![Page 1: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/1.jpg)
Technology DeathmatchThe arms race is onSean M. Bodmer, CEH, CISSP, NCIA
Chief ResearcherCounter-Exploitation Intelligence
CounterTack
![Page 2: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/2.jpg)
Who is this tool? Sean M. Bodmer, CISSP, CEH, NCIA
Arrested @16 years of age for hacking NASA and 3 other .gov networks Yes, it did put a damper on my life for a few years
>50% of my time spent in non-gov’t based clandestine cyber operations 2012 – Helped US Entities seize and recuperate > $6M USD
Brief Bio Over 16 Years in IT Systems Security Over 10 Years in Intelligence and Counter-Intelligence Operations Lectured at numerous Industry Conferences Co-Authored 2 Books w/McGraw-Hill (writing 2 more) Quoted and Named in > 400
Magazines, newspapers, radio, and tv-news CounterTack, Inc.
Focused on in-progress detection and attribution of threats Develops and deploys custom high-interaction honeypots Provides customers tailored Threat Intelligence Services
Knowledge Bridge Intelligence, Inc US IO Subject Matter Expert
![Page 3: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/3.jpg)
04/10/2023 3
![Page 4: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/4.jpg)
There is more than oneDistribution/Delivery (MAS)
• Specialized distribution network• Attracts and infects victims• Global & targeted content delivery• Delivery through Spam/drive-by/USB/etc.• Offers 24x7 support
Author(s)• Original malware creator(s)• Offer malware “off-the-rack”
or custom built• May offer DIY construction kits• Money-back guarantee if detected• 24x7 support
Leader• Individual or criminal team • Maintains and controls order• Holds admin credentials
Operator• Operates a section • Issues commands• May be the leader
Resilience/Recovery (MAS)
• Provides C&C resilience services• Anti-takedown network construction• Bullet-proof domain hosting• Fast-flux DNS services• Offers 24x7 Support
![Page 6: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/6.jpg)
![Page 7: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/7.jpg)
Cloud as a Service Model• YES, criminals are mirroring our e-biz models
![Page 8: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/8.jpg)
Malware As A Service
![Page 9: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/9.jpg)
Malware As A Service
![Page 10: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/10.jpg)
Malware As A Service
![Page 11: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/11.jpg)
Malware As A Service
![Page 13: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/13.jpg)
Host/End-point
![Page 14: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/14.jpg)
Host/End-point
![Page 15: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/15.jpg)
The Arbitrary Icon
THIS DOES NOT MEAN YOU ARE SAFE !!!
![Page 16: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/16.jpg)
![Page 17: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/17.jpg)
Today’s Problem Set
• Almost all discoveries are post-mortem – Next day or countless days later
• Generally, through laborious manual analysis
• Easily detectable over time– Static defenses can be identified by skilled adversaries
• Difficult to use– Heavily dependent on human expertise– Staging and maintaining honeynets– Manual reporting and analysis– Manual correlation between data sources
![Page 18: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/18.jpg)
![Page 19: TakeDownCon Rocket City: Technology Deathmatch, The arms race is on by Sean Bodmer](https://reader038.vdocuments.us/reader038/viewer/2022110303/54b883414a7959c1078b458a/html5/thumbnails/19.jpg)
Let’s Look @ Something
• What can one find when p0wning bad-actors?
Carberp Source Code Leak