©2011 Akamai

Adapting to the Age of Anonymous

Joshua Corman

Director of Security Intelligence

@joshcorman

http://cognitivedissidents.wordpress.com/

SOURCE Barcelona - November 17, 2011

©2011 Akamai

About Joshua CormanDirector of Security Intelligence for Akamai Technologies•Former Research Director, Enterprise Security [The 451 Group]•Former Principal Security Strategist [IBM ISS]

Industry Experience•Expert Faculty: The Institute for Applied Network Security (IANS)•2009 NetworkWorld Top 10 Tech People to Know•Co-Founder of “Rugged Software” www.ruggedsoftware.org

Things I’ve been researching•Compliance vs Security•Disruptive Security for Disruptive Innovations•Chaotic Actors•Espionage•Security Metrics

2

©2011 Akamai

Agenda

• Understanding Anonymous in under 7 minutes

• Deconstructing Anonymous

• Adapting to Anonymous

• Building a Better Anonymous?

©2011 Akamai

Understanding Anonymous:The Rise of the Chaotic Actor

Director of Security Intelligence

Akamai Technologies

2011 FlashTalks powered by PechaKucha

Joshua Corman@joshcorman

©2011 Akamai5

©2011 Akamai

©2011 Akamai

Paradox Slide/Deliberate Disinformation

©2011 Akamaihttp://www.csoonline.com/article/682511/the-rise-of-the-chaotic-actor-understanding-anonymous-and-ourselves

©2011 Akamai9

Some men just want to see the world burn…

©2011 Akamai

Lots & Lots of Anonymous Sects

10

©2011 Akamai

Your Headline Here (in Title Caps)

11

©2011 Akamai

You Choose Your Own Level of Involvement

12

©2011 Akamai

Anonymous* Unmasked? [*Alleged]

©2011 Akamai

You Choose Your Own Level of Involvement

14

©2011 Akamai

You Choose Your Own Level of Involvement

15

©2011 Akamai

Escalation?

16

©2011 Akamai

Anomalous Anonymous?

17

©2011 Akamai

False Flags: Adaptive Persistent Adversaries

“Anonymous is God’s gift to the Chinese” – CISO

©2011 Akamai

Cyber-Neo-McCarthyism

I am not now…

…nor have I ever been…

…a member of Anonymous.

©2011 Akamai

Building a Better Anonymous…

20

©2011 Akamai

Building a Better Anonymous…

21

©2011 Akamai

The easy answers Suggested Background

©2011 Akamai

23

Joshua Corman@joshcorman

©2011 Akamai

Agenda

• Understanding Anonymous in under 7 minutes

• Deconstructing Anonymous

• Adapting to Anonymous

• Building a Better Anonymous?

©2011 Akamai

PANEL: Whoever Fights Monsters…

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

Operation Payback(Anonymous Takes Center Stage)

August-December 2010

Initial Targets

•MPAA

•RIAA

•Intellectual Property Offices

In December, switched to WikiLeaks “defense”

•Financial services: PayPal, Mastercard, Visa

•Public personas: Lieberman, Palin

•Others: Lawyers, security researchers

Stats:

•1k-3k attackers in IRC

•1500 copies of LOIC in Hivemind (# in IRC/2)

•1.5 Gbps peak attack traffic (# in IRC/2)

•750 Mbps sustained traffic (# in IRC/4)

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

Discussion

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

BRAND POLLUTION

http://cognitivedissidents.wordpress.com/2011/11/11/an-anonymous-ink-blot-rorschach/“An Anonymous Ink Blot Rorschach” What do you see in the Anonymous Ink Blot ?

©2011 Akamai

BRAND POLLUTION

©2011 Akamai

BRAND POLLUTION

©2011 Akamai

False Cover: Criminal and State Actors

“Anonymous is God’s gift to the Chinese” – CISO

©2011 Akamai

©2011 Akamai

Agenda

• Understanding Anonymous in under 7 minutes

• Deconstructing Anonymous

• Adapting to Anonymous

• Building a Better Anonymous?

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

DDoS is Legion

74% of surveyed companies experienced one or more DDoS attacks in the past year, 31% of these attacks resulting in service disruption.1

1 Forrester Research

©2011 Akamai

Some of my data

• Typical Attack Size: 3-10 Gbps

• Large Attack Size: 100-200 Gbps

• Attacks are originating from all geographies and are moving between geographies during the attack

2009 2010 20110

100

200

300

400

500

600

Num

ber

of

Att

ack

s

©2011 Akamai

Agency – PROTECTED

U.S. Government Customer 1

U.S. Government Customer 2

U.S. Government Customer 3

U.S. Government Customer 4

U.S. Government Customer 5

U.S. Government Customer 6

New U.S. Government Customer

Peak Traffic

124 Gbps

32 Gbps

9 Gbps

9 Gbps

2 Gbps

1.9 Gbps

0.7 Gbps

Times Above Normal Traffic

598x

369x

39x

19x

9x

6x

SITE DOWN before Akamai

July 4th – 7th 2009 DDoS Attack400,000 Korean Bots Attack Key U.S. Government Web Sites

©2011 Akamai

Agenda

• Understanding Anonymous in under 7 minutes

• Deconstructing Anonymous

• Adapting to Anonymous

• Building a Better Anonymous?

©2011 Akamai

Agenda

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

©2011 Akamai

Discussion

©2011 Akamai

Thank You!

Joshua Corman

@joshcorman

http://cognitivedissidents.wordpress.com/

Barcelona, November 17, 2011