1
00:00:01,580 --> 00:00:10,280
today's a todos good afternoon everybody

2
00:00:06,560 --> 00:00:17,190
today we will talk about

3
00:00:10,280 --> 00:00:18,990
dual-stack that means ipv6 if someone

4
00:00:17,190 --> 00:00:21,840
doesn't know what it might be Vince X

5
00:00:18,990 --> 00:00:28,669
will check it out in Wikipedia and start

6
00:00:21,840 --> 00:00:28,670
reading when we start talking today

7
00:00:30,019 --> 00:00:44,579
first feed of intelligence or thirds in

8
00:00:33,180 --> 00:00:46,110
ipv6 and ipv4 some some of you may say

9
00:00:44,579 --> 00:00:49,860
well it's not this bad as all that

10
00:00:46,110 --> 00:00:51,989
ipv6 who is using it I don't have it at

11
00:00:49,860 --> 00:00:53,519
home so if I don't have have it at home

12
00:00:51,989 --> 00:00:58,320
the people who usually malware maybe

13
00:00:53,520 --> 00:01:00,510
they don't have it either what people

14
00:00:58,320 --> 00:01:04,080
use this hashtag in eternally in their

15
00:01:00,510 --> 00:01:07,830
mind at least but it's not no long

16
00:01:04,080 --> 00:01:10,320
abandoned because part of the man were

17
00:01:07,830 --> 00:01:15,408
are already been implemented in ipv6

18
00:01:10,320 --> 00:01:18,630
this proxy unused edits EverBank trojan

19
00:01:15,409 --> 00:01:21,720
implements pv6 and also advertises it in

20
00:01:18,630 --> 00:01:24,509
its capabilities to propagate to bank

21
00:01:21,720 --> 00:01:28,920
trojans and to send information to the

22
00:01:24,509 --> 00:01:35,930
bad guys if the end of malware is

23
00:01:28,920 --> 00:01:39,119
implement in ipv6 there is not so in

24
00:01:35,930 --> 00:01:44,399
current sealing we have lots of Trojans

25
00:01:39,119 --> 00:01:49,408
that are increasing this collection of

26
00:01:44,399 --> 00:01:53,100
2019 on the screen if we focus on one of

27
00:01:49,409 --> 00:01:56,880
them select run on the details we have

28
00:01:53,100 --> 00:02:00,530
already found information on this Trojan

29
00:01:56,880 --> 00:02:03,360
which is in dual stack this Trojan has

30
00:02:00,530 --> 00:02:06,659
compromised sites command and control

31
00:02:03,360 --> 00:02:10,500
that implement the old stack so it's not

32
00:02:06,659 --> 00:02:11,950
enough to filter things

33
00:02:10,500 --> 00:02:15,870
[Music]

