targeted attacks analysis and investigation building
play

Targeted Attacks: Analysis and Investigation Building Trust in the - PowerPoint PPT Presentation

Apr 28, 2023 •246 likes •811 views

Targeted Attacks: Analysis and Investigation Building Trust in the Information Age Summer School on Computer Security & Privacy 16th of September 2014 Dr. Marco Balduzzi Course Outline Who am I and research in the industry Target

  1. Targeted Attacks: Analysis and Investigation Building Trust in the Information Age Summer School on Computer Security & Privacy 16th of September 2014 Dr. Marco Balduzzi

  2. Course Outline ● Who am I and research in the industry ● Target Attacks & Success Stories ● Investigative Approach ● Pseudo-Automated Approach ● Discussion ● Questions Slides available @ Slides available @ iseclab.org/people/embyte iseclab.org/people/embyte

  3. Who is Marco Balduzzi (embyte)

  4. BERGAMO

  11. MUNICH

  14. NICE

  17. Back in the '80s – My First PC

  18. Back in the '90s

  20. $ whoami embyte

  26. 1

  30. ● HackMeeting (HackIT) ● 2010 – 2003, 2004, 2014 – AsiaCCS 2010 ● LinuxDay – DIMVA 2010 – 2003, 2004, 2005 – RAID 2010 ● 2004 – TWDT 2010 – Security Date, Webb.it, MOCA, SatExpo ● 2011 ● OWASP – NDSS 2011 (2 papers) – AppSec Research EU 2010, 2011, 2013 – BeNeLux 2010, 2011 – LEET 2011 – Italy 2013, 2014 – DIMVA 2011 ● BlackHat ● 2012 – EU 2011, USA 2012, ASIA 2014 – SAC 2012 – WebCast 2011 & 2012 – Schloss Dagstuhl 2012 ● HITB (Hack In The Box) ● 2013 – KUL 2011, EU 2012, EU 2014 ● Latin America – PST 2013 (2 papers) – Security Zone Colombia 2011, 2012 ● 2014 – 8.8 Chile 2011, 2012 – ACSAC 2014 ● Others – ISC 2014 – MOHP 2007 – Swiss Cyber Storm 2011 – Etc...

  31. Topics of Interest ● Real problems ● Web and Browser Security ● Vulnerability Code Analysis ● Botnets Detection (Network Security) ● Cybercrime Investigation and Research ● Privacy and Threats in Social Networks, and New Technologies ● Malware and Intrusion Detection Systems

  32. *Real* Topics of Interest

  34. So, what am I doing now? Senior Research Scientist

  35. FTR Mission ● Forward-Looking Threat Research ● Considered the “elite” research team within Trend Micro Forward Looking Statement for Executives

  36. International Coverage

  37. Honeypots Research ● Yes, we love data ;-) ● Web Honeypot. Joint-research project with EURECOM ● ICS Honeypot.

  38. Web Research ● Soundsquatting: Uncovering the use of homophones in domain squatting – Joint-research project with KUL. @ISC2014

  39. Scouting the DeepWeb

  40. Marketplaces & exchanged goods

  41. Cybercriminals' infrastructures ● By Path

  42. Technology Research – AIS ● Joint-project with external researcher

  43. Technology Research

  44. GLOBAL APAC NORTH AMERICA EUROPE LATIN AMERICA

  45. Operation Ghost Click ● 4 Millions bots, 100 C&C servers (#1 history) ● Steal clicks (replacing ads, hijacking search results) ● Collaboration between FBI, Estonian Police and FTR ● 2-years operation ● Vladimir Tsastsin, CEO of Rove Digital (ISP) ● 6+ years arrested

  46. Hamza Bendelladj (BX1) ● SpyEye co-author (#1 banking trojan) ● Algerian in Thailand (XMas) ● https://www.youtube.com/watch?v=OAhSW-l0-Xk

  47. Reveton Ransomware ● Locks you out. Demands money to let you back in :) http://www.northeastern.edu/securenu/wp-content/uploads/2012/09/multiple_ransomware_warnings.gif ● https://www.youtube.com/watch?v=wBMyaOa4Xnw ●

  48. BUT, Are these Targeted Attacks? NO!

  49. Targeted Attacks (MKT likes APT) ● Internet Security Threat Report: – Spam volume is decreased, but... – Web-based attacks increased 30% – 5,291 new vulnerabilities discovered in 2012 – The number of phishing pages spoofing social networks increased 125% ● 42% increase in targeted attacks in 2012

