WHOIS the Master - An Introduction to ShoNuff

•

1 j'aime•1,513 vues

This talk introduces a new security tool called ShoNuff. With all the talk about IPv4 address scarcity, and the resulting migration to IPv6, I thought it would be interesting to see how the IP space was chopped up. Additionally, I figured it would be interesting to see what organizations were responsible for various network blocks. So, I've started enumerating the whois space for the entire Internet, normalizing that information and making it available to the public. Additionally, I'm tying the allocated network blocks to SHODAN, so that one can query an organization's name and return a complete list of netblocks associated with that entity, then discover what service banners SHODAN has for that particular netblock. Jason Ross Jason has been working in the IT industry for about 12 years, and specifically doing InfoSec for the past 9. Jason provides security consulting services, and, after hours, he performs malware research with a number of international organizations and runs the Rochester DefCon Group (DC585). Despite all that, Jason is most proud to be a husband, and a father to 4 wonderful sons.

Technologie

WHOIS the master
an introduction to
Sho'Nuff
jason ross

about me
• break stuff for a living
• play with malware for fun
• poorly manage defcon group 585
• refuse to use caps in slide decks (acronyms
excluded)

agenda
• 2^32 addresses ought to be enough for
anybody
• alphabet soup, iron fists, and ipv6
• whois: awesomely full of crap
• shonuff – the whois master

a (very) brief history of 'the internet'
• lots of separate networks hooked up, some
confusion ensued
• InterNIC stepped out, ICANN stepped in
• ICANN manages global addressing under contract
to US Dept. of Commerce as IANA
• (not for) profit!

ipv4 network allocation
• large blocks of addresses are allocated to global
geographic regions
• large blocks may be allocated to national
geographic regions
• blocks are divided up and allocated to local ISPs
• individual addresses or small blocks are assigned
to ISP customers

early allocation methods
• there's so much space!
• large chunks of network space allocated to
single organizations
• justification requirements fairly lax

zomg! this thing works!
• demand increased
• address assignments got smaller
• requirements to prove need of requested
space got tighter

what's a RIR?
• Regional Internet Registry
• in charge of large geographic regions
– AfriNIC : Africa
– APNIC : Asia / Pacific
– ARIN : North America
– LACNIC : Latin America & some Caribbean
– RIPE NCC : Europe, Middle East, Central Asia

what's a NIR?
• National Internet Registry
• in charge of small geographic regions
• act as an agent of the RIR
• not commonly used, but there's a few

what's a LIR?
• Local Internet Registry
• usually an ISP

why the push for ipv6?
• ipv4 was not designed for security
• "available address space is running low"

security
• many con talks and whitepapers by folks lots
smarter that i have already covered this
• so i won't

scarcity
• there have been comments and discussion
around the fact that IPv4 space is 'running out'
for years.
• IEEE-USA published a report on this in 8/1999

the sky is falling! (aka: how low can you go?)
image taken from arstechnica: http://is.gd/dCnMM

if ipv4 is running out, where did it go?
• nobody that knows is telling ('freely')
• nobody else knows
• leading to much debate

how to find out
• ask IANA!
• when that fails, ask the RIRs
• then ask the LIRs

overview of whois tools
• *nix: whois
• web: http://lmgtfy.com/?q=web+whois
• www.robtex.com/whois

what's missing?
• no standardized output
• can't perform true wildcard queries
– whois -h whois.arin.net " o . bank*"
• query options vary by RIR
• information is not centralized
– chasing referrals sucks

how accurate is whois data?
• contact data is required by law in most
countries to be legit
• ARIN is working on a policy to validate WHOIS
POC info

theoretical challenges
• how to handle referrals
• should i throttle queries
• parsing the results

interesting reports
• organizational breakdown
– who has the most allocations
– who has the most network space
• geographic breakdown
– what countries have ip space
– which countries have the most space

linking results to shodan
• shodan has no API an API!
• so i just link to the search results make calls to
it for you
• you need to have an account
• and you need to be logged in

shonuff – the WHOIS master!
• started as PHP/MySQL
• then i got mocked (gently)
• so i ported it to JSP/Postgres 5 days ago
– to prove it can always get worse
• will probably end up as something else is now
written in ruby!

