1
00:00:00,000 --> 00:00:04,980
Good afternoon, everybody. Welcome to the home stretch of Saturday. Thanks for being here at

2
00:00:04,980 --> 00:00:10,260
Crypto and Privacy Village. We've got another fantastic talk lined up. Ken Gears, Senior

3
00:00:10,260 --> 00:00:16,180
Research Scientist at Komodo, is going to run us through traffic analysis in cyberspace. All the

4
00:00:16,180 --> 00:00:26,460
cybery cybers. Thanks, Ken. Give it up. Awesome. Thanks for being here. I really

5
00:00:26,460 --> 00:00:32,080
appreciate it. So I'll just, I think the most important takeaway from this talk is that,

6
00:00:32,560 --> 00:00:39,160
you know, the math works and it doesn't really matter how, you know, how solid your crypto is

7
00:00:39,160 --> 00:00:44,380
if somebody can see what you're doing. You know, if somebody basically knows, you know, if they're

8
00:00:44,380 --> 00:00:51,340
looking for you, especially. But given ubiquitous surveillance and sensors today, you know, often

9
00:00:51,340 --> 00:00:56,140
people just can see who you are and where you are. And we'll get to that in just a second. But

10
00:00:56,140 --> 00:00:56,440
you know, I think the most important takeaway from this talk is that, you know, if somebody

11
00:00:56,460 --> 00:01:01,840
I'm sort of have an intelligence background. So I kind of look at things with an international

12
00:01:01,840 --> 00:01:06,180
relations perspective. So a geopolitical perspective. And that's what I've done at

13
00:01:06,180 --> 00:01:12,920
government for 20 years and then with a couple of companies as well. So who knows what pizza

14
00:01:12,920 --> 00:01:25,080
and the Pentagon's have in common? Yes. Exactly. So, you know, if you're a journalist, you can sit

15
00:01:25,080 --> 00:01:26,440
out at two in the morning and you can see what's going on. And you can see what's going on. And

16
00:01:26,440 --> 00:01:29,580
you can see what's happening outside the Pentagon and just count the number of pizza deliveries. And

17
00:01:29,580 --> 00:01:36,900
if it's average 200 and then on one night it's 20,000 pizzas, the largest office building in the

18
00:01:36,900 --> 00:01:42,220
world, something is probably happening that you might want to be interested in. Right. So and then

19
00:01:42,220 --> 00:01:47,460
if you go to Alan Turing in World War II, you know, when the Japanese fleet set sail for Pearl

20
00:01:47,460 --> 00:01:52,280
Harbor, well, they kept the communications going as much as possible as normal, even though the

21
00:01:52,280 --> 00:02:00,700
ships weren't there. When we invaded France on D-Day from Normandy, we had all kinds of fake things

22
00:02:00,700 --> 00:02:07,620
happening. We wanted the Nazis to think that we were going to invade to the left and we went to the right. Right. And

23
00:02:07,620 --> 00:02:12,900
the same thing is on the Enigma machine from the German perspective. The Germans had great faith in the Enigma for a

24
00:02:12,900 --> 00:02:20,680
long time because the math was sound. You know, if it's trying to find one star in a universe of billions, you know, it's

25
00:02:20,680 --> 00:02:21,100
pretty good.

26
00:02:22,280 --> 00:02:27,140
The problem, though, is in the process. Right. And Garry Kasparov, if you heard his talk yesterday, he talked about this. He said

27
00:02:27,140 --> 00:02:35,060
it's all in the process. He said, honestly, he said a very average intelligence person with a smartphone can beat

28
00:02:35,060 --> 00:02:41,500
almost the best chess players today if they just know how to operate the phone well and they don't question the wisdom

29
00:02:41,500 --> 00:02:49,040
of the phone. So it's all about intelligence but you have to have smart people. And like with Bletchley Park and Alan

30
00:02:49,040 --> 00:02:51,980
Turing, there were thousands of people supporting him.

31
00:02:51,980 --> 00:02:57,820
doing HUMINT and SIGINT and all kinds of other intelligence operations behind them.

32
00:02:58,400 --> 00:02:59,880
So just a couple of slides on this.

33
00:03:00,160 --> 00:03:08,480
You know, if you have a whole bunch of traffic, right, on your network or in your country or in your home even,

34
00:03:08,680 --> 00:03:14,560
you can usually figure out, if you just start sorting it out, who's in charge, right?

35
00:03:14,660 --> 00:03:15,960
In other words, chain of command.

36
00:03:16,520 --> 00:03:21,420
And by timing, you can see when things happen that are important, right?

37
00:03:21,420 --> 00:03:23,520
And so that's how a lot of attribution.

38
00:03:23,580 --> 00:03:30,100
I spent years in the basement of the Pentagon trying to do attribution for these big intrusion sets that DoD looks at.

