Security Incidents And Trends In Croatia. Domagoj Klasić

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Security Incidents And Trends In Croatia. Domagoj Klasić dklasic@cert.hr"

Transcription

1 Security Incidents And Trends In Croatia Domagoj Klasić

2 Croatian National CERT About us Founded in in accordance with the Information Security Act We are a department of the Croatian Academic and Research Network (CARNet) Promotion and preservation of the information security of the public information systems in Croatia.

3 Few Words about CARNet Government institution, ISP (second largest in Croatia) It supports educational institutions in Croatia (elementary schools, high schools, universities, institutes ) Offers more than 100 e-learning services Has 2 national services:.hr TLD Authority National CERT (That s us)

4 NCERT About us Our activities Following computer-security news and dissemination of information Promoting the awareness of importance of computer security Educational training for specific groups Coordination in solving incidents that include at least one side in Croatia We don t do Troubleshooting and technical support Punishing of problematic users Criminal prosecution and investigations Arbitration in disputes

5 Security incidents in Croatia Starting with general statistics 343 Number of processed incidents in the last year 0,93 Incidents per day, in practice more than one per day (we don t work weekends) Keep in mind We can only count incidents reported to us Incidents are for servers with static IPs

6 Incident trend in Croatia Monthly trend: to

7 What kind of incidents are we talking about? Distribution by incident type OKR = Other Compromised hosts NMA = Illicit network activities Ostali incidenti = Other incidents

8 What are these incidents? Malware URL URL that distribute malware Redirects to exploit kits Rarely: web shells, spam scripts, ddos scripts Phishing URL Classical phishing pages, mostly for foreign financial institutions (banks, paypal )

9 What are these incidents? Other compromised hosts Compromised hosts that don t belong in Malware or Phishing URL category Mostly web site defacements Sometimes drop zones or information theft Total number of compromised hosts = Malware URL + Phishing ULR + Other compromised hosts = 289

10 What kind of hosts are these? Most of these hosts are shared hosting servers hosted at Croatian hosting companies They are compromised using known bugs in popular CMS systems (Wordpress, Joomla ) Mass compromise Sometimes servers are rooted Sometimes server are from companies other than hosting providers

11 Other incidents Only a few DDoS attacks but some of them got a lot of media attention: Attack on the web site of the Office of the President

12 Other incidents There were a few C&C servers for different botnets in Croatia Interesting one was for a Zeus botnet. We analyzed it and it turns out it was just a proxy It was not a compromised host, but a purchased VPS server from one of our hosting providers

13 Botnets trend National CERT is keeping a track of discovered bots in Croatia Exact IP addresses of bots are forwarded to their ISP providers National CERT keeps a statistical data of all discovered bots

14 Bots trend Registrated bots (daily trend) November 2011 September 2012

15 Bots trend Registrated bots (monthly trend) November 2011 September 2012

16 Bots trends Most popular malware are: Conficker (downadup) Sality Grum There are even a few flashback trojans

17 Flashback Flashback trojan (daily trend) November 2011 September 2012

18 Spam National CERT is trying to analyze spam messages that are being distributed in Croatian Internet space We have built our own spamtrap We are catching and analysing spam We can get some statistical data about the spam

19 Spam stats by spamtrap (January 2012 Sptember 2012) Total number of spams received 195,4 Spams per day 209 Spams sent from Croatian servers 4374 Spams in Croatian language

20 Spam trend by spamtrap (January 2012 Sptember 2012) Daily trend in number of received spam messages

21 Spams Most of the spams are just commercials There are some more serious spams that contain malicious links All of these spams where not targeted towards Croatian users With the help of automatic analysis we can recognize some interesting trends, for example

22 Do spammers work on weekends? Weekday distribution of received spam messages

23 Malware campaigns Daily trend of spam with malicious links June 21 and Jun 25, unusual high number

24 June 21 and June 26

25 Spam We are always looking to expand our spamtrap If you own or administer a web site and would like to help us, contact me after presentation or send us a mail at

26 The End Thank you for listening Questions?

Using big data analytics to identify malicious content: a case study on spam emails

Using big data analytics to identify malicious content: a case study on spam emails Using big data analytics to identify malicious content: a case study on spam emails Mamoun Alazab & Roderic Broadhurst Mamoun.alazab@anu.edu.au http://cybercrime.anu.edu.au 2 Outline Background Cybercrime

