Finding Foes and Yourself with Latency Trilateration
Lorenzo Cococcia explores offensive physical geolocation, using network latency trilateration across distributed sensors to locate adversary C2 servers.
Summary
The Limits of Traditional IP Geolocation
Conventional IP geolocation databases rely on static registrar records and ISP routing tables, which adversaries easily obscure using VPNs, proxies, and bulletproof hosting providers.
Physical Laws and Latency Trilateration
Lorenzo Cococcia introduces latency trilateration in cybersecurity, measuring the physical propagation delay of network packets across multiple globally distributed sensors to calculate precise geographic positions.
Applications in Threat Intelligence and Malware Evasion
Trilateration enables researchers to accurately locate hidden command-and-control servers, while allowing red-team implants to verify their own geographic environment before detonating.
Practical Constraints and Countermeasures
The author discusses physical speed-of-light constraints in fiber optics, network routing jitter, and defensive techniques to confound latency-based localization.
Related talks
Blacks in Cybersecurity Village·37 min
Malachi Walker
Introduces Domain Intelligence Analysis, leveraging proactive DNS artifacts and registration telemetry to detect adversary infrastructure before public IOC disclosures.
Creator Stage·14 min
Mehmet Onder Key · Furkan Aydogan
Demonstrates low-cost OSINT techniques leveraging vessel tracking, port data, and open intelligence to detect anomalous behavior and maritime security risks.
Main Stage·33 min
Ben Folland
Demonstrates methodologies for intercepting and decrypting command-and-control traffic between active malware implants and adversary servers.