SlideShare ist ein Scribd-Unternehmen logo

Birds of a Feather 2017: 邀請分享 Place of Attribution in Threat Intelligence - Fyodor

•
•
H
HITCON GIRLS

This document discusses principles of threat attribution through analyzing artifacts left behind by threat actors. It explains that attribution is difficult as there are usually multiple possible explanations but outlines approaches like examining metadata, anomalies, targeting patterns, and mistakes over time. Specific case studies are presented on a hacking back of a command and control server, using stolen certificates to attribute Lazarus, and clues in timestamps and encoding errors that point to Lazarus having Korean origins.

Ingenieurwesen
1 von 41
Downloaden Sie, um offline zu lesen
Nikolay Akatyev*, Fyodor Yarochkin Vladimir Kropotov** Place of Attribution in Threat Intelligence
About speaker(s) 2
Agenda Why Attribution? Generic Principles of Attribution Attribution Case Studies Conclusions 3
Why Attribution? What are the common questions people try to answer with attribution? - Am I a targeted victim or was hit by a random chance? - What should I do to address the situation? 4
Disclaimer - We try not to attribute any of the activity to any Nation State - When we say “attribution” - we try to give answers to the following questions: - Are we dealing with any known threat actor? - Is the actor commonly targeting specific targets? - Learn more about the threat actor: working hours, possible geographic location, association with other peers - Targets of interest, tools and techniques commonly used by the threat actor - And more.. 5
Attribution is Difficult: WHY? Attribution of targeted attacks is often similar to Intelligence/Counter-Intelligence operations where for every question multiple answers could be found and you need to make an educated decision which answers are right. 6 Battle for Inchon JUST LIKE WITH REAL SPIES, RIGHT? :)
There are multiple versions of Truth 7 https:// www.youtube.com/ watch?v=uTXs- XKA4pI
Economical Metrics TO Attribution Scientists like quantifiable results (show me the numbers!) Some artifacts are harder to fake than others. Consistently faking certain artifacts to match a particular threat actor is expensive. Examining validity/truthfulness of certain artifacts from the point of cost-evaluation can be effective. 8
Common Approaches in Attribution • Use known data and metadata: IP, Domain, Character Encoding, Strings, Time-Zones • Based on Humint (human intelligence) • Based on Known/Visible Actor Targets • Based on Known/Visible Actor Objectives • Binary structure and anomalies in binary structures or implementation of algorithms • Call back/Hack back/Interact with attacker • Attacker Errors • Average dwelling time (how long actor stays undetected) • Data leaks, like Wiki Leaks (Often Reliable) 9
Cost? “Mistakenly” leaking language encoding in binaries is cheaper. Consistently leaking the same encoding, as mistake, across multiple campaigns, is expensive and requires perfect OPSEC discipline. 10
Cost(of falsifying an Attribution Artifact) Cost(Attribution Artifact) = Expense required to fake given artifact over period of time 11
Awesome talk on cost of IOCs by pinkflawd and blackswanburst: IOCannon: Blasting back on Attackers with Economics https://github.com/pinkflawd/IoCannon
Reliability Reliability Level of Attribution Artifacts has direct impact on incurring cost of faking them. 13
Composition When we verify our hypothesis, we must consider a set of artifacts, and more is better. 14
Composition of Artifacts 15 GMT+8 time langua ge timezo ne ground truth time language binary encoding
Don’t stand out! uniqueness 16
Equation Group What did Equation do wrong, and how can we avoid doing the same? ... 17 https://wikileaks.org/ciav7p1/cms/page_14588809.html
Example of equation group mistakes 18 Source: https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf
Difficulty of faking artifacts C2 calling pattern: easy - just cut-n-paste Domain name - harder, requires ability of taking over a domain name IP address - even harder. May need to be able to compromise the hosting system. 19
of Attribution Let’s think about different approaches 20
How reliable approaches based on data and metadata • IP, Domain, Encoding, Strings, Time-Zones – Have you seen rental contract for hosting? How long it typically lasts? Never heard about proxies? Innocent victims, when c2 hosted on EDU, Gov resources or News outlets? • Code snippets – Could it be just public library? – Have you seen it at the first time? Along one campaign? Inside legit code? – Rarely used programming languages? Crypto algorithms? Encoding? 21
