Detecting Botnets with NetFlow
|
|
|
- Esther Wade
- 8 years ago
- Views:
Transcription
1 Detecting Botnets with NetFlow V. Krmíček, T. Plesník {vojtec FloCon 2011, January 12, Salt Lake City, Utah
2 Presentation Outline NetFlow Monitoring at MU Chuck Norris Botnet in a Nutshell Botnet Detection Methods NfSen Botnet Detection Plugin Conclusion Krmíček, Plesník Detecting Botnets with NetFlow 2 / 28
3 Part I NetFlow Monitoring at MU Krmíček, Plesník Detecting Botnets with NetFlow 3 / 28
4 Masaryk University, Brno, Czech Republic 9 faculties: 200 departments and institutes students and employees networked hosts 2x 10 gigabit uplinks to CESNET Interval Flows Packets Bytes Second 5 k 150 k 132 M Minute 300 k 9 M 8 G Hour 15 M 522 M 448 G Day 285 M 9.4 G 8 T Week 1.6 G 57 G 50 T Number of Flows in MU Network (5-minute Window) Average traffic volume at the edge links in peak hours. 0 Mon Tue Wed Thu Fri Sat Sun Krmíček, Plesník Detecting Botnets with NetFlow 4 / 28
5 FlowMon Probes at Masaryk University Campus FlowMon probes: 25 NetFlow collectors: 6 Krmíček, Plesník Detecting Botnets with NetFlow 5 / 28
6 NetFlow Monitoring at Masaryk University FlowMon probe FlowMon probe FlowMon probe NetFlow data generation Krmíček, Plesník Detecting Botnets with NetFlow 6 / 28
7 NetFlow Monitoring at Masaryk University FlowMon probe FlowMon probe NetFlow v5/v9 NetFlow collector FlowMon probe NetFlow data generation NetFlow data collection Krmíček, Plesník Detecting Botnets with NetFlow 6 / 28
8 NetFlow Monitoring at Masaryk University FlowMon probe SPAM detection FlowMon probe NetFlow v5/v9 NetFlow collector worm/virus detection intrusion detection FlowMon probe NetFlow data generation NetFlow data collection NetFlow data analyses Krmíček, Plesník Detecting Botnets with NetFlow 6 / 28
9 NetFlow Monitoring at Masaryk University FlowMon probe FlowMon probe SPAM detection NetFlow v5/v9 worm/virus detection NetFlow collector intrusion detection FlowMon probe NetFlow data generation Krmíček, Plesník http WWW mail mailbox syslog syslog server NetFlow data collection NetFlow data analyses Detecting Botnets with NetFlow incident reporting 6 / 28
10 From NetFlow Monitoring to Botnet Discovery Network Behaviour Analysis at MU Identifies malware from NetFlow data. Watch what s happening inside the network 24/7. Single purpose detection patterns (scanning, botnets,...). Complex models of the network behavior. Even Chuck Norris Can t Resist NetFlow Monitoring Unusual worldwide TELNET scan attempts. Mostly comming from ADSL connections. New botnet Chuck Norris discovered at December Detailed analysis followed. Krmíček, Plesník Detecting Botnets with NetFlow 7 / 28
11 Part II Chuck Norris Botnet in a Nutshell Krmíček, Plesník Detecting Botnets with NetFlow 8 / 28
12 Chuck Norris Botnet Linux malware IRC bots with central C&C servers. Attacks poorly-configured Linux MIPSEL devices. Vulnerable devices ADSL modems and routers. Uses TELNET brute force attack for infection. Users are not aware about the malicious activities. Missing anti-malware solution to detect it. Discovered at Masaryk University on 2 December The malware got the Chuck Norris moniker from a comment in its source code [R]anger Killato : in nome di Chuck Norris! Krmíček, Plesník Detecting Botnets with NetFlow 9 / 28
13 Botnet Lifecycle Scanning for vulnerable devices in predefined networks IP prefixes of ADSL networks of worldwide operators network scanning # pnscan -n /24 23 Infection of a vulnerable device TELNET dictionary attack 15 default passwords admin, password, root, 1234, dreambox, blank password IRC bot initialization IRC bot download and execution on infected device # wget Botnet C&C operations further bots spreading and C&C commands execution DNS spoofing and denial-of-service attacks Krmíček, Plesník Detecting Botnets with NetFlow 10 / 28
14 More about Chuck Norris Botnet Chuck Norris botnet lifecycle in details and further information are available at the CYBER project page: stop remote access (ports 22-80) STOP infected device bot 1. join ##soldiers## 2. Topic:!* init-cmd (get scan-tools) C&C (IRC) server 3. wget scan-tools web server Krmíček, Plesník Detecting Botnets with NetFlow 11 / 28
15 Part III Botnet Detection Methods Krmíček, Plesník Detecting Botnets with NetFlow 12 / 28
16 Detection Methods Overview Five Detection Methods Telnet scan detection. Connections to botnet distribution sites detection. Connections to botnet C&C centers detection. DNS spoofing attack detection. ADSL string detection. Methods Correspond to Botnet Lifecycle Applied to NetFlow Data Defined as NFDUMP filters. Implemented to NfSen collector. Krmíček, Plesník Detecting Botnets with NetFlow 13 / 28
17 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. infected device NFDUMP detection filter: Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