39
00:03:30,360 --> 00:03:32,600
Well, one of the basic ways to do that is time.

40
00:03:32,880 --> 00:03:40,940
You know, you take the majority of the traffic and you say, okay, between 9 and 5, where is it happening work time-wise?

41
00:03:41,260 --> 00:03:44,240
Okay, this intrusion set is 9 to 5 Beijing time.

42
00:03:44,440 --> 00:03:45,780
This is Moscow time.

43
00:03:45,960 --> 00:03:47,180
This is Maryland time.

44
00:03:47,460 --> 00:03:50,880
Aha, okay, here we have sort of the APTs sorted out, right?

45
00:03:51,420 --> 00:03:57,680
And so, again, if you imagine yourself sort of in a bunker in World War II, you know, with headphones on,

46
00:03:57,780 --> 00:04:03,200
you know, it's the frequency of the communications, the volume of communications.

47
00:04:03,300 --> 00:04:07,480
And a lot of times, this is going to give away even things like SSH and TLS.

48
00:04:07,980 --> 00:04:16,420
Security protocols on the Internet, they're subject to basic time and size and frequency attacks, right?

49
00:04:16,520 --> 00:04:19,660
Just depending on how often you're communicating and with whom you're communicating,

50
00:04:19,660 --> 00:04:22,340
a lot of times, the metadata is enough.

51
00:04:22,580 --> 00:04:24,960
You don't even really want the content, right?

52
00:04:25,020 --> 00:04:27,160
Because content just slows you down.

53
00:04:28,060 --> 00:04:28,960
It's hard enough.

54
00:04:29,000 --> 00:04:30,380
I can tell you, I was a linguist at NSA.

55
00:04:31,060 --> 00:04:36,780
It's hard enough to understand, for a person to understand what somebody else is saying,

56
00:04:36,980 --> 00:04:40,440
especially on the other side of the world, in a different context, a different language.

57
00:04:40,940 --> 00:04:42,880
It's even harder for computers, right?

58
00:04:42,940 --> 00:04:44,060
You know this from the Turing test.

59
00:04:44,580 --> 00:04:48,840
So, the metadata is really what you want, and you want to be able to chew

60
00:04:48,840 --> 00:04:57,620
on that, you know, algorithmically, and you can almost know more, quicker, faster, better, without the content.

61
00:04:58,340 --> 00:05:04,200
So, back and forth might be communications and random, it might be security or some kind of operation.

62
00:05:04,500 --> 00:05:07,140
You know, rapid, slow, silence, right?

63
00:05:07,320 --> 00:05:13,660
If all kinds of data is flooding all of a sudden, well, something important is happening if there's no communications.

64
00:05:13,660 --> 00:05:16,940
Well, guess what? That also might signal something very interesting.

65
00:05:17,200 --> 00:05:18,720
Let's say you're following a spy.

66
00:05:18,840 --> 00:05:23,140
You're counterintelligence, and then all of a sudden communications are completely broken.

67
00:05:24,140 --> 00:05:26,820
Maybe there's an important operation going on, right?

68
00:05:26,960 --> 00:05:31,220
Then that's an important takeaway from no comms.

69
00:05:31,280 --> 00:05:37,380
So, then on countering basic signals intelligence or traffic analysis, how do you do it on defense?

70
00:05:37,980 --> 00:05:40,760
Right? So, one of the basic ways is to burst communications.

71
00:05:41,260 --> 00:05:48,080
So, over the course of a month, you know, if I fire off some this morning, and then next Thursday, and then that's it,

72
00:05:48,080 --> 00:05:48,820
I'm hoping, you know, that's it.

73
00:05:48,820 --> 00:05:50,880
You're going to not be listening at the right time.

74
00:05:51,020 --> 00:05:52,560
So, it's all about when you're listening.

75
00:05:53,440 --> 00:05:56,240
Spread spectrum is all about where you're listening.

76
00:05:56,520 --> 00:05:57,840
You know, there's a range of frequencies.

77
00:05:58,120 --> 00:06:01,140
And so, I shoot one up here, one down here, and one down here.

78
00:06:01,360 --> 00:06:03,820
You know, you're only going to get part of it, right?

79
00:06:04,460 --> 00:06:09,160
Indirect communications are very important because, like at the Pentagon, way back when, 15 years ago,

80
00:06:10,160 --> 00:06:14,840
let's say Chinese intrusion sets or whatever intrusion set, you know, coming from the Pentagon,

81
00:06:14,960 --> 00:06:18,140
they're not going to take the data directly back, right, to headquarters.

82
00:06:18,840 --> 00:06:24,200
But it's going to go to Maryland, or go to Virginia, go to Canada first, right?

83
00:06:25,060 --> 00:06:28,820
Cyberspace, there's only one cyberspace and only one internet, right?

