A Broad View of the Ecosystem of Socially Engineered Exploit - - PowerPoint PPT Presentation

▶
a broad view of the ecosystem of socially engineered
SMART_READER_LITE
LIVE PREVIEW

A Broad View of the Ecosystem of Socially Engineered Exploit - - PowerPoint PPT Presentation

Sep 14, 2022 243 likes •1.11k views

A Broad View of the Ecosystem of Socially Engineered Exploit Documents Stevens Le Blond, Cdric Gilbert, Utkarsh Upadhyay, Manuel Gomez Rodriguez and David Choffnes Challenges with measuring targeted attacks Low-volume, socially

slide-1
SLIDE 1

A Broad View of the Ecosystem of
 Socially Engineered Exploit Documents

Stevens Le Blond, Cédric Gilbert, Utkarsh Upadhyay, Manuel Gomez Rodriguez and David Choffnes

slide-2
SLIDE 2

Challenges with measuring targeted attacks

  • Low-volume, socially engineered messages that convince 


specific victims to install malware 2

slide-3
SLIDE 3

Challenges with measuring targeted attacks

  • Low-volume, socially engineered messages that convince 


specific victims to install malware

  • Three studies published at Usenix Security’14
  • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.)

2

slide-4
SLIDE 4

Challenges with measuring targeted attacks

  • Low-volume, socially engineered messages that convince 


specific victims to install malware

  • Three studies published at Usenix Security’14
  • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.)

2

slide-5
SLIDE 5

Challenges with measuring targeted attacks

  • Low-volume, socially engineered messages that convince 


specific victims to install malware

  • Three studies published at Usenix Security’14
  • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.)

? 2

slide-6
SLIDE 6

Challenges with measuring targeted attacks

  • Low-volume, socially engineered messages that convince 


specific victims to install malware

  • Three studies published at Usenix Security’14
  • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.)

Measuring targeted attacks
 is a long and difficult process ? 2

slide-7
SLIDE 7

Can Anti-Virus Aggregators (VirusTotal) help?

3

slide-8
SLIDE 8

Can Anti-Virus Aggregators (VirusTotal) help?

3

slide-9
SLIDE 9

Can Anti-Virus Aggregators (VirusTotal) help?

3

slide-10
SLIDE 10

Can Anti-Virus Aggregators (VirusTotal) help?

3

slide-11
SLIDE 11

VirusTotal Statistics (one week)

4

slide-12
SLIDE 12

VirusTotal Statistics (one week)

4

slide-13
SLIDE 13

VirusTotal Statistics (one week)

4

slide-14
SLIDE 14

VirusTotal Statistics (one week)

4

slide-15
SLIDE 15

VirusTotal Statistics (one week)

4

slide-16
SLIDE 16

VirusTotal Statistics (one week)

4

slide-17
SLIDE 17

VirusTotal as a vantage point
 to measure targeted attacks

5

slide-18
SLIDE 18

VirusTotal as a vantage point
 to measure targeted attacks

5

slide-19
SLIDE 19

VirusTotal as a vantage point
 to measure targeted attacks

5

slide-20
SLIDE 20

VirusTotal as a vantage point
 to measure targeted attacks

5

slide-21
SLIDE 21

Research questions

  • Do targeted groups upload exploit documents to VirusTotal?
  • Can we scale our analysis to hundreds of thousands of samples?
  • How do attacks faced by different groups compare with each other?
  • Is VirusTotal used by other actors such as attackers and

researchers?

6

slide-22
SLIDE 22

Outline

1) Methodology 2) Analysis of exploit documents 3) Future work

7

slide-23
SLIDE 23

Exploit document infection process

Exploit Decoy Malware

8

slide-24
SLIDE 24

Exploit document infection process

Exploit Decoy Malware

8

slide-25
SLIDE 25

Exploit document infection process

Exploit Decoy Malware

8

slide-26
SLIDE 26

Exploit document infection process

Exploit Decoy Malware

8

slide-27
SLIDE 27

Data acquisition and processing workflow

9

slide-28
SLIDE 28

Data acquisition and processing workflow

9

slide-29
SLIDE 29

Can we scale our analysis to hundreds of thousands of samples? Acquisition

257,635 10

slide-30
SLIDE 30

Can we scale our analysis to hundreds of thousands of samples? Acquisition

257,635 10

slide-31
SLIDE 31

Can we scale our analysis to hundreds of thousands of samples? Acquisition

257,635 143 10

slide-32
SLIDE 32

Data acquisition and processing workflow

11

slide-33
SLIDE 33

Can we scale our analysis to hundreds of thousands of samples? Detection

257,635 143 12

slide-34
SLIDE 34

Can we scale our analysis to hundreds of thousands of samples? Detection

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

12

slide-35
SLIDE 35

Can we scale our analysis to hundreds of thousands of samples? Detection

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

12

slide-36
SLIDE 36

Can we scale our analysis to hundreds of thousands of samples? Detection

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

  • 219,794

37,841

  • 29

114 12

slide-37
SLIDE 37

How many versions of
 readers do we have to test?

