Lessons learned: Sinkholing the Zeroaccess botnet. Ross Gibb. Attack Investigations Team Symantec Security Response.

Size: px
Start display at page:

Download "Lessons learned: Sinkholing the Zeroaccess botnet. Ross Gibb. Attack Investigations Team Symantec Security Response."

Transcription

1 Lessons learned: Sinkholing the Zeroaccess botnet Ross Gibb Attack Investigations Team Symantec Security Response AIT - Zeroaccess 1

2 Agenda 1 Introduction to Zeroaccess 2 Details of the P2P protocol 3 The sinkhole operation 4 Results of the sinkhole operation 5 Next steps AIT - Zeroaccess 2

3 Zeroaccess (ZA) Introduction Zeroaccess is a botnet, also known as Sirefef or ZAccess or Zerokit First appeared in Summer 2011 Two major versions Version 1, rootkit, TCP P2P (2011) Version 2, user mode, UDP P2P (2012) Infected computers exclusively use the peer-to-peer (P2P) network to distribute payloads Can be thought of as a framework to load any module/malware Infection vectors include social engineering, exploit kits, and other downloaders Pay Per Install (PPI) and revenue sharing model Primary revenue is through click-fraud Malicious payloads use their own C&C infrastructure AIT - Zeroaccess 3

4 ZA Size Counts are of average daily unique infected hosts, measured in May 2013 Networks are subdivided into 32-bit and 64-bit client networks; no internetwork / cross-port communication ZA v1 (TCP) All Networks 30K ZA v2 (UDP) Network 1 UDP ports (32-bit) / (64-bit) Network 2 UDP ports (32-bit) / (64-bit) M What would a sinkhole of Zeroaccess look like? AIT - Zeroaccess 4

5 ZA P2P Operation Bot A Bot B 1 Request: IP list and file meta-data (getl) Response: IP list and file meta-data (retl) 2 UDP UDP Internal List of Peers Bot B IP th IP 3 Refresh Internal List AIT - Zeroaccess 5

6 ZA P2P Operation Bot A Bot B 1 Request: IP list and file meta-data (getl) Response: IP list and file meta-data (retl) 2 UDP UDP Request: IP list and file meta-data (getl+) 3 4 Response: IP list and file meta-data (retl+) Bot A s IP (newl) (16) (16) (16) (16) (16) 8 times How many bots could receive Bot A s IP address? i billion More than the entire IPv4 address space i AIT - Zeroaccess 6

7 ZA Could the P2P network be sinkholed? Identified weaknesses Relatively small fixed length internal peer list (256 IPs) Unsolicited P2P messages are accepted from any IP IP list in P2P messages is not digitally signed, only payload file meta data is digitally signed Any IP address can be introduced into a remote peer s internal peer list AIT - Zeroaccess 7

8 ZA Challenges to sinkholing Sinkhole 1 newl (with S s IP) Public Peer 1 3 getl 2 retl (with S s IP) NAT Internal peer list Sinkhole IP 1 Sinkhole IP 2 Sinkhole IP th IP newl (Public Peer IP) newl (Public Peer IP) Public Peer 2 Takes a very large amount of continuous bandwidth Public Peer 3 IP churn makes it difficult to know all the public peers (super nodes) Zeroaccess author could use newl s in the same way to retake public peers Difficult to run in a network simulation prior to deployment AIT - Zeroaccess 8

9 ZA Sinkholing Plan Internal List of Peers newl (with A s IP) newl (with A s IP) newl (with A s IP) 1 getl 4 getl 2 Public Peer 1 IP Sinkhole Public Peer Farm 2 A IP IP 256 th IP NAT 3 retl (with A s IP) Sinkhole Farm A Sinkhole B 5 retl (with B s IP) retl (with B s IP) retl (with B s IP) retl (with B s IP) getl (sinkhole servers) Sinkholed Internal List of Peers Sinkhole B IP 1 Sinkhole B IP AIT - Zeroaccess 9

10 ZA The sinkhole master plan Preconditions to launching the sinkhole operation Simulate infected peers to understand runtime behaviour Test sinkholing infected computers on a private LAN with various NAT devices Test against the live P2P live as much as possible without actually sinkholing Expected results Infected peers behind NAT devices are sinkholed and the payloads can no longer be updated All infected machines can be identified for remediation AIT - Zeroaccess 10