More information

Cyber Security and Critical Information Infrastructure

Cyber Security and Critical Information Infrastructure Cyber Security and Critical Information Infrastructure Dr. Gulshan Rai Director General Indian Computer Emergency Response Team (CERT- In) grai [at] cert-in.org.in The Complexity of Today s Network Changes

More information

TECHNICAL REPORT. An Analysis of Domain Silver, Inc..pl Domains

TECHNICAL REPORT. An Analysis of Domain Silver, Inc..pl Domains TECHNICAL REPORT An Analysis of Domain Silver, Inc..pl Domains July 31, 2013 CONTENTS Contents 1 Introduction 2 2 Registry, registrar and registrant 3 2.1 Rogue registrar..................................

More information

Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)

Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology

More information

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL

BOTNETS. Douwe Leguit, Manager Knowledge Center GOVCERT.NL BOTNETS Douwe Leguit, Manager Knowledge Center GOVCERT.NL Agenda Bots: what is it What is its habitat How does it spread What are its habits Dutch cases Ongoing developments Visibility of malware vs malicious

More information

Report on Cyber Security Alerts Processed by CERT-RO in 2014

Report on Cyber Security Alerts Processed by CERT-RO in 2014 Section III - Cyber-Attacks Evolution and Cybercrime Trends Report on Cyber Security Alerts Processed by CERT-RO in 2014 Romanian National Computer Security Incident Response Team office@cert-ro.eu The

More information

About Botnet, and the influence that Botnet gives to broadband ISP

About Botnet, and the influence that Botnet gives to broadband ISP About net, and the influence that net gives to broadband ISP Masaru AKAI BB Technology / SBB-SIRT Agenda Who are we? What is net? About Telecom-ISAC-Japan Analyzing code How does net work? BB Technology

More information

Challenges and Best Practices in Fighting Financial Fraud in Brazil

Challenges and Best Practices in Fighting Financial Fraud in Brazil Challenges and Best Practices in Fighting Financial Fraud in Brazil Cristine Hoepers cristine@cert.br CERT.br Computer Emergency Response Team Brazil NIC.br - Network Information Center Brazil CGI.br -

More information

Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000

Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000 Information Technology Information and Systems Security/Compliance Northwestern University 1800 Sherman Av Suite 209 Evanston, IL 60201 Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000

More information

Information Security Threat Trends

Information Security Threat Trends Talk @ Microsoft Security Day Sep 2005 Information Security Threat Trends Mr. S.C. Leung 梁 兆 昌 Senior Consultant 高 級 顧 問 CISSP CISA CBCP M@PISA Email: scleung@hkcert.org 香 港 電 腦 保 安 事 故 協 調 中 心 Introducing

More information

ReadySpace Limited Unit J, 16/F Reason Group Tower, 403-413 Castle PeakRoad, Kwai Chung, N.T.

ReadySpace Limited Unit J, 16/F Reason Group Tower, 403-413 Castle PeakRoad, Kwai Chung, N.T. Reputation and Blacklist Monitoring Basic Professional Business Enterprise Reputation Monitoring Blacklist Monitoring Standard Malware Detection Scan for known Malware Scan for known viruses All pages

More information

Security from the Cloud

Security from the Cloud Security from the Cloud Remote Vulnerability Scanning Writer: Peter Technical Review: David Contact: info@hackertarget.com Published: April 2008 Summary: This white paper describes advantages of using

More information

Current counter-measures and responses by CERTs

Current counter-measures and responses by CERTs Current counter-measures and responses by CERTs Jeong, Hyun Cheol hcjung@kisa.or.kr April. 2007 Contents I. Malware Trends in Korea II. Malware from compromised Web sites III. Case Study : Malware countermeasure

More information

Cyber Security & Role of CERT-In. Dr. Gulshan Rai Director General, CERT-IN Govt. of India grai@mit.gov.in

Cyber Security & Role of CERT-In. Dr. Gulshan Rai Director General, CERT-IN Govt. of India grai@mit.gov.in Cyber Security & Role of CERT-In Dr. Gulshan Rai Director General, CERT-IN Govt. of India grai@mit.gov.in Web Evolution Web Sites (WWW) 1993 Web Invented and implemented 130 Nos. web sites 1994 2738 Nos.

