2

Size: px

Start display at page:

Download "2"

栾鹭郦
9 years ago
Views:

1 2011 Ver

2 2

3 3 P2P Tunnel BotNet Zero-Day

4 4 port port HTTP (TCP/80), HTTPS(TCP/443) SSL SSH IPSec Ex:TOR Protocol Obfuscation( ) P2P Protocol Obfuscation

5 P2P 5

6 P2P 6 P2P P2P P2P 6

7 7 P2P Tunnel BotNet Zero-Day

8 亞洲翻牆軟體的演進曾經我們是祖國的花朵茁壯成長如今我們是祖國的紅杏集體翻牆 8

9 9 (Wujie) (Freegate) Tor = = = Tunnel =

10 1 1. well-known port, VPN server VPN Server VPN Client Computer ehind firewall VPN Client VPN Client VPN Client Computer on the Internet Computer behind firewall Computer on the Internet

11 1 2. tunneling LAN VPN Server VPN Client Computer ehind firewall VPN Client VPN Client VPN Client Computer on the Internet Computer behind firewall Computer on the Internet

12 1 3. VPN VPN Server Critical server behind firewall VPN Client Computer ehind firewall VPN Client VPN Client VPN Client Computer on the Internet Computer behind firewall Computer on the Internet

13 1 Step 3. IM Client connects to local VPN server in plain text IM Client 3 Step 1. Install VPN Server locally VPN Server 1 Step 4. VPN Server connects through Firewall encrypte and undetected 4 VPN Tunnel VPN Server Step 2. Configure IM client to connect via local SOCKS or HTTP proxy server 2 Step 5. External VPN Server connects to IM server in Plain text 5

14 1 Step 3. Step 1. IE VPN VPN Server Server 3 VPN Server 1 Step 4. VPN Server VPN Server 4 VPN Tunnel VPN Server Step 2. IE VPN Server 2 Step 5. VPN Server 5

15 Tunnel 1 Tunnel? web(port 80 or 443) L3~4

16 Tunnel (cont.) Tunnel 1

17 1 P2P Tunnel BotNet Zero-Day

18 BotNet 1 SPAM Mariposa 12,000,000? Conficker 10,000,000 10,000,000,000/day Zeus 3,600,000 (US Only) N/A Cutwail 1,500,000 74,000,000,000/day Storm 160,000 3,000,000,000/day Waledac 80,000 1,500,000,000/day Wikipedia

19 BotNet 1 Gartner 2013 BotNet 19

20 BotNet (cont.) 2 Gartner BotNet 20

21 2 P2P Tunnel BotNet Zero-Day

22 2 Internet Worm Blaster Sasser Zotob Mocbot IRC Bot 0-day 0-day rc:

23 rc:

24 OS 2 Server side Client side Client side c:

25 2 client side server side client side Web Src:

26 PDF 2 PDF 2008 PDF client side bot

27 2 P2P Tunnel BotNet Zero-Day

28 Zero-day 2 zeroday frame work zero-day Adobe PDF Flash Player Microsoft Office Suite (PowerPoint, Excel and Word) software c:

29 2 P2P WMF 0-day

30 FTC P2P

31 P2P

32 P2P P2P

33 Foxy P2P

34 3 P2P WMF 0-day

36 (cont.) 3 (Robin Sage) Facebook 25 PO (Twitter) PO

37 盖 13 Twitter

38 盖 13 Twitter (cont.) 3 3 Twitter 2 4 Twitter 1 Twitter 5 CODEC 6 8 Twitter 7 CODEC

39 3 P2P WMF 0-day Bot IM

40 MS WMF 0-day IE 0-day Win XP SP2 WMF Crackz [dot] ws unionseek [dot] com [dot] com Iframeurl [dot] biz beehappyy [dot] biz more...

41 WMF 0-day 4

42 WMF 0-day 4

43 WMF 0-day 4

44 WMF 0-day 4 IE 0-day!!

45 4 P2P WMF 0-day

46 4

47 IM 4

48 IM 4

49 4

50 IM 5

51 5

52 5

53 MSN 5

54 5

55 5

56 5

57 5

58 -- NetKeeper 5 IPS NSS ICSALabs / DDoS / /

59 5 BroadWeb IPS 0-day MS WMF 0-day 0 exploits 28 Dec, Dec, Jan, 2006 Attack MS WMF exploit publicly released BroadWeb released pattern update Microsoft released patch 0-day Vulnerability D day D+1 day D+N day Attack Vulnerability was publicly unveiled BroadWeb released pattern update Vender released patch

60 -- NetKeeper 6 BotNet BotNet BotNet

61 -- NetKeeper IM P2P

62 -- FlowManager 6 IM P2P

63 -- FlowManager 6

64 BroadWeb 6 State Machine

65 BroadWeb Web P2P IM Streaming Media VoIP 16

66 BroadWeb 6 AP State Machine Tunnel IM/P2P

67 Bots Botnets 6 IPS/ Bot 0-day IPS IRC IM/P2P ( pdf office ) IM URL Bot

68 6

一专业名称专业名称 : 会计二入学要求与基本学制入学要求 : 初中毕业生基本学制 : 三年 ; 其中前二年为在校学习时间, 最后一年为企业实习时间层次 : 中职三培养目标本专

一专业名称专业名称 : 会计二入学要求与基本学制入学要求 : 初中毕业生基本学制 : 三年 ; 其中前二年为在校学习时间, 最后一年为企业实习时间层次 : 中职三培养目标本专安徽省滁州市明光职业高级中学会计专业人才培养方案一专业名称专业名称 : 会计二入学要求与基本学制入学要求 : 初中毕业生基本学制 : 三年 ; 其中前二年为在校学习时间, 最后一年为企业实习时间层次 : 中职三培养目标本专业