84
00:06:28,880 --> 00:06:31,240
And we're all in the same space together.

85
00:06:31,600 --> 00:06:36,140
So, that gives attackers all kinds of possibilities because, I don't know if I have it in this presentation,

86
00:06:36,360 --> 00:06:40,880
but I have a slide, basically, of all the C2 comms over about a six-month period.

87
00:06:41,520 --> 00:06:44,180
And there's connections between any two countries on the planet.

88
00:06:44,340 --> 00:06:48,640
So, what does that mean if you're a really smart hacker, you can route it a different way every time?

89
00:06:48,640 --> 00:06:54,360
Right, buried fiber, like in Iraq, this gave NSA for a long time, you know, all kinds of headaches, you know.

90
00:06:54,420 --> 00:06:59,500
You digitize communications, you put them underground, very hard to find it.

91
00:06:59,880 --> 00:07:07,100
Now, one of the only ways really to get around, theoretically, traffic analysis is by continuous ciphertext.

92
00:07:07,420 --> 00:07:15,860
So, just, you know, encrypt everything to the nth degree and then fire it 24-7, 365, at full volume.

93
00:07:16,240 --> 00:07:18,620
And why is that the only way to get around traffic?

94
00:07:18,620 --> 00:07:27,600
It's because then somebody can't do timing attacks, frequency attacks, size attacks against your traffic, right?

95
00:07:27,720 --> 00:07:29,860
And failing all else, there's human courier.

96
00:07:30,020 --> 00:07:32,300
But then again, that's the silence problem, right?

97
00:07:32,440 --> 00:07:38,060
So, in Abbottabad, Pakistan, you know, when the CIA is trying to find Osama bin Laden,

98
00:07:38,220 --> 00:07:43,840
and that huge house on the corner has no telephone, no internet communications.

99
00:07:43,860 --> 00:07:45,160
Well, guess what?

100
00:07:45,260 --> 00:07:48,600
Silence is, in and of itself, a huge red flag.

101
00:07:48,620 --> 00:07:49,260
Right?

102
00:07:49,580 --> 00:07:51,580
If you're on the hunt for someone.

103
00:07:52,800 --> 00:07:58,480
So, if you work for a big company, you probably also have a picture like this of the world.

104
00:07:58,740 --> 00:08:03,400
You know, this is malware detections for the past few months that I've been looking at.

105
00:08:03,480 --> 00:08:06,380
And I really enjoy it because the company I work at now, we've got,

106
00:08:06,480 --> 00:08:09,180
we actually have clients in every country on the planet,

107
00:08:09,240 --> 00:08:12,440
because you can download and use software for free, security software.

108
00:08:12,620 --> 00:08:13,680
So, what does that mean?

109
00:08:13,760 --> 00:08:17,540
In every little island and in province and city and state,

110
00:08:17,680 --> 00:08:18,480
I get malware.

111
00:08:18,620 --> 00:08:20,040
We are trafficked to analyze.

112
00:08:21,060 --> 00:08:26,500
You know, but all of these, they kind of lie outside your sovereignty and law enforcement jurisdiction.

113
00:08:26,600 --> 00:08:29,440
So, you have to think of some other ways to get at this.

114
00:08:30,780 --> 00:08:36,980
And so, if you plot it as a network, same data, but you plot it as on a network chart,

115
00:08:38,080 --> 00:08:39,460
then you get a different picture.

116
00:08:39,500 --> 00:08:43,700
And again, here you can see, ah, you know, sovereignty and jurisdiction are not so important anymore,

117
00:08:43,840 --> 00:08:47,320
because we're all in the same cyberspace to some degree.

118
00:08:47,320 --> 00:08:53,340
So, the malware analysts at my company, they put things in categories like Trojan, application malware, etc.

119
00:08:53,640 --> 00:08:55,560
And I think more in terms of countries.

120
00:08:55,720 --> 00:09:01,800
So, all these little orange circles around the side are, you know, Netherlands, Iran, Latvia, etc.

121
00:09:02,020 --> 00:09:05,680
You can see where we have most of our detections, Russia, US, Germany, etc.

122
00:09:06,360 --> 00:09:14,700
But what you can see here is that this is truly an international problem that requires an international solution

123
00:09:14,700 --> 00:09:17,300
from a legal point of view.

124
00:09:17,320 --> 00:09:22,480
It's not a legal policy perspective, but as an analyst, you know, you can do a lot with this, too,

125
00:09:22,560 --> 00:09:27,420
by clicking on, you know, your country and your particular malware type.

126
00:09:27,540 --> 00:09:31,260
And all of a sudden, you blow it up, and you make it, you simplify the problem.

127
00:09:31,400 --> 00:09:37,700
And here's our top five for the spring malware types, along with the top ten countries for each.

128
00:09:37,980 --> 00:09:43,840
And then you color code them a little bit, and you can see where most of our detections are in Russia and the United States.

