1. INSIGHTS FROM CYREN'S
NEW Q3 TREND REPORT
31 October 2014 © 2014 CYREN Confidential and Proprietary

2. 2
© 2014 CYREN Confidential and Proprietary
IN TODAY’S WEBINAR
 Apple users targeted
 Shellshock
 Exploiting tragedy
 DNS abuse
 Diet spam is good for you

3. 3
© 2014 CYREN Confidential and Proprietary
CELEBRITY PHOTO HACK – HOW?
1) Vulnerability in iCloud
2) Vulnerability in Find My iPhone
3) Phishing
4) Brute force password
5) Answering password questions
6) Using other account data
7) 3-6 combined
8) One hacker
9) A whole bunch of hackers
10) Anyone who was at the Golden Globes

4. 4
© 2014 CYREN Confidential and Proprietary
MOST LIKELY….
“After more than 40 hours of
investigation, we have discovered that
certain celebrity accounts were
compromised by a very targeted attack on
user names, passwords and security
questions, a practice that has become all
too common on the Internet. None of the
cases we have investigated has resulted
from any breach in any of Apple’s systems
including iCloud® or Find My iPhone.”
Chris Chaney

5. 5
© 2014 CYREN Confidential and Proprietary
APPLE PHISHING
ssl.apple.com.update-id…….

6. 6
© 2014 CYREN Confidential and Proprietary
POLL – APPLE PHISHING
 Have you received an Apple phishing email in the last
2 months?

7. 7
© 2014 CYREN Confidential and Proprietary
APPLE LEGITIMATE EMAIL CONFUSION
…. And “free” iPhone 6 offers
....And: OS X bash Update 1.0.....

8. 8
© 2014 CYREN Confidential and Proprietary
Shellshock
• Disclosed publicly in late September
• Deemed by many as the “world’s most dangerous
Internet security bug.”
• Security hole in the Unix/Linux “Bash” Shell,
version 1.0.3.
• Completely unnoticed for 21 years
• Leaves hundreds of millions of Internet-connected
devices (including servers and
computers) vulnerable to hackers
• Hackers began exploiting it almost immediately
upon the announcement
• Could have been going on for years

9. 9
© 2014 CYREN Confidential and Proprietary
BASH? ENVIRONMENT VARIABLES?

10. 10
CYREN: Unix/Flooder.AN (CGI attack)
© 2014 CYREN Confidential and Proprietary
EXAMPLES AND USES
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
http-header = Cookie:() { :; }; ping -c 3 209.xx.230.74
• “Getting shell” on a box has always been a major win for an attacker
• Control over the target environment
• Access to internal data
• Reconfiguration of environments
• Publication of malicious code etc.
• Almost limitless
• Readily automatable
Thanks to: http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html

11. 11
© 2014 CYREN Confidential and Proprietary
POLL: SHELLSHOCK
 What do you think about Shellshock?

12. 12
© 2014 CYREN Confidential and Proprietary
EXPLOITING TRAGEDY

13. 13
© 2014 CYREN Confidential and Proprietary
MALWARE DOWNLOAD

14. 14
© 2014 CYREN Confidential and Proprietary
ADWARE, PUA
…And IS (ISIS)

15. 15
© 2014 CYREN Confidential and Proprietary
419

16. © 2014 CYREN Confidential and Proprietary
MALWARE TRENDS

17. 17
© 2014 CYREN Confidential and Proprietary
DUNIHI RAT
• Dunihi is a RAT (Remote Access Tool)
• Provides backdoor access to the infected system
• Run a command instructions in command shell
• Download and execute files which may include other malware
• Update or uninstall a copy of itself
• Send a local file for upload
• Delete a local file or folder

18. 18
© 2014 CYREN Confidential and Proprietary
MICROSOFT VS. HOUDINI
• Microsoft filed civil lawsuit against:
• Mohamed Benabdellah
• Naser Al Mutairi
• U.S. company, Vitalwerks Internet Solutions, LLC (doing business as No-IP.com)
• …”for their roles in creating, controlling, and assisting in infecting millions of
computers with malicious software—harming Microsoft, its customers and the
public at large.”
• Bladabindi (NJrat) and Jenxcus (NJw0rm)
• Distributed using No-IP domains 93 percent of the time.
• Over 8 million infections

19. 19
© 2014 CYREN Confidential and Proprietary
DYNAMIC DNS
• For good:
• Remote access your computer, DVR,
webcam, security camera or any
internet connected device easily
• Dynamic DNS points an easy to
remember hostname to your
dynamic IP address
• For bad:
• Agile evasion technique against IP
blacklisting
• Deliver malicious payloads from
constantly-changing hosting IPs
• Use randomly-generated disposable
subdomains under the dynamic DNS
domain

20. 20
© 2014 CYREN Confidential and Proprietary
DNS POISONING
• Attacker exploits a flaw in the DNS software
• Data is introduced into a DNS cache database
• Causes the DNS to return an incorrect IP address
• Diverting traffic to malicious computer
Customers
of ISP
redirected
to phony
banking
site

21. 21
© 2014 CYREN Confidential and Proprietary
DNS POISONING
You
Hacked
DNS (ISP)
Good
DNS
Fake
site
Real
site

22. 22
© 2014 CYREN Confidential and Proprietary
YOUR DNS PROVIDER
 Who do you use as your DNS provider?
 Google
 OpenDNS
 Your ISP
 Another provider
 Not sure…

23. © 2014 CYREN Confidential and Proprietary
SPAM TRENDS

24. 24
© 2014 CYREN Confidential and Proprietary
SPAM LEVELS
 Daily average of 55 billion, averaged 68%

25. 25
© 2014 CYREN Confidential and Proprietary
ZOMBIE COUNTRIES
Russian Federation
11.5%
Vietnam
11.4%
China
9.9%
India
9.4%
Iran
Taiwan 5.6%
4.7%
Argentina
3.1%
Ukraine
3.0%
United States
3.0%
Brazil
2.4%
Italy
1.4%
Korea
1.6%
Saudi Arabia
1.8%
Germany
1.8%
Thailand
1.3%
Others
28.0%

26. 26
© 2014 CYREN Confidential and Proprietary
SPAM TOPICS

27. 27
EATING LOW CALORIE SALADS WILL MAKE YOU GAIN WEIGHT…
© 2014 CYREN Confidential and Proprietary

28. © 2014 CYREN Confidential and Proprietary
GLOBALVIEW

29. 29
© 2014 CYREN Confidential and Proprietary
GLOBALVIEW CLOUD AND PRODUCT FAMILIES
GlobalViewTM Cloud
WEB ANTIMALWARE EMAIL
CYRENWebSecurity
URL-Filtering
MobileSecurity
AntiVirus
CYREN EmailSecurity
Email Messaging Suite
AntiSpam
Outbound AntiSpam
IP Reputation
AntiVirus for Email

30. 30
WHAT MAKES US DIFFERENT
COMMITTED TO PARTNER SUCCESS
© 2014 CYREN Confidential and Proprietary
We focus on our core
competencies so our
partners can focus
on theirs.
 Technical Account Managers
 Partner Success Program

31. © 2014 CYREN Confidential and Proprietary
ANY QUESTIONS?
Test your knowledge on Internet security in our quiz!
http://pages.cyren.com/2014-Q4_Internet-Threats-Quiz.html