Bots Combine! : Behind the Modern Botnet. Andrea Sept 1, 2017
|
|
|
- Dinah Harmon
- 5 years ago
- Views:
Transcription
1 Bots Combine! : Behind the Modern Botnet Andrea Sept 1, 2017
2 Security Research Cisco Umbrella (formerly OpenDNS) in San Francisco since 2015 Previously a System Administrator for 12 years
3 What is a botnet?
4 What is a botnet?
5 What is a botnet?
6 Why research botnet infrastructure? Click here!! $$$$$$$$$$$$$$
7 Hard Problem to Solve
8 Hard Problem to Solve Millions of infected devices all over the globe - no central location
9 Hard Problem to Solve Millions of infected devices all over the globe - no central location Locations hidden - proxied Rent cheaply - no setup
10 Hard Problem to Solve Millions of infected devices all over the globe - no central location Locations hidden - proxied Rent cheaply - no setup Infections go undetected
11 Hard Problem to Solve Millions of infected devices all over the globe - no central location Locations hidden - proxied Rent cheaply - no setup Infections go undetected Leaking information Providing bandwith to the botnet
12 LIFECYCLE OF A BOT
13 LIFECYCLE OF A BOT Infection & Spreading SPAM, Injected Code or Malvertising Infection & Spreading
14 LIFECYCLE OF A BOT Infection & Spreading SPAM, Injected Code or Malvertising C&C Contact/Rallying Static IP lists, Domain Flux, IP flux Infection & Spreading C&C Contact
15 LIFECYCLE OF A BOT Infection & Spreading SPAM, Injected Code or Malvertising C&C Contact/Rallying Static IP lists, Domain Flux, IP flux Infection & Spreading C&C Contact Report & Await Commands DDoS, Spam, InfoStealer Report & Await Commands
16 LIFECYCLE OF A BOT Infection & Spreading SPAM, Injected Code or Malvertising C&C Contact/Rallying Static IP lists, Domain Flux, IP flux Infection & Spreading C&C Contact Report & Await Commands DDoS, Spam, InfoStealer Maintain & Evade detection - Rallying techniques Report & Await Commands Evade Detection
17
18
19 Infected users/ computers Accept and carry out commands
20 Infected users/ computers Accept and carry out commands More Infected Users act as HTTP proxies between bots and front end C&Cs
21 Infected users/ computers Accept and carry out commands More Infected Users act as HTTP proxies between bots and front end C&Cs C&C Frontend made up of Compromised Servers. Act as proxy between Nodes & C&C Backend
22 Infected users/ computers Accept and carry out commands More Infected Users act as HTTP proxies between bots and front end C&Cs C&C Frontend made up of Compromised Servers. Act as proxy between Nodes & C&C Backend C&C Backend Control Panel
23 DOMAIN NAMES IP ADDRESSES NAMESERVERS
24 DOMAIN NAMES DGAs - NX Domains IP ADDRESSES NAMESERVERS
25 DOMAIN NAMES DGAs - NX Domains IP ADDRESSES C2 communications NAMESERVERS
26 DOMAIN NAMES DGAs - NX Domains IP ADDRESSES C2 communications Fast Flux domains NAMESERVERS
27 DETECTION METHODS
28 Sudden surge of queries from clients using our resolvers DETECTION METHODS
29 DETECTION METHODS Sudden surge of queries from clients using our resolvers IP history- fast flux
30 DETECTION METHODS Sudden surge of queries from clients using our resolvers IP history- fast flux Pivot from Domain, IP, nameserver, WHOIS
31
32
33 Hailstorm Spam
34 Hailstorm Spam
35 Hailstorm Spam
36 Hailstorm Spam
37 Hailstorm Spam
38 Hailstorm Spam
39 Russian Sponsored Canadian Pharma Fraud
40 magicmedsprogram.ru that we saw on has also resolved to
41
42 More of the same
43 =
44 = "09f1d a595578ff86ff63a514d47d5496ab5c23f38cda1f0d57dd6cd1", "bb0881b d26beded4f69a9a8b80702f", "e9a81fb5fd86ba9a78ec6528c2b1ae37" "7fd d78a1fd4ae950dfff96cebc2f9be779d831c4367c427a23f1eb7e", "e8dbf5f13bc315dbdb3edf73e110f1970a575edb", "66c b3390b4487c625e046173" "b4ffc48d7ce966631d1a7eba54f91047c979f53211ce077f528068adb2140cf2", "7f c92acc799a9b7be2dba1d9e6c346", "e0a5aaa4319e09cca2d05c d3" "864a3f9899e9a0420b34ab16de2e0085a06a9c7fbe7ec548cd3e15b0c5feb2f0", "90987b26896ed9451efca6ef5069f ", "7ee21f cd2ce9b087c261059" "6ec83b8226a492f ed6183b41c2c4541d5193bded0f b2a3", "a2e3dc7a7e65c3256f21b d c", "3e31da2e063090a016ef4a3cef79cbfd" "64ea76d8ef8cb13f249eddb382ee998d2ab7e6ff b5efdbbc6eea450a", " b69af b157d8fbb13fedb47", "f548ab42e92d25959f5dbc0d4f01a635" "58f519c6d9db704df9a5a0b697f727238db5cfc9e7ce5fb0d8d49a40bc6cf2f8", "d7b8132eed9abecc25fbe c e8b", "e613cf78955a4c1d8732b0ecb202caec" "4bd06baf053614a9ef b672db28caf2f31ce2346ed88e03439ebc305", "90e3230eeadd246c6020f7ddfe73f92763f228f0", "549a242c84d00a4fee0580b396ddfa31" "47c79e706903a773ba20d94136ac10542f4342d2a387392e6edcf130ee96ddfa", "285b2ab27dfdd12a bdcbfb9dd12a86b3", "70d6764da826e1b4180af95bbf1ffd59" "368834d7d5319d94da43946d0d290841d8d0f74a5856b6a46f504559b5fd372d", "4c e68502c6af89492a3d19edd6ed8b22a", "0acaa22f146196f5eaaecd3a4ca18232" "16933d9e56416ef c66417fea20f6ba68fe0695eb6a9a0d4175db47cd", "9bbe06b5b5b8644fe125d90d9e3da1ce0b477802", "0bc6a973616eff0ecd2d956b464b8ec2" "0c619cc80a3a c5fa0eded2a616b1799d23740a7aa4cb4c83f4a57", "2677c96ea397fe56733dff4d88cfb4e088f494d1", "f9dbc99e389beecbc09e4fed32b63dcd" "c74b5b0183e4f1c4f85d9714bfeaa311d57c36827c8e3ef ffbde107", "df5d499eae8304bac9acdf73958f3357e831fd29", "918c69dbb4f2f5d16618c3d33d3a1706" "61ab284b33d34fedb4725c0c3e5e1a2a4a3cc3767f29b10b87dd8598bfda2471", "3743bf1138e546adfd70e81a125d3b10d5a14897", " f86a6b2a50befab250f43" " d3790d21f9f312319c6f87d4d7bdb7a3fe998eb74df9d46e61dd73e03", "3aa9f817ab594f8cf66d1fd8cc505b6417ed04a8", "4b b43b7e17453ec3e17f6cf5b" "6eeb0454bf825824cf528859da0cf3b69dee10b4d69313ba66dbea690cbe94fc", "4325e522e6297e754795aa4c90ade1305e950e7d", "5ec24081bd392430abd20d bf2" "fba0d7b1db1d0770f23eecf1e42875aa04c330fec2f4a6f6ab0406cee61e5964", "2c fcd368d4dd1169e6f4c3c0cb69f21d6", "bfe7965da54f2b26d384ebc1fe7cfd07" "ed884cc38b4b99e1bcdaf65fd07b40f bf3b44e866ed3547f75229", "a7de4c d9d9c13c82b6b09523b1028dd4", "2aa3ecc4d d5feadde6472f0f" "2e16d36064f2048f529d220d2cb3ce6ce0dccfdcd05d7c9b f9bcd38f", "2f4fddd232ab44c0ae74fba4aee01e5714ad0c4e", "8fd9c646df2d7d03259a8d " "c5be f07ba8aaecc55ecb639c726a7e565cd6a735e958c4da5708aeaa1", "35fb6e3c4839e7281ce67c8cabfdfa7f2e7380c4", "cb3067d72959dab3f2465f83ecbd3641" "b1a383634ee3067d6c8b947b1c60cee25a869f664b5de ff3184", "93a6789db80ab f16c4742faa40ce8dd", "b7cb59735d7b04cb61ac7c29b26dd093" "11213f65805ef0c6deb8be3000fdd00db89769faffbef006d7df0b380f50fd41", "0dd21b6b48fb8669ad9a1c90e77a0f7da1da3df8", "4723b17ae8e58290f af8abd49" "7a9afc9edda5d992ab49b27a376012a2a563fa59ad7d30fd9719daa28d98ccf4", "01ec0844a6a1cc9b0ca9cab48b2c242d122e0040", "2ab90bb7fac0206d762eb1e235f0191a" "5527ab9e407e24260f695776c419d8b52c9c70d4e30666fc37c66d217fdffe73", "b624154ed080487c603b9eb360e7cf836b11fd43", "d2e8d8f37b9fdf c9c9173b367" "491281be5565c50f171e a7dd09eee28acd24a5274dd7d beb37", "a5e52e1115e234b58c2c4432b519aa0adafec970", "39af562ed60ceb490cc0fe4a195caf1d" LOCKY
45 homeherbeshop.be e0e59486e2c61c17ea4ed4a2efcd6deb6e d4b c438 Locky
46 homeherbeshop.be e0e59486e2c61c17ea4ed4a2efcd6deb6e d4b c438 Locky
47 homeherbeshop.be e0e59486e2c61c17ea4ed4a2efcd6deb6e d4b c438 Locky
48 e0e59486e2c61c17ea4ed4a2efcd6deb6e d4b c438 UPS-Delivery doc.zip
49
50 Spam with Locky downloader attachment e0069b27da9da4d131a7e15f0f687ed7a7dfeb95b7d0bd97d 9f848fcc69916
51 Pharma Fraud Spam
52 f159735fd37614f134ee0dda49d5b88edff82a1d45f c29e0c312ca4817d47f8a system becomes part of spam botnet
53 f159735fd37614f134ee0dda49d5b88edff82a1d45f c29e0c312ca4817d47f8a system becomes part of spam botnet
54 f159735fd37614f134ee0dda49d5b88edff82a1d45f c29e0c312ca4817d47f8a system becomes part of spam botnet
55 f159735fd37614f134ee0dda49d5b88edff82a1d45f c29e0c312ca4817d47f8a system becomes part of spam botnet
56 bestremediasale.su safebestservice.ru datesx.ru herbalhotservice.ru naturalpillvalue.ru dateyu.ru mycuringsale.ru safehealingsale.ru dategh.ru dateer.ru datepi.ru datert.ru datexs.ru