More information

REPORT on the cyber security alerts received by CERT-RO during 2013

REPORT on the cyber security alerts received by CERT-RO during 2013 ROMANIAN NATIONAL COMPUTER SECURITY INCIDENT RESPONSE TEAM REPORT on the cyber security alerts received by CERT-RO during 2013 http://www.cert-ro.eu - Blank page 2 / 21 CONTENTS 1. Summary of the report...

More information

Cross Site Scripting in Joomla Acajoom Component

Cross Site Scripting in Joomla Acajoom Component Whitepaper Cross Site Scripting in Joomla Acajoom Component Vandan Joshi December 2011 TABLE OF CONTENTS Abstract... 3 Introduction... 3 A Likely Scenario... 5 The Exploit... 9 The Impact... 12 Recommended

More information

Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms

Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.

More information

The anatomy of an online banking fraud

The anatomy of an online banking fraud The anatomy of an online banking fraud or: Harvesting bank account data By Valentin Höbel. Mail to valentin@xenuser.org (March2010) I. What this document is about II. Introduction III. The anatomy of an

More information

D m i t r y S l i n k o v, C I S M SWISS C Y B E R S TO R M 2015. Black market of cybercrime in Russia

D m i t r y S l i n k o v, C I S M SWISS C Y B E R S TO R M 2015. Black market of cybercrime in Russia D m i t r y S l i n k o v, C I S M SWISS C Y B E R S TO R M 2015 Black market of cybercrime in Russia WHOAMI Information Security Manager (Russia and CIS) Information Security Officer Information Security

More information

Response to the OFTA Consultation Paper, Proposal to Contain the Problem of Unsolicited Electronic Messages

Response to the OFTA Consultation Paper, Proposal to Contain the Problem of Unsolicited Electronic Messages Response to the OFTA Consultation Paper, Proposal to Contain the Problem of Unsolicited Electronic Messages by Hong Kong Computer Emergency Response Team Coordination Centre 1. General We consider that

More information

Protect Yourself in the Cloud Age

Protect Yourself in the Cloud Age Protect Yourself in the Cloud Age Matthew Wu Consultant Hong Kong Computer Emergency Response Team Coordination Centre About HKCERT HKCERT ( 香 港 電 腦 保 安 事 故 協 調 中 心 ) Established in 2001 Funding & Operation

More information

Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia

Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Helmi Rais CERT-TCC Team Manager National Agency for Computer Security, Tunisia helmi.rais@ansi.tn helmi.rais@gmail.com Framework

More information

WEB ATTACKS AND COUNTERMEASURES

WEB ATTACKS AND COUNTERMEASURES WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in

More information

Acceptable Use Policy and Terms of Service

Acceptable Use Policy and Terms of Service Acceptable Use Policy and Terms of Service Vox Populi Registry Ltd. 3-110 Governors Square 23 Lime Tree Bay Ave. Grand Cayman, Cayman Islands PO Box 1361, George Town, KY1-1108 www.nic.sucks Version 1.0

More information

Data Centers Protection from DoS attacks. Trends and solutions. Michael Soukonnik, Radware Ltd michaels@radware.com Riga. Baltic IT&T. 21.04.

Data Centers Protection from DoS attacks. Trends and solutions. Michael Soukonnik, Radware Ltd michaels@radware.com Riga. Baltic IT&T. 21.04. Data Centers Protection from DoS attacks. Trends and solutions Michael Soukonnik, Radware Ltd michaels@radware.com Riga. Baltic IT&T. 21.04.2010 Cybercrime Trends Page 2 Types of DoS attacks and classical

More information

Who will win the battle - Spammers or Service Providers?

