Jared Naude (140)
Attack Mining: How to use distributed sensors to identify and take down adversaries by Lars König
Buckle up for a deep dive into the constant battle to protect systems on the internet against adversaries gaining access, and how you can help make the internet a safer place!
You can get involved by using the data which is available on GitHub, deploying or own attack pod or joining the team to fight against these groups. #38c3
Does any of this work? Looking at the statistics, from 264 000 cases:
1) Average take down time is 5 days.
2) China Telecom does not accept abuse reports.
3) Digital Ocean supports XARF and average takedown is 28 Hours.
4) Tencent does not care about abuse notification unless it comes from government or law enforcement.
The graph shows a subset that was investigated. This shows 238 unique IPs between Feb - Dec. Each IP scan contains 169 username and password combination. #38c3
From the data, Lars has created these 2 diagrams. The first diagram shows where the attacks come from. The second diagram shows the map of IOT devices. #38c3
Lars has an idea to create an attacker pod hosted in docker that would allow attackers to log in, capture the credentials and then deny the log on attempt. This is a scalable solution. #38c3
Very large variety of passwords that are being used. Victim customization does not happen as it does with user names. By using the user names and passwords that adversaries use, we could do adversary fingerprinting. #38c3
By combing several attributes, this data can be visualized in a multi-dimensional environment. By reducing the dimensions, a graph can be created to visualize this better. #38c3
Adversaries will often brute force well known user names (Root, admin, user, test, etc). However, they will also create a list that is specific to a domain and site. The next set of users that are targeted are accounts created by applications that are installed (e.g. postgres) #38c3
