So you think all those attacks are originated from China? Let's go through a journey of an in-depth investigation of attacks by using custom honeypots

No ratings

Presented at Wahckcon 2015 by

Pedram Hayati

Looking at your server logs, you always see sheer loads of connections from China or Hong Kong. The typical impression is that they are script kiddies running their automated bots, scanning IPv4 space, looking for vulnerable hosts. And interestingly, over 90% of them are originated from Chinese owned providers. Well, that's what 'they' want you to think! In this presentation, I will take you through a journey of in-depth analysis of these suspicious connections to discover their orchestration and motives. The journey is based on my observation of setting up a number of custom honeypots (i.e. Smart Honeypot) across major cloud providers to attract adversaries and to monitor their tactics. I will talk through different layers of actors behind attacks as well as geographic targeted intrusions (geoattacks). Moreover, I will talk about applying Network Theory principles in order to get better insights into attackers' behaviour and their relationships. I will conclude the presentation with tips on hardening (cloud-hosted) servers against especially if you are hosting your servers on AWS, Google Cloud or Azure.