1. COLIN O’HANLON & NICK CIGANKO Sam Spade: Network Query Tool

2. What it does Used to identify malicious sites Operates on multiple platforms Basic network query  Ping for service  Finger  Tracert  Whois  Reporting abuse  DNS diagnostics

3. Why? Block unwanted network contact  Spam mail origins  Adversary working from a specific IP  Malicious host General network curiosity

4. Other Features Scanning addresses Crawling for info Browsing  Source Blacklist Check Timezone check

5. Ping Contact a host (local or networked) Number of pings Types to ping IP Ping URL Ping

6. Finger Retrieves IP address Works on sites, mail hosts

7. Tracert Network hub diagnostics GUI focus

8. Whois Network Diagnostics Address Registration Admins

9. Abuse Reporting Site’s abuse department Finds associtaed complaint center and provides email address  Usually “abuse@ ” format

10. How does this help me now? Scenario: You have a malicious website that wants to access your computer but you cannot exit the browser window, ect.  Finger the URL for the IP  As Windows Admin: Start>Control Panel>System and Security>Windows Firewall>Advanced Settings  Select the INBOUND RULES, then single click the NEW RULE on the right panel  Custom Rule>All Programs>Next> Add (enter the IP as a These remote IP address) > BLOCK CONNECTION > Next>Next>Finish  DEMO

12. Questions or Concerns?