SlideShare ist ein Scribd-Unternehmen logo

Big Game Hunting - Peculiarities In Nation State Malware Research

•
•
P
pinkflawd

This document discusses various techniques used in malware analysis and attribution, including: 1) Analyzing malware samples and associated metadata to identify patterns in implementation traits, infrastructure, and custom features that can provide clues to the actor. 2) The challenges of attribution given issues like attribution indicators being faked, the influence of individual analysts and compilers, and denials from suspected groups. 3) How soft attribution based on analyzing similarities in malware is less definitive than hard attribution with confirmed links, and how both are interpreted by analysts.

Ingenieurwesen
1 von 88
Downloaden Sie, um offline zu lesen
BIG GAME HUNTING Peculiarities In Nation State Malware Research
WHOIS
Stux
~D
Offense Going Commercial
AV 2.0 … where the customer is the product How Anti-Virus went Threat-Intel Malware.. ‘watching’ Actor tracking Publicity APT numbering, logos & names
http://fc01.deviantart.net/fs11/i/2006/253/8/f/BASIC_TERMS__Sewing_Needle_by_mmp_stock.jpg
http://cdn2.landscapehdwalls.com/wallpapers/1/haystack-837-1920x1200.jpg
Haystack Processing ~70.000 – 300.000 new samples/day (Depending which report you trust) Sample trading Automated processing http://cdn2.landscapehdwalls.com/wallpapers/1/haystack-837-1920x1200.jpg
Needle Processing Threat Intelligence Telemetry Data Leaked Documents Infected Machines Gossip http://fc01.deviantart.net/fs11/i/2006/253/8/f/BASIC_TERMS__Sewing_Needle_by_mmp
Endpoint Wars Endpoint agents Threat indicators Mitigation tactics Silent data exchange
Agent Threat detection & mitigation Threat Indicators Q&A Data Signature hits Timestamps Hit frequencies Binaries Endpoint Wars
•Signature generation & testing •Silent signatures •Binaries •Telemetry •‘Free’ security products Endpoint Wars backstage
Frenemies & The Fungus Amongus Or: When Malware Became Intellectual Property
Frenemies & The Fungus Amongus Or: When Malware Became Intellectual Property
[REDACTED] “Where did you find this malware?” Me: “It was sent to me by targeted activists.” [REDACTED] “That’s Cheating.”
Taymour Karim Syrian Activist
“My computer was arrested before me.”
Ala’a Shehabi BahrainWatch Co-founder
FinFisher Patient-Zero
Ghazi Farhan
Ahmed Mansoor and the UAE Five
Ahmed Mansoor and the UAE Five
Hahaha.
Sometimes Attribution isn’t Tricky 83.111.56.188 inetnum: 83.111.56.184 – 83.111.56.191 netname: minaoffice-EMIRNET descr: Office Of Sh. Tahnoon Bin Zayed Al Nahyan descr: P.O. Box 5151 , Abu Dhabi, UAE country: AE
Alberto Nisman
Alberto Nisman
Todo parece indicar que Nisman fue engañado. A su teléfono Motorola xt626 llegó un archivo con el título “estrictamente secreto y confidencial.pdf.jar”. Acaso creyendo que se trataba de un documento importante, lo abrió sin advertir la extensión “.jar”. Allí estaba el virus. •3445a61556ca52cf5950583e0be4133de7a4f6a8
Attribution IS tricky? • Network based indicators point to Argentina and Uruguay • Also use of hosting services in the US, Germany, and Sweden
Babar PET Persistent Elephant Threat
http://dopemichael.deviantart.com/art/Dead-Bunny-Wallpaper-119327469 Bunny
LUUUKE I am your father!! You.. Sure?
Misery Business Who wrote the malware? Who controlled the malware? Who were the victims? What was the aim of the operation?
BINARY CONTEXT BINARY BINARY IN A CONTEXT Misery Business
SH* Academics say Source code authorship attribution Automatic detection of stylistic features in binary code Problems?
Datafication of RE results Different domains & lots of attributes Any attribute can be faked or random Assumption: Impossible that all vary in all cases Goal: Even out individual human / compiler influence
