Fighting malware and spam

Profiling hackers: real data, real experiences, wrong myths

Raoul Chiesa UNICRI/ISECOM

Imagine being able to preview an attacker's next move based on the traces left on compromised machines. That's the aim of the Hacker's Profiling Project (HPP), an open methodology that hopes to enable analysts to work on the data (logs, rootkits and any code) left by intruders from a different point of view, providing them with a profiling methodology that will identify the kind of attacker and therefore his modus operandi and potential targets.

This paper will cover the following:

• InfoSec - Information Security - what does it mean?
• Cybercrime: how history can help us
• Profiling the enemy: looking into the hacker's world
• HPP: the Hacker's Profiling Project
• What has changed?
• References & books you should read