18 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. infected device local network NFDUMP detection filter: (net local_network) Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
19 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. list of C class networks to scan infected device x x x x local network NFDUMP detection filter: (net local_network) Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
20 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. list of C class networks to scan infected device TCP/ x x x x local network NFDUMP detection filter: (net local_network) and (dst port 23) and (proto TCP) Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
21 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. list of C class networks to scan infected device TCP/ x x x x x local network x NFDUMP detection filter: (net local_network) and (dst port 23) and (proto TCP) Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
22 Telnet Scan Detection Phase I Incoming and outgoing TCP SYN scans on port 23. list of C class networks to scan infected device TCP/23 SYN/RESET flags x x x x x local network x NFDUMP detection filter: (net local_network) and (dst port 23) and (proto TCP) and ((flags S and not flags ARPUF) or (flags SR and not flags APUF)) Krmíček, Plesník Detecting Botnets with NetFlow 14 / 28
23 Connections to Botnet Distribution Sites Phase II Bot s web download requests from infected host. local network NFDUMP detection filter: 1 IP addresses of attacker s botnet distribution web servers Krmíček, Plesník Detecting Botnets with NetFlow 15 / 28
24 Connections to Botnet Distribution Sites Phase II Bot s web download requests from infected host. infected device local network NFDUMP detection filter: (src net local_network) 1 IP addresses of attacker s botnet distribution web servers Krmíček, Plesník Detecting Botnets with NetFlow 15 / 28
25 Connections to Botnet Distribution Sites Phase II Bot s web download requests from infected host. botnet distribution web server botnet distribution web server infected device local network botnet distribution web server NFDUMP detection filter: (src net local_network) and (dst ip web_servers 1 ) 1 IP addresses of attacker s botnet distribution web servers Krmíček, Plesník Detecting Botnets with NetFlow 15 / 28
26 Connections to Botnet Distribution Sites Phase II Bot s web download requests from infected host. botnet distribution web server botnet distribution web server TCP/80 infected device local network botnet distribution web server NFDUMP detection filter: (src net local_network) and (dst ip web_servers 1 ) and (dst port 80) and (proto TCP) 1 IP addresses of attacker s botnet distribution web servers Krmíček, Plesník Detecting Botnets with NetFlow 15 / 28
27 Connections to Botnet Distribution Sites Phase II Bot s web download requests from infected host. botnet distribution web server botnet distribution web server TCP/80 SYN/ACK flags infected device local network botnet distribution web server NFDUMP detection filter: (src net local_network) and (dst ip web_servers 1 ) and (dst port 80) and (proto TCP) and (flags SA and not flag R) 1 IP addresses of attacker s botnet distribution web servers Krmíček, Plesník Detecting Botnets with NetFlow 15 / 28
28 Connections to Botnet C&C Center Phase III Bot s IRC traffic with command and control center. local network NFDUMP detection filter: 2 IP address of an attacker s IRC server (Botnet C&C center) Krmíček, Plesník Detecting Botnets with NetFlow 16 / 28
29 Connections to Botnet C&C Center Phase III Bot s IRC traffic with command and control center. infected device local network NFDUMP detection filter: (src net local_network) 2 IP address of an attacker s IRC server (Botnet C&C center) Krmíček, Plesník Detecting Botnets with NetFlow 16 / 28
30 Connections to Botnet C&C Center Phase III Bot s IRC traffic with command and control center. botnet C&C server infected device local network NFDUMP detection filter: (src net local_network) and (dst ip IRC_server 2 ) 2 IP address of an attacker s IRC server (Botnet C&C center) Krmíček, Plesník Detecting Botnets with NetFlow 16 / 28
31 Connections to Botnet C&C Center Phase III Bot s IRC traffic with command and control center. botnet C&C server TCP/1200 infected device local network NFDUMP detection filter: (src net local_network) and (dst ip IRC_server 2 ) and (dst port 1200) and (proto TCP) 2 IP address of an attacker s IRC server (Botnet C&C center) Krmíček, Plesník Detecting Botnets with NetFlow 16 / 28
