Download to read offline
Uploaded byPing Yan
Ripple Effect (preso @s4)
This document discusses the ripple effect of malware and domain generation algorithms (DGAs). It provides an example of the Cryptolocker malware which uses DGAs to generate domain names for its command and control servers to evade detection. The presentation includes a demo of tracking DGA domains on the Umbrella security graph and shows IP addresses from November 7th that resolved DGA domains, illustrating the ongoing nature of the threat. It concludes by asking if there are any questions.
Ripple Effect (preso @s4)
- 1. Ripple Effect Algorithmic Threat Intelligence& Containment Ping @OpenDNS.com
- 2. Ping Came from China Wasin U. of Arizona graduate school Data mining, Machine learning InfoSec
- 3. Agenda DNS transactions The RippleEffect Case study - Cryptolocker Demo
- 4. More IP, ASintel, the present and the past? What is this traffic spikes all about?
- 5. What are allthese weird stuff that one was requesting?
- 7. The Ripple Effect Theprocess of searching the newer and the unknown, … starting from the seeding intelligence
- 10. Cryptolocker DGA 1. Infection 2.retrieve encryption key from CnC 3. encrypt data files 4. collect money! IP CnC fails quickly ! DGA kicks in !
- 13. I don’t knowthe DGA!!!
- 14.
- 16.
- 17.
- 18.
- 19.
- 21.