securing and enabling dynamic business

Slides:

Advertisements

Similar presentations

Copyright 2009, Vigilant LLC Spy VS Spy Countering SpyEye with SpyEye Lance James Director of Intelligence Vigilant, LLC March 21 st,

Advertisements

Welcome to SpyEye Front-end interface called “CN 1” or “Main Access Panel.”

Protecting the irreplaceable | f-secure.com Internet threat monitoring and reporting service Idar Kvernevik Senior Researcher, Network Security Security.

Cyber Security - Threats James Clement Network Specialist ETS: Communications & Network Services

IBM Security Network Protection (XGS)

© 2012 IBM Corporation IBM Security Systems 1 © 2014 IBM Corporation IBM Security Network Protection (XGS) Advanced Threat Protection Integration Framework.

 Proxy Servers are software that act as intermediaries between client and servers on the Internet.  They help users on private networks get information.

1 E LECTRICAL E NGINEERING AND C OMPUTER S CIENCES U NIVERSITY OF C ALIFORNIA Berkeley Combating Stealth Malware and Botnets in Higher Education Educause.

Lesson 1: Understanding Browsers. This unit is a set of investigations into how to protect against digital threats, and how to detect digital crimes.

Norman SecureSurf Protect your users when surfing the Internet.

Threats and ways you can protect your computer. There are a number of security risks that computer users face, some include; Trojans Conficker worms Key.

PROJECT IN COMPUTER SECURITY MONITORING BOTNETS FROM WITHIN FINAL PRESENTATION – SPRING 2012 Students: Shir Degani, Yuval Degani Supervisor: Amichai Shulman.

China Science & Technology Network Computer Emergency Response Team Botnet Detection and Network Security Alert Tao JING CSTCERT,CNIC.

Securing Information Systems

Outline  Infections  1) r57 shell  2) rogue software  What Can We Do?  1) Seccheck  2) Virus total  3) Sandbox  Prevention  1) Personal Software.

B OTNETS T HREATS A ND B OTNETS DETECTION Mona Aldakheel

In Dire Straits: Straight Talk on Dyre

BotNet Detection Techniques By Shreyas Sali

2002 Symantec Corporation, All Rights Reserved The dilemma European Security Policy and Privacy Ilias Chantzos Government Relations EMEA Terena Conference,

Trend Micro Confidential 9/23/2015 Threat Rules Sharing Advanced Threats Research.

Click to edit Master title style Click to edit Master text styles Second level Third level Fourth level Fifth level June 10 th, 2009Event details (title,

Bots Used to Facilitate Spam Matt Ziemniak. Discuss Snort lab improvements Spam as a vehicle behind cyber threats Bots and botnets What can be done.

Jeong, Hyun-Cheol. 2 Contents DDoS Attacks in Korea 1 1 Countermeasures against DDoS Attacks in Korea Countermeasures against DDoS Attacks in.

Topics to be covered 1. What are bots,botnet ? 2.How does it work? 4.Prevention of botnet. 3.Types of botnets.

Software Security Testing Vinay Srinivasan cell:

CSU - DCE Internet Security... Privacy Overview - Fort Collins, CO Copyright © XTR Systems, LLC Setting Up & Using a Site Security Policy Instructor:

2012 4th International Conference on Cyber Conflict C. Czosseck, R. Ottis, K. Ziolkowski (Eds.) 2012 © NATO CCD COE Publications, Tallinn 朱祐呈.

Chapter 8 Safeguarding the Internet. Firewalls Firewalls: hardware & software that are built using routers, servers and other software A point between.

Trojan Virus By Forbes and Mark. What is a Trojan virus Trojans are malicious programs that perform actions that have not been authorised by the user.

© 2012 IBM Corporation IBM Security Systems 1 © 2014 IBM Corporation IBM Security Network Protection (XGS) Integration Framework: QRadar 7.2 MR1.

Topic 5: Basic Security.

IT Security. What is Information Security? Information security describes efforts to protect computer and non computer equipment, facilities, data, and.

Big Bad Botnet Day! Xeno Kovah In association with the Corporation for Public Botcasting, and Viewers Like You! Xeno Kovah In association with the Corporation.

Cybersecurity Test Review Introduction to Digital Technology.

Unit 2 Personal Cyber Security and Social Engineering Part 2.

Internet Vulnerabilities & Criminal Activity Internet Forensics 12.1 April 26, 2010 Internet Forensics 12.1 April 26, 2010.

Chapter 6 Introduction to Digital Security

AP CSP: Cybercrime.

Chapter 40 Internet Security.

