SecTor 2011 Keynote: Online Attacks and Espionage by Nation-states
•
0 likes•502 views
This document discusses online attacks and espionage by nation-states. It notes that certain groups like supporters of Tibet or Uighur minorities are often targeted. It provides examples of malware used in these attacks like Poison Ivy and Gh0st Rat. The document lists domains and IP addresses that have been seen connecting to targeted machines. It advises patching systems, removing Adobe Reader, adding firewall traps, and hopes of not being directly targeted.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to SecTor 2011 Keynote: Online Attacks and Espionage by Nation-states
Similar to SecTor 2011 Keynote: Online Attacks and Espionage by Nation-states (20)
More from Mikko Hypponen
Recently uploaded
Recently uploaded (20)
SecTor 2011 Keynote: Online Attacks and Espionage by Nation-states
- 1. ONLINE ATTACKS AND ESPIONAGE BY NATION-STATES Mikko Hypponen CRO, F-Secure Corp twitter.com/mikko Protecting the irreplaceable | f-secure.com
- 2. Fake News? Hacked News site?
- 11. 6es7-417
- 13. Duqu
- 14. Connects to 206.183.111.97 aka canoyragomez.rapidns.com
- 17. Protecting the irreplaceable | f-secure.com
- 18. Protecting the irreplaceable | f-secure.com
- 21. 21
- 24. Document Exploit Code EXE DOC Filling
- 28. 28
- 29. 29
- 40. Little financial incentive to target: • Supporters of Tibet • Members of Falun Dafa / Falun Kong • Supporters of the Uighur minorities • Supporters of Inner Mongolian minorities
- 41. Data from Messagelabs / Symantec study
- 44. Case Agent.BTZ
- 48. • 48
- 49. • 49
- 51. Our desire for success is like wolf's desire for blood. We work together against the enemy like a pack of wolves.
- 52. Poison ivy, gh0st rat, zwshell
- 53. 20 October, 2011
- 54. How do I know if I was hit? • Your colleagues have no idea of the mail you got from them • Your machine connects to funky hosts on it's own • Word / Excel / Acrobat flashes and restarts • You get weird error messages from Office • Non-SSL port 443 traffic in your network
- 55. Funky hosts? • Some actual hosts we've seen in targeted attacks • kira.8800.org • angelwp.3322.org • xpgod.8866.org:8181 • ysc20008.3322.org • a041181.3322.org • mm2007.6600.org • sgiorgus.8800.org • a85468546.9966.org • cvnxus.8800.org • wcs.8800.org • qingchun521.9966.org • miao1314.8800.org • getmeg.go.8866.org • update-microsoft.kmip.net • hobby.8800.org • a2b2.3322.org • dns3.westcowboy.com • swzcs.to.8866.org • hi222.3322.org • www.scratchindian.com • hackeroo.3322.org • wangba8888.3322.org • hgz3.8800.org • cybersyndrome.3322.org
- 56. From obvious to non-obvious • boxy.3322.org • jj2190067.3322.org • hzone.no-ip.biz • tempsys.8866.org • zts7.8800.org • shenyuan.9966.org • xinxin20080628.gicp.net • www.adobeupdating.com • ip2.kabsersky.com • mapowr.symantecs.com.tw • iran.msntv.org • windows.redirect.hm
- 57. PATCH, PATCH, PATCH GET RID OF ADOBE READER ADD TRAPS TO YOUR FIREWALLS HOPE THAT THEY DON’T TARGET YOU
- 58. ONLINE ATTACKS AND ESPIONAGE BY NATION-STATES Mikko Hypponen CRO, F-Secure Corp twitter.com/mikko Protecting the irreplaceable | f-secure.com