32 Connections to Botnet C&C Center Phase III Bot s IRC traffic with command and control center. botnet C&C server TCP/1200 SYN/ACK flags infected device local network NFDUMP detection filter: (src net local_network) and (dst ip IRC_server 2 ) and (dst port 1200) and (proto TCP) and (flags SA and not flag R) 2 IP address of an attacker s IRC server (Botnet C&C center) Krmíček, Plesník Detecting Botnets with NetFlow 16 / 28
33 DNS Spoofing Attack Detection Phase IV Attacker s DNS or OpenDNS Queries Common DNS requests forwarded to OpenDNS servers. Targeted DNS requests forwarded to attacker s spoofed DNS. DNS Queries Outside Local Network Used for Phishing Attacks local network E.g. Facebook or banking sites. NFDUMP detection filter: 3 IP addresses of a common OpenDNS servers 4 IP addresses of a spoofed attacker s DNS servers Krmíček, Plesník Detecting Botnets with NetFlow 17 / 28
34 DNS Spoofing Attack Detection Phase IV Attacker s DNS or OpenDNS Queries Common DNS requests forwarded to OpenDNS servers. Targeted DNS requests forwarded to attacker s spoofed DNS. DNS Queries Outside Local Network Used for Phishing Attacks E.g. Facebook or banking sites. NFDUMP detection filter: (src net local_network) infected device local network 3 IP addresses of a common OpenDNS servers 4 IP addresses of a spoofed attacker s DNS servers Krmíček, Plesník Detecting Botnets with NetFlow 17 / 28
35 DNS Spoofing Attack Detection Phase IV Attacker s DNS or OpenDNS Queries Common DNS requests forwarded to OpenDNS servers. Targeted DNS requests forwarded to attacker s spoofed DNS. OpenDNS server DNS Queries Outside Local Network Used for Phishing Attacks E.g. Facebook or banking sites. infected device local network NFDUMP detection filter: (src net local_network) and ((dst ip OpenDNS servers 3 ) or 3 IP addresses of a common OpenDNS servers 4 IP addresses of a spoofed attacker s DNS servers Krmíček, Plesník Detecting Botnets with NetFlow 17 / 28
36 DNS Spoofing Attack Detection Phase IV Attacker s DNS or OpenDNS Queries Common DNS requests forwarded to OpenDNS servers. Targeted DNS requests forwarded to attacker s spoofed DNS. spoofed DNS server OpenDNS server DNS Queries Outside Local Network Used for Phishing Attacks E.g. Facebook or banking sites. infected device local network NFDUMP detection filter: (src net local_network) and ((dst ip OpenDNS servers 3 ) or (dst ip DNS servers 4 )) 3 IP addresses of a common OpenDNS servers 4 IP addresses of a spoofed attacker s DNS servers Krmíček, Plesník Detecting Botnets with NetFlow 17 / 28
37 DNS Spoofing Attack Detection Phase IV Attacker s DNS or OpenDNS Queries Common DNS requests forwarded to OpenDNS servers. Targeted DNS requests forwarded to attacker s spoofed DNS. spoofed DNS server UDP/53 OpenDNS server DNS Queries Outside Local Network Used for Phishing Attacks E.g. Facebook or banking sites. infected device local network NFDUMP detection filter: (src net local_network) and ((dst ip OpenDNS servers 3 ) or (dst ip DNS servers 4 )) and (proto UDP) and (dst port 53) 3 IP addresses of a common OpenDNS servers 4 IP addresses of a spoofed attacker s DNS servers Krmíček, Plesník Detecting Botnets with NetFlow 17 / 28
38 ADSL String Detection Looking for ADSL String ADSL string indicates Chuck Norris botnet. Searching in victim s hostname or victim s WHOIS. Quering DNS server and parsing recieved hostname. Quering WHOIS database and parsing recieved info. adsl Krmíček, Plesník Detecting Botnets with NetFlow 18 / 28
39 Detected Chuck Norris Servers Known IP Addresses Web server addresses: , IRC server addresses: , IRC server port: OpenDNS server addresses: , Spoofed DNS server: This data is used in detection methods by default. IP addresses updates are published at project page. Krmíček, Plesník Detecting Botnets with NetFlow 19 / 28
40 Part IV NfSen Botnet Detection Plugin Krmíček, Plesník Detecting Botnets with NetFlow 20 / 28
41 Botnet Detection Plugin Plugin Features Detects Chuck Norris-like botnet behavior. Based on NetFlow and other network data sources. Processes data regularly and provides real-time output. Plugin Architecture Compliant with NfSen plugins architecture recommendations. PHP frontend with a Perl backend and a PostgreSQL DB. Web, and syslog detection output and reporting. Krmíček, Plesník Detecting Botnets with NetFlow 21 / 28
42 Plugin Architecture BACKEND FRONTEND Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
43 Plugin Architecture BACKEND FRONTEND cndet.pm Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
44 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
45 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
46 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface cndetdb.pm Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
47 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface cndetdb.pm NetFlow data DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
48 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface PostgreSQL cndetdb.pm NetFlow data DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