Botnets A collection of compromised machines

Hotspot Shield Protect Your Online Identity

Lesson Objectives Aims You should be able to:

Chapter 7: Identifying Advanced Attacks

WEB APPLICATION TESTING

A lustrum of malware network communication: Evolution & insights

Instructor Materials Chapter 7 Network Security

Secure Software Confidentiality Integrity Data Security Authentication

Speaker : YUN–KUAN,CHANG Date : 2009/11/17

Chapter 6 Introduction to Digital Security

Threats to computers Andrew Cormack UKERNA.

Pulse: An Adaptive Intrusion Detection System for the Internet of Things (IoT) Good morning every one , I will give you a brief overview of the work my.

BotCatch: A Behavior and Signature Correlated Bot Detection Approach

Protect Your Computer Against Harmful Attacks!

Botnets A collection of compromised machines

Your Botnet is My Botnet: Analysis of a Botnet Takeover

Five Unethical Uses of Computers

MIT GSL 2018 week 1 | day 4 Introduction to Web Development II.

Risk of the Internet At Home

Malware, Phishing and Network Policies

Unit 1.6 Systems security Lesson 2

Brute force attacks, DDOS, Botnet, Exploit, SQL injection

Web Servers / Deployment

Computer Security.

Faculty of Science IT Department By Raz Dara MA.

Intrusion Detection system

COSC-100 (Elements of Computer Science) Prof. Juola

Computer Security By: Muhammed Anwar.

WJEC GCSE Computer Science

Test 3 review FTP & Cybersecurity

Presentation transcript:

securing and enabling dynamic business Spy VS Spy Countering SpyEye with SpyEye Lance James Director of Intelligence Vigilant, LLC March 21st, 2011

Lance James Lance James Brief Bio: Director of Intelligence, Vigilant, LLC Founder of Secure Science Corporation Brief Bio: Infosec over a decade, development, research, network intrusion, cryptography (IIP/I2P), IntelliFound, Daylight Author of “Phishing Exposed”, Co-Author of “Emerging Threat Analysis” 3rd Book on it’s way (counter-intelligence) Loves Karaoke Very Hyper (but I am getting old)

Research SpyEye Law Web Panel based C&C DIY Builder Kits Merging with Zeus $1000-$3000 WMZ Law Title 18 USC 1030 Color of Right Expectation of Privacy

SpyEye

Components of SpyEye Trojan Build it yourself Data interception Formgrabs Credit Cards Software Collection Process hooking Kills Zeus/Zeus Merger UPX Packed (most cases)

Components of SpyEye Web-based Panel SYN 1 (Blind Drop) Formgrabber/Data Manager FTP Theft Bank of America Theft Stats CN 1 (Command & Control) Binary Updates Configuration Updates Statistic collection Plugins Backconnect (SOCKS5/FTP)

Builder

Web Panel (SYN 1)

Web Panel (CN 1)

Web Panel Investigation What we know Web Panel Investigation Build Inference (directories and files) Debug.log (general traffic) Error.log (possible leaked IP’s and other info) Tasks.log (what it’s doing) Backup.sh (sql dump and passwords) Config.ini (settings) Understand the code AJAX driven AJAX queries and refreshes for data

Debug.log

Case Study CnC Host: 91.211.117.25/sp/admin (currently down) History: specific URI discovered publicly 09/07/2010 Prior attacks from this IP discovered 07/26/2010 (same operator) ASN 48587 (known for malicious activity) Location: Ukraine (UA) AS Name: Private Entrepreneur Zharkov Mukola Mukolayovuch Malware Life-cycle: Monday 08/30/10 – Friday, 09/24/10 (25 days) Unique computers infected: 28,590 Unique binaries distributed: 2,325

C&C Activity

Botnet Infections

C&C has many world readable files Including Frm_grab.php C&C Advancement & Law C&C has many world readable files Including Frm_grab.php Doesn’t work without AJAX environment Same concept as request 1 world readable file Many requests at once Very useful intelligence Very complicated Legally Explain what we did to a jury or judge Explain it to attorney DOJ conservative to risk

How it works C&C Target (SYN 1) main page password protected (illegal in US to log in)

Log in to local C&C setup Eating Dog Food Log in to local C&C setup Fire up Proxy, Set Servers to Stun!

Kibbles & Bits Proxy Setup – either with burp or netsed Header Modification Browser proxy configuration

Target Acquired When this changes we know we are connected

All data compromised in real time Bot GUIDS per data compromise Results All data compromised in real time Bot GUIDS per data compromise Dates of compromises Bonus points! Bad guy activity The day before 0 Settings We can update the botnets (Not Approved)

Spy Wars Adversary is quick, no boundaries Jedi tools Jedi Council Disciplined Philosophy Jedi skill Limited by Law

Be the Smart Jedi May the Force Be With Us Do or Do Not! We’re gonna need it Do or Do Not! There is no try Yoda is awesome

Contact Thank You! Lance James Director of Intelligence ljames@thevigilant.com http://www.thevigilant.com