Kaspersky Lab analysts are seeing over 50,000 new malware threats per day in the lab. The best defense against these threats is knowledge. Our Global Research and Analysis Team provided succinct presentations and discussion about the latest Internet threats that exist today, and offered tips to protect attendees from cybercriminals. These presentations provided a greater understanding of the threat landscape and what to expect throughout the rest of 2010.

1. New York City August 5, 2010

2. Welcome Randy Drawas Chief Marketing Officer Kaspersky Lab Americas

3. Kaspersky Lab Fighting Cybercrime for 25 Years Founded in 1997 Headquartered in Moscow,The Russian Federation Trained as cryptographer, Eugene Kaspersky got hit with one of the Internet’s very first viruses in 1986.

4. Kaspersky Technology Inside The World’s Largest OEM of Anti-Malware Technology (100+ Partners)

5. Fastest Growth in the Security Industry The world’s largest privately-held anti-malware company 100% focus on Threat Protection & Anti-Malware Protecting 300 million systems worldwide 50,000 new systems added every day! 2,000 experts globally #1 selling software in the U.S. retail This includes MS Office & World of Warcraft

6. Special Guest Scott Stratten UnMarketing @unmarketing

7. Today’s Moderator Ryan Naraine Security Evangelist Kaspersky Lab Americas

8. Agenda The Rise & Rise of Scareware Nico Brulez, Senior Malware Researcher, France

9. Agenda Behind the Scenes of Identity Theft David Emm, Senior Researcher, United Kingdom

10. Agenda Social Media & the Automation of Targeted Attacks Stefan Tanase, Senior Anti-Virus Researcher, Romania

11. Agenda Aurora Who? Roel Schouwenberg, Senior Anti-Virus Researcher, U.S.

12. The Rise & Rise of Scareware Nicolas Brulez, Senior Malware Researcher Global Research and Analysis Team

13. History and Evolution of Rogue AV 2006 Desktop hijackers, fake anti-spyware 2007 Fake registry cleaning tools added 2008 Desktop hijackers, Fake anti-virus (rogue anti-virus) 2009 System notifications (popup near the system tray) became standard behavior 2010 Fake anti-virus becomes more advanced Now includes phone, chat and e-mail support, uninstallers, multi-language support

14. Infection Vectors Black Hat SEO Spam Fake videos and fake codecs Social Networks Instant Messengers Downloaded and installed by prior malware infections

15. The number of detected malware: up to 70 Popup Wall paper Hijacking They copy the look and feel from legit Anti Virus products to display behavior detections Task Manager Injection Sounds, Screen blinking Fake Network Intrusion detection Scaring people 101

16. Real person Ready to answer any question Phone Support 24*7 Support E-mail support in anylanguage Rogue AV Support

17. Conclusion and Predictions Rogue AV has greatly improved during the past 4 years Professional graphical interface - localized Phone, email and live chat support – 24/7 Advanced scaring techniques Multiple ways to target new “customers” We predict improvements in the support systems to make them appear more legitimate New scaring and spreading techniques will appear in the future

18. Thank you! Nico Brulez Global Research and Analysis Team

19. Behind the Scenes of Identity Theft David Emm Global Research and Analysis Team

20. Setting the Scene: Cybercrime Cybercrime is a booming business It’s profitable. It’s easy to do. It’s low-risk. Botnets are a core component of the threat landscape. The drop-zone is where they stash the stolen loot. Let’s take a closer look at - Their modus operandi The drop-zone of a banking Trojan

22. aka Zbot, Wsnpoem, Kneber

23. The most popular banking Trojan in the wild

24. First appeared at the end of 2006

25. Thousands of versions available

26. Full pack with generic version

27. Cost = $500-$1,000

28. Full pack + unique exclusive version

29. Cost = $3,000-$5,000

30. Many plug-ins and modules available

32. Zeus Infections Worldwide

33. Command & Control Online Command & Control panels provide easy management of cybercriminal bot armies

34. Command & Control PDF exploits for Adobe Reader top the charts

35. C&C – Bot Geo Distribution The cybercriminals can easily see where their victims are located & even target specific geo areas!

36. C&C – Infection Statistics

37. C&C – Maintenance

39. A server configured to receive and store stolen data

40. This may amount to several GB daily.

41. Generally, cybercriminals like to take care of their valuables.

43. Dump File Analysis

44. Drop-Zone Logs Logs can be easily read and understood:

45. Drop-Zone Logs Thousands of credit cards, bank accounts

46. Intercepting Financial Transactions Cybercriminals can intercept financial transactions on-the-fly and change the receiving account to their own.

