using disposable mailboxes for research
TRANSCRIPT
![Page 1: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/1.jpg)
1
Brad Antoniewicz
Disposable Mailboxes for Research!
Cisco Umbrella, formally OpenDNS
![Page 2: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/2.jpg)
2
Hi, I’m @brad_anton
![Page 3: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/3.jpg)
3 3© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
40%Businesses affected
in the last year
$1BGross Revenue in
2016
128%Growth in new
samples
Ransomware SucksCommodity malware distracts researchers from cooler stuff
![Page 4: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/4.jpg)
4
Email Distribution
To: Brad Antoniewicz <[email protected]>From: Barbara Almond <[email protected]>Received: from mail.mailexpress.com …
Subject: Invoice #0299301Attachment: invoice01.zip
Body: Brad,Attached is the invoice you requested.
Thanks,Barbara
Domain AnalysisPattern Analysis
Natural Language Website Crawling
@brad_anton
![Page 5: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/5.jpg)
5
Not good for research
![Page 6: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/6.jpg)
6
![Page 7: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/7.jpg)
7
MailRunnerIdentifying ransomware and commodity malware
Bait MailboxesBlock
Dewey Classification
Engine
@brad_anton
Convict, then pass on email attributes
![Page 8: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/8.jpg)
8
![Page 9: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/9.jpg)
9
Architecture
Fetch, Process, and Store
Check and Categorize
Sandbox
Analyzer
Block
![Page 10: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/10.jpg)
10
Detections(One mailbox)
7.4k Malicious Emails15k Unique Domains
@brad_anton
![Page 11: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/11.jpg)
11
![Page 12: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/12.jpg)
12@brad_anton
![Page 13: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/13.jpg)
13
![Page 14: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/14.jpg)
14
![Page 15: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/15.jpg)
15@brad_anton
![Page 16: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/16.jpg)
1616
Takeaways1. Commodity malware ruins it2. Disposable mailboxes FTW3. LacedMail.com4. MailRunner opensource soon!
![Page 17: Using Disposable Mailboxes for Research](https://reader035.vdocuments.us/reader035/viewer/2022070512/589aa7281a28abfc1a8b6661/html5/thumbnails/17.jpg)
1717© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Thanks!-@brad_anton