11 ZA The best laid plans of mice and men From April to June 2013, the simulation and testing of the sinkhole plan progressed On June 29, 2013, new P2P code was distributed to Zeroaccess version 2 network 2 ZA v2 (UDP) Network 1 UDP ports (32-bit) / (64-bit) Network 2 UDP ports (32-bit) / (64-bit) The update made P2P Network 2 much more resilient to sinkholing Reduction in instruction set (newl dropped) Introduction of secondary internal peer list (holds ~16M IPs) Altered run-time peer communication (secondary peer list for redundancy, and connection state table) AIT - Zeroaccess 11

12 ZA Sinkhole results P2P sinkhole of Network 1 initiated on July, Available targets June 29, 2013, protocol update reduced possible targets to ~900,000 Sinkhole results week of July 17 July 23 (in avg. daily IPs) Botnet size: 797,235 Number of bots sinkholed: 460,000 High sinkhole count for 24 hour period 495,610 Average proportion of botnet sinkholed: 58.7% AIT - Zeroaccess 12

13 ZA Graph of botnet size Botnet size Botnet size AIT - Zeroaccess 13

14 ZA Graph of sinkhole size Sinkholed Sinkholed AIT - Zeroaccess 14

15 Worldwide Infections of Zeroaccess (Approx 800K Daily) AIT - Zeroaccess 15

16 ZA Next steps Continue to work with ISP s and CERTs to clean up infections Continue monitoring P2P networks (sinkholed and not), as well as payload infrastructure Continue with other avenues of investigation AIT - Zeroaccess 16

17 ZA Questions Ross Gibb Attack Investigations Team (AIT) Symantec Security Response Culver City, California AIT - Zeroaccess 17

18 Thank you! Copyright 2010 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. AIT - Zeroaccess 18

A Review of ZeroAccess peer-to-peer Botnet

A Review of ZeroAccess peer-to-peer Botnet A Review of ZeroAccess peer-to-peer Botnet Ms. Cheenu M.TECH & Graphic Era Hill University Dehradun India Abstract Today ZeroAccess is one of the widespread threats over the internet. The total number

More information

2014 ASE BIGDATA/SOCIALCOM/CYBERSECURITY Conference, Stanford University, May 27-31, 2014 ASE 2014 ISBN: 978-1-62561-000-3 1

2014 ASE BIGDATA/SOCIALCOM/CYBERSECURITY Conference, Stanford University, May 27-31, 2014 ASE 2014 ISBN: 978-1-62561-000-3 1 ASE 2014 ISBN: 978-1-62561-000-3 1 Network Traffic Analysis of ZeroAccess Bot Shree Garg, Anil K. Sarje, Sateesh K. Peddoju Department of Computer Science & Engineering Indian Institute of Technology Roorkee,

More information

Introducing IBM s Advanced Threat Protection Platform

Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Advanced Threat Protection Platform Introducing IBM s Extensible Approach to Threat Prevention Paul Kaspian Senior Product Marketing Manager IBM Security Systems 1 IBM NDA 2012 Only IBM

More information

Billion Dollar Botnets:

Billion Dollar Botnets: Billion Dollar Botnets: An Examination of the Current Trend in Android Botnets Cathal Mullaney Senior Software Engineer @threatintel Symantec Security Response 1 Presentation agenda 1 2 Android botnets

More information

IBM WebSphere Application Server Communications Enabled Applications

IBM WebSphere Application Server Communications Enabled Applications IBM WebSphere Application Server Communications Enabled Applications Configuring a CEA environment 2011 IBM Corporation This presentation describes how to configure a WebSphere Application Server environment

More information

Protecting the Infrastructure: Symantec Web Gateway

Protecting the Infrastructure: Symantec Web Gateway Protecting the Infrastructure: Symantec Web Gateway 1 Why Symantec for Web Security? Flexibility and Choice Best in class hosted service, appliance, and virtual appliance (upcoming) deployment options

More information

How Cisco IT Protects Against Distributed Denial of Service Attacks

How Cisco IT Protects Against Distributed Denial of Service Attacks How Cisco IT Protects Against Distributed Denial of Service Attacks Cisco Guard provides added layer of protection for server properties with high business value. Cisco IT Case Study / < Security and VPN

More information

The ZeroAccess Botnet Mining and Fraud for Massive Financial Gain

The ZeroAccess Botnet Mining and Fraud for Massive Financial Gain The ZeroAccess Botnet Mining and Fraud for Massive Financial Gain By James Wyke, Senior Threat Researcher, SophosLabs Introduction: Since our last paper on ZeroAccess, The ZeroAccess Rootkit [1], its authors

More information

Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.

Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch. Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.20 Long term and short term solutions to Internet scalability

More information

Best Practices for Controlling Skype within the Enterprise. Whitepaper

Best Practices for Controlling Skype within the Enterprise. Whitepaper Best Practices for Controlling Skype within the Enterprise Whitepaper INTRODUCTION Skype (rhymes with ripe ) is a proprietary peer-to-peer (P2P) voice over Internet protocol (VoIP) network, founded by

More information

Is Your Browser Putting You at Risk?

Is Your Browser Putting You at Risk? ANALYST BRIEF Is Your Browser Putting You at Risk? PART 2: CLICK FRAUD Authors Francisco Artes, Stefan Frei, Ken Baylor, Jayendra Pathak, Bob Walder Overview The US online advertising market in 2011 was

More information

Symantec enterprise security. Symantec Internet Security Threat Report April 2009. An important note about these statistics.

Symantec enterprise security. Symantec Internet Security Threat Report April 2009. An important note about these statistics. Symantec enterprise security Symantec Internet Security Threat Report April 00 Regional Data Sheet Latin America An important note about these statistics The statistics discussed in this document are based

More information

NetBackup Best Practice Using Tape Storage with Deduplicating Disk Storage

NetBackup Best Practice Using Tape Storage with Deduplicating Disk Storage NetBackup Best Practice Using Tape Storage with Deduplicating Disk Storage This document looks at best practices around creating multiple copies of backups on a mixture of tape and deduplicating disk storage.

More information

Best Practices for Controlling Skype within the Enterprise > White Paper

Best Practices for Controlling Skype within the Enterprise > White Paper > White Paper Introduction Skype is continuing to gain ground in enterprises as users deploy it on their PCs with or without management approval. As it comes to your organization, should you embrace it

More information

A Critical Investigation of Botnet

A Critical Investigation of Botnet Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals

More information

Secure Your Mobile Workplace

Secure Your Mobile Workplace Secure Your Mobile Workplace Sunny Leung Senior System Engineer Symantec 3th Dec, 2013 1 Agenda 1. The Threats 2. The Protection 3. Q&A 2 The Mobile Workplaces The Threats 4 Targeted Attacks up 42% in

More information

LOAD BALANCING 2X APPLICATIONSERVER XG SECURE CLIENT GATEWAYS THROUGH MICROSOFT NETWORK LOAD BALANCING

LOAD BALANCING 2X APPLICATIONSERVER XG SECURE CLIENT GATEWAYS THROUGH MICROSOFT NETWORK LOAD BALANCING SECURE CLIENT GATEWAYS THROUGH MICROSOFT NETWORK LOAD BALANCING Contents Introduction... 3 Network Diagram... 3 Installing NLB... 3-4 Configuring NLB... 4-8 Configuring 2X Secure Client Gateway... 9 About

More information

PEER-TO-PEER NETWORK

PEER-TO-PEER NETWORK PEER-TO-PEER NETWORK February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

Email Security.cloud Configuring DLP on to your email flow and applying security to your hosted email deployment

Email Security.cloud Configuring DLP on to your email flow and applying security to your hosted email deployment Email Security.cloud Configuring DLP on to your email flow and applying security to your hosted email deployment Phil Walters Principal Learning Consultant, Technical Field Enablement Email Security.cloud

More information

VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION

VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally

More information

On and off premises technologies Which is best for you?

On and off premises technologies Which is best for you? On and off premises technologies Which is best for you? We don t mind what you buy, as long as it is YELLOW! Warren Sealey and Paul-Christian Garpe On Premises or in the cloud? 1 Agenda Why Symantec? Email

More information

Unified Security, ATP and more

Unified Security, ATP and more SYMANTEC Unified Security, ATP and more TAKE THE NEXT STEP Martin Werner PreSales Consultant, Symantec Switzerland AG MEET SWISS INFOSEC! 27.01.2016 Unified Security 2 Symantec Enterprise Security Users

More information

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION

INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION INDUSTRIAL CONTROL SYSTEMS CYBER SECURITY DEMONSTRATION Prepared for the NRC Fuel Cycle Cyber Security Threat Conference Presented by: Jon Chugg, Ken Rohde Organization(s): INL Date: May 30, 2013 Disclaimer

More information

To Catch A Thief: Preventing the Next Fortune 500 Data Breach

To Catch A Thief: Preventing the Next Fortune 500 Data Breach To Catch A Thief: Preventing the Next Fortune 500 Data Breach Rob Eggebrecht President and CEO, BEW Global John Ochman Manager, Security Operations, BD To Catch A Thief: Preventing the Next Fortune 500