57 Questions?
DNS Security. Ch 1: The Importance of DNS Security. Updated
DNS Security Ch 1: The Importance of DNS Security Updated 8-21-17 DNS is Essential Without DNS, no one can use domain names like ccsf.edu Almost every Internet communication begins with a DNS resolution
State of the Internet Security Q Mihnea-Costin Grigore Security Technical Project Manager
State of the Internet Security Q2 2017 Mihnea-Costin Grigore Security Technical Project Manager Topics 1. Introduction 2. DDoS Attack Trends 3. Web Application Attack Trends 4. Spotlights 5. Resources
Botnet Communication Topologies
Understanding the intricacies of botnet Command-and-Control By Gunter Ollmann, VP of Research, Damballa, Inc. Introduction A clear distinction between a bot agent and a common piece of malware lies within
The Interactive Guide to Protecting Your Election Website
The Interactive Guide to Protecting Your Election Website 1 INTRODUCTION Cloudflare is on a mission to help build a better Internet. Cloudflare is one of the world s largest networks. Today, businesses,
BOTNET-GENERATED SPAM
BOTNET-GENERATED SPAM By Areej Al-Bataineh University of Texas at San Antonio MIT Spam Conference 2009 www.securitycartoon.com 3/27/2009 Areej Al-Bataineh - Botnet-generated Spam 2 1 Botnets: A Global
Sizing and Scoping ecrime
ICANN MEXICO CITY MARCH 5 TH, 2009 Sizing and Scoping ecrime Jeffrey R. Bedser President/COO The Internet Crimes Group Inc. ithreat Solutions Sophos: Downadup May Cause Friday the 13th / Southwest Airlines
Application Security. Rafal Chrusciel Senior Security Operations Analyst, F5 Networks
Application Security Rafal Chrusciel Senior Security Operations Analyst, F5 Networks r.chrusciel@f5.com Agenda Who are we? Anti-Fraud F5 Silverline DDOS protection WAFaaS Threat intelligence & malware
Size Matters Measuring a Botnet Operator s Pinkie
VB2010, Vancouver Size Matters Measuring a Botnet Operator s Pinkie Gunter Ollmann, VP Research gollmann@damballa.com About Gunter Ollmann VP of Research, Damballa Inc. Board of Advisors, IOActive Inc.
