Sixth Conference on
Detection of Intrusions and Malware & Vulnerability Assessment
July 9-10 2009
Milan, Italy
DIMVA 2009: Program
| 9th July (Thursday) |
|
|
|
|
| 9:00 |
Opening Remarks
Danilo Bruschi and Ulrich Flegel |
|
 |
|
 |
| 9:15 |
Session: Malware and SPAM
Chair: Toralv Dirro, McAfee Avert Labs
|
|
|
|
|
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
| 11:15 |
Session: Emulation-based Detection
Chair: Peter Szor, Symantec Corporation
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Abstract:Botnets, which are networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security threats on the Internet. A particularly sophisticated and insidious type of bot is Torpig, which is a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this talk, we report on our efforts to take control of the Torpig botnet for ten days. Over this period, we observed more than 180 thousand infections and recorded more than 70 GB of data that the bots collected.
While botnets have been hijacked before, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server during the ten day period. This shows that botnet estimates that are based on IP addresses are likely to report inflated numbers. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of information from the infected victims. This allowed us to perform interesting data analysis that goes well beyond simply counting the number of stolen credit cards. In this talk we will discuss the analysis that we performed on the data collected and the lessons learned from the analysis, as well as the process of obtaining (and losing) the botnet. |
|
|
|
|
|
|
| 15:45 |
Session: Software Diversity
Chair: John McHugh, University of North Carolina and Dalhousie University Halifax
|
|
|
|
|
|
|
|
|
|
|
|
| 16:45 |
SIG SIDAR Open Meeting
Chair: Michael Meier, Technical University of Dortmund
Co-Chair: Thorsten Holz, University of Mannheim
|
|
| 10th July (Friday) |
|
|
|
|
Abstract:
Dropping packets is one of the easiest and most effective methods of mitigating the effects of a network attack from a known source. Without any third-party information, it is next to impossible to apply this defense against a botnet-based attacker. A large number of hosts, each initiating a very small number of attacks, has the potential to cause a significant amount of damage in aggregate.
For the past several years, the botnet-based attacker has held the upper hand against defenders working in isolation. While the size of a botnet population is very large, the population of defenders that they attempt to attack is significantly larger. Network defenders need to share data about attacks with one another to turn the tables on the botnet-based attackers.
Cisco's latest Intrusion Prevention System (IPS) software release, IPS 7.0, adds Global Threat Correlation. This allows all 200000 deployed IPS sensors to optionally share their security event data with Cisco Security Intelligence Operations (CSIO). CSIO correlates this attack data and pushes actionable information back to the deployed IPS sensors, allowing them to effectively block botnet-based attacks.
We will offer an in-depth look at the implementation of Cisco's Global Threat Correlation technology with a focus on how Cisco has solved many of the scalability issues associated with aggregating data on this scale. We will conclude with a discussion of many of the open research issues in security event aggregation. |
|
|
|
|
|
|
| 10:45 |
Session: Harnessing Context
Chair: Engin Kirda, Eurécom
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 13:30 |
Rump Session
Chair: Sven Dietrich, Stevens Institute of Technology
|
|
| 13:30 |
Visualization of Malware Behavior
Philipp Trinius |
|
|
|
|
| 13:45 |
Are botnets used to run phishing over the phone?
Frederico Maggi |
|
|
|
|
| 13:50 |
Automatically Generating Models for Botnet Detection
Peter Würzinger |
|
|
|
|
| 14:00 |
Tracking Intelligence Project
Angelo Dell'Aera |
|
|
|
|
| 14:10 |
Browser SSL-Fingerprinting
Christian Bockermann |
|
|
|
|
| 14:15 |
Bypassing Kernel-Integrity Protection Mechanisms
Thorsten Holz |
|
|
|
|
|
|
| 15:00 |
Session: Anomaly Detection
Chair: Pavel Laskov, University of Tübingen
|
|
|
|
|
|
|
|
|
|
|
|
| 16:00 |
CIPHER 5 Capture the Flag
Chair: Lexi Pimenidis, iDev GmbH
|
|
|
|
|
|
|
|
|
| 16:30 |
Concluding Remarks
Ulrich Flegel and Michael Meier |
|
|
|
|
|
