BlackHat资料us-14-Geers-Leviathan-Command-And-Control-Communications-On-Planet-Earth-WP.pdfVIP

DRAFT Leviathan: Command and Control Communications on Planet Earth Black Hat Las Vegas 2014 Kenneth Geers Senior Global Threat Analyst, FireEye Kevin Thompson Threat Analyst, FireEye Abhishek Pidwa Data Analyst Intern, FireEye Abstract Every day, computer network attackers leverage a Leviathan of compromised computer infrastructure, based in every corner of the globe, to play hide-and-seek with network security, law enforcement, and counterintelligence personnel. This presentation draws a new map of Planet Earth, based not on traditional parameters, but on hacker command and control (C2) communications. The primary data points used in this worldwide cyber survey are more than 30 million malware callbacks to over 200 countries and territories over an 18-month period, from January 2013 to June 2014. First, this talk covers the techniques that hackers use to communicate with compromised infrastructure across the globe. The authors analyze the domains, protocols, ports, and websites used for malicious C2. They explain how covert C2 works, and how attackers keep their communications hidden from network security personnel. Second, this talk looks at strategic impact. The authors examine relationships between the targeted industries and countries and the first-stage malware servers communicating with them. Traffic analysis is used to deduce important relationships, patterns, and trends in the data. This section correlates C2 communications to traditional geopolitical conflicts and considers whether computer network activity can be used to predict real world events. In conclusion, the authors consider the future of this Leviathan, including whether governments can subdue it – and whether they would even want to. DRAFT