Paul M Kane Director, 20th anniversary of.LV HOSTS: Institute of Mathematics and Computer Science...

Paul M KaneDirector,

www.CDNS.net

20th anniversary of .LVHOSTS: Institute of Mathematics and Computer ScienceVENUE: Radisson Blu Daugava Hotel, Riga, Latvia.19th April 2013.

Cyber attacks increasing – keep your domain safe

International Conference on DNS and Internet - 19th April 2013, Riga

2

Thank you to nic.LV

• Inviting me and for working with us.

• Congratulations on 20 reliable years, here’s to the next 20 years.

• For being an active member of the Domain Name System Infrastructure Resilience (DIR) Task Force – www.DIR.ORG> With financial support from the European Commission - Directorate-General

Justice, Freedom and Security; Prevention, Preparedness and Consequence Management of Terrorism and other Security Related Risks Programme.

• Cyber-Security is NOT sexy –we’re telling users they are frequently the cause of problems –but being protected is better for them, their employer and wider Internet.


3

Agenda

• What we do> A word from our sponsors!

• Growth of Internet access> Broadband access and speeds

• Vulnerabilities and attack traffic> Compromised devises, attack vectors and Video – watch carefully, see if you

can see some of the tricks.

• Why and how do the bad guys use YOU> Using compromised devices is an efficient way to gain information, generate

revenue or cause disruption.

• How resilient is the Internet> It is as safe as you make it!

• References> Any questions.


4

Real Time Data – 29th Nov 2010

• 12 billion users per day

• 1,869 ISPs host CDNS servers.

• 160,731,688 names on platform

• 636,707 updates on 8th March 2013

• Peaked at 193,000 transactions per second

• Capacity is 855 billion per second!

www.CDNS.net/live_stats.html


5

CDNS - Server Locations

55 locations, 48 Countries, 24x7x365 NOCs in UK, USA and Japan, monitoring, serving and blocking malicious traffic for DNS, WEB and other applications


6

DNS – Reflection attacks

• DDoS Increasing

• DNSSEC has much larger payload

• DNS Amplification attacks increasing

• 23rd March 2012 7.6m queries per sec peak, >2m queries per sec for approx 24 hour

• Genuine traffic <300,000 queries per second


7

Network monitoring for DNS and more

• Improving cyber-security for customers.> Managing Anycast cloud represents approximately 30% of the job

and is technically relatively easy.> 70% is network monitoring, looking for “bad” guys who seek to

change DNS data or introduce anomalies for personal gain.


8

European Broadband – July 2012

European Commission Communications Committee - Digital Agenda, July 2012


9

Broadband lines by speed and country



10

Mobile Broadband - Jan 2009 to July 2012



11

Year on Year growth - 2011 v 2012

• Attack traffic is increasing dramatically.

European Commission DG INFSO, Unit C4: Economical and Statistical Analysis


12

Total attack types 2012

European Commission DG INFSO, Unit C4: Economical and Statistical Analysis


13

Home DSL Router vulnerability test results

• It works!! -leave it alone> Majority of home

users buy their router and do not install security patches.

> UK – 19m DSL Routers, 35% compromised, average upstream say 0.5Mbps = DDoS of 3.3Tbpsor 3325Gbps


14

Cyber-espionage - You’ve got mail!


15

How mail system works….

Message:Broken intoPackets,Numberedanddispatched

Receiver:Acknowledge

receipt, lost packets are

resent, Reassembled

in order


16

Emailing your Bank – DNSSEC helps a bit


17

2011 Denial of Service Attack Vectors

• UDP popular “hook” for initiating attacks as is SYN – the TCP three way handshake


18

2012 Attack vectors

• DNS Attacks almost tripled Q1 2011 to Q1 2013 from 2.35% to 4.67%


19

Top 10 countries - sources of DDoS attacks

• UK – has almost 19million home/office Broadband connections.


20

2011 – Top 10 DDoS source countries.


21

2012 – Top 10 DDoS source countries.


22

Compromised Devices by Country

Source: Panda Security


23

ASN – Most used ASN for DDoS

• Counterfeit software is NOT patched by supplier therefore vulnerable to compromise.


24

Work - Bad guys “fish, where fish are!”

37%

• In US – 77% of employees use social media during worktime.

• 33% of companies have been infected by malware through social media channel

Panda Labs Q3 2012 Quarterly Report

> 57% of companies have Policies regulating use

> 81% have staff dedicated to monitoring and implementing Policies

> 62% do not allow these sites to be accessed

> Android smart phone are the new target


25

Why do they do it- Reason for cyber-crime

Panda Labs Q3 2012 Quarterly Report


26

How the “bad guys” corrupt systems


27

Botnets as a Service.


28

How much to know your competitors?


29

How Resilient is the Internet?

• Very – BUT …. Progress means things are changing fast……..

> To keep ahead of the bad-guys, needs careful monitoring

> Need to check your DNS settings and services regularly

> Do not rely on the Public Internet, make good use of private VPN’s that use IP address (IPv4 and IPv6) rather than just standard “name” resolution.

> Encrypt private communications – PKI, like PGP etc

> Periodically check for inconsistencies such as the way staff terminals use the Internet.

> Smart Phones are now the target, so they need scanning where users interact with social media sites and may download viruses to act as Trojan on home and work networks.


30

References

• PHP Vulnerability -Injection Attack> http://security.radware.com/itsoknoproblembro/

• SOAP Vulnerable Products:> https://docs.google.com/spreadsheet/ccc

?key=0ApUaRDtAei07dGxkSHN1cEN3V2pmYW4yNkpZMlQ0Rmc#gid=0

• Around 40-50 million network-enabled devices are at risk due to vulnerabilities found in the Universal Plug and Play (UPnP) protocol. > UPnP enables devices such as routers, printers, network-attached storage (NAS), media players

and smart TVs to communicate with each other.

> http://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf

• Java (again) - turn off Java Runtime Environment

https://blogs.oracle.com/security/entry/february_2013_critical_patch_update


31

Happy Birthday nic.LV!!!

[email protected]

Thank you

Date post:	17-Dec-2015
Category:	Documents
Upload:	dayna-jordan
View:	217 times
Download:	2 times

Paul M Kane Director, 20th anniversary of.LV HOSTS: Institute of Mathematics and Computer Science...

Documents