One Day At The Internet Storm Center

The speaker introduces the Internet Storm Center, a volunteer-run service that grew out of the Lion worm incident and that he has contributed to as a handler since 2015. The talk is a tour of the free resources the service offers rather than a technical deep dive.

The middle of the talk covers the five-minute daily podcast aimed at commuters, the handler-written diaries that range from Linux malware analysis to campaigns abusing short videos, and the infocon threat level, which has stayed green since 2017 to avoid alert fatigue. The main data comes from the DShield honeypot network, whose logs are sent back daily. Search interfaces show new URLs, top scanning addresses, port trends and keyword activity, and threat feeds are available through an open API without registration. The speaker warns that only the published block list should be applied directly in firewalls, since reputation lookups produce false positives. He also described reconfiguring honeypots to mimic targeted products, which pushed the Netherlands to the top of a WebLogic exposure statistic.

The closing part is a call for participation. Listeners can run a honeypot on inexpensive hardware, submit samples with control over how they are credited, or apply to become a handler. Applicants need prior security training, must communicate openly, and must be vetted by existing handlers. Handlers publish without legal or marketing review, and the speaker said the group would welcome more European members.