STRING CONSTANTS Error messages String formatting style English grammar mistakes C&C commands Timestamp formatting IMPLEMENTATION TRAITS Memory allocation habits Use of global variables Multi-threading model Software architecture and design Constructor design Dynamic API loading technique Exception handling Usage of public source code Programming language and compiler Compilation time stamps and time zones CUSTOM FEATURES Obfuscation techniques Stealth and evasion techniques Use of encryption and compression algorithms Encryption keys Re-used source code Malware specific features System infiltration Propagation mechanisms Artifact naming schemes / algorithms Data exfiltration techniques System / OS version determination technique C&C command parsing implementation INFRASTRUCTURE C&C servers Countries / languages used for domain hosting and naming Beaconing style Communication protocol and port Communication intervals
Science, yo
JSON
BUNNY spearphish ing with 0- days DINO spying in Iran CASPER active in Syria in 2014 BABAR linked to French government NBOT Denial-of- Service Stylometry in Attribution
What It’s Not No authorship attribution Manual work Not feasible for automation / machine learning Interpretation in the eye of the analyst
Soft Attribution vs Hard Attribution
“Check out this super interesting .cn apt malware that I found…”
“uhh… I’m not sure that’s China...”
“Looking at the code closely, we conclude that the “QWERTY” malware is identical in functionality to the Regin 50251 plugin.”
"Blind Freddy could see E_QWERTY is a REGIN plugin"
Legal Spies are obliged to lie
“There is absolutely no evidence that links us to those samples…”
Denials In response to the United Nations panel, the company responded this January that they were not currently selling to Sudan.
Oooops Internal records show that in 2012, Sudan’s National Intelligence and Security Service in Kartoum paid 960,000 euros for Remote Control System. “We absolutely need to avoid being mentioned in these documents.”
C
C
“Mr. Marquis-Boire has been a tireless wolf-crier on the issue of privacy as he defines it […] that’s a perfect formula for criminals or terrorists who routinely use the Web, mobile phones and other devices.” It‘s just business
I’m sure it’s not personal... "Marquis-Boire" - 117 mentions "Morgan Mayhem" - 29 mentions "headhntr" - 15 mentions
C
But hey….
Cheshire Cat
SSOOOUU... e2ca6cca598d47dee311f06920c1efde - 2002-11-05 02:02:19 4e0a3498438adda8c50c3e101cfa86c5 - 2007-08-13 11:02:54 3ba57784d7fd4302fe74beb648b28dc1 - 2008-08-13 15:20:23 7b0e7297d5157586f4075098be9efc8c – 2009-05-03 20:43:05 fa1e5eec39910a34ede1c4351ccecec8 - 2011-05-16 16:55:17
2002 String obfuscation with XOR 9Bh Checking for running security processes (and dummyyy.exe)
2002 Control component talking to a device driver .asr2892 Sending IOCTLs 220004 & 220008 Orchestrator component executing binaries from disk Drops ‘msrun.exe’ from .rsrc section Redirects standard handles of spawned process, piping output back to launcher
2002 Prepared to run on _old_ Windows versions Using APIs deprecated after Win95/98/ME Function to check for the MZ value, the PE value and the NE value
2007-2009 Implementation traits and user agent string indicate Win NT 4.0 as target platform Persists as shell extension for the icon handler Wants to run in the context of the ‘Progman’ window
2007-2009 Implant to monitor terminal server sessions Global hook to filter for WM_KEYFIRST, WM_SYSKEYDOWN, WM_CHAR, WM_SYSCHAR Loads msob4k32.dll and 6 exports by ordinal
2007-2009 String obfuscation using XOR 9Bh Evasive when network sniffer products are running Super stealthy network communication: Versatile communication method 9+ C&C servers, infrequent intervals Communication done through injected standard browser instance
2011 Fine tuned to paddle around Kaspersky security products
~DF
Attribution is hard. Use the magic 8-ball.
Morgan @headhntr Marion @pinkflawd #FREECLAUDIO @botherder

