Adventures in Cybercrime. Piotr Kijewski CERT Polska/NASK
|
|
|
- Chloe Alexander
- 8 years ago
- Views:
Transcription
1 Adventures in Cybercrime Piotr Kijewski CERT Polska/NASK
2 Would you like a Porsche? Porsche Cayenne S Turbo: USD
3 Or maybe a different type? Porsche 911 Turbo: USD
4 The car is there Porsche Cayenne S Turbo: Porsche 911 Turbo: USD Paunch (Dmitry Fedotov?): USD monthly src: krebsonsecurity.com,
5 And a luxurious lifestyle Hamza Bendelladj (bx1): mln USD for a transaction? src: krebsonsecurity.com, emirates.com
6 Losses seem huge * < INSERT ANY NUMBER OF $$$ REPORTED IN THE MEDIA HERE > * but also obviously hard to verify independently
7 What do we try to do about it as CERT.PL? Try to assess the situation from the local perspective (attribute numbers, at least based on what we receive) Look at threats that use Polish internet properties on a large scale for C&C purposes or target Polish users Look at threats that Try to do something about it Mostly malware/botnet related
8 Bots in Poland in over 15 mln unique IP/bot combinations registered 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% Conficker 40% Virut 15% ZeuS 12% Sality 9% ZeroAccess Pushdo ZeuS-P2P 4% 4% 6% Kelihos Cutwail Dorkbot 2% 2% 1% Other 5% Percentage = out of total bots registered
9 Daily maximum of unique IP/bot combinations throughout 2013 Conficker Sality ZeroAccess Virut Zeus/Citadel B58 Zeus P2P Ircbot Pushdo Kelihos Overall using this methodology: 170k unique IP/bots seen daily
10 Much C&C infra for a lot of botnets ZeuS Citadel ZeuS ICE IX Virut Sality Dorkbot/Ngrbot Andromeda/Gamrue RunForestRun was in Poland
11 Changes in the.ru cctld.ru Registry introduced changes that enabled takedowns of domains and then A few days ago Jindrich Kubec (Avast) pinged me that the RunForestRun malware changed the domain generating algorithm (DGA) and now uses waw.pl subdomains (instead of.ru) in malicious URLs.
12 CASE STUDY #1: VIRUT
13 Virut Virut botnet, controlled from Poland Basic method of spreading: PE file infection (later versions also spread by HTML files, drive-bys) Business model: pay-per-install schemes, rented out Involved in financial theft, DDoS, spam etc. Centrally managed over an IRC based protocol Operational since 2006 Tons of variants
14 Virut in statistics Kaspersky 2012
15 Virut botnet takeover Jan/Feb 2013: NASK in coordination with multiple other parties took over all known Virut domains worldwide. Over 82 domains taken down 43.pl, 30.ru, 8.at i 1.org and redirected Sinkhole established: sinkhole.cert.pl
16 Virut snapshot at the moment of takeover
17 Virut sinkholed
18 Domain hijacking & DGA Fallback mechanism when communicating with unauthenticated C&C 2048 bit RSA crypto, SHA-256 To recognize C&C (incl. static ones) as legitimate waits for signed date (+/- 3 days) and IP, else disconnects after 30 seconds To recognize DGA domain as legitimate, needs signed domain name, obtained after connecting to port 443 (waits for 20 seconds, then disconnects) Up to 10k domains can be used daily 6 characters long,.com TLD But this seems to vary
19 BANKING TROJANS - POLAND
20 Man in the Browser
21 Web-inject Target URL : */our internet bank/* data_before <head> data_after <body> data_inject <script type= text/javascript src= > </script>
22 Automatic Transfer System
23 Erroneous transfer
24 Defined transfer
25 CASE STUDY #2: POWERZEUS
26
27 PowerZeus/KINS Started targeting Polish users around July 2013 Combines 3 features: webinjects (Zeus), plugin API (SpyEye), code injection methods used by Power Loader (Alureon) Modules downloaded by framework (essentially what PowerZeus is) Includes a module we called zeus-dll (encrypted on disk) This particular instance aimed at installing the poland.apk, polska.apk, e-security.apk on an Android This instance used.ru domains for C&C
28 get info Command features + steganography starts with #, phone no. somewhere in message new number fin starts with /, phone no. somewhere in message starts with, uninstall starts with!
