Rogue DNS servers a case study
|
|
|
- Merry Chandler
- 8 years ago
- Views:
Transcription
1 Rogue DNS servers a case study Feike Hacquebord Forward Looking Threat Research, Trend Micro Cupertino, CA, USA feikehayo_hacquebord@trendmicro.com
2 Contents Introduction to DNS DNS Changer Trojans Rogue DNS servers A large rogue DNS network - replacing advertisements with DNS tricks - fraud with search engines - personal information leakage - installing a Trojan via update functions - click fraud with referral / affiliate programs The role of Esthost.com Reconstructing the zone file of the rogue DNS servers. Remedies Concluding remarks 2
3 Introduction to DNS Domain Name System servers translate domain names to IP addresses. This is essential for the internet to work. Most internet users automatically use DNS servers of their ISP. DNS has not been designed with security in mind. Internet users implicitly trust the DNS servers they use. What happens when DNS settings of internet users are silently changed to foreign DNS servers? 3
4 Rogue DNS servers Rogue DNS servers resolve certain domain names to malicious IP addresses. Victims of rogue DNS servers may be directed to malicious websites without them noticing it. The surfing habits of victims of rogue DNS servers may be monitored for a long time. This makes targeted attacks possible. 4
5 DNS Changer Trojans DNS Changer Trojans silently change DNS settings on the victim s computer to foreign DNS servers. An example are the fake Video Codec Trojans which are supposedly needed to view video content. Some websites install a unique DNS Changer Trojan for each victim (this was originally posted on a Unisog mailing list: ). 5
6 A typical website of a DNS Changer Trojan Professional looking websites attempt to lure internet users into installing a fake codec. 6
7 An EULA of a DNS Changer Trojan A License Agreement of a DNS Changer Trojan 7
8 Spreading rogue DNS settings Some of the DNS Changer Trojans attempt to modify DNS settings of routers by brute force password attacks. This means that once 1 client in a network is infected all other clients will be using rogue DNS servers once the Trojan is able to modify DNS settings on the router 8
9 Spreading rogue DNS settings (cont.) 9
10 Spreading rogue DNS settings (cont.) Some of the DNS Changer Trojans install a rogue DHCP server that will reply to DHCP requests of other clients in the same network that come online. These rogue DHCP servers propagate rogue DNS settings (DHCP is a protocol that assigns network parameters like DNS servers to clients in a network). 10
11 Spreading rogue DNS settings (cont.) So rogue DNS settings can spread in a network when only 1 client is infected. Result: Other clients in the same network are at great risk because of modified DNS settings. Clients might even get infected through (automatic) update functions of legitimate software that has been installed. 11
12 A large network of rogue DNS servers We found more than 1175 rogue DNS servers most of them hard coded in DNS changer Trojans. These rogue DNS servers exhibit the same kind of behavior. Rogue resolution of 14,000+ domains to 200+ IP addresses. Internet connectivity by Pilosoft (2005 -), Cernel (2007 -), Intercage ( ), UkrTeleGroup (2008). This network is stable and about 4 years old. Estimated number of victims ~ 4,000,000 Feb
13 Behavior of rogue DNS servers Most domain names get resolved correctly Non existent domain names got resolved Some domain names get resolved to foreign IP addresses These include domain names of: - search engines - advertising companies - popular dating sites - financial institutions - legitimate software - other malware and C&C servers 13
14 Targets of rogue DNS network Google, Yahoo, AOL, MSN, Live.com, Ask.com Google Ads, Doubleclick, AOL Advertising, yieldmanager.com, CCbill.com, Fastclick.net, Webpower.com, Alexa.com, digg.com Credit Suisse, Mortgage / insurance brokers Adobe flash Friendfinder Inc, UK Dating, All Music, musicload.de, Travel Channel, Travelocity, AV companies / Microsoft 14
15 Targets of rogue DNS network (Cont.) Pornography distributors (Penthouse, Hustler, porn.com + many many more) Domain names known for hosting C&C servers Domain names of rogue (fake) AV software Some domain parking FQDNs that host scripts 15
16 Stealth click fraud replacing ads CNN.com on January 5th 2009 with a Double Click ad related to a car 16
17 Stealth click fraud replacing ads (cont) CNN.com loaded by a DNS Changer victim on January 5th Double Click Ad is replaced by a Vimax pills Ad from a foreign server. 17
