targeted attacks analysis and investigation building
play

Targeted Attacks: Analysis and Investigation Building Trust in the - PowerPoint PPT Presentation

Apr 28, 2023 •246 likes •811 views

Targeted Attacks: Analysis and Investigation Building Trust in the Information Age Summer School on Computer Security & Privacy 16th of September 2014 Dr. Marco Balduzzi Course Outline Who am I and research in the industry Target

  1. Targeted Attacks: Analysis and Investigation Building Trust in the Information Age Summer School on Computer Security & Privacy 16th of September 2014 Dr. Marco Balduzzi

  2. Course Outline ● Who am I and research in the industry ● Target Attacks & Success Stories ● Investigative Approach ● Pseudo-Automated Approach ● Discussion ● Questions Slides available @ Slides available @ iseclab.org/people/embyte iseclab.org/people/embyte

  3. Who is Marco Balduzzi (embyte)

  4. BERGAMO

  11. MUNICH

  14. NICE

  17. Back in the '80s – My First PC

  18. Back in the '90s

  20. $ whoami embyte

  26. 1

  30. ● HackMeeting (HackIT) ● 2010 – 2003, 2004, 2014 – AsiaCCS 2010 ● LinuxDay – DIMVA 2010 – 2003, 2004, 2005 – RAID 2010 ● 2004 – TWDT 2010 – Security Date, Webb.it, MOCA, SatExpo ● 2011 ● OWASP – NDSS 2011 (2 papers) – AppSec Research EU 2010, 2011, 2013 – BeNeLux 2010, 2011 – LEET 2011 – Italy 2013, 2014 – DIMVA 2011 ● BlackHat ● 2012 – EU 2011, USA 2012, ASIA 2014 – SAC 2012 – WebCast 2011 & 2012 – Schloss Dagstuhl 2012 ● HITB (Hack In The Box) ● 2013 – KUL 2011, EU 2012, EU 2014 ● Latin America – PST 2013 (2 papers) – Security Zone Colombia 2011, 2012 ● 2014 – 8.8 Chile 2011, 2012 – ACSAC 2014 ● Others – ISC 2014 – MOHP 2007 – Swiss Cyber Storm 2011 – Etc...

  31. Topics of Interest ● Real problems ● Web and Browser Security ● Vulnerability Code Analysis ● Botnets Detection (Network Security) ● Cybercrime Investigation and Research ● Privacy and Threats in Social Networks, and New Technologies ● Malware and Intrusion Detection Systems

  32. *Real* Topics of Interest

  34. So, what am I doing now? Senior Research Scientist

  35. FTR Mission ● Forward-Looking Threat Research ● Considered the “elite” research team within Trend Micro Forward Looking Statement for Executives

  36. International Coverage

  37. Honeypots Research ● Yes, we love data ;-) ● Web Honeypot. Joint-research project with EURECOM ● ICS Honeypot.

  38. Web Research ● Soundsquatting: Uncovering the use of homophones in domain squatting – Joint-research project with KUL. @ISC2014

  39. Scouting the DeepWeb

  40. Marketplaces & exchanged goods

  41. Cybercriminals' infrastructures ● By Path

  42. Technology Research – AIS ● Joint-project with external researcher

  43. Technology Research

  44. GLOBAL APAC NORTH AMERICA EUROPE LATIN AMERICA

  45. Operation Ghost Click ● 4 Millions bots, 100 C&C servers (#1 history) ● Steal clicks (replacing ads, hijacking search results) ● Collaboration between FBI, Estonian Police and FTR ● 2-years operation ● Vladimir Tsastsin, CEO of Rove Digital (ISP) ● 6+ years arrested

  46. Hamza Bendelladj (BX1) ● SpyEye co-author (#1 banking trojan) ● Algerian in Thailand (XMas) ● https://www.youtube.com/watch?v=OAhSW-l0-Xk

  47. Reveton Ransomware ● Locks you out. Demands money to let you back in :) http://www.northeastern.edu/securenu/wp-content/uploads/2012/09/multiple_ransomware_warnings.gif ● https://www.youtube.com/watch?v=wBMyaOa4Xnw ●

  48. BUT, Are these Targeted Attacks? NO!

  49. Targeted Attacks (MKT likes APT) ● Internet Security Threat Report: – Spam volume is decreased, but... – Web-based attacks increased 30% – 5,291 new vulnerabilities discovered in 2012 – The number of phishing pages spoofing social networks increased 125% ● 42% increase in targeted attacks in 2012

  50. Shift ● World dominated by widespread malware that infects indiscriminately, to a more selectively targeted approach ● Just-for-fun era is over? ● Espionage, nation-driven, criminal organizations ● Specific targets / industries – e.g. civil society organizations, business enterprises, critical infrastructures, government and military assets

  51. Modus Operandi ● High-selective Reconnaissance ● Use of Social Engineering ● Emails and IMs as attack-vectors ● Malicious PDF, DOC, Flash ● Persistence and Lateral Movements ● Data Ex-filtration

  52. 2009: Operation Aurora

  53. Ongoing since 2004 (at the least)

  54. 2010: StuxNet Critical Infrastructures

  55. 2012-07: Cyberespionage program

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik Matuschke Tom McCormick Gianpaolo Oriolo TU Berlin UBC Vancouver Tor Vergata Britta Peis Martin Skutella RWTH Aachen TU Berlin Robust flows

531 views • 28 slides
Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks

Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks

Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks Aron Laszka 1 , 2 Benjamin Johnson 3 Jens Grossklags 1 1 Pennsylvania State University 2 Budapest University of Technology and Economics 3 University

867 views • 43 slides
Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017

Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017

Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017 www.lookingglasscyber.com PRESENTER: Allan Thomson, CTO Dr Jamison Day, Principal Data Scientist 2017 LookingGlass Cyber Solutions Inc. 1 What threats are

344 views • 21 slides
Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh,

Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh,

Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh, Elisavet Gallou, James N. Robinson III, Yuqing Zhou Importance May 2014 : A lethal terrorist attack on the Jewish Museum in Brussels denotes a

629 views • 9 slides
Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index

Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index

Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index 1. Malware volume evolution 2. Malware Eras 3. Panda Adaptive Defense 1. What is it 2. Features & Benefits 3. How does it work 4.

661 views • 47 slides
ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and

ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and

ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@ rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF

641 views • 46 slides
CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks

CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks

CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks Wei Wang ECE Dept. Worcester Polytechnic Institute (WPI) Security and Privacy Problems in the mobile and cloud computing Security and Privacy

608 views • 19 slides
US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted

US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted

http://www. orcid.org/0000-0002-2668-4821 US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted analysis Antony Williams 1 , Alex Chao 2 , Tom Transue 3 , Tommy Cathey 3 , Elin Ulrich 4 and Jon Sobus 4 1)

804 views • 64 slides
Stealthy Attacks In many scenarios, attackers want to keep successful security compromises

Stealthy Attacks In many scenarios, attackers want to keep successful security compromises

FlipThem : Modeling Targeted Attacks with FlipIt for Multiple Resources Aron Laszka 1 , Gabor Horvath 2 , Mark Felegyhazi 2 , and Levente Buttyan 2 1 : Vanderbilt University, Institute for Software Integrated Systems 2 : Budapest University of

547 views • 23 slides
using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis

using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis

Website Fingerprinting using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis Wiki says What is Traffic Analysis Wiki says Process of intercepting and examining messages in order to deduce

1.15k views • 41 slides
Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen

Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen

Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen Cao, Sencun Zhu, Jingqiang Lin, Peng Liu, Yubin Xia, and Bo Luo Why do Physical-space Threats Concern for SmartPhones? Why do Physical-space Threats

318 views • 31 slides
I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global

I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global

I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global Analysis Quantitative analysis Long term predictions and Stefan Zota recurring patterns of attacks Measurement and Global Analysis The UNIVERSITY

474 views • 14 slides
Plaza East Plaza East Analysis 3: Im plem entation Checking Green Roof Loads Chantilly ,

Plaza East Plaza East Analysis 3: Im plem entation Checking Green Roof Loads Chantilly ,

4/28/2008 Plaza East Chantilly, Virginia Project Overview Presentation Topics Analysis 1: Building Envelope Analysis 2: Green Building Envelope Roof Implementation Investigation Green Roof Green Roof Plaza East Plaza East Analysis 3:

