Ripple Effect (preso @s4)
-
Upload
ping-yan -
Category
Technology
-
view
214 -
download
2
description
Transcript of Ripple Effect (preso @s4)
![Page 1: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/1.jpg)
Ripple EffectAlgorithmic Threat
Intelligence & ContainmentPing @OpenDNS.com
![Page 2: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/2.jpg)
Ping
Came from China Was in U. of Arizona graduate school
Data mining, Machine learningInfoSec
![Page 3: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/3.jpg)
Agenda
DNS transactions
The Ripple Effect
Case study - Cryptolocker
Demo
![Page 4: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/4.jpg)
More IP, AS intel, the present and the past?
What is this traffic spikes all about?
![Page 5: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/5.jpg)
What are all these weird stuff that one was requesting?
![Page 6: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/6.jpg)
![Page 7: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/7.jpg)
The Ripple Effect
The process of searching the newer and the unknown, … starting from the seeding intelligence
![Page 8: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/8.jpg)
![Page 9: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/9.jpg)
![Page 10: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/10.jpg)
Cryptolocker DGA
1. Infection2. retrieve encryption key from CnC3. encrypt data files 4. collect money!
IP CnC fails quickly! DGA kicks in !
![Page 11: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/11.jpg)
![Page 12: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/12.jpg)
![Page 13: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/13.jpg)
I don’t know the DGA!!!
![Page 14: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/14.jpg)
https://sgraph.umbrella.com/domain-view/name/xvaxsxbptmerjb.com/view
![Page 15: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/15.jpg)
![Page 16: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/16.jpg)
Demohttp://labs.umbrella.com/wp-content/uploads/2013/09/cyl.gif
load https://sgraph.umbrella.com/thibault/Web/?name=xvaxsxbptmerjb.com
![Page 17: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/17.jpg)
The Algorithm
![Page 18: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/18.jpg)
November 7th 144.76.192.13095.59.26.43
![Page 19: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/19.jpg)
Beyond Cryptolocker
https://sgraph.umbrella.com/domain-view/name/o2i2394073g2oh2b34.com/view
![Page 20: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/20.jpg)
![Page 21: Ripple Effect (preso @s4)](https://reader034.fdocuments.in/reader034/viewer/2022051514/54b5eb464a795949388b45b7/html5/thumbnails/21.jpg)
QUESTIONS?