How reliable approaches based on Anomalies in Binary structure • Host indicators and file dependencies • How maps to killchain stages • Anomalies in Binary structure (anti-forensics tricks) – Coders and packers? – Uniq compilation and optimization tools? – Execution paths – Code protection methods 22 Fuzzy Hashing algorithms can help to find related binaries: https://github.com/trendmicro/tlsh - Locality Sensitive Hashing (opensource)
Ex. Lazarus binaries 23
How reliable approaches based on non technical indicators • Based on Humint – How reliable the source? Does the source have enough capabilities to make a judgement on this topic? Does the source have hidden agenda? • Based on Visible actor Targets – Actor targets particular industry? Particular countries? – Almost everyone? Almost every country exept…? • Based on Visible actor Objectives – Money focused – Tactical tasks – Strategic tasks • Based on Visible actor Objectives over angle – Enhance actor capabilities – Reduce victim capabilities 24
How reliable approaches based on Statistics and Long term campaign analysis • Attacker errors (faults - Hangover), especially crypto • Average dwelling time (how long actor stays undetected) – Detected in days and weeks – Detected in Months – Detected in Years • Data leaks, like Wiki Leaks (Often Reliable) – Leaked source code of the binaries – Leaked unique exploits – Dumps of the (De)Classified documents 25
How reliable approaches based on Active actions • Call back – Feed attacker with something, that do passive or silent fingerprinting • Hack Back – Mostly the field of LE agencies, but there are a number of public examples • Interact with attacker – Force the attacker to make a mistake during the interaction and win your time and try to reveal the attacker identity 26
Campaigns Attributing binaries is difficult. No context. Binaries are often shared between the groups. Attribution activity campaigns can be a little bit more simpler, because of presence of additional components: a victim, attacker TTPs and so on, time, compromised hosts, time zone of attacker activity and so on 27
So lets look into some case studies 28
Hack back - control c2 server https://malware.lu/assets/files/articles/ RAP002_APT1_Technical_backstage.1.0.pdf 29
Hummint attribution Human intelligence: always reliable! 30
Errors and mistakes by attacker Use of crypto : forgotten certificates, keys oops.. Proxy/VPN use errors 31
Stolen Certificates http://m.ytn.co.kr/news_view.php?s_mcd=0102&key=201602220213189044&pos= 32 7c77ec259162872bf9ab18f6754e0e844157b31b32b4a746484f444b9f9a3836 Lazarus
Time attributions 33 Source: Blackhat 2013 US: HUNTING THE SHADOWS: IN DEPTH ANALYSIS OF ESCALATED APT ATTACKS
Timestamps: Lazarus (timestamps in UTC) 34 Time Stamp : 2016:10:17 21:01:44+08:00 09a9ce7b2f443f9192007000c3cceed481be0e80 Time Stamp : 2016:10:20 14:30:05+08:00 52de4a4a2bdc7dc5c64bb5b6032df6ffd37c512c694993c337d6913eab316d78 Time Stamp : 2016:10:20 14:30:05+08:00 53da95da2842fb3a84aba16a4d2b346b2308e832d69dd4034f9b98880f7c51c2 Time Stamp : 2016:10:20 14:30:05+08:00 fbc9e003690727f3bff6957beabad58b018c00b7 Time Stamp : 2016:10:21 12:07:39+08:00 2c6c244b3858ce06a0b646ae386f65e69ae5c046 Time Stamp : 2016:10:21 12:07:39+08:00 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 Time Stamp : 2016:10:27 10:31:55+08:00 09c1756064f15fcdd29ff8f239b3d5dcc22ac492 Time Stamp : 2016:10:27 10:31:55+08:00 825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc Time Stamp : 2016:10:27 11:55:43+08:00 178994ab2d4fc0a32a328e97d7d220c8bbb9150c Time Stamp : 2016:10:27 11:55:43+08:00 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d Time Stamp : 2016:11:04 09:29:03+08:00 97a3698ffffdb63df79faeaf58169f9755db1f90 Time Stamp : 2017:01:19 03:24:20+08:00 2c2fb1149c819456a51a75fe310a3a24b28a98d8 Time Stamp : 2017:01:19 03:24:20+08:00 7c77ec259162872bf9ab18f6754e0e844157b31b32b4a746484f444b9f9a3836 Time Stamp : 2017:01:19 03:24:20+08:00 884e06c3ff0781fcd9fb995cd746051c6f8293d3 Time Stamp : 2017:01:19 03:24:20+08:00 da967dc59a7b61aeaeaee380b2c147c5bb1b3bc5 Time Stamp : 2017:01:22 23:40:03+08:00 4d1f7e9405e4129134856a9d535bd5bc369a80ca
Language encodings: Lazarus PE binaries 35
Attribution to Russophone actors in Lazarus Do you speak russian? ;) 36
Lazarus: Hints to Korea Interesting encoding error was discovered by Kaspersky Labs: c05329f101979fa75ca297c4f77c8cd69fe8eb499d4f693550b734beb9f564b 9 37
Unicode Encoding error.. 38 EUC-KR Encoding table: A8CF is .. ©
Bad Opsec: Operation Hangover 39
whowas #badrabbit 40
@kolyaak @fygrave fyodor_yarochkin@trendmicro.com Questions? 41