29 Spanish connection fonyou.es turns out C&C number was virtual
30 Sinkhole stats unique IPs/day Sample date: 12/11/2013
31 CASE STUDY #3: DOMAIN SILVER
32 Domain Silver, Inc Seychelles based Registrar, active in.pl since June 2012 Q4 2012: an increase in domains registered through this Registrar, mostly for C&C purposes Weak reaction to abuse notifications Slow suspension of domains, apparently to allow for the botnets involved to hop to other C&C domains Despite numerous requests, the malicious registrations continued
33 Domain Silver, Inc Q1-Q2 2013: takeover of about 100 domains used for C&C Formal request to cease malicious registrations Domain Silver, Inc, claimed to comply but the malicious registrations continued 30th July 2013: NASK terminated its agreement with Domain Silver, Inc.
34 Domain Silver, Inc Overall, out of 641 domains registered on the 9th of July 2013 (plus sinkholed previously), all active ones turned out to be malicious apart from domainsilver.pl itself Over 20 different botnets taken over or disrupted: including ransomware cases
35 Sort of cloud services
36 Distribution of botnets registered through Domain Silver, Inc
37 CASE STUDY #4: SOHO ROUTER HACKING
38 SOHO Router Case
39 Scenario 1
40 Scenario 1 The following piece of code was injected at the end of the HTML: <script> jquery(document).ready(function() { jquery('a[href*="ebgz.pl"]').attr('href',' jquery('li p a.button.green').attr('href',' }); </script>
41 Scenario 1
42 Scenario 2
43 The trend we see: hacking the mind src:
44 Contact: Web:
TECHNICAL REPORT. An Analysis of Domain Silver, Inc..pl Domains
TECHNICAL REPORT An Analysis of Domain Silver, Inc..pl Domains July 31, 2013 CONTENTS Contents 1 Introduction 2 2 Registry, registrar and registrant 3 2.1 Rogue registrar..................................
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION
VIRUS TRACKER CHALLENGES OF RUNNING A LARGE SCALE SINKHOLE OPERATION Kleissner & Associates Botconf 14, 3-5 Dec 2014, Nancy/France Worlds largest botnet monitoring system Since September 2012 Originally
Report. Takeover of Virut domains
Report Takeover of Virut domains February 25, CONTENTS Contents 1 Executive summary 2 2 Introduction 2 2.1 What is Virut?................................ 2 2.2 Takeover of Virut domains..........................
Botnets: The Advanced Malware Threat in Kenya's Cyberspace
Botnets: The Advanced Malware Threat in Kenya's Cyberspace AfricaHackon 28 th February 2014 Who we Are! Paula Musuva-Kigen Research Associate Director, Centre for Informatics Research and Innovation (CIRI)
The art of sinkholing. Tomasz Bukowski CERT Polska / NASK
The art of sinkholing Tomasz Bukowski CERT Polska / NASK About WHOIS Name:Tomasz Bukowski (tomasz.bukowski@cert.pl) Works in CERT Polska/NASK 5 years in IRT Fight malware && monitor botnets Linux user
Botnets Die Hard Owned and Operated
Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University Aditya K Sood About Us PhD
Security Incidents And Trends In Croatia. Domagoj Klasić dklasic@cert.hr
Security Incidents And Trends In Croatia Domagoj Klasić dklasic@cert.hr Croatian National CERT About us Founded in 2008. in accordance with the Information Security Act We are a department of the Croatian
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
ENEE 757 CMSC 818V. Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park
21. Botnets ENEE 757 CMSC 818V Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park http://ter.ps/757 https://www.facebook.com/sdsatumd Today s Lecture Where we ve been AuthenDcaDon
REPORT on the cyber security alerts received by CERT-RO during 2013
ROMANIAN NATIONAL COMPUTER SECURITY INCIDENT RESPONSE TEAM REPORT on the cyber security alerts received by CERT-RO during 2013 http://www.cert-ro.eu - Blank page 2 / 21 CONTENTS 1. Summary of the report...