future plans
• add in WHOIS contact data
• malware IP to WHOIS correlation
– allows easy tieback of malicious content to "real
world" network & hosting businesses
• integrate DNS PTR records for netblocks
• Maltego transform?
• Tie-in for Fierce?
• Metasploit fun?

the end
@rossja
algorythm@gmail.com
cruft.blogspot.com

Contenu connexe

Plus de Rochester Security Summit

Dissecting the Hack: Malware Analysis 101 is designed to be an introduction into the world of malware analysis. This presentation will begin with a brief 5 to 10 minute introduction to some malware analysis theory, followed by a live demonstration that will take the audience through an in-depth behavioral and code analysis of a select piece of malware. This demonstration will include techniques using free open source tools such as detecting packers and unpacking, file and registry analysis, and in depth code analysis. Gerry Brunnelle, System Security Engineer, Boeing Gerry Brunelle is currently a System Security Engineer for Boeing in the Washington, D.C. area. He is also currently a candidate for a MS in Computer Security and Information Assurance from RIT and has a BS in Network and System Administration from RIT. He has participated in various security groups and competitions, and designed and ran the Capture the Flag event for the Rochester Security Summit in 2009.

Dissecting the Hack: Malware Analysis 101

Rochester Security Summit

Are you managing GRC in the most effective manner? Is it contributing to business governance or becoming a burden ? We will discuss the current state of GRC and recognized business drivers as well as supportive risk management infrastructures. Strategies for the alignment of business interests with enterprise GRC programs to establish a complete, auditable, less time consuming program which benefits from management visibility and compliance readiness will additionally be presented. Utilize GRC to manage your business, not to burden it. James P Finn, Modulo James has twenty five years experience in security and disaster recovery consulting, managing and delivering enterprise solutions to more than 200 worldwide commercial and government clients. He has held various management and consulting positions in the information security field including as a worldwide IBM Corporate Auditor for Information Security reporting to the Corporation’s Board of Directors and the as the founding Principal of both the IBM and Unisys Security Consulting Practices and as Vice President of Risk Management for Modulo. He has consulted in more than 38 countries (U.S., Asia, Europe, South America) on business, technical security and recovery solutions to assist clients to achieve and maintain effective goverance across the full spectrum of security and business recovery disciplines. James is a Microsoft MSRA trained assessor, a KPMG trained SOX auditor and also holds Business Continuity certifications. He is frequently requested as a speaker at international industry conferences, live webcasts and TV and radio news shows and is the author of over 50 media articles on computer security

GRC– The Way Forward

Rochester Security Summit

Despite cloud computing’s maturation as an enterprise IT application or infrastructure option, IT management concerns persist, notably in the areas of security, IT governance, and business continuity. The speaker will focus on security and data governance issues regarding deployment of private, hybrid and public clouds, and offer a pragmatic plan for resolving these concerns. This plan navigates the tangle of security responsibilities between enterprises and cloud service providers to enable IT managers to leverage the economics and flexibility provided by cloud-based applications. The plan focuses on how companies can create secure spaces in the cloud and both protect and control data in those spaces. Todd Thiemann ,. Senior Director, Datacenter Products, Trend Micro, Inc. Todd Thiemann has been with Trend Micro for over eight years and is currently responsible for planning Trend Micro’s products and technologies designed to secure datacenter information including virtualization and cloud security, DLP, and encryption. Todd is also co-chair of the Cloud Security Alliance Solution Provider Forum. Todd holds a BS degree from Georgetown University and an MBA from the Anderson School of Business at the University of California, Los Angeles.