Empfohlen

Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - Howard
Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - HowardBirds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - Howard
Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - HowardHITCON GIRLS
 
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）HITCON GIRLS
 
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...AlienVault
 
Red team Engagement
Red team EngagementRed team Engagement
Red team EngagementIndranil Banerjee
 
TiC
TiCTiC
TiCCory Kennedy
 
Threat Intelligence Is Like Three Day Potty Training
Threat Intelligence Is Like Three Day Potty TrainingThreat Intelligence Is Like Three Day Potty Training
Threat Intelligence Is Like Three Day Potty TrainingPriyanka Aash
 
Bridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementBridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementPriyanka Aash
 
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersIntroduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersOllie Whitehouse
 

Empfohlen

Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - Howard
Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - HowardBirds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - Howard
Birds of a Feather 2017: 邀請分享 Glance into the Enterprise InfoSec Field - HowardHITCON GIRLS
 
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）HITCON GIRLS
 
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...
How to Normalize Threat Intelligence Data from Multiple Sources - Tech Talk T...AlienVault
 
Red team Engagement
Red team EngagementRed team Engagement
Red team EngagementIndranil Banerjee
 
TiC
TiCTiC
TiCCory Kennedy
 
Threat Intelligence Is Like Three Day Potty Training
Threat Intelligence Is Like Three Day Potty TrainingThreat Intelligence Is Like Three Day Potty Training
Threat Intelligence Is Like Three Day Potty TrainingPriyanka Aash
 
Bridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementBridging the Gap Between Threat Intelligence and Risk Management
Bridging the Gap Between Threat Intelligence and Risk ManagementPriyanka Aash
 
Introduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersIntroduction to Advanced Persistent Threats (APT) for Non-Security Engineers
Introduction to Advanced Persistent Threats (APT) for Non-Security EngineersOllie Whitehouse
 
Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat IntelligenceDeepak Kumar (D3)
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligencePriyanka Aash
 
2018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 22018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 2FRSecure
 
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...Positive Hack Days
 
Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9UISGCON
 
Python-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming OperationPython-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming OperationSatria Ady Pradana
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in securityOsama Ellahi
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
The Library of Sparta
The Library of SpartaThe Library of Sparta
The Library of SpartaLancope, Inc.
 
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017FRSecure
 
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017FRSecure
 
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal AuditorsION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal Auditorsmdagrossa
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
Security Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent ThreatsSecurity Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent ThreatsPeter Wood
 
Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015Roy Ramkrishna
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat IntelligenceOWASP Delhi
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber SecurityDeep Shankar Yadav
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceAlienVault
 
Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseJohn Bambenek
 

Weitere ähnliche Inhalte

Was ist angesagt?

Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghOWASP Delhi
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligencePriyanka Aash
 
2018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 22018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 2FRSecure
 
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...Positive Hack Days
 
Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9UISGCON
 
Python-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming OperationPython-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming OperationSatria Ady Pradana
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in securityOsama Ellahi
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingDhruv Majumdar
 
The Library of Sparta
The Library of SpartaThe Library of Sparta
The Library of SpartaLancope, Inc.
 
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017FRSecure
 
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017FRSecure
 
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal AuditorsION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal Auditorsmdagrossa
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence WorkshopPriyanka Aash
 
Security Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent ThreatsSecurity Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent ThreatsPeter Wood
 
Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015Roy Ramkrishna
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat IntelligenceOWASP Delhi
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedSteve Lodin
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceAlienVault
 

Was ist angesagt? (20)

Threat Intelligence
Threat IntelligenceThreat Intelligence
Threat Intelligence
 
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep SinghCyber threat Intelligence and Incident Response by:-Sandeep Singh
Cyber threat Intelligence and Incident Response by:-Sandeep Singh
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat Intelligence
 
2018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 22018 CISSP Mentor Program Session 2
2018 CISSP Mentor Program Session 2
 
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
 
Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9Mark Arena - Cyber Threat Intelligence #uisgcon9
Mark Arena - Cyber Threat Intelligence #uisgcon9
 
Python-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming OperationPython-Assisted Red-Teaming Operation
Python-Assisted Red-Teaming Operation
 
Threat intelligence in security
Threat intelligence in securityThreat intelligence in security
Threat intelligence in security
 
Bsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat HuntingBsides 2019 - Intelligent Threat Hunting
Bsides 2019 - Intelligent Threat Hunting
 
