• Home

  • Documents

  • Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware...
26
Microsoft Malware Protection Center (MMPC)

Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

  • Upload
    vocong

  • View
    238

  • Download
    2

Embed Size (px)

Citation preview

Page 1: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Microsoft Malware Protection Center (MMPC)

Page 2: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Protection points

Home: • Microsoft Security

Essentials (MSE)

• Malicious Software

Removal Tool (MSRT)

• Windows Defender

Corp: • System Center Endpoint

Protection (SCEP)

Cloud: • Intune

• Hotmail

• Exchange

• Azure

Investments:

safe future systems, processes

scale

Protect through the

cloud

Collaborate with

security industry

Operationalize

research with BI, automation

Strategy:

Ensure all of

Microsoft’s

customers are

protected Security vendor agnostic

Disrupt the malware

ecosystem

Support the security

industry Security content, sharing

Trustworthy Computing

Page 3: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 4: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 5: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 6: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 7: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 8: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 9: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 10: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 11: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 12: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 13: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 14: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Sends the payment details to DB server

Acknowledges payment received, sends decryption key

Decrypts the archive’s payload

Page 15: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 16: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 17: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Archive Creator

• Creates Paid Archive

• Ensure a big number of downloads

Archive creator

• Create paid archive

• Ensure a big number of downloads

Trustworthy Computing

Victim/user

• Mobile phone

• Money

Premium SMS service

• Collect and distribute payments

Archive creator

• Create paid archive

• Ensure a big number of downloads

Toolkit supplier

• Builder toolKit

• Hosting

• Archives database

Page 18: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Page 19: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

12 000+ partners from 2009

$6 400 000 revenue

120 templates

Installs Mail.Ru Sputnik ($0.06)

Page 20: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Active since 2010

Offline and online versions

60 templates

AV detection evasion

Page 21: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

ZIP Archive 4 000+ webmasters, top 10

Pro Wap 1 200+ webmasters

MS Windows (all versions)

.NET executable payload

Code obfuscation

Online and offline builders

80 templates

Mobile platforms

APK or JAR payloads

80 MIDlets

Landing pages

Traffic distribution system (TDS)

Page 22: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

StimulProfit

36 000+ registered partners since 2010

Traffic only partnership (server side); paid archives are only seen by users

Plugins for DataLife Engine (DLE), WordPress and uCoz

Domain parking

Page 23: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Employs obfuscation packers to avoid Detection • Same packers commonly found in: Zeus (Zbot), Reveton, Kanots, Dofoil

Builder Supplier MS Detection Name Anti-Detection Techniques

Zip Monster Program:Win32/Pameseg.BU 1. Search bytes in system DLLs

2. Check OS environment

3. Use infinite loops

Zip Pro Program:Win32/Pameseg.(AK|AZ)

1. Search bytes in system DLLs

2. String obfuscation

Zip Archive Program:MSIL/Pameseg.G

NET assembly obfuscation

(use commercial obfuscators)

Pro Wap Trojan:AndroidOS/VolterSms.A

APK code and string tempering

Stimul Profit Program:Win32/Pameseg.CF

TCrypt packer

Page 24: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing

Lower cost for victim

Attract less attention

Use less agressive behaviors

Longer lifetime – longer victim exposure

Split responsibility

Long-term effectiveness

Use EULAs as legal buffers

Page 25: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)
Page 26: Microsoft Malware Protection Center (MMPC) - Virus … ·  · 2012-10-05Microsoft Malware Protection Center (MMPC) Protection points Home: • Microsoft Security Essentials (MSE)

Trustworthy Computing


SOCIALLY-ENGINEERED MALWARE PROTECTION

SOCIALLY-ENGINEERED MALWARE PROTECTION

Documents
Malware self protection-matrix

Malware self protection-matrix

Technology
Web Malware Protection System - FireEye Products & Solutions | …Web Malware Protection System Next-Generation Web Security to Combat Advanced Targeted Attacks The FireEye Web Malware

Web Malware Protection System - FireEye Products & Solutions | …Web Malware Protection System Next-Generation Web Security to Combat Advanced Targeted Attacks The FireEye Web Malware

Documents
Cisco Advanced Malware Protection для руководителей, принимающих решения

Cisco Advanced Malware Protection для руководителей, принимающих решения

Technology
Umbrella for MSPs: Enterprise Grade Malware Protection & Containment

Umbrella for MSPs: Enterprise Grade Malware Protection & Containment

Technology
File Policies and Advanced Malware Protection - cisco.com · File Policies and Advanced Malware Protection Thefollowingtopicsprovideanoverviewoffilecontrol,filepolicies,filerules,AMPcloudconnections,

File Policies and Advanced Malware Protection - cisco.com · File Policies and Advanced Malware Protection Thefollowingtopicsprovideanoverviewoffilecontrol,filepolicies,filerules,AMPcloudconnections,

Documents
DWP Security Standard – Malware Protection (SS-015) · Malware software will not necessarily have these in place by default). *When reviewing Anti-Malware software and Anti-Malware

DWP Security Standard – Malware Protection (SS-015) · Malware software will not necessarily have these in place by default). *When reviewing Anti-Malware software and Anti-Malware

Documents
The Ultimate Protection Against Spyware and Malware...detection and removal of malware. The Missing Link in Protection STOPzilla AntiMalware fills in the gaps of protection left by

The Ultimate Protection Against Spyware and Malware...detection and removal of malware. The Missing Link in Protection STOPzilla AntiMalware fills in the gaps of protection left by

Documents
Security standard SS-015: Malware Protection · 2020-05-01 · Anti-Malware software on these systems will not provide the required level of protection). 10.4. Anti-malware software

