DNS Footprint of Malware
|
|
|
- Pauline Harrington
- 8 years ago
- Views:
Transcription
1 DNS Footprint of Malware Ed Stoner CERT Network Situational Awareness 2010 Carnegie Mellon University
2 Anexa Automated Run-Time Analysis environment Malicious Software Catalog of millions of samples ~ 250,000 uniq md5s every 6 months Network Touchpoints Domain Names 119,000 of them over 6 months IP addresses 2
3 Malicious Domain Name Research 3
4 Data Set domains -> IPs 4
5 Data Set domains -> IPs 5
6 Coverage by MD5 6
7 Control Case Malicious Domains Random Domains 7
8 Top Level Domains - Malware 8
9 Random TLD distribution 9
10 GeoLocation based upon IP address Geolocation by MaxMind 10
11 Random GeoLocation distribution 11
12 Top domains (by md5) to auto.search.msn.com, downloadfixandlove.com,4339 ads.netbios-local.com,2581 irc.zief.pl, ayb.trinityacquisitions.com,2083 ayb.maximumexperience.com,2083 myart-gallery.com,1736 jet-arts-center.com,1716 videoporntrue.net,1645 freeavtest.com,1497 crystal-arts.net,1361 tubepornolive.com,1300 siteload.cn,1239 hostnsload.cn,1239 pornotube912.com, to mk.maxthon.cn,11516 google.com,8731 download.flvdome.com,7518 submit.flvdome.com, auto.search.msn.com, msn.com,5666 all-internal.info,4478 cfg.353wanwan.com,3987 crl.verisign.com,3950 csc crl.verisign.com,3945 digitalartsaward.com,3608 cts.hotbar.com,3009 mediaartsplaza.com, ayb.host com,2792 ayb.host com,2792 ayb.host com,2792 config.ie.sogou.com,
13 Top nameservers (by md5) ns1-6.wingdns.net ns1-2.nameself.com ns1-4.trafficclub.com ns1-4.google.com ns1-5.byet.org ns1-2.dns.com.cn ns1-2.bluehost.com dns1-2.uni5.net dns1-4.kinghost.com.br ns1-2.ukraine.com.ua ns11-16.bigwww.com ns,ns2,ns3.pipni.cz ns1-3.surf-town.net ns1-2.ignum.com.: 8738 dns,dns2.site5.com ns1-4.cloudns.net ns1-4.serveriai.lt.: 8735 ns1-3.cnchost.com ns1-2.infobox.org
14 Domain Name Characteristics Baseline Sample All Malicious Domains Two-Labels (example.com) 3227 (11% of) 67,398 (56% of) Three-labels ( (25% of) 45,944 (38% of ) Dynamic DNS 36 (0% of) 22,153 (18.5% of total, 50% of 3-label) 14
15 Registrars and Dynamic DNS Dynamic DNS 22,153 out of 119, % of total, but nearly 50% of the 3 rd level domains) Registrars (2 nd Level Domains) 67,398 out of 119,385 56% of total 75% of malicious domains 15
16 Lifetimes Malicious Domains Random Baseline Lifetime 104 days 110 days After Removal of Akamai, rbls, and cdns 105 days 165 days RBLs Remote Block Lists CDNs Content Distribution Networks 16
17 Parked Domains Domains that are parked on a non-operational IP address Often unroutable IP space ( , ) Sometimes strange IP addresses ( , ) Other times popular IP address (google, akamai, microsoft) 17
18 Parked examples - domains parked at google ip space: a.emmai.info ac3n.info adslstats.net boqeouti.org bujozami.cn customme.cn dreamnaut.no-ip.info f.unicat.org forbes-2009.com forrodesejomusical.com.br google-resolve.servehttp.com gooogle.com hackhound.org hurt23.mine.nu lanzadorx.com mail.xakep.ru mgq s idc.com omfgitzpjx.info ruvegaro.cn sickshot.us.to speedytorrents.net vampire008tw.xxxy.info viptrips.net wmi.pho24.info yc.shockwavesfx.com 18
19 Normal Parking expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com
20 Normal Parking expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com expired.domain.com
