Estudo e análise dos grupos hackers que realizam desfiguração de páginas Web no Brasil

Abstract

Deface or defacement is a common form of attack on Web sites, where the content of the site is totally or partially replaced by an attacker that includes content such as, texts, images and signature forms of the attacker or manifestations offensive policies or social causes. The consequences of page defacement may vary between financial and moral, so investigating such actions and recording such occurrences are of great value to computer security as this can become preventive measures or early warning. It aims to investigate hacker groups aimed at the disfigurement of pages in Brazil, in order to extract intelligence information for the monitoring of these groups and patterns used in the disfigurations that allow the development of mechanisms of automatic detection and early warning systems. For this, the HTML of the sites that have been disfigured were collected and recorded in Zone-H, creating a database to be processed through text mining techniques. Through the processing of the HTML and the characterization of the database, it was possible to extract the main groups/individuals that operate in Brazil, characterizing the domains that these tend to attack. In addition it was obtained the schedules and days of the week that most occur disfigurement, was extracted from social networks and it was confirmed that the attacks are released by the networks. Individual and general standards were extracted, also obtaining the main terms used in the disfigurations. It is concluded that through the techniques used it was possible to highlight the groups/individuals that most act in Brazil and that from this it was possible to create a base of information that could be used by detection mechanisms and early warning system.