18 Stealth click fraud replacing ads (cont.) The rogue DNS servers can resolve any advertising domain name to a foreign IP address and let victims load ads from there. This is very hard to detect click fraud - no automated clicks - fraud happens outside the network of advertisers Negative impact: - loss of revenue - reputation damage 18
19 Hijacking search engine results We search for a hotel in San Francisco at Yahoo. 19
20 Hijacking search engine results (cont.) We get search results back. Then we click on a sponsored result. 20
21 Hijacking search engine results (cont.) We get redirected via a rogue version of rds.yahoo.com -> theft of traffic. 21
22 Hijacking search engine results (cont.) The rogue DNS servers target major search engines, like Google, Yahoo, MSN, AOL, Ask.com Example: a DNS Changer victim enters a search query into gets resolved normally by the rogue DNS servers; the victim gets back search results from Yahoo - When he clicks on a (sponsored) search results he gets redirected via rds.yahoo.com to the site found in the search results. This is all normal. BUT - rds.yahoo.com gets resolved to a foreign IP address (currently ). This foreign server may redirect the internet user to any site hijacking of (sponsored) search results. 22
23 Example of possible information theft August 2008 the rogue DNS network started to resolve and several British mortgage broker sites to a foreign IP address. This was for a relatively short period. However personal information might have been stolen during this period. Other finance related domain names got rogue resolution for a short period in February 2009: finance.yahoo.com, finance.google.com, 23
24 Example of Information theft (2007) Friendfinder accepted login data on two FQDNs and friendfinder.com was the login script of site The related rogue DNS servers resolved: friendfinder.com to IP (foreign) to IP (normal) IP parsed login data sent by victims to and redirected victims to with the login data -> leakage of personal information. Friendfinder claims to have ten millions of users. This problem has been fixed by Friendfinder in
25 Installing Trojans via update function Legitimate software frequently polls a website for updates. Updates might even be installed automatically. What happens when the domain name that hosts updates of legitimate software gets resolved to a foreign IP address? Instead of an update a Trojan might get installed. 25
26 Installing Trojans via update function (cont.) January 2009: attempts to abuse the update function of Adobe s flash: Rogue resolution: fpdownload2.macromedia.com. 600 IN xx A xx is hosting a Trojan called cab.our 26
27 Installing Trojans via update function (cont.) From a log file of the foreign spoofed Adobe site: ::fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab::/home/h osting/ /www/htdocs/files/fpdownload2.macromedia.com/cab.our::mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1;.NET CLR ; Media Center PC 5.0;.NET CLR ) ::fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab::/home/h osting/ /www/htdocs/files/fpdownload2.macromedia.com/cab.our::mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR ; SpamBlockerUtility 4.8.4;.NET CLR ) ::fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab::/home/ hosting/ /www/htdocs/files/fpdownload2.macromedia.com/cab.our::mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR ;.NET CLR ) 27
28 Referrer click fraud The rogue DNS servers use a vulnerability in the setup of some advertising companies. Some advertising companies accept clicks on several FQDNs The rogue DNS servers resolve one.foo.com to a foreign IP address and two.foo.com correctly. gets loaded from foreign IP address by a DNS Changer victim. This foreign IP address redirects to Domain two.foo.com gets resolved normally so the victim will load this URL from the real advertising company -> click fraud 28
29 Referrer click fraud (Cont.) Example (2009): Refer.ccbill.com gets resolved to foreign IP Refer2.ccbill.com gets resolved to IP (normal) A DNS Changer infected user will load the advertisement link " from foreign server This foreign server changes the PA tag and then redirects the victim to &HTML= As a result the wrong party will be paid for showing the advertisement. 29
30 Referrer click fraud (cont.) Details where PA tag of ccbill.com gets changed: * About to connect() to port 80 * Trying connected * Connected to ( ) port 80 > GET /cgi-bin/clicks.cgi?ca= &pa= &html= HTTP/1.1 > Host: refer.ccbill.com > < HTTP/ Found < Date: Mon, 05 Jan :..:.. GMT < Server: Apache/2.2.3 (Debian) PHP/ etch13 < X-Powered-By: PHP/ etch13 < Location: &HTML= < Content-Length: 0 < Connection: close < Content-Type: text/html; charset=utf-8 * Closing connection #0 30
