INTRUSION RESPONSE INTRUSION RESPONSE REALITY CHECK USA USA vs - - PDF document

▶
intrusion response intrusion response reality check usa
SMART_READER_LITE
LIVE PREVIEW

INTRUSION RESPONSE INTRUSION RESPONSE REALITY CHECK USA USA vs - - PDF document

Sep 05, 2022 222 likes •459 views

6/22/2010 Kris Harms Kris Harms Peter Silberman Peter Silberman INTRUSION RESPONSE INTRUSION RESPONSE REALITY CHECK USA USA vs vs Slovenia Slovenia 2 Score Update Score Update 1 6/22/2010 MANDIANT MANDIANT 3 APT and CDT

slide-1
SLIDE 1

6/22/2010 1

INTRUSION RESPONSE

Kris Harms Kris Harms Peter Peter Silberman Silberman

INTRUSION RESPONSE REALITY CHECK USA USA vs vs Slovenia Slovenia

  • Score Update

Score Update

2

slide-2
SLIDE 2

6/22/2010 2

MANDIANT MANDIANT

  • APT and CDT experts

APT and CDT experts

3

  • VISA Qualified Incident

VISA Qualified Incident Response Assessor (QIRA) Response Assessor (QIRA)

  • Located in

Located in

− Washington

Washington

− New York

New York Los Angeles Los Angeles

− Los Angeles

Los Angeles

− San Francisco

San Francisco

  • Services, software, and

Services, software, and education education

MANDIANT Intelligent Response MANDIANT Intelligent Response (MIR) (MIR)

  • Collect indicators

Collect indicators f th d f f th d f

4

from thousands of from thousands of agents agents

  • Index and search the

Index and search the results results

  • Live IR on thousands

Live IR on thousands

  • f systems at once
  • f systems at once
  • f systems at once
  • f systems at once
  • From disk images to

From disk images to registry keys to live registry keys to live memory forensics memory forensics

slide-3
SLIDE 3

6/22/2010 3

Introductions Introductions

  • Kris Harms

Kris Harms

− IR Engagement Lead Instructor

IR Engagement Lead Instructor

5

IR Engagement Lead, Instructor IR Engagement Lead, Instructor

  • Peter

Peter Silberman Silberman

− Researcher /

Researcher / Engineer, Co Engineer, Co-

  • Author

Author of

  • f

Memoryze Memoryze and Audit Viewer, Malware and Audit Viewer, Malware Analysis Team Analysis Team

Important note Important note

6

All information All information is derived is derived from MANDIANT observations from MANDIANT observations in non in non-

  • classified environments.

classified environments. Some information has been sanitized Some information has been sanitized Some information has been sanitized Some information has been sanitized to protect our clients’ interests. to protect our clients’ interests.

slide-4
SLIDE 4

6/22/2010 4

Agenda Agenda

  • Why Most Defenders Lose

Why Most Defenders Lose

  • A Few Malware Samples and Attacker

A Few Malware Samples and Attacker

7

A Few Malware Samples and Attacker A Few Malware Samples and Attacker Techniques Techniques

  • How to Win

How to Win

  • A Few Investigation Techniques That Work

A Few Investigation Techniques That Work Today Today

Why Defenders Lose Why Defenders Lose

8

VS VS

Your Company L H Logo Here

slide-5
SLIDE 5

6/22/2010 5

Why Defenders Lose Why Defenders Lose

9

Why Defenders Lose Why Defenders Lose

10

slide-6
SLIDE 6

6/22/2010 6

Why Defenders Lose Why Defenders Lose

GENERAL WINDOWS GENERAL WINDOWS KNOWLEDGE KNOWLEDGE YOUR NETWORK YOUR NETWORK CONFIGURATION CONFIGURATION

11

VS

Choose Your Theater

12

Why Defenders Lose Why Defenders Lose

Porn Sites Porn Sites

(sorry no pictures)

slide-7
SLIDE 7

6/22/2010 7

Well…It Depends Well…It Depends

  • Sample A

Sample A

− Obfuscated

Obfuscated shellcode shellcode

15

− Built in

Built in

  • Keylogger

Keylogger functionality functionality

  • Ability to download functionality

Ability to download functionality

  • Unknown functionality

Unknown functionality

− Compromised accounts?

Compromised accounts? Compromised accounts? Compromised accounts?

− Exploit component?

Exploit component?

− Pivot component?

Pivot component?