47. Profitability Evolution – Cybercriminal Group ‘X’ Total: $1.7 million -1000$ Even criminals have bad days 400% growth in 9 months

49. Highly profitable

50. Sophisticated but easy-to-use systems

51. Drop-zones can be closed, but new ones appear immediately.

52. There are many victims.

53. Mitigation is a process.

54. Modern hardware and software

55. Patches and updates

56. Internet security solution

57. The right security mindset

59. Social Media & the Automation of Targeted Attacks Stefan Tanase Global Research and Analysis Team

61. 2009: more than 15,000,000

63. Targeted attacks: threats to SMBs & enterprises

64. Targeted Attacks - Threats to Businesses

66. One email is enough, instead of tens of thousands

67. Targeted organizations are either not awareor don’t publicly disclose information

68. It is hard to get samples for analysis

69. Classic signature-based AV is useless

70. New defense technologies

71. Much higher stakes

74. Targeted Attacks Becoming Mainstream Targeted ads? Targeted attacks are already out there. Social networks Enabling cybercriminals to deliverautomated targeted attacks The personal data is there. Next step? Automation - Geographical IP location has been around for a while. Automatic language translation services are becoming better. Personal interests & tastes are public (ie: trending topics).

75. Geo Targeting Example

76. Language Targeting Example

77. Interests Targeting Example

79. User education and awareness

80. Human mind is hard to patch

81. Proactive protection technologies

82. Virtualization and sandboxing

83. Behavioral analysis

84. A highly motivated targeted attacker will eventually succeed.Kaspersky Lab US Press Tour - San Francisco & New York - August 2010

85. A Targeted Attack Demo

86. A targeted attack demo

87. Thank you! Stefan Tanase Global Research and Analysis Team

88. Aurora Who? Roel Schouwenberg Global Research and Analysis Team

90. Siemens SimaticWinCC specifically

91. Uses rootkittechnology

92. Spreads via USB sticks

93. Once infected, machines become part of the StuxnetbotnetKaspersky Lab International Press Tour, Cyprus, June 3-6, 2010

95. Stuxnet uses the vulnerability to spread via USB sticks

96. Infection near-automatic when plugging in infected USB

97. Monday, August 2nd - Microsoft published OOB patch

98. Exploits adopted by other families

100. Realtek and Jmicron certificates stolen

101. Verisign-signed files trusted by security softwareKaspersky Lab International Press Tour, Cyprus, June 3-6, 2010

102. Stuxnet Geographic Distribution Kaspersky Lab International Press Tour, Cyprus, June 3-6, 2010

104. Stuxnet has zero-day which works on old & new.

105. Stuxnet has signed drivers to evade security software.

106. Stuxnet uses Rootkit technology to hide itself.

108. Predictions Kaspersky Lab International Press Tour, Cyprus, June 3-6, 2010 Attack is too complex to become mainstream. Similar attacks likely to slip under radar. Microsoft must improve handling of signed files.

109. Thank you! Roel Schouwenberg Global Research and Analysis Team

110. Introducing Kaspersky Lab’s 2011 Consumer Security Peter Beardmore Consumer Product Team

111. 65 The Challenge Kaspersky Internet Security 2011 Stay Ahead Outwit Kaspersky Anti-Virus2011 Think Different Innovate 65

112. Today’s Security is Complex Frequent/Small Updates Geo Filter Virtual Keyboard Vulnerability Scanning UDS Privacy Cleaner Application Security Rating Heuristics iSwift/iChecker Application Control Firewall Proactive Defense Dynamic Rating AV engine Anti-Spam Web Toolbar Safe Run Gamer Mode System Watcher Cloud-based Threat Intelligence Rescue Disk w/USB option Network Monitor Anti-banner System Monitoring Safe Desktop Browser Configuration Safe Surf URL Filtering Parental Control 66

113. Kaspersky Makes It Easy and Intuitive 67

114. Kaspersky Makes It Easy and Intuitive 68

115. Kaspersky Makes It Easy and Intuitive 69

116. Today’s Premium Protection 70 Real-time Protection Emerging Threat Protection ID Protection Family Protection

117. 71 Real-time Protection Kaspersky Security Network URL Filtering Urgent Detection System New: Safe Surf Latest Threats

118. New: Safe Run for Web 72 Real-time Protection Kaspersky Security Network URL Filtering Urgent Detection System NEW: Safe Surf

119. Kaspersky Security Network URL Filtering Urgent Detection System NEW: Safe Surf NEW: Safe Run for Web 73 Real-time Protection New: Geo Filter

120. Proactive Defense Application Security Rating and Vulnerability Control Application Control 74 Emerging Threat Protection New: System Watcher Monitor Log Application Security Reverse

121. Proactive Defense Application Security Rating and Vulnerability Control Application Control NEW: System Watcher 75 Emerging Threat Protection New: Safe Desktop

122. v 76 ID Protection Anti-Phishing Virtual Keyboard Identity Information Control New: Proactive Phishing Protection

123. Block/Limit Access/ Log family activities Time Online Web Content File Downloads 77 Family Protection New: Added Features Communications via Email, IM, Social Network Contacts Personal Information(credit cards, phone #’s etc.) Specific words Applications Games Time on Computer

124. Kaspersky is Built for Speed 78 Intelligent Scanning Small, frequent updates Optimized

125. Kaspersky Even Installs On Infected Computers 79

126. 80 Kaspersky Internet Security 2011 Kaspersky Anti-Virus2011 Reassuring Optimized Different Always Ahead Relentless

127. Introducing Kaspersky Lab’s 2011 Consumer Security Peter Beardmore Consumer Product Team

128. Closing Monica Vila Chief Technology Mom The Online Mom

129. THANK YOU!