five days in the life of a cms brute forcing malware
play

FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna - PowerPoint PPT Presentation

Sep 29, 2022 •169 likes •605 views

FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna Shirokova Veronica Valeros Cognitive Threat Analytics Cognitive Threat Analytics @ AnnaBandicoot @ verovaleros WHO WE ARE? Anna Veronica Threat Researcher Threat Researcher

  1. FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna Shirokova Veronica Valeros Cognitive Threat Analytics Cognitive Threat Analytics @ AnnaBandicoot @ verovaleros

  2. WHO WE ARE? Anna Veronica • Threat Researcher • Threat Researcher Cognitive Threat Analytics, Cognitive Threat Analytics, Prague, Czech Republic Prague, Czech Republic • Co-founder of MatesLab Hackerspace in Argentina • Core member of Security Without Borders (@swborders)

  3. ACKNOWLEDGEMENT Sebastian García: http://ar.linkedin.com/in/sebagarcia https://www.researchgate.net/profile/Sebastian_Garcia6 https://stratosphereips.org/category/dataset.html @eldracote

  4. WHAT THIS TALK IS ABOUT?

  5. WHAT THIS TALK IS NOT ABOUT?

  6. POPULAR TARGET ~5% of the Internet websites built with WordPress

  7. AUTHENTICATION METHOD /wp-login.php /xmlrpc.php /administrator/index.php ` ?option=com login /?q=user /?q=user/login /xmlrpc.php

  8. BRUTE FORCING ATTACK Trying different credentials until the correct one found

  9. SIMPLE AUTOMATED WORKS

  10. SATHURBOT

  12. MODULAR BOTNET • backdoor • downloader • web crawler • brute forcer

  13. URL PATTERN OF THE INFECTED TORRENTS

  14. INFECTION

  15. CRAWLER

  16. SEARCH ENGINES QUERY http://www.bing.com/search?q= makers %20 manage %20 manual

  19. p,k,c,a r,j,g,q t,e,d,o f,c,m,t g,g,k,o d,p,b,r k,n,q,b k,o,j,l n,q,j,i g,d,j,e e,k,s,m l,l,j,l p,p,o,c o,c,l,l f,h,b,s r,c,s,h p,l,b,b q,i,d,t o,i,k,e l,h,t,b g,g,k,q d,d,g,p d,j,b,a j,f,h,m o,l,i,g g,q,b,t g,i,o,l d,k,l,m t,c,g,p n,t,m,k j,s,j,i e,k,o,e c,g,h,d r,i,e,b g,e,n,t e,q,d,i

  20. WORDPRESS FRAMEWORK CHECK http://[domain_name]/wp-login.php

  21. BRUTE FORCE MODULE

  22. ATTACK WITH XML-RPC POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 231 Host: www.venuscursos[REDACTED].com.br <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodName> wp.getUsersBlogs </methodName> <params> <param><value>venuscursos[REDACTED]</value></param> <param><value> magic </value></param> </params> </methodCall>

  23. STANDARD CREDENTIAL’S COMBO User name[domain_name]Password POST /wp-login.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 232 Host: www.sanat[REDACTED].org log=sanat[REDACTED] & pwd=magic &wp-submit=Log+In&testcookie=1

  24. NON STANDARD CREDENTIAL’S COMBO User name[special_name]Password POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 227 Host: www.vodokanal[REDACTED].ru <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodName>wp.getUsersBlogs</methodName> <params> <param><value> vdknl2017admin </value></param> <param><value> swimming </value></param> </params> </methodCall>

  25. ENUMERATION SCAN Requesting numerical user IDs to reveal usernames

  26. MORE THAN ONE TRY & PASSWORD TIME:02:17:11.265496 TIME:06:15:32.848090 POST /xmlrpc.php HTTP/1.1 POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Connection: Keep-Alive Accept: */* Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Gecko/20100101 Firefox/40.1 Content-Length: 226 Content-Length: 226 Host: www.raduapostol[REDACTED].ro Host: www.raduapostol[REDACTED].ro <?xml version="1.0" encoding="iso-8859-1"?> <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodCall> <methodName>wp.getUsersBlogs</methodName> <methodName>wp.getUsersBlogs</methodName> <params> <params> <param><value> raduapostol[REDACTED] </value></param> <param><value> raduapostol[REDACTED] </value></param> <param><value> mokito </value></param> <param><value> system </value></param> </params> </params> </methodCall> </methodCall>

  28. TOP 20 PASSWORDS TRIED

  29. TRIES TO BRUTE FORCE QUORA: GET http://www.quora.com/wp-login.php GIPHY: 
 GET http://giphy.com/wp-login.php SNAPCHAT: 
 GET http://snapchat.com/wp-login.php TWITTER: 
 GET http://twitter.com/wp-login.php SOUNDCLOUD : 
 GET http://soundcloud.com/wp-login.php SHOPIFY: 
 GET http://www.shopify.com/wp-login.php