34
00:02:11,950 --> 00:02:18,549
seeing on this and as time goes by we

35
00:02:15,870 --> 00:02:19,180
thought well why don't we start working

36
00:02:18,550 --> 00:02:22,150
on this

37
00:02:19,180 --> 00:02:25,290
why even NIST and other organizations

38
00:02:22,150 --> 00:02:28,780
they spent years publishing documents

39
00:02:25,290 --> 00:02:31,510
warning about the ipv6 about the dual

40
00:02:28,780 --> 00:02:35,800
stack about the necessity of

41
00:02:31,510 --> 00:02:38,649
implementing safety procedures one of

42
00:02:35,800 --> 00:02:40,990
the big problems we have now is we do i

43
00:02:38,650 --> 00:02:43,930
pv 6 is not taken into account and this

44
00:02:40,990 --> 00:02:46,450
is a big problem because some people

45
00:02:43,930 --> 00:02:48,520
don't even know that they have it if you

46
00:02:46,450 --> 00:02:50,380
don't have it you can filter it if you

47
00:02:48,520 --> 00:02:53,980
have it and you don't know how to filter

48
00:02:50,380 --> 00:02:57,280
it there's an additional step that we

49
00:02:53,980 --> 00:02:59,799
try to preempt which is when i have the

50
00:02:57,280 --> 00:03:05,620
tool for filtering do i know what to

51
00:02:59,800 --> 00:03:08,230
filter where's the who's the one who

52
00:03:05,620 --> 00:03:13,000
gives me the IP what do i have to filter

53
00:03:08,230 --> 00:03:15,790
in order to avoid problems so today we

54
00:03:13,000 --> 00:03:17,860
will talk to you about the first iOS you

55
00:03:15,790 --> 00:03:20,709
feed but before that we will tell you

56
00:03:17,860 --> 00:03:23,709
how with the same information you can

57
00:03:20,709 --> 00:03:32,050
also play a little to will find the

58
00:03:23,709 --> 00:03:35,230
threats yes this feel like that we will

59
00:03:32,050 --> 00:03:38,440
present to you today is not only about a

60
00:03:35,230 --> 00:03:43,119
list of IP the domains that are related

61
00:03:38,440 --> 00:03:47,290
to malicious agents we are used to this

62
00:03:43,120 --> 00:03:49,660
information and your feed and with its

63
00:03:47,290 --> 00:03:53,380
domains and IPS what I will show you now

64
00:03:49,660 --> 00:03:55,709
is you can download this information if

65
00:03:53,380 --> 00:03:55,709
you want

66
00:03:56,140 --> 00:04:00,019
[Music]