# affected versions CDF 13

slide-38
SLIDE 38

How many versions of
 readers do we have to test?

Few exploits are portable across all reader versions # affected versions CDF 13

slide-39
SLIDE 39

Data acquisition and processing workflow

14

slide-40
SLIDE 40

Can we scale our analysis to hundreds of thousands of samples? Extraction

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

  • 219,794

37,841

  • 29

114 15

slide-41
SLIDE 41

Can we scale our analysis to hundreds of thousands of samples? Extraction

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 29

114 15

slide-42
SLIDE 42

Can we scale our analysis to hundreds of thousands of samples? Extraction

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 29

114 15

slide-43
SLIDE 43

Can we scale our analysis to hundreds of thousands of samples? Extraction

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

257,635 143

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 29

114

  • 34,026

3,815

  • 11

103 15

slide-44
SLIDE 44

Data acquisition and processing workflow

16

slide-45
SLIDE 45

Can we scale our analysis to hundreds of thousands of samples? Analysis

  • 29

114

  • 11

103

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

257,635

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 34,026

3,815 143 17

slide-46
SLIDE 46

Can we scale our analysis to hundreds of thousands of samples? Analysis

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

257,635

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 34,026

3,815 17

slide-47
SLIDE 47

Can we scale our analysis to hundreds of thousands of samples? Analysis

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 34,026

3,815

Translators Malware sandboxes

17

slide-48
SLIDE 48

Can we scale our analysis to hundreds of thousands of samples? Analysis

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 34,026

3,815

Translators Malware sandboxes

17

slide-49
SLIDE 49

Can we scale our analysis to hundreds of thousands of samples? Analysis

Acrobat w/ driver

0.0 1.0 2.0 3.0 4.0 5.0

Office w/ EMET Acrobat w/ EMET

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0

Office w/ driver

2003 2007 2010 VIII IX X XI SP0 SP1 SP2 SP3

  • 219,794

37,841

  • 34,026

3,815

Translators Malware sandboxes

2,447 3,705 17

slide-50
SLIDE 50

Outline

1) Methodology 2) Analysis of exploit documents 3) Future work

18

slide-51
SLIDE 51

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys)

19

slide-52
SLIDE 52

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys)

19

slide-53
SLIDE 53

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys)

19

slide-54
SLIDE 54

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys)

VirusTotal gives visibility into attacks targeting numerous groups 19

slide-55
SLIDE 55

How attacks faced by different groups compare with each other? Languages of decoys

Fraction 20

slide-56
SLIDE 56

How attacks faced by different groups compare with each other? Languages of decoys

Fraction 20

slide-57
SLIDE 57

How attacks faced by different groups compare with each other? Languages of decoys

Fraction 20

slide-58
SLIDE 58

How attacks faced by different groups compare with each other? Languages of decoys

Fraction 20

slide-59
SLIDE 59

How attacks faced by different groups compare with each other? Languages of decoys

Decoys tend to use the official language of the groups they target Fraction 20

slide-60
SLIDE 60

How attacks faced by different groups compare with each other? Malware targeting

21

slide-61
SLIDE 61

How attacks faced by different groups compare with each other? Malware targeting

21

slide-62
SLIDE 62

How attacks faced by different groups compare with each other? Malware targeting

21

slide-63
SLIDE 63

How attacks faced by different groups compare with each other? Malware targeting

21

slide-64
SLIDE 64

How attacks faced by different groups compare with each other? Malware targeting

From our dataset, malware families tend to target one or two countries 21

slide-65
SLIDE 65

Targeted regions

  • Chinese influence: Tibet, Uyghur, Taiwan
  • Asia Pacific: Myanmar, the Philippines, Thailand, and Vietnam
  • Asia Pacific, G20: India, Indonesia, Japan, and South Korea
  • Russia and USA
slide-66
SLIDE 66

How do attacks faced by different groups compare with each other? Malware targeting (cont.)

Fraction 23

slide-67
SLIDE 67

How do attacks faced by different groups compare with each other? Malware targeting (cont.)

Fraction 23

slide-68
SLIDE 68

How do attacks faced by different groups compare with each other? Malware targeting (cont.)

Fraction 23

slide-69
SLIDE 69

How do attacks faced by different groups compare with each other? Malware targeting (cont.)

Fraction 23

slide-70
SLIDE 70

How do attacks faced by different groups compare with each other? Malware targeting (cont.)

Malware found in multiple countries tend to target a confined region Fraction 23

slide-71
SLIDE 71

Outline

1) Methodology 2) Analysis of exploit documents 3) Future work

24

slide-72
SLIDE 72

Future work

  • Monitoring operator behavior of targeted malware
  • Analysis of evasions techniques, attackers operations,

and other attack vectors

  • Deploy on-premises and cloud-based services for

analysis of email attachments

25

slide-73
SLIDE 73

Take home messages

  • Complementary methodology to measure targeted attacks at scale
  • At-risk groups upload exploit documents to VirusTotal
  • Groups tend to be targeted with tailored decoys and malware families
  • Preliminary impact
  • Service deployed at email provider with 100,000+ users
  • Dataset and academic service available at https://slingshot.dedis.ch

26

slide-74
SLIDE 74

Frequently Asked Questions

stevens.leblond@epfl.ch

  • What are the observational biases of using VirusTotal?
  • What are the common types of malicious documents that you filtered out?
  • Why did you focus on exploit documents?
  • What precautions did you take to reduce false negatives?
  • Did you find indications of successful compromises?

27

slide-75
SLIDE 75
slide-76
SLIDE 76

What are the observational biases of using VirusTotal?

  • Coverage of targeted attacks is limited to those users and
  • rganizations who upload suspicious files
  • VirusTotal’s visibility is likely skewed towards users who work

with non-classified material

  • VirusTotal dataset offers a partial coverage of attacks where

individuals and NGOs are likely over-represented

slide-77
SLIDE 77

What are the most common malicious documents that you filtered out?


slide-78
SLIDE 78

Why did you focus on exploit documents?

  • Exploit documents are the most common vector of targeted

attacks identified by related work

  • Macros require additional user approval and can be forcibly

disabled by system administrators

  • Used against a range of targets including NGOs, news agencies,

and military, governmental and intelligence agencies

slide-79
SLIDE 79

What precautions did you take to reduce false negatives?

  • Reducing detection FNs
  • Cross validated EMET detection results with ground truth from the WUC dataset
  • 29/143 WUC documents were not detected by EMET, none of them FNs (16 Mac OS X, 9

wrong reader version, 2 password, and 2 without exploit)

  • Reducing extraction FNs
  • Manually inspected EMET detections that didn’t write files to disk
  • 29/4,259 documents detected by EMET did not write any files to disk, none of them FNs (6

crashes, 4 experimental, and 19 dysfunctional)

  • None of our analyses depends on the lack of evasion techniques in the malware

embedded in exploit documents

slide-80
SLIDE 80

Did you find indication of successful compromises?

  • Coded decoys based on their languages, the countries they refer to,

ethnic groups and dates, and whether they targeted specific individuals or organizations

  • Native speakers independently coded the documents written in

Russian, Traditional Chinese, Uyghur, and Vietnamese

  • Identified documents likely exfiltrated from compromised systems and

used as decoys in exploit documents targeting new, related victims

slide-81
SLIDE 81

Did you find indication of successful compromises (cont.)?

Fraction

slide-82
SLIDE 82

Did you find indication of successful compromises (cont.)?

Most groups were targeted with replayed decoys Fraction

slide-83
SLIDE 83

Did you find evidence of zero-day vulnerabilities?

  • We collaborated with a large AV vendor to determine the CVE tags of the exploited

reader vulnerabilities

  • The vendor scanned all the exploit documents that we detected and compared the

resulting CVE with the majority of VirusTotal tags

  • If the two CVEs matched, no further action was taken
  • Otherwise, the sample was analyzed manually
  • Samples for which the CVE release date was after the date of upload on VirusTotal

were examined manually to determine the CVE’s correctness

  • Based on this methodology, we didn’t find evidence of zero-day vulnerabilities
slide-84
SLIDE 84

Can you estimate the dates of the decoys?

  • We coded decoys according to their languages, the countries they refer to,

ethnic groups and dates, and whether they targeted specific individuals or

  • rganizations
  • Native speakers independently coded the documents written in Russian,

Traditional Chinese, Uyghur, and Vietnamese

slide-85
SLIDE 85

Can you estimate the dates of the decoys (cont.)?

Fraction

slide-86
SLIDE 86

Can you estimate the dates of the decoys (cont.)?

All groups exhibited decoys referring to a least one year in 2013-2015 Fraction