An Eye on the Storm: Inside the Storm Epidemic. Josh Ballard Network Security Analyst Kansas State University
An Eye on the Storm: Inside the Storm Epidemic Josh Ballard Network Security Analyst Kansas State University bal@k-state.edu Contents The Headlines Peer-to-peer network So just how big is this thing? How
A SUBSYSTEM FOR FAST (IP) FLUX BOTNET DETECTION
Chapter 6 A SUBSYSTEM FOR FAST (IP) FLUX BOTNET DETECTION 6.1 Introduction 6.1.1 Motivation Content Distribution Networks (CDNs) and Round-Robin DNS (RRDNS) are the two standard methods used for resource
ECESSA / TRACKING DOWN MALICIOUS TRAFFIC
A QUICK OVERVIEW ECESSA / TRACKING DOWN MALICIOUS TRAFFIC Prepared By: Jake Engles DIS APSCN/LAN Support Traffic Dump Using Ports and Addresses to find malicious traffic Finding Traffic on your Network:
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN)
Threat Detection and Mitigation for IoT Systems using Self Learning Networks (SLN) JP Vasseur, PhD - Cisco Fellow jpv@cisco.com Maik G. Seewald, CISSP Sr. Technical Lead maseewal@cisco.com June 2016 Cyber
(Botnets and Malware) The Zbot attack. Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth
(Botnets and Malware) The Zbot attack Group 7: Andrew Mishoe David Colvin Hubert Liu George Chen John Marshall Buck Scharfnorth What Happened? Type of Attack Botnet - refers to group of compromised computers
ERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
GNSO Issues Report on Fast Flux Hosting
GNSO STATUS OF THIS DOCUMENT This is the requested by the GNSO Council. SUMMARY This report is submitted to the GNSO Council in response to a request received from the Council pursuant to a Motion proposed
Innovative Cisco Security- Lösungen für den Endpoint Das Alpha und Omega unsere Next Gen Security
Innovative Cisco Security- Lösungen für den Endpoint Das Alpha und Omega unsere Next Gen Security Sven Kutzer Consulting Systems Engineer GSSO - CYBERSECURITY SALES Mittwoch, 7. März 2018 Challenges 2017
Post Breach Industry Report
NOVEMBER 2014 Post Breach Industry Report TABLE OF CONTENTS A Real-World View of Ongoing Cyber Security Attacks 3 Anatomy of a Real-World Cyber Attack 3 A Crime of Opportunity or Premeditation 3 An In-depth
Automating Security Response based on Internet Reputation
Add Your Logo here Do not use master Automating Security Response based on Internet Reputation IP and DNS Reputation for the IPS Platform Anthony Supinski Senior Systems Engineer www.h3cnetworks.com www.3com.com
Real-Time Detection of Fast Flux Service Networks
Cybersecurity Applications & Technology Conference For Homeland Security Real-Time Detection of Fast Flux Service Networks Alper Caglayan, Mike Toothaker, Dan Drapeau, Dustin Burke and Gerry Eaton Milcord
Detect Cyber Threats with Securonix Proxy Traffic Analyzer
Detect Cyber Threats with Securonix Proxy Traffic Analyzer Introduction Many organizations encounter an extremely high volume of proxy data on a daily basis. The volume of proxy data can range from 100
Chapter 2 Malicious Networks for DDoS Attacks
Chapter 2 Malicious Networks for DDoS Attacks Abstract In this chapter, we explore botnet, the engine of DDoS attacks, in cyberspace. We focus on two recent techniques that hackers are using to sustain
Improved C&C Traffic Detection Using Multidimensional Model and Network Timeline Analysis
Improved C&C Traffic Detection Using Multidimensional Model and Elad Menahem Avidan Avraham Modern Threats Are More Sophisticated & Evasive CYBER KILL CHAIN: Infection Phase Post-Infection Recon Weaponization
Comprehensive datacenter protection
Comprehensive datacenter protection There are several key drivers that are influencing the DDoS Protection market: DDoS attacks are increasing in frequency DDoS attacks are increasing in size DoS attack
Citation for published version (APA): Stevanovic, M., & Pedersen, J. M. (2013). Machine learning for identifying botnet network traffic.
Aalborg Universitet Machine learning for identifying botnet network traffic Stevanovic, Matija; Pedersen, Jens Myrup Publication date: 2013 Document Version Accepted author manuscript, peer reviewed version
Discovering new malicious domains using DNS and big data Case study: Fast Flux domains. Dhia Mahjoub OpenDNS May 25 th, 2013
Discovering new malicious domains using DNS and big data Case study: Fast Flux domains Dhia Mahjoub OpenDNS May 25 th, 2013 Background A@ackers seek to keep their operabons online at all Bmes The Network
(Im)possibility of Enumerating Zombies. Yongdae Kim (U of Minnesota - Twin Cities)
(Im)possibility of Enumerating Zombies Yongdae Kim (U of Minnesota - Twin Cities) From Gunter Ollmann at Damballa's blog Botnet and DDoS Botnets becoming the major tool for DDoS 5 million nodes Botnet
Monetizing Attacks / The Underground Economy
Monetizing Attacks / The Underground Economy CS 161: Computer Security Prof. Vern Paxson TAs: Jethro Beekman, Mobin Javed, Antonio Lupher, Paul Pearce & Matthias Vallentin http://inst.eecs.berkeley.edu/~cs161/
Cisco Cloud Security. How to Protect Business to Support Digital Transformation
Cisco Cloud Security How to Protect Business to Support Digital Transformation Dragan Novakovic Cybersecurity Consulting Systems Engineer January 2018. Security Enables Digitization Digital Disruption,
Battle between hackers and machine learning Current status and trends
Battle between hackers and machine learning Current status and trends Mikhail Kader Distinguished System Engineer July, 5 2018 Alexey Lukatsky Business Development Manager Our agenda AI for cyber security
Intelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
Cisco Cyber Range. Paul Qiu Senior Solutions Architect
Cisco Cyber Range Paul Qiu Senior Solutions Architect Cyber Range Service A platform to experience the intelligent Cyber Security for the real world What I hear, I forget What I see, I remember What I
Norman presentation. From Storm to Waledac. By Hans Christoffer Gaardløs Hansen virus analyst, Norman ASA
Norman presentation From Storm to Waledac By Hans Christoffer Gaardløs Hansen virus analyst, Norman ASA Storm first peer-to-peer botnet Old method IRC-server Specific chat-channels and run commandoes via
OpenDNS DNS Database Client Library Documentation
OpenDNS DNS Database Client Library Documentation Release 0.1 Frank Denis October 21, 2016 Contents 1 Installation 1 2 Example 3 3 Parallel requests 5 4 Setup 7 5 Note on certificates format 9 6 Operations
IBM Security Network Protection Solutions
Systems IBM Security IBM Security Network Protection Solutions Pre-emptive protection to keep you Ahead of the Threat Tanmay Shah Product Lead Network Protection Appliances IBM Security Systems 1 IBM Security
CS 155 Final Exam. CS 155: Spring 2009 June 2009
CS 155: Spring 2009 June 2009 CS 155 Final Exam This exam is open books and open notes. You may use course notes and documents that you have stored on a laptop, but you may NOT use the network connection
August 14th, 2018 PRESENTED BY:
August 14th, 2018 PRESENTED BY: APPLICATION LAYER ATTACKS 100% 80% 60% 40% 20% 0% DNS is the second most targeted protocol after HTTP. DNS DoS techniques range from: Flooding requests to a given host.
Protecting DNS Critical Infrastructure Solution Overview. Radware Attack Mitigation System (AMS) - Whitepaper
Protecting DNS Critical Infrastructure Solution Overview Radware Attack Mitigation System (AMS) - Whitepaper Table of Contents Introduction...3 DNS DDoS Attacks are Growing and Evolving...3 Challenges
Luminous: Bringing Big(ger) Data to the Fight
Luminous: Bringing Big(ger) Data to the Fight Norm Ritchie Drew Bagley ICANN Helsinki June, 2016 Secure Domain Foundation Non-profit Founded in 2014 Proactive mitigation of malicious domains used for cybercrime
It s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security
It s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security Pavel Minařík, Chief Technology Officer Neutral Peering Days 2018, The Hague Your customers depend on your
Temporal Correlations between Spam and Phishing Websites
Temporal Correlations between Spam and Phishing Websites, Richard Clayton and Henry Stern Center for Research on Computation and Society Harvard University USENIX LEET 09 Boston, MA April 21, 2009 Outline
INF3700 Informasjonsteknologi og samfunn. Application Security. Audun Jøsang University of Oslo Spring 2015
INF3700 Informasjonsteknologi og samfunn Application Security Audun Jøsang University of Oslo Spring 2015 Outline Application Security Malicious Software Attacks on applications 2 Malicious Software 3
Security Trend of New Computing Era
Security Trend of New Computing Era Presented by Roland Cheung HKCERT Agenda Security Threat Overview Introduction of Botnet Impact of Botnet Fight Back Botnet Security Protection Scheme Security Threat
TempR: Application of Stricture Dependent Intelligent Classifier for Fast Flux Domain Detection
I. J. Computer Network and Information Security, 2016, 10, 37-44 Published Online October 2016 in MECS (http://www.mecs-press.org/) DOI: 10.5815/ijcnis.2016.10.05 TempR: Application of Stricture Dependent
Dynamic Botnet Detection
Version 1.1 2006-06-13 Overview The widespread adoption of broadband Internet connections has enabled the birth of a new threat against both service providers and the subscribers they serve. Botnets vast
CyberCrime as a business
CyberCrime as a business How criminal networks use cloud services and Involuntary Contribution Associates to make money Francis Turner Stop Botnets Stealing From You! Agenda The cloud for business The
Gladiator Incident Alert
Gladiator Incident Alert Allen Eaves Sabastian Fazzino FINANCIAL PERFORMANCE RETAIL DELIVERY IMAGING PAYMENT SOLUTIONS INFORMATION SECURITY & RISK MANAGEMENT ONLINE & MOBILE 1 2016 Jack Henry & Associates,
Naming in Distributed Systems
Naming in Distributed Systems Dr. Yong Guan Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University Outline for Today s Talk Overview: Names, Identifiers,
INFINITY: THE CYBERSECURITY ARCHITECTURE OF THE FUTURE - IN A DIGITAL WORLD
INFINITY: THE CYBERSECURITY ARCHITECTURE OF THE FUTURE - IN A DIGITAL WORLD Nathan Shuchami VP of Emerging Products 2017 Check Point Software Technologies Ltd. 1 WE LIVE IN AN AMAZING WORLD age WE LIVE
F5 Synthesis Information Session. April, 2014
F5 Synthesis Information Session April, 2014 Agenda Welcome and Introduction to Customer Technology Challenges Software Defined Application Services Reference Architectures for Today s Customer Challenges
Battle between hackers and machine learning. Alexey Lukatsky Cybersecurity Business Consultant April 03, 2019
Battle between hackers and machine learning Alexey Lukatsky Cybersecurity Business Consultant April 03, 2019 Google: facts and numbers Real Cisco Big Data for Security Training Set Why is Machine Learning
Stratum Filtering for DDoS Resilient Clouds
Stratum Filtering for DDoS Resilient Clouds Michael Waidner Joint work with Amir Herzberg and Haya Shulman A CRISP Member 8rd ACM Cloud Computing Security Workshop Vienna,
Operationalizing your Security Data. Presenter: Lee Imrey Splunk, Security Market Specialist
Operationalizing your Security Data Presenter: Lee Imrey Splunk, Security Market Specialist Agenda Introduction Basics Using the right tools for the jobs Identifying (and Exploring) Data Sources Investigation
Stochastic Blockmodels as an unsupervised approach to detect botnet infected clusters in networked data
Stochastic Blockmodels as an unsupervised approach to detect botnet infected clusters in networked data Mark Patrick Roeling & Geoff Nicholls Department of Statistics University of Oxford Data Science
( ) 2016 NSFOCUS
NSFOCUS 2016 Q3 Report on DDoS Situation and Trends (2016-10-20) 2016 NSFOCUS Copyright 2016 NSFOCUS Technologies, Inc. All rights reserved. Unless otherwise stated, NSFOCUS Technologies, Inc. holds the
New Developments in the SpamPots Project
New Developments in the SpamPots Project Klaus Steding-Jessen Cristine Hoepers CERT.br CERT Brazil http://www.cert.br/ NIC.br Brazilian Network Information Center http://www.nic.br/
Post-Intrusion Report June White paper
Post-Intrusion Report June 2015 White paper TABLE OF CONTENTS About the data in this report.... 3 Classification of data.... 3 High-level trends.... 4 Detected threats by category.... 4 A spike in indicators
Is the Best Defense a Good Offense? Christopher T. Pierson, CIPP/US, CIPP/G James T. Shreve, CIPP/US, CIPP/IT
Is the Best Defense a Good Offense? Christopher T. Pierson, CIPP/US, CIPP/G James T. Shreve, CIPP/US, CIPP/IT Agenda & Disclaimer 1. Scenarios 2. Issues - Status of Cybersecurity and Hacking 3. Capabilities
Directory Service Defense (DSD) Mark Kosters CTO
Directory Service Defense (DSD) Mark Kosters CTO Whois/Whois-RWS/RDAP Directory services is Whois, Whois-RWS, RDAP, and soon RPSL Goal for directory services availability is for people to query the service
Post Intrusion Report
Post Intrusion Report JUNE 2015 VERSION 2.0 Report Table of Contents About the data in this report 3 Classification of data 3 High-level trends 4 Detected threats by category 4 A spike in indicators of
Chapter 10: Denial-of-Services
Chapter 10: Denial-of-Services Technology Brief This chapter, "Denial-of-Service" is focused on DoS and Distributed Denial-of-Service (DDOS) attacks. This chapter will cover understanding of different
Detection of DNS Traffic Anomalies in Large Networks
Detection of Traffic Anomalies in Large Networks Milan Čermák, Pavel Čeleda, Jan Vykopal {cermak celeda vykopal}@ics.muni.cz 20th Eunice Open European Summer School and Conference 2014 1-5 September 2014,
The Past and Future Threat Landscape:
The Past and Future Threat Landscape: A Review of Cisco s 2017 Annual Cybersecurity Report Prepared By: Btech 221 E. Walnut Street, Ste. 138 Pasadena, CA 91101 Author: Lance Bird Last Edit Date: February
Why to talk about Botnets
Botnets 1 Why to talk about Botnets Botnet could be a most powerful supercomputer in the world [1]. Recent attack on Estonia. Vehicle for cyber-terrorism and cyber crime. Very serious security threat that
ddos-guard.net Protecting your business DDoS-GUARD: Distributed protection against distributed attacks
ddos-guard.net Protecting your business DDoS-GUARD: Distributed protection against distributed attacks 2 WHAT IS A DDOS-ATTACK AND WHY ARE THEY DANGEROUS? Today's global network is a dynamically developing
NANOG29. The Relationship Between Network Security and Spam. Carl Hutzler, Director AntiSpam Operations Ron da Silva, Principal Architect
NANOG29 The Relationship Between Network Security and Spam Carl Hutzler, Director AntiSpam Operations Ron da Silva, Principal Architect America Online, Inc. 2 Executive Summary Spam is a large and growing
RIPE Atlas. Measuring the Internet
RIPE Atlas Measuring the Internet Why What is it useful for? Why RIPE Atlas? (1) Internet Growth Critical Multi- Stakeholder Monitor Troubleshoot Measurements Improve Security Lack of Internet wide measurements
ZLAB. The stealth process injection of the new Ursnif malware. Malware Analysts: Antonio Pirozzi Antonio Farina Luigi Martire
ZLAB The stealth process injection of the new Ursnif malware Malware Analysts: Antonio Pirozzi Antonio Farina Luigi Martire 11/01/18 Introduction Whereas the malware LockPos, famous for its new incredibly
Multi-phase IRC Botnet & Botnet Behavior Detection Model
Software Verification and Validation Multi-phase IRC Botnet & Botnet Behavior Detection Model Aymen AlAwadi aymen@tmit.bme.hu Budapest university of technology and economics Department of Telecommunications
Avoiding Information Overload: Automated Data Processing with n6
Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński pawel.pawlinski@cert.pl 26th annual FIRST conference Boston, June 23rd 2014 Who we are part of national CERT for Poland
IRL: Live Hacking Demos!
