1. What We’re Up Against:
Why Good Guys Do Bad Things
Sherri Davidoff, GCFA, GPEN
LMG Security & BrightWise
June 12, 2019

2. Who Am I?
§Sherri Davidoff
§“Alien” of “Breaking and Entering”
§18 years as a cybersecurity professional
§CEO of LMG Security and BrightWise
§Training: Black Hat, FFIEC/FDIC,
American Bar Association, DoD & more
§COMING SOON! Data Breaches book
2
www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved.

3. www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 3
“A trip to Temkin’s is a trip back in time. Abe
was born in this building in 1922. He and his
wife, Annabelle, and daughter Sheila
provide old-fashioned customer service.” –
The Trenton Times, August 9, 1989
Roots

4. §State of Retail Cybersecurity
§The Latest Epidemic – Banking
Trojans
§Protect Yourself & Your Community
Roadmap
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 4

5. POS Hacks are Down… but Not Out
www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 5

6. Ecommerce Hacks are On The Rise
www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 6
https://arstechnica.com/information-technology/2019/05/more-than-100-commerce-sites-infected-with-code-that-steals-payment-card-data/

7. www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 7

8. Loyalty Under Attack
www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 8

9. www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 9

10. www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 10

11. The Cybersecurity Ecosystem
§Customers get hacked
§Vendors get hacked
§Due to security issues on
their OWN networks
§Retailers lose $$ and
reputation
11

12. The Granddaddy of All Banking Trojans

13. …Evolved into Much More

14. §Steal your passwords
§Hijack your online accounts
§Steal your payment card
numbers
§Steal your data
§Control your computer
§Install more malware!
What Can Banking Trojans Do?
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 14

15. Let’s Go Shopping!

16. We Got a 60-Day Trial License!

17. Comes With A Manual…

18. Let’s Infect The Victim
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 18

19. Don’t Click!!!

20. “Heartbeat”

21. Scan of the Infected Computer
The
malicious
executable

22. The Attacker’s Dashboard
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 22

23. I Know Your Balance
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 23
Infected
computers
Web sites
Account Balances
Image source: Manual for Citadel malware

24. Stealing Your Account Passwords

25. www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 25
Infected Computer: Attacker Sees:

26. All Your Passwords are Belong to Me!
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 26
Cached Password stolen
from Internet Explorer

27. I’m Stealing Your Files
Metered
Exfiltration

28. I’m Stealing All Your Data
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 28

29. I Know When You’re Working

30. I See You…
www.LMGsecurity.comCopyright LMG Security 2019. All rights reserved. 30
Victim
Attacker
clicks…

31. Protect Yourself and Your Community
www.LMGsecurity.comCopyright LMG Security 2017. All rights reserved. 31
1. Phishing Prevention
−User Training
−Technical Controls
2. Strong Authentication
−Two-Factor Authentication
−Long Passwords
3. Patch Management
4. Proactive Threat Hunting
5. Outreach/Education

32. Questions?
§Sherri Davidoff / LMG Security
−Email: info@LMGsecurity.com
−Phone: 406-830-3165
−@sherridavidoff
§Find me on
32