Upload File

spam/botnets and malware

23
SPAM/BOTNETS and Malware Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine

Upload: neva

Post on 24-Feb-2016

38 views

Category:

Documents


0 download

Report

Tags:

DESCRIPTION

SPAM/BOTNETS and Malware. Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine. We Put Up Walls. Modern Day Fort. War Against SPAM. How do you Detect SPAM Mails? Key words Heuristics/Abnormal behavior What can you do to defend against it? SPAM Filters - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: SPAM/BOTNETS and Malware

SPAM/BOTNETS and Malware Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine

Page 2: SPAM/BOTNETS and Malware

We Put Up Walls

Page 3: SPAM/BOTNETS and Malware

Modern Day Fort

Page 4: SPAM/BOTNETS and Malware

How do you Detect SPAM Mails?– Key words– Heuristics/Abnormal behavior

What can you do to defend against it?– SPAM Filters– Reputation services to block traffic from those

Spamming IP addresses– Take down the root cause

War Against SPAM

Page 5: SPAM/BOTNETS and Malware

SPAM

US34%

CN16%

RU12%

UK7%

AR7%

BR6%

FR5%

ES5%

RO4%

DE4%

Page 6: SPAM/BOTNETS and Malware

What are Botnets used for? How do we detect them? How can we defend Against it? Botnet lifecycle

– Bot-herder configures initial bot parameters such as infection vectors, payload, stealth, C&C details

– Register a DDNS– Register a static IP– Bot-herder launches or seeds new bot(s)– Bots spread– Causes an increase of DDoS being sent to the victim– Losing bots to rival botnets

Bot Army

http://en.wikipedia.org/wiki/Infection_vector
http://en.wikipedia.org/wiki/Dynamic_DNS
http://en.wikipedia.org/wiki/DDoS
Page 7: SPAM/BOTNETS and Malware

Botnets

US53%

RU8%

DE8%

UK7%

FR6%

UA6%

NL5%

CA3%

SE2%

ES2%

Page 8: SPAM/BOTNETS and Malware

Different types of Malware Broad Category

– Trojans, Rootkits, Backdoors Malware for Fun and Profit

– Spyware, Key loggers, Dialers, Bots, Proxies, SEO etc..

Grayware

Camouflaged Attacks

Page 9: SPAM/BOTNETS and Malware

Malware

US45%

CN11%

RU9%

DE8%

NL6%

UA6%

UK4% KR

3% CA3%

CZ3%

Top 10 Malware Countries

Page 10: SPAM/BOTNETS and Malware

Threat Landscape - Brute Force

Page 11: SPAM/BOTNETS and Malware

Threat Landscape - FTP

Page 12: SPAM/BOTNETS and Malware

Threat Landscape - SSH

Page 13: SPAM/BOTNETS and Malware

Threat Landscape - Conficker

Page 14: SPAM/BOTNETS and Malware

Threat Landscape - Slammer

Page 15: SPAM/BOTNETS and Malware

Threat Landscape - Fake Search Agents

Page 16: SPAM/BOTNETS and Malware

Threat Landscape - e107 bot

Page 17: SPAM/BOTNETS and Malware

How Does Malware Happen

$$$$$$

<html>Holy Crap! Infected! Click Here to clean</html>

GET http://intermediary.com/ll.php

Make HTTP calls to infection script and site is infected

Compromised Attack Server(s)

Servers with Compromised Accounts(Zeus/Phishing/etc)

FTP/SSH Upload of Attack Shell/Script

Casual Web User Visits Infected Site

End Users

Fake AV

<script>http://intermediary.com/ll.php</script>

Disposable Domain Name

Page 18: SPAM/BOTNETS and Malware

0 Day vulnerability in a web application or Web Server– Compromises the web sites– Redirects the end user to a malware site or competitors website.– Example: Fake AV Campaign

Fake AV

Page 19: SPAM/BOTNETS and Malware

What Can We Do?

Network/Application Security toolsFirewallsIntrusion Prevention SystemsIntrusion Detection SystemsWeb Application FirewallsNetwork Access ControlsAntivirusReputation based AccessCode Audits

Page 20: SPAM/BOTNETS and Malware

The Most Important Deterent

Security Professionals

Page 21: SPAM/BOTNETS and Malware

Is The Internet Worth IT?