67
00:03:58,400 --> 00:04:03,459
what we have seen here at the back these

68
00:04:00,020 --> 00:04:07,160
domains here it could be sort of

69
00:04:03,459 --> 00:04:11,090
suspicious with ipv4 address if we look

70
00:04:07,160 --> 00:04:13,880
the old but the reports that these IPS

71
00:04:11,090 --> 00:04:16,910
have opened there are many then I'm

72
00:04:13,880 --> 00:04:23,000
gonna match it seems to be that the

73
00:04:16,910 --> 00:04:24,380
configuration they might have is some

74
00:04:23,000 --> 00:04:29,060
relation between them

75
00:04:24,380 --> 00:04:30,500
so today hunting and analysis it is

76
00:04:29,060 --> 00:04:33,200
important to know which threats are

77
00:04:30,500 --> 00:04:35,419
related to each other basically because

78
00:04:33,200 --> 00:04:38,990
the people in the background could be

79
00:04:35,419 --> 00:04:45,560
the same if we start taking a look at

80
00:04:38,990 --> 00:04:50,900
the ipv6 addresses of these domains we

81
00:04:45,560 --> 00:04:53,680
see that the ipv6 addresses and not easy

82
00:04:50,900 --> 00:04:56,120
to read but there's things in common

83
00:04:53,680 --> 00:04:56,960
could you tell me someone tell me what

84
00:04:56,120 --> 00:05:01,039
they have in common

85
00:04:56,960 --> 00:05:04,820
the prefix you know ipv6 we will talk

86
00:05:01,039 --> 00:05:09,530
about this several times if in addition

87
00:05:04,820 --> 00:05:16,510
we have apart from the prefix which is

88
00:05:09,530 --> 00:05:20,299
accrued in the feed you can see that

89
00:05:16,510 --> 00:05:24,500
this is actually a malware it's just

90
00:05:20,300 --> 00:05:28,070
classified in three levels taxonomy here

91
00:05:24,500 --> 00:05:32,590
we have the prefix this is our SC where

92
00:05:28,070 --> 00:05:36,289
people discuss about the address

93
00:05:32,590 --> 00:05:39,669
assigned to someone who wants to have

94
00:05:36,289 --> 00:05:43,520
ipv6 addressing so it says it is

95
00:05:39,669 --> 00:05:49,219
recommended to assign a bar for th in

96
00:05:43,520 --> 00:05:53,349
general when an ICP requests a range of

97
00:05:49,220 --> 00:05:53,350
ipv4 he gets about 24

98
00:05:53,790 --> 00:06:03,770
with ipv6

99
00:05:56,790 --> 00:06:08,100
this is a bar 48 and a bar 64 is when

100
00:06:03,770 --> 00:06:18,659
you will only need one sort of network

101
00:06:08,100 --> 00:06:24,330
only but in the end never 128 a single

102
00:06:18,660 --> 00:06:30,750
IP one only one device is to be

103
00:06:24,330 --> 00:06:34,560
connected that means that home in my

104
00:06:30,750 --> 00:06:38,640
access to VPS we will get a at least a

105
00:06:34,560 --> 00:06:51,590
bar 64 ipv6 ever has 128 bits which

106
00:06:38,640 --> 00:06:55,380
means that very similar to ipv4 and ASM

107
00:06:51,590 --> 00:07:02,390
autonomous system which is the

108
00:06:55,380 --> 00:07:11,909
distributor of those prefixes so we have

109
00:07:02,390 --> 00:07:16,789
if you subtract 128 64 from 128 so we

110
00:07:11,910 --> 00:07:21,570
will have 2 by 64 times ipv6 addresses

111
00:07:16,790 --> 00:07:24,570
you can a huge amount of IP addresses in

112
00:07:21,570 --> 00:07:28,830
ipv4 but one will have a prefix it is

113
00:07:24,570 --> 00:07:32,490
associated to the site agent an entity

114
00:07:28,830 --> 00:07:38,400
that is being allocated or assigned the

115
00:07:32,490 --> 00:07:42,530
bar 64 so here we have it and this is

116
00:07:38,400 --> 00:07:42,530
what the web looks like it's an open web

117
00:07:44,680 --> 00:07:55,720
and from there you can start downloading

118
00:07:48,300 --> 00:07:59,500
in JSON and CSV and soon in sticks IO

119
00:07:55,720 --> 00:08:03,699
sees that were collecting right now we

120
00:07:59,500 --> 00:08:07,810
have about 10,000 can filter by country

121
00:08:03,699 --> 00:08:13,360
and we also have these two tables by way

122
00:08:07,810 --> 00:08:15,460
of a summary you have the top is is

123
00:08:13,360 --> 00:08:28,449
related to malware and blue the ones

124
00:08:15,460 --> 00:08:31,630
related to fraud so you can browse

125
00:08:28,449 --> 00:08:34,450
around this website so we will focus on

126
00:08:31,630 --> 00:08:37,630
one of these things the bottom right