49 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface PostgreSQL cndetdb.pm NetFlow data DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
50 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface PostgreSQL cndetdb.pm NetFlow data DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
51 Plugin Architecture BACKEND FRONTEND cndet.pm cndet.php nfsend comm. interface PostgreSQL cndetdb.pm NetFlow data DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 22 / 28
52 Plugin Methods Architecture cndetdb.pm Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
53 Plugin Methods Architecture cndetdb.pm NetFlow data PostgreSQL DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
54 Plugin Methods Architecture cndetdb.pm Telnet scan detection NetFlow data PostgreSQL DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
55 Plugin Methods Architecture cndetdb.pm Telnet scan detection Botnet distribution sites detection NetFlow data PostgreSQL DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
56 Plugin Methods Architecture cndetdb.pm Telnet scan detection Botnet distribution sites detection NetFlow data Botnet C&C centers detection PostgreSQL DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
57 Plugin Methods Architecture cndetdb.pm Telnet scan detection Botnet distribution sites detection NetFlow data Botnet C&C centers detection DNS spoofing attack detection PostgreSQL DNS WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
58 Plugin Methods Architecture cndetdb.pm Telnet scan detection Botnet distribution sites detection NetFlow data Botnet C&C centers detection DNS spoofing attack detection PostgreSQL DNS ADSL string detection WHOIS db Krmíček, Plesník Detecting Botnets with NetFlow 23 / 28
59 Web Interface Infected Host Detected Krmíček, Plesník Detecting Botnets with NetFlow 24 / 28
60 Part V Conclusion Krmíček, Plesník Detecting Botnets with NetFlow 25 / 28
61 Detection Plugin and Other Botnets Botnet Lifecycle Similar for Majority of Botnets scanning for possible bots infection of a vulnerable devices bot initialization/update botnet operation Botnet Detection Plugin Customization modular plugin engine easy modification for detection of other botnet we need to customize detection methods plugin distributed under the BSD license Krmíček, Plesník Detecting Botnets with NetFlow 26 / 28
62 Conclusion Network Devices Are Not Protected Routers, access points, printers, cameras, TVs,... No AV software, missing patches and firmware updates. But they should be protected! Experience Future NetFlow can monitor all such devices in network. Discovery of new Chuck Norris botnet using NetFlow. Developed a specialized NfSen plugin for Chuck Norris botnet detection. Chuck Norris is down, but others are coming (e.g., Stuxnet). We are open to research collaboration. Detection plugin is available at our project site. Krmíček, Plesník Detecting Botnets with NetFlow 27 / 28
63 Thank You For Your Attention! Detecting Botnets with NetFlow Vojtěch Krmíček Tomáš Plesník vojtec Project CYBER This material is based upon work supported by the Czech Ministry of Defence under Contract No. OVMASUN Krmíček, Plesník Detecting Botnets with NetFlow 28 / 28
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior
Revealing Botnets Using Network Traffic Statistics
Revealing Botnets Using Network Traffic Statistics P. Čeleda, R. Krejčí, V. Krmíček {celeda vojtec}@ics.muni.cz, radek.krejci@mail.muni.cz Security and Protection of Information 2011, 10-12 May 2011, Brno,
Network Security Monitoring and Behavior Analysis Best Practice Document
Network Security Monitoring and Behavior Analysis Best Practice Document Produced by CESNET led working group on network monitoring (CBPD133) Author: Pavel Čeleda September 2011 TERENA 2011. All rights
NfSen Plugin Supporting The Virtual Network Monitoring
NfSen Plugin Supporting The Virtual Network Monitoring Vojtěch Krmíček krmicek@liberouter.org Pavel Čeleda celeda@ics.muni.cz Jiří Novotný novotny@cesnet.cz Part I Monitoring of Virtual Network Environments
nfdump and NfSen 18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH
18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH Some operational questions, popping up now and then: Do you see this peek on port 445 as well? What caused this peek on your
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag 2005 SWITCH What I am going to present: The Motivation. What are NfSen and nfdump? The Tools in Action. Outlook
Automatic Network Protection Scenarios Using NetFlow
Automatic Network Protection Scenarios Using NetFlow Vojt ch Krmí ek, Jan Vykopal {krmicek vykopal}@ics.muni.cz FloCon 2012 January 9-12, Austin, Texas Part I Flow-based Network Protection Krmicek et al.
