I attended the 6th Annual GFIRST National Conference organized by US-CERT. GFIRST stands for Government Forum of Incident Response and Security Teams. This year’s theme was: Building Today, Shaping Tomorrow – Ensuring an Effective Response Capability to Manage Risks in Cyberspace. The conference was well attended with some talks standing room only in a 300-person conference room. Most commercial information security vendors interested in this space were participating exhibitors in the accompanying expo. I will not be able to cover some of the really interesting presentations in this public forum due to the sensitivity of the topics, but here are a couple of tidbits for general consumption.
“Emerging Threats in 2010″ by Dave Marcus, Director of Security Research and Communications, McAfee Labs was one of my favorite presentations of the conference. Dave Marcus, who blogs at Reclaim Hacking, posited that he can make anyone click on malicious malware by mining personal information from the social media aggregated by several services. Dave uses Twitscoop to find the trending topics for messaging that the recipient will be interested in, uses Bing to figure out what OS the user is is using and what the user is yapping about so that he can send targeted malware on the right platform like Android, MacOS, etc., mines pic tags using PicFog (alert: potential offensive material), uses Twittermap to deliver malware to folks attending an event, mines twitter trends using Trendistic, uses hashtags.org to track trends, uses Openbook that mines Facebook, and designs url’s by appending keywords to tinyURL. Openbook exposes the awful default privacy settings in Facebook as lots of users don’t know how to set their preferences. After listening to this presentation, I have no doubt a determined adversary can figure out anyone’s hot button to push to deliver targeted malware. So what can you do? Check the privacy settings of your social media accounts, start using url expanders, install safe browsing plug-in’s …
Dawn Capelli and Adam Cummings of CERT gave a nice talk on insider threat by presenting their empirical analysis of the MERIT database, which covers 157 fraud, 116 sabotage, 77 theft, 120 espionage, 44 miscellaneous cases, and SpyDR (Spy Data Repository) espionage database, which covers 120 cases. Their findings show that sabotage is perpetrated by former employees who insert malicious code before leaving while fraud is carried out typically by help desk person recruited from outside. Their recommendations: enable message tracking on your mail server, use Splunk to track mail flow to competitors, foreign entities, etc., look for email with size over a certain size, do continuous logging, targeted monitoring, real time alerting. You can find more detailed information on this research here.
Aaron Shelmire and Ed Stoner of CERT presented their Dynamic DNS and Fast Flux analysis. They started their analysis with a malicious software catalog and appended the malware domains list with ISC-SIE A, MX, NS records. They define a fast flux domain as one that resolves to at least 25 different IPs on 20 ASNs. It was a good chance to validate each other’s results. For instance, Shelmire and Stoner see 1.5%-2% fast flux in malware. Our FastFluxMonitor detects flux about 1.4% – 4% in malware domain feeds. Their high level findings were similar to the trends we observed in our Botnet Threat Intelligence database.
Our presentation in the Event Detection via DNS and Route Monitoring session was received well. Daniel Massey discussed how to detect network route prefix hijacking via BGP monitoring. Our presentation focused on the use of the botnet social networks in detection and mitigation. In summary, our Botnet Threat Intelligence solution provides two levels of evidence as shown in the table below. Our guilt by association score is based upon a domain’s, nameserver’s, or IP’s relationship to other malicious entities through the historical social network knowledge. In contrast, our fast flux score is based on the domain’s or nameserver’s real-time behavior. Guilt by association scores provide pre-zero day intelligence while fast flux scores provide near-real time situation assessment.
