Large Scale Attacks on the Internet Lessons learned from the LOBSTER - - PowerPoint PPT Presentation

▶
large scale attacks on the internet lessons learned from
SMART_READER_LITE
LIVE PREVIEW

Large Scale Attacks on the Internet Lessons learned from the LOBSTER - - PowerPoint PPT Presentation

Apr 24, 2023 100 likes •336 views

The LOBSTER project An IST Project http://www.ist-lobster.org/ Large Scale Attacks on the Internet Lessons learned from the LOBSTER project Evangelos Markatos Institute of Computer Science (ICS) Foundation for Research and Technology

slide-1
SLIDE 1

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Large Scale Attacks on the Internet Lessons learned from the LOBSTER project Evangelos Markatos Institute of Computer Science (ICS) Foundation for Research and Technology – Hellas (FORTH)

Crete, Greece The LOBSTER project

slide-2
SLIDE 2

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Agenda

  • Motivation
  • The LOBSTER Infrastructure

– Number of sensors - deployment – Attacks captured

  • Lessons Learned
  • Policy Implications
slide-3
SLIDE 3

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Agenda

  • Motivation
  • The LOBSTER Infrastructure

– Number of sensors - deployment – Attacks captured

  • Lessons Learned
  • Policy Implications
slide-4
SLIDE 4

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Computer Security is getting increasingly important

  • 1988

– The Morris worm compromised 6,000 UNIX computers

  • 2001

– The Code Red worm compromised 300,000 computers

Source: CAIDA/UCSD

slide-5
SLIDE 5

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Computer Security is Critical

  • 2007: Vint Cerf (the father of the Internet and

VP of Google) says:

– 25% of all computers online are compromised

  • 100-150 million computers are compromised…
slide-6
SLIDE 6

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Vulnerabilities

1000 2000 3000 4000 5000 2004 2005 2006

Vulnerabilities found

  • Total Vulnerabilities documented by Symantec Corporation

(source: Internet Security Threat Report)

slide-7
SLIDE 7

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Black Market Trading

slide-8
SLIDE 8

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

So?

  • One out of four computers is compromised
  • Hackers penetrate all different kinds of

computers

  • Vulnerabilities are increasing every year
  • They are being sold in the black market
  • We need to react:

– Monitor large scale attacks – Understand mechanisms and motives of attackers

slide-9
SLIDE 9

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Agenda

  • Motivation
  • The LOBSTER Infrastructure

– Number of sensors - deployment – Attacks captured

  • Lessons Learned
  • Policy Implications
slide-10
SLIDE 10

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

The LOBSTER project

  • Research Networking Test-Bed project

– 2005-2007 Funded by IST

  • Installed a monitoring infrastructure

– To study performance and security issues in European Research and Educational networks – Deployed

  • more than 40 sensors
  • in 10 countries

– Monitors incoming traffic to see if it contains network attacks from hackers

Funded by the European Commission

slide-11
SLIDE 11

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

LOBSTER Deployment

slide-12
SLIDE 12

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Attacks Captured: focus on polymorphic attacks

  • Close to one million attacks captured
  • One attack every 30 seconds!
  • One attack every two seconds (peak rate)!
slide-13
SLIDE 13

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Where do attackers come from?

All over the world

slide-14
SLIDE 14

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Where do attackers come from?

  • 70% of the attacks to an organization originate from

“inside” hosts

– Maybe compromised computers which attack the local network

Attacks Launched

from internal hosts from external hosts

slide-15
SLIDE 15

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Agenda

  • Motivation
  • The LOBSTER Infrastructure

– Number of sensors - deployment – Attacks captured

  • Lessons Learned
  • Policy Implications
slide-16
SLIDE 16

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Lessons Learned

  • Attackers launch attacks from all over the world
  • Several attacks originate from “internal” hosts

– Probably compromised computers of the organization

  • Isolated viewpoints provided a “narrow point of view” of

the attack plane, i.e.

– One sensor reported heavy attack while – Another sensor reported very little attacks

SENSOR 1 SENSOR 2

slide-17
SLIDE 17

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Agenda

  • Motivation
  • The LOBSTER Infrastructure

– Number of sensors - deployment – Attacks captured

  • Lessons Learned
  • Policy Implications
slide-18
SLIDE 18

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

What needs to be done?

  • The knowledge of large scale attacks may be

fragmented today

– Individual organizations know their status but do not know the status of other organizations/networks

  • Very few people/organizations have a global view of the

attack landscape

  • Even fewer publish this information on the public domain
  • We need to work towards a “broad viewpoint” by sharing
  • f data
  • Large-scale attack monitoring needs “broadened points
  • f view”
slide-19
SLIDE 19

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

What has been done

  • ENISA has started work in this area:

– Examining the feasibility of a data collection framework

  • Unit A3 of ICT promotes the “Learning from

Large-Scale Attacks on the Internet”

  • Individual projects/organizations in Europe

provide some form of data/information (NoAH, WOMBAT, Arakis, Leurre.com, etc.)

  • BUT
  • We need to share more information/data
slide-20
SLIDE 20

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

What needs to be done?

  • Facilitate sharing of knowledge – facilitate

sharing of data

– Encourage Organizations to share attack-related data

  • Universities are usually willing to provide information but

– they may need technical and legal advice before doing so

– Help organizations exchange attack-related data

  • Create repositories for all data provided by individual
  • rganizations
  • Provide a legal framework for data sharing

– Who can access the data, when and for which purposes

slide-21
SLIDE 21

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Summary

  • Lots of attacks out there
  • Vulnerabilities are increasing

– They are being traded in the black market

  • One out of four computers is compromised
  • Existing projects/initiatives/organizations provide attack-

related information-data but

– Most of them provide narrow viewpoints

  • We need to find a formula to broaden our point of view

– And to share data and information

  • Large-scale attacks need large-scale viewpoints
slide-22
SLIDE 22

An IST Project http://www.ist-lobster.org/

Learning from Large Scale Attacks on the Internet Policy Implications markatos@ics.forth.gr

Large Scale Attacks on the Internet Lessons learned from the LOBSTER project Evangelos Markatos Institute of Computer Science (ICS) Foundation for Research and Technology – Hellas (FORTH)

Crete, Greece The LOBSTER project