Evade IDS/IPS Systems Using Geospatial Threat Detection
Ryan Trost details iDS/IPS systems are becoming more and more advanced and geocoding is adding another layer of intelligence to try and defend against a company's vulnerabilities.
Summary
Architecture and Background
IDS/IPS systems are becoming more and more advanced and geocoding is adding another layer of intelligence to try and defend against a company's vulnerabilities. Learn how to evade complex geospatial threat detection countermeasures.
Vulnerability Analysis
Most crackers use zombie machines to launch professional attacks...but zombies even leave geographic fingerprints that are easily picked up by pattern recognition algorithms. Learn how to take professional attacks to the next level.
Exploitation and Demonstrations
Ryan Trost is the Director of Security and the Data Privacy Officer at Comprehensive Health Services where he oversees all the organization's security and privacy decisions. He teaches several Information Technology courses including Ethical Hacking, Intrusion Detection and Data Visualization at Northern Virginia Community College which allows him to continue his technical interests.
Remediation and Defensive Strategies
In his spare time he is working to cross-pollinate Network Security, Geographical Information Systems (GIS) and Data Visualization and is considered a leading expert in geospatial intrusion detection techniques. Ryan participated as a RedTeamer in the first annual Collegiate Cyber Defense Competition (CCDC) and fielded a team of students this past year. Ryan has been a Senior Security Consultant for several government agencies before transitioning over to the private sector. In 2005, Ryan received his MS degree in Computer Science from George Washington University where he developed his first geospatial intrusion detection tool. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·17 min
Stefan Frei · Thomas Duebendorfer · Gunter Ollmann · Martin May
Stefan Frei and Thomas Duebendorfer explores exploiting a hundred-million hosts before brunch at DEF CON 16, examining academic-research and practical defenses.
Main Stage·39 min
Fabian Fabs Yamaguchi · FX
Fabian "Fabs" Yamaguchi & FX: New ideas for old practices - Port-Scanning improved How fast a port-scan can be is largely dependent on the performance of the network in question.
Main Stage·48 min
David Weston · Tiller Beauchamp
David Weston and Tiller Beauchamp explores re: trace at DEF CON 16, examining academic-research and practical defenses.