Entries by Thorsten Holz

Quick blog posting about the new forensic challenge by the Honeynet Project:

Challenge 4 - VoIP - (provided by Ben Reardon from the Australian and Sjur Eivind Usken from Norwegian Chapter) takes you into the world of voice communications on the Internet. VoIP with SIP is becoming the de-facto standard for voice communication on the Internet. As this technology becomes more common, malicious parties have more opportunities and stronger motives to take control of these systems to conduct nefarious activities. This Challenge is designed to examine and explore some of attributes of the SIP and RTP protocols. Enjoy the challenge.

You can find all info at http://honeynet.org/challenges/2010_4_voip. Submission deadline is June 30th 2010 - thus you still have some time to work on the challenge. You can win books, for example a signed copy of "Virtual Honeypots: From Botnet Tracking to Intrusion Detection" by Niels and me.

Recently, we studied an aspect of the World Wide Web that did not receive a lot of attention yet - the online adult industry. Compared to traditional media, the Internet provides fast, easy, and anonymous access to the desired content. That, in turn, results in a huge number of users accessing pornographic content. To improve the understanding of this part of the Web, we performed a study of the online adult industry. As a result, we provide a detailed overview of the individual actors and roles within the online adult industry, which enables us to better understand the mechanisms with which visitors are redirected between the individual parties and how money flows between them. Furthermore, we examined the security aspects of more than 250,000 adult pages and studied, among other aspects, the prevalence of drive-by download attacks. In addition, we analyzed domain-specific security threats such as disguised traffic redirection techniques, and surveyed the hosting infrastructure of adult sites.

Lastly, we operated two adult web sites on our own. By becoming adult web site operators ourselves, we gained additional insights on unique security aspects in this domain. This enabled us to obtain a deeper understanding of the related abuse potential. We participated in adult traffic trading, and provide a detailed discussion of this unique aspect of adult web sites, including insights into the economical implications, and possible attack vectors that a malicious site operator could leverage. For example, we discovered that a malicious operator could infect more than 20,000 with a minimal investment of about $160. Furthermore, we experimentally show that a malicious site operator could benefit from domain-specific business practices that facilitate click-fraud and mass exploitation. We conclude that many participants of this industry have business models that are based on very questionable practices that could very well be abused for malicious activities and conducting cyber-crime. In fact, we found evidence that this kind of abuse is already happening in the wild.

All details of our study are available in the paper. The paper will be presented at the Ninth Workshop on the Economics of Information Security (WEIS 2010). WEIS will take place on June 7/8 at Harvard University.

Abstract:
The online adult industry is among the most profitable business branches on the Internet, and its web sites attract large amounts of visitors and traffic. Nevertheless, no study has yet characterized the industry’s economical and security-related structure. As cyber-criminals are motivated by financial incentives, a deeper understanding and identification of the economic actors and interdependencies in the online adult business is important for analyzing security-related aspects of this industry.
In this paper, we provide a survey of the different economic roles that adult web sites assume, and highlight their economic and technical features. We provide insights into security flaws and potential points of interest for cyber-criminals. We achieve this by applying a combination of automatic and manual analysis techniques to investigate the economic structure of the online adult industry and its business cases. Furthermore, we also performed several experiments to gain a better understanding of the flow of visitors to these sites and the related cash flow, and report on the lessons learned while operating adult web sites on our own.

This paper was joint work with Gilbert Wondracek, Christian Platzer, Engin Kirda, and Christopher Kruegel, all members of the International Secure Systems Lab. You can get the paper at http://honeyblog.org/junkyard/paper/adultSites-weis2010.pdf.

A quick announcement:

Join us at the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats, which will take place in San Jose, CA, on April 27, 2010. LEET '10 will provide a unique forum for the discussion of threats to the confidentiality of our data, the integrity of digital transactions, and the dependability of the technologies we increasingly rely on.

