Upload File

design of indonesia malware attack monitoring center - charles lim

  • Home
  • Technology
  • Design of Indonesia Malware Attack Monitoring Center - Charles Lim
19
Design of Indones Monitorin 7 th Ma Indonesia Security Indonesia Security Markassar Charles Lim, Msc., ECSA Indonesia Honeynet ia Malware Attack ng Center ay 2012 y Conference 2012 y Conference 2012 r, Indonesia A, ECSP, ECIH, CEH, CEI Project Chapter Lead

Upload: idsecconf

Post on 18-Dec-2014

702 views

Category:

Technology


0 download

Report

DESCRIPTION

 

TRANSCRIPT

Page 1: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Design of IndonesgMonitorin

7th Ma

Indonesia SecurityIndonesia SecurityMarkassar

Charles Lim, Msc., ECSA

Indonesia Honeynet

ia Malware Attack ng Center

ay 2012

y Conference 2012y Conference 2012r, Indonesia

A, ECSP, ECIH, CEH, CEI

Project Chapter Lead

Page 2: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

AGEN

Problem StatementHoneynet capturinHoneynet – capturinspreading malwareDistributed HoneynSystem ArchitectureSystem ArchitectureNational MonitoringgConclusion and Rec

NDA

ng autonomousng autonomous

et Sensorsee

g Centergcommendation

2

Page 3: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Problem SIDSIRTII h iIDSIRTII has experimeusing nepenthes and d

Swiss German UniversSwiss German Universalso experimented honand dionaea for at leasand dionaea for at leas

No existing grand desaround Indonesia and attacks around Indone

Statementt d ith h tented with honeypot

dionaea

sity, independently, hassity, independently, has neypot using nepenthes st 2 yearsst 2 years

sign to place sensors monitor actual malware

esia

3

Page 4: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Hone

Honeynet is a collectio

“Is a decoy that is useattacker (hacker) ”attacker (hacker).”

“It is a computer that hvalue, so if it is comprvalue, so if it is comprshould not affect the acompanies.”p

eynet

on of honeypots

ed to lured malware or

have no production romised or destroyedromised or destroyed activities of the

4

Page 5: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Honeypot Based

Two kinds of honeypoTwo kinds of honeypo

Low Interaction Honeypo

High Interaction Honeyp

d on Interaction

ot :ot :

ot

pot

5

Page 6: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Low Interactio

Do not implements Disguise as a real sDisguise as a real sGood for finding kngexpected behaviorUsually automatedUsually automatedLower cost neededExample : Nepenthe

on Honeypot

actual servicesystemsystem

own attack and

es, Amun, Dionaea

6

Page 7: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

High Interacti

It is a “real” systemdifferent configuratgsystem.Riskier than Lo InRiskier than Low-In“Allow all” configurDifficult to maintainconfigureconfigureHigher cost neededExample : Physical

on Honeypot

m usually with ion than the real

teracti it d e toteractivity due to rationn and manually

HIH, Virtual HIH

7

Page 8: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Table of Co

Low-inte

Degree of interaction Lo

Real operating system N

Risk Lo

Knowledge gain ConnectioKnowledge gain Connectio

Can be conquered NCan be conquered N

Maintenance time Lo

omparison

eraction High-interaction

ow High

No Yes

ow High

on/Request Everythingon/Request Everything

No YesNo Yes

ow High

8

Page 9: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

SGU Honeyynet Project

9

Page 10: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

SGU Honeyynet Report

10

Page 11: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

SGU Honeyynet Report

11

Page 12: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

SGU Honeyynet Report

12

Page 13: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Distributed Hon

IndoneMalwar

neynet Sensors

sia Honeynetre Repository

13

Page 14: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

System Ar

In ProIn Pro

rchitecture

gressgress

Page 15: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

National Moni

Design for National MoMalware Attack propo

KEMKOMINFO has coKEMKOMINFO has cothe first pilot will involwithin this year in diffewithin this year in diffe

toring Center

onitoring Center for sal is work in progress

mmitted to the work andmmitted to the work and lve about 10 nodes erent cities in Indonesiaerent cities in Indonesia

Page 16: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

National C

1st Academy CERT on http://www.sgu.ac.id/acahttp://www.sgu.ac.id/aca

2nd Academy CSIRT onhtt // lid hhttp://www.slideshare.nesetting-up-malware-lab

3 d A d CSIRT3rd Academy CSIRT onTo be held on 30th May thttp://csirt.itmaranatha.o

onference

Malware Researchademy-cert-meetingademy cert meetingn Malware Lab Setupt/ h l li / k het/charles.lim/workshop-on-

