HPW2012 - Examining Attacker Behavior On and Off-Line Using Social Science Research - Thomas J. Holt
Channel: The Honeynet Project
Date: 04/04/2012

The range of threats facing computer users and critical infrastructure is complex and continuously evolving. Attacks vary based on the target and skill level of the actor, ranging from publicly accessible malware that can be purchased on the open market to unique zero-day exploits created for a specific attack. Attackers also have varied motivations, including monetary gain to political ideologies. Though technical explorations provide insight into how to defend against these crimes, there is still a great deal that is unknown about the social world of hackers. This talk will provide an exploration of the motives, social structures, and dynamics that facilitate computer attacks around the world using real world examples. The presentation will examine the disparate on-line communities involved in the theft and sale of stolen data and malware, as well as the social networks and organizational composition of the marketplace. We will also discuss unique tools designed to automate the analysis and examination of these communities. In addition, we will present the findings from an international study of the factors that predict participation in politically motivated attacks against critical infrastructure and government targets. The findings will give unique insights into the role of patriotism, technological skill, and hacking in various forms of political attacks. In turn, this presentation will benefit computer security professionals, law enforcement, and the intelligence community by identifying the social dynamics that shape the hacker and attacker community across the globe.