maznu-naughty-step-netmcr- maznu-naughty-step-netmcr-

Naughty Step Net

1. The Naughty Step
Marek Isalski — @maznu
Faelix Limited — https://faelix.net/

2. ssh
SMTP
IMAP
POP
VOIP
Drupal
WordPress

3. That is one big
pile of shit!

4. The Naughty Step

5. The Shit Pit
The Naughty Step

6. PushDo
virus cover traffic sending 2kbytes with POST / HTTP/1.0
and opening connection to TCP port 25

7. omg wtf loadavg

8. – every infosec professional ever
“Security is hard.”

9. WWW
Cat GIF Blog
make DJT
root again!

10. WWW
Cat GIF Blog
make DJT
root again!
apache
logs
fail2ban

11. Edge Router
WWW
Cat GIF Blog
make DJT
root again!
apache
logs
fail2ban
slurry
AMQP

12. Edge Router
WWW
Cat GIF Blog
make DJT
root again!
apache
logs
fail2ban
slurry
spreader
AMQP

13. Edge Router
WWW
Cat GIF Blog
apache
logs
fail2ban
slurry
spreader
AMQP
passwords
are hard

14. Edge Router
WWW
Cat GIF Blog
apache
logs
fail2ban
slurry
spreader
AMQP
passwords
are hard

15. WWW
Cat GIF Blog
apache
logs
fail2ban
slurry
spreader
AMQP
passwords
are hard
Edge Router

16. Edge Router
fail2ban
slurry
spreader
AMQP
passwords
are hard

17. Edge Router
WWW
Cat GIF Blog
fail2ban
slurry
spreader
AMQP
passwords
are hard

18. Edge Router
fail2ban
slurry
spreader
AMQP
make DJT
root again!

19. Edge Router
fail2ban
slurry
spreader
AMQP
make DJT
root again!

DNS RBL
badips.com
VIPs

20. Edge Router
fail2ban
slurry
spreader
AMQP
make DJT
root again!

DNS RBL
badips.com
fastnetmon
VIPs
fastnetmon?
NetMcr #2!

21. Edge Router
fail2ban
slurry
spreader
AMQP
make DJT
root again!

DNS RBL
badips.com
fastnetmon
VIPs
snort?
NetMcr #???
snort

22. Edge Router
fail2ban
slurry
spreader
AMQP
make DJT
root again!

DNS RBL
badips.com
VIPs
IPv6
fastnetmon
snort

23. bots = smart
Typical day of traffic in the shitpit:
spike of traffic, bot realises, moves on.

24. bots = dumb
Last 90 days, showing some ongoing, persistent attackers.

25. Show me the code!

26. Show me the code!
:-(

27. Show me the code!
:-)
soon?

28. Check these out!
•fail2ban = tail log files, filter them, perform actions
•fastnetmon = am I being DDoSed? uses NetFlow/etc
•portsentry = am I being portscanned?
•mod_security + OWASP = Web Application Firewall
•snort = intrusion detection system

29. Check these out!
•fail2ban = tail log files, filter them, perform actions
•fastnetmon = am I being DDoSed? uses NetFlow/etc
•portsentry = am I being portscanned?
•mod_security + OWASP = Web Application Firewall
•snort = intrusion detection system
•MikroTik MUM London 2016-11-14 (Monday!)

30. Q?
E: [email protected]
T: @maznu