127
00:08:34,450 --> 00:08:42,039
which is the top ipv6 prefixes by IO

128
00:08:37,630 --> 00:08:45,760
sees this means in first column we have

129
00:08:42,039 --> 00:08:49,180
prefixes ipv6 focuses many threats and

130
00:08:45,760 --> 00:08:56,100
this is important because there are some

131
00:08:49,180 --> 00:09:00,640
cases in which for example and VPS

132
00:08:56,100 --> 00:09:03,490
provided does a poor job and you get an

133
00:09:00,640 --> 00:09:05,980
ipv6 address that means that they're not

134
00:09:03,490 --> 00:09:10,680
complying with a standard if they give

135
00:09:05,980 --> 00:09:14,620
you a bar 64 well it's happy v6 OE

136
00:09:10,680 --> 00:09:19,150
there's prefix which is the one marked

137
00:09:14,620 --> 00:09:30,130
at the top that says almost 3000 related

138
00:09:19,150 --> 00:09:34,390
IRC we can find relationships between an

139
00:09:30,130 --> 00:09:39,870
ASM why is it created what prefix does

140
00:09:34,390 --> 00:09:39,870
it create and publish in the end

141
00:09:40,080 --> 00:09:51,990
just like when we filter in a firewall

142
00:09:46,080 --> 00:09:53,850
any attack originated in ipv6 you don't

143
00:09:51,990 --> 00:09:56,190
have to look after pre-fit at the house

144
00:09:53,850 --> 00:09:58,080
but you have to look at the prefix in

145
00:09:56,190 --> 00:10:02,610
the case of mine where the same can be

146
00:09:58,080 --> 00:10:04,980
the case now you have to take it to

147
00:10:02,610 --> 00:10:07,050
content I know that this is a prefix

148
00:10:04,980 --> 00:10:10,350
there's a lot of malware behind this one

149
00:10:07,050 --> 00:10:12,479
so maybe the prefix is being used by a

150
00:10:10,350 --> 00:10:16,050
malicious agent probably the same one

151
00:10:12,480 --> 00:10:18,030
and I can block it I can probably find

152
00:10:16,050 --> 00:10:22,589
the relationships with the rest of our

153
00:10:18,030 --> 00:10:27,870
seeds okay I am in charge of this right

154
00:10:22,590 --> 00:10:31,700
okay coming back to the filter we

155
00:10:27,870 --> 00:10:34,340
prepared let's focus on what we've been

156
00:10:31,700 --> 00:10:37,440
checking out the past few weeks

157
00:10:34,340 --> 00:10:44,210
here for example of the IRC there are

158
00:10:37,440 --> 00:10:49,530
trusted and we have two large groups

159
00:10:44,210 --> 00:10:55,200
with two well-known a s and apart from

160
00:10:49,530 --> 00:11:00,720
these these people accumulate lots of

161
00:10:55,200 --> 00:11:03,630
viruses and devices it is interesting to

162
00:11:00,720 --> 00:11:07,320
see how threats are distributed in the

163
00:11:03,630 --> 00:11:09,300
prefixes and how they are associated to

164
00:11:07,320 --> 00:11:12,810
the existing asn.1

165
00:11:09,300 --> 00:11:16,939
what we see here you know in speak but

166
00:11:12,810 --> 00:11:20,089
it is grouping by prefix if you have the

167
00:11:16,940 --> 00:11:22,290
types of threads that we attack

168
00:11:20,090 --> 00:11:24,720
identified within that prefix when

169
00:11:22,290 --> 00:11:27,839
prophet was saying about a one prefix

170
00:11:24,720 --> 00:11:32,540
one device we also have one prefix

171
00:11:27,840 --> 00:11:32,540
several devices and several threats

172
00:11:33,500 --> 00:11:41,310
machine that has ipv6 is what going all

173
00:11:37,140 --> 00:11:44,490
time machine instead we'll have one ipv6

174
00:11:41,310 --> 00:11:46,540
with one prefix and it makes a more

175
00:11:44,490 --> 00:11:51,130
complex distribution

176
00:11:46,540 --> 00:11:54,520
when we think about how to filter it an

177
00:11:51,130 --> 00:11:56,920
important thing we have found I will

178
00:11:54,520 --> 00:12:00,819
just drop it for anyone hostile research

179
00:11:56,920 --> 00:12:04,750
we've seen the relationship between the

180
00:12:00,820 --> 00:12:06,610
dual stack with the same gates or ports

181
00:12:04,750 --> 00:12:09,160
in IPA for an ipv6

182
00:12:06,610 --> 00:12:12,160
there are machines they are foreign to a

183
00:12:09,160 --> 00:12:16,870
stack that have port they're not

184
00:12:12,160 --> 00:12:20,380
filtered in ipv6 that is not only the

185
00:12:16,870 --> 00:12:24,670
