Город никогда не спит / The City Never Sleeps
•
1 gostou•3,344 visualizações
Ведущие: Денис Макрушин и Юрий Наместников Среди прочих мер, направленных на защиту корпоративной инфраструктуры от злоумышленников, специалисты по безопасности полагаются на строгую политику ограничения доступа приложений к интернету. Защита информационных систем предприятия основана главным образом на принципе «запретить все, что не разрешено». Тем временем угрозы безопасности притаились в недрах корпоративных сетей и ждут, когда у сотрудников закончится рабочий день. Мы расскажем вам, как с наступлением темноты киберпреступники используют Notepad, AutoCAD, Tomcat и SQL Server в своих целях.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Destaque
Destaque (20)
Semelhante a Город никогда не спит / The City Never Sleeps
Semelhante a Город никогда не спит / The City Never Sleeps (20)
Mais de Positive Hack Days
Mais de Positive Hack Days (20)
Último
Último (20)
Город никогда не спит / The City Never Sleeps
- 1. THE CITY NEVER SLEEPS Yury Namestnikov, Denis Makrushin Global Research and Analysis Team, Kaspersky Lab
- 2. YOU MIGHT THINK I’M BULLETPROOF. BUT I’M NOT.
- 3. “WHITE” TECHNOLOGIES FROM THE “WHITE” SIDE 3
- 4. 4Security Analyst Summit 2016
- 5. 5Security Analyst Summit 2016
- 7. 30 000 connection attempts in 94 countries
- 8. 8 EXPLOTING, DLL HIJACKING… PFFFFFF…
- 9. 9 IE IS A “BUG” OF THE ERP SYSTEM
- 11. 4th of December 06:36 am hxxp://202.68.226.59:8000/x/tm/one.zip
- 12. 12 MALWARE.MOF
- 13. 13 OH MY… SQL! Malicious Link Application http://222.186.15.215:8080/Autoexed.bat sqlservr.exe http://222.186.34.180/svshost.exe sqlservr.exe http://104.149.7.196:8080/SB1.exe sqlservr.exe http://216.99.150.246:8080/12.exe sqlservr.exe http://121.41.40.17:8888/SB360.exe sqlservr.exe http://198.13.101.85:8080/CleanReg.bat sqlservr.exe http://117.21.226.123:8080/Seymtre.exe sqlservr.exe http://173.82.68.163:8080/1.exe sqlservr.exe http://45.34.1.179:8080/Cacrk.exe sqlservr.exe http://65.49.70.102:8080/q.exe sqlservr.exe http://65.49.70.102:8080/ccavwm.exe sqlservr.exe http://104.217.216.190/svshost.exe sqlservr.exe http://121.139.205.78:8888/svchost.exe sqlservr.exe http://45.34.1.160:8000/SB360.exe sqlservr.exe http://45.34.1.152:8080/1.exe sqlservr.exe http://198.13.119.36:8080/svshost.exe sqlservr.exe http://27.50.136.47/SB360.exe sqlservr.exe http://61.147.103.178:8082/get.exe sqlservr.exe seg:http://61.147.103.178:8082/get.exe sqlservr.exe http://222.186.34.147:8080/serr.exe sqlservr.exe http://122.226.223.77:8080/btc530.exe sqlservr.exe http://boxpro.cn/boxpro/publishdownload/TecJwI Y_GG?fileName=look2015.pif sqlservr.exe Malicious Link Application http://173.254.203.93:8080/MFMS.exe sqlservr.exe http://www.k1001.com/rj/good.exe sqlservr.exe http://111.73.45.126:8080/123.exe sqlservr.exe http://appdown.keyipin.com/ss.exe sqlservr.exe http://23.91.15.215:8080/Autoexec.exe sqlservr.exe http://150.242.248.132/Serve.exe sqlservr.exe http://manhack.f3322.net:8080/mysql.exe sqlservr.exe http://123.249.45.183:8000/SB360.exe sqlservr.exe http://114.37.133.174:8080/1.exe sqlservr.exe http://60.172.229.71:8080/he.exe sqlservr.exe http://1.93.10.119/3.0.exe sqlservr.exe http://60.190.216.240:8080/123.exe sqlservr.exe http://222.186.21.119:8888/get.exe sqlservr.exe http://119.29.85.139:8888/wincj.exe sqlservr.exe http://120.132.178.112/360Save.exe sqlservr.exe http://114.80.100.14:8080/svshost.exe sqlservr.exe http://222.186.34.136:81/server.exe sqlservr.exe http://123.249.56.196/1.exe sqlservr.exe http://222.186.56.17:8080/server.exe sqlservr.exe http://115.29.39.152:8080/svshost.exe sqlservr.exe http://199.83.94.67:8080/1.exe sqlservr.exe http://104.149.88.222:8080/winlogon.exe sqlservr.exe http://112.124.58.140:8080/server.exe sqlservr.exe http://222.186.34.196/1.exe sqlservr.exe http://119.90.45.98:8080/erloseo.exe sqlservr.exe http://113.10.242.125:8080/SB360.exe sqlservr.exe http://58.221.47.41:8080/1.exe sqlservr.exe http://216.99.158.168:8080/jiujie.exe sqlservr.exe