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
Detecting peer-to-peer botnets
Detecting peer-to-peer botnets Reinier Schoof & Ralph Koning System and Network Engineering University of Amsterdam mail: reinier.schoof@os3.nl, ralph.koning@os3.nl February 4, 2007 1 Introduction Spam,
Report on Cyber Security Alerts Processed by CERT-RO in 2014
Section III - Cyber-Attacks Evolution and Cybercrime Trends Report on Cyber Security Alerts Processed by CERT-RO in 2014 Romanian National Computer Security Incident Response Team office@cert-ro.eu The
Microsoft Security Response Center (MSRC) Microsoft Malware Protection Center (MMPC)
Security@Microsoft Trustworthy Computing (TwC) Programs supporting security outreach and engagement Microsoft Active Protections Program (MAPP), Government Security Program (GSP) (was SCP) Microsoft Security
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS
WHEN THE HUNTER BECOMES THE HUNTED HUNTING DOWN BOTNETS USING NETWORK TRAFFIC ANALYSIS /ABOUT/ME Thomas Chopitea - Incident handler @CertSG Digital forensics & incident response (#DFIR), malware analysis,
Beyond Aurora s Veil: A Vulnerable Tale
Beyond Aurora s Veil: A Vulnerable Tale Derek Manky Cyber Security & Threat Research FortiGuard Labs October 26th, 2010: SecTor 2010 Toronto, CA Conficker: April Doomsday.. Meanwhile JBIG2 Zero Day PDF/SWF
Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity
Computer Crime and Intellectual Property Section Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Albert Rees Computer Crime and Intellectual Property Section (CCIPS) Criminal Division,
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime ThreatScape Intelligence Cyber Crime Report November 5, 2013 Version: [1] Key Points Citadel is based on the publicly
A TASTE OF HTTP BOTNETS
Botnets come in many flavors. As one might expect, these flavors all taste different. A lot of Internet users have had their taste of IRC, P2P and HTTP based botnets as their computers were infected with
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess By Richard Wang, Manager, SophosLabs U.S. Over the last few years the volume of malware has grown dramatically, thanks mostly to automation and
Seminar Computer Security
Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example
Cyber Threats to e-commerce. S.C. Leung CISSP CISA CBCP
Cyber Threats to e-commerce S.C. Leung CISSP CISA CBCP Who are we? HKCERT Established in 2001. Operated by HK Productivity Council Provide Internet users and SME services (free-of-charge) Scope of services
Resilient Botnet Command and Control with Tor
Resilient Botnet Command and Control with Tor Dennis Brown July 2010 10/14/10 1 Who am I? Dennis Brown Security Researcher for Tenable Network Solutions Toorcon 10, 11 Defcon 18 PaulDotCom Podcast Rhode
Security A to Z the most important terms
Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from
Current Threat Scenario and Recent Attack Trends
Current Threat Scenario and Recent Attack Trends Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Objectives Current Cyber space Nature of cyberspace and associated risks
Top 10 Data Security Threats Plaguing Credit Unions
Top 10 Data Security Threats Plaguing Credit Unions (2H 2013 Threat Report) Andrew Jaquith CTO & SVP, Cloud Strategy Grace Zeng, SilverSky Labs February 20, 2014 Housekeeping rules Everyone s phone is
Using big data analytics to identify malicious content: a case study on spam emails
Using big data analytics to identify malicious content: a case study on spam emails Mamoun Alazab & Roderic Broadhurst Mamoun.alazab@anu.edu.au http://cybercrime.anu.edu.au 2 Outline Background Cybercrime
Security Business Review
Security Business Review Security Business Review Q4: 2014 2 By Bitdefender Labs Security Business Review Botnet Anonymization Raises New Security Concerns Executive Overview While botnets, which are large
Tespok Kenya icsirt: Enterprise Cyber Threat Attack Report. Quarter 3 July - September 2013
Tespok Kenya icsirt: Enterprise Cyber Threat Attack Report About this Report This report was compiled and published by the Tespok icsirt in partnership with the Serianu Cyber Threat Intelligence Team and
CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT
CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT AN ANALYSIS OF NETWORK SECURITY INCIDENTS FIRST HALF OF 2011 2 Contents How to read this document?
Dr. Seltsam, oder wie ich lernte, Malware zu lieben
Dr. Seltsam, oder wie ich lernte, Malware zu lieben Matthias Schmidt schmidt@ieee.org Quid est Malware? 2 Viruses Spyware Worms Adware Malware Rootkits Trojans Keyloggers Ransomware Dialers 06/05/13 3
Cyber Attack Trend and Botnet
Cyber Attack Trend and Botnet S.C. Leung CISSP CISA CBCP Agenda Botnet and Cyber Attack Trends Botnet Attack Trends Commercialization of Cyber Crime Professionalization of Cyber Crimeware Social Engineering
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望
Hong Kong Information Security Outlook 2015 香 港 資 訊 保 安 展 望 Agenda Information Security Trends Year 2014 in Review Outlook for 2015 Advice to the Public Hong Kong Computer Emergency Response Team Coordination
Anatomy of Attacks. Dmitry Samosseiko, SophosLabs
Anatomy of Attacks Dmitry Samosseiko, SophosLabs SophosLabs Team One global team UK, US, Canada, Australia 24/7, 365 days/year ~100 Researchers and Developers globally Threat Operations Systems Development
MRG Effitas Online Banking / Browser Security Certification Project Q3 2014
MRG Effitas Online Banking / Browser Security Certification Project Q3 2014 1 Contents Introduction... 3 Executive summary... 3 Certification... 4 The purpose of this report... 4 Tests employed... 6 Security
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
From Georgia, with Love Win32/Georbot. Is someone trying to spy on Georgians?
From Georgia, with Love Win32/Georbot Is someone trying to spy on Georgians? At the beginning of the year, a curious piece of malware came to our attention. An analyst in our virus laboratory noticed that
Beware! CryptoLocker Ransomware
Beware! CryptoLocker Ransomware 1 Ransomware Malicious software (malware) that infects a computer and restricts access to the computer and/or its files Demands a ransom to be paid in order for the restriction
Anti-Malware Technologies
: Trend of Network Security Technologies Anti-Malware Technologies Mitsutaka Itoh, Takeo Hariu, Naoto Tanimoto, Makoto Iwamura, Takeshi Yagi, Yuhei Kawakoya, Kazufumi Aoki, Mitsuaki Akiyama, and Shinta
CSE 3482 Introduction to Computer Security. Denial of Service (DoS) Attacks
CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic
Cyber liability threats, trends and pointers for the future
Cyber liability threats, trends and pointers for the future Tim Smith Partner, BLM t: 020 7865 3313 e: tim.smith@blm-law.com February 2013 Cyber liability threats, trends and pointers for the future The
This report is a detailed analysis of the dropper and the payload of the HIMAN malware.
PAGE 5 Check Point Malware Research Group HIMAN Malware Analysis December 12, 2013 Researcher: Overview This report is a detailed analysis of the dropper and the payload of the HIMAN malware. This malware
WildFire Reporting. WildFire Administrator s Guide 55. Copyright 2007-2015 Palo Alto Networks
WildFire Reporting When malware is discovered on your network, it is important to take quick action to prevent spread of the malware to other systems. To ensure immediate alerts to malware discovered on
Spy Eye and Carberp the new banker trojans offensive
Spy Eye and Carberp the new banker trojans offensive The common way for a wanna-be hacker to fulfill his sick aspirations is to achieve a known trojan there is a plenty on the Internet, sometimes they
CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT ISSN 2084-9079
CERT Polska operates within the framework of the Research and Academic Computer Network CERT POLSKA REPORT ISSN 2084-9079 AN ANALYSIS OF NETWORK SECURITY INCIDENTS IN 2011 Contents CERT POLSKA REPORT
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
DDoS Attacks Can Take Down Your Online Services
DDoS Attacks Can Take Down Your Online Services Dr. Bill Highleyman Managing Editor, Availability Digest Continuity Insights New York 2014 October 8, 2014 editor@availabilitydigest.com Who Am I? Dr. Bill
CYBERSECURITY INESTIGATION AND ANALYSIS
CYBERSECURITY INESTIGATION AND ANALYSIS The New Crime of the Digital Age The Internet is not just the hotspot of all things digital and technical. Because of the conveniences of the Internet and its accessibility,
ACCEPTABLE USE AND TAKEDOWN POLICY
ACCEPTABLE USE AND TAKEDOWN POLICY This Acceptable Use and Takedown Policy ( Acceptable Use Policy ) of Wedding TLD2, LLC (the Registry ), is to be read together with the Registration Agreement and words
2014 ASE BIGDATA/SOCIALCOM/CYBERSECURITY Conference, Stanford University, May 27-31, 2014 ASE 2014 ISBN: 978-1-62561-000-3 1
ASE 2014 ISBN: 978-1-62561-000-3 1 Network Traffic Analysis of ZeroAccess Bot Shree Garg, Anil K. Sarje, Sateesh K. Peddoju Department of Computer Science & Engineering Indian Institute of Technology Roorkee,