More information

Deciphering and Mitigating Blackhole Spam from Email-borne Threats

Deciphering and Mitigating Blackhole Spam from Email-borne Threats Deciphering and Mitigating Blackhole Spam from Email-borne Threats Samir Patil Symantec Deciphering and Mitigating Blackhole Spam from Email-borne Threats 1 Outline 1 Background 2 Detection Challenges

More information

Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka

Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques

More information

Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations

Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations Symantec Endpoint Protection 11.0 Architecture, Sizing, and Performance Recommendations Technical Product Management Team Endpoint Security Copyright 2007 All Rights Reserved Revision 6 Introduction This

More information

Resilient Botnet Command and Control with Tor

Resilient Botnet Command and Control with Tor Resilient Botnet Command and Control with Tor Dennis Brown July 2010 10/14/10 1 Who am I? Dennis Brown Security Researcher for Tenable Network Solutions Toorcon 10, 11 Defcon 18 PaulDotCom Podcast Rhode

More information

Big Data in Action: Behind the Scenes at Symantec with the World s Largest Threat Intelligence Data

Big Data in Action: Behind the Scenes at Symantec with the World s Largest Threat Intelligence Data Big Data in Action: Behind the Scenes at Symantec with the World s Largest Threat Intelligence Data Patrick Gardner VP Engineering Sourabh Satish Distinguished Engineer Symantec Vision 2014 - Big Data

More information

Getting Ahead of Malware

Getting Ahead of Malware IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,

More information

Botnets: The Advanced Malware Threat in Kenya's Cyberspace

Botnets: The Advanced Malware Threat in Kenya's Cyberspace Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)

More information

Deploying IPv6, Now. Christian Huitema. Architect Windows Networking & Communications Microsoft Corporation

Deploying IPv6, Now. Christian Huitema. Architect Windows Networking & Communications Microsoft Corporation Deploying IPv6, Now Christian Huitema Architect Windows Networking & Communications Microsoft Corporation Agenda The Opportunity Key Problems The Promise of IPv6 What is Microsoft doing Call to Action

More information

ZeroAccess. James Wyke. SophosLabs UK

ZeroAccess. James Wyke. SophosLabs UK ZeroAccess James Wyke SophosLabs UK Abstract ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the most widespread threats in the current malware ecosystem. ZeroAccess ability

More information

F5 Silverline DDoS Protection Onboarding: Technical Note

F5 Silverline DDoS Protection Onboarding: Technical Note F5 Silverline DDoS Protection Onboarding: Technical Note F5 Silverline DDoS Protection onboarding F5 Networks is the first leading application services company to offer a single-vendor hybrid solution

More information

Cisco Advanced Services for Network Security

Cisco Advanced Services for Network Security Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs

More information

HoneyBOT User Guide A Windows based honeypot solution

HoneyBOT User Guide A Windows based honeypot solution HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3

More information

Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd

Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd Product Roadmap Symantec Endpoint Protection Suzanne Konvicka & Paul Murgatroyd Symantec Endpoint Protection Product Roadmap 1 Safe Harbor Disclaimer Any information regarding pre-release Symantec offerings,

More information

Managing Security Risks in Modern IT Networks

Managing Security Risks in Modern IT Networks Managing Security Risks in Modern IT Networks White Paper Table of Contents Executive summary... 3 Introduction: networks under siege... 3 How great is the problem?... 3 Spyware: a growing issue... 3 Feeling

More information

Rise of the Machines: An Internet-Wide Analysis of Web Bots in 2014

Rise of the Machines: An Internet-Wide Analysis of Web Bots in 2014 SESSION ID: SPO2-W04 Rise of the Machines: An Internet-Wide Analysis of Web Bots in 2014 John Summers VP, Security Products Akamai #RSAC The Akamai Intelligent Platform The Platform 167,000+ Servers 2,300+

More information

Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity

Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Computer Crime and Intellectual Property Section Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Albert Rees Computer Crime and Intellectual Property Section (CCIPS) Criminal Division,

More information

Cisco Collaboration with Microsoft Interoperability

Cisco Collaboration with Microsoft Interoperability Cisco Collaboration with Microsoft Interoperability Infrastructure Cheatsheet First Published: June 2016 Cisco Expressway X8.8 Cisco Unified Communications Manager 10.x or later Microsoft Lync Server 2010