- 16. 16Security Analyst Summit 2016
- 17. 17 ILL DLL HIJACKING Mr. Insecure Load Library: “One my DLL could pwn you without talking with DEP, ASLR and Whitelist”
- 18. 18
- 19. APT STORY: FROM CHINA WITH LOVE DLL… 19 Very popular technique among chinese APT groups: PlugX, Emissary Panda, Wonknu and etc • 7 zip archive • Legit signed EXE • With malicious DLL • Legit file name • Legit name of a function. But this function contains malicious code
- 20. …DLL HIJACKING 20 Example: • Dll can do two things: xor and load code in the memory • In the same directory there is a *.url file with xored backdoor code
- 23. “KNOWLEDGE IS A BEST FORM OF PROTECTION”. DUDE, GIVE ME THIS “BEST FORM”! 23
- 24. 24Security Analyst Summit 2016 SILVER BULLET
Notas do Editor
- Right now on the other side of the world, where it is night system administrators go to sleep and mafia wakes up in the infrastructure of organizations. So good Day Ladies and Gentlemen, we are Yury Namestnikov and Denis Makrushin here to let you open your eyes for a moment during this game and see who plays for mafia.
- It seems firewalls and whitelists must protect the corporate systems from all kinds of mafia. We allow only trusted and known applications to enter the internet. The phenomenon of malicious software in corporate networks should be killed by using only trusted applications, isn’t?
- … И вот почему: технологии мирных жителей – белые списки, прочно закрепились в индустрии в различном виде (fw, App control, etc). Принцип их действия просто до безобразия, однако технологическая реализация остается нетривиальной: контролировать попадание нежелательных элементов из «темной» стороны не всегда оказывается возможным…
- But When night falls, the mafia wakes up. In childhood, Who spilled a flour in the house to catch a thief? We did, but in our childhood It didn’t work, but It works now.
- The 3 main criteria to devide ghost false positive. If you are whitelisted app, If you are trusted app with certificates, and if you like to execute a malicious code. Come here! As a result a lot trusted apps came from shadow: in their memory we found a lot of unexpected code.
- So we actually analyzed only the applications that were never suspected to do malicious things. Using the statistics of connections to known malicious servers and attempts to download known malware.
- We found 30 000 connection attempts of the sort from computers and servers located in 94 countries during 2015. Actually there were a lot of servers that runs trusted applications like database engines, application servers, web servers and etc.
- We was waiting for trivial Exploiting or DLL hijacking attempts, but we impressed that the first things, that we spotted: various applications contains Internet Explorer engine as a result SAPlogon or ERP module try to connect on website with exploit kits
- For example, 1c is a erp system popular in Russia with ie engine in one of modules. And you know how it was: Internet explorer + angler exploit kit
- Unexpected functionality is one thing, but then we found what we’ve expected: injection in ERP system to get credit card data processed by connected point of sale terminal. Data goes to mafia in real time.
