http://www.grnet.gr
GRNET CERT 2012
by Alex Zaharis
Website: http://cert.grnet.gr
Email: cert@grnet.gr
Team: GRNET-CERT
Phone: +30 210 7475718
Overview
•
•
•
•
•
•
•
•
GRNET-CERT Info & Deliverables
GRNET-CERT Services
Workload Statistics
Case 1: Phishing Attack
Case 2: SQL Injection Attack
Case 3: Malware Analysis
Case 4: Anon
Tools of the Trade
Ημερομηνία
Τίτλος παρουσίασης
2
GNET-CERT AT A GLANCE
• Created in 2002.
• National Point of contact for all Educational &
Research Institutes.
• Protecting the Greek Critical Internet
Infrastructure.
• Participating on National Cyber Defense
Committee
Other Greek CERTs:
• GR-NCERT
• FORTHCERT
• AUTH-CERT
30/2/2012
GRNET-CERT
3
GRNET-CERT Deliverables
• Create an Overview of the risks the use of
Internet poses in GREECE.
• Through Communication with other CERTs
create a CYBER DEFENCE Coordination Team
that can handle any kind of Cyber / Electronic
attack.
• Participated/Co-ordinated the National Cyber
Defense Exercise 2011.
• TF–CERT members
30/2/2012
GRNET-CERT
4
CERT Cooperation Plan
incidents
incidents
GRNET
CERT
X
CERT
incidents
Y
CERT
incidents
CERT
Law Enforcement
Knowledge Pool
CERT
National Cyber Defense Committee
National Cyber Space
22/5/2012
Foreign Cyber Space
GRNET-CERT
5
GRNET-CERT SERVICES
Proactive Services
Reactive Services
1. Issue Alerts & Warnings
2. Incident Handling
1. Security Announcements
2. Technology Watch
3. Security Audits & Assessments
4. Development of Security Tools
5. Intrusion Detection Services
-Incident Analysis
-Incident Response Coordination
3. Vulnerability Handling
-Vulnerability Analysis
4. Artifact Handling
-Artifact Analysis
5. Forensics
30/2/2012
GRNET-CERT
6
Ημερομηνία
Τίτλος παρουσίασης
7
Τίτλος παρουσίασης
8
Some Statistics
• For 2012 (5 months)
-900+ Various Abuse Reports Mitigated
Various Abuse Reports
-500+ Infringement Notices Handled
-397 Network Scans
-22 DOS Attacks
-20 DDOS Attacks
-Over 20 Cases of Phishing / Defacing etc.
-2 Malware Analysis (Trojan, Scareware)
-1 Anonymous Attack
-Vulnerability (SQLi,XSS)
Warning issued for:
http://eclass.aspete.gr
Infridgment Notice
DOS
DDOS
Network/Port Scan,
Bruteforce
• For 2011 (last 3 months)
-600+ Abuse Reports Mitigated
-350+ Infringement Notices Handled
-Vulnerability (SQLi,XSS)
Warning issued for:
http://labs.opengov.gr
http://www.presidency.gr/
22/5/2012
SPAM MAIL
SSH Brute Force
REGBOT
BADBOT
GRNET -CERT
9
Website
Ημερομηνία
Τίτλος παρουσίασης
10
Cases
Ημερομηνία
Τίτλος παρουσίασης
11
ΙΚΑ Phishing
Type Of Attack: Phishing
• Scam email Received.
• Attack Site detected & scanned.
• Original Phishing Forms along with contact info
recovered. (emails used by attackers)
• Police Authorities Informed.
22/5/2012
GRNET-CERT
12
High Profile Warning issued
Type Of Attack: SQLi
• Labs.opengov.gr SQLi on facebook module
22/5/2012
GRNET -CERT
13
Malware Analysis
Type Of Attack: Scareware \ Malware
CONTACTING IP: 91.232.29.95 (Ukraine)
http://91.232.29.95/?0bbccd2979886358e559cd8ebc45985d
Ημερομηνία
Τίτλος παρουσίασης
14
Anonymous Attack
Type Of Attack: Reflective Amplified DNS Spoofing Attack
•
•
•
•
•
•
DNS requests (ANY) για το isc.org
Source IP = Spoofed IPs., PORT 80
Destination Ips = Ips του φοιτητικού DSL,PORT 53 (UDP).
Φοιτητικά DSL modems με ανοιχτό recursive nameserver
(dnsmasq) και forwarders αυτούς που έλαβαν από το PPP,
δηλ. τους rns0.grnet.gr & rns1.grnet.gr
Προωθούν το ίδιο query στους rns μας. Οι rns μας απαντούν
στα modems, και κατόπιν οι dnsmasq των modems απαντούν
στον αρχικό (spoofed) προορισμό.
Η ιδιαιτερότητα εδώ είναι ότι το isc.org είναι από τις πρώτες
DNSSEC-signed ζώνες, που σημαίνει πως η απάντηση στο
αρχικό DNS query είναι μεγάλη (> 512 bytes), οπότε σύμφωνα
με το πρωτόκολλο, κάνει upgrade σε EDNS, που είναι TCP.
Αποτέλεσμα είναι, ότι όλες αυτές οι χιλιάδες διευθύνσεις του
φοιτητικού, ανοίγουν TCP connection στην port 80 (HTTP) στα
targeted hosts (δηλ. στις spoofed αυτές διευθύνσεις) και κατά
συνέπεια κάνουν DoS
22/5/2012
GRNET -CERT
15
Tools
• Websites:
–
–
–
–
–
–
–
–
–
https://apps.db.ripe.net/search/query.html#resultsAnchor
http://cqcounter.com/whois/
http://projecthoneypot.org/
http://www.phishtank.com/
http://www.exploit-db.com/
https://www.virustotal.com/
http://anubis.iseclab.org
http://www.iptrackeronline.com/header.php
http://www.liveipmap.com/
• Tools:
–
–
–
–
–
–
–
–
22/5/2012
Netsparker, Acunetix, Metasploit
Wireshark, Burp Suite
Nmap, Zenmap
BackTrack (Various Tools)
Sqlmap, Havij
Vmware Workstation
Sysintelnals
FTK
GRNET -CERT
16
Questions?
Personal Info:
Name: Alex Zaharis
Email: azaharis@admin.grnet.gr
Team: GRNET-CERT
Phone: +30 210 7475718
22/5/2012
GRNET-CERT
17