Who will win the battle - Spammers or Service Providers? Who will win the battle - Spammers or Service Providers? Pranaya Krishna. E* Spam Analyst and Digital Evidence Analyst, TATA Consultancy Services Ltd. (pranaya.enugulapally@tcs.com) Abstract Spam is abuse

More information

SAC 025 SSAC Advisory on Fast Flux Hosting and DNS

SAC 025 SSAC Advisory on Fast Flux Hosting and DNS Fast and Double Flux Attacks 1 SAC 025 SSAC Advisory on Fast Flux Hosting and DNS An Advisory from the ICANN Security and Stability Advisory Committee (SSAC) January 2008 Fast and Double Flux Attacks 2

More information

Evolution of attacks and Intrusion Detection

Evolution of attacks and Intrusion Detection Evolution of attacks and Intrusion Detection AFSecurity seminar 11 April 2012 By: Stian Jahr Agenda Introductions What is IDS What is IDS in mnemoic How attacks have changed by time and how has it changed

More information

Web Vulnerability Scanner by Using HTTP Method

Web Vulnerability Scanner by Using HTTP Method Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 4, Issue. 9, September 2015,

More information

Evolving Threats and Attacks: A Cloud Service Provider s viewpoint. John Howie Senior Director Online Services Security and Compliance

Evolving Threats and Attacks: A Cloud Service Provider s viewpoint. John Howie Senior Director Online Services Security and Compliance Evolving Threats and Attacks: A Cloud Service Provider s viewpoint John Howie Senior Director Online Services Security and Compliance Introduction Microsoft s Cloud Infrastructure Evolution of Threats

More information

Phishing Activity Trends Report June, 2006

Phishing Activity Trends Report June, 2006 Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account

More information

CERT's role in national Cyber Security: policy suggestions

CERT's role in national Cyber Security: policy suggestions CERT's role in national Cyber Security: policy suggestions Subject: Legal Aspect of Cyber Security. Author: Vladimir Chitashvili Lecture: Anna-Maria Osula What is national Cyber Security is? In another

More information

How to Secure TYPO3 Installations

How to Secure TYPO3 Installations How to Secure TYPO3 Installations Jochen Weiland April 2011 "Viagra Hack" Searching for "Viagra" lists unrelated pages in Google Beispiel Beispiel "Exclusive: Many TYPO3 Sites have been hacked" April 27,

More information

CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT

CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT AN ANALYSIS OF NETWORK SECURITY INCIDENTS FIRST HALF OF 2011 2 Contents How to read this document?

More information

WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services

WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services WEB SITE SECURITY Jeff Aliber Verizon Digital Media Services 1 SECURITY & THE CLOUD The Cloud (Web) o The Cloud is becoming the de-facto way for enterprises to leverage common infrastructure while innovating

More information

Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS

Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS Trend Micro Incorporated Research Paper 2012 Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs AN IN-DEPTH ANALYSIS By: Jon Oliver, Sandra Cheng, Lala Manly, Joey Zhu, Roland

More information

Fast Flux Hosting and DNS ICANN SSAC

Fast Flux Hosting and DNS ICANN SSAC Fast Flux Hosting and DNS ICANN SSAC What is Fast Flux Hosting? An evasion technique Goal Avoid detection and take down of web sites used for illegal purposes Technique Host illegal content at many sites

More information

Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK

Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK Adventures in Cybercrime Piotr Kijewski CERT Polska/NASK Would you like a Porsche? Porsche Cayenne S Turbo: 149 000 USD Or maybe a different type? Porsche 911 Turbo: 149 000 USD The car is there Porsche

More information

DNS Traffic Monitoring. Dave Piscitello VP Security and ICT Coordina;on, ICANN

DNS Traffic Monitoring. Dave Piscitello VP Security and ICT Coordina;on, ICANN DNS Traffic Monitoring Dave Piscitello VP Security and ICT Coordina;on, ICANN Domain Names ICANN coordinates the administra2on of global iden2fier systems Domain names provide user friendly identification

More information

Tunisia s experience in building an ISAC. Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc

Tunisia s experience in building an ISAC. Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc Tunisia s experience in building an ISAC Haythem EL MIR Technical Manager NACS Head of the Incident Response Team cert-tcc 1 Agenda Introduction ISAC objectives and benefits Tunisian approach SAHER system

More information

Security A to Z the most important terms

Security A to Z the most important terms Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from

More information

Current Threat Scenario and Recent Attack Trends

Current Threat Scenario and Recent Attack Trends Current Threat Scenario and Recent Attack Trends Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Objectives Current Cyber space Nature of cyberspace and associated risks

More information

CERT-GOV-GE Activities & International Partnerships

CERT-GOV-GE Activities & International Partnerships CERT-GOV-GE Activities & International Partnerships Zurich, Switzerland 2014 CERT-GOV-GE Manager David Kvatadze www.dea.gov.ge CERT-GOV-GE - Structural unit was formed within the Information Security and

More information

An analysis of exploitation behaviors on the web and the role of web hosting providers in detecting them

An analysis of exploitation behaviors on the web and the role of web hosting providers in detecting them An analysis of exploitation behaviors on the web and the role of web hosting providers in detecting them Davide Canali, Davide Balzarotti Aurélien Francillon Software and System Security Group EURECOM,

More information

An Efficient Methodology for Detecting Spam Using Spot System

An Efficient Methodology for Detecting Spam Using Spot System Available Online at www.ijcsmc.com International Journal of Computer Science and Mobile Computing A Monthly Journal of Computer Science and Information Technology IJCSMC, Vol. 3, Issue. 1, January 2014,

More information

Phishing Activity Trends

Phishing Activity Trends Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record

More information

CS 558 Internet Systems and Technologies

CS 558 Internet Systems and Technologies CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.

More information

Detecting Algorithmically Generated Malicious Domain Names

Detecting Algorithmically Generated Malicious Domain Names Detecting Algorithmically Generated Malicious Domain Names Sandeep Yadav, Texas A&M University IT Security for the Next Generation American Cup, New York 9-11 November, 2011 Introduction Botnets, a network

More information

Fraud and Phishing Scam Response Arrangements in Brazil

Fraud and Phishing Scam Response Arrangements in Brazil Fraud and Phishing Scam Response Arrangements in Brazil Marcelo H. P. C. Chaves mhp@cert.br Computer Emergency Response Team Brazil CERT.br http://www.cert.br/ Brazilian Internet Steering Committee http://www.cgi.br/

More information

NUIT Tech Talk. Peeking Behind the Curtain of Security. Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance

NUIT Tech Talk. Peeking Behind the Curtain of Security. Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance NUIT Tech Talk Peeking Behind the Curtain of Security Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance Definitions Malware: The Virus/Trojan software we ve all come

More information

December 2010 Report #48

December 2010 Report #48 December 2010 Report #48 With the holidays in full gear, Symantec observed an increase of 30 percent in the product spam category as spammers try to push Christmas gifts and other products. While the increase

More information

UNMASKCONTENT: THE CASE STUDY

UNMASKCONTENT: THE CASE STUDY DIGITONTO LLC. UNMASKCONTENT: THE CASE STUDY The mystery UnmaskContent.com v1.0 Contents I. CASE 1: Malware Alert... 2 a. Scenario... 2 b. Data Collection... 2 c. Data Aggregation... 3 d. Data Enumeration...

More information

The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED

The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED The FBI Cyber Program Bauer Advising Symposium October 11, 2012 Today s Agenda What is the threat? Who are the adversaries? How are they attacking you? What can the FBI do to help? What can you do to stop

More information

5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep)

5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) 5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) survey says: There are things that go bump in the night, and things that go bump against your DNS security. You probably know

More information

Internet Security and Resiliency: A Collaborative Effort

Internet Security and Resiliency: A Collaborative Effort Internet Security and Resiliency: A Collaborative Effort Baher Esmat Manager, Regional Relations Middle East MENOG 4 Manama, 9 April 2009 1 WHAT IS THIS PRESENTATION ABOUT? ICANN s effort in enhancing

More information

Security Business Review

Security Business Review Security Business Review Security Business Review Q4: 2014 2 By Bitdefender Labs Security Business Review Botnet Anonymization Raises New Security Concerns Executive Overview While botnets, which are large

More information

Who s Doing the Hacking?

Who s Doing the Hacking? Who s Doing the Hacking? 1 HACKTIVISTS Although the term hacktivist refers to cyber attacks conducted in the name of political activism, this segment of the cyber threat spectrum covers everything from

More information

6. ecommerce Security and Payment Systems. Alexander Nikov. Teaching Objectives. Video: Online Banking, Is It Secure?

6. ecommerce Security and Payment Systems. Alexander Nikov. Teaching Objectives. Video: Online Banking, Is It Secure? INFO 3435 ecommerce 6. ecommerce Security and Payment Systems Alexander Nikov Teaching Objectives Explain the scope of ecommerce crime and security problems. Describe the key dimensions of e-commerce security.