A Plan to Control and Protect Data in the Private and Public Cloud

Rochester Security Summit

One problem that every information security organization faces is how to accurately quantify the risks that they manage. In most cases, there is not enough information available to do this. There is now enough known about data breaches to let us draw interesting conclusions, some of which may even have implications in other areas of information security. This talk describes what we can learn from a careful analysis of the available information on data breaches, how we can extend what we learn about data breaches to other aspects of information security, and why doing this makes sense. Luther Martin, Chief Security Architect, Voltage Security, Inc. Luther Martin is the Chief Security Architect at Voltage Security, Inc., a vendor of encryption technology and products. He began his career in information security at the National Security Agency, where he graduated from the NSA's Cryptologic Mathematician Program in 1991, and eventually became the Technical Director of the NSA's Engineering and Physical Sciences Security Division. After leaving the NSA, he has worked at both security consulting and product companies. Notable accomplishments during this period include creating the security code review for consulting firm Ernst & Young, running the first commercial security code review projects, and creating the public-key infrastructure technology that was used in the U.S. Postal Service's PC Postage program. He is the author of Introduction to Identity-based Encryption, and has contributed to seven other books and over 100 articles on the topics of information security and risk management.

Finding Patterns in Data Breaches

Rochester Security Summit

Since the days of California's pioneering data breach notification law, virtually all states have implemented some form of consumer ID theft protection law. In 2008, the focus shifted to the east coast, when Massachusetts took it beyond notification, and issued their regulations for the protection of personal information, viewed by many as the most proscriptive in the US. This presentation will provide a general overview of state law, but focus on how the MA regulations evolved from the version issued in Sept 2008 to what became effective March 2010, how organizations are responding, and some potential implications for the future. Allison Dolan, Program Director, Protecting Personally Identifiable Information, Massachusetts Institute of Technology Allison F. Dolan is currently Program Director, Protecting Personally Identifiable Information at the Massachusetts Institute of Technology. This program is co-sponsored by the Institute Auditor and Vice President for Information Services and Technology (IS&T). Previously, Allison spent 10 years in IS&T, including roles as Director of Shared Services - Finance, Administration and HR, and as Director of Telephony Services. Allison’s MIT experience was preceded by 20 years of combined information systems, operational, and leadership experience at Eastman Kodak. Allison holds a BA degree from the University of Delaware, with a double major in Computer Science and Economics.

State Data Breach Laws - A National Patchwork Quilt

Rochester Security Summit

Enterprises react more often to threats than to vulnerabilities since threats are more visible and frightening. So it seems to go with data protection -- our enterprises seem intent on getting the latest gizmos to protect against the most visible threats. We should, instead, be thinking about the overall structure of vulnerabilities and what structure of protections it implies. This presentation shows an enterprise-architectural view of vulnerabilities that can endanger our data and suggests a rational program of protections that can minimize them. It’s not flashy, but it is effective. David C. Frier, CISSP, Security Practice Leader, CIBER New York David Frier is the Security Practice Lead for CIBER, Inc. the global IT consultancy with the local presence. Now in the 32nd year of his IT career, he has performed consulting work in the areas of Enterprise Architecture, Disaster Recovery, SOX Audit (as the auditOR), SAS 70 and ISO 17799 Audit (as the auditEE), mission critical operations, enterprise encryption solutions, and Data Leakage Prevention (DLP). David holds the CISSP and CRISC certifications.

It's All About the Data!

Rochester Security Summit

Payment Card Industry (PCI) Data Security Standard (DSS) compliance is frequently misunderstood. Determining an effective strategy for the demonstration of compliance and its ongoing governance is critical to mitigate emerging payment security risks. Knowing when you need help, understanding which requirements are applicable, and determining the proper course of actions to adhere to the standard is often more complex than it may at first seem. Join Fortrex Technologies QSA Peter Spier and Senior Director of Information Security, Compliance and Fraud for PAETEC Holding Corporation, Jim Raub, for this discussion of common challenges and practical solutions. Peter Spier, Senior Risk Management Consultant,Fortrex Technologies Peter is President of the ISACA Western New York Chapter and is a Senior Risk Management Consultant at Fortrex Technologies based in Frederick, Maryland. Peter attained his graduate degree from Syracuse University's School of Information Studies and over the course of 12 years of experience has earned Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP), Qualified Security Assessor (QSA), Information Technology Infrastructure Library (ITIL) Foundation version 3, and HITRUST CSF Assessor certifications. Jim Raub Senior Director of Information Security, Compliance and Fraud, PAETEC Holding Corporation Jim has held a wide range of IT positions over the past 30 years, with a concentration on security for the past decade. He has presented at numerous conferences and taught many business and college courses as an adjunct faculty member. Jim’s certifications include Certified Information Systems Auditor (CISA) and Certified Information Systems Security Professional (CISSP). When he’s not working, he is an avid musician and volunteer at several non-profit organizations.