Flow-based detection of RDP brute-force attacks
Flow-based detection of RDP brute-force attacks Martin Vizváry vizvary@ics.muni.cz Institute of Computer Science Masaryk University Brno, Czech Republic Jan Vykopal vykopal@ics.muni.cz Institute of Computer
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Exercise 7 Network Forensics
Exercise 7 Network Forensics What Will You Learn? The network forensics exercise is aimed at introducing you to the post-mortem analysis of pcap file dumps and Cisco netflow logs. In particular you will:
From traditional to alternative approach to storage and analysis of flow data. Petr Velan, Martin Zadnik
From traditional to alternative approach to storage and analysis of flow data Petr Velan, Martin Zadnik Introduction Network flow monitoring Visibility of network traffic Flow analysis and storage enables
FlowMon. Complete solution for network monitoring and security. INVEA-TECH info@invea-tech.com
FlowMon Complete solution for network monitoring and security INVEA-TECH info@invea-tech.com INVEA-TECH University spin-off company 10 years of development, participation in EU funded projects project
CSE 3482 Introduction to Computer Security. Denial of Service (DoS) Attacks
CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Network and Incident monitoring
August, 2013 Network and Incident monitoring Koichiro (Sparky) Komiyama Sam Sasaki JPCERT Coordination Center, Japan Agenda 1. Introduction of TSUBAME 2. Recent Observation cases 2 1. INTRODUCTION OF TSUBAME
An overview of traffic analysis using NetFlow
The LOBSTER project An overview of traffic analysis using NetFlow Arne Øslebø UNINETT Arne.Oslebo@uninett.no 1 Outline What is Netflow? Available tools Collecting Processing Detailed analysis security
Nemea: Searching for Botnet Footprints
Nemea: Searching for Botnet Footprints Tomas Cejka 1, Radoslav Bodó 1, Hana Kubatova 2 1 CESNET, a.l.e. 2 FIT, CTU in Prague Zikova 4, 160 00 Prague 6 Thakurova 9, 160 00 Prague 6 Czech Republic Czech
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
NFSEN - Update 13th TF-CSIRT Meeting 23. September 2004 Malta Peter Haag
NFSEN - Update 13th TF-CSIRT Meeting 23. September 2004 Malta Peter Haag 2004 SWITCH NFSEN ( NetFlow Sensor ) 12th TF-CSIRT Meeting Hamburg: 2004 SWITCH 2 NFSEN http://www.terena.nl/tech/task-forces/tf-csirt/meeting12/nfsen-haag.pdf
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.
Emerald Network Collector Version 4.0 Emerald Management Suite IEA Software, Inc. Table Of Contents Purpose... 3 Overview... 3 Modules... 3 Installation... 3 Configuration... 3 Filter Definitions... 4
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Analysis of Network Beaconing Activity for Incident Response
Analysis of Network Beaconing Activity for Incident Response FloCon2008 Peter Balland, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by under
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for
Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik
Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and
Description: Course Details:
Course: Malicious Network Traffic Analysis Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: There are a tremendous amount of network based attacks to be aware of on the internet
How To Create A Network Monitoring System (Flowmon) In Avea-Tech (For Free)
Network Traffic Performance & Security Monitoring Project proposal minimal project Orsenna;Invea-Tech FLOWMON PROBES 1000 & 100 Contents 1. Introduction... 2 1.1. General System Requirements... 2 1.2.
UNMASKCONTENT: THE CASE STUDY
DIGITONTO LLC. UNMASKCONTENT: THE CASE STUDY The mystery UnmaskContent.com v1.0 Contents I. CASE 1: Malware Alert... 2 a. Scenario... 2 b. Data Collection... 2 c. Data Aggregation... 3 d. Data Enumeration...
