www.cloudsec.com | #CLOUDSEC

The State of Web Defacements and Hacktivism

Ryan Flores

#CLOUDSEC

whoami

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Cybercrime

• Actors: cybercriminals – traditional criminals

• Motivation: $$$

• Timeframe: immediate – several months

• Impact: financial loss, brand damage

• Targeting: opportunistic to targeted

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Targeted Attack

• Actors: state sponsored

• Motivation:

• Timeframe: several months - years

• Impact: leverage, opportunity

• Targeting: highly targeted

#CLOUDSEC

Hacktivism

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Arab Spring

0

200

400

600

800

1000

1200

1400

1600

1800

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016

#CLOUDSEC

#CLOUDSEC

Anonymous and Lulzsec

0

50

100

150

200

250

300

350

400

450

1998 2000 2002 2004 2006 2008 2010 2012 2014 2016

Defacement pages are

getting… boring

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Defacers can instantly turn

into Hacktivists

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Local Defacements and Issues

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

#CLOUDSEC

Summary

• Hackers operate in groups, by campaigns

• Grouped by country

• Real life events influence hacker motivation, driven by

• Patriotism

• Socio-political

• Opportunistic

• Uses known vulnerabilities

• Scans for vulnerable websites

#CLOUDSEC

Summary

• Soft Targeting

• Targets by TLD and IP space

• Risk of Data Leakage

Ryan Flores Forward Looking Threat

Research Team

Trend Micro ryan_flores@trendmicro.com