Security Operations

Indication of Compromise

Geolocation irregularities

Increase in database read volume;

Nonstandard port activity

Unusual outbound network traffic

Malware

System crashes, slow system or browser response

Modified or missing files

Unfamiliar processes or services running, unknown TCP or UDP ports open

3

Evasion methods

Encryption and tunneling – hide or scramble the malware content

Resource exhaustion – keep the host device too busy to detect the invasion

Traffic fragmentation – split the malware into multiple packets

Protocol-level misinterpretation – sneak by the firewall

Pivot – use a compromised network device to attempt access to another device

Rootkit – allow the hacker to avoid detection as well as hide software installed by the hacker

4

Demo ARP Storm

5

arp.opcode == 1 : request

arp.opcode == 2 : reply

demo_arp-storm.pcap

Demo An attack attempt

6

Servers receive SYN request, but clients should not!

demo_unexpected_SYN.pcap

Demo ARP cache poisoning as an MITM attack

7

ARP request should be broadcast

demo_arp-MITM.pcap

Demo nmap

8

almost all ports are closed => TCP RST

More than thousands TCP/UDP conversations

demo_nmap.pcapng

Demo demo_CyberEYE

9

CyberEYE is a popular Turkish-born tool used to create RAT executables and administrator compromised hosts.

demo_nmap.pcapng