“The trick is to stop thinking of it as ‘your’ money” - IRStce.webee.eedev.technion.ac.il/wp-content/uploads/sites/8/2015/02/... · “The trick is to stop thinking of it

1 © Copyright 2011 EMC Corporation. All rights reserved.

“The trick is to stop thinking

of it as ‘your’ money” - IRS

Technion Security Summer School 2012

Etay Maor

Research Lab Manager

[email protected]


1 2

6 5

RDP MITM Attack Scheme


VNC/RDP


What Else Are Fraudsters Up To?

• Citadel – THE latest version of Zeus

• Acknowledge the community’s requests

• Modules include: – All previous Zeus components – Video recorder – Auto CMD (“This is a good feature to have when analyzing a

company’s internal structure”) – DNS redirection (“AVs, Banks”) – “Important: Our software does not work on Russian-language systems.

If a Russian or Ukrainian layout is detected, the bot terminates. This is done to prevent installs on CIS systems. You may disagree, but that’s taboo for us.”


Citadel


Citadel + Ransomware


Mobile Vulnerabilities (POC)

– Insecure data storage

– HTML Injection

– Sensitive information disclosure

– Broken Cryptography

– And more…

• Source: OWASP Mobile Security Project


Portals, Redirectors and ATMs…O My…


Citadel Mobile Malware






Trojan Evasion


Trojan Evasion


XaaS


Security Awareness 101

“The trick is to stop thinking of it as ‘your’ money” - IRStce.webee.eedev.technion.ac.il/wp-content/uploads/sites/8/2015/02/... · “The trick is to stop thinking of it

Documents