Finding the Seoul of Malware: An Analysis of Attacks in East Asia

No ratings

Presented at BSidesKansasCity 2018 by

Justin Nitz

Have you been intrigued by the latest malware attacks targeting e-commerce startups in foreign countries? In this talk, we will embark on a journey through the eyes of a fictitious cryptocurrency exchange based in Seoul. Using honeypots hosted in South Korea and the United States, we will uncover the differences in the attack methods used in these two countries. At the end of the talk, you will gain insight on attack vectors targeting East Asia and discover if our startup lived to fight another day.Securing Windows with (some) Group PolicyJosh RickardN/AN/AWhen you buy a house what's the first thing you do? Me, I replace the locks. It’s the same with operating systems. Just because you installed the OS, doesn’t mean it’s secure. You need to configure/harden it!Group Policy exists in almost every modern business environment. Many organizations either do not use it or do not use it as extensively as they should.Do you understand Group Policy processing? Did you know you can manage both Active Directory groups and user rights? What about running Scheduled Tasks and do you even Manage Services, bro? Why do all your Administrative accounts have extra permissions like Debug Programs? And why the hell are you afraid of AppLocker?Remember, Group Policy is an ENTERPRISE scale registry editor.