Hack3rcon V presentation by @tothehilt and @synackpwn on the current state of 'cyber threat intelligence', how scanning CONPOTs make you OMG CHINA, and other nonsense in the industry.

1. I’m a Nation State and So Can You!

2. NextGen Cyber Threat Intel

3. Intros
SynAckPwn

4. Intros
tothehilt

5. Started With Derbycon
youtube.com/watch?v=7jfshUL-0yM

6. Know Your Protocols

7. Oops

8. OMG Chattanooga?
However, DouceNoozle Inc founder and Chief Technical
Officer Herbert A Derp points out that nation-states
sometimes launch attacks from computers within their own
borders because they control the Internet there and can
ensure the computers won't get taken offline.

9. Choo Choo Motherfucker
Beijing may not be a surprise, but Chattanooga?

10. "The scans were to
honeypots, so there is
no reason for any traffic
to be going to these
systems.”
“We found almost
nothing publicly
available about this IP."
“They run no legitimate services and have no DNS
entries, so any traffic to them is suspicious, especially
traffic to tcp port 102 that conforms to the S7comm spec.”

11. Threat Intel Derp Levels: Seeing what you want to see

12. Cyber Threat Intel: Purdy Lights & Meaningless Data

13. Cyber Threat Intel: Purdy Lights & Meaningless Data

14. Cyber Threat Intel: Purdy Lights & Meaningless Data

15. Cyber Threat Intel: Purdy Lights & Meaningless Data

16. Cyber Threat Intel: Purdy Lights & Meaningless Data

17. Cyber Threat Intel: Purdy Lights & Meaningless Data

18. Cyber Threat Intel: Purdy Lights & Meaningless Data

19. Cyber Threat Intel: Purdy Lights & Meaningless Data

20. What is (Real)Intel Analysis?
- Develop specific expertise, discern patterns of complex behavior, and
provide an accurate understanding of present and future threats.
- Apply highly developed inductive reasoning skills to provide a proactive approach to
potential threats.
- Navigate a variety of records, reports, miscellaneous communications, case files, and other sources to support
research and analysis.
- Initiate, establish, and maintain effective working relationships inside and outside the
FBI.
What makes a good IA? According to Marita Cook, a strategic analyst at FBI Headquarters, “You have to be very data
oriented. You need to understand the data and how all the pieces can be used together to see the larger picture. You
need to be intrigued by questions—why are things happening
the way they are? And above all,” she said, “you have to be persistent, following every lead to its logical conclusion.”
Find Meaningful Patterns in Meaningless Noise

21. What is Not?
Data Visualization ≠
Intel Analysis

22. Magic Quadrant
Level 0:
Just scanning shit - No
obfuscation needed
Level 1:
Non attribution - Still
legal
Level 2:
Non attribution -
Probably Illegal
Level 3:
OMG NSA - Going to
GITMO

23. Level 0
The ‘ErrataRob’ Model - Fuck you, I can scan
what I want and I’m going to let you know about it

24. Level 1
The ‘I Don’t Want to Be Weev’ Model - Still legal, but you
don’t want to deal with the hassle
Active scanning, browsing, FTP, etc. Not attacks, just using
the services available.

25. Level 2
The ‘Internet Census 2012’ Model - Illegal tactics for the
greater good (mostly harmless)

26. Level 3
The ‘Swat Brian Krebs’ Model - I just want to cause
harm on the internet, because lulz.

27. “NextGen Threat Intel”
Level 0 - OMG APTCHINA: Pings and port scans are
tagged as advanced attacks from adversaries.
Level 1/2 - Noise: Just obfuscated enough for them
to not care, activity not interesting enough to
investigate
Level 3 - Nation State Attention: FBI/NSA is on your
ass

28. Master De/b/ater
If you’re not doing anything
wrong, then you have
nothing hide.

29. Master De/b/ater
What is Real Threat Intel

30. Master De/b/ater
Is ‘Threat Intel’ Useful - Blue
Teams, Perimeter Defense,
Anything?

31. Master De/b/ater
Admitting we’re
wrong, current cyber
threat intel is only
mostly worthless, not
completely worthless

32. Questions?