CS 259D 内部威胁

作者:Leo

  • 案例
  • 两类攻击者
  • 启发
  • 内部攻击
    • 攻击的形式
    • 内部攻击的特点
  • 检测方法
  • 参考资料

尽管每年都有些不同,但内部的事故和外部的总是差不多。不过,得到的教训却很简单:机构必须预防来自各个方面的攻击。

CSI/FBI 计算机犯罪与安全调查 2005

案例

  • 希腊沃达丰公司
    • 有针对性地监听100多名高级官员
      • 希腊总理和他的妻子
      • 部长大人们:国防,外交,司法
      • 希腊欧盟专员
      • 雅典市长
    • 08年8月之前就已经开始,一直持续到05年3月
    • 由于 rootkit 更新失误而意外被检测到
    • 追查到沃达丰的内部人士
    • 沃达丰被处以7600万美元罚金
  • 爱德华·斯诺登

两类攻击者

  • 背叛者
    • 一个有访问权限的合法用户可以干坏事
    • 对内部体系和安全政策有充分地了解
  • 伪装者
    • 一个窃取/占用合法用户凭证的攻击者

启发

  • 攻击者和普通用户的行为表现会有所差异
  • “行为表现”是无法被盗用的东西
  • 当背叛者做坏事时,行为会偏离正常的表现
    • 既使攻击者模拟成正常用户,也会在攻击的时刻暴露出来

内部攻击

攻击的形式

  • 未经授权提取,复制或泄露数据
  • 篡改数据(未经授权更改数据或记录)
  • 销毁和删除关键资产
  • 从未经授权的来源下载或使用可能包含后门或恶意代码的盗版软件
  • 窃听和嗅数据包探
  • 欺骗和冒充其他用户
  • 社会工程学攻击
  • 滥用资源以此进行与业务无关或未经授权的活动
  • 别有目的地安装恶意软件

内部攻击的特点

  • 大多数事故的技术门槛要求低
  • 行动是有计划的
  • 动机是经济利益
  • 犯罪行为发生在工作期间
  • 事故通常是由非安全人员发现
  • 事故通常是通过手动程序检测到

检测方法

  • Shell 命令序列 (CLI)
  • 系统调用
  • 数据库/文件访问
  • 系统日志
  • 网络请求
  • 键盘/鼠标动态信息
  • 蜜罐
伪装者 背叛者
一类/两类分类器:Unix 命令序列 高 – 不熟悉本地系统环境和用户行为 中 – 可以模仿另一个普通用户或有目的的训练分类器
Unix 审计事件 中 – 给予适当的认证证书,可能不会触发警报 低 – 应用级别的恶意行为可能不会显示为异常事件
Unix 系统调用 中 – 可能不违反系统调用配置文件 低 – 应用级别的恶意行为可能不会显示为异常事件
窗口使用事件 中 – 给予适当的认证证书,可能不会触发警报 低 – 应用级别的恶意行为可能不会显示为异常事件
Windows 注册表访问 中 – 除非恶意程序访问注册表 中 – 除非恶意程序访问注册表
网络活动审计 中 – 如果攻击使用网络并且可以归因 高 – 如果攻击使用网络并且可以归因
蜜罐和诱饵技术 高 – 不熟悉本地信息,可能与蜜罐交互 中 – 如果知道蜜罐位置,则不太可能与其交互

参考资料

  • The Athens Affair
  • Insider Attack and Cyber Security: Beyond the Hacker, chapter “A Survey of Insider Attack Detection Research”
  • CS 259D Lecture 3

“CS 259D 内部威胁”的110个回复

  1. I just want to say I’m newbie to weblog and certainly savored this web blog. Almost certainly I’m planning to bookmark your blog post . You amazingly have impressive articles and reviews. With thanks for revealing your blog.

  2. My personal sis recommended me personally about your own internet website and exactly how excellent it really is. She’s correct, I’m really impressed with the writing and clever design. It appears in my experience you are merely itching the surface when it comes to what you might achieve, nevertheless you’re on a good begin!

  3. Every weekend i used to visitgo to seepay a visitpay a quick visit this websiteweb sitesiteweb page, becauseasfor the reason that i wantwish for enjoyment, sinceasfor the reason that this this websiteweb sitesiteweb page conations reallyactuallyin facttrulygenuinely nicepleasantgoodfastidious funny stuffinformationdatamaterial too.