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Spyware Linkages to Malware and its Affects A Multi-Layered Approach to Stopping Information Theft
Spyware Linkages to Malware and its Affects A Multi-Layered Approach to Stopping Information Theft Kim Duffy Internet Security Systems Agenda What are the trends? Why should I be concerned? How does Spyware
CEH Version8 Course Outline
CEH Version8 Course Outline Module 01: Introduction to Ethical Hacking Information Security Overview Information Security Threats and Attack Vectors Hacking Concepts Hacking Phases Types of Attacks Information
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Cyber Crime Threat Intelligence - Turkey
CSIS Whitepaper July 2014 Cyber Crime Threat Intelligence - Turkey CSIS - Cyber Security Intelligence Service Author Stefan Frei, PhD Abstract Cyber criminals effectively exploit the opportunities provided
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010)
Indian Computer Emergency Response Team (CERT-In) Annual Report (2010) Indian Computer Emergency Response Team (CERT-In) Department of Information Technology Ministry of Communications & Information Technology
The Case for Network-based Malware Detection The need for an additional layer of protection
The Case for Network-based Malware Detection The need for an additional layer of protection Strategic White Paper Client-based anti-malware software is important in any approach to Internet security. Unfortunately,
MRG Effitas Online Banking / Browser Security Certification Project Q1 2015 Level 1
MRG Effitas Online Banking / Browser Security Certification Project Q1 2015 Level 1 Contents Introduction... 3 Executive summary...3 Certification... 4 The purpose of this report...4 Tests employed...
Data Centers Protection from DoS attacks. Trends and solutions. Michael Soukonnik, Radware Ltd michaels@radware.com Riga. Baltic IT&T. 21.04.
Data Centers Protection from DoS attacks. Trends and solutions Michael Soukonnik, Radware Ltd michaels@radware.com Riga. Baltic IT&T. 21.04.2010 Cybercrime Trends Page 2 Types of DoS attacks and classical
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for
Phishing by data URI
Phishing by data URI Henning Klevjer henning@klevjers.com October 22, 2012 1 Abstract Historically, phishing web pages have been hosted by web servers that are either compromised or owned by the attacker.
A Critical Investigation of Botnet
Global Journal of Computer Science and Technology Network, Web & Security Volume 13 Issue 9 Version 1.0 Year 2013 Type: Double Blind Peer Reviewed International Research Journal Publisher: Global Journals
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
Versafe TotALL Online Fraud Protection
Versafe TotALL Online Fraud Protection Protect ALL users. From ALL malware, threat types. On ALL devices. ALL transparently to the end-user. Summary of Mobile Malware & Cross-Device Attacks Overview of
Attacks from the Inside
Attacks from the Inside Eddy Willems, G Data Righard J. Zwienenberg, Norman Attacks from the Inside. Agenda - Social Networking / Engineering - Where are the threats coming from - Infection vectors - The
Security workshop Protection against botnets. Belnet Aris Adamantiadis Brussels 18 th April 2013
Security workshop Belnet Aris Adamantiadis Brussels 18 th April 2013 Agenda What is a botnet? Symptoms How does it work? Life cycle How to fight against botnets? Proactive and reactive NIDS 2 What is a
DDoS Attacks: The Latest Threat to Availability. Dr. Bill Highleyman Managing Editor Availability Digest
DDoS Attacks: The Latest Threat to Availability Dr. Bill Highleyman Managing Editor Availability Digest The Anatomy of a DDoS Attack Sombers Associates, Inc. 2013 2 What is a Distributed Denial of Service
DriveLock Websecurity
Whitepaper DriveLock Websecurity Cloud-based internet security CenterTools Software GmbH 2015 Contents 1 DRIVELOCK WEBSECURITY... 2 1.1 WEBSECURITY CLOUDBASIERTE INTERNETSICHERHEIT... 2 1.2 KONFIGURATION
Cybercrime myths, challenges and how to protect our business. Vladimir Kantchev Managing Partner Service Centrix
Cybercrime myths, challenges and how to protect our business Vladimir Kantchev Managing Partner Service Centrix Agenda Cybercrime today Sources and destinations of the attacks Breach techniques How to
MRG Effitas Online Banking / Browser Security Certification Project - Q2 2014 (Level 2)
MRG Effitas Online Banking / Browser Security Certification Project - Q2 2014 (Level 2) 1 Contents Introduction...3 Executive summary...3 Certification...4 The purpose of this report...4 Tests employed...6
COMPUTER-INTERNET SECURITY. How am I vulnerable?