The program includes:
-- Keynote Address: "Why Don't I (Still) Trust Anything?" by Jeff Moss, Founder, Black Hat and DEF CON

-- Invited Talk: "Naked Avatars and Other Cautionary Tales About MMORPG Password Stealers," by Jeff Williams, Microsoft Malware Protection Center

-- Sessions on threat measurement and characterization, botnets, threat detection and mitigation, and more.

Check out the full program at
http://www.usenix.org/events/leet10/tech/

Connect with the broad community of researchers and practitioners who focus on worms, bots, spam, spyware, phishing, DDoS, and the ever-increasing palette of large-scale Internet-based threats in fostering the development of preliminary work in this diverse area and stimulating discussion of thought-provoking ideas.

Find out more and register today at
http://www.usenix.org/leet10/proga

And please note that the deadline for RAID 2010 has been extended to April 21, 2010. See the Call for Participation for more details. Looking forward to your papers!

We recently published a technical report on another project related to social networks. The paper is entitled "Abusing Social Networks for Automated User Profiling" and we focus on automatically collecting information about users based on the information available in different networks.

Imagine that you have a profile on Facebook, on LinkedIn, and on MySpace. Perhaps you do not want to directly link these profiles, for example since you want to have a more serious profile on LinkedIn, while having a more relaxed one on MySpace and Facebook. Thus you use different pseudonym/names on the different profiles and expect that the information can not be correlated. However, there is a problem with that assumption: during the registration on the different networks, you used the same e-mail address. And a social network typically enables a user to search for e-mail addresses in order to find friends (a convenient feature, after all you want to network with your friends). An attacker can thus go ahead and search on each network for a given e-mail address, scrape the profile related to that address, and then correlate the information found on different network. At the end, an attacker can thus enrich a given e-mail address with information collected on different social networks.

An attacker can not only search for one e-mail address at a time, but typically for hundreds or even thousands. And he can not only do this once, but thousands of times per day. For example, we were able to check about 10 million e-mail addresses on Facebook per day. A spammer could use this "feature" to verify e-mail addresses by using Facebook as an oracle to determine whether or not a given e-mail address is valid. Furthermore, the correlation aspect is of course also a privacy problem since an attacker can find "hidden" information and correlate information across different networks.

We have contacted different social networks. Facebook and XING have already addressed the problem - thanks a lot!

Abstract:
Recently, social networks such as Facebook have experienced a huge surge in popularity. The amount of personal information stored in these sites calls for appropriate security precautions to protect this data.
In this paper, we describe how we are able to take advantage of a common weakness, namely the fact that an attacker can query the social network for registered e-mail addresses on a large scale. Starting with a list of about 10.4 million email addresses, we were able to automatically identify more than 1.2 million user profiles associated with these addresses. By crawling these profiles, we collect publicly available personal information about each user, which we use for automated profiling (i.e., to enrich the information available from each user).
Finally, we propose a number of mitigation techniques to protect the user’s privacy. We have contacted the most popular providers, who acknowledged the threat and are currently implementing our countermeasures. Facebook and XING in particular have recently fixed the problem.

The technical report is available at http://www.iseclab.org/papers/socialabuse-TR.pdf and it was joint work with Marco Balduzzi, Christian Platzer, Engin Kirda, Davide Balzarotti, and Christopher Kruegel.

At the International Secure Systems Lab, we have developed a couple of services like Anubis, Wepawet, or FIRE. Lately, we have worked on a mechanism to detect spammers on Twitter, a popular microblogging service. We have developed several heuristics to detect spamming profiles, and have already reported thousands of these profiles to Twitter, who then shut down these profiles. Now we have created a profile to which users can flag spammers on Twitter: the flagged accounts are added to our database, allowing us to detect profiles from campaigns we did not observe before.

The profile is @spamdetector, and the messages it accepts are of the format

"@spamdetector @spamaccount"

Whenever you see a suspicious account, you can simply send us a notification and our system will check if this account is likely a spammer or not. This helps us to improve our heuristics, and we can help Twitter to shut down suspicious profiles, leading to a better service.

This work was carried out by Gianluca Stringhini, a PhD student at University of California, Santa Barbara, working as research assistant at the Computer Security lab. And you can find my tweets at @thorstenholz.