21 Example of Parking until Operations badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com
22 Example of Parking until Operations badguy.com badguy.com Thursday badguy.com Friday badguy.com badguy.com badguy.com badguy.com badguy.com badguy.com Thursday badguy.com Friday badguy.com badguy.com badguy.com
23 Fast Flux fully qualified domain name (such as to have multiple (hundreds or even thousands) IP addresses assigned to it. These IP addresses are swapped in and out of flux with extreme frequency, using a combination of roundrobin IP addresses and a very short Time-To-Live (TTL) for any given particular DNS Resource Record (RR) 23
24 old FastFlux working definition Previous definition: 20 different ASNs w/ 25 different IP-addresses TTL of less than 2000 seconds 24
25 FastFlux Hosting 25
26 Most IPs per Domain Unsophisticated Criminals Domain IPs md5s handle Notes 02fgu cn no Unknown fastflux botnet c2 viotto.dyndns.org yes discusses SpyNet 1.8 and 2.0 momo26.no-ip.biz yes ZeuS C2, momo.exe, not in virustotal malchh.no-ip.biz yes Turkojan v1, discussing turkojan v4 spy-pc1.no-ip.biz no Poison/BiFrose yousufshah.no-ip.biz yes discussing facebook passwords, CyberGate souhil5.no-ip.info yes Poison/BiFrose, discussing bifrose semao.myftp.biz yes bifrose Variant 26
27 Flux Spread of Malicious Domains 27
28 Flux Spread w/ Random Sample 28
29 Flux Spread w/ CDNs removed 29
30 New Algorithm - domains with: - 20 or more A recs - IPs are in 20 or more ASNs - of those domains: - find IP sets with more than 5 addrs in common - white list known CDNs 30
31 what we're finding 6/01/2010: cc.allaboutc0ntrol,com.haijeihefoobeekahkohweto,net.jdhyh1230jh, ru.mmjl3l45lkjbdb 7/15/2010: com.drunkjeans,com.earlymale,com.hillchart,com.hugejar,com.roundstorm, com.tightsales,ru.dealyak,ru.greedford,ru.heroguy,ru.jarpub, ru.marketholiday,ru.pantscow,ru.problemdollars,ru.raceobject,ru.tintie 08/29/2010: com.first-wave-aug,com.hotsku,com.iwfybfywi,com.mortalconbat, com.qrtmpqpmlolpmu,com.uuvqvkoqrrdtli,net.instamfan,net.roundhome, ru.adaichaepo,ru.aijohcolev,ru.dahzunaeye,ru.deilaeyeew,ru.hazelpay, ru.iesahnaepi,ru.iveeteepew,ru.jocudaidie,ru.johgheejae,ru.kaithuushi, ru.ohphahfech,ru.ootaivilei,ru.purplepron,ru.railuhocal 31
32 Flux Statistics 32
33 Domain Flux Definition: generation of a large number of pseudo-random domains using the same seed 1.) to hide communication channel 2.) to prevent domains being blocked looks like: aabdykuiwcymao.biz,aaemxwiugkeq.info,aafueyeoya.biz,aaiahiiugkeq.biz, aaiavsiugkeq.biz,aakmbsiugkeq.biz,aaonhaiugkeq.info,aapgpqeoya.info, abahfodsholapet.cc,abcyxmnansnan.com,abdqbenansnan.com,acjybkdsholapet.org OR: ysggof.1dumb.com,yxnhwhmrckk.dynserv.com,yxrxopwfrvz.yi.org, yybvnivcjei.3-a.net.,yzscnmh.afraid.org,zbttjqq.afraid.org, zdhmosqbmuy.3-a.net,zeczrpsck.dynserv.com,zibjyomx.hn.org,zpkwnmip.hn.org, zppkhkxsawq.yi.org.,zqptrlup.dynserv.com,zsbbrdwp.dynserv.com 33
34 Domains per MD5 34
35 NxDomain need to capture to find: 1.) domain flux 2.) other domains seen for only one day different md5s (1.2%) 3.) What else are we missing? 35
36 YAF yet another flowmeter - initial public release Mar. 28, processes packets from pcap or live capture - exports flow to IPFIX format - tcp reassembly, fragment reassembly - widely deployed - supports 10Gbs capture 36