  4. Awesome post. I’m a regular visitor of your blog and appreciate you taking the time to maintain the nice site. I’ll be a frequent visitor for a really long time.

  5. My only minor complaint is that the edges might be a little bit “stronger”. There’s an opportunity you might roll off if you get too close to the edge.

  6. I’ve been surfing online greater than 3 hours as of late, but I never found any fascinating article like yours. It¡¦s pretty value enough for me. In my opinion, if all website owners and bloggers made excellent content as you did, the net shall be a lot more helpful than ever before.

  7. I truly enjoy studying on this internet site, it holds great posts. “A short saying oft contains much wisdom.” by Sophocles.

  8. Hands down, Apple’s app store wins by a mile. It’s a huge selection of all sorts of apps vs a rather sad selection of a handful for Zune. Microsoft has plans, especially in the realm of games, but I’m not sure I’d want to bet on the future if this aspect is important to you. The iPod is a much better choice in that case.

  9. I’m also writing to make you be aware of what a magnificent encounter our daughter found reading the blog. She picked up numerous things, which included what it is like to have an awesome teaching style to let men and women very easily thoroughly grasp some impossible matters. You undoubtedly did more than visitors’ expected results. Thank you for distributing these essential, trusted, informative and in addition fun guidance on the topic to Jane.

  10. Thank you, I have recently been searching for info about this subject for a while and yours is the greatest I’ve came upon so far. However, what in regards to the conclusion? Are you positive concerning the supply?

  11. RETS PRO reviews and information are typically attainable within our message boards. RETS PRO serves a community of developers and real estate teams who require the ultimate flexibility throughout their IDX output. RETSPRO rets plugin is the most effective software package for any real estate website developer. RETSPRO was built specifically for web developers to provide them with the various tools to truly customize a website used for real-estate clients.

  12. Faytech North America is a touch screen Manufacturer of both monitors and pcs. They specialize in the design, development, manufacturing and marketing of Capacitive touch screen, Resistive touch screen, Industrial touch screen, IP65 touch screen, touchscreen monitors and integrated touchscreen PCs. Contact them at http://www.faytech.us, 121 Varick Street, New York, NY 10013, +1 646 205 3214

  13. Its like you read my mind! You seem to know so much about this, like you wrote the book in it or something. I think that you could do with a few pics to drive the message home a little bit, but instead of that, this is fantastic blog. A fantastic read. I’ll certainly be back.

  14. MetroClick specializes in building completely interactive products like Photo Booth for rental or sale, Touch Screen Kiosks, Large Touch Screen Displays , Monitors, Digital Signages and experiences. With our own hardware production facility and in-house software development teams, we are able to achieve the highest level of customization and versatility for Photo Booths, Touch Screen Kiosks, Touch Screen Monitors and Digital Signage. Visit MetroClick at http://www.metroclick.com/ or , 121 Varick St, New York, NY 10013, +1 646-843-0888

  15. I needed to put you that little word just to thank you over again for your personal magnificent guidelines you have documented at this time. It is so tremendously open-handed of people like you to grant without restraint exactly what many of us could have offered for sale as an electronic book to get some bucks for themselves, mostly considering that you could possibly have tried it if you ever decided. Those tricks as well worked as a great way to recognize that some people have similar fervor just as my very own to understand very much more around this condition. I’m sure there are numerous more pleasant instances ahead for individuals that see your blog post.

  16. I have been exploring for a bit for any high-quality articles or blog posts on this sort of area . Exploring in Yahoo I ultimately stumbled upon this site. Studying this info So i¡¦m happy to convey that I have an incredibly good uncanny feeling I came upon just what I needed. I so much indisputably will make certain to do not forget this web site and provides it a glance on a constant basis.

  17. RETS PRO ripoffs have been all over online, mainly available as nulled/old copies of our RETS PRO plugin. There is only one legitimate place to buy our software and that is on our own RETSPRO website.

