why attacker toolsets do what they do
play

WHY ATTACKER TOOLSETS DO WHAT THEY DO (or.. Reasons they just keep - PowerPoint PPT Presentation

May 11, 2023 •155 likes •725 views

WHY ATTACKER TOOLSETS DO WHAT THEY DO (or.. Reasons they just keep working) Matt McCormack OVER THE LAST YEAR 50+ engagements Good chunk of different verticals, industries, etc. Varying qualities and effectiveness of defenses Collective

  1. WHY ATTACKER TOOLSETS DO WHAT THEY DO (or.. “Reasons they just keep working”) Matt McCormack

  2. OVER THE LAST YEAR 50+ engagements Good chunk of different verticals, industries, etc. Varying qualities and effectiveness of defenses Collective noun of different Threat Groups … but really? Similar tools and tactics

  3. THE MAGIC OF INTERPRETIVE DANCE Pick through this year’s interesting engagements Construct a convenient narrative Discuss the common blind-spots the tools keep leveraging Explore Reasons They Just Keep Working ( RIJKW )

  4. OUR SCENARIO

  5. RTJKW #1: AD HOC DEPLOYMENTS Deploy and forget (bonus: default configurations) External teams not looping in the security team Third-party systems without patch management Cloud infrastructure: the new frontier of terrible

  6. THE VOLUME GAME Scan and exploit; because eventually it will work

  7. CHINACHOPPER POST Webshell all the things

  10. OWA: WHO NEEDS THE DC? ISAPI filter (.NET) OwaAuth.Application_EndRequest() - Receives request after submitted - Extract username and password from login, save to text file - Parse traffic for magic key, password, and params for backdoor

  11. OwaAuth.ShowError() - List, read, write, delete, modify, files and directories - Timestomp file or directory - Download file from URL - Launch process - Connect, query, write to SQL server

  12. OUR SCENARIO… SO FAR

  16. ACEHASH: ALL THE HASHES Mimikatz Custom-compiled PE executes sekurlsa:: logonpasswords command automatically Ace1 Custom DLL, uses samsrv.dll APIs to dump hashes from disk/registry Ace2 Custom DLL, based on WCE, uses msv1_0.dll APIs for LM/NTLM InjectMemDll Inject above when required

  20. OUR SCENARIO… SO FAR

  21. RTJKW #2: CREDENTIAL “ISSUES” Golden images are convenient, as is scripting installs Same local Admin passwords is … not great Failing to restrict local Admin over network Insecurely storing passwords on network

  22. "whoami" "ipconfig" /all "net" time /domain "net" start query "netstat" -an "ping" -n 1 www.nba.com "net" view /domain "net" localgroup administrators "net" user adm_it /domain "cmd" /c dir C:\users\ "net" group "Domain Admins" /domain "C:\Windows\system32\net1 group "Domain Admins" /domain "nltest" /trust_domain

  23. “C:\windows\temp\nbtscan.exe 10.16.2.1/24 ">C:\windows\temp\nb.txt" "net" use \\10.16.2.208 "Changeme!" /user:CORP\CS_ADM_IT "cmd" /c dir \\10.16.2.208\c$ "dir \\10.16.2.208\c$ "net" use \\10.16.2.208\c$ "Changeme!" /user:CORP\CS_ADM_IT "C:\windows\temp\acehash64.exe -s adm_qa:CORP: AAD3B435B51404EEAAD3B435B51404EE:A5B440A4C4E1965E6F5905A08AF6F2DE "dir \\10.16.2.233\c$" "C:\windows\temp\acehash64.exe -s Administrator:123: AAD3B435B51404EEAAD3B435B51404EE:A67C071444ED771589B736189B08F2AD "dir \\10.16.2.208\c$" "C:\windows\temp\acehash64.exe -s Administrator:123: AAD3B435B51404EEAAD3B435B51404EE:A67C071444ED771589B736189B08F2AD "dir \\10.16.2.204\c$\inetpub\"

  24. OUR SCENARIO… SO FAR

  25. RTJKW #3: BOTTLENCK BRO? Chokepoints using (authenticating) proxies Central point to log, gather/apply intel, block, etc. Many basic RATs/Toolsets/Malware won’t work Unfettered internet access is a terrible idea

  26. POISON IVY Grandfather of Chinese targeted RATs (circa 2004) Custom TCP C&C protocol Still deployed, updated but only basic proxy support seen this year Volatility + Chopshop + metasploit modules available