37 IPFIX RFC 5101,5102,5103 (previously Cisco Netflow v9) abstract data types: unsigned8,unsigned16,unsigned32,unsigned64,signed8,signed16, signed32,signed64,float32,float64,boolean,macaddress,octetarray, string,datetimeseconds,datetimemilliseconds,datetimemicroseconds, datetimenanoseconds,ipv4address,ipv6address over 200 Information Elements already defined very widely supported in hardware and software 37
38 YAF current status - as of Jul 27, now supporting: - udp-uniflow - FTP,HTTP,IMAP,RTSP,SIP,SMTP,SSH,DNS, IRC,NNTP,POP3,SLP,TFTP - custom protocol decoders as plugins - as C code or regex 38
Flow Based Traffic Analysis
Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City murali@ncb.ernet.in Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode
Botnet Analysis Leveraging Domain Ratio Analysis Uncovering malicious activity through statistical analysis of web log traffic
The Leader in Cloud Security RESEARCH REPORT Botnet Analysis Leveraging Domain Ratio Analysis Uncovering malicious activity through statistical analysis of web log traffic ABSTRACT Zscaler is a cloud-computing,
Computer Networks: Domain Name System
Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com
Report. Takeover of Virut domains
Report Takeover of Virut domains February 25, CONTENTS Contents 1 Executive summary 2 2 Introduction 2 2.1 What is Virut?................................ 2 2.2 Takeover of Virut domains..........................
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
Advanced DNS Course. Module 4. DNS Load Balancing
Advanced DNS Course Module 4 DNS Load Balancing Services (SRV) Record The Services RR allows a service to be associated with a host name. A user or application that wishes to discover where a service
Decoding DNS data. Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs
Decoding DNS data Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs The Domain Name System (DNS) is a core component of the Internet infrastructure,
DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic
DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic Yizheng Chen, Manos Antonakakis, Roberto Perdisci, Yacin Nadji, David Dagon, and Wenke Lee Domain Name System Machine-level
Kindred Domains: Detecting and Clustering Botnet Domains Using DNS Traffic "" " Matt Thomas" Data Architect, Verisign Labs"
Kindred Domains: Detecting and Clustering Botnet Domains Using DNS Traffic "" " Matt Thomas" Data Architect, Verisign Labs" About the Author"! Matthew Thomas! Data Architect" Verisign Labs"! Aziz Mohaisen!
Network Monitoring for Cyber Security
Network Monitoring for Cyber Security Paul Krystosek, PhD CERT Network Situational Awareness 2006 Carnegie Mellon University What s Coming Up The scope of network monitoring Cast of characters Descriptions
DNS Firewall Overview Speaker Name. Date
DNS Firewall Overview Speaker Name 1 1 Date Reserved. Agenda DNS Security Challenges DNS Firewall Solution Customers Call to Action 2 2 Reserved. APTs: The New Threat Landscape Nation-state or organized-crime
Domain Name System 2015-04-28 17:49:44 UTC. 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement
Domain Name System 2015-04-28 17:49:44 UTC 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement Contents Domain Name System... 4 Domain Name System... 5 How DNS Works
DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come!
DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come! Amir Herzberg and Haya Shulman Dept. of Computer Science Bar Ilan University 8/1/2013 About us Bar Ilan University
Indexing Full Packet Capture Data With Flow
Indexing Full Packet Capture Data With Flow FloCon January 2011 Randy Heins Intelligence Systems Division Overview Full packet capture systems can offer a valuable service provided that they are: Retaining
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
Passive Monitoring of DNS Anomalies
Passive Monitoring of DNS Anomalies Bojan Zdrnja 1, Nevil Brownlee 1, and Duane Wessels 2 1 University of Auckland, New Zealand, {b.zdrnja,nevil}@auckland.ac.nz 2 The Measurement Factory, Inc., wessels@packet-pushers.com
plixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels
Scrutinizer Competitor Worksheet Scrutinizer Malware Incident Response Scrutinizer is a massively scalable, distributed flow collection system that provides a single interface for all traffic related to
Basheer Al-Duwairi Jordan University of Science & Technology
Basheer Al-Duwairi Jordan University of Science & Technology Outline Examples of using network measurements /monitoring Example 1: fast flux detection Example 2: DDoS mitigation as a service Future trends
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
Whose IP Is It Anyways: Tales of IP Reputation Failures
Whose IP Is It Anyways: Tales of IP Reputation Failures SESSION ID: SPO-T07 Michael Hamelin Lead X-Force Security Architect IBM Security Systems @HackerJoe What is reputation? 2 House banners tell a story
Take the NetFlow Challenge!
TM Scrutinizer NetFlow and sflow Analysis Scrutinizer is a NetFlow and sflow analyzer that provides another layer of cyber threat detection and incredibly detailed network utilization information about
Shell over what?! Naughty CDN manipulations. Roee Cnaan, Information Security Consultant
Shell over what?! Naughty CDN manipulations Roee Cnaan, Information Security Consultant About me (mister) Penetration Tester DDoS fitness tester Python and Scapy programmer SCADA and ICS attacker Tools
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
ENEE 757 CMSC 818V. Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park
21. Botnets ENEE 757 CMSC 818V Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park http://ter.ps/757 https://www.facebook.com/sdsatumd Today s Lecture Where we ve been AuthenDcaDon
PRACTICAL EXPERIENCES BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR. ` Mark Graham
PRACTICAL EXPERIENCES OF BUILDING AN IPFIX BASED OPEN SOURCE BOTNET DETECTOR ` Mark Graham OUTLINE RESEARCH PROBLEM: Botnet detection in Cloud Providers FLOW: IPFIX and NetFlow CONCEPTUAL FRAMEWORK: Build
How To Identify Different Operating Systems From A Set Of Network Flows
Passive OS detection by monitoring network flows Siebren Mossel University of Twente P.O. Box 217, 7500AE Enschede The Netherlands s.mossel@gmx.net ABSTRACT` Network flow monitoring is a way of monitoring
Configuration Notes 0215
Mediatrix Digital and Analog VoIP Gateways DNS SRV Configuration for a Redundant Server Solution (SIP) Introduction... 2 Deployment Scenario... 2 DNS SRV (RFC 2782)... 3 Microsoft Server Configuration...
Using big data analytics to identify malicious content: a case study on spam emails
Using big data analytics to identify malicious content: a case study on spam emails Mamoun Alazab & Roderic Broadhurst Mamoun.alazab@anu.edu.au http://cybercrime.anu.edu.au 2 Outline Background Cybercrime
Exploring the Black Hole Exploit Kit
Exploring the Black Hole Exploit Kit Updated December 20, 2011 Internet Identity Threat Intelligence Department http://www.internetidentity.com http://www.internetidentity.com 12/29/11 Page 1/20 Summary
Monitoring commercial cloud service providers
Monitoring commercial cloud service providers July Author: Lassi Kojo Supervisor: Stefan Lüders CERN openlab Summer Student Report Abstract There is a growing tendency by individuals to sign-up for public
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally
The art of sinkholing. Tomasz Bukowski CERT Polska / NASK
The art of sinkholing Tomasz Bukowski CERT Polska / NASK About WHOIS Name:Tomasz Bukowski (tomasz.bukowski@cert.pl) Works in CERT Polska/NASK 5 years in IRT Fight malware && monitor botnets Linux user
Cisco ASA 5500 Series Adaptive Security Appliance 8.2 Software Release
Cisco ASA 5500 Series Adaptive Security Appliance 8.2 Software Release PB526545 Cisco ASA Software Release 8.2 offers a wealth of features that help organizations protect their networks against new threats
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN Applicable Version: 10.6.2 onwards Overview Virtual host implementation is based on the Destination NAT concept. Virtual
Week 3 / Paper 2. Bernhard Ager, Wolfgang Mühlbauer, Georgios Smaragdakis, Steve Uhlig ACM IMC 2010.