Empfohlen

Ekivalensi kurikulum 2011 2016 tk ne
Ekivalensi kurikulum 2011 2016 tk neEkivalensi kurikulum 2011 2016 tk ne
Ekivalensi kurikulum 2011 2016 tk neSetia Juli Irzal Ismail
 
Kurikulum prodi d3 tk 2016
Kurikulum prodi d3 tk 2016Kurikulum prodi d3 tk 2016
Kurikulum prodi d3 tk 2016Setia Juli Irzal Ismail
 
Ekivalensi kurikulum 2011 2016 tk es
Ekivalensi kurikulum 2011 2016 tk esEkivalensi kurikulum 2011 2016 tk es
Ekivalensi kurikulum 2011 2016 tk esSetia Juli Irzal Ismail
 
Krs d3 tk angkatan 2014 ne
Krs d3 tk angkatan 2014 neKrs d3 tk angkatan 2014 ne
Krs d3 tk angkatan 2014 neSetia Juli Irzal Ismail
 
Krs d3 tk angkatan 2014 es
Krs d3 tk angkatan 2014 esKrs d3 tk angkatan 2014 es
Krs d3 tk angkatan 2014 esSetia Juli Irzal Ismail
 
Hiding In Plain Sight – Protect Against Bad Hashes
Hiding In Plain Sight – Protect Against Bad HashesHiding In Plain Sight – Protect Against Bad Hashes
Hiding In Plain Sight – Protect Against Bad HashesTripwire
 
Mr201401 consideration for indicators of malware likeness based on static fil...
Mr201401 consideration for indicators of malware likeness based on static fil...Mr201401 consideration for indicators of malware likeness based on static fil...
Mr201401 consideration for indicators of malware likeness based on static fil...FFRI, Inc.
 
Dll hijacking
Dll hijackingDll hijacking
Dll hijackingantitree
 

Empfohlen

Ekivalensi kurikulum 2011 2016 tk ne
Ekivalensi kurikulum 2011 2016 tk neEkivalensi kurikulum 2011 2016 tk ne
Ekivalensi kurikulum 2011 2016 tk neSetia Juli Irzal Ismail
 
Kurikulum prodi d3 tk 2016
Kurikulum prodi d3 tk 2016Kurikulum prodi d3 tk 2016
Kurikulum prodi d3 tk 2016Setia Juli Irzal Ismail
 
Ekivalensi kurikulum 2011 2016 tk es
Ekivalensi kurikulum 2011 2016 tk esEkivalensi kurikulum 2011 2016 tk es
Ekivalensi kurikulum 2011 2016 tk esSetia Juli Irzal Ismail
 
Krs d3 tk angkatan 2014 ne
Krs d3 tk angkatan 2014 neKrs d3 tk angkatan 2014 ne
Krs d3 tk angkatan 2014 neSetia Juli Irzal Ismail
 
Krs d3 tk angkatan 2014 es
Krs d3 tk angkatan 2014 esKrs d3 tk angkatan 2014 es
Krs d3 tk angkatan 2014 esSetia Juli Irzal Ismail
 
Hiding In Plain Sight – Protect Against Bad Hashes
Hiding In Plain Sight – Protect Against Bad HashesHiding In Plain Sight – Protect Against Bad Hashes
Hiding In Plain Sight – Protect Against Bad HashesTripwire
 
Mr201401 consideration for indicators of malware likeness based on static fil...
Mr201401 consideration for indicators of malware likeness based on static fil...Mr201401 consideration for indicators of malware likeness based on static fil...
Mr201401 consideration for indicators of malware likeness based on static fil...FFRI, Inc.
 