Security standard SS-015: Malware Protection · 2020-05-01 · Anti-Malware software on these systems will not provide the required level of protection). 10.4. Anti-malware software

Documents
Anatomy of a cyberattack - Infocom SecurityEndpoint Protection. Protection with NextGen Endpoint Protection. Modern Malware. Zero-Day Malware. ... Deep Memory Analysis. Initial & Post

Anatomy of a cyberattack - Infocom SecurityEndpoint Protection. Protection with NextGen Endpoint Protection. Modern Malware. Zero-Day Malware. ... Deep Memory Analysis. Initial & Post

Documents
Threat Prevention with AMP (Advanced Malware Protection) · PDF fileThreat Prevention with AMP (Advanced Malware Protection) ... Presentation_ID Cisco and/or its affiliates. ... Examines

Threat Prevention with AMP (Advanced Malware Protection) · PDF fileThreat Prevention with AMP (Advanced Malware Protection) ... Presentation_ID Cisco and/or its affiliates. ... Examines

Documents
Think Outside the Sandbox Cisco AMP (Advanced Malware ... · PDF fileCisco AMP (Advanced Malware Protection) ... Think Outside the Sandbox Cisco AMP (Advanced Malware Protection)

Think Outside the Sandbox Cisco AMP (Advanced Malware ... · PDF fileCisco AMP (Advanced Malware Protection) ... Think Outside the Sandbox Cisco AMP (Advanced Malware Protection)

Documents
PA 1080 a 4210 MMPC L KeithleyBlueCableDoc

PA 1080 a 4210 MMPC L KeithleyBlueCableDoc

Documents
Network Visibility and Advanced Malware Protection · Network Visibility and Advanced Malware Protection James Weathersby, Director Technical Marketing ... of top 500 Android apps

Network Visibility and Advanced Malware Protection · Network Visibility and Advanced Malware Protection James Weathersby, Director Technical Marketing ... of top 500 Android apps

Documents
Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Email Malware Protection System - FireEye, Inc. · Email Malware Protection System Next-Generation Email Security to Stop Advanced Targeted Attacks The FireEye Email Malware Protection

Documents
Malware Protection

Malware Protection

Documents
Computer Malware Protection Policy

Computer Malware Protection Policy

Documents
Malware Protection Test...- 1 - Anti-Virus Comparative Malware Protection Test Dateierkennungstest mit Ausführung einschließlich Fehlalarmtest Letzte Überarbeitung: 12. April 2017

Malware Protection Test...- 1 - Anti-Virus Comparative Malware Protection Test Dateierkennungstest mit Ausführung einschließlich Fehlalarmtest Letzte Überarbeitung: 12. April 2017

Documents
Hawaii Tech Day- Cisco Advanced Malware Protection

Hawaii Tech Day- Cisco Advanced Malware Protection

Technology
Mmpc case study (1)

Mmpc case study (1)

Marketing
Modern Malware, Modern Defenses and Protection · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA chiock@slb.com

Modern Malware, Modern Defenses and Protection · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA [email protected]

Documents
Malware Removal and Firewall Protection · Malware Removal and Firewall Protection VISIT SITESASSURE.COM FOR YOUR FREE MALWARE SCAN Our security team will clean your website of malware,

Malware Removal and Firewall Protection · Malware Removal and Firewall Protection VISIT SITESASSURE.COM FOR YOUR FREE MALWARE SCAN Our security team will clean your website of malware,

Documents
SDN Malware: Problems of Current Protection Systems and ...cs.emis.de/LNI/Proceedings/Proceedings256/89.pdfSDN Malware: Problems of Current Protection Systems and Potential Countermeasures

SDN Malware: Problems of Current Protection Systems and ...cs.emis.de/LNI/Proceedings/Proceedings256/89.pdfSDN Malware: Problems of Current Protection Systems and Potential Countermeasures

Documents
AccessMiner Using System-Centric Models for Malware Protection

AccessMiner Using System-Centric Models for Malware Protection

Documents
Microsoft | Malware Protection Centerdownload.microsoft.com/download/D/2/C/D2C47748-0310-4D6F-AC72... · 3 Introduction This Microsoft Malware Protection Center (MMPC) Threat Report

Microsoft | Malware Protection Centerdownload.microsoft.com/download/D/2/C/D2C47748-0310-4D6F-AC72... · 3 Introduction This Microsoft Malware Protection Center (MMPC) Threat Report

Documents
Malware Protection Center - download.microsoft.com€¦ · Malware Protection Center System integration Hardening improvements Prevalent threats Advanced protection New technologies

Malware Protection Center - download.microsoft.com€¦ · Malware Protection Center System integration Hardening improvements Prevalent threats Advanced protection New technologies

Documents
Cisco Advanced Malware Protection для технических специалистов

Cisco Advanced Malware Protection для технических специалистов

Technology
Tracking Anti-Malware Protection 2015dennistechnologylabs.com/reports/s/a-m/symantec/... · Tracking Anti-Malware Protection 2015, A time-to-protect anti-malware comparison test Page

Tracking Anti-Malware Protection 2015dennistechnologylabs.com/reports/s/a-m/symantec/... · Tracking Anti-Malware Protection 2015, A time-to-protect anti-malware comparison test Page

Documents
Advanced Malware Protection Against ransomware

Advanced Malware Protection Against ransomware

Documents
MMPC Funding Programs Submission Documentation...MMPC Funding Programs Submission Documentation Richard A. McIndoe, Ph.D. MMPC Coordinating Unit Contact Information: Medical College

MMPC Funding Programs Submission Documentation...MMPC Funding Programs Submission Documentation Richard A. McIndoe, Ph.D. MMPC Coordinating Unit Contact Information: Medical College

Documents