Jared Naude (140)
Does any of this work? Looking at the statistics, from 264 000 cases:
1) Average take down time is 5 days.
2) China Telecom does not accept abuse reports.
3) Digital Ocean supports XARF and average takedown is 28 Hours.
4) Tencent does not care about abuse notification unless it comes from government or law enforcement.
Attack Mining: How to use distributed sensors to identify and take down adversaries by Lars König
Buckle up for a deep dive into the constant battle to protect systems on the internet against adversaries gaining access, and how you can help make the internet a safer place!
Adversaries will often brute force well known user names (Root, admin, user, test, etc). However, they will also create a list that is specific to a domain and site. The next set of users that are targeted are accounts created by applications that are installed (e.g. postgres) #38c3
From the data, Lars has created these 2 diagrams. The first diagram shows where the attacks come from. The second diagram shows the map of IOT devices. #38c3
The speaker has automated this process by monitoring IP addresses, identifying the ISP contact, send abuse notification and then monitors for replies which goes to a LLM which will respond with any additional information as needed. #38c3
You can get involved by using the data which is available on GitHub, deploying or own attack pod or joining the team to fight against these groups. #38c3
The challenge with honey pots is doing target emulation is hard and adversaries could determine that it is a honey pot. By modifying the openssh-server it can help with the emulation without the adversaries knowing what is going on. #38c3
When these IPs are looked up in Shodan, they are residential IP addresses which shows either infected home or IOT devices. The speakers dives into a specific example of an adversary trying a set of specific passwords over and over again. #38c3
The graph shows a subset that was investigated. This shows 238 unique IPs between Feb - Dec. Each IP scan contains 169 username and password combination. #38c3