regular normal people who don't know how

186
00:12:20,380 --> 00:12:27,820
to filter ipv6 maybe we could get in

187
00:12:24,670 --> 00:12:33,959
that way but we have many subcategories

188
00:12:27,820 --> 00:12:38,350
our distribution right now is focused on

189
00:12:33,960 --> 00:12:42,160
fishing and fraud in ipv6 simply because

190
00:12:38,350 --> 00:12:46,240
many sites have been vulnerable and they

191
00:12:42,160 --> 00:12:50,530
inherited capability so in the mild

192
00:12:46,240 --> 00:12:53,410
world we have seen lots and lots of

193
00:12:50,530 --> 00:12:57,610
distribution which was a bit difficult

194
00:12:53,410 --> 00:13:01,000
to understand initially we have a an

195
00:12:57,610 --> 00:13:05,110
incredible amount of families that

196
00:13:01,000 --> 00:13:09,820
support ipv6 in several layers within

197
00:13:05,110 --> 00:13:12,460
the distribution within the botnet

198
00:13:09,820 --> 00:13:16,330
management etc for example here we have

199
00:13:12,460 --> 00:13:18,590
a group between binaries and common

200
00:13:16,330 --> 00:13:22,490
control and

201
00:13:18,590 --> 00:13:26,800
we have several families shown here with

202
00:13:22,490 --> 00:13:30,920
a leading role in the statistics of ILCs

203
00:13:26,800 --> 00:13:34,189
if we go to tall things we've seen is

204
00:13:30,920 --> 00:13:36,770
that or supports a b-26 obviously and we

205
00:13:34,190 --> 00:13:38,770
see here that the distribution of

206
00:13:36,770 --> 00:13:41,089
prefixes is a bit weird

207
00:13:38,770 --> 00:13:43,189
tor is supposed to be an enormous

208
00:13:41,089 --> 00:13:48,100
network with everyone participates

209
00:13:43,190 --> 00:13:51,050
making available e to the rest a node

210
00:13:48,100 --> 00:13:53,779
what you see here that some prefixes

211
00:13:51,050 --> 00:13:56,180
accumulate lots of nodes we don't know

212
00:13:53,779 --> 00:13:58,100
it's because if it's because someone is

213
00:13:56,180 --> 00:14:02,390
setting up many nodes in the same

214
00:13:58,100 --> 00:14:09,410
network with whatever idea I may have in

215
00:14:02,390 --> 00:14:11,630
mind community behind a specific prefix

216
00:14:09,410 --> 00:14:18,589
these are things that we should analyze

217
00:14:11,630 --> 00:14:21,880
when I can group the accesses but we

218
00:14:18,589 --> 00:14:24,170
have find other unusual things as well

219
00:14:21,880 --> 00:14:29,930
that's right if we invite you to take a

220
00:14:24,170 --> 00:14:33,050
look at the feed this is also an extract

221
00:14:29,930 --> 00:14:35,150
of what we got maybe it's something here

222
00:14:33,050 --> 00:14:38,949
called your attention in other thoughts

223
00:14:35,150 --> 00:14:44,260
outlined in green this is an ipv6

224
00:14:38,950 --> 00:14:44,260
represented in hex the people that

225
00:14:48,430 --> 00:14:54,040
putting like nicknamed like coffee and

226
00:14:51,260 --> 00:14:54,040
beef or whatever

227
00:14:55,600 --> 00:15:03,010
we see that this is related to the

228
00:14:58,310 --> 00:15:06,589
malicious agent so let us take a look

229
00:15:03,010 --> 00:15:09,529
what it's a bit like funny already

230
00:15:06,589 --> 00:15:14,410
I don't know you know this websites its

231
00:15:09,529 --> 00:15:14,410
provides public information about ASL

232
00:15:16,750 --> 00:15:22,790
here we can get the ASN so let's ask

233
00:15:20,029 --> 00:15:23,709
let's make let's search and see what we

234
00:15:22,790 --> 00:15:32,089
find

235
00:15:23,709 --> 00:15:35,839
behind this prefix is this does this ASM

236
00:15:32,089 --> 00:15:39,639
publish a a sense public huge amounts of

237
00:15:35,839 --> 00:15:44,810
prefix but this a BSN publish is only 2

238
00:15:39,639 --> 00:15:49,790
to Peavey's ipv4 and to ipv6 which is

239
00:15:44,810 --> 00:15:52,699
quite unusual however we have seen it

240
00:15:49,790 --> 00:16:01,640
says four thousand seven hundred

241
00:15:52,699 --> 00:16:07,609
sixty-six IOC s within that ASM so if we

242
00:16:01,640 --> 00:16:09,949
go to prefixes that is published one

243
00:16:07,610 --> 00:16:12,620
comes and the other one goes either this

244
00:16:09,949 --> 00:16:16,670
is a joke or what but it's quite unique

