despre mine

Tudor Damian IT Solutions Specialist

tudy.tel

despre seminar

activiti de zi cu zi

d-mi un link la blogul la...

trimite-mi pe mail...

uite ce-am gsit pe google...

dac ai id de mess, i trimit acolo fiierul...

pot s-mi verific mail-ul?...

l am pe memory stick, l poi copia de acolo...

tendine

Phishing

Phishing Explodes

Crimeware

Zero Day Exploits & Threats

crime

Adware

Spyware

Spyware & Adware Explode

Rootkits On the Rise

Bots & Botnets

DDoS Attacks

Bots Explode

Paid Vulnerability Research

Spam

Tracking Cookies

Spam Explodes

curiosity

Vulnerabilities Openly Discussed

Mass Mailing Worms

Network Worms

Virus

Destructive Virus

Macro Virus

1986

16

2008

c tot vorbim de $$$ ...

o list de preuri
Produs Instalare adware Pachet malware, versiunea basic Add-ons pentru pachete malware nchiriere de exploit - o or nchiriere de exploit - 2,5 ore nchiriere de exploit - 5 ore Pre 30 ceni in US, pn la 2 ceni in alte ri 1.000$ 2.000$ Preuri variabile pornind de la 20$ De la 0,99$ la 1$ De la 1,60$ la 2$ 4$

Troian nedetectabil
Atac DDOS Informaii despre conturi bancare Un milion de mesaje e-mail

80$
100$ pe zi Preuri variabile pornind de la 50$ De la 8$ n sus Informaiile se refera la anul 2007, sursa: TrendMicro

Acces la 10.000 de PC-uri compromise 1.000$

pe cmpul de lupt

trojan / rootkit / worm / spyware

AV-Test.org estimeaz c exist peste 11 milioane de exemplare de malware

scopul poate fi extrem de diferit, de la caz la caz

spre exemplu, Win32.Worm.Delf.NFW (locul 9 n topul BitDefender pe luna iulie)

terge fiiere mp3 care conin numele unor cntarei romni "populari"

Adrian Minune Adi de la Valcea Florin Salam Fraii de Aur Laura Vass Liviu Putiu Liviu Gu

DDoS / botnets

Smurf
Computer Computer Computer

ICMP Echo

Network A

Broadcast Address

Replies from every terminal in the Network

ICMP Echo

Workstation

Workstation

Workstation

ICMP Echo ICMP Echo

Network B

Replies from every terminal in the Network

Target system

Broadcast Address

Attacker Laptop Computer

ICMP Echo
Network C

ICMP Echo

Replies from every terminal in the Network

Broadcast Address Computer Workstation

SynFlood Attack

SynFlood
Half Open Connection Half Open Conenction

Attacker

Half Open Conenction Half Open Conenction

Server

Legitimate Connection

Legitimate userr

DNS DoS
Query with spoofed IP DNS 1 Results from attackers query

Attack er Query with spoofed IP

DNS 2 Results from attackers query

Target

Query with spoofed IP

DNS 3 Results from attackers query

Query with spoofed IP DNS 4

Results from attackers query

DDoS
Attackers Commands Attacker Client Software Command Attackers Coomand Command Command Client

Server Software (Zombie)

Server Software Server Software (Zombie) (Zombie) Packets

Server Software (Zombie)

Server Software (Zombie)

Packets Packets Packets Target Host Packets

exemplele nu sunt la scar real :)

SQLi / XSS / CSRF / RFI

SQL injection

XSS

XSS

XSS

Open Web Application Security Project (OWASP) top 10 list

www.owasp.org/index.php/Top_10_2007

OWASP Top 10 List 2007

1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Cross Site Scripting (XSS) Injection Flaws Malicious File Execution Insecure Direct Object Reference Cross Site Request Forgery (CSRF) Information Leakage and Improper Error Handling Broken Authentication and Session Management Insecure Cryptographic Storage Insecure Communications Failure to Restrict URL Access

spam

conform Sophos, 96.5% din business email este spam

phishing / crimeware / scareware

crimeware

categorie de malware conceput pentru automatizarea activitilor criminale de natur financiar

scareware, o variant de social engineering

botnet on demand

top 5 botnets in 2008

Botnet Kraken Srizbi Rustock Cutwail Numrul de boi estimat 400.000 315.000 150.000 125.000 Capacitatea de generare de spam 100 miliarde mesaje pe zi 60 miliarde mesaje pe zi 30 miliarde mesaje pe zi 16 miliarde mesaje pe zi

Storm

85.000

3 miliarde mesaje pe zi

Surse: SecureWorks, Damballa

furt de identitate

ateptrile societii legat de confidenialitate scad vizibil

$40 pe an, 30.000 americani s-au nscris

You have no privacy, get over it!

