Cyber espionage - Tinker, taylor, soldier, spy

1. BARRY COATESWORTH

2. Tier 3 Hacktivist Tier 2 Cyber crime Tier 1 Cyber espionage The Adversary

3. The Adversary Intellectual property secrets Financial Economic gain Hacktervist Motivator Expertise Ideology political change Cybercriminal Nation State Vandalism Theft Military / political dominance

4. The kill Chain

5. Hacktavism SQL Injection Phishing Weak Authentication Account / DNS Hijacking

6. Hacking and exposure Gaining unauthorized access to and publicly exposing in plain view on the Internet large amounts of confidential data with the goal of causing monetary and reputational damages to the targeted entity. Distributed denial-of-service (DDoS) usually infected with a Trojan or other form of malware to flood a targeted system, usually one or more web servers of a website DDoS attacks are the hacktivist’ cyber attack weapon of choice. • They do not require actual hacking knowledge or skill. • Many “off-the-shelf” tools are available right on the Internet Doxing Gathering and exposing valuable personal information of public figures such as politicians and celebrities to the benefit of the hacktivist, and to react or take action in a way that favours the hacktivist’ ideology. Hacktavism

7. Hacktavism Anonymous Attack Count HTTP: SQL Injection (Benchmark) 1 HTTP: SQL Injection (Benchmark) 1 HTTP: SQL Injection (SELECT) 2 HTTP: SQL Injection (SELECT) 1 HTTP: SQL Injection Evasion SQL Comment Terminator 1 HTTP: SQL Injection (UNION) 1 HTTP: SQL Injection Evasion SQL Comment Terminator 1 HTTP: SQL Injection (Boolean Identity) 2 HTTP: SQL Injection Evasion Inline SQL Comment 1 HTTP: SQL Injection (Boolean Identity) 1 HTTP: SQL Injection (Boolean Identity) 1 HTTP: SQL Injection (Boolean Identity) 2

8. The top five cybercrime specialties, courtesy of the FBI, are: · Coders who write malware and exploit data theft tools · Vendors who trade stolen data, malware kits and footprints into compromised networks · Criminal IT guys who maintain criminal IT infrastructure like servers and bulletproof ISPs · Hackers who seek and exploit application, system and network vulnerabilities · Fraudsters who create and social engineering ploys like phishing and domain squatting. • Botnet • Fast Flux Networks • Social Engineering • Denial-of-Service attacks • Skimmers • SPAM Cyber Crime

9. Cyber Crime Cybercriminals developed sophisticated crime ware kits (Zeus, Citadel, Eleonor, Phoenix) • Easy to use development tools • Service level agreements – CaaS (Crimeware as a Service) • Evasion and anti detection built in

10. Cyber Crime – going mobile Trend of the year: mobile banking Trojans 2013 was marked by a rapid rise in the number of Android banking Trojans Botnet targeting Android smartphone users who bank at financial institutions in the Middle East

11. Cyber Crime – going mobile In 2013 Cybercriminals made use of some exceptionally sophisticated methods to infect mobile devices. • Infecting popular websites - water holes. • Distribution via botnets by sending out text messages

12. Cyber Crime – going mobile

13. Pineapples? The warning comes in the light of a growing number of cyber attacks using personal information stolen through public Wi-Fi hotspots.

14. Pineapples?

15. Cyber Espionage 1998 – Moon light maze 2003 – Titan rain 2009 – operation aurora 2009 – Ghost net 2011 – Nightdragon 2011 – Operation shady rat (2006) 2012 – Red October (2007) 2012 – Elderwood project 2012 – Flame 2012 – Gauss (2009) 2012 – Shamoon 2014 – Mask 2014 – snake APT Cyber Warfare APT - Advanced Persistent Threat PTA - Persistent Targeted Attacks

16. Cyber Espionage

17. Kill Chain - Reconnaissance • Target is analyzed and scoped to identify potential attack vectors • Open source Intelligence: • Social media, conferences, company directories, public records • Public web site mapping • Server scanning and fingerprintingg

18. Asymmetric Warfare Corporate laptop Home server desktop PerimeterHostbased direct attack Firewall IPS indirect attack indirect attack Firewall IPS Anti virus Browser URL Block Anti virus Browser URL Block

19. Kill Chain - Delivery Common Attack vectors: • Common vulnerability (e.g. SQL injection) • Zero-day exploits • USB keys • Insider threat • Physical access to devices • Interactive social engineering • “Spear Phishing”*

20. Spear Phishing From: Greg To: Jussi Subject: need to ssh into rootkit im in europe and need to ssh into the server. can you drop open up firewall and allow ssh through port 59022 or something vague? and is our root password still 88j4bb3rw0cky88 or did we change to 88Scr3am3r88 ? thanks

21. Waterholes Strategic Web Compromise (SWC)

22. • Backdoors implemented as Windows service • Usually “hide in plain sight” • Use a simple command set • Dwell time is a measure of time that an intruder has on the network • Takes on average 18 days to respond and remove an intrusion Kill Chain - Exploitation

23. Once inside a network, malware “beacons” out to a Command and Control (C2) servers • C2 servers are either compromised or rented • Traffic is usually HTTP, HTTPS or DNS and mimics common protocols Kill Chain - Command & Control