Hiding in plain sight Hiding in plain sight

16

slide-8
SLIDE 8

6/22/2010 8

Persistence Mechanism Persistence Mechanism

Of the APT backdoor Of the APT backdoor samples we have samples we have collected, 60% were collected, 60% were

3%

18

, persistent on the persistent on the targeted system. targeted system. Interestingly, of the Interestingly, of the non non-

  • persistent

persistent samples, almost a samples, almost a third used process third used process injection to injection to

27% 70% 3%

injection to injection to masquerade their masquerade their network traffic as network traffic as legitimate legitimate communication. communication. HKLM Run key Service Other

Persistence Persistence

  • sens.dll

sens.dll – – 5 byte persistence FTW 5 byte persistence FTW

  • services exe

services exe – bringing bringing cron cron back back

19

services.exe services.exe bringing bringing cron cron back back

slide-9
SLIDE 9

6/22/2010 9

The Legitimate The Legitimate DllMain DllMain() Function () Function

  • The code in the

The code in the DllMain DllMain() () function calls two library function calls two library functions: functions: DisableThreadLibraryCalls DisableThreadLibraryCalls() () and and GetProcessHeap GetProcessHeap() ()

20

GetProcessHeap GetProcessHeap() ()

722D12B9 ; int __stdcall _DllMain(struct HINSTANCE__ *, unsigned long, void *) 722D12B9 mov edi, edi 722D12BB push ebp 722D12BC mov ebp, esp 722D12BE mov eax, [ebp+fdwReason] 722D12C1 dec eax 722D12C2 jnz short loc_722D12D8 722D12C4 push [ebp+hLibModule] 722D12C7 call ds:__imp__DisableThreadLibraryCalls@4 722D12CD ll d i

GetProcessHeap@0

722D12CD call ds:__imp__GetProcessHeap@0 722D12D3 mov ?ghSensHeap@@3PAXA, eax 722D12D8 loc_722D12D8: 722D12D8 xor eax, eax 722D12DA inc eax 722D12DB pop ebp 722D12DC retn 0Ch 722D12DC DllEntryPoint endp

The Trojanized DllMain() Function The Trojanized DllMain() Function

  • Now code in the DllMain() only GetProcessHeap()

gets called.

  • The Call to DisableThreadLibraryCalls() has been

21

722D12B9 722D12B9 ; ; int int __ __stdcall stdcall _DllMain DllMain(struct

struct HINSTANCE__ *, unsigned long, void *) HINSTANCE__ *, unsigned long, void *)

722D12B9 722D12B9 mov mov edi edi, , edi edi 722D12BB 722D12BB push push ebp ebp 722D12BC 722D12BC mov mov ebp ebp, , esp esp 722D12BE 722D12BE mov mov eax eax, [ , [ebp+ ebp+fdwReason fdwReason] ] 722D12C1 722D12C1 dec dec eax eax 722D12C2 722D12C2 jnz jnz short loc_722D12D8 short loc_722D12D8 722D12C4 722D12C4 push [ push [ebp+ ebp+hinstDLL hinstDLL] ] 722D12C7 722D12C7

jmp jmp

loc_722D822D loc_722D822D

722D12C7 722D12C7 ; ; ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ 722D12CC 722D12CC db db 88h 88h

y () replaced by a mysterious jmp instruction.

722D12CD 722D12CD ; ; ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ 722D12CD 722D12CD loc_722D12CD: loc_722D12CD: 722D12CD 722D12CD call call ds:__imp__ ds:__imp__GetProcessHeap

GetProcessHeap@0

@0 722D12D3 722D12D3 mov mov ? ?ghSensHeap ghSensHeap@@3PAXA, @@3PAXA, eax eax 722D12D8 722D12D8 loc_722D12D8: loc_722D12D8: 722D12D8 722D12D8 xor xor eax eax, , eax eax 722D12DA 722D12DA inc inc eax eax 722D12DB 722D12DB pop pop ebp ebp 722D12DC 722D12DC retn retn 0Ch 0Ch 722D12DC 722D12DC DllEntryPoint DllEntryPoint endp endp

slide-10
SLIDE 10

6/22/2010 10

Would you know its bad? Would you know its bad?

