Iran and the Soft War for Internet Dominance Claudio Guarnieri - - PowerPoint PPT Presentation

▶
iran and the soft war for internet dominance
SMART_READER_LITE
LIVE PREVIEW

Iran and the Soft War for Internet Dominance Claudio Guarnieri - - PowerPoint PPT Presentation

Sep 23, 2022 20 likes •878 views

Iran and the Soft War for Internet Dominance Claudio Guarnieri (@botherder) & Collin Anderson (@cda) Who we are nex cda @botherder @cda Technologist at Amnesty Networked systems researcher, International. based in

slide-1
SLIDE 1

Iran and the Soft War for Internet Dominance

Claudio Guarnieri (@botherder) & Collin Anderson (@cda)

slide-2
SLIDE 2

Who we are

nex

  • @botherder
  • Technologist at Amnesty

International.

  • Senior Research Fellow at

CitizenLab.

  • Creator of Cuckoo Sandbox, Viper,

Malwr.com …

  • https://nex.sx

cda

  • @cda
  • Networked systems researcher,

based in Washington, D.C.

  • Collaborates with civil society on

Internet measurement and policy issues (e.g. Wassenaar), academic institutions, and others.

  • History on Iran human rights and

foreign policy.

  • https://cda.io
slide-3
SLIDE 3

Disclaimer: this work was done independently from our respective current affiliations. Opinions expressed here are our own, and do not reflect those of our employers.

slide-4
SLIDE 4

The Green Movement and the Soft War

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

Shedding Light on the Targeting of Activists and At-Risk Communities

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12

Mission

Collect Samples and Incidents from Targets of Iran-based Intrusion Campaigns for Accountability and Community Education.

slide-13
SLIDE 13

Intrusions and Elections

slide-14
SLIDE 14

Internet Speed Throttling (May – June 2013)

slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17

Phishing and Malware, the New Normal

slide-18
SLIDE 18

Mandatory Grugq Quote

slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21

Campaigns, Tools and Actors

Cross section of the Ecosystem

slide-22
SLIDE 22

Cleaver (Ghambar)

slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

Features

  • Self-destruct
  • Shell
  • Screenshot
  • Shutdown computer
  • Reboot computer
  • Logoff user
  • Lock computer
  • Set and copy clipboard
  • Turn on and off display
  • Enable/disable mouse and keyboard (not implemented)
  • “Enable or disable desktop” (not implemented)
  • Trigger BSOD (not implemented)
slide-26
SLIDE 26

Some neat little things…

  • The keylogger doesn’t store anything on disk, unless the C&C is
  • unreachable. Then removes the logs when submitted.
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29

Some neat little things…

  • The keylogger doesn’t store anything on disk, unless the C&C is
  • unreachable. Then removes the logs when submitted.
  • Ghambar is entirely modular. It’s able to download and execute new

plugins.

  • Uses a SOAP-based protocol for communicating to the C&C, very

similar to Operation Cleaver’s TinyZBot.

  • The samples we obtained appeared to still be under development.
  • Ghambar might be the next generation implant from Cleaver?
slide-30
SLIDE 30

private static void Main() { try { Utils.DbgPrint(".: In the name of God :."); string destinationPathOfExecution = IoPathUtils.GetDestinationPathOfExecution(); string text = Path.Combine(destinationPathOfExecution, Resources.APP_EXE_FILE_NAME); if (!Directory.Exists(destinationPathOfExecution)) { Directory.CreateDirectory(destinationPathOfExecution); }

slide-31
SLIDE 31
slide-32
SLIDE 32

Cleaver: summing up

  • Active in compromising legitimate hosts, doing watering hole attacks.
  • Rudimentary programming skills, but improving.
  • Targeting both corporate and civil society.
  • New version of TinyZBot?
slide-33
SLIDE 33

Sima

slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38
slide-39
SLIDE 39

Tools & Techniques

  • We’ve seen Sima using two different droppers
  • One worked terribly, had logic flaws, and had endless loops of flashing

cmd.exe attempting to call reg command to gain persistence.

slide-40
SLIDE 40
slide-41
SLIDE 41

Tools & Techniques

  • We’ve seen Sima using two different droppers
  • One worked terribly, had logic flaws, and had endless loops of flashing

cmd.exe attempting to call reg command to gain persistence.

  • One much better designed, using task scheduler for persistence, and

errors/dialogs suppression.

  • Both would then instantiate a legitimate RegAsm.exe, do process

hollowing, and inject it with Luminosity Link code.

slide-42
SLIDE 42
slide-43
SLIDE 43

Sima: summing up

  • Excellent recon skills.
  • Excellent social engineering skills.
  • Better English than most groups.
  • Very methodical.
  • Bad OPSEC.
  • Bad development skills
  • Still, successful.
slide-44
SLIDE 44

Rocket Kitten

slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47

[Link Info] Location flags: 0x00000001 (VolumeIDAndLocalBasePat h) Drive type: 3 (DRIVE_FIXED) Drive serial number: 703c-a852 Volume label (ASCII): Local path (ASCII): C:\Windows\System32\WindowsPowerShell\v1 .0\powershell.exe [String Data] Comment (UNICODE): windows photo viewer Relative path (UNICODE): ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Arguments (UNICODE):

  • NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -En

codedCommand [BASE64 encoded payload]

slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50

Then the attacker would…

  • 1. Install a first stage .exe with persistence, that would launch a

PowerShell command.