24. Covert channels - DNS tunnelling DNS TUNNELLING TOOLS OzymanDNS Dns2tcp Iodine Heyoka DNSCat NSTX DNScapy MagicTunnel, Element53, VPN-over-DNS (Android) VPN over DNS • DNS tunnels are commonly used to carry out covert file transfers, C&C server traffic and web browsing • Botnets can use DNS tunnelling to act as a covert channel, and these covert channels are very hard to detect Covert Storage Channels – Stenography, unused parts of packets Timing Covert Channels – Modulating resources and response time (accurate clock)

25. Covert channels - Stenography

26. • Attacker performs internal reconnaissance • User enumeration • Analysis and monitoring of host user activity • Dump of internal and external websites • Scan of connected systems • “Net use” and reverse shell commands • Password logging • Pass-the-hash* Kill Chain - Lateral Movement

27. Pass the hash • “Hash” refers to a cached credential • Usually not the “clear text” credential • Hash is treated as the actual credential internally by most systems • Then use hashes to move “laterally” through the network • Network/domain privileged account - Game over

28. Kill Chain - Exfiltration • Identifies targeted assets for exfiltration • Move data to Staging servers • Positions itself for persistent presence • Maintains hold of key high-privilege accounts • Remains resident on only a selection of systems

29. Nation states Juniper firewall implant Huawei firewall implant Cisco PIX firewall implant

30. Nation States Wireless exploit kit USB Covert ChannelPC hardware implant

31. Snake Back in 2008 an unknown malicious file was discovered and auto-classified as “Agent.BTZ” which infected US military networks. Reverse engineering showed that snake is a more advanced variant of Agent.BTZ. It is a rootkit using complex techniques for evading host defences utilising cover channels over Links to Red October and other cyber espionage campaigns

32. Geo political events

33. The Dark Side Dark net Deep web Dark market Malicious marketplace In 2001 • Deep Web was 400 to 550 times larger than the commonly defined World Wide Web. • The deep Web 7,500 terabytes of information compared to 19 terabytes in the surface Web. • Contained nearly 550 billion individual documents compared to the one billion of the surface Web. • More than 200,000 deep Web sites existed • Deep Web site is not well known to the Internet-searching public.

34. The Dark Side

35. The Dark Side To date, three main networks are used to grant anonymity on both the client and server side: TOR, I2P, and Freenet.

36. Dark market Tor .onion domains There are many different techniques in use, but Tor’s onion router network is probably the easiest one to get started with. The .onion domains are not part of the ICANN registry and will not resolve until you are running Tor. The combined effect leaves this form of Internet far beyond any kind of government control or regulation. I2P2 Network and .i2p Domains I2P works in a very similar way to Tor, although more flexible • Email • Anonymous websites • Blogging and forums • Website hosting • File sharing • Decentralized file storage

37. Dark Market Prices of Different Types of Goods Site name Address Type of good Cost Normalized Cost (US$) Cloned credit cards http://mxdcyv6gjs3tvt 5u.onion/products. html EU/US credit cards €40 US$54 NSD CC Store http://4vq45ioqq5cx 7 u32.onion EU/US credit cards US$10 US$10 Carders Planet http://wihwaoykcdzab add.onion/ EU/US credit cards US$60–150 US$60–150 HakPal http://pcdyurvcdiz66 qjo.onion/ PayPal accounts 1 BTC for US$1,000 US$126 for US$1,000 Onion identity http://abbujjh5vqtq7 7 wg.onion/ Fake IDs/passports €1,000–1,150 (ID) €2,500–4,000 (passport) US$1,352–1,555 (ID) US$3,380–5,400 (passport) U.S. citizenship http://ayjkg6ombrsah bx2.onion/silkroad/ home U.S. citizenship US$10,000 US$10,000 U.S. fake driver’s licenses http://en35tuzqmn4l o fbk.onion/ Fake U.S. driver’s license US$200 US$200 U.K. passports http://vfqnd6mieccqy iit.onion/ U.K. passports £2,500 US$4,000

38. Mapping the hidden services directory: Both TOR and I2P use a domain database built upon a distributed system known as a “DHT.” Social site monitoring: Sites like Pastebin are often used to exchange contact information and addresses for new hidden services Hidden service monitoring: Most hidden services to date tend to be highly volatile and go offline very often, maybe to come back online later under a new domain name Conclusion • Threats will continue to evolve • Security breaches are Inevitable • You need collaboration from people, process & technology • Visibility and detection are key differentiators – centralise security • Threat intelligence internal (system monitoring) and external threat landscape • Survival of the fittest - Share threat Intelligence with your peers • Continual awareness and education

39. Recap THANK YOU Reference/sources:

Cyber espionage - Tinker, taylor, soldier, spy

Cyber espionage - Tinker, taylor, soldier, spy

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados(20)

Destaque

Destaque(20)

Similar a Cyber espionage - Tinker, taylor, soldier, spy

Similar a Cyber espionage - Tinker, taylor, soldier, spy(20)

Último

Último(20)

Cyber espionage - Tinker, taylor, soldier, spy