cybercrime friendly sales policy - cert.lv · pdf filekiberšahs 2017, riga, latvia ....
TRANSCRIPT
![Page 1: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/1.jpg)
CYBERCRIME FRIENDLY SALES POLICY…
Varis Teivans 05.10.2017. Kiberšahs 2017, Riga, Latvia
![Page 2: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/2.jpg)
Why Cybercrime friendly?
2
• Free SSL – “Let’s Encrypt” is reducing costs for attackers to stay covert in their operations
• Low Cost domain names, fast registration & activation, anonymity, crypto currency
• Low cost hosting services, anonymity, crypto currency • IP source address spoofing
![Page 3: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/3.jpg)
Data is needed to find the answers
3
• Indicators Of Compromise • IP
• DNS
• URI
• HOSTING • ORG-name
• Accepts cryptocurrency?
• Historical data sets • PDNS & P-Whois
• PSSL
![Page 4: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/4.jpg)
Data sources - IOC
4
•2.3 million records
![Page 5: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/5.jpg)
DNS & some difficulties along the way
5
• DNS price range 0 – 5 $ / yr – mapping them on IOCs
• Safeguards to mitigate DNS abuse? • Yes, DNS crowd is working on that… ICANN working group
https://www.icann.org/news/announcement-2-2016-03-15-en
• Common TOS – helping CERTs to make a difference
• Common whois requirements – thick and machine friendly data
![Page 6: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/6.jpg)
DNS
6
![Page 7: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/7.jpg)
DNS
7
![Page 8: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/8.jpg)
DNS
8
• Com
• Net
• Org
• Biz
• Info
• Ru
![Page 9: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/9.jpg)
DNS
9
• Eu
• Br
• Co
• Au
• Cc
LV – 115 IOCs
![Page 10: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/10.jpg)
DNS
10
15 - 25 EUR
![Page 11: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/11.jpg)
SSL
11
• Observations
• Trustworthiness
• Good VS Bad
• PSSL – Passive SSL Database – CIRCL.LU • Idea from GCHQ project “Flying Pig”
![Page 12: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/12.jpg)
SSL
12
74.Th place - A lot of selfsigned - Google is misleading
![Page 13: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/13.jpg)
13
Autonomous Systems
![Page 14: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/14.jpg)
14
Possibly prefix hijacking of network that is not in use
![Page 15: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/15.jpg)
Hosting & Payment
15
• Does anyone even regulate which payment systems should be accepted?
![Page 16: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/16.jpg)
Hosting
16
• Best practices are nice as long as there is somebody who cares…
![Page 17: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/17.jpg)
Hosting
3
![Page 18: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/18.jpg)
Conclusions
18
• Results from the available IOC data analysis do not reveal an overwhelming abuse of low cost IT services however, there are strong indications of specific Cybercrime interest (research should be extended)
![Page 19: CYBERCRIME FRIENDLY SALES POLICY - cert.lv · PDF fileKiberšahs 2017, Riga, Latvia . Why Cybercrime friendly? 2 ... •Low cost hosting services, anonymity, crypto currency](https://reader031.vdocument.in/reader031/viewer/2022030405/5a7cddab7f8b9a0a668d5292/html5/thumbnails/19.jpg)
Conclusions
• Low cost domains (with exceptions) – Cyber Crime Friendly
• VPS hosting accepting crypto currency – Cyber Crime Friendly
• Free SSL – not really but soon..
• Malware hosting & Cyber Crime tourism
• Policy & regulations will come.. Casualties VS Time
19