Network Security Monitoring - Theory and Practice

Network Security Monitoring: Theory and Practice presentation for EUSecWest '06 conference 2006/02/21

Technology

Network Security Monitoring – Theory and Practice
Network Security Monitoring
Theory and Practice
Michael Boman
IT Security Researcher and Developer
proxy@11a.nu | http://proxy.11a.nu

Network Security Monitoring – Theory and Practice
About Me
● Born in Sweden, been working in Singapore for
the last 6 years
● Spent the last 5 years specializing in IT Security
● Currently working for KPMG Singapore

Network Security Monitoring – Theory and Practice
Agenda
● Network Security Monitoring (NSM) Theory
● Network Security Monitoring (NSM) Practice

Network Security Monitoring – Theory and Practice
Assumptions
● Some intruders are smarter than you
● Intruders are unpredictable
● Prevention eventually fails

Network Security Monitoring – Theory and Practice
Limitations of
Alert Based Approach
1)IDS generates an alert when a packet is matched
2)Analyst's interface displays the offending packet
3)Analyst trying to make decision regarding if the
event is a false positive or if the incident response
team needs to be informed
4)Usually no other information is easily available
to the analyst to make a more informed
judgement (if any was collected in the first place)

Network Security Monitoring – Theory and Practice
History of NSM
● 1980 – “Computer Security Threat Monitoring and
Surveillance” (James P. Anderson)
● 1990 – “A Network Security Monitor” (L. Todd
Heberlein et al.)
● 2002 – “Network Security Monitoring” (Bamm Visscher
& Richard Bejtlich)
– Defined NSM as “the collection, analysis and
escalation of indications and warnings (I&W) to
detect and respond to intrusions”

Network Security Monitoring – Theory and Practice
What is NSM?
● Collection
● Analysis
● Escalation

Network Security Monitoring – Theory and Practice
NSM Data Types
● Alert data
● Statistical
● Session
● Full content
Less
More
Storage requirement

Network Security Monitoring – Theory and Practice
Data Collection
● Collect as much data you legally and technically
can

Network Security Monitoring – Theory and Practice
Data Collection
● Sometimes you can't collect everything, but
consider this:
– Data sampling is better than nothing
– Traffic analysis is better than nothing

Network Security Monitoring – Theory and Practice
NSM's role in Incident Response
● What else did the intruder potentially
compromise?
● What tools did he download?
● Who else do we need to inform?

Network Security Monitoring – Theory and Practice
NSM in practice - Sguil
● Sguil is an open source project whose tag line is
“For Analysts - By Analysts”
● Written in TCL/TK by Bamm Visscher, with
many contributors (including myself)
● Sensor / Server / Client architecture

Network Security Monitoring – Theory and Practice
History of Sguil
● SPREG – Proprietary in-house ancestor of Sguil
developed in Perl/TK, around 2000-2001
● Sguil development started late 2002
● First public release was 0.2, May 2003
● Current version is 0.6.1

Network Security Monitoring – Theory and Practice
Sguil Analyst Console

Network Security Monitoring – Theory and Practice
Sguil Framework Demo

Network Security Monitoring – Theory and Practice
Future of Sguil
● PADS (Passive Asset Detection System)
Integration
● SnortSAM Integration
● Snort rule management

Network Security Monitoring – Theory and Practice
NSM in the Real World
● Who is using it
– Fortune 500 Companies
– US Government Labs
– Universities
– MSSPs

Network Security Monitoring – Theory and Practice
NSM in the Real World
● Real life success stories
– Charles Tomlin used Sguil to track down a recent
compromise
● http://www.ecs.soton.ac.uk/~cet/2006-01-01.html

Network Security Monitoring – Theory and Practice
NSM in the Real World
● NSM Products / Projects
– Apparently Sguil is the only public available product /
project that utilizes NSM methodology

Network Security Monitoring – Theory and Practice
What NSM is Not
● NSM Is Not Device Management
● NSM Is Not Security Event Management
● NSM Is Not Network-Based Forensics
● NSM Is Not Intrusion Prevention

