Because the Internet of Things is a major part of modern life, security threats are everywhere. Security incidents as well as the results of our many threat hunts have shown us that hundreds of millions of devices have been traumatized by attackers’ malicious actions, made part of large botnets, or disrupted through malicious programs taking advantage of zero-day or one-day vulnerabilities.
In order to reinforce detection and defensive capabilities against such IoT-ICS threats, we have deployed hundreds of automated threat hunting engines worldwide. In the past year, we have received and analyzed more than 25 TB of traffic, detected over 1.1 billion attacks from over 200 countries, and hunted 400 million plus suspicious IPs, 30 million plus suspicious domains, and over 1 million malicious files (RATs, trojans, worms, ransomware, and so on). Among those malicious files, more than 40% are unknown -- VirusTotal couldn’t recognize them. We also found that more than 1.1 million devices may have been assimilated into botnets. This talk will share in detail how we built an automated large-scale threat hunting system, and give a deep look into the overall threat situation and trends from 6 hunting examples from the past year. We will share the benefits and responses to the threats we found, and the next steps for our threat hunting project.
Mars Cheng is a threat researcher for TXOne Networks, blending a background and experience in both ICS/SCADA and Enterprise cybersecurity systems. Mars has directly contributed to more than 10 CVE-IDs, and has had work published in three Science Citation Index (SCI) applied cryptography journals. Before joining TXOne, Mars was a security engineer at the Taiwan National Center for Cyber Security Technology (NCCST). Mars is a frequent speaker and trainer at several international cyber security conferences such as Black Hat, HITB, HITCON, SecTor, ICS Cyber Security Conference USA and Asia, CLOUDSEC, and InfoSec Taiwan as well as other conferences and seminars related to the topics of ICS and IoT security. Mars is general coordinator of HITCON 2021 and was vice general coordinator of HITCON 2020.
Patrick Kuo is a threat researcher and hunting system operator for TXOne Networks. He focused on big data analysis, threat hunting engine building and threat hunting system development. For big data analysis, Patrick has focused on monitoring and classifying malicious payloads from big data, and then analyzing the correctness and uniqueness of these payloads. For the threat hunting engine, Patrick focused on building, integrating, refactoring and improving the engine to improve its ability to hunt malicious attacks and payloads. For the threat hunting system, Patrick focused on creating complete and adjustable infrastructure to process and analyze large amounts of data flow in real-time.