The Library of Sparta
The Library of SpartaThe Library of Sparta
The Library of Sparta
 
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 4 – FRSecure CISSP Mentor Program 2017
 
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
Slide Deck – Session 12 – FRSecure CISSP Mentor Program 2017
 
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal AuditorsION-E Defense In Depth Presentation for The Institiute of Internal Auditors
ION-E Defense In Depth Presentation for The Institiute of Internal Auditors
 
Threat Intelligence Workshop
Threat Intelligence WorkshopThreat Intelligence Workshop
Threat Intelligence Workshop
 
Security Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent ThreatsSecurity Intelligence: Advanced Persistent Threats
Security Intelligence: Advanced Persistent Threats
 
Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015Sans cyber-threat-intelligence-survey-2015
Sans cyber-threat-intelligence-survey-2015
 
Actionable Threat Intelligence
Actionable Threat IntelligenceActionable Threat Intelligence
Actionable Threat Intelligence
 
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - SubmittedThreat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence 101 - Steve Lodin - Submitted
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber Security
 
Crowd-Sourced Threat Intelligence
Crowd-Sourced Threat IntelligenceCrowd-Sourced Threat Intelligence
Crowd-Sourced Threat Intelligence
 

Ähnlich wie Birds of a Feather 2017: 邀請分享 Place of Attribution in Threat Intelligence - Fyodor

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Spyglass Security
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseJohn Bambenek
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFMichael Gough
 
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...EC-Council
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfssuser4237d4
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Danny Akacki
 
Web hacking 1.0
Web hacking 1.0Web hacking 1.0
Web hacking 1.0Q Fadlan
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware GenerationStephan Chenette
 
Security in the age of open source - Myths and misperceptions
Security in the age of open source - Myths and misperceptionsSecurity in the age of open source - Myths and misperceptions
Security in the age of open source - Myths and misperceptionsTim Mackey
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisAntonio Parata
 
B-Sides Seattle 2012 Offensive Defense
B-Sides Seattle 2012 Offensive DefenseB-Sides Seattle 2012 Offensive Defense
B-Sides Seattle 2012 Offensive DefenseStephan Chenette
 
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101Attacking and Exploiting Ethereum Smart Contracts: Auditing 101
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101Simone Onofri
 
Hacking and its types
Hacking and its typesHacking and its types
Hacking and its typesRishab Gupta
 
Risk-based Security Technical Debt Reduction: When everything’s important, n...
Risk-based Security Technical Debt Reduction: When everything’s important, n...Risk-based Security Technical Debt Reduction: When everything’s important, n...
Risk-based Security Technical Debt Reduction: When everything’s important, n...laurieannwilliams
 
AktaionPPTv5_JZedits
AktaionPPTv5_JZeditsAktaionPPTv5_JZedits
AktaionPPTv5_JZeditsRod Soto
 
Ten security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard ofTen security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard ofAdrian Sanabria
 
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018Codemotion
 
EmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
EmPOW: Integrating Attack Behavior Intelligence into Logstash PluginsEmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
EmPOW: Integrating Attack Behavior Intelligence into Logstash PluginsFaithWestdorp
 

Ähnlich wie Birds of a Feather 2017: 邀請分享 Place of Attribution in Threat Intelligence - Fyodor (20)

Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2Hunting: Defense Against The Dark Arts v2
Hunting: Defense Against The Dark Arts v2
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDF
 
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
Hacker Halted 2018: From CTF to CVE – How Application of Concepts and Persist...
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
 
Web hacking 1.0
Web hacking 1.0Web hacking 1.0
Web hacking 1.0
 
The Future of Automated Malware Generation
The Future of Automated Malware GenerationThe Future of Automated Malware Generation
The Future of Automated Malware Generation
 
Security in the age of open source - Myths and misperceptions
Security in the age of open source - Myths and misperceptionsSecurity in the age of open source - Myths and misperceptions
Security in the age of open source - Myths and misperceptions
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware Analysis
 
B-Sides Seattle 2012 Offensive Defense
B-Sides Seattle 2012 Offensive DefenseB-Sides Seattle 2012 Offensive Defense
B-Sides Seattle 2012 Offensive Defense
 
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101Attacking and Exploiting Ethereum Smart Contracts: Auditing 101
Attacking and Exploiting Ethereum Smart Contracts: Auditing 101
 
Hacking and its types
Hacking and its typesHacking and its types
Hacking and its types
 
Risk-based Security Technical Debt Reduction: When everything’s important, n...
Risk-based Security Technical Debt Reduction: When everything’s important, n...Risk-based Security Technical Debt Reduction: When everything’s important, n...
Risk-based Security Technical Debt Reduction: When everything’s important, n...
 
