GRNET CERT 2012 by Alex Zaharis Website:

Παρουσίαση με θέμα: "GRNET CERT 2012 by Alex Zaharis Website:"— Μεταγράφημα παρουσίασης:

1 GRNET CERT 2012 by Alex Zaharis Website: http://cert.grnet.gr
Team: GRNET-CERT Phone:

2 Overview GRNET-CERT Info & Deliverables GRNET-CERT Services
Workload Statistics Case 1: Phishing Attack Case 2: SQL Injection Attack Case 3: Malware Analysis Case 4: Anon Tools of the Trade Ημερομηνία Τίτλος παρουσίασης

3 GNET-CERT AT A GLANCE Created in 2002.
National Point of contact for all Educational & Research Institutes. Protecting the Greek Critical Internet Infrastructure. Participating on National Cyber Defense Committee Other Greek CERTs: GR-NCERT FORTHCERT AUTH-CERT 30/2/2012 GRNET-CERT

4 GRNET-CERT Deliverables
Create an Overview of the risks the use of Internet poses in GREECE. Through Communication with other CERTs create a CYBER DEFENCE Coordination Team that can handle any kind of Cyber / Electronic attack. Participated/Co-ordinated the National Cyber Defense Exercise 2011. TF–CERT members 30/2/2012 GRNET-CERT

5 National Cyber Defense Committee
CERT Cooperation Plan incidents incidents incidents incidents GRNET CERT X CERT Y CERT incidents CERT Law Enforcement CERT Knowledge Pool National Cyber Defense Committee National Cyber Space Foreign Cyber Space 22/5/2012 GRNET-CERT 5

6 GRNET-CERT SERVICES Proactive Services Reactive Services
1. Security Announcements 2. Technology Watch 3. Security Audits & Assessments 4. Development of Security Tools 5. Intrusion Detection Services Proactive Services 1. Issue Alerts & Warnings 2. Incident Handling -Incident Analysis -Incident Response Coordination 3. Vulnerability Handling -Vulnerability Analysis 4. Artifact Handling -Artifact Analysis 5. Forensics Reactive Services 30/2/2012 GRNET-CERT

7 Ημερομηνία Τίτλος παρουσίασης

8 Τίτλος παρουσίασης

9 Some Statistics For 2012 (5 months) For 2011 (last 3 months)
-900+ Various Abuse Reports Mitigated -500+ Infringement Notices Handled -397 Network Scans -22 DOS Attacks -20 DDOS Attacks -Over 20 Cases of Phishing / Defacing etc. -2 Malware Analysis (Trojan, Scareware) -1 Anonymous Attack -Vulnerability (SQLi,XSS) Warning issued for: For 2011 (last 3 months) -600+ Abuse Reports Mitigated -350+ Infringement Notices Handled 22/5/2012 GRNET -CERT

10 Website Ημερομηνία Τίτλος παρουσίασης

11 Cases Ημερομηνία Τίτλος παρουσίασης

12 ΙΚΑ Phishing Scam email Received. Attack Site detected & scanned.
Type Of Attack: Phishing Scam Received. Attack Site detected & scanned. Original Phishing Forms along with contact info recovered. ( s used by attackers) Police Authorities Informed. 22/5/2012 GRNET-CERT

13 High Profile Warning issued
Type Of Attack: SQLi Labs.opengov.gr SQLi on facebook module 22/5/2012 GRNET -CERT

14 Malware Analysis Type Of Attack: Scareware \ Malware
CONTACTING IP: (Ukraine) Ημερομηνία Τίτλος παρουσίασης

15 Anonymous Attack Type Of Attack: Reflective Amplified DNS Spoofing Attack DNS requests (ANY) για το isc.org Source IP = Spoofed IPs., PORT 80 Destination Ips = Ips του φοιτητικού DSL,PORT 53 (UDP). Φοιτητικά DSL modems με ανοιχτό recursive nameserver (dnsmasq) και forwarders αυτούς που έλαβαν από το PPP, δηλ. τους rns0.grnet.gr & rns1.grnet.gr Προωθούν το ίδιο query στους rns μας. Οι rns μας απαντούν στα modems, και κατόπιν οι dnsmasq των modems απαντούν στον αρχικό (spoofed) προορισμό. Η ιδιαιτερότητα εδώ είναι ότι το isc.org είναι από τις πρώτες DNSSEC-signed ζώνες, που σημαίνει πως η απάντηση στο αρχικό DNS query είναι μεγάλη (> 512 bytes), οπότε σύμφωνα με το πρωτόκολλο, κάνει upgrade σε EDNS, που είναι TCP. Αποτέλεσμα είναι, ότι όλες αυτές οι χιλιάδες διευθύνσεις του φοιτητικού, ανοίγουν TCP connection στην port 80 (HTTP) στα targeted hosts (δηλ. στις spoofed αυτές διευθύνσεις) και κατά συνέπεια κάνουν DoS 22/5/2012 GRNET -CERT

16 Tools Websites: Tools: Netsparker, Acunetix, Metasploit
Tools: Netsparker, Acunetix, Metasploit Wireshark, Burp Suite Nmap, Zenmap BackTrack (Various Tools) Sqlmap, Havij Vmware Workstation Sysintelnals FTK 22/5/2012 GRNET -CERT

17 Questions? Personal Info: Name: Alex Zaharis
Team: GRNET-CERT Phone: 22/5/2012 GRNET-CERT