  50. Shift ● World dominated by widespread malware that infects indiscriminately, to a more selectively targeted approach ● Just-for-fun era is over? ● Espionage, nation-driven, criminal organizations ● Specific targets / industries – e.g. civil society organizations, business enterprises, critical infrastructures, government and military assets

  51. Modus Operandi ● High-selective Reconnaissance ● Use of Social Engineering ● Emails and IMs as attack-vectors ● Malicious PDF, DOC, Flash ● Persistence and Lateral Movements ● Data Ex-filtration

  52. 2009: Operation Aurora

  53. Ongoing since 2004 (at the least)

  54. 2010: StuxNet Critical Infrastructures

  55. 2012-07: Cyberespionage program

Recommend

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik

Protection of flows Protection of flows under targeted attacks under targeted attacks Jannik Matuschke Tom McCormick Gianpaolo Oriolo TU Berlin UBC Vancouver Tor Vergata Britta Peis Martin Skutella RWTH Aachen TU Berlin Robust flows

531 views • 28 slides
Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks

Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks

Mitigating Covert Compromises: A Game-Theoretic Model of Targeted and Non-Targeted Covert Attacks Aron Laszka 1 , 2 Benjamin Johnson 3 Jens Grossklags 1 1 Pennsylvania State University 2 Budapest University of Technology and Economics 3 University

867 views • 43 slides
Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017

Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017

Assessing Targeted Attacks in Incident Response Threat Correlation Jan 2017 www.lookingglasscyber.com PRESENTER: Allan Thomson, CTO Dr Jamison Day, Principal Data Scientist 2017 LookingGlass Cyber Solutions Inc. 1 What threats are

344 views • 21 slides
Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh,

Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh,

Protecting Vulnerable Communities from Targeted Violence and Mass Casualty Attacks Cole Bligh, Elisavet Gallou, James N. Robinson III, Yuqing Zhou Importance May 2014 : A lethal terrorist attack on the Jewish Museum in Brussels denotes a

629 views • 9 slides
Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index

Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index

Evolution of Malware and the Next Generation Endpoint Protection against Targeted Attacks Index 1. Malware volume evolution 2. Malware Eras 3. Panda Adaptive Defense 1. What is it 2. Features & Benefits 3. How does it work 4.

661 views • 47 slides
ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and

ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and

ICmyNet.Flow: NetFlow based traffic investigation analysis traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@ rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF

641 views • 46 slides
CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks

CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks

CS525: Who s Your Best Friend? Targeted Privacy Attacks In Location sharing Social Networks Wei Wang ECE Dept. Worcester Polytechnic Institute (WPI) Security and Privacy Problems in the mobile and cloud computing Security and Privacy

608 views • 19 slides
US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted

US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted

http://www. orcid.org/0000-0002-2668-4821 US-EPA Comptox Chemicals Dashboard to support mass spectrometry targeted and non-targeted analysis Antony Williams 1 , Alex Chao 2 , Tom Transue 3 , Tommy Cathey 3 , Elin Ulrich 4 and Jon Sobus 4 1)

804 views • 64 slides
Stealthy Attacks In many scenarios, attackers want to keep successful security compromises

Stealthy Attacks In many scenarios, attackers want to keep successful security compromises

FlipThem : Modeling Targeted Attacks with FlipIt for Multiple Resources Aron Laszka 1 , Gabor Horvath 2 , Mark Felegyhazi 2 , and Levente Buttyan 2 1 : Vanderbilt University, Institute for Software Integrated Systems 2 : Budapest University of

547 views • 23 slides
using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis

using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis

Website Fingerprinting using Traffic Analysis Attacks Salini S K What is Traffic Analysis What is Traffic Analysis Wiki says What is Traffic Analysis Wiki says Process of intercepting and examining messages in order to deduce

1.15k views • 41 slides
Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen

Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen

Protecting Mobile Devices from Physical Memory Attacks with Targeted Encryption Le Guan , Chen Cao, Sencun Zhu, Jingqiang Lin, Peng Liu, Yubin Xia, and Bo Luo Why do Physical-space Threats Concern for SmartPhones? Why do Physical-space Threats

318 views • 31 slides
I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global

I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global

I ntroduction I ntrusion Detection How prevalent are DoS attacks? Backscatter and Global Analysis Quantitative analysis Long term predictions and Stefan Zota recurring patterns of attacks Measurement and Global Analysis The UNIVERSITY

474 views • 14 slides
Plaza East Plaza East Analysis 3: Im plem entation Checking Green Roof Loads Chantilly ,

Plaza East Plaza East Analysis 3: Im plem entation Checking Green Roof Loads Chantilly ,