Week 3 / Paper 2 Comparing DNS Resolvers in the Wild Bernhard Ager, Wolfgang Mühlbauer, Georgios Smaragdakis, Steve Uhlig ACM IMC 2010. Main point How does ISP DNS compare with Google DNS and OpenDNS?
PEQ-DNS A Platform for DNS Quality Monitoring
PEQ-DNS A Platform for DNS Quality Monitoring DNS Monitoring Challenges [1/2] The DNS is a complex distributed system that requires a distributed (per DNS server) monitoring system Monitoring usually focuses
How To Protect Your Network From Intrusions From A Malicious Computer (Malware) With A Microsoft Network Security Platform)
McAfee Security: Intrusion Prevention System REV: 0.1.1 (July 2011) 1 Contents 1. McAfee Network Security Platform...3 2. McAfee Host Intrusion Prevention for Server...4 2.1 Network IPS...4 2.2 Workload
Concierge SIEM Reporting Overview
Concierge SIEM Reporting Overview Table of Contents Introduction... 2 Inventory View... 3 Internal Traffic View (IP Flow Data)... 4 External Traffic View (HTTP, SSL and DNS)... 5 Risk View (IPS Alerts
Internet Monitoring via DNS Traffic Analysis. Wenke Lee Georgia Institute of Technology
Internet Monitoring via DNS Traffic Analysis Wenke Lee Georgia Institute of Technology 0 Malware Networks (Botnets) 1 From General-Purpose to Targeted Attacks 11/14/12 2 Command and Control l Botnet design:
Scalable Internet Services and Load Balancing
Scalable Services and Load Balancing Kai Shen Services brings ubiquitous connection based applications/services accessible to online users through Applications can be designed and launched quickly and
Deploying DNSSEC: From End-Customer To Content
Deploying DNSSEC: From End-Customer To Content March 28, 2013 www.internetsociety.org Our Panel Moderator: Dan York, Senior Content Strategist, Internet Society Panelists: Sanjeev Gupta, Principal Technical
1 2014 2013 Infoblox Inc. All Rights Reserved. Talks about DNS: architectures & security
1 2014 2013 Infoblox Inc. All Rights Reserved. Talks about DNS: architectures & security Agenda Increasing DNS availability using DNS Anycast Opening the internal DNS Enhancing DNS security DNS traffic
3. The Domain Name Service
3. The Domain Name Service n Overview and high level design n Typical operation and the role of caching n Contents of DNS Resource Records n Basic message formats n Configuring/updating Resource Records
DNS SRV Usage June 22, 2011
DNS SRV Usage June 22, 2011 Proprietary 2011 Media5 Corporation Table of Contents Scope of this Document... 3 DNS SRV (RFC 2782)... 3 Deployment Scenario... 4 Mediatrix Unit Configuration... 5 Scenario
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Fast Flux Hosting and DNS ICANN SSAC
Fast Flux Hosting and DNS ICANN SSAC What is Fast Flux Hosting? An evasion technique Goal Avoid detection and take down of web sites used for illegal purposes Technique Host illegal content at many sites
Intelligent. Data Sheet
Cisco IPS Software Product Overview Cisco IPS Software is the industry s leading network-based intrusion prevention software. It provides intelligent, precise, and flexible protection for your business
