Capacity Development Workshop on Public Information Management System and Policy in Korea on cyber attacks Jeong Min, Lee KISA

Capacity Development Workshop on Public Information Management Contents Korea Cyber Security Framework DDoS Response System –Security Monitoring Center –Detection Tools –DNS Sinkhole –Cyber Cure System for Infected PCs –DDoS Cyber Shelter DDoS Response Case : – 3.4 DDoS in 2011 Korea Cyber Security Framework DDoS Response System –Security Monitoring Center –Detection Tools –DNS Sinkhole –Cyber Cure System for Infected PCs –DDoS Cyber Shelter DDoS Response Case : – 3.4 DDoS in 2011

Capacity Development Workshop on Public Information Management Korea Cyber Security Framework

Capacity Development Workshop on Public Information Management Cyber Crisis Response Framework President National Center For Crisis Management National Center For Crisis Management Ministry of National Defense Ministry of National Defense Defense Security Command Military Area/each unit Korea Communications Commission Korea Communications Commission KrCERT/CC Critical Infrastructures in Private Sector Critical Infrastructures in Private Sector National Intelligence Service National Intelligence Service KNCERT/CC Critical Infrastructures in Government/Public Sector Critical Infrastructures in Government/Public Sector

Capacity Development Workshop on Public Information Management Security Cooperation Framework

Capacity Development Workshop on Public Information Management Distributed Denial of Service Attack

Capacity Development Workshop on Public Information Management DDoS Attack Response

Capacity Development Workshop on Public Information Management Security Monitoring Center

Capacity Development Workshop on Public Information Management

Capacity Development Workshop on Public Information Management DDoS Nation Wide Anti-DDoS System DDoS Detection system IX(Internet eXchange) Backbone Router A ISPB ISP Ix RuterIX Router Legitimate Traffic IDC, Internet Biz company, Internet Service Provides, etc IDC, Internet Biz company, Internet Service Provides, etc DDoS Attack Traffic Block or Detour Conn ected Block or Detour DDoS Attack Traffic Normal Traffic Conn ected

Capacity Development Workshop on Public Information Management Detection Tools: Malicious code analysis(Utilize HoneyNet)

Capacity Development Workshop on Public Information Management Web Hacking Malicious Code Detection (MC-Finder) Web Service Provider All Domains registered in Korea (1.8 million) 1. Update detection rule Malicious Code Finding System (MC-Finder) 2.Check hidden malicious URL in website 3. Request to block foreign malicious URL ISP Staff on duty KT T Broad SK Broadband 4. Request to remove malicious URL Malicioius URL (Dissemination, Route) KISA

Capacity Development Workshop on Public Information Management DNS Sinkhole : Block BotNet

Capacity Development Workshop on Public Information Management Cyber Cure System for Infected PCs 1.Collect infected PC IP Target website DDoS attack 2. Operate cyber cure System ISP 3. Popup window for notification 4. Dedicated vaccine Zombie PC Stop! Cure zombie PC Cyber cure system Download dedicated vaccine

Capacity Development Workshop on Public Information Management DDoS Cyber Shelter

Capacity Development Workshop on Public Information Management Case Study : Success Story of KR DDoS attack countermeasure by KISA

Capacity Development Workshop on Public Information Management Overview of 3.4 DDoS(1) ~ 3.15(about 10 days) Attack Target : 40 institutions –24 Government and Public institutions –9 Financial institutions –7 Portal & Shopping Mall

Capacity Development Workshop on Public Information Management March and July DDoS attacks are Similar ClassificationMar 4thJuly 7th # of Zombie PCs116,299115,044 # of Target websites4036 # of Blocked C&C Servers # of Destroyed HDDs7561,466

Capacity Development Workshop on Public Information Management March DDoS Method is more Intelligent and destructive than July 3.4 DDoS Attack attempted only attack of disturbing the system network with very high technology, so that this attack is deemed as the testing kind’s prior attack for checking Korea’s state of defense. –(Dmitri Alperovitch, vice president of McAfee, DongA Ilbo Interview dated on July 9, 2011)

Capacity Development Workshop on Public Information Management Depending on the response, the attack is continuing to change KISA Response Vaccine distribution via Effective defense against DDoS Attack Hard disk damage prevention guideline Change in Attack Method Block zombie PC’s access to Destroy HDD just after the infection HDD is destroyed even at safe mode booting

Capacity Development Workshop on Public Information Management Nationwide Cyber Security Alert System

Capacity Development Workshop on Public Information Management DDoS Nation Wide Anti-DDoS System DDoS Detection system IX(Internet eXchange) Backbone Router A ISPB ISP Ix RuterIX Router Legitimate Traffic IDC, Internet Biz company, Internet Service Provides, etc IDC, Internet Biz company, Internet Service Provides, etc DDoS Attack Traffic Block or Detour Conn ected Block or Detour DDoS Attack Traffic Normal Traffic Conn ected

Capacity Development Workshop on Public Information Management DDoS Cyber Shelter

Capacity Development Workshop on Public Information Management Cyber Cure System for Infected PCs 1.Collect infected PC IP Target website DDoS attack 2. Operate cyber cure System ISP 3. Popup window for notification 4. Dedicated vaccine Zombie PC Stop! Cure zombie PC Cyber cure system Download dedicated vaccine

Capacity Development Workshop on Public Information Management Q&A

Capacity Development Workshop on Public Information Management THANK YOU!