A Broad View of the Ecosystem of Socially Engineered Exploit - PowerPoint PPT Presentation

A Broad View of the Ecosystem of 
 Socially Engineered Exploit Documents Stevens Le Blond, Cédric Gilbert, Utkarsh Upadhyay, Manuel Gomez Rodriguez and David Choffnes

Challenges with measuring targeted attacks • Low-volume, socially engineered messages that convince 
 specific victims to install malware 2

Challenges with measuring targeted attacks • Low-volume, socially engineered messages that convince 
 specific victims to install malware • Three studies published at Usenix Security’14 • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.) 2

Challenges with measuring targeted attacks • Low-volume, socially engineered messages that convince 
 specific victims to install malware • Three studies published at Usenix Security’14 • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.) 2

Challenges with measuring targeted attacks • Low-volume, socially engineered messages that convince 
 specific victims to install malware • Three studies published at Usenix Security’14 • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.) ? 2

Challenges with measuring targeted attacks • Low-volume, socially engineered messages that convince 
 specific victims to install malware • Three studies published at Usenix Security’14 • Tibet (Hardy et al.), Middle East (Marczak et al.), and Uyghur (Le Blond et al.) ? Measuring targeted attacks 
 is a long and difficult process 2

Can Anti-Virus Aggregators (VirusTotal) help? 3

Can Anti-Virus Aggregators (VirusTotal) help? 3

Can Anti-Virus Aggregators (VirusTotal) help? 3

Can Anti-Virus Aggregators (VirusTotal) help? 3

VirusTotal Statistics (one week) 4

VirusTotal Statistics (one week) 4

VirusTotal Statistics (one week) 4

VirusTotal Statistics (one week) 4

VirusTotal Statistics (one week) 4

VirusTotal Statistics (one week) 4

VirusTotal as a vantage point 
 to measure targeted attacks 5

VirusTotal as a vantage point 
 to measure targeted attacks 5

VirusTotal as a vantage point 
 to measure targeted attacks 5

VirusTotal as a vantage point 
 to measure targeted attacks 5

Research questions • Do targeted groups upload exploit documents to VirusTotal? • Can we scale our analysis to hundreds of thousands of samples? • How do attacks faced by different groups compare with each other? • Is VirusTotal used by other actors such as attackers and researchers? 6

Outline 1) Methodology 2) Analysis of exploit documents 3) Future work 7

Exploit document infection process Exploit Decoy Malware 8

Exploit document infection process Exploit Decoy Malware 8

Exploit document infection process Exploit Decoy Malware 8

Exploit document infection process Exploit Decoy Malware 8

Data acquisition and processing workflow 9

Data acquisition and processing workflow 9

Can we scale our analysis to hundreds of thousands of samples? Acquisition 257,635 10

Can we scale our analysis to hundreds of thousands of samples? Acquisition 257,635 10

Can we scale our analysis to hundreds of thousands of samples? Acquisition 257,635 143 10

Data acquisition and processing workflow 11

Can we scale our analysis to hundreds of thousands of samples? Detection 257,635 143 12

Can we scale our analysis to hundreds of thousands of samples? Detection Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 IX 2007 X 2010 XI 257,635 143 12

Can we scale our analysis to hundreds of thousands of samples? Detection Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 IX 2007 X 2010 XI 257,635 143 12

Can we scale our analysis to hundreds of thousands of samples? Detection Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 IX 2007 X 2010 XI 257,635 143 - 219,794 -29 37,841 114 12

How many versions of 
 readers do we have to test? CDF # affected versions 13

How many versions of 
 readers do we have to test? CDF # affected versions Few exploits are portable across all reader versions 13

Data acquisition and processing workflow 14

Can we scale our analysis to hundreds of thousands of samples? Extraction Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 IX 2007 X 2010 XI - 219,794 -29 257,635 143 37,841 114 15

Can we scale our analysis to hundreds of thousands of samples? Extraction Office w/ driver Acrobat w/ driver Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -29 257,635 143 37,841 114 15

Can we scale our analysis to hundreds of thousands of samples? Extraction Office w/ driver Acrobat w/ driver Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -29 257,635 143 37,841 114 15

Can we scale our analysis to hundreds of thousands of samples? Extraction Office w/ driver Acrobat w/ driver Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -29 -34,026 257,635 143 -11 37,841 114 3,815 103 15

Data acquisition and processing workflow 16

Can we scale our analysis to hundreds of thousands of samples? Analysis Acrobat w/ driver Office w/ driver Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -29 257,635 143 -34,026 -11 37,841 114 3,815 103 17

Can we scale our analysis to hundreds of thousands of samples? Analysis Acrobat w/ driver Office w/ driver Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 257,635 -34,026 37,841 3,815 17

Can we scale our analysis to hundreds of thousands of samples? Analysis Malware Acrobat w/ driver sandboxes Office w/ driver Translators Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -34,026 37,841 3,815 17

Can we scale our analysis to hundreds of thousands of samples? Analysis Malware Acrobat w/ driver sandboxes Office w/ driver Translators Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -34,026 37,841 3,815 17

Can we scale our analysis to hundreds of thousands of samples? Analysis Malware Acrobat w/ driver sandboxes Office w/ driver Translators Office w/ EMET Acrobat w/ EMET SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 SP0 SP1 SP2 SP3 0.0 1.0 2.0 3.0 4.0 5.0 VIII 2003 VIII 2003 IX 2007 IX 2007 X 2010 X 2010 XI XI - 219,794 -34,026 2,447 3,705 37,841 3,815 17

Outline 1) Methodology 2) Analysis of exploit documents 3) Future work 18

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys) 19

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys) 19

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys) 19

Do targeted groups upload exploit documents on VirusTotal? Likely targets (inferred from decoys) VirusTotal gives visibility into attacks targeting numerous groups 19

How attacks faced by different groups compare with each other? Languages of decoys Fraction 20

How attacks faced by different groups compare with each other? Languages of decoys Fraction 20

How attacks faced by different groups compare with each other? Languages of decoys Fraction 20

How attacks faced by different groups compare with each other? Languages of decoys Fraction 20

How attacks faced by different groups compare with each other? Languages of decoys Fraction Decoys tend to use the official language of the groups they target 20

How attacks faced by different groups compare with each other? Malware targeting 21

How attacks faced by different groups compare with each other? Malware targeting 21

How attacks faced by different groups compare with each other? Malware targeting 21

How attacks faced by different groups compare with each other? Malware targeting 21