Network Security Monitoring – Theory and Practice
Books
● The Tao of Network Security Monitoring:
Beyond Intrusion Detection
– By Richard Bejtlich
– Publisher: Addison-Wesley; ISBN: 0321246772
● Extrusion Detection: Security Monitoring for
Internal Intrusions
– By Richard Bejtlich
– Publisher: Addison-Wesley; ISBN 0321349962

Network Security Monitoring – Theory and Practice
Thank You
Questions?
There is no secure end-state
– only eternal vigilance
My Website is at http://proxy.11a.nu
Sguil can be downloaded at http://www.sguil.net

This document summarizes research into security vulnerabilities in industrial robot controllers. The researchers analyzed the attack surface and potential robot-specific attacks against an industrial robot controller. They identified 5 robot-specific attacks, including control loop alteration, tampering with calibration parameters, and tampering with production logic. As a case study, the researchers analyzed vulnerabilities in a particular controller running Windows CE and were able to fully exploit it to demonstrate proof-of-concept attacks violating accuracy, safety, and integrity requirements. The document concludes that future challenges include securing collaborative robots and addressing vulnerabilities introduced by increased connectivity and programmability in Industry 4.0 trends.

Lesson 1

This document discusses physical security considerations for protecting computing facilities and information assets. It covers key physical access controls like walls, fences, locks, ID badges, alarms and electronic monitoring. Critical environment factors are also addressed, such as fire safety and ensuring proper temperature, humidity and power. The roles of general management, IT and information security professionals in implementing physical security measures are defined. Maintaining secure computer rooms and wiring closets is emphasized, as logical access controls can be easily defeated without strong accompanying physical security.

Lesson 3

This document discusses the design of security architecture and contingency planning. It covers spheres of security and levels of controls that make up a security framework. Defense in depth through multiple layers of controls is described. The importance of security education, training, and awareness programs is emphasized to reduce accidental breaches and build security knowledge. Contingency plans like incident response, disaster recovery, and business continuity plans aim to restore operations during and after incidents. The contingency planning process involves impact analysis, preventive controls, recovery strategies, plan development, testing and more.

Lesson 1- Intrusion Detection

This document discusses intrusion detection and prevention systems (IDPS). It defines the key concepts of intrusion detection, prevention, reaction, and correction. There are two main types of IDPS: network-based systems which monitor network traffic for attacks, and host-based systems which monitor activity on individual hosts. The document outlines the advantages and disadvantages of both approaches. It also describes different models of network-based IDPS including wireless and network behavior analysis systems.

Lesson 3- Effectiveness of IDPS

This document discusses intrusion detection and prevention systems (IDPS), honeypots, and security scanning and analysis tools. It describes how IDPS effectiveness is measured, different types of IDPS, and how honeypots, honeynets, and padded cell systems work. Finally, it outlines various scanning and analysis tools like port scanners, firewall analyzers, OS detectors, vulnerability scanners, packet sniffers, and wireless security tools that can be used both by attackers and defenders.

Ise viii-information and network security [10 is835]-solution

Vivek Maurya

This document contains the question paper solution from VTU for the course Information and Network Security 10IS835. It discusses various topics in system security policies, including: - How managerial guidelines and technical specifications can be used in system-specific security policies. - Who is responsible for policy management and how policies are managed. - The different approaches for creating and managing issue-specific security policies. - The major steps and components of contingency planning, including the business impact analysis. - Pipkin's three categories of incident indicators and the ISO/IEC 270xx standard for information security management. - The importance of incident response planning and testing security response plans. - The

Cybersecurity Summit AHR20 Recover Tridium

Cimetrics Inc

The document discusses recovering from a malware attack that has affected an organization's IT and OT networks. It outlines key aspects of recovery including recovery planning, communications, and technical functionality restoration. Recovery planning requires having a detailed plan for various scenarios. Communications involve informing internal stakeholders, customers, and media. Technical recovery priorities restoration of critical systems and services while ensuring the threat is addressed. The recovery process is complex and requires coordination across teams.

Fundamentals of threats and risk management course, cybersecurity

Tonex

The document discusses principles of information security including legal, ethical and professional issues. It covers major national laws affecting information security practice, deterring unethical behavior, codes of ethics from professional organizations like ACM, (ISC)2, SANS, ISACA and ISSA. It also discusses key US federal agencies that deal with cybersecurity and their roles, including DHS, Secret Service, FBI and NSA.

