IDSECCONF 2016

Charles Lim, Msc., ECSA, ECSP, ECIH, CEH, CEI

Mario Marcello24 Sep 2016 | UIN Maulana Malik Ibrahim | Malang, Indonesia

Sistem Pemantauan Ancaman Serangan Siber di Indonesia

Generasi Baru

About MeCharles Lim, Msc., ECSA, ECSP, ECIH, CEH, CEIResearcher – Information Security Research Group and LecturerSwiss German UniversityCharles.lims [at] gmail.com and charles.lim [at] sgu.ac.idhttp://people.sgu.ac.id/charleslim

I am currently doing my doctoral study in Universitas Indonesia

Research Interest

CommunityIndonesia Honeynet Project - Chapter Lead

Academy CSIRT – member

Asosiasi Digital Forensik Indonesia - member

MalwareIntrusion DetectionThreats Intelligence

Vulnerability AnalysisDigital ForensicsCloud Security

Agenda

• About Honeynet

• Indonesia Honeynet Project

• The Threat Intelligence

• The New Generation Threat Intelligence

• Research & Publications

• Statistics

• Conclusion

Introduction to Honeynet

About Honeynet• Volunteer open source computer security

research organization since 1999 (US 501c3 non-profit)

• Mission: ¨learn the tools, tactics and motives involved in computer and network attacks, and share the lessons learned¨ -http://www.honeynet.org

About Indonesia Honeynet Project• Mycert introduces honeypot in OIC-CERT in

2009

• Explore honeypot in 2010, due to students’ interest in learning data mining on:

– Cyber terrorism

– Malware behavior

• Cecil (Singapore Chapter lead) introduced us to Honeynet global

About Indonesia Honeynet Project• 15 passionate security

professionals, academicians and government officials met signed a petition in 25 November 2011

• Indonesia Chapter officially recognized 9 January 2012

• Current members: 178 (25 active members)

About Indonesia Honeynet Project

About Indonesia Honeynet Project• Attended Honeynet Workshop 2012

• With support from KOMINFO, we conducted yearly seminar and workshops– Focus on Security Awareness and Security Research

• Honeynet communities: Jakarta, Semarang, Surabaya, Yogya, Denpasar, Palembang, Lampung

• Research Topics: Incident handling, Vulnerability Analysis, Malware, Digital Forensics, Penetration Testing, Threats Intelligence

About Indonesia Honeynet Project

Honeynet Seminar & Workshop | 10-11 Juni 2015 | Lampung, Indonesia

About Indonesia Honeynet Project

Incident Response & Analysis Challenge | 24 Aug 2015 | Jakarta, Indonesia

Honeypots Research & Deployment

2009 2011 2013 2015

LearningPeriod

Early Period

GrowingPeriod

ExpandingPeriod

Honeypot: Nepenthes

Honeypot:Nepenthes, Dionaea

Honeypot:Dionaea

Honeypot:Dionaea, Kippo, Glastopf, Honeytrap

Learning How to install and configure

Deployed 1st

Honeypot in SGUTarget: Academic, Government, ISP

Coverage: Java, Bali, Sumatera,

# Honeypots deployed: None

# Honeypots deployed: 1

# Honeypotsdeployed: 5

# Honeypots deployed: 20

Hardware: Client Hardware: SimpleClient and Server

Hardware: Mini PC and Server

Hardware: Raspberry Pi and Dedicated servers

List of contributors

• Amien H.R.

• Randy Anthony

• Michael

• Stewart

• Glenn

• Mario Marcello

• Joshua Tommy

• Andrew Japar

• Christiandi

• Kevin Kurniawan

The Threat Intelligence

What is Darknets?

Darknet – portion of routed, allocated IP

space in which no active servers reside.

— Team CYMRU

What is Darknets?

Livenet Darknet

Live IP Address (used) Unused IPs

Darknets and Honeypots

Goal

• To understand cyber activities in our institutions in Indonesia (Government, Education and Industry)

How

• Honeypot servers put in the unused IP address across the above organizations

First Step – Distributing Sensors

Mini PC Raspberry Pi

First Step – Collecting sensors’ data

Repository Server

Raspberry Pi

Raspberry Pi

Raspberry Pi

Second Step – Analysis

Repository Server

AnalysisServer

Raspberry Pi

Raspberry Pi

Raspberry Pi

Third Step – User Experience

Repository Server

AnalysisServer

WebServer

USERSRaspberry Pi

Raspberry Pi

Raspberry Pi

Honeypots Implemented• Dionaea – capturing attack patterns and

malware involved via port 21, 42, 69, 80, 135, 445, 1433, 3306 dan 5060 & 5061

• Glastopf – capturing attack pattern on web application attacked

• Kippo – capturing traffic pattern on SSH port

• Honeytrap – capturing other misc. ports not captured above

Why not IDS? Why Honeypots?

