4th Latin American Security Analysts Summit in Cartagena

Casco Historico, Cartagena, Colombia

Last week, GReAT LatAm had the pleasure of participating in the Fourth Latin American Security Analysts Summit in Cartagena, Colombia. We were joined by 29 journalists from 12 different countries throughout the region and a guest speaker. This is one of our favorite events as it presents a rare opportunity to discuss ongoing research with journalists one-on-one and address security concerns at a regional level. The LatAm focus of the event allows us to examine the ‘latin flavor’ of cybercrime and cyberespionage originating within our borders.

The Summit was divided into two days. The first day involved presentations ranging from the evolution of the threat landscape to issues involving wearable devices, the disturbing trend of ‘camfecting’, and new tendencies in Brazilian trojan bankers now aided by cooperation with Eastern European cybercriminals. The second day largely revolved around APTs and cyberespionage campaigns as well as mobile threats affecting integration with the cloud.

Hyperconnected Threats

The ever-charismatic Fabio Assolini discussed a favorite topic of his, the development of banking trojans in his native Brazil. The country is known for its carder culture and widespread cybercrime. Interesting figures presented included the correlation between the cost of Zeus and Caberp and their infection rates in the region, as we witness an exhorbitant rise in the rate of infection once their respective source codes leak and effectively eliminate the initial investment on the part of the criminals. Fabio also unveiled the link between Brazilian and Eastern European cybercriminals who are now exchanging knowledge through online resources to enhance their crimes.

Our very own Santiago Pontiroli took to the stage to discuss mobile- and cloud-based attack vectors in a presentation rife with Orwellian parallels and forewarnings. Santiago discussed Latin America’s proclivity for piracy and pornography as presenting massive opportunities for cybercriminals fully willing to exploit them.

Android, a platform enjoying wide-adoption in the region is also an increasingly appealing target for cybercriminals as evidenced by the fact that 98% of mobile malware detected in 2013 were aimed at Android devices –a number that doubled in the first quarter of 2014! Many of these devices are now integrated with the cloud which breathes new life into old phishing schemes whose pay-off now includes extensive access to personal data, storage, and even real-time location information. Some criminals have gone so far as to misuse manufacturer recovery services to act as pre-installed ransomware.

Roberto Martinez and I took on the topic of wearable technologies, increasingly popular devices that collect all kinds of stats about their users, store personal information, and are designed to be worn continuously. I focused on the Samsung Galaxy Gear 2 smartwatch and the ease with which it can be misused by deviants in the ‘creepshots’ community, as rooting and executing a handful of commands disables camera alerts and recording limitations. Roberto focused on Google Glass whose integrated wifi capability leaves it susceptible to tried-and-true sniffing to expose some of the traffic being relayed to the device.

Emphasizing that the design itself of wearable devices has a propensity to embolden well-known methods of attack as users have limited access to information regarding altered applications or suspicious connections. As wearable devices function by linking with a mobile device, they can eventually become an interesting means for persistent attacks as they are capable of interacting with the information on our phones without being subject to the security measures of their master devices.

Evolving Threats in Cyberespionage

On the cyberespionage front, we saw two thought-provoking and exciting presentations:

We were joined by Jaime Blasco, Director of Research at Alienvault and a close friend of GReAT. Jaime discussed an overview of APT campaigns over the past decade, the measures developed to understand them, and traits that help categorize the work of recurring nationstate players.

Dmitry Bestuzhev announced GReAT’s discovery of the first ever cyberespionage campaign of Latin American origin! The Machete campaign affected military, diplomatic, and governmental institutions in 15 countries, primarily Venezuela, Ecuador, and Colombia. Interestingly, though LatAm has been considered by many as lacking the infrastructure for sustained cyberespionage, research revealed that the campaign has been active since 2010.

Finally, no Kaspersky event would be complete without an active entertainment day for all participants. We retreated to the Cartagena Golf Club for an afternoon of activities ranging from kayaking and beach volleyball to cocktail-making, dance lessons, and guided flower arrangements, as well as a massage area. The evening concluded with a gala dinner accompanied by the traditional music and dances of Colombia and closing words from our thoughtful organizers. I hope you can join us next year!

For more follow me on twitter: @juanandres_gs