This project about Pasteing websites like Pastebin.com. The project is part of Egyptian CERT incident handling team. The project is a Python class that keep monitoring pastebin and only shows pastes that are related to a specific filter. For example, a user can add the filter that looks for everything that includes ".gov.eg". We use a weighting function that receives an array of strings/regular expression. The weighting function uses the input to calculate the weight of each paste on pastebin. We keep reviewing the relevant pastes using the web interface of the application. We use Django framework for the UI. The purpose of the project is to stay aware with any potential DDOS attack or leakage of sensitive data that is related to Egypt. The next version of the script should be able to collect data from different pasting websites and correlate between them. The tool has been created by Ibrahim M. El-Sayed (me) and Mahmoud Raouf

1. Paste Digest
Ibrahim M. El-Sayed
Mahmoud Raouf

2. Outline
• Introduction
o Incident handling
o News
o The Spark
• Project
o Goal
o How
o Extendibility
o Performance
o Simplicity
• Conclusion
o Results
o Challenges
o Futuristic Vision

3. Introduction
Incident Handling
“Computer security incident management involves
the monitoring and detection of security events on a
computer or computer network, and the execution of
proper responses to those events.” - "ISO
17799|ISO/IEC 17799:2005(E)"

4. Introduction
• News
o Sony Pictures Entertainment Hack
o Anonymous #OpEgypt

5. Introduction
• The Spark
o Collect
o Analyze
o Correlate
o Notify

6. Idea
“A live channel that monitors, analyzes and
notifies the posts of the cyber attacks on pasting
websites“

7. Pastebin Server
Script
3 Seconds
Database
Pastebin File
How?

8. Demo

9. Extendibility
• Class diagram
• Extend to other websites
• Extend weight function

10. Performance
• Pattern matching
o Regex matching
o Knuth–Morris–Pratt algorithm O(N+M)
• 50000 chars
• Built in method: 0.000952557316432 sec
• KMP: 9.10658855941e-07
• Threading

11. Simplicity

12. Simplicity

13. Simplicity

14. Simplicity

15. Conclusion
• Results

16. Conclusion
• Challenges
o Getting blocked
o Encoding
o False positives

17. Conclusion
• To-Do
o Upgrade the database for archiving
o Correlating different pasting websites together
o Why storing everything?
o Availability
o Notifying with emails
• Vision

18. Acknowledgment
Ahmed Hassan
Ahmed Alaa

19. Questions