Cybersec Tech 7

How much does Google about us?
340 request to Google servers from android phone per 24 hrs
https://adssettings.google.com/authenticated
https://myactivity.google.com/
https://takeout.google.com/settings/takeout?pli=1
87% of income comes from advertisement

Packages and malware
.docx
Part items (workbook.xml, sheetn.xml, other files )
Content type items (description of)
extraction of the document container:

unzip OpenDocument-v1.2.odt 

.doc has a “filesystem” inside a container
.doc profiling tools

• OfficeMalScanner 
• DFView (oldschool microsoft OLE structure viewer)
• ..
  

.pdf

• The original look of the document
• “trustworthy and secure” – actually not
• Flash, javascript and more
• exploit kits

peedf 
with peedf it is possible to see all the hidden parts
Origami framework
pdf-xraylite
pdf-parser

HTML filter bypass

browser allow any 

How to approach  infected computer
Preparation (backup copies of data) 
If ransomware: pay, https://www.nomoreransom.org/cs/index.html, antiransomware
Trojanized computer part of Botnet
Wireshark, network traffic
SNAFU LOOP

OpenIoC
Scripting 
Suspicious Behaviour

LAB4
whois command in unix