You Know You Need PCI Compliance Help When…

Rochester Security Summit

There are many different methodologies for implementing and testing security controls in an IT system to ensure that it is operating under an “acceptable level of risk.” Many of these methodologies require the use of software to aid in this measurement. While the execution of technical tools is important, it can sometimes place a financial burden on an organization (especially a small business) that may not have the resources to purchase the software or hire trained personnel to run the tools and conduct an analysis of the results. This presentation provides an overview of a security testing methodology developed by the Federal Government through the Department of Commerce’s National Institute of Standards and Technology (NIST) Computer Security Division that is available for use by the security community at no cost. The NIST methodology allows an organization to test their security posture by analyzing controls that are listed in 18 different security categories. Attendees will: 1. Be presented a comprehensive security testing approach that limits the need for using automated tools 2. Take away an understanding of National Institute of Standards and Technology (NIST) security controls and learn how to apply them to their information systems 3. Be shown techniques for documenting testing results 4. Be apprised of best practices for conducting security testing of information systems Tom Hasman, Senior Information Security Analyst, SRA International Tom is Senior Information Security Analyst on the Information Assurance team for SRA International. Tom specializes in Security Tests & Evaluations in support of the government’s Certification & Accreditation process. He performs risk assessments and makes recommendations to clients for prioritizing and mitigating vulnerabilities. Tom also develops security policies and procedures for government clients.

A Security Testing Methodology that Fits Every IT Budget

Rochester Security Summit

Business Impact Assessments and Risk Assessments lay the foundation for a successful Disaster Recovery and Business Continuity program. This presentation will examine the elements of the assessments and focus on how the assessment results help a business determine areas of risk and potential impact to their business when things go wrong. Audience members will participate in an assessment exercise. Susan Kastan, Kastan Consulting Susan Kastan has worked over 20 years in the information technology field with experience in business continuity planning, security analysis, systems development, and project management. She is currently focused on developing business continuity and disaster recovery plans for companies and associations. Susan has experience in all areas of the business continuity life cycle including risk and business continuity assessments, business impact analysis, plan development, training, testing, and plan maintenance. She also writes information security policies and procedures providing organizations the necessary framework to secure their information systems. Penny Klein, PJKlein Consulting Penny Johnson Klein has been in the Information Assurance field for over 20 years and is a recognized expert in the field. During her career, she has provided support for various Department of Defense (DOD) Agencies, Federal Agencies, and the Private Sector. She spent 14 years with DOD, with 13 of those years in the Information Assurance arena, assisting in the development of security policies, processes, and procedures. She was one of the prime authors of the DOD Information Technology Security Certification and Accreditation Process (DITSCAP), and contributor to the National Information Assurance Certification and Accreditation Process (NIACAP). In addition, Ms. Klein has directed numerous successful Security Test and Evaluations and has developed information security programs.

Business Impact and Risk Assessments in Business Continuity and Disaster Reco...

Rochester Security Summit

Losing Control to the Cloud

Rochester Security Summit

“Firewall Defense against Covert Channels” will explore the feasibility of using firewalls to defend against covert channels. Several open-source covert channel tools such as Covert_tcp, Wsh, and CCTT will be demonstrated and tested against a network-layer firewall as well as an application-layer firewall using the 7-layer OSI Network Model as a framework for analysis. Rich Savacool, Chief Security Officer, Nixon Peabody, LLP Rich Savacool is the Chief Security Officer for Nixon Peabody, LLP, a law firm based in Rochester, NY. He has nearly 20 years of experience in networking and systems security for both the commercial and government sectors. Rich holds numerous certifications including the CISSP, CEH, CCE, and GPEN. He has recently completed his Master’s Degree in Computer Security and Information Assurance from Rochester Institute of Technology.

Firewall Defense against Covert Channels

Rochester Security Summit

Plus de Rochester Security Summit (11)

Dissecting the Hack: Malware Analysis 101

GRC– The Way Forward

A Plan to Control and Protect Data in the Private and Public Cloud

Finding Patterns in Data Breaches

State Data Breach Laws - A National Patchwork Quilt

It's All About the Data!

You Know You Need PCI Compliance Help When…

A Security Testing Methodology that Fits Every IT Budget

Business Impact and Risk Assessments in Business Continuity and Disaster Reco...

Losing Control to the Cloud

Firewall Defense against Covert Channels

Dernier

Axa Assurance Maroc - Insurer Innovation Award 2024

The Digital Insurer

Histor y of HAM Radio presentation slide

vu2urc

Enterprise Knowledge’s Urmi Majumder, Principal Data Architecture Consultant, and Fernando Aguilar Islas, Senior Data Science Consultant, presented "Driving Behavioral Change for Information Management through Data-Driven Green Strategy" on March 27, 2024 at Enterprise Data World (EDW) in Orlando, Florida. In this presentation, Urmi and Fernando discussed a case study describing how the information management division in a large supply chain organization drove user behavior change through awareness of the carbon footprint of their duplicated and near-duplicated content, identified via advanced data analytics. Check out their presentation to gain valuable perspectives on utilizing data-driven strategies to influence positive behavioral shifts and support sustainability initiatives within your organization. In this session, participants gained answers to the following questions: - What is a Green Information Management (IM) Strategy, and why should you have one? - How can Artificial Intelligence (AI) and Machine Learning (ML) support your Green IM Strategy through content deduplication? - How can an organization use insights into their data to influence employee behavior for IM? - How can you reap additional benefits from content reduction that go beyond Green IM?

Driving Behavioral Change for Information Management through Data-Driven Gree...

Enterprise Knowledge

BooK Now Call us at +918448380779 to hire a gorgeous and seductive call girl for sex. Take a Delhi Escort Service. The help of our escort agency is mostly meant for men who want sexual Indian Escorts In Delhi NCR. It should be noted that any impersonator will get 100 attention from our Young Girls Escorts in Delhi. They will assume the position of reliable allies. VIP Call Girl With Original Photos Book Tonight +918448380779 Our Cheap Price 1 Hour not available 2 Hours 5000 Full Night 8000 TAG: Call Girls in Delhi, Noida, Gurgaon, Ghaziabad, Connaught Place, Greater Kailash Delhi, Lajpat Nagar Delhi, Mayur Vihar Delhi, Chanakyapuri Delhi, New Friends Colony Delhi, Majnu Ka Tilla, Karol Bagh, Malviya Nagar, Saket, Khan Market, Noida Sector 18, Noida Sector 76, Noida Sector 51, Gurgaon Mg Road, Iffco Chowk Gurgaon, Rajiv Chowk Gurgaon All Delhi Ncr Free Home Deliver

08448380779 Call Girls In Friends Colony Women Seeking Men

Delhi Call girls

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

Delhi Call girls

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

Sara Mae O’Brien Scott and Tatiana Baquero Cakici, Senior Consultants at Enterprise Knowledge (EK), presented “AI Fast Track to Search-Focused AI Solutions” at the Information Architecture Conference (IAC24) that took place on April 11, 2024 in Seattle, WA. In their presentation, O’Brien-Scott and Cakici focused on what Enterprise AI is, why it is important, and what it takes to empower organizations to get started on a search-based AI journey and stay on track. The presentation explored the complexities of enterprise search challenges and how IA principles can be leveraged to provide AI solutions through the use of a semantic layer. O’Brien-Scott and Cakici showcased a case study where a taxonomy, an ontology, and a knowledge graph were used to structure content at a healthcare workforce solutions organization, providing personalized content recommendations and increasing content findability. In this session, participants gained insights about the following: Most common types of AI categories and use cases; Recommended steps to design and implement taxonomies and ontologies, ensuring they evolve effectively and support the organization’s search objectives; Taxonomy and ontology design considerations and best practices; Real-world AI applications that illustrated the value of taxonomies, ontologies, and knowledge graphs; and Tools, roles, and skills to design and implement AI-powered search solutions.

IAC 2024 - IA Fast Track to Search Focused AI Solutions

Enterprise Knowledge

Handwritten Text Recognition for manuscripts and early printed texts

Maria Levchenko

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Neo4j

[2024]Digital Global Overview Report 2024 Meltwater.pdf

hans926745

The Raspberry Pi 5 was announced on October 2023. This new version of the popular embedded device comes with a new iteration of Broadcom’s VideoCore GPU platform, and was released with a fully open source driver stack, developed by Igalia. The presentation will discuss some of the major changes required to support this new Video Core iteration, the challenges we faced in the process and the solutions we provided in order to deliver conformant OpenGL ES and Vulkan drivers. The talk will also cover the next steps for the open source Raspberry Pi 5 graphics stack. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://eoss24.sched.com/event/1aBEx

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...

Igalia

What are drone anti-jamming systems? The drone anti-jamming systems and anti-spoof technology protect against interference, jamming, and spoofing of the UAVs. To protect their security, countries are beginning to research drone anti-jamming systems, also known as drone strike weapons. The anti-jam and anti-spoof technology protects against interference, jamming and spoofing. A drone strike weapon is a drone attack weapon that can attack and destroy enemy drones. So what is so unique about this amazing system?

What Are The Drone Anti-jamming Systems Technology?

Antenna Manufacturer Coco

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

In this session, we will delve into strategic approaches for optimizing knowledge management within Microsoft 365, amidst the evolving landscape of Copilot. From leveraging automatic metadata classification and permission governance with SharePoint Premium, to unlocking Viva Engage for the cultivation of knowledge and communities, you will gain actionable insights to bolster your organization's knowledge-sharing initiatives. In this session, we will also explore how to facilitate solutions to enable your employees to find answers and expertise within Microsoft 365. You will leave equipped with practical techniques and a deeper understanding of how there is more to effective knowledge management than just enabling Copilot, but building actual solutions to prepare the knowledge that Copilot and your employees can use.

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Drew Madelung

Automating Google Workspace (GWS) & more with Apps Script

wesley chun

Discord is a free app offering voice, video, and text chat functionalities, primarily catering to the gaming community. It serves as a hub for users to create and join servers tailored to their interests. Discord’s ecosystem comprises servers, each functioning as a distinct online community with its own channels dedicated to specific topics or activities. Users can engage in text-based discussions, voice calls, or video chats within these channels. Understanding Discord Servers Discord servers are virtual spaces where users congregate to interact, share content, and build communities. Servers may revolve around gaming, hobbies, interests, or fandoms, providing a platform for like-minded individuals to connect. Communication Features Discord offers a range of communication tools, including text channels for messaging, voice channels for real-time audio conversations, and video channels for face-to-face interactions. These features facilitate seamless communication and collaboration. What Does NSFW Mean? The acronym NSFW stands for “Not Safe For Work,” indicating content that may be inappropriate for professional or public settings. NSFW Content NSFW content encompasses material that is sexually explicit, violent, or otherwise graphic in nature. It often includes nudity, profanity, or depictions of sensitive topics.

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

UK Journal

A Domino Admins Adventures (Engage 2024)

Gabriella Davis

🐬 The future of MySQL is Postgres 🐘

RTylerCroy

presentation ICT roal in 21st century education

jfdjdjcjdnsjd

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

Dernier (20)

Axa Assurance Maroc - Insurer Innovation Award 2024

Histor y of HAM Radio presentation slide

Driving Behavioral Change for Information Management through Data-Driven Gree...

08448380779 Call Girls In Friends Colony Women Seeking Men

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

IAC 2024 - IA Fast Track to Search Focused AI Solutions

Handwritten Text Recognition for manuscripts and early printed texts

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

[2024]Digital Global Overview Report 2024 Meltwater.pdf

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...

What Are The Drone Anti-jamming Systems Technology?

Boost PC performance: How more available memory can improve productivity

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

Automating Google Workspace (GWS) & more with Apps Script

Understanding Discord NSFW Servers A Guide for Responsible Users.pdf

A Domino Admins Adventures (Engage 2024)

🐬 The future of MySQL is Postgres 🐘

presentation ICT roal in 21st century education

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

WHOIS the Master - An Introduction to ShoNuff

1. WHOIS the master an introduction to Sho'Nuff jason ross

2. about me • break stuff for a living • play with malware for fun • poorly manage defcon group 585 • refuse to use caps in slide decks (acronyms excluded)

3. agenda • 2^32 addresses ought to be enough for anybody • alphabet soup, iron fists, and ipv6 • whois: awesomely full of crap • shonuff – the whois master

4. a (very) brief history of 'the internet' • lots of separate networks hooked up, some confusion ensued • InterNIC stepped out, ICANN stepped in • ICANN manages global addressing under contract to US Dept. of Commerce as IANA • (not for) profit!

5. ipv4 network allocation • large blocks of addresses are allocated to global geographic regions • large blocks may be allocated to national geographic regions • blocks are divided up and allocated to local ISPs • individual addresses or small blocks are assigned to ISP customers

6. early allocation methods • there's so much space! • large chunks of network space allocated to single organizations • justification requirements fairly lax

7. zomg! this thing works! • demand increased • address assignments got smaller • requirements to prove need of requested space got tighter

8. what's a RIR? • Regional Internet Registry • in charge of large geographic regions – AfriNIC : Africa – APNIC : Asia / Pacific – ARIN : North America – LACNIC : Latin America & some Caribbean – RIPE NCC : Europe, Middle East, Central Asia

9. what's a NIR? • National Internet Registry • in charge of small geographic regions • act as an agent of the RIR • not commonly used, but there's a few

10. what's a LIR? • Local Internet Registry • usually an ISP

11. why the push for ipv6? • ipv4 was not designed for security • "available address space is running low"

12. security • many con talks and whitepapers by folks lots smarter that i have already covered this • so i won't

13. scarcity • there have been comments and discussion around the fact that IPv4 space is 'running out' for years. • IEEE-USA published a report on this in 8/1999

14. the sky is falling! (aka: how low can you go?) image taken from arstechnica: http://is.gd/dCnMM

15. if ipv4 is running out, where did it go? • nobody that knows is telling ('freely') • nobody else knows • leading to much debate

16. how to find out • ask IANA! • when that fails, ask the RIRs • then ask the LIRs

17. overview of whois tools • *nix: whois • web: http://lmgtfy.com/?q=web+whois • www.robtex.com/whois

18. what's missing? • no standardized output • can't perform true wildcard queries – whois -h whois.arin.net " o . bank*" • query options vary by RIR • information is not centralized – chasing referrals sucks

19. how accurate is whois data? • contact data is required by law in most countries to be legit • ARIN is working on a policy to validate WHOIS POC info

20. theoretical challenges • how to handle referrals • should i throttle queries • parsing the results

21. interesting reports • organizational breakdown – who has the most allocations – who has the most network space • geographic breakdown – what countries have ip space – which countries have the most space

22. linking results to shodan • shodan has no API an API! • so i just link to the search results make calls to it for you • you need to have an account • and you need to be logged in

23. shonuff – the WHOIS master! • started as PHP/MySQL • then i got mocked (gently) • so i ported it to JSP/Postgres 5 days ago – to prove it can always get worse • will probably end up as something else is now written in ruby!

24. future plans • add in WHOIS contact data • malware IP to WHOIS correlation – allows easy tieback of malicious content to "real world" network & hosting businesses • integrate DNS PTR records for netblocks • Maltego transform? • Tie-in for Fierce? • Metasploit fun?

25. the end @rossja algorythm@gmail.com cruft.blogspot.com

WHOIS the Master - An Introduction to ShoNuff

Recommandé

Recommandé

Contenu connexe

Plus de Rochester Security Summit

Plus de Rochester Security Summit (11)

Dernier

Dernier (20)

WHOIS the Master - An Introduction to ShoNuff