The malware monetization machine
•
1 j'aime•173 vues
A new generation of Internet startups is focused on converting malware infections into revenue. Who are these new CEOs, what can we learn from their business models? No longer in the shadows of the dark web, they are businessmen scaling operations and driving revenue. This session will discuss how malware is being monetized as a sustainable business, showing a realistic picture of what we’re up against. (Source :RSA Conference USA 2017)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à The malware monetization machine
Similaire à The malware monetization machine (20)
Plus de Priyanka Aash
Plus de Priyanka Aash (20)
Dernier
Dernier (20)
The malware monetization machine
- 1. SESSION ID:SESSION ID: #RSAC Tony Anscombe The Malware Monetization Machine SPO2-R11 VP and Senior Security Evangelist Avast @TonyAtAVG
- 2. The Malware Monetization Machine Tony Anscombe ***********
- 3. #RSAC Malware Inc. The Business 3
- 4. #RSAC Malware Inc. The Business 4 30 employees Healthcare, vacation, lunch, gym membership Goal: grow distribution and use of software increasing LTV and ROI 2 offices located anywhere Revenue 2015 - $25m 2016 - $1bn 2017 - >2x growth?
- 5. #RSAC Malware Inc. Products and Services 5 Software distribution Data storage and encryption Data collection and sales Support services
- 6. #RSAC Malware Inc. Software Distribution Q4 Recap 6 Q4 software distribution campaigns Email delivery • 20m emails delivered to 12m unique users • Open rate • Execution of the software package • Conversion rates to paying customer
- 7. #RSAC Malware Inc. Software Distribution Q4 Recap 7 Q4 software distribution campaigns Hosted website downloads • Automated - drive by download • Unique users vs actual delivery/installation • User initiated - click jacking • CTR - Click Through Rate 0.5%
- 8. #RSAC Malware Inc. Q4 Data Business 8 Q4 data collection Mobile App distribution Collected from 3rd parties Service redirection Email campaigns
- 9. #RSAC Malware Inc. Bonus Payments Over achievement on goals Revenue exceeded target All staff will receive a 110% bonus We shutdown for the holidays early, congratulations! 9
- 10. #RSAC Malware Inc. Bonus Payments Over achievement on goals Revenue exceeded target All staff will receive a 110% bonus We shutdown for the holidays early, congratulations! 10 January 17, 2017 Locky down as cybercrime takes a brief December holiday
- 11. #RSAC Malware Inc. Q1 Target Markets 11
- 12. #RSAC Malware Inc. Q1 Target Markets High monetizing countries 12
- 13. #RSAC Malware Inc. Q1 Initiatives 13 A/B testing of offer screens
- 14. #RSAC Malware Inc. Q1 Testing Payment Methods 14
- 15. #RSAC Malware Inc. Q1 Translation 15 12 Languages to be offered
- 16. #RSAC Malware Inc. Q1 Time Sensitive Offers 16 Early purchase discounts
- 17. #RSAC Malware Inc. Q1 Detecting Fraud 17
- 18. #RSAC Malware Inc. Q1 Legacy Customers 18
- 19. #RSAC Malware Inc. Q1 Software Sales 19 Product sales security software
- 20. #RSAC Malware Inc. Q1 Identity Duplication 20 Stealing login details
- 21. #RSAC Malware Inc. Q1 Identity Duplication 21 X
- 22. #RSAC Malware Inc. Q1 Mobile 22
- 23. #RSAC Malware Inc. EOL Products 23 Banking Trojans Premium rate SMS
- 25. #RSAC Malware Inc. Q1 Outsourced Engineering 25 Bot nets/herders Exploit writers Malware writers Infrastructure/tool providers
- 26. #RSAC Malware Inc. The Competition 26
- 29. How do we combat?
- 30. #RSAC Overall security threat is growing in complexity Mobile threats are also accelerating People’s Security Needs are Growing Total malware threats, millions (Cumulative malware threat attacks, million) 2010 2011 2012 2013 2014 2015 47 65 470 183 100 326 0.35 1.01 4.26 10.6 585 2016 17.0 30 Mobile malware threats, millions (Cumulative malware threat attacks, million)
- 31. #RSAC Probability of Attack - The Americas 31
- 32. #RSAC Probability of Attack - The Americas 32 CA: 15% US: 14% MX: 21% BR: 20% PE: 27% FR: 16% PT: 18% MA: 29% SN: 28% …
- 33. #RSAC Probability of Attack - Most of ROW 33
- 34. #RSAC Probability of Attack - Most of ROW 34 CZ: 27% EG: 25% RU: 25% ET: 41% KZ: 27% SA: 14% TZ: 23% IN: 28% LK: 29% …
- 35. #RSAC How do we combat? 35 Incidents per day 23.7 million
- 36. #RSAC How do we combat? 36 Incidents - rolling 30 687.0 million
- 37. #RSAC Where do threats hide?
- 38. #RSAC Ransomware - 2016 #1 Threat 150 new strains of ransomware 128,108,948 x $500 = (detections) (average ransom)
- 39. #RSAC Ransomware - 2016 #1 Threat 150 new strains of ransomware 128,108,948 x $500 = $ 64,054,474,000 105% growth year on year (detections) (average ransom)
- 40. #RSAC Ransomware Hotspots 1. US 2. Brazil 3. Russia 4. UK 5. Mexico 6. Italy 7. Spain 8. Canada 9. Poland 10. Australia 11. India 40
- 41. #RSAC Combatting Ransomware Many different forms Scareware, screen lockers, crypto lockers, Doxingware Ransomware is detected on every protection layer, including behavioral analysis 14 ‘Free’ decryption tools available Decryption is a last resort Not Decryptable , 0.565 Decryptable , 0.3785 Plausible Decryption , 0.0565 41
- 42. #RSAC Connected devices estimated to reach up to 50 billion by 2020 Source: Cisco IBSG Report 42 Internet of Things is Exploding Avast Confidential
- 43. #RSAC Enslaved IoT Devices IoT attacks more frequent: • DDoS attack on Dyn • 900,000 Telekom routers attacked • 2016: from more than 4.3 million routers scanned, 48% had some security vulnerability • More than 50% of all home routers use default passwords • 2 out of 5 people are unaware that their router has an administrative interface where they can log in to view and change their settings • 1 out of 7 log into their router’s admin interface weekly or monthly to check for updates43
- 44. #RSAC Avast Confidential 44 Over 400M endpoints acting as sensors. Allow us to detect and neutralize threats fast. Largest, most sophisticated, most geographically dispersed threat detection network. World’s largest security-centric machine-learning network. About Avast Leveraging data analytics to improve customers online lifestyle. 8,524 virtual, 2,527 physical and 443 AWS servers 82,600 simultaneous VPN connections 2.1m DNS requests (normal and secure) per second 3.6tr URLs processed per year 45.8m concurrent connections Pushed 110pb of data in last three months
- 45. #RSAC Best Practices for a Ransomware Defense: 45 Ensure your systems, applications and devices are fully updated and patched Ensure you have strong layered anti-malware security solution Educate employees not to open suspicious attachments Disable Microsoft Office macros by default as a policy Keep recent backup copies, disconnected and offsite
- 46. #RSAC Summary 46 Anti-Malware is a passionate business Malware is a business X