Lesson 1

The document discusses the implementation phase of a security project life cycle. It explains that an organization's security blueprint must be translated into a detailed project plan that addresses leadership, budget, timelines, staffing needs, and organizational considerations. An effective project plan uses a work breakdown structure and considers financial, priority, scheduling, procurement, and change management factors. The project manager plays a key role in planning, supervising, and wrapping up the project successfully.

Chapter 1 Presentation

Amy McMullin

The document provides an overview of presentations for chapters in a security guidebook. It states that the presentations cover the chapter objectives and list all objectives at the beginning. The presentations can be customized for class needs and include some figures from the chapters. It then provides an excerpt from Chapter 1 which discusses the challenges of securing information, defines key security concepts, and identifies common types of attackers and basic steps of an attack. It also outlines the five principles of defense: layering, limiting access, diversity, obscurity, and simplicity.

Information Security Aspects of the Public Safety Data Interoperability Network

Blaz Ivanc

Major security incidents require cross-border cooperation with the national security authorities and other public safety agencies. The purpose of the REDIRNET (Emergency Responder Data Interoperability Network) consortium was to provide a true Europe-wide interoperability that is non-reliant on specific technology or proprietorial system. In a technical sense, the REDIRNET provides a communication solution for the exchange and sharing of information via voice, data, images, video, CCTV and remote sensors. In order to develop such capacity, it is necessary to ensure adequate security of the system and data protection.

Understanding Technology Stakeholders

John Gilligan

The document summarizes the key topics from a presentation on understanding technology stakeholders' progress and challenges with cyber security. It discusses the historical context of internet development and the increasing cyber threats facing both private industry and national security. It outlines recommendations from a cyber security commission to establish comprehensive strategies through public-private partnerships and supply chain risk management. Longer-term, it calls for redesigning the internet and fundamentally changing the software industry model to prioritize reliability and security over creativity in order to better protect critical infrastructure and the economy.

All about Cyber Security - From the perspective of a MS student

Apurv Singh Gautam

Enabling effective hunt teaming and incident response

jeffmcjunkin

This document provides an overview of enabling effective hunt teaming and incident response with limited resources. It defines hunt teaming as proactively assuming compromise, finding compromised hosts, determining how they were compromised through forensics, and implementing preventative and detective controls. Incident response is defined as reactively noticing an incident, stopping any active threats, and learning from the incident to implement improved controls. The document discusses how most attacks actually occur based on data from breaches, and provides examples of low-cost tools and techniques that can be used for persistence and program execution tracking, centralized logging, and data exfiltration detection.

Modern SOC Trends 2020

Modern SOCs face expanding attack surfaces, security talent shortages, and too many alerts from numerous tools. A modern SOC organizes teams by skills rather than levels, structures processes around threats instead of alerts, performs threat hunting, uses multiple visibility tools including logs and network data, and automates tasks through SOAR. It consumes and creates threat intelligence, elegantly uses third-party services, and does not treat incidents as rare or center itself around a single tool like a SIEM. A modern SOC recommends handling alerts but recognizing that is not the entire role, making analysts and engineers collaborate, hiring skills over levels, automating routines, and keeping fuzzy tasks for humans while using third parties for some tasks.

Visualization in the Age of Big Data

Raffael Marty

The extent and impact of recent security breaches is showing that current security approaches are just not working. But what can we do to protect our business? We have been advocating monitoring for a long time as a way to detect subtle, advanced attacks that are still making it through our defenses. However, products have failed to deliver on this promise. Current solutions don't scale in both data volume and analytical insights. In this presentation we will explore what security monitoring is. Specifically, we are going to explore the question of how to visualize a billion log records. A number of security visualization examples will illustrate some of the challenges with big data visualization. They will also help illustrate how data mining and user experience design help us get a handle on the security visualization challenges - enabling us to gain deep insight for a number of security use-cases.

Managing Network Security Monitoring at Large Scale with Puppet - PuppetConf ...

Puppet

All Hope is Not LostNetwork Forensics Exposes Today's Advanced Security Thr...