31 Esthost.com and DNS Changers Esthost is an Estonian Webhosting company operating in the US using several names like Esthost, Estdomains, Cernel, Rovedigital, Internet Path Inc., Infradata, Esthost has been hosting DNS Changer Trojans, C&C servers, rogue DNS servers and backend servers of the rogue DNS network from , mainly in Intercage, Cernel and Pilosoft IP space. Is there more to say about the role of Esthost? 31
32 Esthost.com and DNS Changers (cont) The role of Esthost has been VERY suspicious. Some of the more interesting evidence: Numerous FQDNs in the Esthost.com zone file appeared to host crucial back end servers for the rogue DNS network (until Intercage went down in September 2008). Probable involvement of Esthost employees in the Mega Traffic Distribution (megatds.com) system that redirects DNS Changer victims. 32
33 Interesting FQDNs at Esthost.com dns-repos.esthost.com management system for rogue DNS network. dns1.esthost.com, dns2.esthost.com, dns3.esthost.com, dns52.esthost.com 52 backend servers for rogue DNS servers apdns1.esthost.com, apdns2.esthost.com, apdns3.esthost.com, apdns26.esthost.com 26 backend servers for rogue DNS servers testdns1.esthost.com, testdns2.esthost.com Confirmed rogue DNS servers. For testing purposes? testapdns1.esthost.com, testapdns2.esthost.com Confirmed rogue DNS servers. For testing purposes? codecsys.esthost.com, ucodecsys.esthost.com Backend systems of codec Trojan servers. megatds.esthost.com Mega Traffic System? Click fraud system? Related to 33
34 Interesting FQDNs at Esthost.com (cont.) banex1.esthost.com banex7.esthost.com banner exchange servers? These servers were (DNS) back ends for the spoofed version of pagead2.googlesyndication.com, media.fastclick.net, a.tribalfusion.com, xgallery1.esthost.com xgallery10.esthost.com (DNS) back end servers for porn leading to Zlob. + more Who controlled the zone file of Esthost.com? 34
35 Intercage went offline what happened? Saturday, September , Intercage went offline. What happened with the rogue DNS network? (out 1178) rogue DNS servers went down - most of the 14,000+ rogue resolutions disappeared However from Monday, September onwards rogue versions of major search engines moved to /24. January 2009: the spoofed websites of advertising companies, porn distributors etc are spread over several IP addresses of multiple webhosting companies. Estimated number of DNS Changer victims: ~ 4,000,000 (February 2009). 35
36 Reconstructing the rogue DNS zone file The zone file of the rogue DNS servers can be reconstructed by: passive DNS data (look for DNS mismatches / discrepancies) resolving numerous domain names with the rogue DNS servers We found 14,000+ rogue resolutions Contact me for details. 36
37 Remedies for ISPs ISPs can protect their internet users by Dropping DNS queries to known rogue DNS servers Detecting DNS queries to foreign DNS servers on the gateway Forcing their customers to use the DNS servers of the ISP, much like forcing outgoing to be relayed through the mail servers of the ISP. 37
38 Conclusion Rogue DNS servers are a major threat. They may be used for: Click fraud Theft of personal information Targeted attacks Installing Trojans The Zlob related rogue DNS network is very large (1100+ rogue DNS servers) well connected to the internet Very stable and about 4 years old the bad guys must make a lot of revenue here There is evidence that Esthost is part of the rogue DNS gang ISPs can protect their users by blocking DNS queries to rogue servers forcing their users to use the DNS servers of the ISPs 38
39 Thank You 39
A Cybercrime Hub. Trend Micro Threat Research. Trend Micro, Incorporated. A Trend Micro White Paper I August 2009
Trend Micro, Incorporated Trend Micro Threat Research A Trend Micro White Paper I August 2009 TABLE OF CONTENTS INTRODUCTION...3 THE CYBERCRIME COMPANY...4 ROGUE DNS SERVERS...5 INTRANET OF CYBERCRIME...6
MALICIOUS REDIRECTION A Look at DNS-Changing Malware
MALICIOUS REDIRECTION A Look at DNS-Changing Malware What are Domain Naming System (DNS)-changing malware? These recently garnered a lot of attention due to the recent Esthost takedown that involved a
Step-by-Step Configuration
Step-by-Step Configuration Kerio Technologies Kerio Technologies. All Rights Reserved. Printing Date: August 15, 2007 This guide provides detailed description on configuration of the local network which
What Does DNSChanger Do to My Computer? Am I Infected?
DNSChanger Malware DNS (Domain Name System) is an Internet service that converts user-friendly domain names into the numerical Internet protocol (IP) addresses that computers use to talk to each other.
INFORMATION SECURITY REVIEW
INFORMATION SECURITY REVIEW 14.10.2008 CERT-FI Information Security Review 3/2008 In the summer, information about a vulnerability in the internet domain name service (DNS) was released. If left unpatched,
DNS Changer Remediation Study
DNS Changer Remediation Study The following study was presented by Georgia Tech researchers at the M 3 AAWG 27 th General Meeting February 19, 2013, San Francisco M 3 AAWG Messaging, Malware and Mobile
Phishing Activity Trends
Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection
The Dark Side of Trusting Web Searches From Blackhat SEO to System Infection Trend Micro, Incorporated Marco Dela Vega and Norman Ingal Threat Response Engineers A Trend Micro Research Paper I November
SECURING INFORMATION SYSTEMS
SECURING INFORMATION SYSTEMS (November 9, 2015) BUS3500 - Abdou Illia - Fall 2015 1 LEARNING GOALS Understand security attacks preps Discuss the major threats to information systems. Discuss protection
(606) 785-3450 Knott County (606) 439-3167 Perry County (606) 633-0778 Letcher County. support@tvscable.com
TVS CableNet Technical Support Guide Effective August 15, 2006 All materials 2006 TV Service, Inc. This material may not be reproduced in any form except for personal private use by TV Service Cable Internet
Current counter-measures and responses by CERTs
Current counter-measures and responses by CERTs Jeong, Hyun Cheol hcjung@kisa.or.kr April. 2007 Contents I. Malware Trends in Korea II. Malware from compromised Web sites III. Case Study : Malware countermeasure
Phishing Activity Trends Report June, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
DDoS Attacks: The Latest Threat to Availability. Dr. Bill Highleyman Managing Editor Availability Digest
DDoS Attacks: The Latest Threat to Availability Dr. Bill Highleyman Managing Editor Availability Digest The Anatomy of a DDoS Attack Sombers Associates, Inc. 2013 2 What is a Distributed Denial of Service
User Documentation Web Traffic Security. University of Stavanger
User Documentation Web Traffic Security University of Stavanger Table of content User Documentation... 1 Web Traffic Security... 1 University of Stavanger... 1 UiS Web Traffic Security... 3 Background...
Practical tips for a. Safe Christmas
Practical tips for a Safe Christmas CONTENTS 1. Online shopping 2 2. Online games 4 3. Instant messaging and mail 5 4. Practical tips for a safe digital Christmas 6 The Christmas holidays normally see
The Underground Economy of the Pay-Per-Install (PPI) Business
The Underground Economy of the Pay-Per-Install (PPI) Business Kevin Stevens, Security Researcher SecureWorks Counter Threat Unit (CTU) History of the PPI Business The Pay-Per-Install business model (PPI)
Threat Events: Software Attacks (cont.)