  30. MOST COMMON TLDS TARGETED gTLD com 1552601 org 139582 net 102798 info 23288 xyz 16076 eu 14732 ccTLD de 68078 uk 59681 nl 45528 cc 45419 cn 36527 au 35410 it 32400 br 28158 pl 26216 fr 25319 ca 24766 ru 21802 es 17372 se 14284

  31. INFRASTRUCTURE

  32. DIFFERENT VERSIONS 2015 SHA-256: 28f1cb771de05473b0c1cc2c21f3c437dc50cc6ab3c4c15ceefb21ea6e6b95fa URL: asdas2qw2aswasasdasd.in/wordpress.php?g=4bc87ed0379a11e5acf3080027535333&b=0&v=1 2016 SHA-256: - URL: edasdfdfwedzsczxczxcawaw1.xyz/wordpress.php?g=5f64c9690c7911e68d7c00155d0a1117&b=0&v=1 2017 SHA-256: 20ae9e5f8f26635c627afce5eaeeb749af459f55138c80f29da9d787ecc38f92 URL: forcedsharetraktor.live/cocos/driver.php?g=e71847216cbc11e7b4e0080027e1e38a&v=3

  33. LINKED EMAIL URL: asdas2qw2aswasasdasd.in/wordpress.php?g=4bc87ed0379a11e5acf3080027535333&b=0&v=1

  34. CONNECTION SEQUENCE 3rd C&C 4th C&C 1st C&C uromatalieslave.space megafreecontentdelivery.club forcedsharetraktor.live 217.23.6.215 217.23.6.155 2nd C&C DNS TXT Record zeusgreekmaster.xyz Connectivity check google.com Brute forcing Crawling

  35. DOMAINS FORCE MASTER asdkjnasdiu3kadsomiljsd force .xyz zeusgreek master .xyz forced sharedtraktor.live apollogreek master .xyz new forced domainsherenow.club jhasdkjanskdjnahsn master .xyz justanother forced domain.xyz jhasdkjanskdjnahsn master .info SLAVE BOOM uromatalie slave .space boom boom boomway.xyz mr slave lemmiwinkstwo.xyz bada boom mail.xyz artemiso slave .xyz bada boom sharetracker.xyz crazyfucking slave mudak.xyz

  36. DOMAINS OTHER TORRENT TRACKERS mega freecontentdelivery.com ed asd fdfwedzsczxczxcawaw1.xyz mega freeshare tracke r.club mozilladownloadshare space .xyz blablablablabla traffic .xyz jhkabmasdjm2 asd u7gjaysgdd asd .xyz webdatasource traffic .xyz asxdq2sax ads dawdq2sasaddfsdfsf4ssfuckk.xyz happynewyear traffic .xyz asxdq2sax ads dawdq2sasaddfsdfsf4ssfuck.xyz web traffic success.xyz kj askd hkaudhsnkq3uhaksjndkud3 asd s.xyz freemplemedia tracker .xyz updateserviceshared space .xyz sharetorrentsonline tracker .xyz adq3asd asd a3adfkunssssss. space coolfastcheap tracker .link khkh asd 89u8ojaodsijdkjaksd.link coolfastcheap tracker .xyz kjh askd jhkuhk2qwskjakjshdkjh123kjs2.in mega newblablablan.in asd as2qw2aswasasd asd .in kjanskduhi8 asd askjdkn.in

  37. DETECTION

  38. VERTICAL BRUTE FORCING

  39. HORIZONTAL BRUTE FORCING

  40. WHY IT IS IMPORTANT?

  41. QUESTIONS? Sathurbot pcap https://stratosphereips.org/category/dataset.html Anna Shirokova Veronica Valeros ashiroko@cisco.com vvaleros@cisco.com @AnnaBandicoot @verovaleros

  42. THANK YOU!

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu and Roberto Perdisci Presented by : Ashwag Altayyar CISC850 Cyber Analytics Bare-metal Analysis Environments Forcing the malware sample to run

388 views • 21 slides
Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE

Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE

A RIZONA S TATE U NIVERSITY Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE U NIVERSITY Common Types of Attacks Phishing Malware SQLi XSS MITM DoS Brute-force &amp;

858 views • 55 slides
#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive

#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive

#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive been tracking data about myself for 11 years. Find what I use at anomalily.net/life-stack#qs (almost) Each year* I compile an annual report

484 views • 29 slides
Automatic Translation Error Analysis or how to brute-force through exponential complexity

Automatic Translation Error Analysis or how to brute-force through exponential complexity

