Investigating DDOS - Architecture Actors and Attribution

Black Hat USA 2016

Presented by: AndreCorrea, Elliott Peterson
Date: Thursday August 04, 2016
Time: 11:00 - 11:50
Location: Mandalay Bay EF

DDOS attack usage has been accelerating, in terms of both attack volume and frequency. Such attacks present a major threat to enterprises worldwide. Presenters will discuss a number of novel techniques utilized by law enforcement and the private sector, to measure, study, and attribute attacks originating from sources such as embedded device botnets and booter/stresser services. Presenters will discuss the usage of honeypots to gather historical attack details, as well as best practices for conducting live DDOS attack testing. Representative PCAPs will be shown, dissected, and explain. Finally, presenters will provide examples of where these services are offered for sale, how they are purchased, and the individuals who operate them.

Elliott Peterson

Elliott Peterson is a Special Agent with the FBI in the Anchorage FieldOffice. A member of Anchorage's Computer Intrusion Squad, he is responsiblefor investigating complex botnets, high dollar account takeover fraud, andDistributed Denial of Service attacks. Prior to joining the FBI, Elliottworked in Higher Education and served as an officer in the United StatesMarine Corps. He holds a Bachelor's Degree in Computer Science from DickinsonCollege and a Master's Degree in Crime Analysis from Tiffin University.

AndreCorrea

Andre Correa is an Information Security and Threat Intelligence Professionalwhose qualifications include in-depth knowledge of Internet technologies,current cyber security landscape, incident response, security mechanisms andbest practices. He is Co-Founder of Malware Patrol (malwarepatrol.net) andactively studies the evolving tactics employed by DDOS practitioners. Andre isa certified CISSP. He holds a Bachelor of Marketing and Sales Management andBachelor of Science in Physics. Andre is fluent in English and Portuguese.


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats