The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet....
Transcript of The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet....
![Page 1: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/1.jpg)
“TheWonderful thing about the
Internetyou’reconnectedeveryone
to
else”
is that
Vinton Cerf
![Page 2: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/2.jpg)
“TheTerrible thing about the
Internetyou’reconnectedeveryone
to
else”
is that
-- Vint Cerf
![Page 3: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/3.jpg)
Carlos Fragoso Mariscal1st Spanish Network Operator’s Group meeting
Facing the Dark Side of the Internet
![Page 4: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/4.jpg)
Goal
Describe current trends of the Dark-Side guys on the Internet and how to face them
![Page 5: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/5.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 6: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/6.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 7: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/7.jpg)
ISPhood ISPhood ISPhood
Carrierhood Carrierhood
![Page 8: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/8.jpg)
Internethood• Roads: network
• Carriers, ISP’s, IXP’s,
• Home/Office: end sites
• Universities, enterprises, home
• Tools/vehicles: hardware and software
• Vendors, developers ...
• Citizens: users and boxes
• End users, servers ...
![Page 9: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/9.jpg)
What’s wrong with users?
•Limited or null security knowledge
•False sense of security
•No mainteinance
•Most of them use Windows
![Page 10: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/10.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 11: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/11.jpg)
Who are the... BADGUYS?
![Page 12: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/12.jpg)
The BAD guys
•Not hackers anymore
•Cybercrime organizations
•IT well-paid professionals
•Hacktivism / Cyberterrorism
![Page 13: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/13.jpg)
Motivation
•Distributed Denial of Service
•Identity theft
•Spam
•Crime obfuscation
•Fraud
![Page 14: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/14.jpg)
Roles
•Infrastructure engineers
•Malware developers
•Spammers
•Operators
•Mules
![Page 15: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/15.jpg)
Their tools
•Trojans
•Keyloggers
•Packers / crypters
•Malware creation kits
![Page 16: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/16.jpg)
Common target
•Windows OS boxes
•Unpatched
•Unprotected (FW, AV)
•Client-side infection
![Page 17: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/17.jpg)
2008 Menaces
• Web site attacks against browser vulnerabilities
• Sophisticated and effective botnets
• Targeted phishing
• Mobile phone threats
• Insider attacks
• Advanced Identity Theft
• Social EngineeringSource: SANS Institute
![Page 18: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/18.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 19: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/19.jpg)
“A botnet is comparable to compulsory military service for windows boxes”
Source: Stromberg
![Page 20: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/20.jpg)
•Bot - Zombie - Drone
• Malware
• Remote control agent
•Command & Control
• Protocol and actions
What is a botnet ?
![Page 21: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/21.jpg)
![Page 22: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/22.jpg)
a Zombie ?Am I
Drone?
Bot?
![Page 23: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/23.jpg)
![Page 24: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/24.jpg)
Zombie demography
30%
19%15%
10%
6%
6%
6%4% 3% 3%
OtherUnited StatesChinaSouth KoreaGermanyFranceBrazilJapanUnited KingdomSpain
Source: Ciphertrust
![Page 25: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/25.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 26: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/26.jpg)
Trends
•Encryption
•Stealthy
•New control protocols
•Distributed architecture
![Page 27: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/27.jpg)
Fast-Flux
•Multiple IP addresses to same FQDN
•Round-Robin DNS RR with low TTL
•Load distribution
![Page 28: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/28.jpg)
Source: The Honeynet Project
![Page 29: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/29.jpg)
Distributed C&C
• Drones as botnet controllers
• Smaller botnets
• Difficult and time consuming tracking
• P2P protocols using supernodes
![Page 30: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/30.jpg)
BlackEnergy botnet
•HTTP-based
•Small binary (<50KB)
•DDoS as main purpose
![Page 31: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/31.jpg)
BlackEnergyHTTP C&C locations
Source: Arbor Networks
![Page 32: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/32.jpg)
BlackEnergyDDoS Targets
Source: Arbor Networks
![Page 33: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/33.jpg)
Agenda
•Internethood
•The Dark Side
•Botnets
•Trends
•Facing them
![Page 34: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/34.jpg)
Fight !!!Please...
![Page 35: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/35.jpg)
Fight against them
•Build your own IR team
•Join IR communities
•Get and deploy your tools
•Train your users/customers
•Get in touch with LEOs
![Page 36: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/36.jpg)
Join and share ...Incident Response Communities
•FIRST
•TF-CSIRT
•NSP-SEC
•NSP-SEC-LEO
•SANS ISC
![Page 37: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/37.jpg)
tools?Got
![Page 38: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/38.jpg)
Tools
• Flow consolidation
•Network Forensics
•Anomalous Detection Systems
• Blackhole Route Servers
• Security lab (analysis)
•Communication (IM, VoIP)
![Page 39: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/39.jpg)
Summing upCybercrime will become
more and more aggresive...
...but we will be here to fight them back!
![Page 40: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/40.jpg)
Some references
•CSI Survey 2007
•ENISA Botnets paper
•The Honeynet project
•Arbor Networks’ blog
![Page 41: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/41.jpg)
Greetings
•Spanish CSIRT’s
•NSP-SEC community
•The Honeynet Project
•Jose Nazario and John Kristoff
•ESNOG guys
![Page 42: The Wonderful Internet is that you’re connected everyone · Facing the Dark Side of the Internet. Goal Describe current trends of the Dark-Side guys on the Internet and how to face](https://reader033.fdocuments.net/reader033/viewer/2022050407/5f841064a99ffa662d003dd0/html5/thumbnails/42.jpg)
Comedy?
Tragedy?