Examining the Internet's Pollution
Karyn Benson analyzes terabytes of background radiation collected by network telescopes, illuminating global scanning patterns, botnet sweeps, and DDoS backscatter.
Summary
Architecture and Background
Network telescopes are collections of unused but BGP-announced IP addresses. They collect the pollution of the Internet: scanning, misconfigurations, backscatter from DoS attacks, bugs, etc.
Vulnerability Analysis
For example, several historical studies used network telescopes to examine worm outbreaks. In this talk I will discuss phenomena that have recently induced many sources to send traffic to network telescopes.
Exploitation and Demonstrations
By examining this pollution we find a wealth of security-related data. Specifically, I’ll touch on scanning trends, DoS attacks that leverage open DNS resolvers to overwhelm authoritative name servers, BitTorrent index poisoning attacks (which targeted torrents with China in their name), a byte order bug in Qihoo 360 (while updating, this security software sent acknowledgements to wrong IP addresses… for 5 years), and the consequence of an error in Sality’s distributed hash table.
Remediation and Defensive Strategies
Karyn recently defended her PhD in computer science. Prior to starting graduate school she wrote intrusion detection software for the US Army. When not looking at packets, Karb eats tacos, runs marathons, and collects state quarters.
Related talks
Main Stage·21 min
Kenneth Geers
Kenneth Geers analyzes cyber operations in the Russia-Ukraine war, dissecting destructive wiper malware, Viasat satellite outages, and hacktivist mobilization.
Main Stage·40 min
Ian Latter
Ian Latter analyzes adversary remote access trojan design trends, comparing commercial RAT capabilities with bespoke nation-state cyber espionage frameworks.
Main Stage·43 min
Mark Ryan Talabis
Mark Ryan Talabis shares empirical research into underground traffic brokerage networks, analyzing the mechanics of botnets driving commercial click fraud.