- Now let’s look at servers behavior. Let’s start from web servers and java application servers. Here is the example: 4th od December 20015 6 am. Tomcat version 8 downloading and executing malicious script using standard windows tools. What kind of files?
- MOF- files are a containers of wmi modules, execute encoded vbs scrips using csscript.exe. They don’t use any suspicious exe files. By the way in some rare cases we found out that the mof are downloaded and executed by Microsoft SQL Server. But it was not one anomaly wit ms sql.
- Or look on the behavior. It is not a normal, because my sql server downloads a lot of files. Malicious files. Should we still think it plays for good guys?
- Most of the files are DDoS botnets components – we found several different spices – all made in China. They can do different kind of ddos attacks: but certainly they are very effective, cause servers have broadband connection. MySQL is not better than MS. Once again, we see DDoS bots and even signed ones.
- Moreover there are some intersections in names of modules and C2 servers in MS SQL and My SQL infections: we suspect it’s one mafia group. And there actually is even bigger problem with both these software. First, we have spotted that the bad guys are interested in data stored on these servers. Than it became clear that they can manipulate this data by installing remote control tools on the servers.
- Ok, we now know which payload they use on the servers. But how do they get in? First of all it’s classic of genre when you try to exploit remote code execution vulnerability on the server-software
- Secondly – dll hijacking technique. It’s used since 2010 but still actual even at this time, because it can bypass Whitelisting-based protection. Third – unlicensed software with trojans or software downloaded not from trusted sources.
- История про ботнет, который исползует UDF MySQL для DDoS Впервые Chikdos был обнаружен специалистами польского CERT (Computer Emergency Response Team) в 2013 году. Тогда троян ориентировался на компьютеры под управлением Windows и Linux. Зараженные машины становились частью ботнета, использовавшегося для проведения DDoS-атак. Кампания двухлетней давности затрагивала и сервервы, но тогда вредонос устанавливали на них едва ли не вручную, после брутфорса, направленного на SSH, и подбора логина-пароля. Новая версия малвари атакует уже не пользовательские машины, а MySQL серверы. Эксперты Symantec полагают, что они были выбраны в качестве мишени неслучайно: скорее всего, злоумышленников привлекает тот факт, что MySQL серверов много (это вторая по популярности СУБД в мире) и их полоса пропускания позволяет весьма эффективно использовать их для атак. Атака начинается с внедрения вредоносной UDF (user-defined function), которая выступает загрузчиком (Downloader.Chikdos), то есть загружает на сервер фактическую малварь, в классификации Symantec получившую название Trojan.Chikdos.A. Эксперты пишут, что пока не совсем ясно, каким образом злоумышленники подсаживают на сервер вредоносные UDF. Чаще всего, такое осуществляют при помощи с SQL-инъекций, автоматического сканирования и использования червей. Будучи выполнена, UDF скачивает на зараженный сервер основного вредоноса (малварь хранится на скомпрометированных сайтах). И, в некоторых случаях, загрузчик также создает и прописывает в систему нового пользователя.
- Where the victims are located? TOP countries are: India, Russian Federeation, China. Companies in these counties are known for usage software from untrusted recourses and not updating installed software. Victims are from different economic sectors: it, computer games…
- We analyzed a lot of different payloads: ddos bots, downloaders, backdoors and remote control tools. Most traces lead to China: language checks in the code, forgotten debug strings and most of C2 are located on chineese dynamic dns servers.
- Найти все приложения, уделить им пристальное внимание в трафике.
- As a result we still have a rhetorical question: does silver bullet exist? Teoretically yeah, it does – Default Deny, whitelisting, exploit prevention technologies. But practically, we still have a human factor: you need to use this technologies correctly.