Attack Mining: Using Distributed Sensors to Identify and Take Down Cyber Adversaries

Explore a comprehensive conference talk from the 38th Chaos Communication Congress (38C3) that delves into analyzing and combating cyber attacks using distributed sensor networks. Learn how to set up systems that collect attack data from multiple sensors worldwide, understand the process of enriching this data centrally, and discover effective methods for reporting abuse to ISPs and governing bodies. Examine the implementation of Docker containers with modified OpenSSH servers that log attack attempts while remaining undetectable to adversaries. Gain insights into attack patterns, credential analysis, and the correlation between internet-identifiable information and attack strategies. Understand the effectiveness of various takedown approaches, including response times from different ISPs and regional variations in cooperation. Master defensive strategies based on real attack data and learn how to contribute to making the internet more secure through proactive threat identification and reporting.