Upload File

the case of the mistaken malware

12
Forensic Files Series The Case of the Mistaken Malware

Upload: securitymetrics

Post on 22-Apr-2015

213 views

Category:

Technology


1 download

Report

DESCRIPTION

 

TRANSCRIPT

Page 1: The Case of the Mistaken Malware

Forensic Files SeriesThe Case of the Mistaken Malware

Page 2: The Case of the Mistaken Malware

Business backgroundSmall retailer operates one main store, multiple satellite stores, and two corporate offices.

All sites connected to the same card processing environment.

Page 3: The Case of the Mistaken Malware

Business background

During a routine anti-virus log review, in-house IT staff member finds Sirefef rootkit at satellite store.

Page 4: The Case of the Mistaken Malware

What is a rootkit?A rootkit is a type of malicious software activated each time a system boots up.

They are difficult to detect because they reside at the system’s kernel level, and are activated before a system’s operating system has completely booted up.

Page 5: The Case of the Mistaken Malware

How hackers got inCompromised the credentials for the remote access application, LogMeIn.

Installed Sirefef, a sophisticated rootkit that can spread spam or capture sensitive information such as passwords or credit card data.

Page 6: The Case of the Mistaken Malware

Forensic investigator findingsInvestigator finds the Sirefef rootkit did not actually steal customer credit cards.

Further investigation revealed a memory scraper called Alina (installed by the same hacker), designed specifically to capture payment information from POS terminals.

Page 7: The Case of the Mistaken Malware

What is a memory scraper?A memory scraper is designed to capture, or ‘scrape’ sensitive information from system memory (RAM) and return it back to the attacker.

The Alina memory scraper can morph into newer versions to avoid detection, or automatically reinstall in different locations if deleted.

Page 8: The Case of the Mistaken Malware

What the business did wrong

Retailer didn’t employ two-factor authentication to secure remote access into their main store, satellites, and corporate offices.

Page 9: The Case of the Mistaken Malware

What’s 2-factor authentication?

Two factor authentication is an extra layer of security that requires not only a password and username but also something only the user should know/have (e.g., a fingerprint).

Page 10: The Case of the Mistaken Malware

What the business did wrong

Although they regularly reviewed anti-virus logs, IT staff did not regularly update anti-virus program and system security patches.

Page 11: The Case of the Mistaken Malware

What the business did wrong

In addition, the credit card processing environment was not segmented away from routine Internet traffic.

Page 12: The Case of the Mistaken Malware

SecurityMetricsWe Protect Business

ServicesPCI, HIPAA, & data security solutions for businesses of all sizes

QualificationsGlobal provider of ASV, QSA, PFI, PA QSA, P2PE services

ExperienceAssisted over 1 million organizations with compliance needs


Delta Goodrem Mistaken Identity Book

Malware Armoring: The case against incident related binary ... · Malware Armoring: The case against incident related binary analysis Author Name: Steve Hendrikse Date: February 2011

Banach’s Doctorate: A Case of Mistaken Identity

Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Arab Nationalism: Mistaken Identity

Instrumenting Point-of-Sale Malware - DEF CON® …...nstrumenting Point-of-Sale Malware: A Case Study in Communicating Malware Analysis More Effectively, Wesley McGrew, DEFCON, DEF

CASE Qf The Kokopenace A Case Mistaken Identity · Mistaken Identity by Julian N. Falconer, This article is offered as an expres sion of concern about the direction of our nation's

A Case of Mistaken Identity - SE-EPPC · 2009. 1. 23. · Mistaken Identity Native and Exotic “Boston Ferns” and “Sword Ferns” (Nephrolepis spp.) Ken Langeland University

” Contemporary Slavery: A Case of Mistaken Identity? ”

Mistaken Identity - University of Arizona

A case of mistaken identity: Asystole causing convulsions ...A case of mistaken identity: Asystole causing convulsions identified using implantable loop recorder. Khalil Kanjwal, Beverly

A Case Study in Malware Research Ethics Education When ... · A Case Study in Malware Research Ethics Education When teaching bad is good . ... Cyber-security Research Ethics Dialog

Mistaken IdentityPART3

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

James M. Acton...espionage could be mistaken for a cyberattack. Second, malware could accidentally spread from systems that supported non-nuclear operations to nuclear-related sys-tems

A Case of Mistaken Identity - Internal Medicine · A Case of Mistaken Identity: Identifying Rheumatology Mimics Sharon L Kolasinski MD FACP FACR Professor of Clinical Medicine Division

123. Islam a Case of Mistaken Identity

Sherlock Holmes and His Creator: A Case of Mistaken Identity

Kaurna in Tasmania: A case of mistaken identitypress-files.anu.edu.au/downloads/press/p72561/pdf/...Kaurna in Tasmania: A case of mistaken identity Rob Amery Until now, a list of some

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Mistaken Release

the mistaken extinction

Art education: a case of mistaken identity? Alka Sehgal

SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

Mistaken Love by MzKISSEShere

Mistaken for - iiNet

Is Dave Ramsey Mistaken?

Intezer- leading telco case study - Genetic Malware Analysis · Intezer introduces a Genetic Malware Analysis approach, offering enterprises unparalleled and accelerated incident

Malware & Anti-Malware

Character-distinguishing features in fictional dialogue: the case … · 2020. 12. 11. · ilarities than Delta does. For instance, joyful Natasha in this case is never mistaken for

Parasitology (Laboratory) - NEMATODES - Mistaken Stuff

Tracking surreptitious malware distribution …2012.zeronights.org/includes/docs/Yarochkin, Kropotov, Chetvertakov...Tracking surreptitious malware distribution channels Case study

SANS Case Study- Basic Malware Analysis

Mistaken Identity pt 2