245
00:16:12,620 --> 00:16:21,170
also the nationalities unique the isn

246
00:16:16,670 --> 00:16:24,890
the United States but their job location

247
00:16:21,170 --> 00:16:30,069
of the prefix is live in Lithuania so

248
00:16:24,890 --> 00:16:33,230
this is also quite unique or unusual so

249
00:16:30,070 --> 00:16:37,190
I don't have to launch the

250
00:16:33,230 --> 00:16:41,540
recommendation of filtering ipv6 with a

251
00:16:37,190 --> 00:16:44,209
filter the probability of having with

252
00:16:41,540 --> 00:16:52,790
having this set of characters quite

253
00:16:44,209 --> 00:16:55,160
unusual so if we search per ASN we will

254
00:16:52,790 --> 00:17:01,779
see three the top are p v6 prefixes by

255
00:16:55,160 --> 00:17:01,779
our IOC s even though the prefixes a SMD

256
00:17:02,940 --> 00:17:13,150
this one here is it publishes more

257
00:17:07,630 --> 00:17:15,880
prefixes but both in ipv4 and six if you

258
00:17:13,150 --> 00:17:20,380
take a look it says on the ASN has its

259
00:17:15,880 --> 00:17:22,990
own website from australia it has a web

260
00:17:20,380 --> 00:17:25,720
portal officially saying that they

261
00:17:22,990 --> 00:17:29,830
provide these internet services this one

262
00:17:25,720 --> 00:17:33,880
is also from Russia would I like it more

263
00:17:29,830 --> 00:17:38,379
or less has a lot of prefixes only 7 in

264
00:17:33,880 --> 00:17:41,140
ipv6 that are also published this could

265
00:17:38,380 --> 00:17:48,580
be a suspect now we get to this one it

266
00:17:41,140 --> 00:17:52,210
has prefix this ASN has 81 occurrences

267
00:17:48,580 --> 00:17:55,860
of IOC and we see that it only publishes

268
00:17:52,210 --> 00:18:00,270
a single ipv6 prefixes and it has a

269
00:17:55,860 --> 00:18:02,800
service a host are you hosting service

270
00:18:00,270 --> 00:18:07,290
which I could also apply a bit of

271
00:18:02,800 --> 00:18:07,290
deductive capabilities and say hey oh

272
00:18:08,280 --> 00:18:15,850
yes

273
00:18:09,610 --> 00:18:20,409
maybe I have to filter that bar 32 which

274
00:18:15,850 --> 00:18:24,370
is a large amount from Russia exactly

275
00:18:20,410 --> 00:18:27,460
because I know that it is not going to

276
00:18:24,370 --> 00:18:32,500
offer me any interesting it will only

277
00:18:27,460 --> 00:18:37,530
give me problems so how do we do it how

278
00:18:32,500 --> 00:18:41,290
do we prevent this feat okay with magic

279
00:18:37,530 --> 00:18:43,870
directly with magic whenever an I to you

280
00:18:41,290 --> 00:18:47,820
what we're doing is collect a large

281
00:18:43,870 --> 00:18:52,149
amount of information related to

282
00:18:47,820 --> 00:18:53,439
commitment indicators we collate with

283
00:18:52,150 --> 00:18:55,740
all the information with Telugu has

284
00:18:53,440 --> 00:18:55,740
about

285
00:18:56,070 --> 00:19:04,240
the IOC feed so we are creating our own

286
00:19:00,480 --> 00:19:07,300
dual-stack feed with all the processes

287
00:19:04,240 --> 00:19:13,840
that include a complete analysis of the

288
00:19:07,300 --> 00:19:16,000
dual stack with the idea getting all the

289
00:19:13,840 --> 00:19:18,790
context we need to determine whether

290
00:19:16,000 --> 00:19:23,200
it's good bad and the relationship

291
00:19:18,790 --> 00:19:26,020
between both environments where are we

292
00:19:23,200 --> 00:19:28,540
going to the first step is to create the

293
00:19:26,020 --> 00:19:31,330
second was to show it to the community

294
00:19:28,540 --> 00:19:33,280
share it with what everybody and the

295
00:19:31,330 --> 00:19:37,000
next step is that this will be made

296
00:19:33,280 --> 00:19:39,790
available in a new version of my IP lake

297
00:19:37,000 --> 00:19:42,910
and mr. Locher because that fee is

298
00:19:39,790 --> 00:19:45,190
basically static information you

299
00:19:42,910 --> 00:19:47,200
download it and use it but all the

300
00:19:45,190 --> 00:19:50,070
information related to energy will stack

301
00:19:47,200 --> 00:19:54,400
and the feed will be available here for

302
00:19:50,070 --> 00:19:57,189
consultation for query together with

303
00:19:54,400 --> 00:20:01,510
many other things that are on the

