APCERT Activity Updates
Asia Pacific Computer Emergency Response Team

Yurie Ito
JPCERT/CC
Joint Workshop on Security 2008, Tokyo26 March 2008
Copyright © 2008 APCERTAbout APCERT & CSIRTz

APCERT (Asia Pacific Computer Emergency Response Team) isa coalition of the forum of CSIRTs*.
CSIRT*: Computer Security Incident Response TeamInternational Collaboration Model for Information Security

Copyright © 2008 APCERTAPCERT Member Teams
21 Teams / 15 Economies, as of March 2008
Full Members (14)General Members (7)zAusCERT – Australiaz
BP DSIRT – Singaporez
BKIS – VietnamzBruCERT – Negara Brunei Darussalamz
CCERT – People's Republic of Chinaz
CNCERT/CC – People's Republic of China z CERT-In – Indiaz
GCSIRT – Philippinez
HKCERT/CC – Hong Kong, Chinaz
NUSCERT – Singaporez
IDCERT – Indonesia
z SLCERT – Sri Lankaz
JPCERT/CC – Japanz
KrCERT/CC – Koreaz
VNCERT – Vietnamz
MyCERT – Malaysiaz
PH-CERT – Philippinez
SingCERT – Singaporez
ThaiCERT – Thailandz
TWCERT/CC –Chinese Taipeiz
TWNCERT – Chinese TaipeiCopyright © 2008 APCERTObjectiveszzzzzzz

Encourage and support regional and international
cooperation on information security in the Asia
Pacific region;
Jointly develop measures to deal with large-scaleor regional network security incidents;
Facilitate info sharing and technology exchange,
including info security, computer virus andmalicious code, among its members;
Promote collaborative research and developmenton subjects of interest to its members;
Assist other CSIRTs in the region to conduct
efficient and effective computer emergency
response capability;
Provide inputs and/or recommendations to help
address legal issues related to info security andemergency response across issues regionalboundaries;
Organize annual conference to raise awarenesson computer security incident
responses
Copyright© 2008 APCERTandtrends.

Emergency
Response

ComputerSecurityAwarenessAPCERT DRILL 2007

Timeline
0700 Lord of Armageddon (LoA) declare
0700 Lord of Armageddon (LoA) declarecyber war on Beijing Olympics
cyber war on Beijing Olympics
 0900 Co-ordinated botnet attacks from AP 0900 Co-ordinated botnet attacks from AP
region causing media sites and government
region causing media sites and government
portals inaccessible
portals inaccessible
 1100 Spam containing malware that turns
 1100 Spam containing malware that turns
PC into zombies were filling up mailboxes inPC into zombies were filling up mailboxes inAP economies
AP economies 1300 Border and Core routers crashing 1300 Border and Core routers crashingand rebooting frequently. 0-day exploit for
and rebooting frequently. 0-day exploit for
Cisco IOS rumoured to be available. Cisco
Cisco IOS rumoured to be available. Cisco
promise to release fix in a few hours
promise to release fix in a few hours
 1430 – Cisco released patch and advisory 1430 – Cisco released patch and advisoryon critical IOS vulnerability
on critical IOS vulnerability 1600 – Security analysts announced that 1600 – Security analysts announced thatbots automagically removed themselves, nobots automagically removed themselves, nomore attacks
more attacks
Copyright © 2008 APCERTObjectivesz

Establish a common platform for Internet threat
monitoring, information sharing & analyses in AsiaPacific region.

z

Promote collaboration among CSIRT in Asia-Pacificregion by using the common platform.

zEnhance capability of global threat analyses byincorporating 3D Visualization features to the commonplatform(1)Internet Monitoring
ProjectOverview(2) Information Sharing & Analysis(3) Coordination

Country A

Center Unit
Country B
Sharing monitoring data&Collaborative Analyses

Country C

System Overview
Cyber Space(IP address)

Geographical Space(Country-based)

The Internet
Worms

SensorBotnets

SensorMalicious Packets

Sensor(Dark IP’s)