Scott McNealy
CEO, Sun Microsystems

incidente soldate cu pierderi de date 1 ianuarie 2005 4 august 2009

http://www.privacyrights.org/ar/ChronDataBreaches.htm

263 247 398 !

costul mediu al recuperrii datelor pierdute/furate/compromise

$ 197.50 / data record !

sau aproximativ 20% din PIB-ul Romniei pe 2008

cele 10 legi ale securitii reelelor

#1 dac un atacator te convinge s rulezi programul lui pe calculatorul tu, nu mai e calculatorul tu

#2 dac un atacator poate modifica sistemul de operare de pe calculatorul tu, nu mai e calculatorul tu

#3 dac un atacator are acces fizic la calculatorul tu, nu mai e calculatorul tu

#4 dac lai un atacator s upload-eze programe pe site-ul tu, nu mai e siteul tu

#5 parolele slabe anuleaz orice alt form de securitate

#6 un sistem e att de sigur pe ct de mult ncredere poi avea n persoana care l administreaz

#7 datele criptate sunt att de sigure pe ct de sigur e cheia de decriptare

#8 un antivirus fr definiii la zi e cu puin mai bun dect unul inexistent

#9 anonimitatea absolut nu e practic, nici n viaa real, nici pe web

#10 tehnologia nu e un panaceu

abordarea securitii

un singur punct de acces fizic

un singur punct de acces electronic

disciplin, disciplin, disciplin

tot ce vine e maliios, pn la proba contrarie

arhitectura veche

la nceput, internetul era izolat, reelele corporate la fel

internet

corporate network

persoanele din CORP i-a dat seama c pe Internet se gsesc treburi interesante, i au solicitat acces

internet

firewall

corporate network

i accesul outbound era suficient

ntre timp a aprut HTML / HTTP

iar cnd e vorba de culori, imagini i sunete, persoanele de la marketing devin interesate

i au nceput s solicite s pun brouri pe Internet

internet

firewall

web server corporate network

iar cnd s-a dorit i comunicarea cu cei din afar, a aprut DMZ

internet

firewall

web server (DMZ) database (DMZ)

corporate network

treptat, DMZ-ul a devenit o niruire de firewall-uri

soluiile noi au devenit din ce n ce mai complexe, deoarece se bazau pe soluiile deja existente

engineers, architects and contractors

engineers begin knowing a little bit about a lot they learn less and less about more and more until they know nothing about everything

architects begin knowing a lot about a little they learn more and more about less and less until they know everything about nothing

contractors begin knowing everything about everything but end up knowing nothing about anything because of their association with architects and engineers

pe cine cunoatem?

PC-ul, sau persoana?

PC

persoan

PC

persoan

managed

unmanaged

arhitectura nou

internet

corporate network

folosim mprirea managed / unmanaged

internet unmanaged managed

corporate network

astfel, avem nevoie de network edge protection

pentru seciunea unmanaged

dar ce facem cu partea managed?

tim PC-ul, tim persoana

dar pn acum, acestea erau n interiorul reelei, dup firewall

acum, sistemele sunt n afar

dou aspecte eseniale

ambele se asigur c informaia ajunge doar la persoanele autorizate

1. confidenialitate

mecanism principal: criptare

criptarea nu poate preveni intercepia

2. posesie

mecanism principal: access control

posesia nu poate oferi secretizare

de reinut!

confidenialitate (criptare) i

posesie (access control)

lucrul cu informaia ce se colecteaz? cum circul? unde e stocat, i pentru ct timp? cine o aceseaz i de ce? ce se ntmpl n afara sistemului? cnd e distrus?

soluii

non-admin login, NAP, Group Policy, autentificare cu certificate (X.509), IPSec, IPv6 (Teredo), DNSv6, Firewall, soluii gen TrueCrypt/BitLocker, code security best practices, penetration testing, web security platforms, etc.

...i user awareness!

resurse online

oricine le poate gsi :)

feedback :)

http://infoeducatie.tudy.ro/

ntrebri

mulumesc.

Tudor Damian IT Solutions Specialist

tudy.tel