Behaviors and Patterns of Rogue Hosting Providers

Explore the behaviors and patterns of rogue hosting providers in this 39-minute conference talk from the Hack In The Box Security Conference. Delve into the critical role hosting providers play in enabling online businesses globally, while also being exploited by cybercriminals for ransomware, phishing, and other attacks. Learn about the challenges posed by legitimate-but-abused and bulletproof hosters, particularly relevant to The Netherlands with its major hosting infrastructures. Discover how threat intelligence efforts can identify and combat illegal and malicious content on the Internet. Examine the cyber threat intelligence cycle, including stakeholder identification, collection, processing, analysis, and dissemination. Gain insights into the Dutch hosting space and the multi-layered approach needed to address abused hosting providers. Understand the technical perspective on large-scale threat detection and threat intelligence using proven collection, analysis, and correlation techniques.

Intro
Cyber Threat Landscape
Categories of Hosting Providers
Threat Intelligence Cycle
Threat Intel Ecosystem Focus Areas
Requirements
Our stakeholders
Collection
Umbrella Investigate Intel Production Cycle
Processing
Autonomous System Number (ASN)
Analysis
Leaf (Stub) ASN or leaf ASNs chain
Indicator: Offshore Business Registration
Anonymous Payment Methods
Helping customers to maintain operations
Sample Rogue Hosters with a Dutch footprint (April 2018)
Dissemination
Law enforcement: Cross Jurisdictional Business Model
Law enforcement: Taking Down Bad Content
Law Enforcement Recommendations
Security Community Recommendations
Policy makers: Recommendations
Hosting Community Recommendations
Summary
References
Additional Related Work