ROOTKIT stealthy software with root/administrator privileges aims to modify the operation of the OS in order to facilitate a nonstandard or unauthorized functions unlike virus, rootkit s goal is not to
Get Started Guide - PC Tools Internet Security
Get Started Guide - PC Tools Internet Security Table of Contents PC Tools Internet Security... 1 Getting Started with PC Tools Internet Security... 1 Installing... 1 Getting Started... 2 iii PC Tools
Countermeasures against Bots
Countermeasures against Bots Are you sure your computer is not infected with Bot? Information-technology Promotion Agency IT Security Center http://www.ipa.go.jp/security/ 1. What is a Bot? Bot is a computer
Insecurity breeds at home
Insecurity breeds at home - Vulnerabilities in SOHO routers Amrita Center for Cyber Security Amrita University Small Office Home Office(SOHO) Routers 2 Problem at hand No technology available to detect/prevent
Phishing Activity Trends Report for the Month of December, 2007
Phishing Activity Trends Report for the Month of December, 2007 Summarization of December Report Findings The total number of unique phishing reports submitted to APWG in December 2007 was 25,683, a decrease
Device Log Export ENGLISH
Figure 14: Topic Selection Page Device Log Export This option allows you to export device logs in three ways: by E-Mail, FTP, or HTTP. Each method is described in the following sections. NOTE: If the E-Mail,
DNS POISONING, AKA PHARMING, MAKES THE HEADLINES IN NOVEMBER S NEWS
DNS POISONING, AKA PHARMING, MAKES THE HEADLINES IN NOVEMBER S NEWS December 2011 November saw DNS Poisoning, aka Pharming, making the headlines on more than one occasion: To name a few, the online threat
Network Configuration Settings
Network Configuration Settings Many small businesses already have an existing firewall device for their local network when they purchase Microsoft Windows Small Business Server 2003. Often, these devices
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY EXPLOIT KITS UP 75 PERCENT The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent
Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013
Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a
The Police Trojan AN IN-DEPTH ANALYSIS
Trend Micro Research Paper 2012 The Police Trojan AN IN-DEPTH ANALYSIS By: David Sancho and Feike Hacquebord CONTENTS Introduction... 1 Technical Analysis... 1 Technical Findings... 4 Network Analysis...
WHITE PAPER. Using DNS RPZ to Protect Against Web Threats SPON. Published June 2015 SPONSORED BY. An Osterman Research White Paper.
WHITE PAPER Using DNS RPZ to Protect An Osterman Research White Paper Published June 2015 SPONSORED BY SPON sponsored by sponsored by Osterman Research, Inc. P.O. Box 1058 Black Diamond, Washington 98010-1058
Victimless Malware How Blackhats Make a Killing Targeting Companies
Victimless Malware How Blackhats Make a Killing Targeting Companies Lou Manousos RiskIQ Session ID: HT2-401 Session Classification: Intermediate Serendipity Simple Browser Tricks, Hacks and Kits Large
Web Security Threat Report: January April 2007. Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots
Web Security Threat Report: January April 2007 Ryan C. Barnett WASC Member Project Lead: Distributed Open Proxy Honeypots What are we reporting? We are presenting real, live web attack data captured in-the-wild.
January 2011 Report #49. The following trends are highlighted in the January 2011 report:
January 2011 Report #49 Spam made up 81.69% of all messages in December, compared with 84.31% in November. The consistent drop in spam made us wonder, did spammers take a holiday break? Global spam volume
Different Types of Adware and Services
TABLE OF CONTENTS Adware... 2 Ad Server... 2 Backbone... 2 Backdoor... 2 Browser Hijacker... 2 Cookie... 2 Denial Of Service (Dos)... 3 Dialer... 3 Dumpster Diving... 3 E-Mail Harvester... 3 Encryption...