  27. hellointra.no-ip.org,3460 cmdexe.no-ip.biz hellointra.myftp.org,3440 microsoft32.no-ip.biz namesvrtwo.serveftp.com,8888 ga2a.no-ip.biz namesvrone.myftp.org,8989 exw.no-ip.info m2013.no-ip.org,443 60.235.12.64 update17.ignorelist.com,443 hack43mila.no-ip.biz sap123.no-ip.biz,3480 cool-t.no-ip.biz sap123.servehttp.com,5460 alnweer2009.no-ip.info statictwo.myftp.org,9999 alnweer2009.no-ip.org staticone.hopto.org,9898 test.no-ip.org banse.zapto.org,4444 sero.ddns.net gserverhost.no-ip.biz,6666 serix21.no-ip.biz gserverhost.myftp.org,5555 evil3322.no-ip.biz connektme.no-ip.org,6460 zxoo.no-ip.biz connektme.hopto.org,7539 m55m55m44.no-ip.org easyconnect.zapto.org,3333 easyconnect.no-ip.org,4444 swepc.no-ip.biz,3460

  29. OUR SCENARIO… SO FAR

  30. RTJKW #4: DOMAIN SEPARATION Strict separation, limited accounts, hardcore logging Extends to shared infrastructure, third parties, BYOD Trying to avoid these points being like those really fun ball pits, but for privileged credentials

  32. OUR SCENARIO… SO FAR

  33. RTJKW #5: POROUS FIREWALLS Don’t forget about the non-TCP protocols Unit test and regression test the perimeter Segmentation is a thing

  35. EXPOSING YOUR BITS Windows update component for file transfer

  36. PLUGX Been around since 2011, actively developed Modular construction to evade sandboxing, etc. C&C via UDP, DNS over UDP, CUSTOM over TCP, HTTP, HTTPS, ICMP, customer over IP Plugin infrastructure

  41. PLUGINS - Read/write/enumerate files, registry - Download/execute files - Enumerate, read, write, inject, kill processes - Port forward/ proxy traffic , enumerate network - Full SQL driver interface - RDP, keylog, screenshot, video ..

  42. OUR SCENARIO… SO FAR

  43. RIJKW #6: INTERNAL BLINDNESS Some visibility inside the network is … useful Common for newer RATs to have P2P Routing traffic through the network to reach other targets

  44. RBDOOR Alternative to PlugX, full RAT functionality too Both 64 and 32 bit versions C&C via TCP, UDP, HTTP, HTTPS, ... Traffic relay is also built in ...

  51. RBDOOR ROUTING Everything done via IP/TCP header modification Main functionality: - Drop packets from blacklist - Route packets to new destination port in whitelist - Capture session cookies by routing to magic port

  52. NOT EVEN NORTON DSE WILL SAVE YOU Sometimes you just want to load your dodgy network driver on an x64 system DSE from Vista onwards “stops” that Unless … it doesn’t?

  54. OUR SCENARIO… SO FAR

  55. TL; DR “APT”s - mostly not very A, but usually very P 80/20 of network security will thwart the average intruder The adversary reuses tools and tactics; if they get in, you should have home ground advantage. Use it.

  56. REFERENCES & QUESTIONCES DYNDNS LIST https://github. com/EmergingThreats/et-luajit-scripts DNSTUNNEL https://github.com/iagox86/dnscat2 FWUNIT http://fwunit.readthedocs.org/en/latest/

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

VR-Based Toolsets for Instructors H.K. Yaqub 1 1 Unity3D Developer, BMT, Bath, UK Abstract This

VR-Based Toolsets for Instructors H.K. Yaqub 1 1 Unity3D Developer, BMT, Bath, UK Abstract This

VR-BASED TOOLSETS FOR INSTRUCTORS VR-Based Toolsets for Instructors H.K. Yaqub 1 1 Unity3D Developer, BMT, Bath, UK Abstract This paper outlines the development of a suite of VR tools (ENGAGE Instructor Toolset) which allow instructors to

569 views • 3 slides
The use of recursive par//oning via temporal visual toolsets

The use of recursive par//oning via temporal visual toolsets

The use of recursive par//oning via temporal visual toolsets to efficiently isolate pa/ent cohorts Gigi Lipori pflugg@shands.ufl.edu UF Health Concept

458 views • 27 slides
The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same