510 views • 8 slides
Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David

Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David

Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David Wagner University of California, Berkeley Background Neural Networks for Automatic Speech Recognition Neural Networks for Automatic Speech

768 views • 58 slides

About Us Focus on targeted attack investigation, incident response, and threat solution research for more than 15 years

1.03k views • 59 slides
Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis &

Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis &

Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis & Social Media: A New And Powerful Investigation Tactic About the presenters Howard Williamson X1 Matt Niessen IBM Agenda Link Analysis For

335 views • 16 slides
Preparing for the Unthinkable Cyber Security Chicago 2018 Agenda Introduction Security

Preparing for the Unthinkable Cyber Security Chicago 2018 Agenda Introduction Security

Preparing for the Unthinkable Cyber Security Chicago 2018 Agenda Introduction Security Landscape Meraki Security Demo Security Landscape The Growing Importance of Security MALWARE HAS RISEN BY MORE THAN 10X IN THE LAST YEAR 70% M ALW AR E

604 views • 35 slides
Empirical Analysis and Statistical Modelling of Attack Processes based on Honeypots M. Kaniche

Empirical Analysis and Statistical Modelling of Attack Processes based on Honeypots M. Kaniche

Empirical Analysis and Statistical Modelling of Attack Processes based on Honeypots M. Kaniche 1 , E. Alata 1 , V.Nicomette 1 , Y. Deswarte 1 , M. Dacier 2 LAAS-CNRS 1 , Eurecom 2 Mohamed.Kaaniche@laas.fr ACI Scurit &

409 views • 17 slides
E-mail trends in 2010: How do spammers get your address? Using distributed poisoned addresses to

E-mail trends in 2010: How do spammers get your address? Using distributed poisoned addresses to

Motivation How E-mail works Conventional Wisdom Previous Work Implementation Results Conclusion E-mail trends in 2010: How do spammers get your address? Using distributed poisoned addresses to track harvesting behavior Robert Marmorstein

447 views • 17 slides
Robot Attack! Repelling Bots, DDOS, and other Fiends Stanford Drupal Camp 2015 MEET YOUR GUIDES

Robot Attack! Repelling Bots, DDOS, and other Fiends Stanford Drupal Camp 2015 MEET YOUR GUIDES

Robot Attack! Repelling Bots, DDOS, and other Fiends Stanford Drupal Camp 2015 MEET YOUR GUIDES Suzanne Aldrich Martijn Gonlag Senior Customer Success Engineer - Pantheon Technical Support Engineer - CloudFlare AGENDA Surveying Robots

247 views • 13 slides
Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots

ITS335 Intrusion Detection Intruders Intrusion Detection Host-Based Intrusion Detection Distributed Host-Based Network-Based ITS335: IT Security Honeypots Summary Sirindhorn International Institute of Technology Thammasat University

583 views • 30 slides
Great Fires in Raleigh Mike Legeros Presenter Information Day Job: Software company,

Great Fires in Raleigh Mike Legeros Presenter Information Day Job: Software company,

Raleigh Fire Department Historical Society www.raleighfirehistory.org Great Fires in Raleigh Mike Legeros Presenter Information Day Job: Software company, member of web team. Former Raleigh firefighter Fighting Fires

448 views • 18 slides
HoseGoes Orange B Sketch Model Review Slide 1 Introduction Slide 2 Approaches for finding fire

HoseGoes Orange B Sketch Model Review Slide 1 Introduction Slide 2 Approaches for finding fire

HoseGoes Orange B Sketch Model Review Slide 1 Introduction Slide 2 Approaches for finding fire hose in low visibility Sound Light Touch Directionality guider on hose Lead out of building Slide 3 Engineering

494 views • 11 slides
Comparison of Garden Hose complexity with communication and circuit complexities Mikhail

Comparison of Garden Hose complexity with communication and circuit complexities Mikhail

. . . . .. . . .. . . .. . . .. . .. . . . .. . . .. . . .. . Comparison of Garden Hose complexity with communication and circuit complexities Mikhail Dektyarev .. . .. . . . .. . . .. . . .. . . .. .

423 views • 21 slides

More recommend