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
LAN TCP/IP and DHCP Setup
CHAPTER 2 LAN TCP/IP and DHCP Setup 2.1 Introduction In this chapter, we will explain in more detail the LAN TCP/IP and DHCP Setup. 2.2 LAN IP Network Configuration In the Vigor 2900 router, there are
Phishing Activity Trends Report. 1 st Half 2009. Committed to Wiping Out Internet Scams and Fraud
1 st Half 2009 Committed to Wiping Out Internet Scams and Fraud January June 2009 Phishing Report Scope The quarterly APWG analyzes phishing attacks reported to the APWG by its member companies, its Global
Installation Guide For ChoiceMail Enterprise Edition
Installation Guide For ChoiceMail Enterprise Edition How to Install ChoiceMail Enterprise On A Server In Front Of Your Company Mail Server August, 2004 Version 2.6x Copyright DigiPortal Software, 2002-2004
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for
Phishing Scams Security Update Best Practices for General User
Phishing Scams Security Update Best Practices for General User hishing refers to the malicious attack Pmethod by attackers who imitate legitimate companies in sending emails in order to entice people to
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
Chapter 1 Configuring Basic Connectivity
Chapter 1 Configuring Basic Connectivity This chapter describes the settings for your Internet connection and your wireless local area network (LAN) connection. When you perform the initial configuration
2010 Carnegie Mellon University. Malware and Malicious Traffic
Malware and Malicious Traffic What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working
DDoS Attacks Can Take Down Your Online Services
DDoS Attacks Can Take Down Your Online Services Dr. Bill Highleyman Managing Editor, Availability Digest Continuity Insights New York 2014 October 8, 2014 editor@availabilitydigest.com Who Am I? Dr. Bill
Network Setup Guide. 1 Glossary. 2 Operation. 1.1 Static IP. 1.2 Point-to-Point Protocol over Ethernet (PPPoE)
Network Setup Guide 1 Glossary 1.1 Static IP Computers are communicated and recognized by their own unique IP addresses over the Internet. Static IP provided by your ISP (Internet Service Provider) means
A Case Study in Malvertisement
A Case Study in Malvertisement The Shadowserver Foundation Kayne Naughton Drive-By Infections Been around for a long time now Criminals answer to personal firewalls Much bigger attack surface PDFs Java
NETWORK SETUP GLOSSARY
GLOSSARY NETWORK SETUP Static IP PPPoE DHCP DDNS Static IP Computers are communicated and recognized by their own unique IP addresses over the Internet. Static IP provided by your ISP (Internet Service
How To Hack A Legitimate Website With A Phishing Attack
Bad Cocktail Spear Phishing + Application Hacks OWASP Chicago August 2008 Spear Phishing Is A Problem > 15,000 corporate victims in 15 months Victim Losses have exceeded $100,000 Recent Victims Salesforce.com
Savvius Insight Initial Configuration
The configuration utility on Savvius Insight lets you configure device, network, and time settings. Additionally, if you are forwarding your data from Savvius Insight to a Splunk server, You can configure
Essentials of PC Security: Central Library Tech Center Evansville Vanderburgh Public Library
Essentials of PC Security: Central Library Tech Center Evansville Vanderburgh Public Library Why should you be concerned? There are over 1 million known computer viruses. An unprotected computer on the
About Botnet, and the influence that Botnet gives to broadband ISP
About net, and the influence that net gives to broadband ISP Masaru AKAI BB Technology / SBB-SIRT Agenda Who are we? What is net? About Telecom-ISAC-Japan Analyzing code How does net work? BB Technology
ModusMail Software Instructions.
ModusMail Software Instructions. Table of Contents Basic Quarantine Report Information. 2 Starting A WebMail Session. 3 WebMail Interface. 4 WebMail Setting overview (See Settings Interface).. 5 Account
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
CSE 3482 Introduction to Computer Security. Denial of Service (DoS) Attacks
CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic
Transferring Your Internet Services
Page 1 of 6 Transferring Your Internet Services Below you will find the instructions necessary to move your web hosting, email, and DNS services to NuVox. The Basics Transferring your domain name Preparing
Web. Paul Pajares and Max Goncharov. Connection. Edition. ios platform are also at risk, as. numbers via browser-based social.
RESEARCHBRIEF Fake Apps, Russia, and the Mobile Making the SMSS Fraud Connection Paul Pajares and Max Goncharov Web News of an SMS fraud service affecting many countries first broke out in Russia in 2010.