Automatic Translation Error Analysis or how to brute-force through exponential complexity algorithms by abusing beam search Mark Fishel, T ATI Feb. 5, 2011, Theory Days at Nelijrve Outline Approaches to MT evaluation Automatic analysis

418 views • 18 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

568 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your

FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your

FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your Absence too !! Make I&amp;I the Genie for your family! PRESENTATION Policy that suits every pocket MONEY BACK ILLNESS PLAN CRITICAL PLAN

289 views • 3 slides
MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions Brute force algorithms Divide and Conquer What is the brute force approach to Calculate the n th Fibonacci number? 1. Compute the n th power

387 views • 14 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger

Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger

Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger Forcing and its applications retrospective workshop Introduction The method of side conditions, invented by Todorcevic, describes a style of forcing in

710 views • 54 slides
Kindergarten Orientation 2020-2021 Please post your questions through the link on Slide 21 .

Kindergarten Orientation 2020-2021 Please post your questions through the link on Slide 21 .

Kindergarten Orientation 2020-2021 Please post your questions through the link on Slide 21 . Plans for Academic Year 20-21 are taking shape... s We believe Kindergarten IS... Meet the Cassingham elementary kindergarten team! Nurturing

339 views • 21 slides
Holography and DEWSB at the LHC Veronica Sanz Boston University with Johannes Hirn and Adam

Holography and DEWSB at the LHC Veronica Sanz Boston University with Johannes Hirn and Adam

Holography and DEWSB at the LHC Veronica Sanz Boston University with Johannes Hirn and Adam Martin (Yale) hep-ph/0712.3783 + work in progress What we know: Strong interactions are difficult! Rescaled QCD models are ruled out: S

284 views • 26 slides
Lt. Leighton and Lt. Shawna Miller Lt. Leighton Miller US Navy Operation Desert Storm

Lt. Leighton and Lt. Shawna Miller Lt. Leighton Miller US Navy Operation Desert Storm

Lt. Leighton and Lt. Shawna Miller Lt. Leighton Miller US Navy Operation Desert Storm Lt. Shawna Miller US Navy Reserve OHSU Dallas Det V Aunt &amp; Uncle of Makenzie &amp; Brayton Dewell Mark Goodwin US Marine

830 views • 51 slides
SixTrack / BOINC Updates Veronica Berglyd Olsen General SixTrack Meeting Thursday, 13 June 2019

SixTrack / BOINC Updates Veronica Berglyd Olsen General SixTrack Meeting Thursday, 13 June 2019

SixTrack / BOINC Updates Veronica Berglyd Olsen General SixTrack Meeting Thursday, 13 June 2019 Already Implemented Updates Issues with Previous Versions Fixes Made Previous BOINC releases of A BOINC linked SixTrack will now SixTrack

604 views • 5 slides
Encouraging STEM Students to Become Teachers: Summer Internships and Community Engagement

Encouraging STEM Students to Become Teachers: Summer Internships and Community Engagement

Encouraging STEM Students to Become Teachers: Summer Internships and Community Engagement Courtney Garside, Veronica Lawrence, Darci Meiners, Abigail Moninghoff Do Now: Make your own license plate Choose 7 characters (numbers,

478 views • 13 slides
The diphoton excess as a gravity mediator of Dark Matter Veronica Sanz (Sussex) IC HEP seminar,

The diphoton excess as a gravity mediator of Dark Matter Veronica Sanz (Sussex) IC HEP seminar,

The diphoton excess as a gravity mediator of Dark Matter Veronica Sanz (Sussex) IC HEP seminar, May 2016 Outline Challenges for Run2 The diphoton excess Models for the diphoton A spin-two candidate The excess and DM

894 views • 63 slides
Validity of Selection Procedures By: Maria Ananchenko, Sarah Bassett, Veronica Carrillo, Joyce

Validity of Selection Procedures By: Maria Ananchenko, Sarah Bassett, Veronica Carrillo, Joyce

Validity of Selection Procedures By: Maria Ananchenko, Sarah Bassett, Veronica Carrillo, Joyce Reyes, Julianne Storck THE STRATEGIC VALUE OF SELECTION PRACTICES: ANTECEDENTS AND CONSEQUENCES OF FIRM-LEVEL SELECTION PRACTICE USAGE YOUNGSANG

700 views • 42 slides
Modern Version Control with Git Ilan Biala (ibiala@andrew.cmu.edu) Aaron Perley

Modern Version Control with Git Ilan Biala (ibiala@andrew.cmu.edu) Aaron Perley

98-174 S17 Modern Version Control with Git Ilan Biala (ibiala@andrew.cmu.edu) Aaron Perley (aperley@andrew.cmu.edu) https://www.andrew.cmu.edu/course/98-174/ Why should you take this course? Version control software is an essential part of

224 views • 21 slides

More recommend