Savvius, Inc

Do you think it requires an advanced degree to initiate an advanced security attack? Think again. Tool kits are readily available for immediate download that guide those with even just basic computer skills through the steps to initiate complex network attacks. But all hope is not lost. One of the best defenses is readily available in the market today – network recorders with network forensics – and when combined with the appropriate visibility fabric architecture, these solutions defend against attacks on even the fastest networks available today. Join WildPackets and Gigamon as we explore the current state of network attacks, network vulnerabilities, and the solutions available to combat the most aggressive, and the most subtle, attacks.

SIEM 1 solution .pptx

AbdulrahmanMuhammadB

Network monitoring and SIEM solutions are critical for cybersecurity. Network monitoring provides administrators real-time visibility into network performance and health. It helps identify issues early, optimize efficiency, and detect security threats faster. SIEM solutions take this further by collecting and analyzing log data from all digital assets in one place. This gives insights to investigate suspicious activity and strengthen security. Key SIEM tools include Splunk, IBM QRadar, and LogRhythm, with each having their own pros and cons for threat detection, response, and management capabilities.

Enterprise Security Monitoring, And Log Management.

Boni Yeamin

Network security monitoring with open source tools

terriert

The document discusses implementing network security monitoring using open source tools. It begins with an introduction to network security monitoring (NSM) and its goal of collecting and analyzing different types of network data to detect and respond to intrusions. It then discusses recommended platforms and operating systems for NSM, such as various free/open BSD systems. Next, it covers ways to capture network traffic, including using hubs, taps, inline devices, or SPAN ports. It proceeds to describe the four types of data collected in NSM - full content, session, event, and statistical data. For each, it provides examples of open source tools and compares them to commercial options. Finally, it discusses the open source tool Sguil, which implements

Chapter 1.ppt

ssuserec53e73

This document provides an overview of network security for a course, including discussing cryptography algorithms and protocols, network security applications and tools, system security issues, and standards for internet security. The course will cover topics such as encryption, digital signatures, key exchange, and network security protocols and applications. Students will complete homework assignments, projects implementing cryptography and a secure messaging system, and exams.

computer architecture.ppt

Pandiya Rajan

Chapter 1.ppt

Tamer Nadeem

Security Analytics for Data Discovery - Closing the SIEM Gap

Eric Johansen, CISSP

This document discusses security analytics and hunting maturity. It defines hunting as a proactive approach to identifying incidents by actively looking for patterns, intelligence or hunches, rather than waiting for notifications. It describes the "SIEM gap" where SIEM tools are designed for known threats and lack the tools and flexibility for human analysis and hunting of unknown threats. It outlines techniques used in security analytics like event clustering, association analysis, and visualization to help analyze large datasets and discover unknown threats. The document argues security analytics provides the data access, analysis techniques and workflows to help close the SIEM gap and improve an organization's hunting maturity over time.

Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM

Jim Gilsinn

This document discusses network reliability monitoring as a complement to network security monitoring (NSM) and security information and event management (SIEM) for industrial control systems. It notes that while NSM works well for monitoring traffic crossing between zones in ICS networks, it is less effective in lower level zones where most traffic remains internal. Network reliability monitoring provides an alternative by developing profiles of normal network traffic and scanning for deviations that could indicate issues. While complex algorithms are not needed, it requires strong protocol knowledge and root cause analysis can be difficult. Examples are given showing network reliability metrics and how man-in-the-middle attacks did not significantly impact traffic.

SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends

Prof John Walker FRSA Purveyor Dark Intelligence

Dr. Anton Chuvakin discusses how security operations centers (SOCs) have evolved and modernized. He outlines three forces driving the need for modern SOCs: expanding attack surfaces, security talent shortages, and an overload of alerts. Key aspects of a modern SOC include organizing teams by skills rather than levels, structuring processes around threats instead of alerts, conducting threat hunting, using multiple data sources for visibility beyond just logs, and leveraging automation and third-party services. Modern SOCs also focus on detection engineering through content versioning, quality assurance of detections, reuse of detection content, and metrics to improve coverage. Chuvakin recommends that SOCs handle alerts but not focus solely on them, automate routines to free

APT Event - New York

John Walker gave a presentation at the Global APT Defense Summit in New York on responding to and surviving malware activity and network attacks. He discussed 11 key points for an effective security incident response, including indicating anomalies, using cyber intelligence to discover unknown threats, acquiring forensic artifacts, making timely decisions to mitigate impacts, following standards and guidelines, clear communications, maintaining tools and training, dealing with external stakeholders, conducting a post-incident review, and learning lessons. The presentation emphasized the importance of an evolved security operations capability and cross-team coordination to effectively engage security incidents.