Basic Vulnerability Issues for SIP Security
Introduction Basic Vulnerability Issues for SIP Security By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com The Session Initiation Protocol (SIP) is the future
How to Identify Phishing E-Mails
How to Identify Phishing E-Mails How to recognize fraudulent emails and avoid being phished. Presented by : Miguel Fra, Falcon IT Services (miguel@falconitservices.com) http://www.falconitservices.com
Symantec Database Security and Audit 3100 Series Appliance. Getting Started Guide
Symantec Database Security and Audit 3100 Series Appliance Getting Started Guide Symantec Database Security and Audit 3100 Series Getting Started Guide The software described in this book is furnished
BotNets- Cyber Torrirism
BotNets- Cyber Torrirism Battling the threats of internet Assoc. Prof. Dr. Sureswaran Ramadass National Advanced IPv6 Center - Director Why Talk About Botnets? Because Bot Statistics Suggest Assimilation
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
VIDEO Intypedia013en LESSON 13: DNS SECURITY. AUTHOR: Javier Osuna García-Malo de Molina. GMV Head of Security and Process Consulting Division
VIDEO Intypedia013en LESSON 13: DNS SECURITY AUTHOR: Javier Osuna García-Malo de Molina GMV Head of Security and Process Consulting Division Welcome to Intypedia. In this lesson we will study the DNS domain
Using TestLogServer for Web Security Troubleshooting
Using TestLogServer for Web Security Troubleshooting Topic 50330 TestLogServer Web Security Solutions Version 7.7, Updated 19-Sept- 2013 A command-line utility called TestLogServer is included as part
Kaseya Server Instal ation User Guide June 6, 2008
Kaseya Server Installation User Guide June 6, 2008 About Kaseya Kaseya is a global provider of IT automation software for IT Solution Providers and Public and Private Sector IT organizations. Kaseya's
EITC Lessons Learned: Building Our Internal Security Intelligence Capability
EITC Lessons Learned: Building Our Internal Security Intelligence Capability SESSION ID: SEC-W08 Tamer El Refaey Senior Director, Security Monitoring and Operations Emirates Integrated Telecommunications
NATIONAL CREDIT UNION ADMINISTRATION 1775 Duke Street, Alexandria, VA 22314
NATIONAL CREDIT UNION ADMINISTRATION 1775 Duke Street, Alexandria, VA 22314 DATE: December 2002 LETTER NO.: 02-CU-16 TO: All Federally-Insured Credit Unions SUBJ: Protection of Credit Union Internet Addresses
ZyWALL USG ZLD 3.0 Support Notes
2012 ZyWALL USG ZLD 3.0 Support Notes CSO ZyXEL 2/1/2012 Scenario 1 - Reserving Highest Bandwidth Management Priority for VoIP Traffic 1.1 Application scenario In an enterprise network, there are various
NETWORK SETUP INSTRUCTIONS
NETWORK SETUP INSTRUCTIONS How to Connect AVTECH Product to Internet To connect AVTECH DVR or network camera to Internet, you need to: 1). Figure out your network environment, and have related IP information
Protecting the Infrastructure: Symantec Web Gateway
Protecting the Infrastructure: Symantec Web Gateway 1 Why Symantec for Web Security? Flexibility and Choice Best in class hosted service, appliance, and virtual appliance (upcoming) deployment options
NETWORK SET UP GUIDE FOR
NETWORK SET UP GUIDE FOR USZ11ZS USX21ZS USX31ZAND DVRX16D DVRX32D HDDX13D SUPPORTING ROUTER D-Link Linksys NETGEAR BELKI IP Addresses on the Internet When you connect to the Internet, through dialup connection,
Network Security Workshop
Network Security Workshop Threat Pragmatics Fakrul (Pappu) Alam bdhub Limited fakrul@bdhub.com Targets Many sorts of targets: Network infrastructure Network services Application services User machines
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz
Internet Banking Attacks Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Contents Agenda Internet banking today The most common attack vectors The possible countermeasures What protection
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis?
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis? This paper presents a scenario in which an attacker attempts to hack into the internal network
PURPLE PAPER EXEGESIS OF VIRTUAL HOSTS HACKING BY PETKO PETKOV AND PAGVAC (ADRIAN PASTOR)
PURPLE PAPER EXEGESIS OF VIRTUAL HOSTS HACKING BY PETKO PETKOV AND PAGVAC (ADRIAN PASTOR) VIRTUAL HOST ENUMERATION TECHNIQUES There is a lot that we can say about finding virtual hosts from a given IP
1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained
home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:
PROTECT YOUR COMPUTER AND YOUR PRIVACY!
PROTECT YOUR COMPUTER AND YOUR PRIVACY! Fraud comes in many shapes simple: the loss of both money protecting your computer and Take action and get peace of and sizes, but the outcome is and time. That
INSTANT MESSAGING SECURITY
INSTANT MESSAGING SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part
Bypassing Security Toolbars and Phishing Filters via DNS Poisoning
Bypassing Security Toolbars and Phishing Filters via DNS Poisoning Saeed Abu-Nimeh and Suku Nair SMU HACNet Lab Computer Science and Engineering Dept. Southern Methodist University Dallas, TX 75275 {sabunime,
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Anti-Phishing Best Practices for ISPs and Mailbox Providers
Anti-Phishing Best Practices for ISPs and Mailbox Providers Version 2.01, June 2015 A document jointly produced by the Messaging, Malware and Mobile Anti-Abuse Working Group (M 3 AAWG) and the Anti-Phishing
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
Internet Technologies. World Wide Web (WWW) Proxy Server Network Address Translator (NAT)
Internet Technologies World Wide Web (WWW) Proxy Server Network Address Translator (NAT) What is WWW? System of interlinked Hypertext documents Text, Images, Videos, and other multimedia documents navigate
LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains
LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way
Your Guide to Email Security
Your Guide to Email Security Protect your Information Email is a powerful way to connect with people. Unfortunately it also makes us vulnerable targets of scammers that can affect us from thousands of
The State of Spam A Monthly Report August 2008. Generated by Symantec Messaging and Web Security
The State of Spam A Monthly Report August 2008 Generated by Symantec Messaging and Web Security Doug Bowers Executive Editor Antispam Engineering Dermot Harnett Editor Antispam Engineering Joseph Long
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Content Distribution Networks (CDN)
229 Content Distribution Networks (CDNs) A content distribution network can be viewed as a global web replication. main idea: each replica is located in a different geographic area, rather then in the
Payment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Security Scanning Procedures Version 1.1 Release: September 2006 Table of Contents Purpose...1 Introduction...1 Scope of PCI Security Scanning...1 Scanning
ES ET DE LA VIE PRIVÉE E 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS
ES ET DE LA VIE PRIVÉE E 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISS The Internet Threat Landscape Symantec TM Dean Turner Director Global Intelligence Network Symantec Security
Guideline for Prevention of Spyware and other Potentially Unwanted Software
Guideline for Prevention of Spyware and other Potentially Unwanted Software Introduction Most users are aware of the impact of virus/worm and therefore they have taken measures to protect their computers,
The current case DNSChanger what computer users can do now
The current case DNSChanger what computer users can do now Content What happened so far? 2 What is going to happen on 8 March 2012? 2 How can I test my Internet settings? 2 On the PC 3 On the router 5
What do a banking Trojan, Chrome and a government mail server have in common? Analysis of a piece of Brazilian malware
What do a banking Trojan, Chrome and a government mail server have in common? Analysis of a piece of Brazilian malware Contents Introduction.................................2 Installation: Social engineering
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
Table of Contents. Chapter 1: Installing Endpoint Application Control. Chapter 2: Getting Support. Index
Table of Contents Chapter 1: Installing Endpoint Application Control System Requirements... 1-2 Installation Flow... 1-2 Required Components... 1-3 Welcome... 1-4 License Agreement... 1-5 Proxy Server...
Domain Name Abuse Detection. Liming Wang
Domain Name Abuse Detection Liming Wang Outline 1 Domain Name Abuse Work Overview 2 Anti-phishing Research Work 3 Chinese Domain Similarity Detection 4 Other Abuse detection ti 5 System Information 2 Why?
OfficeConnect Internet Firewall 25 Internet Firewall DMZ. QuickStart Guide (3C16770, 3C16771)
OfficeConnect Internet Firewall 25 Internet Firewall DMZ QuickStart Guide (3C16770, 3C16771) Checking Package Contents Getting Started Thank you for purchasing the OfficeConnect Internet Firewall. The
Lesson 13: DNS Security. Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division
Lesson 13: DNS Security Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division Introduction to DNS The DNS enables people to use and surf the Internet, allowing the translation