Dll hijacking
Dll hijackingDll hijacking
Dll hijackingantitree
 
Concepts of Malicious Windows Programs
Concepts of Malicious Windows ProgramsConcepts of Malicious Windows Programs
Concepts of Malicious Windows ProgramsNatraj G
 
Dns security threats and solutions
Dns security threats and solutionsDns security threats and solutions
Dns security threats and solutionsFrank Victory
 
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera... SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...AlienVault
 
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responseEnabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responsejeffmcjunkin
 
PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1amiable_indian
 
Level Up Your Security with Threat Intelligence
Level Up Your Security with Threat IntelligenceLevel Up Your Security with Threat Intelligence
Level Up Your Security with Threat IntelligenceIBM Security
 
SOC Foundation
SOC FoundationSOC Foundation
SOC FoundationMasoud Ostad
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligencePriyanka Aash
 
Modul metasploit
Modul metasploitModul metasploit
Modul metasploitSetia Juli Irzal Ismail
 
Infoblox Secure DNS Solution
Infoblox Secure DNS SolutionInfoblox Secure DNS Solution
Infoblox Secure DNS SolutionSrikrupa Srivatsan
 
For Critical Infrastructure Protection
For Critical Infrastructure ProtectionFor Critical Infrastructure Protection
For Critical Infrastructure ProtectionPriyanka Aash
 
Introducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware AnalysisIntroducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware AnalysisBrian Baskin
 
Jurnal metasploit(revisi)
Jurnal metasploit(revisi)Jurnal metasploit(revisi)
Jurnal metasploit(revisi)Setia Juli Irzal Ismail
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Danny Akacki
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philAPhil Agcaoili
 
Your Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet TakeoverYour Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet TakeoverAhmed EL-KOSAIRY
 
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...Felipe Prado
 
AktaionPPTv5_JZedits
AktaionPPTv5_JZeditsAktaionPPTv5_JZedits
AktaionPPTv5_JZeditsRod Soto
 
Cant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardCant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardSlawomir Jasek
 
Mobile application security and threat modeling
Mobile application security and threat modelingMobile application security and threat modeling
Mobile application security and threat modelingShantanu Mitra
 
Security Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemSecurity Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemMartin Vigo
 
A modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systemsA modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systemsAlane Moran
 

Weitere ähnliche Inhalte

Andere mochten auch

Concepts of Malicious Windows Programs
Concepts of Malicious Windows ProgramsConcepts of Malicious Windows Programs
Concepts of Malicious Windows ProgramsNatraj G
 
Dns security threats and solutions
Dns security threats and solutionsDns security threats and solutions
Dns security threats and solutionsFrank Victory
 
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera... SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...AlienVault
 
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responseEnabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responsejeffmcjunkin
 
PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1amiable_indian
 
Level Up Your Security with Threat Intelligence
Level Up Your Security with Threat IntelligenceLevel Up Your Security with Threat Intelligence
Level Up Your Security with Threat IntelligenceIBM Security
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligencePriyanka Aash
 
For Critical Infrastructure Protection
For Critical Infrastructure ProtectionFor Critical Infrastructure Protection
For Critical Infrastructure ProtectionPriyanka Aash
 
Introducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware AnalysisIntroducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware AnalysisBrian Baskin
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Danny Akacki
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philAPhil Agcaoili
 
Your Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet TakeoverYour Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet TakeoverAhmed EL-KOSAIRY
 

Andere mochten auch (16)

Concepts of Malicious Windows Programs
Concepts of Malicious Windows ProgramsConcepts of Malicious Windows Programs
Concepts of Malicious Windows Programs
 
Dns security threats and solutions
Dns security threats and solutionsDns security threats and solutions
Dns security threats and solutions
 
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera... SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
SANS Ask the Expert: An Incident Response Playbook: From Monitoring to Opera...
 
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident responseEnabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident response
 
PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1PE Packers Used in Malicious Software - Part 1
PE Packers Used in Malicious Software - Part 1
 
Level Up Your Security with Threat Intelligence
Level Up Your Security with Threat IntelligenceLevel Up Your Security with Threat Intelligence
Level Up Your Security with Threat Intelligence
 
SOC Foundation
SOC FoundationSOC Foundation
SOC Foundation
 
Dreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat IntelligenceDreaming of IoCs Adding Time Context to Threat Intelligence
Dreaming of IoCs Adding Time Context to Threat Intelligence
 
Modul metasploit
Modul metasploitModul metasploit
Modul metasploit
 
Infoblox Secure DNS Solution
Infoblox Secure DNS SolutionInfoblox Secure DNS Solution
Infoblox Secure DNS Solution
 
