Como hacer seguimiento de una campaña P2P
28
Tracking P2P Cybercrime Infraestructures Marc Rivero | (@seifreed) | www.ecrime.info
-
Upload
marc-rivero -
Category
Technology
-
view
77 -
download
2
Transcript of Como hacer seguimiento de una campaña P2P
Tracking P2P Cybercrime
Infraestructures
Marc Rivero | (@seifreed) | www.ecrime.info
#who
Marc Rivero López
Ponente en eventos nacionales (No cON Name, Owasp, Navaja Negra) e internacionales (DragonJAR CON - Colombia).Miembro de asociaciones y grupos de research como la HoneyNet Project, Owasp, SySsec etc..También soy el organizador de las conferencias Hack&Beers en BarcelonaMiembro de Malw.re
Infraestructure
* [ Elements…]
DropzoneC&C Config Server
Exploit KitBinary Server
User
* [ Process infection…]
•The victim visits a compromised website•The website redirects the user to an Exploit Kit•The exploits Kit infects the machine
* [ Type of servers…]
* [ Type of servers…]
* [ Type of servers…]
Bulletproof hosting features
Send to /dev/null abuse requestsDDoS protectionChange IP for protecting end customerAny activity allowed
* [ Enemy wanted…]
* [ Zeus P2P features…]
Main differences in P2P variant :•Use P2P network•Daily DGA domains•All Resources with the botmaster signature•DDoS capabilities
* [ Daily DGA domains…]
* [ Statistics…]
* [ Statistics…]
* [ Statistics…]
* [ Statistics…]
* [ Statistics…]
* [ Statistics…]
* [ Statistics…]
* [ Oraculo…]
A tool for tracking P2P campaigns (Only DGA at the moment)
Principal elements:Monitor: tracking all the changes in a domainScheduler: Checking all the changes in all the malware domainsFocused on P2P campaigns, but adaptable to track other familiesPossibility to check sinkholed domains
Tool developed in Python (Backend) + Django (FrontEnd)
* [ Oraculo…]
The tool collects:CountryWeb ServerIP AddressWhoisAnd more information…
* [ Oraculo…]
pDNS information
* [ Oraculo…]
Email reports..We integrate third party tools in the report
* [ Oraculo…]
Domains with more changesDomains more time UP
* [ Oraculo…]
Sinkhole VS malicious domains (Experimental feature)Countries source with more malicious activity
* [ Oraculo…]
Search feature:Search using REGEX, TLD, countries all the information is indexedThe tool shows if the domain it’s active or notCan show a graphic showing the infrastructure
* [ Oraculo…]
Domain detailsGeoposition in a MapActivity relatedHistory activity
* [ Oraculo…]
* [ Oraculo…]
