1. 1 Israeli Internet Hacking Analysis for 2000 Hank Nussbacher hank@interall.co.il Internet Society of Israel Conference Tel Aviv, Israel, March 4, 2001

2. 2 Israeli Internet Hacking Analysis for 2000 Preamble lThe word hacking is used to mean cracking systems lRaw data: incident reports and Excel spreadsheet won’t be made available so don’t ask for it! lNames listed in this presentation have not been changed so as to not protect the innocent

3. 3 Israeli Internet Hacking Analysis for 2000 From where does the data come? lMy name registered on most Israeli IP blocks as contact - hank@isoc.org.il l 192.114.0.0/16, 192.115.0.0/16, 192.116.0.0/16, 192.117.0.0/16, 192.118.0.0/16 lUsers report incidents to cert@cert.ac.il l Firewall logs, Jammer, BlackICE lUsers report incidents to contact name for.il domain lMy estimate is that only 50% of incidents reach me (other than for IBM -> AT&T)

4. 4 Israeli Internet Hacking Analysis for 2000 How many incidents reported? lHow many incidents reported? l 1999: 2592000: 385 lHow many incidents reported that involved Israelis hacking foreign sites? l 1999: 2382000: 272 lHow many incidents reported that involved foreigners hacking Israeli sites? l 1999: 102000: 99 lHow many incidents reported that involved Israelis hacking Israeli sites? l 1999: 112000: 14

5. 5 Israeli Internet Hacking Analysis for 2000 Monthly Distribution

6. 6 Israeli Internet Hacking Analysis for 2000 From which ISPs? lOnly those that had more than 10 incidents recorded lAT&T has all incidents recorded - since I am recorded as contact for their IPs l the other ISPs are underrecorded

7. 7 Israeli Internet Hacking Analysis for 2000 Which domains are being hacked lMost attacked sites: l home.com (15) l llnl.gov (22) l ornl.gov (10) l cw.net (9) l renater.fr (8) l rr.com (7) l vt.edu (7)

8. 8 Israeli Internet Hacking Analysis for 2000 Are the attacks successful? l13% of reported attacks in 1999 are successful l28% of reported attacks in 2000 are successful l most are site defacements lWhich ISP has the most successful hackers? l Internet Zahav

9. 9 Israeli Internet Hacking Analysis for 2000 What were the most popular attacks in 1999? lPort scans - 32% lTelnet attempts - 11% lNetbus and Back Orifice - 10% lDoS - 8% l Smurf, Mail bombing, WinNuke, SYN flooding lRPC attacks - 5%

10. 10 Israeli Internet Hacking Analysis for 2000 What were the most popular attacks in 2000? lSite defacements - 25% l only 2 out of 94 site defacements happened before Rosh HaShana lPort scans - 21% lNetbus, Sub-7, Hacka’Tack and Back Orifice - 17% lFTP scans - 6% lTelnet attempts - 5% lDoS - 4% l Smurf, Mail bombing, WinNuke, SYN flooding

11. 11 Israeli Internet Hacking Analysis for 2000 Site defacements lFirst recorded site defacement - most.gov.il - April 23, 2000 lSecond recorded site defacement - webgate.co.il - June 27, 2000 lThird recorded site defacement - tel-aviv.gov.il - Aug 29, 2000 lOctober 3 - start of massive site defacements

12. 12 Israeli Internet Hacking Analysis for 2000 Site defacements - part II lLast 3 months l 57 - co.il l 27 - ac.il l 4 - org.il l 1 - k12.il l 1 - gov.il l 1 - net.il l Total - 88 site defacements lOn December 29, 80+ sites defaced by Gforce Pakistan - #1 defacer group in the world

13. 13 Israeli Internet Hacking Analysis for 2000 Site defacements - part III lMany other countries with many more site defacements l Brazil - 683 l UK - 234 l Mexico - 207 lTo see more details: l http://www.attrition.org/mirror/attrition/months.html

14. 14 Israeli Internet Hacking Analysis for 2000 Site defacements - part IV

15. 15 Israeli Internet Hacking Analysis for 2000 Site defacements - part V

16. 16 Israeli Internet Hacking Analysis for 2000 Which IPs are the worst hackers? l192.115.216.131-159 l Jan 2 - Sept 30, 2000 l 33 reported incidents l Netbus, BO, Sub-7 scans to mainly.com &.net l belongs to AT&T l192.116.226.252 l Jan 10 - July 5, 2000 l 16 reported incidents l SNMP, ICMP, port scans to many.gov sites l belongs to Internet Zahav

17. 17 Israeli Internet Hacking Analysis for 2000 Lessons learned lIsraeli ISPs don’t want to handle the problem l too much work and effort involved legal - lawyers don’t understand hacking, courts give lenient sentences police - overworked, lack of public interest l too few skills to handle the problem Good security sysadmins earn over 20K NIS/month l lose of revenue if customer leaves lSurvival of the fittest l Arab hackers doing us a favor in weeding out the sites with poor server security