129
00:09:44,980 --> 00:09:47,220
And you can work out from there.

130
00:09:47,960 --> 00:09:51,480
So, application is a huge malware category for us.

131
00:09:51,580 --> 00:09:57,240
We have, you know, unwanted application, potentially unwanted application, malicious application, etc.

132
00:09:57,420 --> 00:09:58,540
So, I threw those out.

133
00:09:58,580 --> 00:10:01,640
Just take these four for this particular analysis.

134
00:10:02,600 --> 00:10:07,860
But you can see Trojan is not only the largest, but it's the most complex dataset.

135
00:10:08,160 --> 00:10:12,540
Over the coming year, I really want to do something on analysis of complexity versus simplicity.

136
00:10:13,220 --> 00:10:15,240
And Trojan is a tough one.

137
00:10:15,320 --> 00:10:16,000
Because of the...

138
00:10:16,000 --> 00:10:17,300
It's the, you know, the Swiss Arctic.

139
00:10:17,320 --> 00:10:17,720
It's the army knife.

140
00:10:17,920 --> 00:10:20,860
When you get that code on your system, you know, you can do ransomware.

141
00:10:20,920 --> 00:10:22,700
You can do basically anything.

142
00:10:23,080 --> 00:10:27,460
So, it's the largest, and as you'll see in a second, it's also the most complex.

143
00:10:27,900 --> 00:10:32,820
And it's also, as you'll see, backdoor, I think, is the most valuable category.

144
00:10:33,020 --> 00:10:41,420
So, here, if you sort, for example, and I'll show you a little bit of this, but countries by the ratio of these four malware types,

145
00:10:41,880 --> 00:10:46,300
according to the ratio within each country, backdoor is...

146
00:10:46,300 --> 00:10:52,020
They're all very rich countries at the highest ratio, and worm is all the very poorest countries.

147
00:10:52,260 --> 00:10:54,380
And I'll show you a little bit of that in a second.

148
00:10:54,600 --> 00:10:58,800
But with these four malware types, I can show you we have every country on the planet.

149
00:10:58,900 --> 00:11:07,140
There's, you know, 190-some-odd countries in the UN, but there's 255 country code top-level domains.

150
00:11:07,540 --> 00:11:09,560
But that's kind of the way I sort them.

151
00:11:09,620 --> 00:11:12,180
And there's a lot of fun ones.

152
00:11:12,180 --> 00:11:16,260
If you like geography, you'll find that there's some little semi-autonomous,

153
00:11:16,300 --> 00:11:22,880
and quasi-independent republics in various places that you can find on the map.

154
00:11:23,840 --> 00:11:26,920
But here's another way to sort your data that's really helpful.

155
00:11:27,020 --> 00:11:29,060
Because here's what I want to say also in this presentation.

156
00:11:29,580 --> 00:11:31,940
You can do anything, I think, with traffic analysis.

157
00:11:32,160 --> 00:11:34,680
You just need to just keep changing your perspective.

158
00:11:35,180 --> 00:11:37,760
Thinking about the attacker's perspective, the defender's perspective.

159
00:11:37,880 --> 00:11:41,640
But also conceptual ideas, like what vertical...

160
00:11:41,640 --> 00:11:44,080
Vertical is kind of a buzzword, but here...

161
00:11:44,080 --> 00:11:46,280
So, you put our clients into...

162
00:11:47,620 --> 00:11:49,100
Particular economic sectors.

163
00:11:49,240 --> 00:11:51,540
Basically, healthcare, education, etc.

164
00:11:51,780 --> 00:11:56,100
And what you'll find is you can fingerprint malware types and families,

165
00:11:56,240 --> 00:11:59,340
threats, threat actors, you know, ever more precisely.

166
00:11:59,740 --> 00:12:01,020
And so you don't have to defend against everything,

167
00:12:01,180 --> 00:12:03,240
but you can defend only against some things.

168
00:12:03,620 --> 00:12:05,920
Now, this is only, obviously, a partial data set,

169
00:12:06,000 --> 00:12:07,500
but I think it's already pretty revealing.

170
00:12:08,300 --> 00:12:10,220
So, for my data, over the past six months,

171
00:12:10,300 --> 00:12:12,960
I've started to put them into malware, you know,

172
00:12:13,400 --> 00:12:15,600
verticals, then malware types, and malware families.

173
00:12:16,300 --> 00:12:18,320
But what you find is if you work out from there,

174
00:12:18,380 --> 00:12:20,000
and you can go the other direction, too,

175
00:12:20,060 --> 00:12:22,700
and that also is interesting, but I only have so much time here.

176
00:12:23,040 --> 00:12:25,140
But, like, online services, for example.

177
00:12:25,260 --> 00:12:29,000
All the ones I've been able to look at so far have been in the worm category.