AktaionPPTv5_JZedits
AktaionPPTv5_JZeditsAktaionPPTv5_JZedits
AktaionPPTv5_JZedits
 
Ten security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard ofTen security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard of
 
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018
N. Oskina, G. Asproni - Be your own Threatbuster! - Codemotion Milan 2018
 
EmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
EmPOW: Integrating Attack Behavior Intelligence into Logstash PluginsEmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
EmPOW: Integrating Attack Behavior Intelligence into Logstash Plugins
 

Mehr von HITCON GIRLS

20200810_資訊洩漏所帶來的資安問題_turkey
20200810_資訊洩漏所帶來的資安問題_turkey20200810_資訊洩漏所帶來的資安問題_turkey
20200810_資訊洩漏所帶來的資安問題_turkeyHITCON GIRLS
 
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短HITCON GIRLS
 
HITCON CTF 介紹 - HG 導覽活動
HITCON CTF 介紹 - HG 導覽活動HITCON CTF 介紹 - HG 導覽活動
HITCON CTF 介紹 - HG 導覽活動HITCON GIRLS
 
HITCON CTF 2019 特色 - HG 導覽活動
HITCON CTF 2019 特色 - HG 導覽活動HITCON CTF 2019 特色 - HG 導覽活動
HITCON CTF 2019 特色 - HG 導覽活動HITCON GIRLS
 
HITCON CTF 2017 特色 - HG 導覽活動
HITCON CTF 2017 特色 - HG 導覽活動HITCON CTF 2017 特色 - HG 導覽活動
HITCON CTF 2017 特色 - HG 導覽活動HITCON GIRLS
 
HITCON CTF 2016 特色 - HG 導覽活動
HITCON CTF 2016 特色 - HG 導覽活動HITCON CTF 2016 特色 - HG 導覽活動
HITCON CTF 2016 特色 - HG 導覽活動HITCON GIRLS
 
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdf
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdfiThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdf
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdfHITCON GIRLS
 
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdf
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdfiThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdf
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdfHITCON GIRLS
 
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom KimBirds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom KimHITCON GIRLS
 
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - Aaron
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - AaronBirds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - Aaron
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - AaronHITCON GIRLS
 
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&TurkeyHITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料HITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎HITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生HITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - Turkey
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - TurkeyHITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - Turkey
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - TurkeyHITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了HITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣HITCON GIRLS
 
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - Belinda
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - BelindaHITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - Belinda
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - BelindaHITCON GIRLS
 
HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON GIRLS
 
Android Hook - Xposed Framework (Elven Liu)
Android Hook - Xposed Framework (Elven Liu)Android Hook - Xposed Framework (Elven Liu)
Android Hook - Xposed Framework (Elven Liu)HITCON GIRLS
 

Mehr von HITCON GIRLS (20)

20200810_資訊洩漏所帶來的資安問題_turkey
20200810_資訊洩漏所帶來的資安問題_turkey20200810_資訊洩漏所帶來的資安問題_turkey
20200810_資訊洩漏所帶來的資安問題_turkey
 
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短
CYBERSEC 2020 臺灣資安大會 windows malware hot 5 - 短短
 
HITCON CTF 介紹 - HG 導覽活動
HITCON CTF 介紹 - HG 導覽活動HITCON CTF 介紹 - HG 導覽活動
HITCON CTF 介紹 - HG 導覽活動
 
HITCON CTF 2019 特色 - HG 導覽活動
HITCON CTF 2019 特色 - HG 導覽活動HITCON CTF 2019 特色 - HG 導覽活動
HITCON CTF 2019 特色 - HG 導覽活動
 
HITCON CTF 2017 特色 - HG 導覽活動
HITCON CTF 2017 特色 - HG 導覽活動HITCON CTF 2017 特色 - HG 導覽活動
HITCON CTF 2017 特色 - HG 導覽活動
 
HITCON CTF 2016 特色 - HG 導覽活動
HITCON CTF 2016 特色 - HG 導覽活動HITCON CTF 2016 特色 - HG 導覽活動
HITCON CTF 2016 特色 - HG 導覽活動
 
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdf
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdfiThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdf
iThome 資安大會 2019 資安大會_AI 的逆襲，眼見真的為憑嗎？ - Turkey&Melody.pdf
 
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdf
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdfiThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdf
iThome 資安大會 2019 駭客如何利用公開工具在內部網路中暢行無阻 - YCY.pdf
 
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom KimBirds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim
Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim
 
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - Aaron
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - AaronBirds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - Aaron
Birds of a Feather 2017: 邀請分享 IoT, SDR, and Car Security - Aaron
 