The tops for collecting network based evidenceyou think that your.pdf

noelbuddy

The tops for collecting network based evidence: you think that your organization’s system has been attacked, or maybe an insider is emailing your organization’s trade secrets to a friend at a rival corporation. What should you do? The single most helpful network-based incident response activity is to deploy computer systems that do nothing but intercept or collect network communications. Capturing network communications is a critical and necessary step when investigating alleged crimes or abuses. In this chapter, we will demonstrate how to capture network traffic the ugly and bare-metal way, with software such as tcpdump and WinDump. We will discuss how to assemble a robust, secure, network-monitoring system and conduct full-content monitoring of network traffic. Catching the traffic is only a portion of the work; extracting meaningful results is the other challenge. After you have collected the raw data that composes your network-based evidence, you must analyze that data. The analysis of network-based evidence includes reconstructing the network activity, performing low-level protocol analysis, and interpreting the network activity. We will introduce the tools that you can use to analyze the data .If a law enforcement officer suspects an individual of a crime such as minor drug dealing, the suspect is usually placed under surveillance to confirm suspicions, accumulate evidence, and identify co-conspirators. The same approach works with suspected crimes against computer networks. Network monitoring is not intended to prevent attacks. Instead, it allows investigators to accomplish a number of tasks Network monitoring can include several different types of data collection: event monitoring, trap-and-trace monitoring, and full-content monitoring. When responding to computer security incidents, you will likely rely on collecting full-content data with tools such as tcpdump. However, there may be occasions when you will intercept solely the transactional data with a trap-and-trace. Event monitoring is based on rules or thresholds employed on the network- monitoring platform. Events are simply alerts that something occurred on your network. Traditional events are generated by a network IDS, but events can also be created by network health monitoring software like MRTG (Multi Router Traffic Grapher) or NTOP. Noncontent monitoring records the session or transaction data summarizing the network activity. Law enforcement refers to such noncontent monitoring as a pen register or a trap-and-trace. It typically includes the protocol, IP addresses, and ports used by a network communication. Additional data may include flags seen during the conversation (if TCP is used), counts of bytes of information sent by each side, and counts of packets sent by each side. Session data does not care about the content of a conversation. Here is a sample of session data, generated by tcptrace. Full-content monitoring yields data that includes the raw packets collected fr.

What's hot

Lesson 3

Lesson 1

Chapter 1 Presentation

Amy McMullin

Information Security Aspects of the Public Safety Data Interoperability Network

Blaz Ivanc

Understanding Technology Stakeholders

John Gilligan

All about Cyber Security - From the perspective of a MS student

Apurv Singh Gautam

Enabling effective hunt teaming and incident response

jeffmcjunkin

What's hot (7)

Lesson 3

Lesson 1

Chapter 1 Presentation

Information Security Aspects of the Public Safety Data Interoperability Network

Understanding Technology Stakeholders

All about Cyber Security - From the perspective of a MS student

Enabling effective hunt teaming and incident response

Similar to Network Security Monitoring - Theory and Practice

Modern SOC Trends 2020

Visualization in the Age of Big Data

Raffael Marty

Managing Network Security Monitoring at Large Scale with Puppet - PuppetConf ...

Puppet

All Hope is Not LostNetwork Forensics Exposes Today's Advanced Security Thr...

Savvius, Inc

SIEM 1 solution .pptx

AbdulrahmanMuhammadB

Enterprise Security Monitoring, And Log Management.

