EKFiddle extends the Fiddler web debugger to help analysts dissect malicious traffic.

1. EKFiddle: a framework
to study Exploit Kits
Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst
BSides Vancouver March 13-14 2017
2017

2. Agenda
•Quick primer on Exploit Kits and drive-by downloads
•Tools to view and capture malicious traffic
•Introducing EKFiddle for the Fiddler web debugger
•Researching and cataloging EKs with EKFiddle

3. Exploit Kits: a quick definition
An exploit kit is a set of tools designed to facilitate the
exploitation of client-side vulnerabilities most commonly
found in browsers and their plugins in order to execute
malicious code on end users’ machines.

4. Exploit Kits: basic flow
Landing
page
Exploits Payload

5. Exploit Kits: some names
•Angler EK (defunct)
•Nuclear Pack (defunct)
•Astrum EK
•RIG EK
•Neutrino EK
•Sundown EK
•Magnitude EK

6. Drive-by campaigns: traffic to exploit kits
•Compromised websites
•EITest, Pseudo-Darkleech
•Malvertising
•[ insert various ad networks here ]

7. Compromised sites and Exploit Kits
Legitimate site
Gate
(optional) Exploit Kit Malware

8. Malvertising and Exploit Kits
Malicious ad Exploit Kit Malware
Gate
(optional)

9. Tools for traffic analysis
•Full packet capture (tcpdump, WireShark, etc.)
•Security Suites (Security Onion)
•IDS/IPS (Suricata)
•HTTP/S (Fiddler, Charles, etc.)

10. What about EK traffic only?
•Full packet captures are nice but not required
•Web debugger easier to inspect/replay web traffic
•Personal preference?

11. EKFiddle
•Based on Telerik’s Fiddler Web Debugger
•Multi OS compatibility via C# CustomRules
•Extends Fiddler’s ContextAction
•Adds support for custom EK regexes

12. The standard Fiddler UI

13. Extend Fiddler’s UI with EKFiddle

14. Set up EKFiddle: Install Fiddler
•Download and install the latest version of Fiddler from
http://www.telerik.com/fiddler
•For Mac and Linux, you will need to set up the Mono
framework first
http://www.telerik.com/blogs/introducing-fiddler-for-os-x-beta-1
http://www.telerik.com/blogs/fiddler-for-linux-beta-is-here

15. Download EKFiddle (CustomRules.cs)
•Download/clone CustomRules.cs from the GitHub page
https://github.com/malwareinfosec/EKFiddle
• Windows (7/10)
C:Users[username]DocumentsFiddler2Scripts
• Ubuntu
/home/[username]/Fiddler2/Scripts/
• Mac
/Users/[username]/Fiddler2/Scripts/

16. Change the default Text Editor (optional)
(Tools -> Telerik Fiddler options -> Tools)

17. Change the default scripting language to C#
(Windows only: Tools -> Telerik Fiddler options -> Scripting)

18. Finalize EKFiddle’s installation

19. Get traffic captures
• Malware Traffic Analysis (PCAPs) http://www.malware-traffic-analysis.net/
• Broad Analysis (PCAPs) http://www.broadanalysis.com/
• PacketTotal (PCAPs) https://www.packettotal.com/
• Malware Don’t Need Coffee (SAZ) http://malware.dontneedcoffee.com/
• VirusTotal (need API) https://www.virustotal.com/

20. Import traffic captures

21. Main features: ContextAction items
•A list of useful ‘shortcuts’
•Designed to collect IOCs and artifacts
•Inspect each session and create signatures

22. Check Host (pDNS, Whois) on VT

23. Check IP (Geo, pDNS) on VT

24. Extract IOCs

25. Extract artifacts

26. Main features: Regular expressions
•Regex matching in 3 different ways:
•URL patterns (URLRegexes.txt)
•Source code patterns (SourceCodeRegexes.txt)
•Server Headers patterns (HeadersRegexes.txt)

27. Build URL Regex (paste from clipboard)

28. Build source code Regex (paste from clipboard)

29. View/edit Regexes

30. Save Regexes
•One signature per line: [Name of sig] TAB [regex]

31. Run Regexes against traffic

32. Visualize results
•Each matched session is colour coded and commented
•Malware type (Landing Page, Flash Exploit, Malware
Payload) is ‘guessed’ automatically

33. Demo

34. Recap
•EKFiddle extends the Fiddler web debugger for EK analysis
•Get it here: https://github.com/malwareinfosec/EKFiddle
•Questions? @jeromesegura

35. Thank You!