Presentation - NJ Infragard

Transcription

Presentation - NJ Infragard
Internet Crimes Group, Inc.
iThreat® Solutions
Global Threat Intelligence:
Mining the Internet for Threat and
Risk Data
Copyright ICG, Inc. 2000-2008 All rights reserved
Global Threat Intelligence
This session will cover a variety of resources and types of
threat data that can be extremely useful in providing the
intelligence needed to protect your operation.
Copyright ICG, Inc. 2000-2008 All rights reserved
Copyright ICG, Inc. 2000-2008 All rights reserved
Threat and Risks
• Data loss
• Counterfeit product
• Attack on products or infrastructure
– Hardware compromise (mobile phone or appliance)
– Planning of attempts to compromise web based
services
•
•
•
•
•
Employee theft
High risk individuals/behaviors
Piracy
Mother nature
Plenty more….
Copyright ICG, Inc. 2000-2008 All rights reserved
Mapping Threats
Your facility
Copyright ICG, Inc. 2000-2008 All rights reserved
Threats to the
facility
Proximity Alerting
Copyright ICG, Inc. 2000-2008 All rights reserved
Public Sources for Threat Data
Copyright ICG, Inc. 2000-2008 All rights reserved
Public (Internet) Data Types
• RSS/XML Feeds
– CNN
– BBC
– NOAA
• Listservs/email lists
• Website/Blogs Message Boards
• iRC (Internet Relay Chat)
Copyright ICG, Inc. 2000-2008 All rights reserved
RSS Data Sources
• Mainstream Media
– CNN, BBC, NYT, WSG, Globe & Mail, FT, etc.
• Independent Media
– Indymedia.org
– Alternet.org
Copyright ICG, Inc. 2000-2008 All rights reserved
You can find just about any topic…. As demonstrated above:
• NOAA – National Oceanographic & Atmosphere Administration
• Imageshack (image(s) hosting)
• Wordpress (blog publishing)
• Electro-music
• AppleTV hacks
Copyright ICG, Inc. 2000-2008 All rights reserved
What is RSS Good for?
• Near-real-time threat data
– Severe weather (Hurricanes, tornadoes,
floods, high wind, etc.)
• Aggregation of local news
– Crime
– Traffic
– Weather
Copyright ICG, Inc. 2000-2008 All rights reserved
Blogs
Estimate for January 2008 = 145M
Copyright ICG, Inc. 2000-2008 All rights reserved
What are Blogs Good for?
• Topics of Operational Concern
– Labor disputes
– Disgruntled employees/customers/clients
(students)
– Public relations/customer feedback (nonsolicited)
Copyright ICG, Inc. 2000-2008 All rights reserved
Auction Sites
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
We Sell Your Stuff
auctionPAL.com
auctionPAL Does the Work, You Get the Cash. Learn More!
Auction.com - Everyones Internet Market Place
www.auction.com/ - 2k - Cached - Similar pages - Note thiseBay - New & used electronics, cars, apparel,
collectibles ...
... and everything else on eBay, the world's online marketplace. Sign up and begin to buy and sell - auction or buy
it now - almost anything on eBay.com. Stock quote for EBAY
www.ebay.com/ - 81k - Cached - Similar pages - Note this
Auction - Wikipedia, the
free encyclopedia
Remember:
The sites you have heard the
An auction is a process of buying and selling goods by offering them up for bid, taking bids, and then selling the
item to the winning bidder.
...
least
about are the ones more likely to be
en.wikipedia.org/wiki/Auction - 58k - Cached - Similar pages - Note this
“fences”
for stolen
goods.
Yahoo! Auctions - Buy used
and Sellas
Sports
Cards, Coins,
Collectibles
...
Experience the best Auctions marketplace. Yahoo! Auctions is now FREE. List your auction for FREE, host
your own images or Bid to buy great new and used ...
auctions.yahoo.com/ - 20k - Cached - Similar pages - Note this
Airline Tickets, Cheap Hotels, Vacation Packages & Travel Deals
The internet leader in Travel Auctions & Buy it Now deals to see the world. Our Lowest Price Guarantee on airline
tickets, hotels, cruises, ...
www.skyauction.com/ - 21k - Cached - Similar pages - Note this
Auction Fire - Free Auctions - Online Auction Site - Internet Auctions
Auction Fire is a free online auction site. An ebay alternative offering free auctions. Internet Auctions Website.
Buy or sell in thousands of internet ...
auctionfire.com/ - 32k - Cached - Similar pages - Note this
Auction Zip - Live Auction Locator - Find Auctions Anywhere!
