passive dns cert at
play

Passive DNS @ CERT.at (pDNS) contact: L. Aaron Kaplan - PowerPoint PPT Presentation

Dec 14, 2022 •264 likes •336 views

Passive DNS @ CERT.at (pDNS) contact: L. Aaron Kaplan <kaplan@cert.at> Tel: +43 1 505 64 16 / 78 Idea & credits: Florian Weimer, BFK pDNS @ CERT.at passive DNS: Idea to capture the DNS answers and give them a timestamp.

  1. Passive DNS @ CERT.at (“pDNS”) contact: L. Aaron Kaplan <kaplan@cert.at> Tel: +43 1 505 64 16 / 78 Idea & credits: Florian Weimer, BFK

  2. pDNS @ CERT.at • passive DNS: Idea to capture the DNS answers and give them a timestamp. • Dataprotection -> omit src IPs (of client)! • CERT.at + UniWien implemented a pDNS server: nmsg + C code + postgresql 9.0 • Optimized for speed! (~ 20 msec for a complex answer). • 100% compatible with BFK pDNS. • Cooperating with other pDNS servers • webinterface, whois • Looking for sensors!

  3. pDNS @ CERT.at: Diagram public Internet internal network Log: answer + Timestamp in DB

  4. pDNS - new User Interface domaine, record type, IP , timeframe(from - last), count_seen

  5. pDNS @CERT.at - Example • Step 1: netblock: rr-name: pharmazoria.com rr-type: A rr-address: 193.104.XX.164 193.104.XX.0/24. seen-first: 2009-12-03 17:16:39 seen-last: 2009-12-30 12:33:43 AS12XX / Vladimir rr-name: www.genericmedsusa.com rr-type: A BLABLAvich - rr-address: 193.104.XX.162 seen-first: 2009-12-16 16:04:07 seen-last: 2009-12-21 11:47:22 suspected BP host • lots of shady domain • Step 2: ask pDNS names rr-name: ns2.federalbankofnevada.com rr-type: A rr-address: 193.104.XX.69 seen-first: 2010-02-17 09:57:25 seen-last: 2010-02-21 12:04:29 rr-name: ns1.pronewmedia.com rr-type: A rr-address: 193.104.XX.67 seen-first: 2010-02-17 09:22:17 seen-last: 2010-02-22 19:51:36 rr-name: ns2.pronewmedia.com rr-type: A rr-address: 193.104.XX.67 seen-first: 2010-02-17 09:22:17 seen-last: 2010-02-22 19:51:36

  6. Join! We want sensors. Get access to the DB!

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Further Aspects of Passive DNS Datamining, visualization and alternative implementations

Further Aspects of Passive DNS Datamining, visualization and alternative implementations

Further Aspects of Passive DNS Datamining, visualization and alternative implementations Sebastien Tricaud (PicViz), Alexandre Dulaunoy (CIRCL.lu), L. Aaron Kaplan (CERT.at), David Durvaux (CERT.be), John Kristoff (Team Cymru) June 19, 2012

435 views • 26 slides
CCN-CERT Setting up a Governmental CERT: The CCN-CERT Case Study Sevilla, June 2007

CCN-CERT Setting up a Governmental CERT: The CCN-CERT Case Study Sevilla, June 2007

CCN-CERT Setting up a Governmental CERT: The CCN-CERT Case Study Sevilla, June 2007 Presentation FORUM: 19th Annual FIRST Conference SESSION: CCN Initiative of a Governmental CERT OBJECTIVE: Set the scope and goals of CCN

648 views • 28 slides
Kinesio Tape Workshop Richard Cohen, D.C., DABCO, RCRB, Cert MDT, Cert VGT, Cert KT1, KT2, KT3

Kinesio Tape Workshop Richard Cohen, D.C., DABCO, RCRB, Cert MDT, Cert VGT, Cert KT1, KT2, KT3

Kinesio Tape Workshop Richard Cohen, D.C., DABCO, RCRB, Cert MDT, Cert VGT, Cert KT1, KT2, KT3 Team Chiropractor Kings College, Wilkes-Barre, PA History Concept developed by Kenzo Kase in the 70s Introduced to NATA in USA 1995

740 views • 32 slides
(E (EG-CERT) Ahmed Tharwat | Sharm El Sheikh | December 2017 Outline EG-CERT EG-CERT

(E (EG-CERT) Ahmed Tharwat | Sharm El Sheikh | December 2017 Outline EG-CERT EG-CERT