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey
未來大人物【互動工作坊】社群網路滲透生活，我們如何保護個資不外洩 蜘子珣&Turkey
 
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料
HITCON GIRLS 資安萌芽推廣 2017: 從 CVE 找材料
 
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎
HITCON GIRLS 資安萌芽推廣 2017: 你知道你連線的網站黑黑的嗎
 
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生
HITCON GIRLS 資安萌芽推廣 2017: 密碼學深入淺出 阿毛 - 台科資管碩士生＆圓圓 - 台科資管碩士生
 
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - Turkey
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - TurkeyHITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - Turkey
HITCON GIRLS 資安萌芽推廣 2017: 探索駭客的世界 - Turkey
 
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了
HITCON GIRLS 資安萌芽推廣 2017: 還能不能好好玩遊戲了
 
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣
HITCON GIRLS 資安萌芽推廣 2017: 從研究生轉職資安工程師 - 蜘子珣
 
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - Belinda
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - BelindaHITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - Belinda
HITCON GIRLS 資安萌芽推廣 2017: 資安工作很酷嘛？當然！ - Belinda
 
HITCON CTF 2016導覽
HITCON CTF 2016導覽HITCON CTF 2016導覽
HITCON CTF 2016導覽
 
Android Hook - Xposed Framework (Elven Liu)
Android Hook - Xposed Framework (Elven Liu)Android Hook - Xposed Framework (Elven Liu)
Android Hook - Xposed Framework (Elven Liu)
 

Kürzlich hochgeladen

Rums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfRums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfsmsksolar
 
Thermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VThermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VDineshKumar4165
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityMorshed Ahmed Rahath
 
Design For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startDesign For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startQuintin Balsdon
 
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...HenryBriggs2
 
Thermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptThermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptDineshKumar4165
 
Online electricity billing project report..pdf
Online electricity billing project report..pdfOnline electricity billing project report..pdf
Online electricity billing project report..pdfKamal Acharya
 
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Call Girls Mumbai
 
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Arindam Chakraborty, Ph.D., P.E. (CA, TX)
 
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptx
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptxA CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptx
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptxmaisarahman1
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projectssmsksolar
 
Engineering Drawing focus on projection of planes
Engineering Drawing focus on projection of planesEngineering Drawing focus on projection of planes
Engineering Drawing focus on projection of planesRAJNEESHKUMAR341697
 
Introduction to Serverless with AWS Lambda
Introduction to Serverless with AWS LambdaIntroduction to Serverless with AWS Lambda
Introduction to Serverless with AWS LambdaOmar Fathy
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptNANDHAKUMARA10
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTbhaskargani46
 
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKARHAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKARKOUSTAV SARKAR
 
kiln thermal load.pptx kiln tgermal load
kiln thermal load.pptx kiln tgermal loadkiln thermal load.pptx kiln tgermal load
kiln thermal load.pptx kiln tgermal loadhamedmustafa094
 
Standard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power PlayStandard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power PlayEpec Engineered Technologies
 
School management system project Report.pdf
School management system project Report.pdfSchool management system project Report.pdf
School management system project Report.pdfKamal Acharya
 
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxHOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxSCMS School of Architecture
 

Kürzlich hochgeladen (20)

Rums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfRums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdf
 
Thermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VThermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - V
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna Municipality
 
Design For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startDesign For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the start
 
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
scipt v1.pptxcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
 
Thermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptThermal Engineering Unit - I & II . ppt
Thermal Engineering Unit - I & II . ppt
 
Online electricity billing project report..pdf
Online electricity billing project report..pdfOnline electricity billing project report..pdf
Online electricity billing project report..pdf
 
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
 
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
Navigating Complexity: The Role of Trusted Partners and VIAS3D in Dassault Sy...
 
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptx
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptxA CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptx
A CASE STUDY ON CERAMIC INDUSTRY OF BANGLADESH.pptx
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects
 
Engineering Drawing focus on projection of planes
Engineering Drawing focus on projection of planesEngineering Drawing focus on projection of planes
Engineering Drawing focus on projection of planes
 
Introduction to Serverless with AWS Lambda
Introduction to Serverless with AWS LambdaIntroduction to Serverless with AWS Lambda
Introduction to Serverless with AWS Lambda
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.ppt
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPT
 
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKARHAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
HAND TOOLS USED AT ELECTRONICS WORK PRESENTED BY KOUSTAV SARKAR
 
kiln thermal load.pptx kiln tgermal load
kiln thermal load.pptx kiln tgermal loadkiln thermal load.pptx kiln tgermal load
kiln thermal load.pptx kiln tgermal load
 
Standard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power PlayStandard vs Custom Battery Packs - Decoding the Power Play
Standard vs Custom Battery Packs - Decoding the Power Play
 
School management system project Report.pdf
School management system project Report.pdfSchool management system project Report.pdf
School management system project Report.pdf
 
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxHOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
 

Birds of a Feather 2017: 邀請分享 Place of Attribution in Threat Intelligence - Fyodor

  • 1. Nikolay Akatyev*, Fyodor Yarochkin Vladimir Kropotov** Place of Attribution in Threat Intelligence
  • 3. Agenda Why Attribution? Generic Principles of Attribution Attribution Case Studies Conclusions 3
  • 4. Why Attribution? What are the common questions people try to answer with attribution? - Am I a targeted victim or was hit by a random chance? - What should I do to address the situation? 4
  • 5. Disclaimer - We try not to attribute any of the activity to any Nation State - When we say “attribution” - we try to give answers to the following questions: - Are we dealing with any known threat actor? - Is the actor commonly targeting specific targets? - Learn more about the threat actor: working hours, possible geographic location, association with other peers - Targets of interest, tools and techniques commonly used by the threat actor - And more.. 5
  • 6. Attribution is Difficult: WHY? Attribution of targeted attacks is often similar to Intelligence/Counter-Intelligence operations where for every question multiple answers could be found and you need to make an educated decision which answers are right. 6 Battle for Inchon JUST LIKE WITH REAL SPIES, RIGHT? :)
  • 7. There are multiple versions of Truth 7 https:// www.youtube.com/ watch?v=uTXs- XKA4pI
  • 8. Economical Metrics TO Attribution Scientists like quantifiable results (show me the numbers!) Some artifacts are harder to fake than others. Consistently faking certain artifacts to match a particular threat actor is expensive. Examining validity/truthfulness of certain artifacts from the point of cost-evaluation can be effective. 8
  • 9. Common Approaches in Attribution • Use known data and metadata: IP, Domain, Character Encoding, Strings, Time-Zones • Based on Humint (human intelligence) • Based on Known/Visible Actor Targets • Based on Known/Visible Actor Objectives • Binary structure and anomalies in binary structures or implementation of algorithms • Call back/Hack back/Interact with attacker • Attacker Errors • Average dwelling time (how long actor stays undetected) • Data leaks, like Wiki Leaks (Often Reliable) 9
  • 10. Cost? “Mistakenly” leaking language encoding in binaries is cheaper. Consistently leaking the same encoding, as mistake, across multiple campaigns, is expensive and requires perfect OPSEC discipline. 10
  • 11. Cost(of falsifying an Attribution Artifact) Cost(Attribution Artifact) = Expense required to fake given artifact over period of time 11
  • 12. Awesome talk on cost of IOCs by pinkflawd and blackswanburst: IOCannon: Blasting back on Attackers with Economics https://github.com/pinkflawd/IoCannon
  • 13. Reliability Reliability Level of Attribution Artifacts has direct impact on incurring cost of faking them. 13
  • 14. Composition When we verify our hypothesis, we must consider a set of artifacts, and more is better. 14
  • 17. Equation Group What did Equation do wrong, and how can we avoid doing the same? ... 17 https://wikileaks.org/ciav7p1/cms/page_14588809.html
  • 18. Example of equation group mistakes 18 Source: https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf
  • 19. Difficulty of faking artifacts C2 calling pattern: easy - just cut-n-paste Domain name - harder, requires ability of taking over a domain name IP address - even harder. May need to be able to compromise the hosting system. 19
  • 20. of Attribution Let’s think about different approaches 20
  • 21. How reliable approaches based on data and metadata • IP, Domain, Encoding, Strings, Time-Zones – Have you seen rental contract for hosting? How long it typically lasts? Never heard about proxies? Innocent victims, when c2 hosted on EDU, Gov resources or News outlets? • Code snippets – Could it be just public library? – Have you seen it at the first time? Along one campaign? Inside legit code? – Rarely used programming languages? Crypto algorithms? Encoding? 21
