The recent cyber attacks against South Korean banks and TV stations highlight the growing problem enterprises of all types face in cyber space Hello, I'm Eric Trabro of information security media group And I'm pleased to be joined by McAfee lab senior vice president Vincent Weaver to analyze the attacks on South Korean institutions. Welcome, Vincent Thank you. It's great to be here Please take a few moments to characterize the attack So what happened this week was we saw a malware attack occurring in South Korea it really targeted some of the largest banks and both concerts in South Korea if he was a malware attack This malware attack tried to destroy disrupts the computer systems inside these organizations and did so by means of attacking We called a master group record the system Which really gives instructions for how to bring up the machine or how to get access to files and at the network All that attack is many systems were rendered to be numberable and therefore many services were to service This attack is very unusual most now where we talk about in a daily basis are Dimensionally motivated or going after your identity or information They're designed to be stealthy silent. They don't want to be seen and the one saying your system goes long as possible here We have the complete options.
This is designed to be seen and heard so they're for you look at a different motivation But the lessons here would be for all the users which is to make sure you change up that how quickly can you recover if you The impact of any malware attack here You want to make sure your information is protected and the services are able to continue going on a regular basis And so recovery and the ability to respond are very important You're seeing the motivation is different from other kinds of malware attacks How unusual are these kinds of attacks? These are the types of very unusual in the context of data destruction We look back over the last couple of years We see many of these involves an attack against our Korea in 2009 We had a July 4th at the night of service attacks where the botnet self-destruct is using some their technique in 2011 We had a tech called a 10 days of rain which again destruction mechanism last year No, this we had a shimu virus in the Middle East which did data destruction But these are really the exception periods of the normal rule of malware which are designed to be stealthy unseen and unheard Until actually extracted looking for which is money presenting should the defenses for this have a malware be different from the other types In general the best protection you would use in terms of securing your systems making sure you're packed up making sure they're available Make sure you got all fine backups will be the same making small malware cyber attacks However in this case since clearly what I'm looking to do is to start the services and destroy the data You really do need to make sure that you can restore your systems quickly So in this case ranking or media services But if they were home users same thing would apply which is how quick can you store your critical data if you are attacked or something occurs? So that's absolutely a lesson to learn here is understanding the motive of an attacker important in developing a defense Understand ourselves because we're looking at not just the tools used by the attackers But their motivation why are they going after certain people what information are looking for in the last number of years? We've seen a lot of attacks going after intellectual property Business plans information and that really drives the security strategy used by enterprise users companies how to protect what information they're trying to secure It certainly changes the security landscape.
We've gone from the old anti-malware models behavioral reputation analysis situational as security It really does evolve the both the protection speaking a couple days after this attack came to light There's suspicion on the North Korean government Although I don't think there's any definitive proof of that yet However, we're seeing more attacks a seem to be coming from countries with clinical motivations What does that say about the threat environment? So we're actually seeing more and more of a tax coming from we call nation states versus say criminal groups and activities The fact that analogy would use is the criminals are creating the tools the sophisticated root kids The toolkits that are used by many types of actors nation states They've been just one example of the type of actors out there And it really feels like sitting in the direction that we're seeing in a daily basis has been a section of our important infrastructure And that's it has gone beyond simply important to absolutely critical for our infrastructure and our protection We saw in South Korea and maybe even the DDOS attacks that we see from here in the US against banks Are they more just of a nuisance at this moment? And can they swell into something much larger? In general, the attacks are seem to be more than annoying It's not just that they take a lot of time and energy to respond to them They're the defenses cost time and money But in general it rarely kicks down a business or cripples an area People have learned the last package how to deal with them These type of attacks that we saw in South Korea where you see self-destruction Where they completely wipe out of the master boot records and file them system We saw last August in Italy is far more destructive They take more time to respond and we cover after the attacks So certainly that would be a ratcheting up of the income to be attacked That's compared to a DDOS, as soon as it's over You're almost back to the same year as a continuation of the evolution of the gun landscape And so for people listening it's fairly thinking about their protection What they do in terms of making sure their systems are secure, patches updates Making sure they're not going down the dark alleys of the internet All of those best practices apply here against these type of attacks That's the other study that they're making sure you're thinking about Will be non-PC devices in this case Some users are actually all the time as well But of course, we're increasing the same tax against Android devices Other time here is again, it's not just about protecting CFPC But making sure it's all your data is protected to the best of your ability Thanks, speaking with Vincent Weaver