Deep Security Vulnerability Protection Summary
Deep Security Vulnerability Protection Summary Trend Micro, Incorporated This documents outlines the process behind rules creation and answers common questions about vulnerability coverage for Deep Security
Cymon.io. Open Threat Intelligence. 29 October 2015 Copyright 2015 esentire, Inc. 1
Cymon.io Open Threat Intelligence 29 October 2015 Copyright 2015 esentire, Inc. 1 #> whoami» Roy Firestein» Senior Consultant» Doing Research & Development» Other work include:» docping.me» threatlab.io
Cisco IOS NetFlow Version 9 Flow-Record Format
Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: February 007 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their
LifeSize Transit Deployment Guide June 2011
LifeSize Transit Deployment Guide June 2011 LifeSize Tranist Server LifeSize Transit Client LifeSize Transit Deployment Guide 2 Firewall and NAT Traversal with LifeSize Transit Firewalls and Network Address
Scalable Internet Services and Load Balancing
Scalable Services and Load Balancing Kai Shen Services brings ubiquitous connection based applications/services accessible to online users through Applications can be designed and launched quickly and
VPN Lesson 2: VPN Implementation. Summary
VPN Lesson 2: VPN Implementation Summary 1 Notations VPN client (ok) Firewall Router VPN firewall VPN router VPN server VPN concentrator 2 Basic Questions 1. VPN implementation options for remote users
Arbor s Solution for ISP
Arbor s Solution for ISP Recent Attack Cases DDoS is an Exploding & Evolving Trend More Attack Motivations Geopolitical Burma taken offline by DDOS attack Protests Extortion Visa, PayPal, and MasterCard
Description: Course Details:
Course: Malicious Network Traffic Analysis Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: There are a tremendous amount of network based attacks to be aware of on the internet
DNSSM: A Large Scale Passive DNS Security Monitoring Framework
DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal 1, Jérôme François 1, Cynthia Wagner 1, Radu State 1, Alexandre Dulaunoy 2, Thomas Engel 1, Olivier Festor 3 1 SnT - University
Domain Name Abuse Detection. Liming Wang
Domain Name Abuse Detection Liming Wang Outline 1 Domain Name Abuse Work Overview 2 Anti-phishing Research Work 3 Chinese Domain Similarity Detection 4 Other Abuse detection ti 5 System Information 2 Why?
CENSURFRIDNS a.k.a. UNCENSOREDDNS. Thomas Steen Rasmussen admin@censurfridns.dk
CENSURFRIDNS a.k.a. UNCENSOREDDNS Thomas Steen Rasmussen admin@censurfridns.dk Agenda Introduction DNS blocking in Denmark What is UncensoredDNS? Why was it started? Issues with DNS blocking A basic conflict:
XN--P1AI (РФ) DNSSEC Policy and Practice Statement
XN--P1AI (РФ) DNSSEC Policy and Practice Statement XN--P1AI (РФ) DNSSEC Policy and Practice Statement... 1 INTRODUCTION... 2 Overview... 2 Document name and identification... 2 Community and Applicability...
