today's a todos good afternoon everybody
today we will talk about
dual-stack that means ipv6 if someone
doesn't know what it might be Vince X
will check it out in Wikipedia and start
reading when we start talking today
first feed of intelligence or thirds in
ipv6 and ipv4 some some of you may say
well it's not this bad as all that
ipv6 who is using it I don't have it at
home so if I don't have have it at home
the people who usually malware maybe
they don't have it either what people
use this hashtag in eternally in their
mind at least but it's not no long
abandoned because part of the man were
are already been implemented in ipv6
this proxy unused edits EverBank trojan
implements pv6 and also advertises it in
its capabilities to propagate to bank
trojans and to send information to the
bad guys if the end of malware is
implement in ipv6 there is not so in
current sealing we have lots of Trojans
that are increasing this collection of
2019 on the screen if we focus on one of
them select run on the details we have
already found information on this Trojan
which is in dual stack this Trojan has
compromised sites command and control
that implement the old stack so it's not
enough to filter things
[Music]
seeing on this and as time goes by we
thought well why don't we start working
on this
why even NIST and other organizations
they spent years publishing documents
warning about the ipv6 about the dual
stack about the necessity of
implementing safety procedures one of
the big problems we have now is we do i
pv 6 is not taken into account and this
is a big problem because some people
don't even know that they have it if you
don't have it you can filter it if you
have it and you don't know how to filter
it there's an additional step that we
try to preempt which is when i have the
tool for filtering do i know what to
filter where's the who's the one who
gives me the IP what do i have to filter
in order to avoid problems so today we
will talk to you about the first iOS you
feed but before that we will tell you
how with the same information you can
also play a little to will find the
threats yes this feel like that we will
present to you today is not only about a
list of IP the domains that are related
to malicious agents we are used to this
information and your feed and with its
domains and IPS what I will show you now
is you can download this information if
you want
[Music]
what we have seen here at the back these
domains here it could be sort of
suspicious with ipv4 address if we look
the old but the reports that these IPS
have opened there are many then I'm
gonna match it seems to be that the
configuration they might have is some
relation between them
so today hunting and analysis it is
important to know which threats are
related to each other basically because
the people in the background could be
the same if we start taking a look at
the ipv6 addresses of these domains we
see that the ipv6 addresses and not easy
to read but there's things in common
could you tell me someone tell me what
they have in common
the prefix you know ipv6 we will talk
about this several times if in addition
we have apart from the prefix which is
accrued in the feed you can see that
this is actually a malware it's just
classified in three levels taxonomy here
we have the prefix this is our SC where
people discuss about the address
assigned to someone who wants to have
ipv6 addressing so it says it is
recommended to assign a bar for th in
general when an ICP requests a range of
ipv4 he gets about 24
with ipv6
this is a bar 48 and a bar 64 is when
you will only need one sort of network
only but in the end never 128 a single
IP one only one device is to be
connected that means that home in my
access to VPS we will get a at least a
bar 64 ipv6 ever has 128 bits which
means that very similar to ipv4 and ASM
autonomous system which is the
distributor of those prefixes so we have
if you subtract 128 64 from 128 so we
will have 2 by 64 times ipv6 addresses
you can a huge amount of IP addresses in
ipv4 but one will have a prefix it is
associated to the site agent an entity
that is being allocated or assigned the
bar 64 so here we have it and this is
what the web looks like it's an open web
and from there you can start downloading
in JSON and CSV and soon in sticks IO
sees that were collecting right now we
have about 10,000 can filter by country
and we also have these two tables by way
of a summary you have the top is is
related to malware and blue the ones
related to fraud so you can browse
around this website so we will focus on
one of these things the bottom right
which is the top ipv6 prefixes by IO
sees this means in first column we have
prefixes ipv6 focuses many threats and
this is important because there are some
cases in which for example and VPS
provided does a poor job and you get an
ipv6 address that means that they're not
complying with a standard if they give
you a bar 64 well it's happy v6 OE
there's prefix which is the one marked
at the top that says almost 3000 related
IRC we can find relationships between an
ASM why is it created what prefix does
it create and publish in the end
just like when we filter in a firewall
any attack originated in ipv6 you don't
have to look after pre-fit at the house
but you have to look at the prefix in
the case of mine where the same can be
the case now you have to take it to
content I know that this is a prefix
there's a lot of malware behind this one
so maybe the prefix is being used by a
malicious agent probably the same one
and I can block it I can probably find
the relationships with the rest of our
seeds okay I am in charge of this right
okay coming back to the filter we
prepared let's focus on what we've been
checking out the past few weeks
here for example of the IRC there are
trusted and we have two large groups
with two well-known a s and apart from
these these people accumulate lots of
viruses and devices it is interesting to
see how threats are distributed in the
prefixes and how they are associated to
the existing asn.1
what we see here you know in speak but
it is grouping by prefix if you have the
types of threads that we attack
identified within that prefix when
prophet was saying about a one prefix
one device we also have one prefix
several devices and several threats
machine that has ipv6 is what going all
time machine instead we'll have one ipv6
with one prefix and it makes a more
complex distribution
when we think about how to filter it an
important thing we have found I will
just drop it for anyone hostile research
we've seen the relationship between the
dual stack with the same gates or ports
in IPA for an ipv6