Boni Yeamin

Network security monitoring with open source tools

terriert

Chapter 1.ppt

ssuserec53e73

computer architecture.ppt

Pandiya Rajan

Chapter 1.ppt

Tamer Nadeem

Security Analytics for Data Discovery - Closing the SIEM Gap

Eric Johansen, CISSP

Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM

Jim Gilsinn

SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends

Prof John Walker FRSA Purveyor Dark Intelligence

APT Event - New York

The tops for collecting network based evidenceyou think that your.pdf

noelbuddy

security onion

Boni Yeamin

Enterprise Security and User Behavior Analytics

Splunk

Splunk Enterprise Security 4.5 provides security information and event management (SIEM) and a security intelligence platform. It includes features like adaptive response to extend analytics-driven decisions and automation, and glass tables to enhance visual analytics. Glass tables allow security teams to create custom visualizations that reflect their workflows and gain visibility across their security ecosystem. The update also includes improvements to detection, investigation, and response times through automation and correlation searches.

Splunk for Enterprise Security featuring User Behavior Analytics

Splunk

This session will review Splunk’s two premium solutions - Splunk Enterprise Security (ES) is Splunk's award-winning security intelligence solution that brings immediate value for continuous monitoring across SOC and incident response environments. Splunk UBA is a new technology that applies unsupervised machine learning and data science to solving one of the biggest problems in information security today: insider threat. You’ll learn how Splunk UBA works in tandem with ES, or third-party data sources, to bring significant automated analytical power to your SOC and Incident Response teams.

The Future of DevSecOps

Stefan Streichsbier

This talk by Stefan Streichsbier, Co-Founder of GuardRails.io, provides a brief history of how development, operations and security testing have become highly complex. It continues to outline the key problems with traditional security solutions and why in 2020 companies around the world are still figuring out a good way to manage security as part of rapid development cycles. Specifically, the big challenge of introducing and fixing new security issues versus tackling the existing security dept of existing applications. To quote Bishop Desmond Tutu, “There comes a point where we need to stop just pulling people out of the river. We need to go upstream and find out why they’re falling in.” After setting the stage, the remainder of the talk will focus on the paradigm shift that security solutions have to incorporate in order to solve the problem of sustainably secure applications on all layers. This will explore how the elements of Speed, Just in time training, and Data science have to be leveraged to empower development teams around the globe to get ahead for once and finally become able to move fast and be safe at the same time. The 3 core takeaways for the audience are: 1.) Where security practices have gone wrong so far. 2.) What new technologies will cause a paradigm shift in how security is applied at scale. 3.) How security will look like in 5-10 years.

Big Data Analytics to Enhance Security คุณอนพัทย์ พิพัฒน์กิติบดี Technical Ma...

BAINIDA

This document discusses using big data analytics to enhance security. It begins by defining big data analytics and describing security trends like the evolution from intrusion detection systems to security information and event management (SIEM) to next-generation SIEM using big data analytics. An example of an advanced persistent threat is provided. The document then discusses integrating security analytics with open source tools like SQRRL and Prelert. Finally, it covers how to apply these concepts by determining what security-related data can be collected and two options for implementing big data analytics in a security program.

Similar to Network Security Monitoring - Theory and Practice (20)

Modern SOC Trends 2020

Visualization in the Age of Big Data

Managing Network Security Monitoring at Large Scale with Puppet - PuppetConf ...

All Hope is Not LostNetwork Forensics Exposes Today's Advanced Security Thr...

SIEM 1 solution .pptx

Enterprise Security Monitoring, And Log Management.

Network security monitoring with open source tools

Chapter 1.ppt

computer architecture.ppt

Chapter 1.ppt

Security Analytics for Data Discovery - Closing the SIEM Gap

Network Reliability Monitoring for ICS: Going Beyond NSM and SIEM

SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends

APT Event - New York

The tops for collecting network based evidenceyou think that your.pdf

security onion

Enterprise Security and User Behavior Analytics

Splunk for Enterprise Security featuring User Behavior Analytics

The Future of DevSecOps

Big Data Analytics to Enhance Security คุณอนพัทย์ พิพัฒน์กิติบดี Technical Ma...

More from Michael Boman

How to drive a malware analyst crazy

Indicators of compromise: From malware analysis to eradication

This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.

