Anti-Crimeware

Today’s Cybercrime is a fast-expanding, global industry, operating in a major shadow economy that closely mimics the real business world, including profit-driven organized cybercrime. Money is the driving force behind the growth of targeted attacks against financial institutions, enterprises and governmental agencies.

During the last few years, there has been a significant rise in attempted and successful data breaches, focused on stealing valuable data that can be used or traded for profit. Financial and healthcare related information, single sign-on login credentials for organizations, and email exchanges are prime targets. The potential business damage to organizations as a result of cybercrime includes financial damages, lawsuits, brand damage and compliance failure. The growing use by enterprises of the latest Web 2.0 technologies for their business operations makes them especially vulnerable for Web 2.0 attacks.

Growth of new Trojans used in cybercrime attacks

The cybercrime evolution is quite spectacular.

• The first phase consisted of the commercialization of malicious code
  (as covered in Finjan’s Web Security Trend Report Q2, 2006)
• It was followed by the use of code obfuscation as a means to bypass traditional signature-based solutions in order to propagate malicious code.
  (as covered in Finjan’s Web Security Trend Report Q4, 2006)
• The next stage was the introduction of evasive attacks, designed to evade anti-virus or the URL filtering solutions
  (as covered in Finjan’s Web Security Trend Report Q2, 2007)
• Cybercriminals then started to use Crimeware-as-a-Service to enhance their operations
  (as covered in Finjan’s Web Security Trend Report Q1, 2008)
• Cybercriminals started copying the structure and modus operandi of organized crime syndicates
  (as covered in Finjan’s Web Security Trend Report Q2, 2008)
• Malicious obfuscated code remains a favorite crime tool, and is now not only embedded in standalone or embedded scripts in HTML webpages, but also in rich-content files
  (as covered in Finjan’s MPOM September 2008)
• Rogueware affiliate networks started to use SEO techniques to distribute their rogue Anti-Virus Software for profit. Typos and misspelled keywords (such as “obbama” and liscense”) as well as trendy keywords taken from Google Trends system were abused to show compromised websites as top search results.
  (as covered in Finjan’s Cybercrime Intelligence Report Issue 1, 2009)
• A new cybercrime milestone was reached with the operations of an advanced trading network and botnet where compromised PCs are bought and sold for profit.
  (as covered in Finjan’s Cybercrime Intelligence Report Issue 2, 2009)
• Cybercriminals targeting online bank customers introduced an “Anti anti-fraud” method to minimize detection by the anti-fraud systems used by banks. They used a combination of Trojans and money mules.
  (as covered in Finjan’s Cybercrime Intelligence Report Issue 3, 2009)

Finjan’s unified Web security solutions are uniquely capable of protection organizations and companies - regardless of their size, location or business activities - against crimeware, malware and data leakage with its patented real-time content inspection technologies and optional Anti-Virus modules. It therefore provides a unified web security solution combining multi-layered security with productivity, liability and bandwidth control via URL categorization, content caching and applications control technologies.

“After Finjan’s comprehensive evaluation, we realized that our current network firewall and Anti-Virus solutions had serious limitations when it came to detecting unknown Crimeware attacks originating from the Web. Since deployment of Finjan’s secure web gateway solution, maintenance of our security solution has become much easier and requires less resources. Finjan’s active real-time web security protects our networks from stealthy Trojans and Crimeware,” Claudio Pieri, Vice President Information Systems at Lotto Sport Italia For the full case study click here