經濟日報、遠傳電信主辦；資策會協辦 2017創新論壇-防駭大作戰

1. © 2016 Imperva, Inc. All rights reserved.
Cyber Attack Trends
Ben Herzberg
@KernelXSS @imperva

2. © 2017 Imperva, Inc. All rights reserved. - @KernelXSS -
about()
2
> ben.childNodes.length
<· 2
> ben.history
<· [“PT”,”Dev”]
> ben.employer
<· “Imperva”
> ben.positionX
<· “Research Group Manager”
> ben.social
<· {“TWT”: “@KernelXSS”, “LNK”: “Ben Herzberg”}

3. DoS / DDoS Attacks

4. WHAT’S DDOS
(IN 6 SECONDS)

7. Volumetric Attacks

9. Layer 7 Attacks

14. WHY?

15. Lately…

16. © 2017 Imperva, Inc. All rights reserved. @KernelXSS @Incapsula_com
IoT DDoS through the (very recent) history
16
Mirai
20-SEP-2016
OVH Attack
21-OCT-2016
Dyn DNS DDoS
5-DEC-2016
INVESTIGATED IoT DDoSINVESTIGATED IoT DDoS
BEFORE IT WAS COOLBEFORE IT WAS COOL

17. © 2017 Imperva, Inc. All rights reserved. @KernelXSS @Incapsula_com
IoT DDoS through the (very recent) history
17
Mirai OVH Attack
30-DEC-2014
21-OCT-2015
20-SEP-2016 5-DEC-2016
…
SOHO Routers
CCTV DDoS
21-OCT-2016
Dyn DNS DDoS

18. @ZAvishh
Why use IoTs 4 DDoS?

19. © 2016 Imperva, Inc. All rights reserved.
@KernelXSS19

20. © 2016 Imperva, Inc. All rights reserved.
@KernelXSS20
IoTPC
internet connection
IoTPC
VVinternet connection

21. © 2016 Imperva, Inc. All rights reserved.
@KernelXSS21
IoTPC
VVinternet connection
code execution
IoTPC
VVinternet connection
VVcode execution

22. © 2016 Imperva, Inc. All rights reserved.
@KernelXSS22
IoTPC
VVinternet connection
VVcode execution
scanability
IoTPC
VVinternet connection
VVcode execution
VXscanability

23. © 2016 Imperva, Inc. All rights reserved.
@KernelXSS23
IoTPC
VVinternet connection
VVcode execution
VXscanability
hackability
IoTPC
VVinternet connection
VVcode execution
VXscanability
VXhackability
IoTPC
VVinternet connection
VVcode execution
VXscanability
VXhackability

24. @KernelXSS
The case of
Mirai

25. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -25
func (this *Database) CreateUser(username string, password string, max_bots
int, duration int, cooldown int)
bool {
...
this.db.Exec("INSERT INTO users (username, password, max_bots, admin, "
"last_paid, cooldown, duration_limit)"
"VALUES (?, ?, ?, 0, UNIX_TIMESTAMP(), ?, ?)",
username, password, max_bots, cooldown, duration)
return true
}

26. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -26
#DEFINE TABLE_MEM_QBOT // REPORT %S:%S
#DEFINE TABLE_MEM_QBOT2 // HTTPFLOOD
#DEFINE TABLE_MEM_QBOT3 // LOLNOGTFO
#DEFINE TABLE_MEM_UPX // X58X4DX4EX4EX43X50X46X22
#DEFINE TABLE_MEM_ZOLLARD // ZOLLARD
#DEFINE TABLE_KILLER_ANIME // .anime
killer_kill_by_port(htons(23)) // Kill telnet service
killer_kill_by_port(htons(22)) // Kill SSH service
killer_kill_by_port(htons(80)) // Kill HTTP service

27. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -27
void attack_tcp_syn(uint8_t targs_len, struct attack_target *targs,…)
void attack_tcp_ack(uint8_t targs_len, struct attack_target *targs,…)
void attack_tcp_stomp(uint8_t targs_len, struct attack_target *targs,…)
void attack_udp_generic(uint8_t targs_len, struct attack_target *targs,…)
void attack_udp_plain(uint8_t targs_len, struct attack_target *targs,…)
void attack_udp_dns(uint8_t targs_len, struct attack_target *targs,…)
void attack_gre_ip(uint8_t targs_len, struct attack_target *targs,…)
void attack_gre_eth(uint8_t targs_len, struct attack_target *targs,…)
void attack_app_http(uint8_t targs_len, struct attack_target *targs,…)

28. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -28
# define TABLE_ATK_DOSARREST 45 // "server: dosarrest"
# define TABLE_ATK_CLOUDFLARE_NGINX 46 // "server: cloudflare-nginx"
if (util_stristr(generic_memes, ret,
table_retrieve_val(TABLE_ATK_CLOUDFLARE_NGINX, NULL)) != -1)
conn->protection_type = HTTP_PROT_CLOUDFLARE;
if (util_stristr(generic_memes, ret, table_retrieve_val(TABLE_ATK_DOSARREST,
NULL)) != -1)
conn->protection_type = HTTP_PROT_DOSARREST;

29. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -29

30. © 2016 Imperva, Inc. All rights reserved. - @KernelXSS -30

31. Industry Challenges for 2018

32. “Secure by default”

33. TMI

34. Antivirus
1987 1992
Firewall
1999
WAF
IPS
NOW
?

35. Host IDS/IPS Database Access Management
Network Anomaly Detection Threat
Intelligence Sharing MDM DDoS Mitigation
Cloud Access Security Broker Identity
Management Threat Containment Solutions
Forensic Kits Honeypots Decoys Automated
Vulnerability Assessment File Access
Management Patch Inventory Management
Device Control Management Network Access
Control Database Firewalls Data Vaults

37. DDoS Trends

38. Over
6,000,000,000
Smart-Phones
By 2020

39. © 2017 Imperva, Inc. All rights reserved. @KernelXSS @Incapsula_com
The growing prevalence of IoTs
39
Source: Ericsson Mobility Report; June 2016.

41. © 2017 Imperva, Inc. All rights reserved. @KernelXSS @Incapsula_com
IoT botnets NG
• Improving the C2 functionality:
• DGA
• P2P
• Different spreading techniques
• TR-069 vulnerabilities
• Windows as a relay
• Non-DDoS botnets
• Bitcoin mining
• SPAM spreading
• Bruteforcing
• IoT vigilantes - Hajime
41
Image credits: www.mobihealthnews.com

42. How do we do that?

43. Small Data is the new BigData

44. “SecOps”

45. Config: Less is More

46. Sometimes
Cloud
is
the
Security

47. © 2017 Imperva, Inc. All rights reserved.47
@KernelXSS, @imperva
Thanks You!
⾮非常感谢您
linkedin.com/in/sysadmin
ben.herzberg@imperva.com