  • 22. How reliable approaches based on Anomalies in Binary structure • Host indicators and file dependencies • How maps to killchain stages • Anomalies in Binary structure (anti-forensics tricks) – Coders and packers? – Uniq compilation and optimization tools? – Execution paths – Code protection methods 22 Fuzzy Hashing algorithms can help to find related binaries: https://github.com/trendmicro/tlsh - Locality Sensitive Hashing (opensource)
  • 24. How reliable approaches based on non technical indicators • Based on Humint – How reliable the source? Does the source have enough capabilities to make a judgement on this topic? Does the source have hidden agenda? • Based on Visible actor Targets – Actor targets particular industry? Particular countries? – Almost everyone? Almost every country exept…? • Based on Visible actor Objectives – Money focused – Tactical tasks – Strategic tasks • Based on Visible actor Objectives over angle – Enhance actor capabilities – Reduce victim capabilities 24
  • 25. How reliable approaches based on Statistics and Long term campaign analysis • Attacker errors (faults - Hangover), especially crypto • Average dwelling time (how long actor stays undetected) – Detected in days and weeks – Detected in Months – Detected in Years • Data leaks, like Wiki Leaks (Often Reliable) – Leaked source code of the binaries – Leaked unique exploits – Dumps of the (De)Classified documents 25
  • 26. How reliable approaches based on Active actions • Call back – Feed attacker with something, that do passive or silent fingerprinting • Hack Back – Mostly the field of LE agencies, but there are a number of public examples • Interact with attacker – Force the attacker to make a mistake during the interaction and win your time and try to reveal the attacker identity 26
  • 27. Campaigns Attributing binaries is difficult. No context. Binaries are often shared between the groups. Attribution activity campaigns can be a little bit more simpler, because of presence of additional components: a victim, attacker TTPs and so on, time, compromised hosts, time zone of attacker activity and so on 27
  • 28. So lets look into some case studies 28
  • 29. Hack back - control c2 server https://malware.lu/assets/files/articles/ RAP002_APT1_Technical_backstage.1.0.pdf 29
  • 31. Errors and mistakes by attacker Use of crypto : forgotten certificates, keys oops.. Proxy/VPN use errors 31
  • 33. Time attributions 33 Source: Blackhat 2013 US: HUNTING THE SHADOWS: IN DEPTH ANALYSIS OF ESCALATED APT ATTACKS
  • 34. Timestamps: Lazarus (timestamps in UTC) 34 Time Stamp : 2016:10:17 21:01:44+08:00 09a9ce7b2f443f9192007000c3cceed481be0e80 Time Stamp : 2016:10:20 14:30:05+08:00 52de4a4a2bdc7dc5c64bb5b6032df6ffd37c512c694993c337d6913eab316d78 Time Stamp : 2016:10:20 14:30:05+08:00 53da95da2842fb3a84aba16a4d2b346b2308e832d69dd4034f9b98880f7c51c2 Time Stamp : 2016:10:20 14:30:05+08:00 fbc9e003690727f3bff6957beabad58b018c00b7 Time Stamp : 2016:10:21 12:07:39+08:00 2c6c244b3858ce06a0b646ae386f65e69ae5c046 Time Stamp : 2016:10:21 12:07:39+08:00 95c8ffe03547bcb0afd4d025fb14908f5230c6dc6fdd16686609681c7f40aca2 Time Stamp : 2016:10:27 10:31:55+08:00 09c1756064f15fcdd29ff8f239b3d5dcc22ac492 Time Stamp : 2016:10:27 10:31:55+08:00 825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc Time Stamp : 2016:10:27 11:55:43+08:00 178994ab2d4fc0a32a328e97d7d220c8bbb9150c Time Stamp : 2016:10:27 11:55:43+08:00 99017270f0af0e499cfeb19409020bfa0c2de741e5b32b9f6a01c34fe13fda7d Time Stamp : 2016:11:04 09:29:03+08:00 97a3698ffffdb63df79faeaf58169f9755db1f90 Time Stamp : 2017:01:19 03:24:20+08:00 2c2fb1149c819456a51a75fe310a3a24b28a98d8 Time Stamp : 2017:01:19 03:24:20+08:00 7c77ec259162872bf9ab18f6754e0e844157b31b32b4a746484f444b9f9a3836 Time Stamp : 2017:01:19 03:24:20+08:00 884e06c3ff0781fcd9fb995cd746051c6f8293d3 Time Stamp : 2017:01:19 03:24:20+08:00 da967dc59a7b61aeaeaee380b2c147c5bb1b3bc5 Time Stamp : 2017:01:22 23:40:03+08:00 4d1f7e9405e4129134856a9d535bd5bc369a80ca
  • 35. Language encodings: Lazarus PE binaries 35
  • 36. Attribution to Russophone actors in Lazarus Do you speak russian? ;) 36
  • 37. Lazarus: Hints to Korea Interesting encoding error was discovered by Kaspersky Labs: c05329f101979fa75ca297c4f77c8cd69fe8eb499d4f693550b734beb9f564b 9 37
  • 38. Unicode Encoding error.. 38 EUC-KR Encoding table: A8CF is .. ©
  • 39. Bad Opsec: Operation Hangover 39