1 Israeli Internet Hacking Analysis for 2000 Hank Nussbacher Internet Society of Israel Conference Tel Aviv, Israel, March 4, 2001

2 Israeli Internet Hacking Analysis for 2000 Preamble lThe word hacking is used to mean cracking systems lRaw data: incident reports and Excel spreadsheet won’t be made available so don’t ask for it! lNames listed in this presentation have not been changed so as to not protect the innocent

3 Israeli Internet Hacking Analysis for 2000 From where does the data come? lMy name registered on most Israeli IP blocks as contact - l /16, /16, /16, /16, /16 lUsers report incidents to l Firewall logs, Jammer, BlackICE lUsers report incidents to contact name for.il domain lMy estimate is that only 50% of incidents reach me (other than for IBM -> AT&T)

4 Israeli Internet Hacking Analysis for 2000 How many incidents reported? lHow many incidents reported? l 1999: : 385 lHow many incidents reported that involved Israelis hacking foreign sites? l 1999: : 272 lHow many incidents reported that involved foreigners hacking Israeli sites? l 1999: : 99 lHow many incidents reported that involved Israelis hacking Israeli sites? l 1999: : 14

5 Israeli Internet Hacking Analysis for 2000 Monthly Distribution

6 Israeli Internet Hacking Analysis for 2000 From which ISPs? lOnly those that had more than 10 incidents recorded lAT&T has all incidents recorded - since I am recorded as contact for their IPs l the other ISPs are underrecorded

7 Israeli Internet Hacking Analysis for 2000 Which domains are being hacked lMost attacked sites: l home.com (15) l llnl.gov (22) l ornl.gov (10) l cw.net (9) l renater.fr (8) l rr.com (7) l vt.edu (7)

8 Israeli Internet Hacking Analysis for 2000 Are the attacks successful? l13% of reported attacks in 1999 are successful l28% of reported attacks in 2000 are successful l most are site defacements lWhich ISP has the most successful hackers? l Internet Zahav

9 Israeli Internet Hacking Analysis for 2000 What were the most popular attacks in 1999? lPort scans - 32% lTelnet attempts - 11% lNetbus and Back Orifice - 10% lDoS - 8% l Smurf, Mail bombing, WinNuke, SYN flooding lRPC attacks - 5%

10 Israeli Internet Hacking Analysis for 2000 What were the most popular attacks in 2000? lSite defacements - 25% l only 2 out of 94 site defacements happened before Rosh HaShana lPort scans - 21% lNetbus, Sub-7, Hacka’Tack and Back Orifice - 17% lFTP scans - 6% lTelnet attempts - 5% lDoS - 4% l Smurf, Mail bombing, WinNuke, SYN flooding

11 Israeli Internet Hacking Analysis for 2000 Site defacements lFirst recorded site defacement - most.gov.il - April 23, 2000 lSecond recorded site defacement - webgate.co.il - June 27, 2000 lThird recorded site defacement - tel-aviv.gov.il - Aug 29, 2000 lOctober 3 - start of massive site defacements

12 Israeli Internet Hacking Analysis for 2000 Site defacements - part II lLast 3 months l 57 - co.il l 27 - ac.il l 4 - org.il l 1 - k12.il l 1 - gov.il l 1 - net.il l Total - 88 site defacements lOn December 29, 80+ sites defaced by Gforce Pakistan - #1 defacer group in the world

13 Israeli Internet Hacking Analysis for 2000 Site defacements - part III lMany other countries with many more site defacements l Brazil l UK l Mexico lTo see more details: l

14 Israeli Internet Hacking Analysis for 2000 Site defacements - part IV

15 Israeli Internet Hacking Analysis for 2000 Site defacements - part V

16 Israeli Internet Hacking Analysis for 2000 Which IPs are the worst hackers? l l Jan 2 - Sept 30, 2000 l 33 reported incidents l Netbus, BO, Sub-7 scans to mainly.com &.net l belongs to AT&T l l Jan 10 - July 5, 2000 l 16 reported incidents l SNMP, ICMP, port scans to many.gov sites l belongs to Internet Zahav

17 Israeli Internet Hacking Analysis for 2000 Lessons learned lIsraeli ISPs don’t want to handle the problem l too much work and effort involved legal - lawyers don’t understand hacking, courts give lenient sentences police - overworked, lack of public interest l too few skills to handle the problem Good security sysadmins earn over 20K NIS/month l lose of revenue if customer leaves lSurvival of the fittest l Arab hackers doing us a favor in weeding out the sites with poor server security