178
00:12:29,360 --> 00:12:33,340
And then those have been mostly in just two malware families,

179
00:12:33,620 --> 00:12:35,480
Nimda and Runounce, right?

180
00:12:35,540 --> 00:12:37,780
So, very quickly, you say, well, if I do online services,

181
00:12:37,980 --> 00:12:40,040
I better take care of this one, at least start here.

182
00:12:40,740 --> 00:12:43,760
Because, you know, there's quantity and there's quality,

183
00:12:44,100 --> 00:12:45,920
and quality sometimes trumps quantity.

184
00:12:45,920 --> 00:12:52,120
But, as you've probably heard, quantity has a quality all its own, right?

185
00:12:52,220 --> 00:12:56,000
So, you have to deal with the big stuff first, the elephant in the room.

186
00:12:57,480 --> 00:12:57,900
Sorry?

187
00:12:59,300 --> 00:13:01,320
Oh, thank you, yeah, quote from Stalin.

188
00:13:02,280 --> 00:13:05,380
So, I've lived most of the past decade in the former Soviet Union.

189
00:13:05,520 --> 00:13:07,340
So, thank you for sharing that with me.

190
00:13:08,220 --> 00:13:11,580
Here's our African traffic, and the list goes way on down,

191
00:13:11,740 --> 00:13:13,580
because there's like 60-some-odd countries in Africa.

192
00:13:14,160 --> 00:13:15,820
But this is one way you can do it.

193
00:13:15,920 --> 00:13:18,960
So, this is in Kibana, Elastic Stack, but you can use anything.

194
00:13:19,360 --> 00:13:21,400
And I just said, okay, for each of the countries,

195
00:13:21,560 --> 00:13:27,360
I want to see the top spike over the last month or two for this data.

196
00:13:27,680 --> 00:13:30,480
And so, that's really interesting, because you can click on one at a time

197
00:13:30,480 --> 00:13:33,480
and open it up and see what was the spike.

198
00:13:33,740 --> 00:13:35,280
So, where was the outbreak?

199
00:13:35,680 --> 00:13:39,740
Where was the largest amount of infections for a given country?

200
00:13:40,740 --> 00:13:45,040
And then, over time, time is kind of your best friend sometimes as an analyst, too,

201
00:13:45,920 --> 00:13:50,020
because you can see, you know, it happened on Christmas or New Year's or Valentine's Day

202
00:13:50,020 --> 00:13:52,440
or whatever it was, and why is that?

203
00:13:53,040 --> 00:13:55,700
And you can also sort, you know, by time of day.

204
00:13:56,760 --> 00:13:59,240
So, this traffic is from the Middle East.

205
00:13:59,680 --> 00:14:01,980
I took six countries in the Middle East.

206
00:14:02,560 --> 00:14:05,460
And again, so this is kind of like the network perspective.

207
00:14:05,980 --> 00:14:08,980
This is malware detections, okay?

208
00:14:09,120 --> 00:14:10,940
Now, I'm going to drop something else on there.

209
00:14:11,120 --> 00:14:15,780
You can see I dropped, I went back and I said, okay, for each of these countries,

210
00:14:16,480 --> 00:14:19,580
is there something interesting that happened at that time?

211
00:14:19,720 --> 00:14:22,120
And I can't promise you these things are directly related,

212
00:14:22,360 --> 00:14:25,080
but I happen to firmly believe, because I have more of a government background,

213
00:14:25,200 --> 00:14:26,060
so that's the way I think.

214
00:14:26,380 --> 00:14:30,600
But I happen to think that there's a whole lot of nation-state operations going on in cyberspace,

215
00:14:30,640 --> 00:14:32,520
many more than we imagine.

216
00:14:33,200 --> 00:14:38,500
So, in this case, the red on the left is Saudi Arabia detections.

217
00:14:38,500 --> 00:14:41,960
And I looked, and on that day, or right about that day or two,

218
00:14:42,120 --> 00:14:45,880
there was a missile fired from Yemen at Mecca.

219
00:14:46,560 --> 00:14:50,480
In Yemen, on that same day, there was a bomb that killed 48 soldiers.

220
00:14:51,060 --> 00:14:52,640
In Egypt, there was a church bomb.

221
00:14:52,880 --> 00:14:55,060
In Turkey, you probably remember this, which is big in the news.

222
00:14:55,120 --> 00:14:56,620
This is New Year's Day here.

223
00:14:56,960 --> 00:15:00,640
There was a bomb at a discotheque in Istanbul that killed almost 40 people.

224
00:15:01,200 --> 00:15:02,820
That was also the biggest spike.

225
00:15:03,000 --> 00:15:04,940
And then over here, there's a cluster of them.

226
00:15:05,000 --> 00:15:06,260
And I said, well, what happened around here?