  • 2. PowerShell commands would inject some code and execute it.
  • 3. At the end of the chain, the code would download a Meterpreter

DLL and launch it as a reverse shell.

slide-51
SLIDE 51

Then the attacker would…

  • 1. Install a first stage .exe with persistence, that would launch a

PowerShell command.

  • 2. PowerShell commands would inject some code and execute it.
  • 3. At the end of the chain, the code would download a Meterpreter

DLL and launch it as a reverse shell.

  • 1. Yes, they totally connected into our VM and when

figured it wasn’t legit, started frenetically deleting stuff and rebooting it.

slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55

WTF?

  • Been burning Telegram API keys like there’s no tomorrow.
  • Fetching user IDs for Iranian phone numbers in mass.
  • Between 15 and 20 million users!
  • ~3 million a day!
  • Useful for reconstructing networks and perhaps deanonymizing users

when someone’s phone is confiscated?

slide-56
SLIDE 56

Let’s be clear…

  • Telegram did not get breached!
  • Those reporting as such should

issue corrections.

  • This actor abused Telegram’s

service in ways we find very concerning.

  • Repressive state + accounts

enumeration + accounts hijacking = BAD NEWS.

  • Telegram acknowledged.
slide-57
SLIDE 57

Rocket: summing up

  • Diverse activities.
  • Interesting tricks, experienced attackers.
  • They do like pentesting tools. Found in the past using Core Impact

Pro, now mostly Metasploit.

  • Very active.
  • For us, one of the most concerning groups.
slide-58
SLIDE 58

Infy

slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65

DGA \o/

  • They implemented a bizarre DGA algorithm
  • It would use rotating pools of ~30 domains.
  • Domains with format box40XX.net
  • The DGA domains are contacted even if primary C&C is up.
  • Only one registered before, all the others available.
  • Started sinkholing from December 2015.
slide-66
SLIDE 66

Professional Sinkhole Camouflage

slide-67
SLIDE 67
slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70
slide-71
SLIDE 71
slide-72
SLIDE 72
slide-73
SLIDE 73

(Mashhad) Razavi Khorasan, Iran

slide-74
SLIDE 74

Update system

  • When the malware checks in with the C&C, it retrieves instructions.
  • If the C&C replies to the HTTP request with a 302 Redirect to a given

URL pointing to an .exe, Infy will download and execute it.

  • No verification or signing, and…
  • The DGA domains are obviously able to distribute updates…
slide-75
SLIDE 75

Game over?

  • On May 2nd, Palo Alto Networks releases a report.
  • On May 12th Palo Alto starts sinkholing (parts) of the network.
  • On May 14th the actors notice.
  • Actor starts pushing updates with new C&Cs at any opportunity, in
  • rder to regain access.
slide-76
SLIDE 76
slide-77
SLIDE 77
slide-78
SLIDE 78

Infy: summing up

  • Very active group, will probably resurface.
  • Rudimentary development skills.
  • Decent social engineering skills.
  • Worst OPSEC ever?
  • Very, very successful. Managed to compromise several hundreds of

targets.

slide-79
SLIDE 79

Coming to an end…

slide-80
SLIDE 80

Conclusions

  • Dearth of information of historical campaigns, but Iranians have been

the subject of targeted intrusion since at least early 2010.

  • Intrusions and disruptions are conducted by disparate groups

concurrent to each other with evolving strategies.

  • Most observed incidents evince low to medium sophistication,

primarily relying on social engineering.

  • Same toolkits used against civil society as in espionage against foreign

targets.

  • Intrusions are common and normalized, but large surface area for

surveillance due to low technical expertise.

slide-81
SLIDE 81

Next steps

  • Document the capabilities and campaigns associated with Iranian

threat actors.

  • Resurface evidence of previous campaigns prior to June 2013.
  • Collect harm stories and case studies of intrusion attempts.
  • Provide background narratives of actors and intrusions over time.
  • Publish full research and datasets, including samples, hashes and

IOCs.

  • https://iranthreats.github.io
  • Coordinate further disclosure and remediation of campaigns.
slide-82
SLIDE 82

Acknowledgements

  • All our sources.
  • Morgan Marquis-Boire
  • Snorre Fagerland
  • Nima Fatemi
  • Domain Tools
  • And many more…
slide-83
SLIDE 83

Fighting the same fight

  • We’re all fighting bad guys.
  • Our “customers” likely different from yours, but equally targeted and

with a lot to lose.

  • You have access to the data, and means to identify attacks.
  • We have access to networks of people, and means to stop those

attacks.

  • Please, help.
slide-84
SLIDE 84

Got samples? Got tips? Wanna help?

nex@amnesty.org

PGP: E063 75E6 B9E2 6745 656C 63DE 8F28 F25B AAA3 9B12

cda@asc.upenn.edu

PGP: 510E 8BFC A60E 84B4 40EA 0F32 FAFB F2FA

slide-85
SLIDE 85

Thank you!

Claudio Guarnieri (@botherder) & Collin Anderson (@cda)