More information

SIP, Security and Session Border Controllers

SIP, Security and Session Border Controllers SIP, Security and Session Border Controllers SIP, Security and Session Border Controllers Executive Summary Rolling out a public SIP service brings with it several security issues. Both users and Service

More information

TECHNICAL NOTE 01/2006 ENGRESS AND INGRESS FILTERING

TECHNICAL NOTE 01/2006 ENGRESS AND INGRESS FILTERING TECHNICAL NOTE 01/2006 ENGRESS AND INGRESS FILTERING 20 APRIL 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to

More information

Security A to Z the most important terms

Security A to Z the most important terms Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from

More information

Internet and Intranet Calling with Polycom PVX 8.0.1

Internet and Intranet Calling with Polycom PVX 8.0.1 Internet and Intranet Calling with Polycom PVX 8.0.1 An Application Note Polycom PVX is an advanced conferencing software application that delivers Polycom's premium quality audio, video, and content sharing

More information

Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1

Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1 Smart Tips Enabling WAN Load Balancing Overview Many small businesses today use broadband links such as DSL or Cable, favoring them over the traditional link such as T1/E1 or leased lines because of the

More information

VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT ISSUE 3 3RD QUARTER 2014

VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT ISSUE 3 3RD QUARTER 2014 VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT ISSUE 3 3RD QUARTER 2014 CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS 4 Mitigations by Attack Size 4 Mitigations by Industry 5

More information

CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION

CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION CYBER SCIENCE 2015 AN ANALYSIS OF NETWORK TRAFFIC CLASSIFICATION FOR BOTNET DETECTION MATIJA STEVANOVIC PhD Student JENS MYRUP PEDERSEN Associate Professor Department of Electronic Systems Aalborg University,

More information

ISB13 Web security deployment options - which is really best for you? Duncan Mills, Piero DePaoli, Stuart Jones

ISB13 Web security deployment options - which is really best for you? Duncan Mills, Piero DePaoli, Stuart Jones ISB13 Web security deployment options - which is really best for you? Duncan Mills, Piero DePaoli, Stuart Jones Web Security Deployment Options 1 1 The threat landscape 2 Why Symantec web security 3 Generic

More information

Deployment Guide July-2014 rev. a. Deploying Array Networks APV Series Application Delivery Controllers with Oracle WebLogic 12c

Deployment Guide July-2014 rev. a. Deploying Array Networks APV Series Application Delivery Controllers with Oracle WebLogic 12c Deployment Guide July-2014 rev. a Deploying Array Networks APV Series Application Delivery Controllers with Oracle WebLogic 12c Table of Contents 1 Introduction... 2 1.1 Array Networks APV Appliance...

More information

Korea s experience of massive DDoS attacks from Botnet

Korea s experience of massive DDoS attacks from Botnet Korea s experience of massive DDoS attacks from Botnet April 12, 2011 Heung Youl YOUM Ph.D. SoonChunHyang University, Korea President, KIISC, Korea Vice-chairman, ITU-T SG 17 1 Table of Contents Overview

More information

Malware B-Z: Inside the Threat From Blackhole to ZeroAccess

Malware B-Z: Inside the Threat From Blackhole to ZeroAccess Malware B-Z: Inside the Threat From Blackhole to ZeroAccess By Richard Wang, Manager, SophosLabs U.S. Over the last few years the volume of malware has grown dramatically, thanks mostly to automation and

More information

Best Practices for Running Symantec Endpoint Protection 12.1 on the Microsoft Azure Platform

Best Practices for Running Symantec Endpoint Protection 12.1 on the Microsoft Azure Platform TECHNICAL BRIEF: BEST PRACTICES GUIDE FOR RUNNING SEP ON.... AZURE.................................... Best Practices for Running Symantec Endpoint Protection 12.1 on the Microsoft Azure Platform Who should

More information

Storm Worm & Botnet Analysis

Storm Worm & Botnet Analysis Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing

More information

Securing the endpoint and your data

Securing the endpoint and your data #SymVisionEmea #SymVisionEmea Securing the endpoint and your data Piero DePaoli Sr. Director, Product Marketing Marcus Brownell Sr. Regional Product Manager Securing the Endpoint and Your Data 2 Safe harbor

More information

Multifaceted Approach to Understanding the Botnet Phenomenon

Multifaceted Approach to Understanding the Botnet Phenomenon Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic

More information

Guidance Regarding Skype and Other P2P VoIP Solutions

Guidance Regarding Skype and Other P2P VoIP Solutions Guidance Regarding Skype and Other P2P VoIP Solutions Ver. 1.1 June 2012 Guidance Regarding Skype and Other P2P VoIP Solutions Scope This paper relates to the use of peer-to-peer (P2P) VoIP protocols,

More information

Enabling Windows Management Instrumentation Guide

Enabling Windows Management Instrumentation Guide Enabling Windows Management Instrumentation Guide Enabling Windows Management Instrumentation Guide The software described in this book is furnished under a license agreement and may be used only in accordance

More information

Best Practices for Running Symantec Endpoint Protection 12.1 on Point-of- Sale Devices

Best Practices for Running Symantec Endpoint Protection 12.1 on Point-of- Sale Devices TECHNICAL BRIEF: BEST PRACTICES GUIDE FOR PROTECTING RETAIL....... POS.... SYSTEMS............................. Best Practices for Running Symantec Endpoint Protection 12.1 on Point-of- Sale Devices Who

More information

Seminar Computer Security

Seminar Computer Security Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example

More information

Extreme Security Threat Protection G2 - Intrusion Prevention Integrated security, visibility, and control for next- generation network protection

Extreme Security Threat Protection G2 - Intrusion Prevention Integrated security, visibility, and control for next- generation network protection DATA SHEET Extreme Security Threat Protection G2 - Intrusion Prevention Integrated security, visibility, and control for next- generation network protection HIGHLIGHTS Delivers superior zero-day threat

More information

WebSphere DataPower Release 3.8.1 DNS Enhancements

WebSphere DataPower Release 3.8.1 DNS Enhancements WebSphere DataPower Release 3.8.1 DNS Enhancements XA/XS/XI/XB/XM 2010 IBM Corporation WebSphere DataPower Release 3.8.1 DNS Enhancements 381DataPowerDNSEnhancement.ppt Page 1 of 6 DNS Enhancements Table

More information

Symantec Database Security and Audit 3100 Series Appliance. Getting Started Guide

Symantec Database Security and Audit 3100 Series Appliance. Getting Started Guide Symantec Database Security and Audit 3100 Series Appliance Getting Started Guide Symantec Database Security and Audit 3100 Series Getting Started Guide The software described in this book is furnished

More information

Detecting peer-to-peer botnets

Detecting peer-to-peer botnets Detecting peer-to-peer botnets Reinier Schoof & Ralph Koning System and Network Engineering University of Amsterdam mail: reinier.schoof@os3.nl, ralph.koning@os3.nl February 4, 2007 1 Introduction Spam,

More information

Network Intrusion Analysis (Hands-on)

Network Intrusion Analysis (Hands-on) Network Intrusion Analysis (Hands-on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect

More information

Enabling Remote Management of SQL Server Integration Services

Enabling Remote Management of SQL Server Integration Services Enabling Remote Management of SQL Server Integration Services Michael@SchmittDotNet.com www.schmittdotnet.com Version 1.0 10/14/2010 Copyright and Disclaimers This guide is for informational purposes only.

More information

Shellshock. Oz Elisyan & Maxim Zavodchik

Shellshock. Oz Elisyan & Maxim Zavodchik Shellshock By Oz Elisyan & Maxim Zavodchik INTRODUCTION Once a high profile vulnerability is released to the public, there will be a lot of people who will use the opportunity to take advantage on vulnerable

More information

Integrating MSS, SEP and NGFW to catch targeted APTs

Integrating MSS, SEP and NGFW to catch targeted APTs #SymVisionEmea #SymVisionEmea Integrating MSS, SEP and NGFW to catch targeted APTs Tom Davison Information Security Practice Manager, UK&I Antonio Forzieri EMEA Solution Lead, Cyber Security 2 Information

More information

FortiWeb 5.0, Web Application Firewall Course #251

FortiWeb 5.0, Web Application Firewall Course #251 FortiWeb 5.0, Web Application Firewall Course #251 Course Overview Through this 1-day instructor-led classroom or online virtual training, participants learn the basic configuration and administration

More information

Security Toolsets for ISP Defense

Security Toolsets for ISP Defense Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.

