Event

23:00
-
00:00

Day 3

Attack Mining: How to use distributed sensors to identify and take down adversaries

Recorded

Security

Ever wondered why your web server seems to be under constant attack from what feels like everyone on the internet? Me too! Join me in this session where we'll explore the data of millions of attacks from hundreds of sensors around the world, to identify who is attacking us from where and why. Additionally, we will have a look into how we can use that data to get abusive systems taken down, and how successful this approach actually is. Buckle up for a deep dive into the constant battle to protect systems on the internet against adversaries gaining access, and how you can help make the internet a safer place!

Looking at the 2024 M-Trends report, brute force is still one of the main reasons for adversaries to gain access and compromise companies. In fact, 6% of all initial access is done via brute force. Knowing this, as well as that attackers are constantly trying all sorts of attacks against any internet-connected device, there seems to be a gap between what is currently mostly done (block the attack) versus what should be done (report and take down the attacker)!

This talk will start with a short introduction on how to set up a system that is able to collect attacks from distributed sensors, enrich them at a central location, as well as use the data to reach out to ISPs and other governing bodies to report the abuse. The sensors are Docker containers with modified OpenSSH servers that will block any login attempt, no matter which username and password combination is used, as well as log the timestamp, source IP, username, and password to a central location. Using this, the so-called "attack pot" is indistinguishable from other Linux systems, ensuring that no suspicion on the attacker's side is raised. For the enrichment part, the ISP's contact data is identified, and abuse notifications are sent via multiple channels to initiate a take down. Furthermore, automated bots monitor if the take down was successful and how long it took, allowing us to share some information on how successful this approach is, which ISPs are more cooperative, and where it is nearly impossible to get any system taken down. Generally, lessons learned with what could be potentially done better will be discussed!

The second part of the talk will focus on the analysis of the collected attacks. Across all of the attacks, multiple clusters, which likely are adversarial groups moving from one target to another, could be identified. Furthermore, by analyzing the used credentials, there seems to be some correlation between internet-identifiable information like DNS, region, or OS and the credentials used in an attack. This will allow defenders to get a better understanding of how to defend and even put out decoy information to quickly identify attacks.

The closure of the presentation will be an outlook on what could be done better from an ISP or governing body side to speed up take downs of adversarial infrastructure, as well as what everyone can do to make the internet a safer place!