227
00:15:06,500 --> 00:15:09,620
And you just go back in Google News to look at what was happening at that time.

228
00:15:09,720 --> 00:15:15,220
And there was a missile, a test in Iran that may have been of interest to all these countries.

229
00:15:15,920 --> 00:15:19,820
May or may not be related directly, but here's the way I put it.

230
00:15:19,860 --> 00:15:24,920
I think a combination of law enforcement, domestic intelligence, foreign intelligence,

231
00:15:25,800 --> 00:15:30,200
hacktivist, loan hacker, cyber criminal, various things, basically.

232
00:15:31,700 --> 00:15:34,860
I think there is a relationship, at least to some degree.

233
00:15:35,280 --> 00:15:38,040
So, I was at a company about five years ago.

234
00:15:38,840 --> 00:15:40,500
Well, only three years ago now.

235
00:15:40,680 --> 00:15:45,800
And I did an 18-month study on malware callbacks.

236
00:15:45,920 --> 00:15:47,160
And here's what I said.

237
00:15:47,220 --> 00:15:48,580
Okay, there's a to and a from.

238
00:15:48,720 --> 00:15:53,660
And I think the to, the person receiving the callback, is going to get greater weight.

239
00:15:53,860 --> 00:15:54,300
Right?

240
00:15:54,380 --> 00:15:55,280
So, let me see.

241
00:15:55,520 --> 00:15:59,160
The malware callbacks to a particular country, I'm just going to plot them all.

242
00:15:59,260 --> 00:16:02,840
And I had 30 million rows of data over an 18-month period.

243
00:16:03,220 --> 00:16:04,960
I'm not sure quite how many are on this screen.

244
00:16:05,040 --> 00:16:05,380
Maybe 18.

245
00:16:06,160 --> 00:16:10,780
But the yellow column on the right is March 2014.

246
00:16:11,240 --> 00:16:15,900
And March 2014 was a very critical month, I think, in geography.

247
00:16:15,920 --> 00:16:16,260
Politics.

248
00:16:16,440 --> 00:16:19,400
I presented this at Black Hat 2014.

249
00:16:20,980 --> 00:16:30,920
And so, in March of that year, Russia annexed Crimea and had troops on the border.

250
00:16:31,440 --> 00:16:37,080
Gazprom, the big Russian company, was threatening an oil shutoff to Ukraine.

251
00:16:37,380 --> 00:16:40,420
The West was threatening sanctions against Russia.

252
00:16:40,660 --> 00:16:45,380
And so, my own belief is that, basically, cyberspace is just a reflection of traditional

253
00:16:45,380 --> 00:16:46,140
human affairs.

254
00:16:46,260 --> 00:16:52,920
You'll never find an election or a military invasion that is not reflected in network

255
00:16:52,920 --> 00:16:58,800
traffic and also in your malware data, right, if you happen to be within that sort of geopolitical

256
00:16:58,800 --> 00:16:59,280
fault line.

257
00:16:59,480 --> 00:17:04,860
So, here, you can see the blue is callbacks to Ukraine from anywhere in the world.

258
00:17:05,560 --> 00:17:09,100
Red is callbacks to Russia from anywhere in the world.

259
00:17:09,200 --> 00:17:13,660
And the Russian is not so clear, because I think, as you'll see in a second, Russia is

260
00:17:13,660 --> 00:17:14,640
riddled with malware.

261
00:17:14,880 --> 00:17:15,360
There's nothing.

262
00:17:15,360 --> 00:17:16,320
A lot of other countries are, too.

263
00:17:17,120 --> 00:17:19,800
But the single highest amount...

264
00:17:19,800 --> 00:17:26,600
See, this is the month, the yellow, of the peak tension, international tension.

265
00:17:26,900 --> 00:17:32,520
And you can see Ukraine, basically, rising up in the data to that particular point.

266
00:17:34,500 --> 00:17:39,260
And so, anyway, I think it's pretty clear, even eyeballing it.

267
00:17:39,320 --> 00:17:44,060
I'm not Alan Turing, but even just looking at the...

268
00:17:44,840 --> 00:17:46,340
At the data, you can tell.

269
00:17:47,500 --> 00:17:51,680
So, in the data I'm looking at for the last few months, I'm also...

270
00:17:51,680 --> 00:17:54,640
I'll show you a couple of ways that I'm trying to analyze it.

271
00:17:54,840 --> 00:17:57,680
And this is this spring.

272
00:17:57,880 --> 00:17:59,200
This is April, May, and June.

273
00:17:59,460 --> 00:18:03,720
And basically, these four malware categories I was showing you earlier, there's just wild

274
00:18:03,720 --> 00:18:05,040
swings in them.

275
00:18:05,100 --> 00:18:06,440
And this is global data.

276
00:18:08,820 --> 00:18:13,620
There's about a billion rows of data and about 50 million that have been tagged by our malware

277
00:18:13,620 --> 00:18:14,040
analysts.