For Critical Infrastructure Protection
For Critical Infrastructure ProtectionFor Critical Infrastructure Protection
For Critical Infrastructure Protection
 
Introducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware AnalysisIntroducing Intelligence Into Your Malware Analysis
Introducing Intelligence Into Your Malware Analysis
 
Jurnal metasploit(revisi)
Jurnal metasploit(revisi)Jurnal metasploit(revisi)
Jurnal metasploit(revisi)
 
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
Hunting: Defense Against The Dark Arts - BSides Philadelphia - 2016
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA
 
Your Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet TakeoverYour Botnet is My Botnet: Analysis of a Botnet Takeover
Your Botnet is My Botnet: Analysis of a Botnet Takeover
 

Ähnlich wie Big Game Hunting - Peculiarities In Nation State Malware Research

DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...Felipe Prado
 
AktaionPPTv5_JZedits
AktaionPPTv5_JZeditsAktaionPPTv5_JZedits
AktaionPPTv5_JZeditsRod Soto
 
Cant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardCant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardSlawomir Jasek
 
Mobile application security and threat modeling
Mobile application security and threat modelingMobile application security and threat modeling
Mobile application security and threat modelingShantanu Mitra
 
Security Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemSecurity Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemMartin Vigo
 
A modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systemsA modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systemsAlane Moran
 
Information security & ethical hacking
Information security & ethical hackingInformation security & ethical hacking
Information security & ethical hackingeiti panchkula
 
IoThings you don't even need to hack
IoThings you don't even need to hackIoThings you don't even need to hack
IoThings you don't even need to hackSlawomir Jasek
 
New era of authentication
New era of authenticationNew era of authentication
New era of authenticationsunil kumar
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerForAllSecure
 
So You Want a Job in Cybersecurity
So You Want a Job in CybersecuritySo You Want a Job in Cybersecurity
So You Want a Job in CybersecurityTeri Radichel
 
Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Mikko Ohtamaa
 
Android: it's time to go to work!
Android: it's time to go to work!Android: it's time to go to work!
Android: it's time to go to work!Pietro F. Maggi
 
BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.Jakub Kałużny
 
Stanford Cybersecurity January 2009
Stanford Cybersecurity January 2009Stanford Cybersecurity January 2009
Stanford Cybersecurity January 2009Jason Shen
 
Next Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA ComplianceNext Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA ComplianceNext Dimension Inc.
 
3d password 23 mar 14
3d password 23 mar 143d password 23 mar 14
3d password 23 mar 14Saddam Ahmed
 
Security Theatre - Benelux
Security Theatre - BeneluxSecurity Theatre - Benelux
Security Theatre - Beneluxxsist10
 

Ähnlich wie Big Game Hunting - Peculiarities In Nation State Malware Research (20)

DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
 
AktaionPPTv5_JZedits
AktaionPPTv5_JZeditsAktaionPPTv5_JZedits
AktaionPPTv5_JZedits
 
Cant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless cardCant touch this: cloning any Android HCE contactless card
Cant touch this: cloning any Android HCE contactless card
 
Mobile application security and threat modeling
Mobile application security and threat modelingMobile application security and threat modeling
Mobile application security and threat modeling
 
Security Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against ThemSecurity Vulnerabilities: How to Defend Against Them
Security Vulnerabilities: How to Defend Against Them
 
A modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systemsA modern approach to safeguarding your ICS and SCADA systems
A modern approach to safeguarding your ICS and SCADA systems
 
Information security & ethical hacking
Information security & ethical hackingInformation security & ethical hacking
Information security & ethical hacking
 
IoThings you don't even need to hack
IoThings you don't even need to hackIoThings you don't even need to hack
IoThings you don't even need to hack
 
New era of authentication
New era of authenticationNew era of authentication
New era of authentication
 
Automotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a HackerAutomotive Cybersecurity: Test Like a Hacker
Automotive Cybersecurity: Test Like a Hacker
 
So You Want a Job in Cybersecurity
So You Want a Job in CybersecuritySo You Want a Job in Cybersecurity
So You Want a Job in Cybersecurity
 
cybersecurity-careers.pdf
cybersecurity-careers.pdfcybersecurity-careers.pdf
cybersecurity-careers.pdf
 
Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)
 
Android: it's time to go to work!
Android: it's time to go to work!Android: it's time to go to work!
Android: it's time to go to work!
 
BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.BSides London 2015 - Proprietary network protocols - risky business on the wire.
BSides London 2015 - Proprietary network protocols - risky business on the wire.
 
Stanford Cybersecurity January 2009
Stanford Cybersecurity January 2009Stanford Cybersecurity January 2009
Stanford Cybersecurity January 2009
 
Next Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA ComplianceNext Dimension and Cisco | Solutions for PIPEDA Compliance
Next Dimension and Cisco | Solutions for PIPEDA Compliance
 
3D Password
3D Password3D Password
3D Password
 
3d password 23 mar 14
3d password 23 mar 143d password 23 mar 14
3d password 23 mar 14
 
Security Theatre - Benelux
Security Theatre - BeneluxSecurity Theatre - Benelux
Security Theatre - Benelux
 

Mehr von pinkflawd

The Magic Superpowers of a well-established "Us"
The Magic Superpowers of a well-established "Us"The Magic Superpowers of a well-established "Us"
The Magic Superpowers of a well-established "Us"pinkflawd
 
La Quadrature Du Cercle - The APTs That Weren't
La Quadrature Du Cercle - The APTs That Weren'tLa Quadrature Du Cercle - The APTs That Weren't
La Quadrature Du Cercle - The APTs That Weren'tpinkflawd
 
The A and the P of the T
The A and the P of the TThe A and the P of the T
The A and the P of the Tpinkflawd
 
Zeus' Not Dead Yet
Zeus' Not Dead YetZeus' Not Dead Yet
Zeus' Not Dead Yetpinkflawd
 
How would you find what you can't see?
How would you find what you can't see?How would you find what you can't see?
How would you find what you can't see?pinkflawd
 
Catch Me If You Can
Catch Me If You CanCatch Me If You Can
Catch Me If You Canpinkflawd
 
Curing A 15 Year Old Desease
Curing A 15 Year Old DeseaseCuring A 15 Year Old Desease
Curing A 15 Year Old Deseasepinkflawd
 
Troopers Diffray v1.1
Troopers Diffray v1.1Troopers Diffray v1.1
Troopers Diffray v1.1pinkflawd
 
brightfuture
brightfuturebrightfuture
brightfuturepinkflawd
 

Mehr von pinkflawd (11)

The Magic Superpowers of a well-established "Us"
The Magic Superpowers of a well-established "Us"The Magic Superpowers of a well-established "Us"
The Magic Superpowers of a well-established "Us"
 
La Quadrature Du Cercle - The APTs That Weren't
La Quadrature Du Cercle - The APTs That Weren'tLa Quadrature Du Cercle - The APTs That Weren't
La Quadrature Du Cercle - The APTs That Weren't
 
Shooting
ShootingShooting
Shooting
 
The A and the P of the T
The A and the P of the TThe A and the P of the T
The A and the P of the T
 
Zeus' Not Dead Yet
Zeus' Not Dead YetZeus' Not Dead Yet
Zeus' Not Dead Yet
 
TS/NOFORN
TS/NOFORNTS/NOFORN
TS/NOFORN
 
How would you find what you can't see?
How would you find what you can't see?How would you find what you can't see?
How would you find what you can't see?
 