NetFlow-Lite offers network administrators and engineers the following capabilities:
Solution Overview Cisco NetFlow-Lite Introduction As networks become more complex and organizations enable more applications, traffic patterns become more diverse and unpredictable. Organizations require
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi Agenda Introduction iscsi Attacks Enumeration Authorization Authentication iscsi Defenses Information Security Partners (isec) isec Partners Independent
New Trends in FastFlux Networks
New Trends in FastFlux Networks Wei Xu 408-753-4135 wei.xu@paloaltonetworks.com Huagang Xie 408-753-4109 hxie@paloaltonetworks.com Xinran Wang 408-753-4108 xwang@paloaltonetworks.com ABSTRACT Fast-flux
DNS and BIND. David White
DNS and BIND David White DNS: Backbone of the Internet Translates Domains into unique IP Addresses i.e. developcents.com = 66.228.59.103 Distributed Database of Host Information Works seamlessly behind
Integrated Approach to Network Security. Lee Klarich Senior Vice President, Product Management March 2013
Integrated Approach to Network Security Lee Klarich Senior Vice President, Product Management March 2013 Real data from actual networks 2 2012, Palo Alto Networks. Confidential and Proprietary. 2008: HTTP,
Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology
SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2
LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains
LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way
Network traffic monitoring and management. Sonia Panchen sonia.panchen@inmon.com 11 th November 2010
Network traffic monitoring and management Sonia Panchen sonia.panchen@inmon.com 11 th November 2010 Lecture outline What is network traffic management? Traffic management applications Traffic monitoring
Lightweight DNS for Multipurpose and Multifunctional Devices
IJCSNS International Journal of Computer Science and Network Security, VOL.13 No.12, December 2013 71 Lightweight DNS for Multipurpose and Multifunctional Devices Yogesh A. Wagh 1, Prashant A. Dhangar
Managing DNS Server Properties
CHAPTER 17 Managing DNS Server Properties This chapter explains how to set the DNS server parameters. Before you proceed with the tasks in this chapter, read Chapter 15, Managing Zones, which explains
Cisco IOS NetFlow Version 9 Flow-Record Format
White Paper Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: May 0 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their
DNS Security Survey for National Computer Security Incident Response Teams December 2010
DNS Security Survey for National Computer Security Incident Response Teams December 2010 Summary As referenced during the ICANN meeting in Brussels, Belgium in June 2010, ICANN developed a survey on DNS
ANATOMY OF A DDoS ATTACK AGAINST THE DNS INFRASTRUCTURE
ANATOMY OF A DDoS ATTACK AGAINST THE DNS INFRASTRUCTURE ANATOMY OF A DDOS ATTACK AGAINST THE DNS INFRASTRUCTURE The Domain Name System (DNS) is part of the functional infrastructure of the Internet and
Leading The World Into Connected Security. Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA
Leading The World Into Connected Security Dipl.-Inform., CISSP, S+ Rolf Haas Enterprise Technology Specialist Content Lead EMEA History of Defining Largest Dedicated Delivering a Next Generation Architecture
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation s Course,
Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com>
Defending your DNS in a post-kaminsky world Paul Wouters Overview History of DNS and the Kaminsky attack Various DNS problems explained Where to address the DNS problem Nameservers,
Flash Crowds & Denial of Service Attacks
Flash Crowds & Denial of Service Attacks Characterization and Implications for CDNs and Web sites Jaeyeon Jung MIT Laboratory for Computer Science Balachander Krishnamurthy and Michael Rabinovich AT&T
TECHNICAL REPORT. An Analysis of Domain Silver, Inc..pl Domains
TECHNICAL REPORT An Analysis of Domain Silver, Inc..pl Domains July 31, 2013 CONTENTS Contents 1 Introduction 2 2 Registry, registrar and registrant 3 2.1 Rogue registrar..................................
Practical Experience with IPFIX Flow Collectors
Practical Experience with IPFIX Flow Collectors Petr Velan CESNET, z.s.p.o. Zikova 4, 160 00 Praha 6, Czech Republic petr.velan@cesnet.cz Abstract As the number of Internet applications grows, the number
Role of Firewall in Network. Security. Syed S. Rizvi. CS 872: Computer Network Security. Fall 2005
Role of Firewall in Network Security By Syed S. Rizvi CS 872: Computer Network Security Fall 2005 Outline o Background o What is a Firewall? o What does a Firewall do? o Implementation of Firewall o Interaction
