Andrei Bozeanu is a cybersecurity researcher working as private security consultant but also as a consultant for Romanian National CERT, CERT-RO. Some of his research work became what is known today as Dekeneas, an Orange Fab startup company. Dekeneas is designed to identify the most elusive and hard to detect cyber attacks, having the attacking vector through the web, such as watering hole, drive-by exploitation or in-browser cryptojacking. These attacks are hard to detect because of HTTP protocol specifics, such the fact that there are different implementations of it which makes it very hard for security tools to comply with all of these different implementations, and also, due to the Traditional detection methods are totally useless against this type of attacks, creating the need for a different approach. Dekeneas is based on a innovative technology which uses machine learning to classify DOM elements in the HTML page as malicious or benign, and proceed with further detailed analysis on those flagged as malicious.

LIONS AT THE WATERING HOLE – ONE YEAR AFTER

Dekeneas was started in October 2018, and in one year of activity we managed to successfully identify a series of web attacks, including some major campaigns that made the news recently, such as the Magecart campaign that infected 18,000 websites all over the world and the attacks discovered and analysed by Google Threat Analysis Group, which made use of iPhone, Android and Windows 0day exploits to infect the victims. This presentation will sum up one year of activity and technically dissect the HTML implants used in some of these campaigns, to better understand how watering holes work and how can we protect against them.