More information

Emerging Security Technological Threats

Emerging Security Technological Threats Emerging Security Technological Threats Jamie Gillespie Training and Education Team Leader, AusCERT About AusCERT Australia s national CERT Collect, monitor, advise on threats and vulnerabilities Incident

More information

Botnets. Sponsored by: ISSA Web Conference. October 26, 2010 Start Time: 9 am US Pacific, Noon US Eastern, 5 pm London

Botnets. Sponsored by: ISSA Web Conference. October 26, 2010 Start Time: 9 am US Pacific, Noon US Eastern, 5 pm London Botnets Sponsored by: ISSA Web Conference October 26, 2010 Start Time: 9 am US Pacific, Noon US Eastern, 5 pm London 1 Welcome: Conference Moderator Phillip H Griffin Member - ISSA Educational Advisory

More information

Botnets: The Advanced Malware Threat in Kenya's Cyberspace

Botnets: The Advanced Malware Threat in Kenya's Cyberspace Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)

More information

Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望

Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination

More information

LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains

LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way

More information

Cybersecurity: Thailand s and ASEAN s priorities. Soranun Jiwasurat www.etda.or.th

Cybersecurity: Thailand s and ASEAN s priorities. Soranun Jiwasurat www.etda.or.th Cybersecurity: Thailand s and ASEAN s priorities Soranun Jiwasurat www.etda.or.th Cyber Threat Landscape Overview 2 Cyber threat a hostile act using computers, electronic information and/or digital networks

More information

VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION

VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally

More information

Use of Honeypots for Network Monitoring and Situational Awareness

Use of Honeypots for Network Monitoring and Situational Awareness Use of Honeypots for Network Monitoring and Situational Awareness Cristine Hoepers cristine@cert.br Computer Emergency Response Team Brazil - CERT.br Network Information Center Brazil - NIC.br Brazilian

More information

ACCEPTABLE USE AND TAKEDOWN POLICY

ACCEPTABLE USE AND TAKEDOWN POLICY ACCEPTABLE USE AND TAKEDOWN POLICY This Acceptable Use and Takedown Policy ( Acceptable Use Policy ) of Wedding TLD2, LLC (the Registry ), is to be read together with the Registration Agreement and words

More information

COMPUTER SECURITY INCIDENT RESPONSE TEAM

COMPUTER SECURITY INCIDENT RESPONSE TEAM Executive Agency "Electronic Communication Networks and Information Systems" COMPUTER SECURITY INCIDENT RESPONSE TEAM VASIL GRANCHAROV DIRECTOR, CERT BG www.esmis.government.bg www.govcert.bg Electronic

More information

Spampots Project First Results of the International Phase and its Regional Utilization

Spampots Project First Results of the International Phase and its Regional Utilization Spampots Project First Results of the International Phase and its Regional Utilization Klaus Steding-Jessen jessen@cert.br LACNIC XIII, 5 th LACSEC, Curaçao May 19, 2010 p. 1/31 CERT.br Computer Emergency

More information

Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity

Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Computer Crime and Intellectual Property Section Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Albert Rees Computer Crime and Intellectual Property Section (CCIPS) Criminal Division,

More information

Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013

Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013 Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a

More information

Policies and Practices on Network Security of MIIT

Policies and Practices on Network Security of MIIT 2011/TEL43/SPSG/WKSP/004 Policies and Practices on Network Security of MIIT Submitted by: China Workshop on Cybersecurity Policy Development in the APEC Region Hangzhou, China 27 March 2011 Policies and

More information

TAKING DOWN THE WORLD S LARGEST BOTNETS

TAKING DOWN THE WORLD S LARGEST BOTNETS TAKING DOWN THE WORLD S LARGEST BOTNETS Ali Mesdaq FireEye, Inc. Session ID: CLE W03 Session Classification: Advanced Credit Atif Mushtaq > Ali Mesdaq Real FireEye veteran Specialized in Botnets and CnC

More information

The risks borne by one are shared by all: web site compromises

The risks borne by one are shared by all: web site compromises The risks borne by one are shared by all: web site compromises Having your company web site hacked or compromised can be a costly experience for your organisation. There are immediate costs in responding

More information

Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information.

