CATCHING PREDATORS CODE

In Proceedings of the 2012 IEEE Symposium on Security and Privacy (Washington, DC, USA, 2012), SP '12, IEEE Computer Society, pp. Evilseed: A guided approach to finding malicious web pages. Invernizzi, L., Benvenuti, S., Cova, M., Comparetti, P.6th Annual International Conference on Information Warfare and Security (2011). Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Hutchins, E., Clopperty, M., and Amin, R.In Proceedings of the 23rd USENIX Conference on Security Symposium (Berkeley, CA, USA, 2014), SEC'14, USENIX Association, pp. Targeted threat index: Characterizing and quantifying politically-motivated targeted malware. Hardy, S., Crete-Nishihata, M., Kleemola, K., Senft, A., Sonne, B., Wiseman, G., Gill, P., and Deibert, R.Advanced web attack techniques using gmail. Scanbox framework - who's affected, and who's using it?, 2014. Cox, A., Elisan, C., Gragido, W., Harrington, C., and McNeill, Jon McNeill, J.In Proceedings of the 20th international conference on World wide web (New York, NY, USA, 2011), Google Scholar Digital Library Prophiler: a fast filter for the large-scale detection of malicious web pages. Canali, D., Cova, M., Vigna, G., and Kruegel, C.In Proceedings of the 22nd international conference on World Wide Web (Republic and Canton of Geneva, Switzerland, 2013), Google Scholar Digital Library The role of web hosting providers in detecting compromised websites. Canali, D., Balzarotti, D., and Francillon, A.In In Proceeding of the Network and Distributed System Security Symposium (NDSS'13) (2013). Behind the scenes of online attacks: an analysis of exploitation behaviors on the web. In Proceedings of the 20OO ACM SIGMOD (2000), ACM. LOF: Identifying density-based local outliers. In Proceedings of the ACM Conference on Computer and Communications Security (2013), CCS '13, ACM. Delta: Automatic Identification of Unknown Web-based Infection Campaigns. Borgolte, K., Kruegel, C., and Vigna, G.

Watering holes exploiting jsonp hijacking to track users in china. Vulnerability summary for cve-2014-6332.

CATCHING PREDATORS CODE

Scanbox javascript code - exploit packs.

Viruswatch - viruswatch watching adress changes of malware URL's.

Farsight security information exchange.

Ad blocking with ad server hostnames and ip addresses.

Also, our study brings to light interesting new observations, including the discovery of a recent JSONP attack on an NGO website that has been widely reported and apparently forced the attack to stop. Given so far there are merely 29 watering holes reported by blogs and technical reports, the findings we made contribute to the research on this attack vector, by adding 59% more attack instances and information about how they work to the public knowledge.Īnalyzing the new watering holes allows us to gain deeper understanding of these attacks, such as repeated compromises of political websites, their long lifetimes, unique evasion strategy (leveraging other compromised sites to serve attack payloads) and new exploit techniques (no malware delivery, web only information gathering). Running this system on the HTTP traffic generated from visits to 61K websites for over 5 years, we are able to discover and confirm 17 watering holes and 6 campaigns never reported before.

This was made possible by a carefully designed methodology, which repeatedly monitors a large number potential watering hole targets to detect unusual changes that could be indicative of strategic compromises.

In this paper, we report our first step toward better understanding this emerging threat, through systematically discovering and analyzing new watering hole instances and attack campaigns. With its importance, little has been done so far to understand how the attack works, not to mention any concrete step to counter this threat. This type of attacks, called 'watering hole', have been increasingly utilized by APT actors to get into the internal networks of big companies and government agencies or monitor politically oriented groups. Unlike a random, run-of-the-mill website infection, in a strategic web attack, the adversary carefully chooses the target frequently visited by an organization or a group of individuals to compromise, for the purpose of gaining a step closer to the organization or collecting information from the group.

Catching predators