4/28/2008 Plaza East Chantilly, Virginia Project Overview Presentation Topics Analysis 1: Building Envelope Analysis 2: Green Building Envelope Roof Implementation Investigation Green Roof Green Roof Plaza East Plaza East Analysis 3:

510 views • 8 slides
Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David

Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David

Audio Adversarial Examples: Targeted Attacks on Speech-To-Text Nicholas Carlini and David Wagner University of California, Berkeley Background Neural Networks for Automatic Speech Recognition Neural Networks for Automatic Speech

768 views • 58 slides

About Us Focus on targeted attack investigation, incident response, and threat solution research for more than 15 years

1.03k views • 59 slides
Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis &

Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis &

Link Analysis & Social Media: A New And Powerful Investigation Tactic Link Analysis & Social Media: A New And Powerful Investigation Tactic About the presenters Howard Williamson X1 Matt Niessen IBM Agenda Link Analysis For

335 views • 16 slides
Non-targeted analysis supported by data and cheminformatics delivered via the US EPA CompTox

Non-targeted analysis supported by data and cheminformatics delivered via the US EPA CompTox

http://www. orcid.org/0000-0002-2668-4821 Non-targeted analysis supported by data and cheminformatics delivered via the US EPA CompTox Chemicals Dashboard Antony Williams , Alex Chao, Tom Transue, Tommy Cathey, Elin Ulrich and Jon Sobus 1)

1.26k views • 68 slides
Loose Ends: Side Channels, Government Surveillance & Targeted

Loose Ends: Side Channels, Government Surveillance & Targeted

CSE 484 / CSE M 584: Computer Security and Privacy Loose Ends: Side Channels, Government Surveillance & Targeted Attacks Spring 2015 Franziska

622 views • 27 slides
Investigation of Thermal Decomposition Investigation of Thermal Decomposition Process of

Investigation of Thermal Decomposition Investigation of Thermal Decomposition Process of

Seminar on Nanotechnology for Fabrication of Hybrid Materials, 6-8, Nov., 2002, Toyama, Japan (4th Japanese-Polish Joint Seminar on Materials Analysis) Investigation of Thermal Decomposition Investigation of Thermal Decomposition Process of

209 views • 16 slides
INCIDENT INVESTIGATION ANALYSIS Nalicia Stevenson Addo Safety Manager, Cutrale What Is An

INCIDENT INVESTIGATION ANALYSIS Nalicia Stevenson Addo Safety Manager, Cutrale What Is An

INCIDENT INVESTIGATION ANALYSIS Nalicia Stevenson Addo Safety Manager, Cutrale What Is An Incident Major Reasons For Conducting Incident Investigations Incident Investigation AGENDA Procedures 5 W 1 H Problem Statement

418 views • 13 slides
Building FPGA-Targeted Accelerators with HeteroCL Zhiru Zhang School of ECE, Cornell University

Building FPGA-Targeted Accelerators with HeteroCL Zhiru Zhang School of ECE, Cornell University

Building FPGA-Targeted Accelerators with HeteroCL Zhiru Zhang School of ECE, Cornell University csl.cornell.edu/~zhiruz In collaboration with Cornell : Yi-Hsiang Lai, Shaojie Xiang, Yuwei Hu UCLA : Yuze Chi, Jie Wang, Cody Yu, Jason Cong TVM

465 views • 30 slides
Building Secure Block Ciphers on Generic Attacks Assumptions Jacques Patarin and Yannick Seurin

Building Secure Block Ciphers on Generic Attacks Assumptions Jacques Patarin and Yannick Seurin

Building Secure Block Ciphers on Generic Attacks Assumptions Jacques Patarin and Yannick Seurin University of Versailles and Orange Labs SAC 2008 August 14-15, 2008 intro the Russian Dolls construction generic attacks application to

539 views • 17 slides
1 2 3 The Industry Standard The Industry Standard Analysis, design, and investigation of

1 2 3 The Industry Standard The Industry Standard Analysis, design, and investigation of

1 2 3 The Industry Standard The Industry Standard Analysis, design, and investigation of R/C Analysis, design, and investigation of R/C beams and one-way slab systems 38 39 Options Options Moment Redistribution Moment

417 views • 8 slides
Threat analysis of a Cellular Botnet regarding DoS attacks (Bedrohungsanalyse von

Threat analysis of a Cellular Botnet regarding DoS attacks (Bedrohungsanalyse von

Lehrstuhl fr Netzarchitekturen und Netzdienste Institut fr Informatik Technische Universitt Mnchen Threat analysis of a Cellular Botnet regarding DoS attacks (Bedrohungsanalyse von Mobilfunk-Botnetzen im Hinblick auf DoS-Angriffe)

311 views • 20 slides

More recommend