Towards a Holistic Approach in Building Intelligence to Fight Crimeware
summary
Combines network telemetry (passive DNS, PTR, BGP, Project Sonar scans) with human infiltration of underground forums to map bulletproof hosting, distinguishing fast‑flux botnet proxy networks and dedicated rogue ASNs. Uses SSL x509 SHA pivoting and common‑name correlations plus active probing to expand from a few indicators to full IP spaces, unmask Cloudflare‑hidden domains, and find previously unflagged malicious certs. Backend is a HBase + ElasticSearch index of ~800 GB/3 years enabling billion‑row lookups with sub‑0.4s reads, which proves effective for predictive blocking.
AI-written summary · about
chapters (36)
- 0:00Welcome
- 0:45Introduction
- 2:00Thomas Mathieu
- 2:11Outline
- 2:47What is cybercrime
- 3:47Bulletproof hosting providers
- 5:08SSL
- 11:02Autonomous Systems
- 11:16Actor View
- 13:15Network View
- 16:25SSL Analysis
- 19:02Trustworthy Domains
- 19:13Abdullah
- 22:38Maxidead
- 26:35Host Shield
- 27:09OutHost
- 28:18FastFox
- 29:01UberGrants
- 30:17ElfHost
- 31:35Other Competitors
- 32:48Sosweet
- 33:36Dataflow
- 34:39Badnesses
- 36:05Xserve
- 37:41BQHost
- 38:19OurRacks
- 38:37SSL Investigation
- 39:45Data Source
- 40:23Three Components
- 40:52Data Platform Architecture
- 41:12HBase
- 42:46Row Key
- 43:25Questions
- 43:59What is a Deep Table
- 44:38Why Elastic Search
- 46:35Elastic Search Demo
related talks
59mCatching Malware En Masse: DNS and IP Style
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
32mSomething’s Phishy: See the Hook Before the Bait
42mCracking the Code: Decoding Anti-Bot Systems!
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
27mAgentic Cyber Defense with External Threat Intelligence
35mThe Best Defense is a Great Offense: Leveraging Automated...
59mCounter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure