IIJ Technical WEEK 2013 Day3 (in English)

Kenji Rikitake @jj1bdx

IIJ Tech Week Day 3 soon, at Jimbocho.

Kenji Rikitake @jj1bdx

I was here last time in 2011 for ACM Erlang Workshop. Good place and great weather.

Kenji Rikitake @jj1bdx

Personal data, NSA, home router - three fiascos on the Internet #iij_tw2013

Kenji Rikitake @jj1bdx

Global paradigm shift after Snowden: “there’s surely somebody is watching me” #iij_tw2013

Kenji Rikitake @jj1bdx

Authentication information theft - not only id/password but all related stuff and chain of reused auth info exploited #iij_tw2013

Kenji Rikitake @jj1bdx

Exploit kits enable individual attackers to focus on specialized technologies, and evade tracking from the authorities #iij_tw2013

Kenji Rikitake @jj1bdx

Targeted attacks against enterprise networks still continuing - not only to nat’l agencies but to ordinary corporations #iij_tw2013

Kenji Rikitake @jj1bdx

Attackers tend to use pre-build exploit kits and the attack vectors do not change much #iij_tw2013

Kenji Rikitake @jj1bdx

(Note: Internet Initiative Japan is a leading service provider in Japan. Today is the Tech Week conf day 3 for security. #iij_tw2013)

Kenji Rikitake @jj1bdx

DDoS: 4 to 10Gbps observed at IIJ, 100 to 300Gbps worldwide / DNS Amplification and open resolver attacks make a trend #iij_tw2013

Kenji Rikitake @jj1bdx

20-MAR-2013 attack in Korea abusing corporate software update infrastructure was serious - the goal was destroying it #iij_tw2013

Kenji Rikitake @jj1bdx

IIJ Tech Week 2013 Archive (in Japanese) http://t.co/0I5tTHUymc

Kenji Rikitake @jj1bdx

The nature of home networks are changing: home appliances will soon become viable targets through WLAN #iij_tw2013

Kenji Rikitake @jj1bdx

Attack examples: webcam hacked and used for snooping #iij_tw2013

Kenji Rikitake @jj1bdx

Default config vuln of CPE revealed in Japan - devices remains unprotected - still thousands of vuln CPEs remain #iij_tw2013

Kenji Rikitake @jj1bdx

The Japanese CPE with vuln remains: ~300K units / actual incidents/damages occur #iij_tw2013

Kenji Rikitake @jj1bdx

An anonymous research paper: 20M routers are accessible (with exploited 420K routers for forwarding) #iij_tw2013

Kenji Rikitake @jj1bdx

CPE vuln: UPnP weakness remains in 23M devices (libupnp) #iij_tw2013

Kenji Rikitake @jj1bdx

DNS misconfigured as open resolvers: massive relay attacks with size amplification (of many RRs) and spoofed IP sources #iij_tw2013

Kenji Rikitake @jj1bdx

What is legitimate or non-legitimate attack canNOT be distinguished by the Internet service providers. #iij_tw2013 (eg Spamhaus/CloudFlare)

Kenji Rikitake @jj1bdx

Observed DNS amplification-intended abuse: from Canada in March, from China in September #iij_tw2013

Kenji Rikitake @jj1bdx

DNS open resolver exploitation looks not systematic (try-and-error) - though targeting attacks do exist #iij_tw2013

Kenji Rikitake @jj1bdx

CPE's unaware risks: devices connected BOTH your home network and the workplace networks will be a viable attack vector #iij_tw2013

Kenji Rikitake @jj1bdx

IIJ investigates their own users' vulnerability. (I will not tweet about the details as requested by the speaker) #iij_tw2013