Catch Me If You Can
Catch Me If You CanCatch Me If You Can
Catch Me If You Can
 
Curing A 15 Year Old Desease
Curing A 15 Year Old DeseaseCuring A 15 Year Old Desease
Curing A 15 Year Old Desease
 
Troopers Diffray v1.1
Troopers Diffray v1.1Troopers Diffray v1.1
Troopers Diffray v1.1
 
brightfuture
brightfuturebrightfuture
brightfuture
 

Kürzlich hochgeladen

Unleashing the Power of the SORA AI lastest leap
Unleashing the Power of the SORA AI lastest leapUnleashing the Power of the SORA AI lastest leap
Unleashing the Power of the SORA AI lastest leapRishantSharmaFr
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projectssmsksolar
 
Computer Networks Basics of Network Devices
Computer Networks Basics of Network DevicesComputer Networks Basics of Network Devices
Computer Networks Basics of Network DevicesChandrakantDivate1
 
DeepFakes presentation : brief idea of DeepFakes
DeepFakes presentation : brief idea of DeepFakesDeepFakes presentation : brief idea of DeepFakes
DeepFakes presentation : brief idea of DeepFakesMayuraD1
 
Thermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptThermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptDineshKumar4165
 
Thermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VThermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VDineshKumar4165
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityMorshed Ahmed Rahath
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTbhaskargani46
 
Employee leave management system project.
Employee leave management system project.Employee leave management system project.
Employee leave management system project.Kamal Acharya
 
Online electricity billing project report..pdf
Online electricity billing project report..pdfOnline electricity billing project report..pdf
Online electricity billing project report..pdfKamal Acharya
 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXssuser89054b
 
Rums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfRums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfsmsksolar
 
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...soginsider
 
Double Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torqueDouble Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torqueBhangaleSonal
 
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwait
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills KuwaitKuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwait
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwaitjaanualu31
 
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxHOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxSCMS School of Architecture
 
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...Health
 
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Call Girls Mumbai
 
Air Compressor reciprocating single stage
Air Compressor reciprocating single stageAir Compressor reciprocating single stage
Air Compressor reciprocating single stageAbc194748
 

Kürzlich hochgeladen (20)

Unleashing the Power of the SORA AI lastest leap
Unleashing the Power of the SORA AI lastest leapUnleashing the Power of the SORA AI lastest leap
Unleashing the Power of the SORA AI lastest leap
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects
 
Computer Networks Basics of Network Devices
Computer Networks Basics of Network DevicesComputer Networks Basics of Network Devices
Computer Networks Basics of Network Devices
 
DeepFakes presentation : brief idea of DeepFakes
DeepFakes presentation : brief idea of DeepFakesDeepFakes presentation : brief idea of DeepFakes
DeepFakes presentation : brief idea of DeepFakes
 
Thermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptThermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.ppt
 
Thermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - VThermal Engineering-R & A / C - unit - V
Thermal Engineering-R & A / C - unit - V
 
Integrated Test Rig For HTFE-25 - Neometrix
Integrated Test Rig For HTFE-25 - NeometrixIntegrated Test Rig For HTFE-25 - Neometrix
Integrated Test Rig For HTFE-25 - Neometrix
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna Municipality
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPT
 
Employee leave management system project.
Employee leave management system project.Employee leave management system project.
Employee leave management system project.
 
Online electricity billing project report..pdf
Online electricity billing project report..pdfOnline electricity billing project report..pdf
Online electricity billing project report..pdf
 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 
Rums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdfRums floating Omkareshwar FSPV IM_16112021.pdf
Rums floating Omkareshwar FSPV IM_16112021.pdf
 
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...
Hazard Identification (HAZID) vs. Hazard and Operability (HAZOP): A Comparati...
 
Double Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torqueDouble Revolving field theory-how the rotor develops torque
Double Revolving field theory-how the rotor develops torque
 
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwait
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills KuwaitKuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwait
Kuwait City MTP kit ((+919101817206)) Buy Abortion Pills Kuwait
 
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptxHOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
HOA1&2 - Module 3 - PREHISTORCI ARCHITECTURE OF KERALA.pptx
 
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...
+97470301568>> buy weed in qatar,buy thc oil qatar,buy weed and vape oil in d...
 
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
Bhubaneswar🌹Call Girls Bhubaneswar ❤Komal 9777949614 💟 Full Trusted CALL GIRL...
 
Air Compressor reciprocating single stage
Air Compressor reciprocating single stageAir Compressor reciprocating single stage
Air Compressor reciprocating single stage
 

Big Game Hunting - Peculiarities In Nation State Malware Research