“the trick is to stop thinking of it as ‘your’ money” -...
TRANSCRIPT
1 © Copyright 2011 EMC Corporation. All rights reserved.
“The trick is to stop thinking
of it as ‘your’ money” - IRS
Technion Security Summer School 2012
Etay Maor
Research Lab Manager
4 © Copyright 2011 EMC Corporation. All rights reserved.
What Else Are Fraudsters Up To?
• Citadel – THE latest version of Zeus
• Acknowledge the community’s requests
• Modules include: – All previous Zeus components – Video recorder – Auto CMD (“This is a good feature to have when analyzing a
company’s internal structure”) – DNS redirection (“AVs, Banks”) – “Important: Our software does not work on Russian-language systems.
If a Russian or Ukrainian layout is detected, the bot terminates. This is done to prevent installs on CIS systems. You may disagree, but that’s taboo for us.”
7 © Copyright 2011 EMC Corporation. All rights reserved.
Mobile Vulnerabilities (POC)
– Insecure data storage
– HTML Injection
– Sensitive information disclosure
– Broken Cryptography
– And more…
• Source: OWASP Mobile Security Project