The Network Network Security Secure against what/whom Security goals Attacker model Same hub `trusted LAN Internet Eavesdrop / block messages / insert messages / ... Typical attacker model security protocol analysis: Attacker

780 views • 63 slides
VR-Based Toolsets for Instructors DR. Hashim Yaqub BMT , UK Abstract This paper outlines the

VR-Based Toolsets for Instructors DR. Hashim Yaqub BMT , UK Abstract This paper outlines the

VR-Based Toolsets for Instructors DR. Hashim Yaqub BMT , UK Abstract This paper outlines the development of a VR-based toolset which allow instructors to monitor the activity of students in a virtual-training scenario. They also allow

301 views • 29 slides
Bluebeam general workflows and toolsets Troy vansanten Local 66 sheet metal journeyman

Bluebeam general workflows and toolsets Troy vansanten Local 66 sheet metal journeyman

Bluebeam general workflows and toolsets Troy vansanten Local 66 sheet metal journeyman Fabrication database manager Hermanson company Mechanical Contractor HVAC Sheet Metal & Piping and Plumbing Fabrication & Design-Build

402 views • 22 slides
SQL Injection: Summary Target: web server that uses a back-end database Attacker goal:

SQL Injection: Summary Target: web server that uses a back-end database Attacker goal:

SQL Injection: Summary Target: web server that uses a back-end database Attacker goal: inject or modify database commands to either read or alter web-site information Attacker tools: ability to send requests to web server (e.g.,

89 views • 4 slides
Reactions and Responses 1 IP Spoofing Stimuli Why would an attacker spoof his source

Reactions and Responses 1 IP Spoofing Stimuli Why would an attacker spoof his source

Reactions and Responses 1 IP Spoofing Stimuli Why would an attacker spoof his source address? Hide the attackers activity nmap decoy option Hide the attackers identity To be able to view the responses, the attacker

548 views • 17 slides
data level parallelism / exceptions 1 1 last time (1) PRIME+PROBE attacker fjll cache set(s)

data level parallelism / exceptions 1 1 last time (1) PRIME+PROBE attacker fjll cache set(s)

data level parallelism / exceptions 1 1 last time (1) PRIME+PROBE attacker fjll cache set(s) with attacker data let victim run, use cache set(s) cache coherency solution: invalidate or update all other caches on write glossed over details:

1.7k views • 123 slides
CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web Security Web Attacker Sets up malicious site visited by victim; no control of network Alice Network Security Network Attacker Intercepts and controls network communication

907 views • 44 slides
Advanced Network Inference Techniques Based on Network Protocol Stack Information Leaks Roya

Advanced Network Inference Techniques Based on Network Protocol Stack Information Leaks Roya

Advanced Network Inference Techniques Based on Network Protocol Stack Information Leaks Roya Ensafi October 2013 Still A Peach Attacker Still A Peach Attacker Zombie Victim Attacker What if we could? Scan a firewall port or a hidden

651 views • 40 slides
A Practical Methodology for Measuring the Side- Channel Signal Available to the Attacker for

A Practical Methodology for Measuring the Side- Channel Signal Available to the Attacker for

A Practical Methodology for Measuring the Side- Channel Signal Available to the Attacker for Instruction- Level Events Robert Callan, Alenka Zajic, and Milos Prvulovic @ MICRO14 (Paper #48) EECS 573 Sung Kim and Siying Feng 6/7/2017 1 1

350 views • 19 slides
ATT&CK the Attacker Assessing & Improving Detection Capabilities # whoami Christian

ATT&CK the Attacker Assessing & Improving Detection Capabilities # whoami Christian

ATT&CK the Attacker Assessing & Improving Detection Capabilities # whoami Christian Kollee Studied Computer Science at University of Erlangen- Nueremberg (Diplom-Informatik) Several years at various universities and at

551 views • 19 slides
Track 17: The New Attacker Model Dr. Ghassan Karame NEC Laboratories Europe Heidelberg, Germany

Track 17: The New Attacker Model Dr. Ghassan Karame NEC Laboratories Europe Heidelberg, Germany

Track 17: The New Attacker Model Dr. Ghassan Karame NEC Laboratories Europe Heidelberg, Germany ghassan@karame.org www.ghassankarame.com The Surge of a New Attacker Model Image Source: pcworld.com Image Source: TheLaw.tv Dr. Ghassan Karame

256 views • 6 slides
Memory Categorization Separating Attacker-Controlled Data Matthias Neugschwandtner Alessandro

