Embed Size (px)
DESCRIPTION
The Cyber Defense center and its services portfolio. McAfee Professional Services – Foundstone Services. DISCUSSION TOPICS. Threat Landscape. Intro. Services. Threat Intelligence. The CDC. What is it ? CERT Computer Emergency Response Team. DISCUSSION TOPICS. Threat Landscape. - PowerPoint PPT Presentation
Citation preview
The Cyber Defense center and its services portfolio
McAfee Professional Services – Foundstone Services
Intro Threat Landscape.Services
DISCUSSION TOPICS
Threat Intelligence.
The CDC
Physical Presence CERT
Regional Support
Reactive, Proactive,
Quality Mgt
Cyber Defense Center
Incident Response
Training
Advanced Malware Analysis
Strategic Services/Ass
essments
Contextual Threat
intelligence
Mobile Forensics
Computer ForensicsWhat is it?
CERT Computer
Emergency Response Team
Reactive Proactive Security Quality Management
• Incident Handling• Vulnerability Handling• Artifact Handling
• Announcements• Technology Watch• Security Audits or
Assessments• Configuration and
Maintenance of Security Tools, Applications, and Infrastructures
• Development of Security Tools
• Intrusion Detection Services• Threat Intelligence
• Risk Analysis• Business Continuity and
Disaster Recovery Planning• Security Consulting• Awareness Building• Education/Training• Product Evaluation
Computer Emergency Response Team (CERT)
Threat Landscape.
Services.
DISCUSSION TOPICS
Threat Intelligence.
•
Spotlight Qatar
Qatar86.2% internet penetration by June 2012 [2]
Highest GDP per capita by 2012 [3]
66% higher malware rate vs. worldwide in Q2 2012 [4]
Critical infrastructure directly tied to largest segment of economy
[1] McAfee Foundstone EMEA Cyber Defense Centre[2] InternetWorldFacts.com[3] CIA World Factbook [4] Microsoft Security Intelligence Report – Volume 13
[1]
Threat Intelligence Cyber Defense Centre – A Threat Intelligence System
Developed in ME.
Focused on E(ME)A.
Open Source Intelligence Public & Underground
Private data sources & API’s
Cryptolocker Infections Gulf Region
KSA UAE Yemen Oman Qatar Kuwait Bahrain0
50
100
150
200
250
Threat Intelligence
Threat Intelligence
Qatari Hackers
Loosely organized
Members of general Arabic hacking discussion groups
Small footprint compared to other Arab hacker communities
Threat Profile - Islamic Security
6,861 members and 55,279+ posts since May, 2012.Administrators include: aBo aLi, Mr.Dm4r, Lov3rDnsTopics Include: - Hacking Tutorials and Targets
- Tool Development and Distribution- Services and Tools for Sale- “Achievements” of Intrusions
Islamic Security – Posts Per Day
5/25/0
8
6/12/0
8
6/30/0
8
7/18/0
88/5
/08
8/23/0
8
9/10/0
8
9/28/0
8
10/16
/08
11/3/
08
11/21
/08
12/9/
08
12/27
/08
1/14/0
92/1
/09
2/19/0
93/9
/09
3/27/0
9
4/14/0
95/2
/09
5/20/0
96/7
/09
6/25/0
9
7/13/0
9
7/31/0
9
8/18/0
99/5
/09
9/23/0
9
10/11
/09
10/29
/09
11/16
/09
12/4/
09
12/22
/091/9
/10
1/27/1
00
50
100
150
200
250
300
350
Islamic Security – Attachment Uploads Per Day
5/25/0
8
6/11/0
8
6/28/0
8
7/15/0
88/1
/08
8/18/0
89/4
/08
9/21/0
8
10/8/
08
10/25
/08
11/11
/08
11/28
/08
12/15
/081/1
/09
1/18/0
92/4
/09
2/21/0
9
3/10/0
9
3/27/0
9
4/13/0
9
4/30/0
9
5/17/0
96/3
/09
6/20/0
97/7
/09
7/24/0
9
8/10/0
9
8/27/0
9
9/13/0
9
9/30/0
9
10/17
/09
11/3/
09
11/20
/09
12/7/
09
12/24
/09
1/10/1
00
1
2
3
4
5
6
7
8
9
10
Islamic Security – Tool Sharing
Islamic Security – Tool Sharing
Threat Intelligence
Profile: Qatar-Attack 61 reported hackings
Methods:Defacements via SQL,file upload, XSS and DDOSusing open source tools
Attacked domains in 11+ countries on 5 continents Maintains or contributes videosand blog posts that assist others in hacking
Threat Intelligence
Profile: Qatar-AttackNames: Qatar-Attack
DB-AttackQatar-Snipern1tr0g3n / n1tr0g3n0xid3MrAboghtalOahTaNiAboqhht QahtaniNaef Alqahtani
Emails: [email protected]@[email protected]@[email protected]@windowslive.com
Twitter: @MrAboqhtYouTube: MrAboqhtDomains: secur1ty.org
s-war.comdb-attack.com
Affiliations: alm3r3fh Groupv4-team
Threat Intelligence
.QA Domain Hacked Locations .QA Hacked Operating Systems
90%
4%
1%4%
1%
LINUX UNIX WINDOWS BSD UNKNOWN
Hosted in Qatar84%
Hosted Offshore
16%
Threat Profile - Islamic Security
6,861 members and 55,279+ posts since May, 2012.Administrators include: aBo aLi, Mr.Dm4r, Lov3rDnsTopics Include: - Hacking Tutorials and Targets
- Tool Development and Distribution- Services and Tools for Sale- “Achievements” of Intrusions
Islamic Security – Attachment Uploads Per Day
5/25/0
8
6/11/0
8
6/28/0
8
7/15/0
88/1
/08
8/18/0
89/4
/08
9/21/0
8
10/8/
08
10/25
/08
11/11
/08
11/28
/08
12/15
/081/1
/09
1/18/0
92/4
/09
2/21/0
9
3/10/0
9
3/27/0
9
4/13/0
9
4/30/0
9
5/17/0
96/3
/09
6/20/0
97/7
/09
7/24/0
9
8/10/0
9
8/27/0
9
9/13/0
9
9/30/0
9
10/17
/09
11/3/
09
11/20
/09
12/7/
09
12/24
/09
1/10/1
00
1
2
3
4
5
6
7
8
9
10
Trends in attacks
RAM Scrapers
Malware targeting phone and computer
ATM attacks
Dexter
Dec 2012
Vskimmer
Jan 2013
BlackPOS
March 2013
Alina
Oct 2012
The rise of the RAM Scrapers
Example: VSKIMMER
Example: VSKIMMER
Where is the CCArd data?
Example: VSKIMMER
What is the name of the USB stick?
Writing the dumpfile to USB-stick
Example: BlackPOS
DEMO
Latest in the world of POS
You swipe and pay,Meanwhile track-data of your card is send by SMS to criminal….
Shukran!
T H A N KY O U !