Environment. Attacks against physical integrity that can modify or destroy the information, Unauthorized use of information. Cyber Security. Environment, Solutions and Case study. Special Telecommunications Service David Gabriel, Buciu Adrian Contact: gdavid13@sts.ro adibuciu@sts.ro Environment Network/services can be damaged

More information

ENISA s Study on the Evolving Threat Landscape. European Network and Information Security Agency

ENISA s Study on the Evolving Threat Landscape. European Network and Information Security Agency ENISA s Study on the Evolving Threat Landscape European Network and Information Security Agency Agenda Introduction to ENISA Preliminary remarks The ENISA report Major findings Conclusions 2 ENISA The

More information

SPAM, VIRUSES AND PHISHING, OH MY! Michael Starks, CISSP, CISA ISSA Fellow 10/08/2015

SPAM, VIRUSES AND PHISHING, OH MY! Michael Starks, CISSP, CISA ISSA Fellow 10/08/2015 SPAM, VIRUSES AND PHISHING, OH MY! Michael Starks, CISSP, CISA ISSA Fellow 10/08/2015 The Usual Players Indebtedness for driving on toll road Transaction receipts Notice to appear Major and Emerging Trends

More information

Computer Software Bugs and Other IT Threats to Critical Infrastructure: A Preliminary Set of Considerations for IT Governance

Computer Software Bugs and Other IT Threats to Critical Infrastructure: A Preliminary Set of Considerations for IT Governance Computer Software Bugs and Other IT Threats to Critical Infrastructure: A Preliminary Set of Considerations for IT Governance Presentation for the Seventh European Academic Conference on Internal Audit

More information

Promoting Network Security (A Service Provider Perspective)

Promoting Network Security (A Service Provider Perspective) Promoting Network Security (A Service Provider Perspective) Prevention is the Foundation H S Gupta DGM (Technical) Data Networks, BSNL hsgupta@bsnl.co.in DNW, BSNL 1 Agenda Importance of Network Security

More information

INFORMATION SECURITY REVIEW

INFORMATION SECURITY REVIEW INFORMATION SECURITY REVIEW 14.10.2008 CERT-FI Information Security Review 3/2008 In the summer, information about a vulnerability in the internet domain name service (DNS) was released. If left unpatched,

More information

Modular Network Security. Tyler Carter, McAfee Network Security

Modular Network Security. Tyler Carter, McAfee Network Security Modular Network Security Tyler Carter, McAfee Network Security Surviving Today s IT Challenges DDos BOTS PCI SOX / J-SOX Data Exfiltration Shady RAT Malware Microsoft Patches Web Attacks No Single Solution

More information

Symantec Intelligence Report: February 2013

Symantec Intelligence Report: February 2013 Symantec Intelligence Symantec Intelligence Report: February 2013 Welcome to the February edition of the Symantec Intelligence report, which provides the latest analysis of cyber security threats, trends,

More information

Attacks Against the Cloud: A Mitigation Strategy. Cloud Attack Mitigation & Firewall on Demand

Attacks Against the Cloud: A Mitigation Strategy. Cloud Attack Mitigation & Firewall on Demand Attacks Against the Cloud: A Mitigation Strategy C L O U D A T T A C K M I T I G A T I O N & F I R E W A L L O N D E M A N D A l e x Z a c h a r i s a z a h a r i s @ a d m i n. g r n e t. g r G R N E

More information

Korea s experience of massive DDoS attacks from Botnet

Korea s experience of massive DDoS attacks from Botnet Korea s experience of massive DDoS attacks from Botnet April 12, 2011 Heung Youl YOUM Ph.D. SoonChunHyang University, Korea President, KIISC, Korea Vice-chairman, ITU-T SG 17 1 Table of Contents Overview

More information

ACS-3921/4921-050 Computer Security And Privacy. Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security

ACS-3921/4921-050 Computer Security And Privacy. Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security ACS-3921/4921-050 Computer Security And Privacy Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security ACS-3921/4921-050 Slides Used In The Course A note on the use of these slides: These

More information

============================================================= =============================================================

============================================================= ============================================================= Stephan Lantos Subject: FW: @RISK: The Consensus Security Vulnerability Alert: Vol. 13, Num. 23 In partnership with SANS and Sourcefire, Qualys is pleased to provide you with the @RISK Newsletter. This