Firewall Firewall August, 2003
Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also
Denial of Service Attacks
2 Denial of Service Attacks : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013 its335y13s2l06, Steve/Courses/2013/s2/its335/lectures/malicious.tex,
Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document
Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document Produced by AMRES NMS Group (AMRES BPD 104) Author: Ivan Ivanović November 2011 TERENA 2010. All rights reserved.
Detecting peer-to-peer botnets
Detecting peer-to-peer botnets Reinier Schoof & Ralph Koning System and Network Engineering University of Amsterdam mail: reinier.schoof@os3.nl, ralph.koning@os3.nl February 4, 2007 1 Introduction Spam,
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX
Monitoring of Tunneled IPv6 Traffic Using Packet Decapsulation and IPFIX Martin Elich 1,3, Matěj Grégr 1,2 and Pavel Čeleda1,3 1 CESNET, z.s.p.o., Prague, Czech Republic 2 Brno University of Technology,
Plugging Network Security Holes using NetFlow. Loopholes in todays network security solutions and how NetFlow can help
Plugging Network Security Holes using NetFlow Loopholes in todays network security solutions and how NetFlow can help About ManageEngine Network Servers & Applications Desktop ServiceDesk Windows Infrastructure
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
Network Monitoring and Management NetFlow Overview
Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
Team Cymru. Network Forensics. Ryan Connolly, ryan@cymru.com <http://www.cymru.com>
Team Cymru Network Forensics Ryan Connolly, ryan@cymru.com Network Forensics what does it mean? network forensics is the analysis of network events in order to discover the source
2010 Carnegie Mellon University. Malware and Malicious Traffic
Malware and Malicious Traffic What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working
Pilot Deployment of Metering Points at CESNET Border Links
CESNET Technical Report 5/2012 Pilot Deployment of Metering Points at CESNET Border Links VÁCLAV BARTOš, PAVEL ČELEDA, TOMÁš KREUZWIESER, VIKTOR PUš, PETR VELAN, MARTIN ŽÁDNÍK Received 12. 12. 2012 Abstract
Chapter 4 Managing Your Network
Chapter 4 Managing Your Network This chapter describes how to perform network management tasks with your ADSL2+ Modem Wireless Router. Backing Up, Restoring, or Erasing Your Settings The configuration
Security Toolsets for ISP Defense
Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
Introduction to Netflow
Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Log Management with Open-Source Tools. Risto Vaarandi rvaarandi 4T Y4H00 D0T C0M
Log Management with Open-Source Tools Risto Vaarandi rvaarandi 4T Y4H00 D0T C0M Outline Why do we need log collection and management? Why use open source tools? Widely used logging protocols and recently
DISTRIBUTED DENIAL OF SERVICE OBSERVATIONS
: DDOS ATTACKS DISTRIBUTED DENIAL OF SERVICE OBSERVATIONS 1 DISTRIBUTED DENIAL OF SERVICE OBSERVATIONS NTT is one of the largest Internet providers in the world, with a significant share of the world s
Flow Based Traffic Analysis
Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City murali@ncb.ernet.in Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode
Decoding DNS data. Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs
Decoding DNS data Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs The Domain Name System (DNS) is a core component of the Internet infrastructure,
Secure and Effective IT Infrastructure
Secure and Effective IT Infrastructure Purpose of this document The IT infrastructure complexity is increasing in today s modern world. New products are constantly being released as well as new types of
GregSowell.com. Mikrotik Security
Mikrotik Security IP -> Services Disable unused services Set Available From for appropriate hosts Secure protocols are preferred (Winbox/SSH) IP -> Neighbors Disable Discovery Interfaces where not necessary.
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning
HUNTING ATTACKERS WITH NETWORK AUDIT TRAILS
HUNTING ATTACKERS WITH NETWORK AUDIT TRAILS Tom Cross tcross@lancope.com Charles Herring cherring@lancope.com 1 CREATING THE AUDIT TRAIL 2 Creating the Trail Logging Provides user and application details
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
[Optional] Network Visibility with NetFlow
![[Optional] Network Visibility with NetFlow](/thumbs/35/17277520.jpg "[Optional] Network Visibility with NetFlow")
[Optional] Network Visibility with NetFlow TELE301 Laboratory Manual Contents 1 NetFlow Architecture........................... 1 2 NetFlow Versions.............................. 2 3 Requirements Analysis...........................