COMPUTER-INTERNET SECURITY How am I vulnerable? 1 COMPUTER-INTERNET SECURITY Virus Worm Trojan Spyware Adware Messenger Service 2 VIRUS A computer virus is a small program written to alter the way a computer
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
EC-Council. Certified Ethical Hacker. Program Brochure
EC-Council C Certified E Ethical Hacker Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional
CIT 480: Securing Computer Systems. Malware
CIT 480: Securing Computer Systems Malware Topics 1. Anti-Virus Software 2. Virus Types 3. Infection Methods 4. Rootkits 5. Malware Analysis 6. Protective Mechanisms 7. Malware Factories 8. Botnets Malware
Codes of Connection for Devices Connected to Newcastle University ICT Network
Code of Connection (CoCo) for Devices Connected to the University s Author Information Security Officer (Technical) Version V1.1 Date 23 April 2015 Introduction This Code of Connection (CoCo) establishes
User Documentation Web Traffic Security. University of Stavanger
User Documentation Web Traffic Security University of Stavanger Table of content User Documentation... 1 Web Traffic Security... 1 University of Stavanger... 1 UiS Web Traffic Security... 3 Background...
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY
QUARTERLY REPORT 2015 INFOBLOX DNS THREAT INDEX POWERED BY EXPLOIT KITS UP 75 PERCENT The Infoblox DNS Threat Index, powered by IID, stood at 122 in the third quarter of 2015, with exploit kits up 75 percent
Top 10 Security Trends
Top 10 Security Trends Keynote at e-irt Open Workshop on e-infrastructure Audimax HG F30, ETH Zurich April 24th, 2008 Dr. Thomas Dübendorfer, CISSP President ISSS / Software Engineer Tech Lead Google thomas@duebendorfer.ch
ZeroAccess. James Wyke. SophosLabs UK
ZeroAccess James Wyke SophosLabs UK Abstract ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the most widespread threats in the current malware ecosystem. ZeroAccess ability
Prevent Malware attacks with F5 WebSafe and MobileSafe. Alfredo Vistola Security Solution Architect, EMEA
Prevent Malware attacks with F5 WebSafe and MobileSafe Alfredo Vistola Security Solution Architect, EMEA Malware Threat Landscape Growth and Targets % 25 Of real-world malware is caught by anti-virus Malware
Korea s experience of massive DDoS attacks from Botnet
Korea s experience of massive DDoS attacks from Botnet April 12, 2011 Heung Youl YOUM Ph.D. SoonChunHyang University, Korea President, KIISC, Korea Vice-chairman, ITU-T SG 17 1 Table of Contents Overview
Presentation Title: When Anti-virus Doesn t Cut it: Catching Malware with SIEM
LISA 10 Speaking Proposal Category: Practice and Experience Reports Presentation Title: When Anti-virus Doesn t Cut it: Catching Malware with SIEM Proposed by/speaker: Wyman Stocks Information Security
UNMASKCONTENT: THE CASE STUDY
DIGITONTO LLC. UNMASKCONTENT: THE CASE STUDY The mystery UnmaskContent.com v1.0 Contents I. CASE 1: Malware Alert... 2 a. Scenario... 2 b. Data Collection... 2 c. Data Aggregation... 3 d. Data Enumeration...