Memory Categorization Separating Attacker-Controlled Data Matthias Neugschwandtner Alessandro

Memory Categorization Separating Attacker-Controlled Data Matthias Neugschwandtner Alessandro Sorniotti Anil Kurmus IBM Research - Zurich 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment; Gothenburg, June

537 views • 24 slides
Inside a BBB Malware Scheme: Mapping and Dissecting Attacker Infrastructure Prepared for FIRST

Inside a BBB Malware Scheme: Mapping and Dissecting Attacker Infrastructure Prepared for FIRST

Inside a BBB Malware Scheme: Mapping and Dissecting Attacker Infrastructure Prepared for FIRST 2008 Michael La Pilla VeriSign iDefense Malicious Code Operations Team June 26, 2008 Why Should Incident Responders Care? + US Commercial Accounts

458 views • 19 slides
VIDEN VIDEN At Attacker Identification on In-Vehicle Networks Kyong-Tak Cho and Kang G. Shin

VIDEN VIDEN At Attacker Identification on In-Vehicle Networks Kyong-Tak Cho and Kang G. Shin

VIDEN VIDEN At Attacker Identification on In-Vehicle Networks Kyong-Tak Cho and Kang G. Shin Presented by Alokparna Bandyopadhyay Fall 2018, Wayne State University Overview Introduction CAN Message Transmission System and Threat

849 views • 31 slides
A perspective to incident response or another set of recommendations for malware authors

A perspective to incident response or another set of recommendations for malware authors

A perspective to incident response or another set of recommendations for malware authors Alexandre Dulaunoy - TLP:WHITE alexandre.dulaunoy@circl.lu June 7, 2013 CIRCL, national CERT of Luxembourg CIRCL 1 is composed of 6 full-time incident

572 views • 21 slides
MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat Sharing Marion Marschalek - Rapha el Vinot - TLP:WHITE July 6, 2016 MISP and starting from a practical use-case During a malware analysis

357 views • 18 slides
Memory-Enhanced Models for Discourse Understanding COMP90042 Web Search and Text Analysis Guest

Memory-Enhanced Models for Discourse Understanding COMP90042 Web Search and Text Analysis Guest

What is Discourse Discourse-related Tasks Models for Discourse Understanding Conclusion Memory-Enhanced Models for Discourse Understanding COMP90042 Web Search and Text Analysis Guest Lecture Fei Liu School of Computing and Information

574 views • 40 slides
Identifying Winter Twigs Prepared by Dennis Deck Terminology

Identifying Winter Twigs Prepared by Dennis Deck Terminology

Identifying Winter Twigs Prepared by Dennis Deck Terminology http://www.clemson.edu/extfor/publications/bul117/characteristics.htm A Few Terms http://www.cactus-art.biz/note-book/ Dictionary/Dictionary_B/dictionary_bud.htm

1.22k views • 45 slides
Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software Architect 1 Agenda Problem Description Fileless Attacks Overview Common Injection Techniques Current Challenges with memory

870 views • 22 slides
Graph Analytics on Massively Parallel Processing Databases Frank McQuillan Feb 2017 MPP

Graph Analytics on Massively Parallel Processing Databases Frank McQuillan Feb 2017 MPP

Graph Analytics on Massively Parallel Processing Databases Frank McQuillan Feb 2017 MPP databases effective for graph analytics at scale in the enterprise 2 Database Engine Popularity http://db-engines.com/en/ranking 3 Graph Engine Trends

583 views • 46 slides
ASSURE Authentication Scheme for SecURE Energy Efficient Non-Volatile Memories Joydeep Rakshit

ASSURE Authentication Scheme for SecURE Energy Efficient Non-Volatile Memories Joydeep Rakshit

ASSURE Authentication Scheme for SecURE Energy Efficient Non-Volatile Memories Joydeep Rakshit Kartik Mohanram Non-Volatile Memories Workshop March 12, 2018 San Diego, CA Electrical and Computer Engineering University of Pittsburgh

971 views • 50 slides
PV204 Security technologies In-Memory Malware Analysis Vclav Lorenc Senior Security Analyst,

PV204 Security technologies In-Memory Malware Analysis Vclav Lorenc Senior Security Analyst,

PV204 Security technologies In-Memory Malware Analysis Vclav Lorenc Senior Security Analyst, Oracle + NetSuite Agenda Basic intro No assembly required No malware (de)obfuscation magic How does the OS look inside?

847 views • 57 slides

More recommend