278
00:18:15,300 --> 00:18:21,260
And so, you can see that there's a huge outbreak of worm and then tapers off.

279
00:18:21,700 --> 00:18:26,420
And people figure out the exploits and vulnerabilities and shut them off.

280
00:18:26,780 --> 00:18:31,780
And say, virus going back to the number one or the number two at the end of the category.

281
00:18:32,200 --> 00:18:37,760
Trojans are maintaining pretty solid number one overall and less with virus.

282
00:18:37,980 --> 00:18:40,520
You can also say, where do these infections take place?

283
00:18:40,880 --> 00:18:43,180
And so, you go by country code here.

284
00:18:43,280 --> 00:18:44,040
And then, also, you can say, where do these infections take place?

285
00:18:44,040 --> 00:18:47,940
And you can see where those worm infections largely were in the Philippines and Indonesia

286
00:18:47,940 --> 00:18:50,180
on the left, right?

287
00:18:50,280 --> 00:18:56,540
And that gets less as other countries then take that room.

288
00:18:56,900 --> 00:18:59,780
But Russia there in the middle is the third country.

289
00:19:00,400 --> 00:19:01,720
And you can see big spikes.

290
00:19:01,940 --> 00:19:03,400
May 29th.

291
00:19:03,400 --> 00:19:08,020
I don't know, but what happened on May 29th, if you're a Russia analyst, you may be able

292
00:19:08,020 --> 00:19:13,980
to associate that with legislation, with international tensions.

293
00:19:13,980 --> 00:19:19,120
With domestic politics, you know, it could just be pure cyber crime.

294
00:19:19,300 --> 00:19:23,700
But then again, I'm not always sure there's such a thing as pure cyber crime that has

295
00:19:23,700 --> 00:19:27,300
no connection to what's happening in politics.

296
00:19:27,700 --> 00:19:32,020
But here you can see, and ideally you want to be able to open these up, right?

297
00:19:32,120 --> 00:19:33,820
And look inside them.

298
00:19:34,020 --> 00:19:39,820
So here, I plot a Trojan worm virus in back door on this tree map.

299
00:19:40,080 --> 00:19:43,020
And so you can see by country code the top.

300
00:19:43,100 --> 00:19:43,960
And we'll just look at the top.

301
00:19:43,980 --> 00:19:47,400
This is a short presentation, so we'll just look at the number ones of anything.

302
00:19:48,080 --> 00:19:54,080
But if we highlight the number one country for each malware type, I think you'll be able

303
00:19:54,080 --> 00:19:55,580
to see something that's very interesting.

304
00:19:56,760 --> 00:19:59,260
The US has a particular problem with Trojans.

305
00:19:59,500 --> 00:20:07,580
But you can see that Trojans have, they've occupied, so if you say, what is the relative

306
00:20:07,580 --> 00:20:12,300
ratio between countries, you'll see that the United States scores varies low on worm

307
00:20:12,300 --> 00:20:13,060
and virus.

308
00:20:13,160 --> 00:20:13,960
But top.

309
00:20:13,960 --> 00:20:14,580
Top on Trojan.

310
00:20:14,620 --> 00:20:21,900
So I think it's a higher value, higher return on investment, more targeted operation in

311
00:20:21,900 --> 00:20:22,580
cyberspace.

312
00:20:22,780 --> 00:20:25,040
Here you can see worm, the Philippines.

313
00:20:25,240 --> 00:20:30,840
But the Philippines, they drop way down on Trojan, further down on virus, and not, at

314
00:20:30,840 --> 00:20:33,640
least in this short bit, top on back door.

315
00:20:34,140 --> 00:20:41,340
But it's, a worm is a lower category of cyber attack.

316
00:20:41,600 --> 00:20:43,940
It's going after the low-hanging fruit.

317
00:20:43,960 --> 00:20:49,400
In cyberspace, unpatched, unmanaged, unlicensed, the easy pickings, right?

318
00:20:50,900 --> 00:20:51,980
So here, virus.

319
00:20:52,380 --> 00:20:57,480
Russia, even though Russia is well known for kind of being an aggressive player in cyberspace,

320
00:20:57,560 --> 00:21:01,820
you can see that they have all kinds of trouble on their networks.

321
00:21:02,040 --> 00:21:02,960
There's no doubt about that.

322
00:21:03,040 --> 00:21:08,260
It's number two on Trojan, number two on worm, and number one on virus.

323
00:21:08,360 --> 00:21:10,500
So really enough said, I think.

324
00:21:10,700 --> 00:21:13,720
And if you look at Poland, which came in number one on back door,

325
00:21:13,960 --> 00:21:15,440
they're a little bit less on the others.