More information

State of the Web 2015: Vulnerability Report. March 2015. 2015 Menlo Security Alright Reserved

State of the Web 2015: Vulnerability Report. March 2015. 2015 Menlo Security Alright Reserved State of the Web 2015: Vulnerability Report March 2015 Motivation In February 2015, security researchers http://www.isightpartners.com/2015/02/codoso/ reported that Forbes.com had been hacked. The duration

More information

JOOMLA REFLECTION DDOS-FOR-HIRE

JOOMLA REFLECTION DDOS-FOR-HIRE 1 TLP: GREEN GSI ID: 1085 JOOMLA REFLECTION DDOS-FOR-HIRE RISK FACTOR - HIGH 1.1 / OVERVIEW / Following a series of vulnerability disclosures throughout 2014, the popular content management framework Joomla

More information

Phishing Activity Trends Report for the Month of December, 2007

Phishing Activity Trends Report for the Month of December, 2007 Phishing Activity Trends Report for the Month of December, 2007 Summarization of December Report Findings The total number of unique phishing reports submitted to APWG in December 2007 was 25,683, a decrease

More information

Spyware. Summary. Overview of Spyware. Who Is Spying?

Spyware. Summary. Overview of Spyware. Who Is Spying? Spyware US-CERT Summary This paper gives an overview of spyware and outlines some practices to defend against it. Spyware is becoming more widespread as online attackers and traditional criminals use it

More information

Internet Monitoring via DNS Traffic Analysis. Wenke Lee Georgia Institute of Technology

Internet Monitoring via DNS Traffic Analysis. Wenke Lee Georgia Institute of Technology Internet Monitoring via DNS Traffic Analysis Wenke Lee Georgia Institute of Technology 0 Malware Networks (Botnets) 1 From General-Purpose to Targeted Attacks 11/14/12 2 Command and Control l Botnet design:

More information

Whose IP Is It Anyways: Tales of IP Reputation Failures

Whose IP Is It Anyways: Tales of IP Reputation Failures Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story

More information

Network and Incident monitoring

Network and Incident monitoring August, 2013 Network and Incident monitoring Koichiro (Sparky) Komiyama Sam Sasaki JPCERT Coordination Center, Japan Agenda 1. Introduction of TSUBAME 2. Recent Observation cases 2 1. INTRODUCTION OF TSUBAME

More information

Denial of Service Attacks

Denial of Service Attacks 2 Denial of Service Attacks : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013 its335y13s2l06, Steve/Courses/2013/s2/its335/lectures/malicious.tex,

More information

Exploring the Black Hole Exploit Kit

Exploring the Black Hole Exploit Kit Exploring the Black Hole Exploit Kit Updated December 20, 2011 Internet Identity Threat Intelligence Department http://www.internetidentity.com http://www.internetidentity.com 12/29/11 Page 1/20 Summary

More information

Innovations in Network Security

Innovations in Network Security Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.

More information

Countermeasures against Bots

Countermeasures against Bots Countermeasures against Bots Are you sure your computer is not infected with Bot? Information-technology Promotion Agency IT Security Center http://www.ipa.go.jp/security/ 1. What is a Bot? Bot is a computer

More information

Module 5: Analytical Writing

Module 5: Analytical Writing Module 5: Analytical Writing Aims of this module: To identify the nature and features of analytical writing To discover the differences between descriptive and analytical writing To explain how to develop

More information

10 Things Every Web Application Firewall Should Provide Share this ebook

10 Things Every Web Application Firewall Should Provide Share this ebook The Future of Web Security 10 Things Every Web Application Firewall Should Provide Contents THE FUTURE OF WEB SECURITY EBOOK SECTION 1: The Future of Web Security SECTION 2: Why Traditional Network Security

More information

THE ABC OF SECURITY FOR WEBSITE OWNERS

THE ABC OF SECURITY FOR WEBSITE OWNERS THE ABC OF SECURITY FOR WEBSITE OWNERS THE ABC OF SECURITY FOR WEBSITE OWNERS For additional information visit: SI-CERT - www.cert.si Varni na internetu - www.varninainternetu.si Slovenian Computer Emergency

More information