I recently came across this white paper which focuses in the dynamic analysis of network indicators for threat detection. The paper is very easy to read and I found very surprising some of the conclusions obtained from the research. The most revealing one is the fact that months before researchers have access or discovered a…
Category: cyberespionage
Cyber Deception: Building the scientific foundation
Looking to understand better cybe deception systems and current state of this technology, I made a thorough search in internet fiding this books in Amazon. The books is a compendium of different research papers aimed at defining cyber depection, its capabilities and technicalities to design them. If you are interested specifically in the design of…
Paper: Wave your false flags! Deception tactics muddying attribution in targeted attacks
This is an 11 page white paper that goes through the current challenges faced by researchers to attribute cyber attacks. It goes through the current techniques such as, Timestamps Strings, debug and metadata Malware families, code reuse Threat infrastructure used It also present some of the most advance APT’s and their potential origin and techniques believed…
The Project Sauron APT
Key takeaways, DNS keeps being an important protocol for exfiltration Process Injection, Memory Persistence, no file trace in disk Living of the land techniques to move laterally They thwarted the attribution process not using twice the same threat infrastructure https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf
Battlefield Digital Forensics
In a quick break this weekend I had a chance to read this new paper developed by NATO to explain and train special forces in the art of digital intelligence and evidence collection. It is clear from this publication how rapidly the world around us is transforming, special forces from now on will be trained…
The Most Dangerous Town on the Internet
A couple of days ago I was recommended these 2 documentaries, they are short but concise and they show how cyber criminality is on the rise. In the first documentary they explain how Romania as a result of its history is seeing a surge in cyber criminal activities. It is an excellent testimony from some…
Cyber Threat Hunting (3): Hunting in the perimeter
In this third post we are going to see what we need to look at when hunting and detecting adversaries in the perimeter. We are also going to look at some of the firewall technologies and their log formats in order to detect anomalies in the inbound and outbound traffic in your network. …
Cyber Threat Hunting (1): Intro
After some long months debating whether to write a white paper, and what potential topics I could write about – I just decided that I do not have enough time to go through the process of writing a research paper for the next 6 to 12 months. Instead, I am taking some of my research and current…
Active Cyber Defense Tactics
Active cyber defense (ACD) is the concept of proactively opposing an attack in computers and networks. There are a series of tactics that can be applied in order to mitigate risk or detect adversaries inside the network. Active Hunting Security operations team focuses on reactive detection mainly based on signatures. In this scenario advanced attackers…
The new security paradigm shift (1)
From the early 80’s to the first decade of the new millennium, security has evolved very fast, however it is in the last decade that the fastest and biggest shift has happened. We all remember the famous movie ‘Hackers’, with the exotic Angelina Jolie and that punk look of the golden times. These hackers were moved…
Offensive Cyber Counterintelligence (white paper)
Interesting white paper, I would not have called Offensive Cyber Counterintelligence as it mainly conveys the idea of creating intelligence from the adversary. Nowaday there are disciplines such as Cyber Threat Intelligence for this sort of intelligence. I understand the Cyber Counterintelligence as a branch of the intelligence which is concerned with keeping information out of…
Computer network defense operations, disrupting the enemy’s attack
In the last couple of weeks I have been reading different white papers related to network computer defense and the general idea in all of them is that the industry is moving towards a dynamic approach to computer network defense. In the past, IT would be dealing with the defense of corporate networks however that…