How the Great Firewall discovers hidden circumvention servers. Roya Ensafi David Fifield Philipp Winter Nick Weaver Nick Feamster Vern Paxson
How the Great Firewall discovers hidden circumvention servers Roya Ensafi David Fifield Philipp Winter Nick Weaver Nick Feamster Vern Paxson Much already known about GFW Numerous research papers and blog
Application Note: Cisco Integration with Onsight Connect
Application Note: Cisco Integration with Onsight Connect Table of Contents Application Note:... 1 Cisco Integration with Onsight Connect... 3 Direct Onsight Device to Cisco Endpoint Calls... 3 Cisco Unified
DDoS ATTACKS: MOTIVES, MECHANISMS AND MITIGATION
DDoS ATTACKS: MOTIVES, MECHANISMS AND MITIGATION Stephen Gates Chief Security Evangelist Corero Network Security Session ID: SEC-W04 Session Classification: Intermediate Recent Headlines Are Denial of
Exercise 7 Network Forensics
Exercise 7 Network Forensics What Will You Learn? The network forensics exercise is aimed at introducing you to the post-mortem analysis of pcap file dumps and Cisco netflow logs. In particular you will:
FAQ (Frequently Asked Questions)
FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias
Detecting Search Lists in Authoritative DNS
Detecting Search Lists in Authoritative DNS Andrew Simpson March 10 th, 2014 Summary Early research into name collisions has postulated that search list interaction drives some portion of the DNS requests
Information- Centric Networks. Section # 3.2: DNS Issues Instructor: George Xylomenos Department: Informatics
Information- Centric Networks Section # 3.2: DNS Issues Instructor: George Xylomenos Department: Informatics Funding These educational materials have been developed as part of the instructors educational
Inspecting DNS Flow Traffic for Purposes of Botnet Detection
Inspecting DNS Flow Traffic for Purposes of Botnet Detection Vojtěch Krmíček, GEANT3 JRA2 T4 Internal Deliverable 2011 Abstract The goal of this report is to examine DNS IP flow traffic and its relation
From Georgia, with Love Win32/Georbot. Is someone trying to spy on Georgians?
From Georgia, with Love Win32/Georbot Is someone trying to spy on Georgians? At the beginning of the year, a curious piece of malware came to our attention. An analyst in our virus laboratory noticed that
Building a Dynamic Reputation System for DNS
Building a Dynamic Reputation System for DNS Manos Antonakakis, Roberto Perdisci, David Dagon, Wenke Lee, and Nick Feamster College of Computing, Georgia Institute of Technology, {manos,rperdisc,dagon,wenke,feamster}@cc.gatech.edu
ENTRADA: Enabling DNS Big Data Applications
ENTRADA: Enabling DNS Big Data Applications Maarten Wullink - SIDN APWG ecrime 2016 June 2 nd 2016 - Toronto What if You have many TB s of network data? And you want to: 1. Store it efficiently 2. Query
Barracuda Intrusion Detection and Prevention System
Providing complete and comprehensive real-time network protection Today s networks are constantly under attack by an ever growing number of emerging exploits and attackers using advanced evasion techniques
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
Chapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4)
Chapter 3 TCP/IP Networks 3.1 Internet Protocol version 4 (IPv4) Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest
Monitoring high-speed networks using ntop. Luca Deri <deri@ntop.org>
Monitoring high-speed networks using ntop Luca Deri 1 Project History Started in 1997 as monitoring application for the Univ. of Pisa 1998: First public release v 0.4 (GPL2) 1999-2002:
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis Leyla Bilge, Engin Kirda, Christopher Kruegel, and Marco Balduzzi Institute Eurecom, Sophia Antipolis {bilge,kirda,balduzzi}@eurecom.fr Northeastern
Configuring Basic Settings
CHAPTER 10 This chapter describes how to configure basic settings on your ASA that are typically required for a functioning configuration. This chapter includes the following sections: Configuring the
Plugging Network Security Holes using NetFlow. Loopholes in todays network security solutions and how NetFlow can help
Plugging Network Security Holes using NetFlow Loopholes in todays network security solutions and how NetFlow can help About ManageEngine Network Servers & Applications Desktop ServiceDesk Windows Infrastructure
DNS based Load Balancing with Fault Tolerance
DNS based Load Balancing with Fault Tolerance by Kåre Presttun, Oslo, Norway Kare@Presttun.org Introduction There are several load-balancing systems on the market. They range from local switch based load
Network Fundamentals. 2010 Carnegie Mellon University
Network Fundamentals What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working Together