Entry Location Description Publisher Image Path HKLM\System\CurrentC (Not verified) Internet c:\program files\iss\proventia

22

HKLM\System\CurrentC

  • ntrolSet\Services

VPatch (Not verified) Internet Security Systems, Inc. c:\program files\iss\proventia desktop\vpatch.exe HKLM\System\CurrentC

  • ntrolSet\Services

MakoNT (Not verified) Internet Security Systems, Inc. c:\windows\system32\drivers\makon t.sys HKLM\System\CurrentC

  • ntrolSet\Services

rap (Not verified) Internet Security Systems, Inc. c:\windows\system32\drivers\rapdrv. sys HKLM\System\CurrentC

  • ntrolSet\Services

SENS (Not verified) Microsoft Corporation c:\windows\system32\sens.dll HKLM\Software\Microsof t\Windows\CurrentVersio n\Shell Directory (Verified) Microsoft \S e Extensions\Approved ecto y Service Find ( e ed) c oso t Windows Publisher c:\windows\system32\dsquery.dll HKLM\Software\Microsof t\Windows\CurrentVersio n\Shell Extensions\Approved Directory Service Common UI (Verified) Microsoft Windows Publisher c:\windows\system32\dsuiext.dll HKLM\Software\Microsof t\Windows\CurrentVersio n\Shell Extensions\Approved Directory Service Common UI (Verified) Microsoft Windows Publisher c:\windows\system32\dsuiext.dll

Abusing services.exe Abusing services.exe

UNMODIFIED UNMODIFIED MODIFIED MODIFIED

23

slide-11
SLIDE 11

6/22/2010 11

services.exe services.exe

  • Automatic installer

Automatic installer

  • services exe loads malicious DLL

services exe loads malicious DLL

24

services.exe loads malicious DLL services.exe loads malicious DLL

  • DLL implements

DLL implements cron cron like functionality like functionality

Hiding in plain sight (network) Hiding in plain sight (network)

  • Used for Command and Control

Used for Command and Control

− Communicate, control the target

Communicate, control the target

25

, g , g

− Gather information

Gather information

− Attackers want this to be covert

Attackers want this to be covert

  • HTTP/S is commonly encrypted

HTTP/S is commonly encrypted

− But it’s not always SSL!

But it’s not always SSL! Encrypted HTML comments Encrypted HTML comments

− Encrypted HTML comments

Encrypted HTML comments

<! <!‐‐ ‐‐aHR0cAXXXXXX aHR0cAXXXXXX ‐‐ ‐‐> >

slide-12
SLIDE 12

6/22/2010 12

Hiding in plain sight (network) Hiding in plain sight (network)

26

Connection port

83% 17%

TCP/80 or 443 Non-HTTP/HTTPS

Communication Security Communication Security

HTTP(S) ports Non-HTTP(S) ports

27

71% 45% 55%

Encrypted Cleartext

29%

Encrypted Cleartext Non-HTTP(S) ports

slide-13
SLIDE 13

6/22/2010 13

Access management Access management

  • Attackers track your assets

Attackers track your assets

− Backdoors

Backdoors

28

  • Need to know:

Need to know:

− IP/Hostname

IP/Hostname

− May know:

May know:

  • OS / SP Level

OS / SP Level

  • MAC

MAC RAM RAM

  • RAM

RAM

  • When one goes away they need to re

When one goes away they need to re-

  • up

up their inventory x 2 their inventory x 2

− New malware

New malware

Sample beacon Sample beacon

  • GET

GET /search /search(#)#### (#)####?h1= ?h1=#&h2= &h2=#&h3= &h3=#&h4= &h4=FMFEFEFHA FMFEFEFHA EBIBKFOFEAGFGFC EBIBKFOFEAGFGFC

29

EBIBKFOFEAGFGFC EBIBKFOFEAGFGFC

− (#)

(#) – – random number random number

− h1 = OS

h1 = OS

− h2 =

h2 = proxied proxied

− h3 = malware version

h3 = malware version

− h4 = encoded

h4 = encoded mac mac address address

slide-14
SLIDE 14

6/22/2010 14

USA USA vs vs Slovenia Slovenia

  • Score Update

Score Update

30

HOW TO WIN

The beatings will continue until security improves The beatings will continue until security improves

HOW TO WIN

slide-15
SLIDE 15

6/22/2010 15

Step 1: Redefine Winning Step 1: Redefine Winning

  • Goals

Goals A Are Customized Per Organization, re Customized Per Organization, B But ut Can Include: an Include:

32

− Improve Detection Capability

Improve Detection Capability

  • Centralize Logs

Centralize Logs

  • Acquire Outside Intelligence

Acquire Outside Intelligence

− Improve Response Capability

Improve Response Capability

  • Remove Political Hurdles

Remove Political Hurdles Iron Processes Out Iron Processes Out

  • Iron Processes Out

Iron Processes Out

− Practice Remediation

Practice Remediation

− Raise the Cost of the Theft to Equal Development

Raise the Cost of the Theft to Equal Development

− Staff Management

Staff Management

Practical Advice Practical Advice

  • Detect and Respond is what is working

Detect and Respond is what is working today. today.