Page 22: SPAM/BOTNETS and Malware

Thank You| Q&A

Neil Warner, CIO [email protected]

Page 23: SPAM/BOTNETS and Malware

https://zeustracker.abuse.ch/ http://www.malwaredomainlist.com/ http://www.phishtank.com/ http://www.clean-mx.de/ http://en.wikipedia.org/wiki/Botnet http://en.wikipedia.org/wiki/Malware

References

https://zeustracker.abuse.ch/
http://www.malwaredomainlist.com/
http://www.phishtank.com/
http://www.clean-mx.de/
http://en.wikipedia.org/wiki/Botnet
http://en.wikipedia.org/wiki/Malware

NSC-JST workshop · Fighting Malware & Botnets – Introduction ... Automated dynamic malware Behavior Analysis ... summary based on Cuckoo Sandbox

T-110.6220 Kernel Malware · • Storm, Srizbi, Pandex, various banking trojans and password stealers • Over half of the biggest spam botnets are kernel malware! [1] April 1, 2009

Malware: Worms and Botnets

CS 4700 / CS 5700 Network Fundamentals Lecture 20: Malware, Botnets, Spam (Wanna buy some v14gr4?) Slides stolen from Vern Paxson (ICSI) and Stefan Savage

Malware: Viruses, Worms, & Botnetspeople.eecs.berkeley.edu/~dawnsong/teaching/f12-cs... · Malware: Viruses, Worms, & Botnets Computer Security Course. Dawn Song . Reflections on

Frequent Sequential Attack Patterns of Malware in Botnets Nur Rohman Rosyid

Team 7 (Botnets and Malware)

03 New Hostnames - Farsight Security · 2019. 6. 25. · such as spam, malware distribution, or botnets within the first minutes of activating them. These new domains can bypass

SPAM: Signal Processing for Analyzing Malware - … · SPAM: Signal Processing for Analyzing Malware Lakshmanan Nataraj, Student Member, IEEE, B.S. Manjunath, Fellow, IEEE C YBER

Fighting malware and spam CONTENTS IN THIS ISSUE · CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT PWN2KILL, EICAR and AV: ... Electronique, Automatique

Using Information Economics & Spam to Thwart Malware

GOTHAM CITY RESEARCH LLC Endurance International Group: A ...€¦ · EIGI domains hosted 1,000s of spam/malware-related sites per spam/malware watchdogs (the hosting world’s Blinkx)

Spam, Spam and More Spam - my.eng.utah.educs5480/notes/spam-lecture-11-Sep-07.pdf3 Botnets and Spammers • Example: Storm worm currently running on up to 50 million infected computers

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012

Fighting malware and spam VB100 COMPARATIVE REVIEW ON … · 2012-05-02 · APRIL 2012 ISSN 1749-7027 Fighting malware and spam VB100 COMPARATIVE REVIEW ON WINDOWS XP PROFESSIONAL

NEW ABUSE REPORT - AFNIC · Google Safe Browsing Domain name Abuse spam phishing spam phishing spam Unwanted s spam spam malware GURID Registrar name Potential abuses Creation date

An Inside Look at Botnets ARO-DHS Special Workshop on Malware Detection, 2005

02 Malware Spam Fraudes

A few final issues Legal obligations Malware Spam

EDICIÓN 2015 - ESETProtección ante Botnets NuEVo Se trata de una novedosa tecnología que te protege de las infiltraciones por malware de tipo botnet: previene el envío de spam

SPAM: Signal Processing for Analyzing Malware · 2016. 5. 18. · 1 SPAM: Signal Processing for Analyzing Malware Lakshmanan Nataraj, Student Member, IEEE, B.S. Manjunath, Fellow,

VIRUS/SPYWARE BASICS Botnets, Malware, Trojans oh my……

ISACA - Evolution of Malware and the Next Generation ... · • Malware professionalization • Use of marketing techniques in spam campaigns • Country/Time based malware variant

Botnets, malware and network attacks

Spam and Botnets: Characterization and Mitigation

Detecting Botnets and Malware

Marshal Security Threats: Spam, Phishing, Malware

Malware: Botnets and Worms

Slide 1 Vitaly Shmatikov CS 361S Malware: Worms and Botnets

PEERING INTO SPAM BOTNETS - Virus Bulletin · PEERING INTO SPAM BOTNETS JEDYNAK & KOTOWICZ VIRUS BULLETIN CONFERENCE OCTOBER 2017 3 Most interesting, and a quite unique idea, is the

Twitter 103 Trolls, Malware and Spam

BotNets & Targeted Malware

Effective Malware: The Importance of StealthMalware: Srizbi. Size: 260k+ bots. Responsible for more spam than all other botnets combined. Infection vector: Browser exploits, social

SPAM/BOTNETS and Malware Neil Warner, CIO, GoDaddy.com Moderator: Dan Kaplan, deputy editor, SC Magazine

CAP6135: Malware and Software Vulnerability Analysis Botnets Cliff Zou Spring 2012