Egyptian Computer Emergency Readiness Team (E (EG-CERT) Ahmed Tharwat | Sharm El Sheikh | December 2017 Outline EG-CERT EG-CERT Hierarchy Operational Framework Key Cybersecurity Threats Capacity Building International

293 views • 14 slides
Implementing the IODEF at the CERT/CC Roman Danyliw &lt;rdd@cert.org&gt; INCH IETF 55

Implementing the IODEF at the CERT/CC Roman Danyliw &lt;rdd@cert.org&gt; INCH IETF 55

Implementing the IODEF at the CERT/CC Roman Danyliw &lt;rdd@cert.org&gt; INCH IETF 55 Incident Reporting Forms CERT Coordination Center (CERT/CC) Federal Computer Incident Response Capability (FedCIRC) National

437 views • 9 slides
Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

MAY 2016 Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports Upcoming opportunities Featured speaker Ben Koshy, Special Ops, MC-CERT Field Searches Outreach Outreach Items WHO: National Institute

599 views • 24 slides
Management and Prevention Debbie Hicks MSc , BA, RGN, NMP, DN Cert, PWT Cert Nurse Consultant

Management and Prevention Debbie Hicks MSc , BA, RGN, NMP, DN Cert, PWT Cert Nurse Consultant

Hypoglycaemia in in Adults in in the Community: Recognition, Management and Prevention Debbie Hicks MSc , BA, RGN, NMP, DN Cert, PWT Cert Nurse Consultant Diabetes Medicus Health Partners Presentation content Statistics relating to

605 views • 24 slides
CERT-SPC: role and mission Cap. G.di F. Gabriele Cicognani - CERT-SPC - Rome, 04.21.2009 Agenda

CERT-SPC: role and mission Cap. G.di F. Gabriele Cicognani - CERT-SPC - Rome, 04.21.2009 Agenda

A modern approach to ICT security in pubblic administration CERT-SPC: role and mission Cap. G.di F. Gabriele Cicognani - CERT-SPC - Rome, 04.21.2009 Agenda SPCs architetture Scenario: security threats The CERT-SPC: role and

562 views • 30 slides
Reduce passive income, reduce taxes We help. You grow. What is passive income and why does it

Reduce passive income, reduce taxes We help. You grow. What is passive income and why does it

Reduce passive income, reduce taxes We help. You grow. What is passive income and why does it matter? Federal government changed rules, effective for tax years that begin after 2018. Canadian controlled private corporations (CPCC) Passive

193 views • 8 slides
Passive Gas System Design PRESENTED BY BRYAN WELDON P.E. Passive System Overview 01 Passive

Passive Gas System Design PRESENTED BY BRYAN WELDON P.E. Passive System Overview 01 Passive

Passive Gas System Design PRESENTED BY BRYAN WELDON P.E. Passive System Overview 01 Passive Components 02 Integrating and Upgrading 03 Questions 04 2 Passive System Overview ___ 3 Passive Gas System ___ 4 Passive Gas System Usually

332 views • 12 slides
Passive Fire Protection For the Oil &amp; Gas Industry Passive Fire Protection What is purpose

Passive Fire Protection For the Oil &amp; Gas Industry Passive Fire Protection What is purpose

Passive Fire Protection For the Oil &amp; Gas Industry Passive Fire Protection What is purpose of fireproofing? To Save Lives To Preserve Assets To Prevent Escalation Passive Fire Protection Passive Fire Protection Passive Fire

311 views • 29 slides
Montgomery County CERT General Meeting Tonights Agenda CERT Business Upcoming Schedule

Montgomery County CERT General Meeting Tonights Agenda CERT Business Upcoming Schedule

JANUARY 2017 Montgomery County CERT General Meeting Tonights Agenda CERT Business Upcoming Schedule GoTeam in 2017 Reports Reports Teen CERT Instructors needed; Contact Kathee if available Sessions are Sunday and

762 views • 38 slides
Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

JUNE 2016 Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports Upcoming opportunities Table toping an EVAC drill? Review protocol and technique Information needed; communications Stair chair;

402 views • 27 slides
Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

JANUARY 2016 Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports Upcoming opportunities Winter Preparedness Outreach Operations Santa Run Report Response was fair to good Sat. easier to staff

685 views • 53 slides
Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports

SEPTEMBER 2016 Montgomery County CERT General Meeting Tonights Agenda CERT Business Reports Upcoming opportunities Calendar review Guest Speakers Beth Anne Nesselt, MCFRS Community Outreach Bat. Chief James Resnick,