AuctionZip is the Nation's largest Directory of Live Auction Listings. Site contains auctions, auctioneers, auction
companies, and auction galleries in ...
auctionzip.com/ - 51k - Cached - Similar pages - Note this
Copyright ICG, Inc. 2000-2008 All rights reserved
Auction/Trade Boards
• Grey market is full of peril. Sure, you may get a
great value but…
– Where did the medications come from? Are they
counterfeit? Expired? Diverted?
– The medical devices and bandaging… same issue…
also, are they sterile?
• Is stolen property from the facility ending up on
these boards being fenced?
• Is your purchasing or supply entity reselling
company property online?
Copyright ICG, Inc. 2000-2008 All rights reserved
Counterfeiting and Diversion:
» The Internet makes it easier
than ever for importers to
obtain counterfeit and
diverted goods.
» Hundreds of business-tobusiness called “Trade
Boards” websites help
suppliers and importers
connect.
Copyright ICG, Inc. 2000-2008 All rights reserved
Wholesale Trade Feeds the Internet Pharmacy Threat
Intelligence Identifies Cyber/Physical Relationships
Portal
Websites
Portal
Websites
Secondary
Market
Wholesalers
SPAM
Portal
Websites
Mail Order
Pharmacy
POP-UP Adds
Portal
Websites
Portal
Websites
Buyers
eCommerce
Pharmacy
Search Engine
Placement
Anchor
Business
Copyright ICG, Inc. 2000-2008 All rights reserved
Affiliate Programs:
Rings of Web Sites
Counterfeiting & Diversion
Counterfeit
& Diverted
Products
Brokers, Importers,
& Exporters
“Institutional” Fences:
Quality King, Purity Wholesale,
Victory, Premium Sales, etc.
Copyright ICG, Inc. 2000-2008 All rights reserved
Black & Gray
Market Retailers
Copyright ICG, Inc. 2000-2008 All rights reserved
Piracy
• Pure threat to IP….
– Movies
– Music
– Games
– Software
• Or greater threat?
– Business software… what else can that
pirated software do? How does/can it impact
our infrastructure?
Copyright ICG, Inc. 2000-2008 All rights reserved
Social Networking Sites
•
Bebo
BlackPlanet (African-Americans)
Bolt (Music and Video)
Broadcaster (Video sharing and webcam chat)
CarDomain (Car lovers)
Care2 (Green living and activism)
Classmates (School, college, work and the military)
Dogears.net (US Universities)
Dogster (uh, dogs!?!)
Eons
Facebook
Flickr (pics)
Friendster
Graduates (School, College)
Golfspinner (Golfers)
Hi5
Joga (Soccer)
Kaneva (3D virtual world)
LibraryThing (Book Lovers)
eSpin (Teens)
Meetup
MiGente (Latinos)
MOG
MSN Spaces
MySpace
MyYearBook
Orkut
Piczo
Palopia (students)
Panjea (music, media player)
Passado
Reunion
Sconex
Tagworld
Travellerspoint (Travels)
Tribe
Vois
WAYN
Xianz (Christians)
Xuqa
Yahoo 360
Yelp
Zaadz (Change the World)
Zorpia
Doostang (Harvard, Stanford, MIT alumni
Copyright ICG, Inc. 2000-2008 All rights reserved
•
Business Networks
•
CollectiveX (for groups)
Guanxi (China)
Ryze (USA)
Tianji (China)
Xing
Arto.dk (Denmark)
ASmallWorld (Euro)
Cyworld (South Korea)
Epuls.pl (Poland)
EveryonesConnected (UK)
Faceparty (UK)
Face-Pic (UK)
Fropper (India)
Grono (Poland)
Hyves (Netherlands)
IRC Galleria (Finland)
iWiW (Hungary)
LunarStorm (Sweden)
Mixi (Japan)
Nexopia (Canada)
Passado (Euro)
Playahead (Sweden)
ProfileHeaven (UK)
Rate.ee (Estonia)
Studivz.net (Germany's Facebook)
Yeeyoo (China)
Yeskee (China)
Yonja (Turkey)
Anti-Social Networks
Isolatr
Snubster
Search Term = “kill them all”
Number of Results = 500
Copyright ICG, Inc. 2000-2008 All rights reserved
Summary
• Awareness
– Do you best to know where and when to look for
intelligence. Much of it is there to find in the public
domain.
• Analysis
– Spend the time to interpret the threat and risk to your
operation.
• Action
– Force the issue in your organization. Be proactive in
your response.
Copyright ICG, Inc. 2000-2008 All rights reserved
Copyright ICG, Inc. 2000-2008 All rights reserved
Jeffrey R. Bedser
President/COO
Phone: 609-806-5000
E-mail: jrb@icginc.com
Website: www.icginc.com
P.O. Box 3599
Princeton, NJ 08543
Copyright ICG, Inc. 2000-2008 All rights reserved