AT&T Real-Time Network Security Overview
AT&T Real-Time Network Security Overview Dan Solero Director of Security Technology, AT&T Know Your Enemy: Security Threats Extend Beyond Viruses & Worms Distributed Denial of Service Spam for Hire Social
Glasnost or Tyranny? You Can Have Secure and Open Networks!
AT&T is a proud sponsor of StaySafe Online Glasnost or Tyranny? You Can Have Secure and Open Networks! Steven Hurst CISSP Director - AT&T Security Services and Technology AT&T Chief Security Office 2009
SECURING INFORMATION SYSTEMS
SECURING INFORMATION SYSTEMS (November 9, 2015) BUS3500 - Abdou Illia - Fall 2015 1 LEARNING GOALS Understand security attacks preps Discuss the major threats to information systems. Discuss protection
VULNERABILITY ASSESSMENT WHITEPAPER INTRODUCTION, IMPLEMENTATION AND TECHNOLOGY DISCUSSION
VULNERABILITY ASSESSMENT WHITEPAPER INTRODUCTION, IMPLEMENTATION AND TECHNOLOGY DISCUSSION copyright 2003 securitymetrics Security Vulnerabilities of Computers & Servers Security Risks Change Daily New
Host Discovery with nmap
Host Discovery with nmap By: Mark Wolfgang moonpie@moonpie.org November 2002 Table of Contents Host Discovery with nmap... 1 1. Introduction... 3 1.1 What is Host Discovery?... 4 2. Exploring nmap s Default
Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000
Information Technology Information and Systems Security/Compliance Northwestern University 1800 Sherman Av Suite 209 Evanston, IL 60201 Email David-Kovarik@northwestern.edu Phone 847-467-5930 Fax 847-467-6000
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
Log Management with Open-Source Tools. Risto Vaarandi SEB Estonia
Log Management with Open-Source Tools Risto Vaarandi SEB Estonia Outline Why use open source tools for log management? Widely used logging protocols and recently introduced new standards Open-source syslog
Chapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
Network Monitoring Tool to Identify Malware Infected Computers
Network Monitoring Tool to Identify Malware Infected Computers Navpreet Singh Principal Computer Engineer Computer Centre, Indian Institute of Technology Kanpur, India navi@iitk.ac.in Megha Jain, Payas
Guidance Regarding Skype and Other P2P VoIP Solutions
Guidance Regarding Skype and Other P2P VoIP Solutions Ver. 1.1 June 2012 Guidance Regarding Skype and Other P2P VoIP Solutions Scope This paper relates to the use of peer-to-peer (P2P) VoIP protocols,
An Open Source IPS. IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan
An Open Source IPS IIT Network Security Project Project Team: Mike Smith, Sean Durkin, Kaebin Tan Introduction IPS or Intrusion Prevention System Uses a NIDS or Network Intrusion Detection System Includes
How To Protect A Dns Authority Server From A Flood Attack
the Availability Digest @availabilitydig Surviving DNS DDoS Attacks November 2013 DDoS attacks are on the rise. A DDoS attack launches a massive amount of traffic to a website to overwhelm it to the point
SECURING APACHE : DOS & DDOS ATTACKS - II
SECURING APACHE : DOS & DDOS ATTACKS - II How DDoS attacks are performed A DDoS attack has to be carefully prepared by the attackers. They first recruit the zombie army, by looking for vulnerable machines,
Firewall Server 7.2. Release Notes. What's New in Firewall Server 7.2
Firewall Server 7.2 Release Notes BorderWare Technologies is pleased to announce the release of version 7.2 of the Firewall Server. This release includes the following new features and improvements. What's
Port Scanning and Vulnerability Assessment. ECE4893 Internetwork Security Georgia Institute of Technology
Port Scanning and Vulnerability Assessment ECE4893 Internetwork Security Georgia Institute of Technology Agenda Reconnaissance Scanning Network Mapping OS detection Vulnerability assessment Reconnaissance
Attacks and Defense. Phase 1: Reconnaissance
Attacks and Defense Phase 1: Reconnaissance Phase 2: Port Scanning Phase 3: Gaining Access Using Application and Operating System Using Networks Phase 1: Reconnaissance Known as information gathering.
How To Mitigate A Ddos Attack
VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT ISSUE 3 3RD QUARTER 2014 CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS 4 Mitigations by Attack Size 4 Mitigations by Industry 5
Management, Logging and Troubleshooting
CHAPTER 15 This chapter describes the following: SNMP Configuration System Logging SNMP Configuration Cisco NAC Guest Server supports management applications monitoring the system over SNMP (Simple Network
How to protect your home/office network?