  18. I am also writing to let you be aware of of the fabulous encounter my cousin’s princess went through going through the blog. She figured out a good number of issues, which included how it is like to possess a very effective teaching style to make the rest easily have an understanding of some hard to do things. You really surpassed my expectations. Thanks for churning out such helpful, healthy, informative and unique thoughts on the topic to Lizeth.

  19. I’m not sure where you’re getting your info, but good topic. I needs to spend some time learning much more or understanding more. Thanks for great info I was looking for this information for my mission.

  20. I got what you intend, thankyou for putting up.Woh I am thankful to find this website through google. “Wisdom doesn’t necessarily come with age. Sometimes age just shows up by itself.” by Woodrow Wilson.

  21. Nice read, I just passed this onto a colleague who was doing some research on that. And he just bought me lunch because I found it for him smile Thus let me rephrase that: Thank you for lunch! “We have two ears and one mouth so that we can listen twice as much as we speak.” by Epictetus.

  22. I do not know if it’s just me or if perhaps everyone else encountering issues with yourwebsite. It seems like some of the written text within your postsare running off the screen. Can someone else please comment and let me know ifthis is happening to them as well? This might be aissue with my browser because I’ve had this happen previously.Appreciate it

  23. I have been surfing online more than 3 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my opinion, if all web owners and bloggers made good content as you did, the internet will be much more useful than ever before.

  24. I am really impressed with your writing skills as well as with the layout on your weblog. Is this a paid theme or did you modify it yourself? Either way keep up the excellent quality writing, it is rare to see a great blog like this one nowadays..

  25. I wish to express my respect for your kind-heartedness for those people who should have assistance with the question. Your real dedication to getting the solution all around had become pretty practical and have continually allowed folks much like me to realize their targets. This useful key points implies a whole lot to me and still more to my peers. Warm regards; from each one of us.

  26. Pretty nice post. I just stumbled upon your blog and wished to say that I have really enjoyed surfing around your blog posts. In any case I will be subscribing to your rss feed and I hope you write again very soon!

  27. Hello, Neat post. There is an issue together with your site in web explorer, could test this… IE nonetheless is the market leader and a good element of people will miss your fantastic writing due to this problem.

  28. Just wish to say your article is as astonishing. The clarity in your post is simply great and i could assume you are an expert on this subject. Fine with your permission allow me to grab your feed to keep up to date with forthcoming post. Thanks a million and please continue the enjoyable work.

  29. Good – I should certainly pronounce, impressed with your website. I had no trouble navigating through all the tabs and related information ended up being truly easy to do to access. I recently found what I hoped for before you know it in the least. Quite unusual. Is likely to appreciate it for those who add forums or something, website theme . a tones way for your customer to communicate. Nice task.

  30. You really make it seem so easy with your presentation but I find this matter to be really something which I think I would never understand. It seems too complicated and extremely broad for me. I’m looking forward for your next post, I will try to get the hang of it!

  31. Somebody necessarily lend a hand to make severely articles I might state. This is the first time I frequented your website page and up to now? I amazed with the research you made to create this actual submit amazing. Fantastic job!

  32. Hello my family member! I want to say that this post is awesome, great written and come with approximately all vital infos. I would like to peer extra posts like this .

  33. Thank you for another magnificent post. Where else could anybody get that type of info in such a perfect way of writing? I’ve a presentation subsequent week, and I’m on the search for such info.

  34. I just could not leave your website before suggesting that I really loved the standard info an individual provide to your visitors? Is gonna be back regularly in order to investigate cross-check new posts

  35. Hey, you used to write excellent, but the last few posts have been kinda boring… I miss your great writings. Past few posts are just a bit out of track! come on!

  36. What i do not realize is if truth be told how you’re no longer really much more smartly-favored than you may be right now. You are very intelligent. You realize therefore significantly when it comes to this topic, produced me in my view imagine it from a lot of numerous angles. Its like men and women aren’t fascinated unless it¡¦s something to do with Girl gaga! Your individual stuffs nice. Always take care of it up!

  37. I’mI am not sure where you areyou’re getting your infoinformation, but goodgreat topic. I needs to spend some time learning moremuch more or understanding more. Thanks for greatwonderfulfantasticmagnificentexcellent informationinfo I was looking for this informationinfo for my mission.