33

y

slide-16
SLIDE 16

6/22/2010 16

INVESTIGATION TECHNIQUES

Game Changers of Today Game Changers of Today

INVESTIGATION TECHNIQUES

Working Investigation Techniques Working Investigation Techniques

  • Differential Analysis

Differential Analysis

− Racking and Stacking

Racking and Stacking

35

g g g g

  • Hard Core Forensic Knowledge

Hard Core Forensic Knowledge

  • Code Signing

Code Signing

  • Intelligence Based Detection

Intelligence Based Detection

slide-17
SLIDE 17

6/22/2010 17

They Dare You to Notice They Dare You to Notice

Count Service Name Path Service DLL 5,598 Seclogon C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\seclogon.dll

36

2 Seclogon C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\selogon.dll 1,233 NWCworkstation C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\nwwks.dll 2 NWCworkstation C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\nwwwks.dll 5,235 iprip C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\iprip.dll 2 iprip C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\iprinp.dll 3 iprip C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\iprinp32.dll 5,598 wuauserv C:\WINDOWS\System32\svchost.exe %SystemRoot%\system32\wuauserv.dll 8 wuauserv C:\WINDOWS\System32\svchost exe %SystemRoot%\System32\wauaserv dll 8 wuauserv C:\WINDOWS\System32\svchost.exe %SystemRoot%\System32\wauaserv.dll

What’s bad?

Working Investigation Techniques Working Investigation Techniques

  • Differential Analysis

Differential Analysis

− Racking and Stacking

Racking and Stacking

38

g g g g

  • Hard Core Forensic Knowledge

Hard Core Forensic Knowledge

  • Code Signing

Code Signing

  • Intelligence Based Detection

Intelligence Based Detection

slide-18
SLIDE 18

6/22/2010 18

File System Review File System Review

39

MFT Parsing MFT Parsing

40

slide-19
SLIDE 19

6/22/2010 19

Working Investigation Techniques Working Investigation Techniques

  • Differential Analysis

Differential Analysis

− Racking and Stacking

Racking and Stacking

41

g g g g

  • Hard Core Forensic Knowledge

Hard Core Forensic Knowledge

  • Code Signing

Code Signing

  • Intelligence Based Detection

Intelligence Based Detection

Digital Signature Checking Digital Signature Checking

  • Audit Viewer and

Audit Viewer and Memoryze Memoryze with MRI Intelligence with MRI Intelligence

42

slide-20
SLIDE 20

6/22/2010 20

Working Investigation Techniques Working Investigation Techniques

  • Differential Analysis

Differential Analysis

− Racking and Stacking

Racking and Stacking

43

g g g g

  • Hard Core Forensic Knowledge

Hard Core Forensic Knowledge

  • Code Signing

Code Signing

  • Intelligence Based Detection

Intelligence Based Detection

Generate a Compromise Profile Generate a Compromise Profile

There is an ongoing APT There is an ongoing APT-

  • related incident. At least 35

related incident. At least 35 systems with APT backdoors have been discovered. One of systems with APT backdoors have been discovered. One of the backdoors installs itself as a Windows service named the backdoors installs itself as a Windows service named “ersvc ersvc” with a service DLL of ” with a service DLL of “% “% t t t t% %\ \ t 32 t 32\ dll” Th fil i i 23 040 dll” Th fil i i 23 040 “% “%systemroot systemroot% %\ \system32 system32\ersvr.dll”. The file size is 23,040 ersvr.dll”. The file size is 23,040 bytes and the MD5 hash is 906b5626b779eb90b4f403c3b4503b46. bytes and the MD5 hash is 906b5626b779eb90b4f403c3b4503b46. In all cases, the modification date of the backdoor file In all cases, the modification date of the backdoor file was 2009 was 2009-

  • 03

03-

  • 21 10:06 AM.