How to protect your home/office network? Using IPTables and Building a Firewall - Background, Motivation and Concepts Adir Abraham adir@vipe.technion.ac.il Do you think that you are alone, connected from
The HoneyNet Project Scan Of The Month Scan 27
The HoneyNet Project Scan Of The Month Scan 27 23 rd April 2003 Shomiron Das Gupta shomiron@lycos.co.uk 1.0 Scope This month's challenge is a Windows challenge suitable for both beginning and intermediate
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Revealing and Analysing Modem Malware
Revealing and Analysing Modem Malware Pavel Celeda Institute of Computer Science Masaryk University Botanicka 68a, 602 00 Brno celeda@ics.muni.cz Radek Krejci CESNET, z.s.p.o. Zikova 4,160 00 Praha 6 rkrejci@cesnet.cz
Tools for penetration tests 1. Carlo U. Nicola, HT FHNW With extracts from documents of : Google; Wireshark; nmap; Nessus.
Tools for penetration tests 1 Carlo U. Nicola, HT FHNW With extracts from documents of : Google; Wireshark; nmap; Nessus. What is a penetration test? Goals: 1. Analysis of an IT-environment and search
About Botnet, and the influence that Botnet gives to broadband ISP
About net, and the influence that net gives to broadband ISP Masaru AKAI BB Technology / SBB-SIRT Agenda Who are we? What is net? About Telecom-ISAC-Japan Analyzing code How does net work? BB Technology
Seminar Computer Security
Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example
Network Monitoring Based on IP Data Flows
Network Monitoring Based on IP Data Flows Best Practice Document Produced by CESNET led working group on Network monitoring (CBPD131) Author:MartinŽádník March2010 TERENA 2010. All rights reserved. Document
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally
7.7 DDoS : Unknown Secrets and Botnet Counter-Attack. www.issuemakerslab.com sionics & kaientt
7.7 DDoS : Unknown Secrets and Botnet Counter-Attack sionics & kaientt Contents Overview Botnet Structure 7.7 DDoS Bot Malware Analysis Botnet Counter-Attack Demo Overview 7.7 DDoS Attack Cyber attack
Network Monitoring Based on IP Data Flows Best Practice Document
Network Monitoring Based on IP Data Flows Best Practice Document Produced by CESNET led working group on Network monitoring (CBPD131) Authors: Martin Žádník March 2010 TERENA 2010. All rights reserved.
The anatomy of an online banking fraud
The anatomy of an online banking fraud or: Harvesting bank account data By Valentin Höbel. Mail to valentin@xenuser.org (March2010) I. What this document is about II. Introduction III. The anatomy of an
CS2107 Introduction to Information and System Security (Slid. (Slide set 8)
Networks, the Internet Tool support CS2107 Introduction to Information and System Security (Slide set 8) National University of Singapore School of Computing July, 2015 CS2107 Introduction to Information
Unless otherwise noted, all references to STRM refer to STRM, STRM Log Manager, and STRM Network Anomaly Detection.
TECHNICAL NOTE FORWARDING LOGS USING TAIL2SYSLOG MARCH 2013 The Tail2Syslog support script provides a method for monitoring and forwarding events to STRM using syslog for real-time correlation. Tail2Syslog
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
CS 356 Lecture 16 Denial of Service. Spring 2013
CS 356 Lecture 16 Denial of Service Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter
Richard Bejtlich richard@taosecurity.com www.taosecurity.com / taosecurity.blogspot.com BSDCan 14 May 04
Network Security Monitoring with Sguil Richard Bejtlich richard@taosecurity.com www.taosecurity.com / taosecurity.blogspot.com BSDCan 14 May 04 Overview Introduction to NSM The competition (ACID, etc.)
PANDORA FMS NETWORK DEVICE MONITORING
NETWORK DEVICE MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS is able to monitor all network devices available on the marke such as Routers, Switches, Modems, Access points,
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
F-Secure Internet Gatekeeper
F-Secure Internet Gatekeeper TOC F-Secure Internet Gatekeeper Contents Chapter 1: Welcome to F-Secure Internet Gatekeeper...5 1.1 Features...6 Chapter 2: Deployment...8 2.1 System requirements...9 2.2
TESTING OUR SECURITY DEFENCES
INFOSECURITY WITH PLYMOUTH UNIVERSITY TESTING OUR SECURITY DEFENCES Dr Maria Papadaki maria.papadaki@plymouth.ac.uk 1 1 Do we need to test our defences? Can penetration testing help to improve security?