  38. I needed to create you the very small word just to thank you very much again just for the beautiful solutions you’ve discussed here. It has been shockingly generous with you to provide easily precisely what many of us would have offered for sale for an electronic book in order to make some cash for their own end, most importantly now that you might well have tried it if you ever decided. Those concepts likewise served as the great way to recognize that other individuals have similar keenness much like my own to know the truth good deal more in terms of this condition. I am sure there are many more pleasurable opportunities in the future for individuals that discover your blog.

  39. I’m just writing to make you understand of the helpful encounter our child enjoyed reading through your site. She noticed lots of details, which include what it is like to possess a great helping style to make folks really easily have an understanding of certain specialized matters. You actually surpassed my desires. I appreciate you for distributing these powerful, dependable, explanatory and in addition easy tips about that topic to Mary.

  40. I loved as much as you’ll receive carried out right here. The sketch is attractive, your authored material stylish. nonetheless, you command get got an nervousness over that you wish be delivering the following. unwell unquestionably come more formerly again since exactly the same nearly very often inside case you shield this hike.

  41. It is the best time to make some plans for the future and it’s time to be happy. I’ve read this post and if I could I want to suggest you some interesting things or advice. Perhaps you can write next articles referring to this article. I wish to read even more things about it!

  42. NiceExcellentGreat blogweblog hereright here! AlsoAdditionally your websitesiteweb site a lotlotsso muchquite a bitrather a lotloads up fastvery fast! What hostweb host are you the use ofusingthe usage of? Can I am gettingI get your associateaffiliate linkhyperlink for youron yourin yourto your host? I desirewantwish my websitesiteweb site loaded up as fastquickly as yours lol

  43. I just could not go away your website before suggesting that I really enjoyed the usual information an individual supply for your visitors? Is gonna be again incessantly to check out new posts.

  44. A person essentially assist to make significantly posts I would state. This is the very first time I frequented your web page and thus far? I surprised with the analysis you made to create this particular post incredible. Excellent task!

  45. I would like to thnkx for the efforts you’ve put in writing this blog. I am hoping the same high-grade web site post from you in the upcoming also. Actually your creative writing abilities has inspired me to get my own blog now. Actually the blogging is spreading its wings quickly. Your write up is a great example of it.

  46. My brother recommended I might like this web site. He was totally right. This post actually made my day. You can not imagine simply how much time I had spent for this info! Thanks!

  47. Fantastic goods from you, man. I’ve understand your stuff previous to and you are just extremely wonderful. I really like what you’ve acquired here, really like what you are stating and the way in which you say it. You make it enjoyable and you still care for to keep it smart. I can’t wait to read far more from you. This is really a terrific web site.

  48. I just couldn’t leave your site prior to suggesting that I actually enjoyed the usual info an individual supply to your visitors? Is going to be again steadily in order to investigate cross-check new posts.

  49. I am really impressed with your writing skills as well as with the layout on your weblog. Is this a paid theme or did you modify it yourself? Anyway keep up the excellent quality writing, it is rare to see a nice blog like this one nowadays..

  50. I do consider all the ideas you’ve presented for your post. They are very convincing and can definitely work. Nonetheless, the posts are too quick for newbies. Could you please extend them a bit from subsequent time? Thanks for the post.

  51. I simply wished to say thanks once more. I am not sure what I could possibly have accomplished in the absence of these opinions documented by you concerning my theme. Previously it was an absolute traumatic issue in my position, however , viewing a expert tactic you dealt with the issue took me to leap over fulfillment. Now i am thankful for the advice and even wish you find out what a great job that you are carrying out educating most people through your web site. More than likely you have never encountered all of us.

  52. What i do not realize is in truth how you’re now not really a lot more well-favored than you might be now. You’re very intelligent. You realize thus considerably in the case of this matter, made me personally believe it from a lot of various angles. Its like women and men aren’t fascinated except it is something to accomplish with Girl gaga! Your individual stuffs great. At all times maintain it up!

  53. ThanksAppreciationThankfulness to my father who toldinformedshared withstated to me regardingconcerningabouton the topic of this blogweblogwebpagewebsiteweb site, this blogweblogwebpagewebsiteweb site is reallyactuallyin facttrulygenuinely awesomeremarkableamazing.

发表评论

电子邮件地址不会被公开。 必填项已用*标注