439 views • 32 slides
Montgomery County CERT General Meeting Tonights Agenda General Meeting Recent CERT

Montgomery County CERT General Meeting Tonights Agenda General Meeting Recent CERT

JANUARY 2014 Montgomery County CERT General Meeting Tonights Agenda General Meeting Recent CERT Activity Outreach IT Training HR Social Media General announcements Recent CERT Activity Sunday Monday Tuesday

671 views • 31 slides
Tim McCarthy Tim McCarthy McCarthy Information Systems tmccart1@san.rr.com Agenda Pros/Cons

Tim McCarthy Tim McCarthy McCarthy Information Systems tmccart1@san.rr.com Agenda Pros/Cons

Tim McCarthy Tim McCarthy McCarthy Information Systems tmccart1@san.rr.com Agenda Pros/Cons of application frameworks Refactoring to DDD patterns getting rid of the persistence/plumbing code from the Domain Model My own DDD

779 views • 11 slides
CPU Scheduling Lecture 13 Disclaimer: some slides are adopted from book authors and Dr.

CPU Scheduling Lecture 13 Disclaimer: some slides are adopted from book authors and Dr.

CPU Scheduling Lecture 13 Disclaimer: some slides are adopted from book authors and Dr. Kulkarnis slides with permission 1 Recap Deadlock prevention Break any of four deadlock conditions Mutual exclusion, no preemption, hold

497 views • 38 slides
The Record Route Option Is an Option! Brian J Goodchild, Yi-Ching Chiu, Rob Hansen, Haonan Lu,

The Record Route Option Is an Option! Brian J Goodchild, Yi-Ching Chiu, Rob Hansen, Haonan Lu,

The Record Route Option Is an Option! Brian J Goodchild, Yi-Ching Chiu, Rob Hansen, Haonan Lu, Matt Calder, Matthew Luckie, Wyatt Lloyd, David Choffnes, Ethan Katz-Bassett Rutgers--Camden USC Columbia Northeastern Microsoft

577 views • 34 slides
Relations Sections 8.1 &amp; 8.5 Based on Rosen and slides by K. Busch 1 Relations and Their

Relations Sections 8.1 &amp; 8.5 Based on Rosen and slides by K. Busch 1 Relations and Their

Relations Sections 8.1 &amp; 8.5 Based on Rosen and slides by K. Busch 1 Relations and Their Properties A binary relation R from set to set A B is a subset of Cartesian product A B Example: UW students UW courses A B

476 views • 9 slides
Class 38: Geometry of Conic Sections Class 38: Geometry of Conic Sections Orbital equation

Class 38: Geometry of Conic Sections Class 38: Geometry of Conic Sections Orbital equation

Class 38: Geometry of Conic Sections Class 38: Geometry of Conic Sections Orbital equation 2 Radial : ( r - r ) f(r) r 2 Tangential Tangential : : L L r 1 u r r

556 views • 17 slides
FCSL Previously on this channel Previously on this channel letrec span (x : ptr) : bool = {

FCSL Previously on this channel Previously on this channel letrec span (x : ptr) : bool = {

FCSL Previously on this channel Previously on this channel letrec span (x : ptr) : bool = { if x == null then val_ret false; else b CAS(x-&gt;m, 0, 1); if b then (r l ,r r ) (span(x-&gt;l) || span(x-&gt;r)); if r l then x-&gt;l :=

1.27k views • 88 slides
Scalable Verification of Stateful Networks Aurojit Panda, Ori Lahav, Katerina Argyraki, Mooly

Scalable Verification of Stateful Networks Aurojit Panda, Ori Lahav, Katerina Argyraki, Mooly

Scalable Verification of Stateful Networks Aurojit Panda, Ori Lahav, Katerina Argyraki, Mooly Sagiv, Scott Shenker UC Berkeley, TAU, ICSI Roadmap Why consider stateful networks? The current state of stateful network verification?

1.31k views • 80 slides
de Sitter Vacua Bret Underwood McGill University Pheno 2009 S. Haque, G. Shiu, BU , T . Van

de Sitter Vacua Bret Underwood McGill University Pheno 2009 S. Haque, G. Shiu, BU , T . Van

de Sitter Vacua Bret Underwood McGill University Pheno 2009 S. Haque, G. Shiu, BU , T . Van Riet, Phys. Rev. D79:086005 (2009), arXiv:0810.5328 Does dS space exist classically from a top down construction? dS Space Bottom Up 1 1 H 2 = H 2

481 views • 13 slides

More recommend