SESSION ID: SBX2-R3 IRL: Live Hacking Demos! Omer Farooq Senior Software Engineer Independent Security Evaluators Rick Ramgattie Security Analyst Independent Security Evaluators What is the Internet of
UTM 5000 WannaCry Technote
UTM 5000 WannaCry Technote The news is full of reports of the massive ransomware infection caused by WannaCry. Although these security threats are pervasive, and ransomware has been around for a decade,
Certified Ethical Hacker (CEH)
Certified Ethical Hacker (CEH) COURSE OVERVIEW: The most effective cybersecurity professionals are able to predict attacks before they happen. Training in Ethical Hacking provides professionals with the
Self Learning Networks An Overview
Self Learning Networks An Overview Alvaro Retana aretana@cisco.com Distinguished Engineer, Cisco Services Slides by JP Vasseur and Jeff Apcar. What Self Learning Networks is About SLN is fundamentally
How to build a multi-layer Security Architecture to detect and remediate threats in real time
How to build a multi-layer Security Architecture to detect and remediate threats in real time Nikos Mourtzinos, CCIE #9763 Cisco Cyber Security Sales Specialist March 2018 Agenda Cisco Strategy Umbrella
Comodo cwatch Web Security Software Version 2.9
rat Comodo cwatch Web Security Software Version 2.9 Quick Start Guide Guide Version 2.9.032318 Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013 Comodo cwatch Web Security - Quick Start Guide
Not-A-Bot: Improving Service Availability in the Face of Botnet Attacks
Not-A-Bot: Improving Service Availability in the Face of Botnet Attacks R. Gummadi, H. Balakrishnan, P. Maniatis, S. Ratnasamy Presented by: Ashish Vulimiri Images lifted from paper/authors NSDI09 slides.
Cisco Ransomware Defense The Ransomware Threat Is Real
Cisco Ransomware Defense The Ransomware Threat Is Real Seguridad Integrada Abril 2018 Ransomware B Malicious Software Encrypts Critical Data Demands Payment Permanent Data Loss Business Impacts Ramifications
DNS: Useful tool or just a hammer? Paul DNS-OARC 06 Oct 2013, Phoenix
DNS: Useful tool or just a hammer? Paul Ebersman pebersman@infoblox.com, @paul_ipv6 DNS-OARC 06 Oct 2013, Phoenix 1 Attacking your cache 2 Recursion DNS queries are either recursive or nonrecursive recursive
Incident Play Book: Phishing
Incident Play Book: Phishing Issue: 1.0 Issue Date: September 12, 2017 Copyright 2017 Independent Electricity System Operator. Some Rights Reserved. The following work is licensed under the Creative Commons
86% of websites has at least 1 vulnerability and an average of 56 per website WhiteHat Security Statistics Report 2013
Vulnerabilities help make Web application attacks amongst the leading causes of data breaches +7 Million Exploitable Vulnerabilities challenge organizations today 86% of websites has at least 1 vulnerability
Use Cases. E-Commerce. Enterprise
Use Cases E-Commerce Enterprise INTRODUCTION This document provides a selection of customer use cases applicable for the e-commerce sector. Each use case describes an individual challenge faced by e-commerce
Smart Protection Network. Raimund Genes, CTO
Smart Protection Network Raimund Genes, CTO Overwhelmed by Volume of New Threats New unique samples added to AV-Test's malware repository (2000-2010) 20.000.000 18.000.000 16.000.000 14.000.000 12.000.000
Firewall nové generace na platformě SF, přístupové politiky, analýza souborů, FireAMP a trajektorie útoků
Firewall nové generace na platformě SF, přístupové politiky, analýza souborů, FireAMP a trajektorie útoků Jiří Tesař, CSE Security, jitesar@cisco.com CCIE #14558, SFCE #124266 Mapping Technologies to the
INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY
INTERNATIONAL JOURNAL OF PURE AND APPLIED RESEARCH IN ENGINEERING AND TECHNOLOGY A PATH FOR HORIZING YOUR INNOVATIVE WORK SPAM DETECTION USNIG SPOT TOOL SURAJ KUTE, DIPIKA MOHOD, PAYAL SHIRE, PRATIKSHA
AKAMAI THREAT ADVISORY. Satori Mirai Variant Alert
AKAMAI THREAT ADVISORY Satori Mirai Variant Alert Version: V002 Date: December 6, 2017 1.0 / Summary / Akamai, along with industry peers, has identified an updated variant of Mirai (Satori) that has activated
