The Other Side Of The Fence. Dealing With Hackers And Malware

The Other Side of the Fence.
Dealing with Malware *Hackers

Prasanna V
http://vprasanna.com

We generally hear about hackers
We generally hear about hackers
& malware, the damage they create,
& malware, the damage they create,
the money & data they steal.
the money & data they steal.

How's it to be on The Other Side?
How's it to be on The Other Side?

Episode 1:
The Conficker Strikes

Somewhere during November 2008, an enterprise
having thousands of systems spread across
the world

Holiday season, most of team were on leave

Complaints of network congestion,
Domain controller was slow

We saw unprecedented network traffic, within LAN
& Outbound to unusual IP addresses!

Rapid replication of suspicious
system behavior across the globe

Antivirus on the systems were
generally up-to-date with definitions

Our Network IDS was detecting traffic
destined to random global IP addresses
on destination ports 445

Turns out that the infected machines
were missing patches, most importantly
MS08-67

Apparently, these systems were also
missing OS hardening that was put in
place

Effective logging and monitoring
are like
torchlight

Layered defense mechanism and
the role of Security Information &
Event Management (SIEM)

Security information from hosts & network
logs helped identify the infected machines

Pivot!
Being good in spreadsheet helps the admins 

Patch the systems or disable network access

Foolproof security ?

Anti-Virus and Firewall are not the ultimate solutions
to today’s sophisticated threats.

There is Reasonable Security

……And it is achieved in layers
14

Episode 2 - DHCP Server Goes
Rogue

An admin’s worst nightmare

1. Logged to gateway / router. Internet is fine.
2. Logged into UTM, sessions have doubled.
3. No malwares reported in the AV manager!

Wireshark is an Admin’s
best friend!

“Documentation is your life
savior”

Was able to identify the offending machine based on a
list I had generated earlier

Turns out that a user had set up a server
and
did not know to disable DHCP
functionality!

People are
the
weakest
link

Learning's:
• Internal users can cause as much trouble as hackers and
malware

Information Security is about
People, Process & Technology

22
Prx

The Other Side Of The Fence. Dealing With Hackers And Malware

Disclaimer

All opinions mentioned here are my personal and not necessarily

of my employer, current or previous.

Thank You

Prasanna V

Cofounder @PacketVerify

http://vprasanna.com

@terminalfix

The Other Side Of The Fence. Dealing With Hackers And Malware

More Related Content

What's hot (20)

Viewers also liked (6)

Similar to The Other Side Of The Fence. Dealing With Hackers And Malware (20)

Recently uploaded (20)

The Other Side Of The Fence. Dealing With Hackers And Malware

Editor's Notes