there are machines they are foreign to a
stack that have port they're not
filtered in ipv6 that is not only the
regular normal people who don't know how
to filter ipv6 maybe we could get in
that way but we have many subcategories
our distribution right now is focused on
fishing and fraud in ipv6 simply because
many sites have been vulnerable and they
inherited capability so in the mild
world we have seen lots and lots of
distribution which was a bit difficult
to understand initially we have a an
incredible amount of families that
support ipv6 in several layers within
the distribution within the botnet
management etc for example here we have
a group between binaries and common
control and
we have several families shown here with
a leading role in the statistics of ILCs
if we go to tall things we've seen is
that or supports a b-26 obviously and we
see here that the distribution of
prefixes is a bit weird
tor is supposed to be an enormous
network with everyone participates
making available e to the rest a node
what you see here that some prefixes
accumulate lots of nodes we don't know
it's because if it's because someone is
setting up many nodes in the same
network with whatever idea I may have in
mind community behind a specific prefix
these are things that we should analyze
when I can group the accesses but we
have find other unusual things as well
that's right if we invite you to take a
look at the feed this is also an extract
of what we got maybe it's something here
called your attention in other thoughts
outlined in green this is an ipv6
represented in hex the people that
putting like nicknamed like coffee and
beef or whatever
we see that this is related to the
malicious agent so let us take a look
what it's a bit like funny already
I don't know you know this websites its
provides public information about ASL
here we can get the ASN so let's ask
let's make let's search and see what we
find
behind this prefix is this does this ASM
publish a a sense public huge amounts of
prefix but this a BSN publish is only 2
to Peavey's ipv4 and to ipv6 which is
quite unusual however we have seen it
says four thousand seven hundred
sixty-six IOC s within that ASM so if we
go to prefixes that is published one
comes and the other one goes either this
is a joke or what but it's quite unique
also the nationalities unique the isn
the United States but their job location
of the prefix is live in Lithuania so
this is also quite unique or unusual so
I don't have to launch the
recommendation of filtering ipv6 with a
filter the probability of having with
having this set of characters quite
unusual so if we search per ASN we will
see three the top are p v6 prefixes by
our IOC s even though the prefixes a SMD
this one here is it publishes more
prefixes but both in ipv4 and six if you
take a look it says on the ASN has its
own website from australia it has a web
portal officially saying that they
provide these internet services this one
is also from Russia would I like it more
or less has a lot of prefixes only 7 in
ipv6 that are also published this could
be a suspect now we get to this one it
has prefix this ASN has 81 occurrences
of IOC and we see that it only publishes
a single ipv6 prefixes and it has a
service a host are you hosting service
which I could also apply a bit of
deductive capabilities and say hey oh
yes
maybe I have to filter that bar 32 which
is a large amount from Russia exactly
because I know that it is not going to
offer me any interesting it will only
give me problems so how do we do it how
do we prevent this feat okay with magic
directly with magic whenever an I to you
what we're doing is collect a large
amount of information related to
commitment indicators we collate with
all the information with Telugu has
about
the IOC feed so we are creating our own
dual-stack feed with all the processes
that include a complete analysis of the
dual stack with the idea getting all the
context we need to determine whether
it's good bad and the relationship
between both environments where are we
going to the first step is to create the
second was to show it to the community
share it with what everybody and the
next step is that this will be made
available in a new version of my IP lake
and mr. Locher because that fee is
basically static information you
download it and use it but all the
information related to energy will stack
and the feed will be available here for
consultation for query together with
many other things that are on the
website we will be generating scoring
for each traffic's prefix because we
want people to understand the importance
of starting thinking in terms of
professes we will also be generating yes
and scoring because of the large number
of prefixes and numbers that we will be
working with and last we would like to
recruit people for our alliance that is
to say researchers that are willing to
share this information with us so that
we can enhance or strengthen our feet so
if you are a vendor organization a
university any organization who wants or
needs to share you will be have a number
of benefits by participating in the feed
and then that would also help increase
and enlarge our feeder feed which will
be open and ready for all of us and well
this is affirm us anything that you may
would like to contribute please share it
with us
contributed and well enjoy it thank you
very much the locust other than all the
magic that you bring with you wherever
you'd like is when you say Alliance this
is the best way to and contribute our
knowledge and to feed each other so are
there any questions I know it is
lunchtime I have a question
have you considered introducing an API
so that people can develop things so
that I can generate my own crawler with
my own rules no actually we haven't
thought about it could be very
interesting just to get information
right away one of the things that we
considered that time with mr. Luca
writing is what said before we would
like to often to offer it as an
infrastructure so the capacity can be
adapted we can control it so if someone
freezes university research project
would like to make any specific testing
for any specific pilot if they just want
to do that across the whole internists
the infrastructure is there available
with services it is highly specialized
thing but mr. Lucca writing can be fully
integrated with an API yeah that would
be a good option indeed are you aware of
companies that do the passive DNS search
and others yes that's one of our targets
entering
building up alliances with these people
they have very very good valuable
information any questions
quality there are no questions we would
like to thank you very much