IT TRENDS AND FUTURE CONSIDERATIONS. Paul Rainbow CPA, CISA, CIA, CISSP, CTGA
IT TRENDS AND FUTURE CONSIDERATIONS Paul Rainbow CPA, CISA, CIA, CISSP, CTGA AGENDA BYOD Cloud Computing PCI Fraud Internet Banking Questions The Mobile Explosion Mobile traffic data in 2011 was nearly
The author(s) shown below used Federal funds provided by the U.S. Department of Justice and prepared the following final report:
The author(s) shown below used Federal funds provided by the U.S. Department of Justice and prepared the following final report: Document Title: Author: Examining the Creation, Distribution, and Function
Current Trends in Botnet Development and Defense Expert Opinion
Current Trends in Botnet Expert Opinion Study conducted for the Cooperative Cyber Defence Centre of Excellence (CCD COE) Tallinn, Estonia December 2010 G. Klein F. Leder Copyright and Disclaimer This work
Acceptable Use Policy. This Acceptable Use Policy sets out the prohibited actions by a Registrant or User of every registered.bayern Domain Name.
This Acceptable Use Policy sets out the prohibited actions by a Registrant or User of every registered.bayern Domain Name. This Acceptable Use Policy forms part of the Registry Policies that apply to and
How Attackers are Targeting Your Mobile Devices. Wade Williamson
How Attackers are Targeting Your Mobile Devices Wade Williamson Today s Agenda Brief overview of mobile computing today Understanding the risks Analysis of recently discovered malware Protections and best
Description: Course Details:
Course: Malicious Network Traffic Analysis Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: There are a tremendous amount of network based attacks to be aware of on the internet
Detecting Algorithmically Generated Malicious Domain Names
Detecting Algorithmically Generated Malicious Domain Names Sandeep Yadav, Texas A&M University IT Security for the Next Generation American Cup, New York 9-11 November, 2011 Introduction Botnets, a network
Welcome To The L.R.F.H.S. Computer Group Wednesday 27 th November 2013
Welcome To The L.R.F.H.S. Computer Group Wednesday 27 th November 2013 BACKUP SECURITY AND THE CLOUD BACK UP ALWAYS BACK UP TO AN EXTERNAL DEVICE OR REMOVAL MEDIA- NEVER DIRECTLY ON TO YOUR COMPUTER IF
Protecting against DoS/DDoS Attacks with FortiWeb Web Application Firewall
Protecting against DoS/DDoS Attacks with FortiWeb Web Application Firewall A FORTINET WHITE PAPER www.fortinet.com Introduction Denial of Service attacks are rapidly becoming a popular attack vector used
Registrar Ramp Up Process. Prepared by Afilias
Registrar Ramp Up Process Prepared by Afilias December 2013 Contents Introduction... 2 Get Started By Having Someone Contact You... 2 Become a Registrar... 3 Step One Business and Legal Process... 3 Step
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com 2 Fraud Prevention for Endpoints KASPERSKY FRAUD PREVENTION 1. Ways of Attacking The prime motive behind cybercrime is making money, and today
US-CERT Security Trends Report: 2012 in Retrospect
US-CERT Security Trends Report: 2012 in Retrospect US-CERT Security Trends Report: 2012 in Retrospect US-CERT Security Trends Report: 2012 in Retrospect.... II How to Read This Document.... 1 Contributors
DDoS Attacks & Mitigation
DDoS Attacks & Mitigation Sang Young Security Consultant ws.young@stshk.com 1 DoS Attack DoS & DDoS an attack render a target unusable by legitimate users DDoS Attack launch the DoS attacks from various
FAQ (Frequently Asked Questions)
FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias
The Hillstone and Trend Micro Joint Solution
The Hillstone and Trend Micro Joint Solution Advanced Threat Defense Platform Overview Hillstone and Trend Micro offer a joint solution the Advanced Threat Defense Platform by integrating the industry
Protection against DDoS and WEB attacks. Michael Soukonnik Radware Ltd michaels@radware.com
Protection against DDoS and WEB attacks Michael Soukonnik Radware Ltd michaels@radware.com Landscape Ponemon Research 2012: Cyber security threats Cyber security threats according to risk mitigation priority