More information

PowerLink Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions

PowerLink Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions Find your network example: 1. Basic network with and 2 WAN lines - click here 2. Add a web server to the LAN - click here 3. Add a web,

More information

Dialogic Brooktrout SR140 Fax Software with Broadvox GO! SIP Trunking Service

Dialogic Brooktrout SR140 Fax Software with Broadvox GO! SIP Trunking Service Dialogic Brooktrout SR140 Fax Software with Broadvox GO! SIP Trunking Service December 2010 64-0600-23 www.dialogic.com Copyright and Legal Notice Copyright 2010 Dialogic Inc. All Rights Reserved. You

More information

Symantec Security Information Manager 4.8 Release Notes

Symantec Security Information Manager 4.8 Release Notes Symantec Security Information Manager 4.8 Release Notes Symantec Security Information Manager 4.8 Release Notes The software described in this book is furnished under a license agreement and may be used

More information

Dell One Identity Cloud Access Manager 8.0.1- How to Configure for High Availability

Dell One Identity Cloud Access Manager 8.0.1- How to Configure for High Availability Dell One Identity Cloud Access Manager 8.0.1- How to Configure for High Availability May 2015 Cloning the database Cloning the STS host Cloning the proxy host This guide describes how to extend a typical

More information

Parallels Plesk Panel. VPN Module for Parallels Plesk Panel 10 for Linux/Unix Administrator's Guide. Revision 1.0

Parallels Plesk Panel. VPN Module for Parallels Plesk Panel 10 for Linux/Unix Administrator's Guide. Revision 1.0 Parallels Plesk Panel VPN Module for Parallels Plesk Panel 10 for Linux/Unix Administrator's Guide Revision 1.0 Copyright Notice Parallels Holdings, Ltd. c/o Parallels International GMbH Vordergasse 49

More information

End to End Security do Endpoint ao Datacenter

End to End Security do Endpoint ao Datacenter do Endpoint ao Datacenter Piero DePaoli & Leandro Vicente Security Product Marketing & Systems Engineering 1 Agenda 1 Today s Threat Landscape 2 From Endpoint: Symantec Endpoint Protection 3 To Datacenter:

More information

The Coremelt Attack. Ahren Studer and Adrian Perrig. We ve Come to Rely on the Internet

The Coremelt Attack. Ahren Studer and Adrian Perrig. We ve Come to Rely on the Internet The Coremelt Attack Ahren Studer and Adrian Perrig 1 We ve Come to Rely on the Internet Critical for businesses Up to date market information for trading Access to online stores One minute down time =

More information

Skype network has three types of machines, all running the same software and treated equally:

Skype network has three types of machines, all running the same software and treated equally: What is Skype? Why is Skype so successful? Everybody knows! Skype is a P2P (peer-to-peer) Voice-Over-IP (VoIP) client founded by Niklas Zennström and Janus Friis also founders of the file sharing application

More information

ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy

ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to

More information

MailMarshal SMTP in a Load Balanced Array of Servers Technical White Paper September 29, 2003

MailMarshal SMTP in a Load Balanced Array of Servers Technical White Paper September 29, 2003 Contents Introduction... 1 Network Load Balancing... 2 Example Environment... 5 Microsoft Network Load Balancing (Configuration)... 6 Validating your NLB configuration... 13 MailMarshal Specific Configuration...

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks Security+ Guide to Network Security Fundamentals, Third Edition Chapter 2 Systems Threats and Risks Objectives Describe the different types of software-based attacks List types of hardware attacks Define

More information

Application Note: GateManager Internet requirement and port settings

Application Note: GateManager Internet requirement and port settings Application Note: GateManager Internet requirement and port settings Informational document regards GateManager Internet requirement. Who to read this document: This document is intended for the person

More information

VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT

VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT VOLUME 3, ISSUE 2 2ND QUARTER 2016 CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS: Q2 2016 4 DDoS Attacks Become More Sophisticated

More information

White Paper. Copyright 2012, Juniper Networks, Inc. 1

White Paper. Copyright 2012, Juniper Networks, Inc. 1 White Paper SRX Series as Gi/ Firewall for Mobile Network Infrastructure Protection Copyright 2012, Juniper Networks, Inc. 1 Table of Contents Executive Summary...3 Introduction...3 Overview of LTE (4G)

More information

Steelcape Product Overview and Functional Description

Steelcape Product Overview and Functional Description Steelcape Product Overview and Functional Description TABLE OF CONTENTS 1. General Overview 2. Applications/Uses 3. Key Features 4. Steelcape Components 5. Operations Overview: Typical Communications Session

More information

VMware View 5.0 and Horizon View 6.0 DEPLOYMENT GUIDE

VMware View 5.0 and Horizon View 6.0 DEPLOYMENT GUIDE VMware View 5.0 and Horizon View 6.0 DEPLOYMENT GUIDE Table of Contents 1 Introduction... 2 2 ACOS Deployment for VMware View... 2 3 Lab Presentation... 2 4 Configuration... 3 4.1 VMware View Administration

More information

What is VLAN Routing?