IDS

HONEYPOT

A

T

T

A

C

K

S

Detection based on

KNOWN ATTACK rules

Record ALL attacks directed toward the monitored IP

add

UNKNOWNATTACK

Current Architecture

Repository Server

AnalysisServer

Web Server + Web Service

USERSPots

Pots

Pots

The New GenerationThreat Intelligence

New Data Source

Repository Server

AnalysisServer

USERS

System Logs

DNSTraffic Log

Pots

Web Server + Web Service

MALWARE ANALYSIS ENGINE

New Analysis Engine

Static DynamicRisk

Scoring

Reverse EngineerMalware code

To find “hidden” code

Run MalwareIn a sandbox; dump

malware code

Provide Risk Score based on the static & behavior analysis

DNS TRAFFICANALYSIS

DNS Analysis Target

Domain

Botnet

Anomaly

Extract Malicious Domain from the DNS traffic

captured

Identifying Botnet fromDomain names Botnet

visited

Identify anomaly traffic from DNS traffic

Architecture DNS Traffic Analysis

Attack Connection Analysis

ATTACK CONNECTION

ANALYSIS

Domain/IPAnalysis

Traffic PatternAnalysis

ProduceMalicious Domain List

(Publicly usable)

New Knowledge on Attack pattern

New Generation Capabilities

• Dynamic Analysis (with Static Analysis) using Binary Instrumentation to obtain critical malware hidden code

• Risk Scoring on malware captured

• Malware Domain List based on DNS traffic and Attack Traffic to Honeypots

• Traffic Attack Pattern knowledge

Some Statistics

Our Contribution

Our Contribution

Attacker Statistics: Attacker IP, Malware, Targeted Ports, Provinces attacked

Our Contribution

Attacker Statistics: Attacker IP, Malware, Targeted Ports, Provinces attacked

Our Statistics

Our Statistics

Our Statistics (malware found)

Our Statistics

Our Statistics

Our Statistics

Our Statistics (other malware)2013 2014

Virus naming by AhnLab-V3 (Virustotal)

Our Statistics (other malware)2015 2016

Virus naming by AhnLab-V3 (Virustotal)

More Statistics

More Statistics

More Statistics

More Statistics

More Statistics

More Statistics (who are they?)

More Statistics (who are they?)

More Statistics (who are they?)

More Statistics (who are they?)

Research & Publications

Our Research & Publications

Malware | Data Mining | Behavior Analysis | Cyber Terrorism

Other Research

Second Hand USB Forensics and Publications

Mapping Research Roadmap

Deception Technology | Malware | Data Mining | Cyber Crime

Deception Technology

Malware

Data Mining Cyber Crime

Tools

Join Us

• http://www.ihpcon.id

• Indonesia Honeynet Project

• idhoneynet

• http://www.honeynet.or.id

• http://groups.google.com/group/id-honeynet

Related Publications• Joshua Tommy Juwono, Charles Lim, Alva Erwin, A Comparative Study

of Behavior Analysis Sandboxes in Malware Detection, The 3rd International Conference on New Media 2015, Jakarta, Indonesia, 2015

• Charles Lim, Nicsen, Mal-EVE Static Detection Model for Evasive Malware, 10th EAI International Conference on Communications and Networking in China, Shanghai, China, 2015

• Charles Lim, Darryl Y. Sulistyan, Suryadi, and Kalamullah Ramli, Experiences in Instrumented Binary Analysis for Malware, The 3rd International Conference on Internet Services Technology and Information Engineering 2015 (ISTIE 2015), Bali, 2015

• Charles Lim, Meily, Nicsen, and Herry Ahmadi, Forensics Analysis of USB Flash Drives in Educational Environment, The 8th International Conference on Information & Communication Technology and Systems, Surabaya, 2014

• Charles Lim, and Kalamullah Ramli, Mal-ONE: A Unified Framework for Fast and Efficient Malware Detection, 2014 2nd International Conference on Technology, Informatics, Management, Engineering & Environment, Bandung, 2014.

Call for Research Collaboration• Research Champion for each university

• Research collaboration across different universities to foster rapid research growth in Cyber security

• Generate more research publications ==> easier to get funding for research as well

Our Partners

THANK YOU

Ministry of Communication and Informatics of Republic of Indonesia