesusedbyattackers• Protectsapplicationsagainstzero-dayexploits,malicious
traffic,andprocessbreaches
UpdatedEndUser AgentUI UpdatedAdminUI
Root-CauseAnalyticsUnderstandingtheWho,What,When,Where,WhyandHow
WhatHappened?• RootCauseAnalysis
• Automaticreport@theprocess/threat/registrylevel• 90Daysofhistoricalreporting• DetailedVisualrepresentationofwhatotherassetshavebeentouched
WhatisatRisk?• CompromisedAssets
• Comprehensivelistofbusinessdocuments,executables,librariesandfiles• Anyadjacentdevice(i.e.,mobile)ornetworkresourceswhichmaybeatrisk
FuturePrevention• SecurityPosture
• Recommendationsbasedonhistoricalsecurityrisks• Providesstepstopreventfutureattacks• RichreportingofCompliancestatus
RootCauseAnalysisInterface
15
InterceptingExploits
ExploitPrevention• Monitorsprocessesforattempteduseofexploittechniquese.g Bufferoverflow,codeinjection,stackpivotandothers
• Blockswhentechniqueisattempted
• Malwareispreventedfromleveragingvulnerabilities
?
SophosCleanMalwareRemoval.VulnerabilityAssessment.
• 100%AutomatedwithInterceptX• AlsoavailableasastandaloneForensicCleanUtility
RemovesThreats• DeepSystemInspection• RemovesMalwareRemnants• FullQuarantine/Removal• EffectiveBreachRemediation
On-DemandAssessment• IdentifiesRiskyFiles/Processes• ConstantlyRefreshedDatabase• ProvidesAdditionalConfidence• Command-LineCapable
SophosInterceptX– TwoWaystoPlay
• Purposebuilttocomplimentandenhance”traditionalAV”solutions• Securityfocusedonexploittechniques,notmerelythetoolsused• DesignedfortheITGeneralist.PowerfulenoughfortheInfo-SecProfessional
The“UltimateBundle”• CentralEndpointAdvancedAdd-OnProduct• “UltimatePromo”Bundle– Contactre:Discount• UpgradestheEndpointtoaSingleAgent
ExistingAV?BetterTogether• ComplimentsandenhancestraditionalAV• AddsLevelsofProtectioncurrentlylacking• ProvidesaForensic-LevelClean
IntroducingSophosInterceptX
ADVANCEDMALWARE
ZERODAYEXPLOITS
LIMITEDVISIBILITY
Anti-Exploit
PreventExploitTechniques• SignaturelessExploitPrevention• ProtectsPatient-Zero/Zero-Day• BlocksMemory-ResidentAttacks• TinyFootprint&LowFalsePositives
NoUser/PerformanceImpactNoFileScanningNoSignatures
AutomatedIncidentResponse• ITFriendlyIncidentResponse• ProcessThreatChainVisualization• PrescriptiveRemediationGuidance• AdvancedMalwareClean
Root-CauseAnalysis
FasterIncidentResponseRoot-CauseVisualizationForensicStrengthClean
DetectNext-GenThreats• StopsMaliciousEncryption• BehaviorBasedConviction• AutomaticallyRevertsAffectedFiles• IdentifiessourceofAttack
Anti-Ransomware
PreventRansomwareAttacksRoll-BackChanges
AttackChainAnalysis
You’rebeinghacked…..
1983199519992001201020112015
“TRUTH IS STRANGER THAN FICTION”
21