326
00:21:15,620 --> 00:21:21,820
But the fact that it comes in number one in our very strategic data set in terms of back

327
00:21:21,820 --> 00:21:23,200
door is something they should look at.

328
00:21:23,580 --> 00:21:24,760
These are families.

329
00:21:24,980 --> 00:21:31,240
So once you get into the particular families of each malware type, then you can get more

330
00:21:31,240 --> 00:21:32,400
precise, right?

331
00:21:32,500 --> 00:21:37,100
Whether you're on offense or defense, because those are kind of one in the same, in a sense.

332
00:21:37,680 --> 00:21:43,140
So here, you can see the US occupying, again, a very high ratio.

333
00:21:43,960 --> 00:21:45,960
Of the detections here.

334
00:21:46,500 --> 00:21:48,600
This is a virus.

335
00:21:48,720 --> 00:21:51,260
You can see Russia, Russia, Russia here.

336
00:21:51,740 --> 00:21:53,460
It's a lower.

337
00:21:53,620 --> 00:21:59,340
In the worm category, you can see Philippines, Indonesia, but also Russia, Russia, Russia,

338
00:21:59,540 --> 00:21:59,900
right?

339
00:22:00,040 --> 00:22:01,200
So this is very important.

340
00:22:01,400 --> 00:22:04,020
I think these networks have a lot of work to do.

341
00:22:04,180 --> 00:22:07,300
You can see Dark Comet here is our top back door.

342
00:22:07,440 --> 00:22:11,580
Also, the previous company I was at, also the top back door was Dark Comet.

343
00:22:11,680 --> 00:22:13,060
But you can see that this is a higher

344
00:22:13,960 --> 00:22:16,940
value, higher return on investment data set.

345
00:22:17,240 --> 00:22:20,380
Poland, Singapore, US, Great Britain, Great Britain, India.

346
00:22:21,200 --> 00:22:26,320
And if you look at it here, you can see, if you just start with back door, you can see

347
00:22:26,320 --> 00:22:30,080
Australia, Great Britain, Japan, the top countries.

348
00:22:30,600 --> 00:22:33,200
Trojan, you look at the top ones here.

349
00:22:33,260 --> 00:22:37,020
This is by ratio, US, Great Britain, Australia.

350
00:22:37,460 --> 00:22:41,240
And worm, I'll just skip down to the bottom, South Africa and Russia.

351
00:22:41,340 --> 00:22:42,300
You can see it pretty clearly.

352
00:22:42,380 --> 00:22:43,940
And you can sort of plot it off.

353
00:22:43,940 --> 00:22:44,420
It's on a map.

354
00:22:44,500 --> 00:22:47,360
And again, basically, this is strategic traffic analysis.

355
00:22:47,600 --> 00:22:53,320
But I think it applies in a smaller micro context, too, within your office, your home,

356
00:22:53,540 --> 00:22:57,740
your enterprise, your vertical in your country, within countries.

357
00:22:57,840 --> 00:23:03,700
But you can see globally, if you plot the top malware types by color on the screen,

358
00:23:03,780 --> 00:23:05,340
you'll see that there are patterns.

359
00:23:06,840 --> 00:23:08,880
I'm approaching the end of my time.

360
00:23:09,000 --> 00:23:13,360
But you can see here, the most people with the most money, with the most malware, in

361
00:23:13,360 --> 00:23:15,620
the United States, basically, on this graph.

362
00:23:15,920 --> 00:23:18,940
And here, also, this further sort of strengthens my argument.

363
00:23:19,160 --> 00:23:22,320
Worm, you can see, the bubble size is per capita income.

364
00:23:22,800 --> 00:23:27,420
And as you go higher ratio worm, these are smaller economies.

365
00:23:27,740 --> 00:23:30,340
Higher ratio back door, larger economies.

366
00:23:32,040 --> 00:23:34,300
Ransomware, here you can look at it by month.

367
00:23:34,380 --> 00:23:38,660
And you can see the United States crawling through the data at the beginning of the year.

368
00:23:38,740 --> 00:23:40,720
This is January, February, March, April, and May.

369
00:23:40,840 --> 00:23:42,820
You can see Russia, Russia, Iran.

370
00:23:43,860 --> 00:23:45,020
Poland, the US.

371
00:23:45,300 --> 00:23:48,060
And my theory here is that they're practicing malware.

372
00:23:48,200 --> 00:23:49,420
They're experimenting with it.

373
00:23:49,460 --> 00:23:53,900
And they're working it out into the richer economies with practice.

374
00:23:54,200 --> 00:23:55,280
So thank you very much.

375
00:23:55,380 --> 00:23:56,080
I'm out of time.

376
00:23:56,180 --> 00:23:57,940
But I appreciate your time and attention.

377
00:23:58,200 --> 00:23:58,520
So thank you.

378
00:23:58,540 --> 00:24:00,040
If you have any questions, feel free to send me an email.