304
00:19:57,190 --> 00:20:04,450
website we will be generating scoring

305
00:20:01,510 --> 00:20:05,920
for each traffic's prefix because we

306
00:20:04,450 --> 00:20:09,000
want people to understand the importance

307
00:20:05,920 --> 00:20:13,660
of starting thinking in terms of

308
00:20:09,000 --> 00:20:16,270
professes we will also be generating yes

309
00:20:13,660 --> 00:20:18,700
and scoring because of the large number

310
00:20:16,270 --> 00:20:22,330
of prefixes and numbers that we will be

311
00:20:18,700 --> 00:20:25,390
working with and last we would like to

312
00:20:22,330 --> 00:20:27,159
recruit people for our alliance that is

313
00:20:25,390 --> 00:20:30,550
to say researchers that are willing to

314
00:20:27,160 --> 00:20:34,660
share this information with us so that

315
00:20:30,550 --> 00:20:37,090
we can enhance or strengthen our feet so

316
00:20:34,660 --> 00:20:42,190
if you are a vendor organization a

317
00:20:37,090 --> 00:20:47,949
university any organization who wants or

318
00:20:42,190 --> 00:20:50,110
needs to share you will be have a number

319
00:20:47,950 --> 00:20:52,390
of benefits by participating in the feed

320
00:20:50,110 --> 00:20:54,669
and then that would also help increase

321
00:20:52,390 --> 00:20:58,270
and enlarge our feeder feed which will

322
00:20:54,670 --> 00:21:03,960
be open and ready for all of us and well

323
00:20:58,270 --> 00:21:07,660
this is affirm us anything that you may

324
00:21:03,960 --> 00:21:08,280
would like to contribute please share it

325
00:21:07,660 --> 00:21:12,460
with us

326
00:21:08,280 --> 00:21:28,590
contributed and well enjoy it thank you

327
00:21:12,460 --> 00:21:30,760
very much the locust other than all the

328
00:21:28,590 --> 00:21:35,409
magic that you bring with you wherever

329
00:21:30,760 --> 00:21:41,460
you'd like is when you say Alliance this

330
00:21:35,410 --> 00:21:44,320
is the best way to and contribute our

331
00:21:41,460 --> 00:21:46,060
knowledge and to feed each other so are

332
00:21:44,320 --> 00:21:48,360
there any questions I know it is

333
00:21:46,060 --> 00:21:51,730
lunchtime I have a question

334
00:21:48,360 --> 00:21:53,439
have you considered introducing an API

335
00:21:51,730 --> 00:21:55,630
so that people can develop things so

336
00:21:53,440 --> 00:21:58,540
that I can generate my own crawler with

337
00:21:55,630 --> 00:21:59,980
my own rules no actually we haven't

338
00:21:58,540 --> 00:22:02,370
thought about it could be very

339
00:21:59,980 --> 00:22:05,230
interesting just to get information

340
00:22:02,370 --> 00:22:06,969
right away one of the things that we

341
00:22:05,230 --> 00:22:10,450
considered that time with mr. Luca

342
00:22:06,970 --> 00:22:12,550
writing is what said before we would

343
00:22:10,450 --> 00:22:18,700
like to often to offer it as an

344
00:22:12,550 --> 00:22:21,879
infrastructure so the capacity can be

345
00:22:18,700 --> 00:22:24,250
adapted we can control it so if someone

346
00:22:21,880 --> 00:22:26,140
freezes university research project

347
00:22:24,250 --> 00:22:29,620
would like to make any specific testing

348
00:22:26,140 --> 00:22:31,660
for any specific pilot if they just want

349
00:22:29,620 --> 00:22:33,280
to do that across the whole internists

350
00:22:31,660 --> 00:22:36,280
the infrastructure is there available

351
00:22:33,280 --> 00:22:41,050
with services it is highly specialized

352
00:22:36,280 --> 00:22:44,470
thing but mr. Lucca writing can be fully

353
00:22:41,050 --> 00:22:47,770
integrated with an API yeah that would

354
00:22:44,470 --> 00:22:50,530
be a good option indeed are you aware of

355
00:22:47,770 --> 00:22:52,980
companies that do the passive DNS search

356
00:22:50,530 --> 00:22:54,930
and others yes that's one of our targets

357
00:22:52,980 --> 00:22:56,970
entering

358
00:22:54,930 --> 00:22:59,250
building up alliances with these people

359
00:22:56,970 --> 00:23:04,820
they have very very good valuable

360
00:22:59,250 --> 00:23:07,380
information any questions

361
00:23:04,820 --> 00:23:11,840
quality there are no questions we would

362
00:23:07,380 --> 00:23:11,840
like to thank you very much