EncryptedTransfer
SQL

httpDBm n128,may,13,05:40:11,111/tcp
m n128,may,13,10:12:55,111/tcp
m n128,may,13,10:13:04,111/tcp
m n128,may,13,12:35:05,111/tcp
m n128,may,13,12:35:05,111/tcp,
m n128,may,13,20:25:27,111/tcp,
m n128,may,13,20:25:27,111/tcp,
m n128,may,13,20:25:30,111/tcp,

Event Log
Records

Event Log
Database(1)(1) Secure
Secure(2)(2) 24×7
24×7 Operation
Operation(3)(3) Robust
RobustAnalysis &3D Visualization
Server

3D Visualization Client(on GoogleEarth)(1)(1) Trend
Trend Analysis
Analysis(2)(2) Statistical
Statistical Analysis
Analysis(3)(3) Threat
Threat Screening
Screening(1)(1) FlexibleFlexible View
View
(2)(2) Manipulation
Manipulation(3)(3) 3D
3D Animation
Animation

Capabilities of 3D Visualization SystemAnimation Controller(Time-Slide Bar)

View Navigation
Controller

Threat Status(Arrows)(1) Color: Threat Level(2) Width: Traffic

Threat data
(1) Traffic(2) ZScore(3) Std.Dev

APCERT Recent Activity Updates 1z

PacINET 2007, 14-22 August 2007, Solomon Islands
http://www.picisoc.org/tiki-index.php?page=PacInet+2007
zz

AusCERT interacted with Pacific Islanders’, who are willing to start discussions
about CERT capability developments.

ITU Regional Workshop, 28-31 August 2007, Hanoi, Vietnam
http://www.itu.int/ITU-D/cyb/events/2007/hanoi/zz

MyCERT, AusCERT, CNCERT/CC, JPCERT/CC attended the “Regional Workshop
on Frameworks for Cybersecurity and Critical Information InfrastructureProtection”.
Indonesia and Mongolia are also willing to discuss CERT capability developments.

Copyright © 2008 APCERTAPCERT Recent Activity Updates 2z

APEC TEL 36, 21-26 October 2007, Santiago, Chile
http://www.apectel36.cl/prontus_apectel/site/edic/base/port/home.htmlzz

CNCERT/CC, JPCERT/CC, KrCERT/CC, MyCERT attended the “Workshopon Cyber Security Exercises” and shared experience of the APCERTIncident Handling Drill.
CNCERT/CC is forwarding a project on "Guide on Policy and TechnicalApproaches Against Botnets".
* As a Security Expert Group, APCERT provides recommendation, situation awareness and trend to AP regional intergovernmental
initiatives. APCERT is a General Guest of APEC TEL.

z

CICTE (Inter-American Committee Against Terrorism)
5-9 November 2007, Miami, USA
http://www.cicte.oas.org/Rev/EN/Events/Cyber_Events/II_Workshop_MIAMI-2007.aspz

MyCERT attended and had interactions with OAS (Organization of AmericanStates) and APWG (Anti-Phishing Working Group).
Copyright © 2008 APCERTAPCERT Recent Activity Updates 3z

Visiting New CSIRTs in Asia Pacificzz

APCERT SC members visited several CSIRTs and relevant
government departments, to support and cooperate in incident
handling and information sharing.

Other International Relationships & Engagements
zz

FIRST Director & SC Member: Yurie Ito, JPCERT/CC
APEC TEL SPSG Deputy Convenor: Jinhyun Cho, KrCERT/CC

Copyright © 2008 APCERTAPCERT Recent Activity Updates 4z

APCERT AGM & Conference 2008, 10-12 March 2008
http://apcert2008.hkcert.org/InterContinental Grand Stanford Hong Kong
Hosted by HKCERTzz

The 7th APCERT Annual Conference, providing a valuable
opportunity for APCERT Teams, CSIRTs of the AP region, andother closely related organizations to come together and sharedifferent experiences, perspectives and best practices on
information security.
Most importantly, it provides an opportunity to help improve
Internet security throughout the Asia Pacific and beyond, throughcross border cooperation and information sharing.
Copyright © 2008 APCERTThank you
APCERT General Contact:
apcert-sec@apcert.org
APCERT Website:
http://www.apcert.org

Copyright © 2008 APCERT