Insights from CYREN's Q2 2014 Internet Threats Trend Report

1. 21 August 2014 © 2014 CYREN Confidential and Proprietary
INSIGHTS FROM CYREN'S
NEW Q2 TREND REPORT

2. © 2014 CYREN Confidential and Proprietary
2
IN TODAY’S WEBINAR
 Android ransomware and banking malware
 The rise and fall (and rise) of Zbot
 PDFs and Docs – real and unreal
 Worldwide, World Cup phishing
 Stock scams with Oakmont Stratton

3. © 2014 CYREN Confidential and Proprietary
3
© 2014 CYREN Confidential and Proprietary
ANDROID MALWARE TRENDS

4. © 2014 CYREN Confidential and Proprietary
4
PC RANSOMWARE

5. © 2014 CYREN Confidential and Proprietary
5
POLL – RANSOMWARE HONESTY
 Do you know someone who paid the ransom? Did
they get their files back?
 They paid and got their files back
 They paid and lost their files
 They refused to pay and lost their files
 They refused to pay and managed to regain access to their PC
 Happily I don’t know anyone who has been infected

6. © 2014 CYREN Confidential and Proprietary
6
ANDROID RANSOMWARE ARRIVES
 May – “ransomware” – but no encryption
 June – ransomware with encryption
AndroidOS/Simplocker.
A.gen!Eldorado.

7. © 2014 CYREN Confidential and Proprietary
7
ANDROID RANSOMWARE ARRIVES
 Before and after encryption
 Scans SD card and encrypts files like .jpg, .png, .doc amongst others

8. © 2014 CYREN Confidential and Proprietary
8
ANDROID IBANKING MALWARE
 SMS/spyware – collects
 Text messages,
 Phone calls
 Recorded audio
 Works in tandem with PC-
based malware
 Intercepts SMS codes sent by banks
 Android OS/Agent.HJ

9. © 2014 CYREN Confidential and Proprietary
9
UNKNOWN SOURCES?

10. © 2014 CYREN Confidential and Proprietary
10
NO MALWARE DETECTED
 ''Virus Shield'', priced at $3.99 in the Google Play
store
 30,000 copies in April
 Does nothing

11. © 2014 CYREN Confidential and Proprietary
11
POLL: YOUR MOBILE APPS
 Where do you download apps
 Android: The Google Play Store
 Android: Anywhere I can find apps
 iOS: Only the iTunes Store
 iOS: Jailbroken device – anywhere I can find apps

12. © 2014 CYREN Confidential and Proprietary
MALWARE TRENDS

13. © 2014 CYREN Confidential and Proprietary
13
A QUICK ZBOT HISTORY
 Zeus Trojan (PC) discovered ~2007
 Generally steals credentials - Banks, email,
social media
 Keyloggers, screenshots
 Sold as botnet creation kit
 Zeus botnet, other botnets
 Distributed command and control
 Millions of victims
 2012 – Microsoft takedown of SpyEye
 Gameover Zbot
 Peer to peer encrypted botnet
 June 2014- Operation Tovar disrupted botnet
 July – new variants emerging…

14. © 2014 CYREN Confidential and Proprietary
14
ONE OF THE LAST ZBOT EMAILS
 Attachment: Eonenergy-Bill-29052014.scr displays a
PDF icon
 W32/Zbot.BXN

15. © 2014 CYREN Confidential and Proprietary
15
ANOTHER ZBOT SENT USING DROPBOX

16. © 2014 CYREN Confidential and Proprietary
16
ACTUAL PDFS CAN ALSO BE PROBLEMATIC
 Securedoc.pdf from BoA
 Versions of reader attacked: 9.3x – 9.5x, 10.1x, 11,
11.001
 (The current version is 11.0.07)

17. © 2014 CYREN Confidential and Proprietary
17
WORD DOCS TO AVOID
 traking_doc_MW42133077
1CA.doc
 aircanada_eticket_[random
_number].doc
 efax__[random_number].d
oc
 file-
_[random_number]_doc
 President Obama’s
Speech.doc

18. © 2014 CYREN Confidential and Proprietary
18
SECURITY EDUCATION POLL
 Do you think people are aware that a PDF or Doc file
could be harmful?
 Yes
 No

19. © 2014 CYREN Confidential and Proprietary
PHISHING TRENDS

20. © 2014 CYREN Confidential and Proprietary
20
WORLD CUP PHISHING
 Chance to win “World-Cup” related prizes
 Cielo – biggest credit card provider in Brazil

21. © 2014 CYREN Confidential and Proprietary
21
GLOBAL BANK PHISHING
 Global brands
 American Express, Bank of America, or Barclays
 Country-specific
 Natwest (Britain)
 Danske Bank (Denmark)
 Swedbank and SEB (Sweden)
 Bank of India (India)
 Credem (Italy)
 Hypovereinsbank (Germany)

22. © 2014 CYREN Confidential and Proprietary
SPAM TRENDS

23. © 2014 CYREN Confidential and Proprietary
23
SPAM LEVELS
 Spam levels continue to drop
 June average is lowest in 5 years!
Q2 Average
55 Billion
June Average
49 Billion

24. © 2014 CYREN Confidential and Proprietary
24
Q2 SPAM TOPICS
Pharmacy Products
43%
Job Offer
22%
Stock
17%
Diet
8%
Other
4%
Online Casino
3%
Phishing
2% Malware
1%
Pharmacy Products
Job Offer
Stock
Diet
Other
Online Casino
Phishing
Malware

25. © 2014 CYREN Confidential and Proprietary
25
PUMP AND DUMP - RCHA
 Buy: 417,000 @ 0.19
 Sell: Many more @ 0.36
 Profit ~$63,000

26. © 2014 CYREN Confidential and Proprietary
26
Q2 SPAM COUNTRIES, SPAM ZOMBIES
Argentina
8%
Spain
8%
Vietnam
7%
United States
6%
Germany
5%
Italy
5%
Iran
4%Brazil
4%
Colombia
4%
Mexico
3%
Others
46%

27. © 2014 CYREN Confidential and Proprietary
27
SAVING HOSTING COSTS…
 Google Docs phishing email
 Google logo at the top stored on legitimate Internet security blog called
http://www.onlinethreatalerts.com/

28. © 2014 CYREN Confidential and Proprietary
GLOBALVIEW

29. © 2014 CYREN Confidential and Proprietary
29
GLOBALVIEW CLOUD AND PRODUCT FAMILIES
WEB EMAILANTIMALWARE
CYREN WebSecurity
URL-Filtering
MobileSecurity
AntiVirus
CYREN EmailSecurity
Email Messaging Suite
AntiSpam
Outbound AntiSpam
IP Reputation
AntiVirus for Email
GlobalViewTM Cloud

30. © 2014 CYREN Confidential and Proprietary
30
We focus on our core
competencies so our
partners can focus
on theirs.
 Technical Account Managers
 Partner Success Program
COMMITTED TO PARTNER SUCCESS
WHAT MAKES US DIFFERENT
© 2014 CYREN Confidential and Proprietary

31. © 2014 CYREN Confidential and Proprietary
ANY QUESTIONS?