What is VLAN Routing? Application Note #38 February 2004 What is VLAN Routing? This Application Notes relates to the following Dell product(s): 6024 and 6024F 33xx Abstract Virtual LANs (VLANs) offer a method of dividing one

More information

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda

More information

Web Security Firewall Setup. Administrator Guide

Web Security Firewall Setup. Administrator Guide Web Security Firewall Setup Administrator Guide Web Security Firewall Setup Guide Documentation version: 1.0 Legal Notice Legal Notice Copyright 2013 Symantec Corporation. All rights reserved. Symantec,

More information

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL BOTNETS Douwe Leguit, Manager Knowledge Center GOVCERT.NL Agenda Bots: what is it What is its habitat How does it spread What are its habits Dutch cases Ongoing developments Visibility of malware vs malicious

More information

UP L13: Leveraging the full protection of SEP 12.1.x

UP L13: Leveraging the full protection of SEP 12.1.x UP L13: Leveraging the full protection of SEP 12.1.x Martial RICHARD Principal Field Enablement Manager Endpoint Security UP L13 1 Threat landscape (ISTR Vol.18 April 2013) http://www.symantec.com/threatreport/

More information

TDC s perspective on DDoS threats

TDC s perspective on DDoS threats TDC s perspective on DDoS threats DDoS Dagen Stockholm March 2013 Lars Højberg, Technical Security Manager, TDC TDC in Sweden TDC in the Nordics 9 300 employees (2012) Turnover: 26,1 billion DKK (2012)

More information

2014 Foley & Lardner LLP Attorney Advertising Prior results do not guarantee a similar outcome Models used are not clients but may be representative

2014 Foley & Lardner LLP Attorney Advertising Prior results do not guarantee a similar outcome Models used are not clients but may be representative 2014 Foley & Lardner LLP Attorney Advertising Prior results do not guarantee a similar outcome Models used are not clients but may be representative of clients 321 N. Clark Street, Suite 2800, Chicago,

More information

VALIDATING DDoS THREAT PROTECTION

VALIDATING DDoS THREAT PROTECTION VALIDATING DDoS THREAT PROTECTION Ensure your DDoS Solution Works in Real-World Conditions WHITE PAPER Executive Summary This white paper is for security and networking professionals who are looking to

More information

Symantec Managed Security Services The Power To Protect

Symantec Managed Security Services The Power To Protect Symantec Managed Security Services The Power To Protect Peter Sparkes Senior Director, Cyber Security Services Asia Pacific & Japan Symantec Managed Security Services Cyber Security Services 1 Expanding

More information

Southwest Arkansas Telephone Cooperative Network Management Practices

Southwest Arkansas Telephone Cooperative Network Management Practices Southwest Arkansas Telephone Cooperative Network Management Practices Page 1 of 11 Release Date 05/18/15 INTRODUCTION... 3 CORE NETWORK OVERVIEW... 3 DISTRIBUTION NETWORK OVERVIEW... 3 ACCESS NETWORK OVERVIEW...

More information

Strong Authentication for Juniper Networks

Strong Authentication for Juniper Networks Strong Authentication for Juniper Networks SSL VPN SSO and OWA with Powerful Authentication Management for Service Providers and Enterprises Authentication Service Delivery Made EASY Copyright Copyright

More information

NUIT Tech Talk. Peeking Behind the Curtain of Security. Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance

NUIT Tech Talk. Peeking Behind the Curtain of Security. Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance NUIT Tech Talk Peeking Behind the Curtain of Security Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance Definitions Malware: The Virus/Trojan software we ve all come

More information

Cyberoam Configuration Guide for VPNC Interoperability Testing using DES Encryption Algorithm

Cyberoam Configuration Guide for VPNC Interoperability Testing using DES Encryption Algorithm Cyberoam Configuration Guide for VPNC Interoperability Testing using DES Encryption Algorithm Document Version:2.0-12/07/2007 IMPORTANT NOTICE Elitecore has supplied this Information believing it to be

More information

Firewall Testing Methodology W H I T E P A P E R

Firewall Testing Methodology W H I T E P A P E R Firewall ing W H I T E P A P E R Introduction With the deployment of application-aware firewalls, UTMs, and DPI engines, the network is becoming more intelligent at the application level With this awareness

More information