M l R tin Malware Reportingto 2nd June 2012,

org/event/201205/

Page 17: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

International

SecureAsia 2011, Jakahttp://www.informationsehttp://www.informationsence/agenda.html

FIRST 2012 ConferencFIRST 2012 Conferenchttp://event.idsirtii.or.id/wcontent/uploads/2011/10content/uploads/2011/10LATEST-UPDATE1.pdf

Conference

arta, Indonesiaecurityasia.com/2011/confereecurityasia.com/2011/confere

ce, Bali, Indonesiace, Bali, Indonesiawp-0/FIRST-TC-PROGRAMS-0/FIRST-TC-PROGRAMS-

Page 18: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

ThThank Yk You

Page 19: Design of Indonesia Malware Attack Monitoring Center - Charles Lim

Questtions

19


BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Social Media Malware - CSIAC · Social Media. Malware. also inside. Damages from Cyber . Attacks by Attack Category and Damage Type The Open Web Application Security Project: Secure

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Forensic Challenge 2010: Scan 1: Attack Trace Solution€¦ · INCIDENT OVERVIEW The network traffic captured in the file attack-trace.pcap relates to an automated malware attack

CAP6135 Malware & Software Vulnerability On Limitations of ...cs.ucf.edu/~czou/CAP6135-14/PaperPresentation/LRPS.pdf · Brute Force attack • The power of brute force attack is given

Malware and Attack Technologies Knowledge Area Version 1.0

CYBER-ATTACK AGAINST UKRAINIAN POWER PLANTS...malicious software (malware) had been introduced into three Ukrainian power utilities via explicitly-targeted spear phishing attack (FBI,

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization

Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware … · 2017-12-19 · malware is either packed or encrypted, malware classification based on static analysis

CAP6135: Malware and Software Vulnerability Analysis Buffer Overflow I: Attack Introduction Cliff Zou Spring 2012

Mobile Malware Visual Analytics and Similarities of Attack ... · WHITE PAPER • Mobile Malware Visual Analytics and Similarities of Attack Toolkits Page 4. We chose DroidKungFu

MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

Malware and Attack Technologies Knowledge Area Issue 1 · 2019-11-10 · Malware and Attack Technologies Knowledge Area Issue 1.0 Wenke Lee Georgia Institute of Technology EDITOR

Garantía y Seguridad en Sistemas y Redes. Tema 5 ......Attack kits and Attack sources Attack Kits Creation of malware requires great technical skills. Today, tools exist to create

Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series

BLADE, An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Reconstructing the Cryptanalytic Attack behind the Flame ... · Reconstructing the Cryptanalytic Attack behind the Flame Malware MSc Thesis (Afstudeerscriptie) written by Fillinger,

BLADE: An Attack-Agnostic Approach for Preventing Drive-By Malware Infections, L. Lu et al. BLADE: An Attack-Agnostic Approach for Preventing Drive-By

Analysis of the First Malware to Attack a Power Grid

Malware Images: Visualization and Automatic Classification · 2020-03-11 · malware. Hence, difficult to prevent a zero day attack. • Characterization: At present, the characterization

Maximum Damage Malware Attack in Mobile Wireless Networks

Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Introduction to Malicious Code (Malware) - Chalmers · Introduction to Malicious Code (Malware) ... • But what type of content is safe? Targeted attacks ... • Salami attack

THINK APP SECURITY FIRST HOW MALWARE CAN STEAL YOUR … · HOW MALWARE CAN STEAL YOUR DATA—AND WHAT YOU CAN DO TO STOP IT MALWARE MITM ATTACKS In this specialized attack, a user

Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity

Defending Web Infrastructures from Malware Attacks · PDF filekrona — up to £580000” by a single Malware attack ... *Ref. ... Banking Malware Attacks resemble

Advanced Systems Security: Malware Detectiontrj1/cse544-s18/slides/cse544-malware.pdfSystems and Internet Infrastructure Security (SIIS) Laboratory Page Malware • Attack code supplied

An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

Cybersecurity Awareness - J.P. Morgan · Hackers attack email providers to gain access to user accounts. Or they directly attack individual email accounts, using phishing, malware,

Analysis of Malware Dns Attack on the Network Using Domain

BLADE : An Attack-Agnostic Approach for Preventing Drive-By Malware Infections

Introduction to Malicious Code (Malware) - Chalmers Maliciou… · Introduction to Malicious Code (Malware) ... • But what type of content is safe? ... Salami attack Usesseemingly

2013 m sc econstructing the cryptanalytic attack behind the flame malware