44CON 2014: Using hadoop for malware, network, forensics and log analysis

DEEPSEC 2013: Malware Datamining And Attribution

Greg Hoglund explained at BlackHat 2010 that the development environments that malware authors use leaves traces in the code which can be used to attribute malware to a individual or a group of individuals. Not with the precision of name, date of birth and address but with evidence that a arrested suspects computer can be analysed and compared with the "tool marks" on the collected malware sample.

44CON 2013 - Controlling a PC using Arduino

Malware Analysis on a Shoestring Budget

Malware analysis as a hobby (Owasp Göteborg)

This document discusses Michael Boman's hobby of analyzing malware samples. It describes how he initially analyzed samples manually in a virtual environment but found it time consuming. He then created the Malware Analysis Research Toolkit (MART) project to automate the process. MART uses tools like Cuckoo Sandbox to analyze samples in virtual machines. It also includes components for sample acquisition, analysis, reporting, and data mining. The document discusses challenges with virtual machine analysis and ways to iterate the automation, such as doing brief static analysis on samples. It provides an overview of the hardware used in Boman's malware lab and discusses next steps for the project.

Malware Analysis as a Hobby

The document notes that manually analyzing malware can be time consuming and boring. MART was created to automate parts of the process such as sample acquisition, analysis using tools like Cuckoo Sandbox, and reporting. This reduces the time spent by malware analysts and allows them to focus on more complex samples. The system also aims to address limitations of virtual machine-based analysis by integrating additional techniques. Overall, MART streamlines malware analysis as a hobby while cutting costs compared to paying for commercial solutions.

Malware analysis as a hobby - the short story (lightning talk)

Michael Boman created the Malware Analyst Research Toolkit (MART) project to automate malware analysis as a hobby. MART uses public and private malware collections, Cuckoo Sandbox for analysis, and VirusTotal for additional results. It stores findings in MongoDB and provides a GUI for analysts. The initial investment was around €1,320 for a computer and license, but ongoing costs after the first year are only around €590 as the system automates most of the workflow. Future goals include expanding automated analysis to additional platforms like Android, OSX, and iOS.

Sans och vett på Internet

Blackhat USA 2011 - Cesar Cerrudo - Easy and quick vulnerability hunting in W...

This short workshop will teach attendees how to easily and quickly find vulnerabilities in Windows applications by using some easy to use tools. I will detail step by step some simple techniques that can be used by experts and non experts. While the techniques are simple the results can be great. Learning these easy and fast techniques will allow attendees to do quick audits on Windows applications to determine how secure they are. I will show how to spot vulnerabilities with just a couple of clicks or with very simple and short debugging sessions. The techniques I will be showing are the same that allowed me to find dozen of vulnerabilities in Windows applications, I'm sure that after the workshop attendees will be able to do the same.

Hur man kan testa sin HTTPS-server

OWASP AppSec Research 2010 - The State of SSL in the World

The document discusses the results of a large scale scan of HTTPS servers to analyze SSL/TLS configuration trends. Over 500,000 servers were scanned, including the Alexa Top 10,000 and Fortune 500 domains. Key findings included that Fortune 500 domains were more likely to enable HTTPS and use secure configurations compared to popular domains. Factors like industry sector did not strongly correlate with security level, but domains providing internet-facing services tended to use HTTPS more securely. Further investigation of the Swedish market was planned.

Enkla hackerknep för testareMichael Boman

Privacy In Wireless Networks Keeping Your Private Data Private 2008-08-08

This document summarizes threats to privacy when using wireless networks and provides technical solutions for keeping private data secure. It discusses attacks like data interception and man-in-the-middle attacks that can be used by individuals, corporations, and governments. The document recommends using SSL-enabled websites, VPN tunnels, and TOR networks to protect data and privacy. It also suggests using personal firewalls, antivirus software, and anti-spyware programs.

USB (In)Security 2008-08-22

Automatic Malware Analysis 2008-09-19

Overcoming USB (In)Security

Privacy in Wireless Networks

This document discusses threats to privacy when using wireless networks, such as data interception and man-in-the-middle attacks. It recommends using SSL-enabled websites, VPN tunnels, and TOR networks to protect private data from individuals, corporations, and governments. Basic protections like personal firewalls, antivirus software, and anti-spyware are also advised. The presentation covers technical solutions for keeping wireless data private and maintaining anonymity online.

Introduction To Linux Security