VOLUME 25

   ISSUE 25

14 August  2013

Part 02 

Threat monitoring and response

The Threat Visualization & Analysis System (TVAS) helps to analyze and identify the alerts generated from the sensors. This helps to analyze near real-time sensor data as well as data that is gathered off-line. These threats fall in to various categories as follows.

A. Unauthorized Scans performed from other networks
B. Identified P2P worm activities
C. Spybot-infected hosts which connect to well known C&C servers
D. Spam relaying servers
E. DDOS attacks

The TVAS is capable of automatically filtering the threats relevant to each ISP. This is a feature which enables effective coordination to proactively mitigate attacks carried out to and from each ISP network.

Figure 3: This graph shows the IP's under attack and the confidence level of the threat

Figure 4: This chart shows the types of different malware identified through the analysis

 Figure 5: The identified incoming and outgoing threats to Sri Lanka at a given time


Figure 6: An alert on a specific threat appearing on Sri Lanka CERT|CC website

ISP's responsibility

The infected hosts within an ISP network are used for various malicious activities. These include carrying out denial of service attacks against other servers, generating SPAM and spreading malware. Once the reports identify that a particular IP is infected by a malware or being used to host a phishing site a comprehensive report containing a list of infected IP's within the ISP network is sent to the designated contact person of the ISP.

Figure 7: A sample report sent to an ISP

Conclusion

By cleaning up our local cyberspace we are able to tell the cyber criminals that ours is not the low hanging fruit. This is a favorite discussion topic at security forums, but not always diligently practiced. As a nation, deploying sensor networks is one easy way to ensure that we are not an easy target, whilst avoiding a large portion of potential threats. It also helps to educate the general public as well as to tap the expertise of Sri Lanka CERT | CC, which is the single trusted source of advice about the latest threats and vulnerabilities affecting computer systems and networks.

Kanishka Yapa
Senior Information Security Engineer
Sri Lanka CERT|CC

References

'Just 18 hours after security researcher Kyle Wilhoit connected two dummy industrial control systems and one real one to the Internet, someone began attacking one of them, and things soon got worse. Over the course of the experiment, conducted during December 2012, a series of sophisticated attacks were mounted on the �honeypots,� which Wilhoit set up to find out how often malicious hackers target industrial infrastructure.'

'.... China�s military is preparing for war in cyberspace involving space attacks on satellites and the use of both military and civilian personnel for a digital �people�s war,� according to an internal Chinese defense report.......'

REVEALED: Cyberthug tool that BREAKS HSBC's anti-Trojan tech Browser lockdown method also used by PayPal

'.... Cybercrooks on an underground forum have developed a technique to bypass anti-Trojan technology from Trusteer used by financial institutions worldwide � including HSBC and Paypal � to protect depositors from cybersnoopers.......'

'.... Recent work by security researchers indicates that one of the problems with having a �smart� home is that some day, it might be smart enough to attack you. The essence of the forthcoming �internet of things� is that everything we own, from ourrefrigerators and egg cartons to our cars and thermostats, will some day be outfitted with internet-connected sensors and control systems, allowing all our possessions, and ultimately all of our civic infrastructure, to communicate with each other and be controlled remotely.......'

'.... In a statement, the university said it will "defer publication" of an academic paper, which explains how researchers were able to hack the sophisticated systems......'