Check Point DDoS Protector Simple and Easy Mitigation
Check Point DDoS Protector Simple and Easy Mitigation Jani Ekman janie@checkpoint.com Sales Engineer DDoS Protector 1 (D)DoS Attacks 2 3 4 DDoS Protector Behavioral DoS Protection Summary 2 What is an
Outline. Motivation. Our System. Conclusion
Outline Motivation Our System Evaluation Conclusion 1 Botnet A botnet is a collection of bots controlled by a botmaster via a command and control (C&C) channel Centralized C&C, P2P-based C&C Botnets serve
REMINDER course evaluations are online
REMINDER course evaluations are online http://web.mit.edu/subjectevaluation please fill them out they provide extremely valuable feedback to all instructors 6.033 Spring 2016 Lecture #23 Combating network
Detecting DGA Malware Traffic Through Behavioral Models. Erquiaga, María José Catania, Carlos García, Sebastían
Detecting DGA Malware Traffic Through Behavioral Models Erquiaga, María José Catania, Carlos García, Sebastían Outline Introduction Detection Method Training the threshold Dataset description Experiment
We re Different. Founded in 2007, Secure Source specializes in Network Security technology and compliance solutions.
COMPANY PROFILE We re Different Founded in 2007, Secure Source specializes in Network Security technology and compliance solutions. A Value-Added Distributor (VAD) with focus on end-to-end security product
Tracking Evil with Passive DNS
Tracking Evil with Passive DNS Bojan Ždrnja, CISSP, GCIA, GCIH Bojan.Zdrnja@infigo.hr INFIGO IS http://www.infigo.hr Who am I? Senior information security consultant with INFIGO IS (Croatia) Mainly doing
Vincent van Kooten, EMEA North Fraud & Risk Intelligence Specialist RSA, The Security Division of EMC
Vincent van Kooten, EMEA North Fraud & Risk Intelligence Specialist RSA, The Security Division of EMC 1 2013 2 3 in 4 3 5.900.000.000 $ 4 RSA s Top 10 List 5 RSA s top 10 phishing list Copyright 2014 EMC
IPv6. Akamai. Faster Forward with IPv6. Eric Lei Cao Head, Network Business Development Greater China Akamai Technologies
Akamai Faster Forward with IPv6 IPv6 Eric Lei Cao clei@akamai.com Head, Network Business Development Greater China Agenda What is Akamai? Akamai s IPv6 Capabilities Experiences & Lessons Measuring IPv6
Protect vital DNS assets and identify malware
N2 THREATAVERT Protect vital DNS assets and identify malware Service Providers recognize network security drives brand equity because it directly impacts subscriber satisfaction. Secure networks are also
Lecture 12. Application Layer. Application Layer 1
Lecture 12 Application Layer Application Layer 1 Agenda The Application Layer (continue) Web and HTTP HTTP Cookies Web Caches Simple Introduction to Network Security Various actions by network attackers
Automated Threat Management - in Real Time. Vectra Networks
Automated Threat Management - in Real Time Security investment has traditionally been in two areas Prevention Phase Active Phase Clean-up Phase Initial Infection Key assets found in the wild $$$$ $$$ $$
Imma Chargin Mah Lazer
Imma Chargin Mah Lazer How to protect against (D)DoS attacks Oliver Matula omatula@ernw.de #2 Denial of Service (DoS) Outline Why is (D)DoS protection important? Infamous attacks of the past What types
Security Events and Alarm Categories (for Stealthwatch System v6.9.0)
Security Events and Alarm Categories (for Stealthwatch System v6.9.0) Copyrights and Trademarks 2017 Cisco Systems, Inc. All rights reserved. NOTICE THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS
Sucuri Technical Overview
Sucuri Technical Overview Product and Service Description 1 TABLE OF CONTENTS SUCURI OVERVIEW Company Overview 3 PRODUCT/SERVICE DESCRIPTION Monitoring Protection Response Backup 4 5 6 6 EXHIBITS A: Holistic
P2P Botnet Detection through Malicious Fast Flux Network Identification
P2P Botnet Detection through Malicious Fast Flux Network Identification David Zhao Department of Electrical and Computer Engineering University of Victoria Victoria, BC, Canada davidzhao@ieee.org Issa