1 Jeff Jonas IBM

Spear Phishing en Masse Jeff Jonas, IBM Distinguished Engineer Chief Scientist, IBM Entity Analytics OReilly Gov 2.0 – May 27, 2010

3 Whats Coming Data will find data and relevance will find you. – Amazing ads tailored just for you – Populations spear phished en masse

4 How? Context accumulating systems used to deliver real-time, high quality predictions.

5 Context, definition of: Better understanding something … by taking into account the things around it.

6 No Context Billy In Barcelona now

7 In Context Previously Worked at AOL Is a Google Net Admin Lives in San Jose Acquaintance of Esthers Billy In Barcelona now

8 Social Media Bill Smith Play: Work: Data Finds Data About Bill is a computer network administrator at Google. Author. Speaker. Forum In Barcelona now! Whoo Hooo. Note new /Billy Is a Google Net Admin In Barcelona

9 Social Media Bill Smith Play: Work: Data Finds Data About Bill is a computer network administrator at Google. Author. Speaker. Forum In Barcelona now! Whoo Hooo. Note new /Billy Is a Google Net Admin In Barcelona

10 Context Accumulates Acquaintance of Esthers Is a Google Net Admin Living in San Jose In Barcelona Previously Worked at AOL

11 Phish This Esther is likely influential to Billy –Esther has 2,500+ FaceBook friends –Billy has 103 FaceBook friends Not best buddies –No recent communications evident on Facebook –No co-references between the two in open source Timely knowledge finds timely material –Lives in San Jose, in Barcelona now –First Google PDF for: [barcelona travelers guide pdf]

12 Phish Bait To: From: Billy, sorry we dont connect more often. Busy busy. A mutual friend tells me you are in Barcelona right now! This is my favorite guide for the area, just in case you need one. Esther PS: The spams killing me, hence the new address Barcelona eGuide.pdf

13 Results Amazing click through rates: – Ads – Infections

14 Spear Phishing en Masse Not a picture of a person. A whole population – the big picture. Humanless, not enuf of em. Targeted searches, subscriptions and crawlers feeding a fully automated context accumulation process. Not a snapshot of the past. What is happening here and now.

15 Plausible Targets The technical elite –Network and database administrators –CIOs, CTOs, CSOs, etc. People in positions of power –Elected officials –Corporate executives Their staff, family and friends Let your imagination run wild, there is virtually no limit

16 Hints for Scripts Travels Hobbies Interests Charitable causes Metallica Family members Others influential over them

17 Old School: GhostNet Next Gen: lasers on foreheads from 6,940 miles 1 vs. 1 vs. 1,000,000s

18 What Now? Better education – Cant keep up Better malware detection – Windows shut too late Better phone home detection – Traffic masking one-step ahead Investment for resilience to black swans – Catastrophic outages too rare

19 Closing Thoughts As context accumulates everyone gets smarter. Great ads. And timely s from folks you recognize and trust … that arent. Will identity authentication be mandated? And how will we square this with our right to be anonymous?

20 Related Links More About GhostNet GhostNet-Investigating-a-Cyber-Espionage- Network Related Stuff On My Blog Puzzling: How Observations Are Accumulated Into Context Data Finds Data Prediction: Channel Consolidation

Spear Phishing en Masse Jeff Jonas, IBM Distinguished Engineer Chief Scientist, IBM Entity Analytics OReilly Gov 2.0 – May 27, 2010