21 10:06 AM. The backdoor connects to a remote site via standard HTTP The backdoor connects to a remote site via standard HTTP protocol, and downloads a Web page that contains a protocol, and downloads a Web page that contains a specially formatted HTML comment. The HTML comment specially formatted HTML comment. The HTML comment contains instructions for the backdoor, and starts with “< contains instructions for the backdoor, and starts with “<-

  • #!#

#!#obot

  • bot”. The backdoor will use the user

”. The backdoor will use the user-

  • agent string

agent string “Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; “Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot

  • bot)”.

)”. The backdoor uses a The backdoor uses a mutex mutex called “ )!VoqA.I4 “. In some called “ )!VoqA.I4 “. In some ) q ) q cases, the backdoor has been installed laterally using the cases, the backdoor has been installed laterally using the credentials of a user named “ credentials of a user named “lazydg lazydg”. ”. Your boss would really like you to clean up the network. Your boss would really like you to clean up the network. Identify Content You Can Use to Identify This Attacker in your Network

slide-21
SLIDE 21

6/22/2010 21

Generate a Compromise Profile Generate a Compromise Profile

There is an ongoing APT There is an ongoing APT-

  • related incident. At least 35

related incident. At least 35 systems with APT backdoors have been discovered. One of systems with APT backdoors have been discovered. One of the backdoors installs itself as a Windows service named the backdoors installs itself as a Windows service named “ersvc ersvc” with a service DLL of ” with a service DLL of “% t t%\ t 32\ dll” Th fil i i 23 040 ” Th fil i i 23 040 “%systemroot%\system32\ersvr.dll”. The file size is 23,040 ”. The file size is 23,040 bytes and the MD5 hash is bytes and the MD5 hash is 906b5626b779eb90b4f403c3b4503b46. . In all cases, the modification date of the backdoor file In all cases, the modification date of the backdoor file was 2009 was 2009-

  • 03

03-

  • 21 10:06 AM.

21 10:06 AM. The backdoor connects to a remote site via standard HTTP The backdoor connects to a remote site via standard HTTP protocol, and downloads a Web page that contains a protocol, and downloads a Web page that contains a specially formatted HTML comment. The HTML comment specially formatted HTML comment. The HTML comment contains instructions for the backdoor, and starts with “< contains instructions for the backdoor, and starts with “<-

  • ”. The backdoor will use the user

”. The backdoor will use the user-

  • agent string

agent string “ ”. ”. The backdoor uses a The backdoor uses a mutex mutex called “ called “ “. In some “. In some cases, the backdoor has been installed laterally using the cases, the backdoor has been installed laterally using the credentials of a user named “ credentials of a user named “lazydg”. ”. Your boss would really like you to clean up the network. Your boss would really like you to clean up the network. Cheap to Change = No Coding Necessary More Costly To Change = Original Author / Source Code Available

Intelligence Based Detection Intelligence Based Detection

  • OpenIOC

OpenIOC (Open Indicator of Compromise (Open Indicator of Compromise Language) Language)

46

g g ) g g )

  • Developed by

Developed by Mandiant Mandiant in in conjuction conjuction with with Industry Industry

  • Designed to Facilitate Sharing of

Designed to Facilitate Sharing of Actionable Intelligence Actionable Intelligence F O IOC O IOC Edit th Edit th M di t M di t

  • Free

Free OpenIOC OpenIOC Editor on the Editor on the Mandiant Mandiant Website to Create and Manage Indicators Website to Create and Manage Indicators

slide-22
SLIDE 22

6/22/2010 22

47

Truths To Date: Truths To Date:

  • No Organization Has:

No Organization Has:

− Been Prepared to Defend Their Network

Been Prepared to Defend Their Network

48

p p Against A Nation State Sponsored Attacking Against A Nation State Sponsored Attacking Capability Capability

  • There is no industry or government

There is no industry or government solution to protect our commercial solution to protect our commercial companies right now companies right now p g p g

slide-23
SLIDE 23

6/22/2010 23

USA USA vs vs Slovenia Slovenia

  • Score Update

Score Update

49

Questions? Questions?

RESOURCES RESOURCES

  • M-
  • Trends

Trends – – MANDIANT website MANDIANT website

50

  • M-
  • Unition

Unition Blog (blog.mandiant.com) Blog (blog.mandiant.com)

  • Mandiant

Mandiant is Hiring! Help us Out! is Hiring! Help us Out! Recruiting@mandiant.com Recruiting@mandiant.com

  • Web Historian 2.0 Release Yesterday at FIRST

Web Historian 2.0 Release Yesterday at FIRST