Catching the Uncatchable: Investigating Malicious Activity Incidents in Corporate Networks

No ratings

Presented at phdays 2013 by

Fyodor Yarochkin

Vladimir Kropotov

Vitaliy Chetvertakov

Vladimir, Fyodor and Vitaliy spend their daily time as security analysts detecting malicious activity outbreaks in large corporate networks. In this presentation they summarize their experience in detecting large, cross-continental mass-infection activities. The presentation will cover both, financially-oriented online crime activities as well as targeted attacks, which recently gained larger exposure due to some high profile network compromises (e. g., recent New York Times compromise incident). The presenters will thoroughly discuss mechanisms of malware dissimulation, primary attack and spreading vectors and attack details, specific to each particular campaign observed. Fyodor will also demonstrate a novel approach of detecting targeted attack compromises within enterprise networks through methods of statistical traffic analysis. Fyodor Yarochkin is a Security Analyst at P1 Security, Academia Sinica. Vladimir Kropotov is an information security analyst and independent researcher. Vitaliy Chetvertakov is a security analyst and independent researcher.Fyodor Yarochkin, Vladimir Kropotov, Vitaliy Chetvertakov Fyodor Yarochkin, Vladimir Kropotov, Vitaliy Chetvertakov