Date: 16 July 2007 Time: 12:00-13:30
Location: "Stelios Orphanoudakis" Seminar Room, FORTH, Heraklion, Crete.
Host: Euaggelos Markatos
As more users are connected to the Internet and conduct their daily activities electronically, computer users have become the target of an underground economy that infects hosts with malware or adware for financial gain. Unfortunately, even a single visit to an infected web site enables the attacker to detect vulnerabilities in the user's applications and force the download a multitude of malware binaries.
Frequently, this malware allows the adversary to gain full control of the compromised systems leading to the ex-filtration of sensitive information or installation of utilities that facilitate remote control of the host. We believe that such behavior is similar to our traditional understanding of botnets. However, the main difference is that web-based malware infections are pull-based and that the resulting command feedback loop is looser.
To characterize the nature of this rising thread, this talk identifies the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets. For each of these areas, the talk presents examples of abuse found on the Internet. Our aim is to present the state of malware on the Web and emphasize the importance of this rising threat.
Niels Provos received a Ph.D. from the University of Michigan in 2003 where he studied experimental and theoretical aspects of computer and network security. He is one of the OpenSSH creators and known for his security work on OpenBSD. He developed Honeyd, a popular open-source honeypot platform, SpyBye, a client honeypot helping web masters to detect malware on their web pages, and many other tools such as Systrace, Stegdetect, etc.
He is a member of the Honeynet project and an active contributor to open source projects. Niels Provos is currently employed as Senior Staff engineer at Google Inc.