SLIDE 1
*DISCLAIMER* this talk is about techniques, not actions. You and ONLY you are responsible for what you do.
WRITING MULTI - PLATFORM SPYWARE *DISCLAIMER* this talk is about - - PowerPoint PPT Presentation
WRITING MULTI - PLATFORM SPYWARE *DISCLAIMER* this talk is about - - PowerPoint PPT Presentation
WRITING MULTI - PLATFORM SPYWARE *DISCLAIMER* this talk is about techniques, not actions. You and ONLY you are responsible for what you do. MISSION: the job of spy ware, is to spy, the goal of the spy ware operator is to spy on humans... the
SLIDE 2
SLIDE 3
MISSION:
the job of spy ware, is to spy, the goal of the spy ware operator is to spy on humans...
SLIDE 4
the goal is simple, acquire as much data as possible, while remaining as hidden as possible.
SLIDE 5
memory corruption disk writes "event" triggers network "volume" CPU load
SLIDE 6
visible changes to the UX reverse engineering is an ever - present risk.
SLIDE 7
TL;DR, ONCE YOUR TARGET SUSPECTS YOUR EXISTENCE, YOU LOSE.
SLIDE 8
INTELLIGENCE GATHERING
SLIDE 9
MEMORY PERSISTANCE
SHARED OBJECT INJECTION
PROCESS ENTER PTRACE SNAPSHOT OVERRIDE PT EXCEPTION SETUP NULL CALL REPLACE REGISTERS RESUME
SLIDE 10
MEMORY PERSISTANCE
HOOKING SYSCALLS
PROCESS
yourCode() someSysCall()
SLIDE 11
MEMORY PERSISTANCE
"THEY'RE IN THE KERNEL!"
SLIDE 12
MEMORY PERSISTANCE
DLL INJECTION
CreateRemoteThread()
SLIDE 13
MEMORY PERSISTANCE
HOOKING ON WINDOWS
SetWindowsHookEx() SetThreadContext() DLL redirection
SLIDE 14
MEMORY PERSISTANCE
LDPRELOAD ON / DYLD_INSERT_LIBRARIES PROCESS MIGRATION
SLIDE 15
MEMORY PERSISTANCE
MODIFY & REPLACE THE APP / LIB
then kill the original process (and restart it if required)
SLIDE 16
MEMORY PERSISTANCE
AUTHOR: JOSHUA PITTS EMAIL: THE.MIDNITE.RUNR[A T]GMAIL<D O T>COM TWITTER: @MIDNITE_RUNR
ROOT@LOCALHOST:~# BACKDOOR-FACTORY
SLIDE 17
MEMORY PERSISTANCE
INSTALL A WINDOWS SERVICE CRON LAUNCHD DLL REDIRECTION
SLIDE 18
MEMORY PERSISTANCE
C:\Users\<user name>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup .bashrc ... init.d modification USB / CDROM autorun network connection auto run (Little Snitch, Microsoft GPO poising
SLIDE 19
MEMORY PERSISTANCE
SLIDE 20
DATA MINING
SLIDE 21
DATA MINING
SLIDE 22
DATA MINING
SLIDE 23
DATA MINING
SLIDE 24
DATA MINING
SLIDE 25
DATA MINING
SSH, VPN, SSL, VNC, RDP, DOMAIN, etc, keys / certs key logger data password databases packet captures GPG, in - memory key tokens whats app signal tor SMIME bio - metric scanners etc...
SLIDE 26
DATA PROCESSING
SLIDE 27
DATA PROCESSING
SLIDE 28
DATA PROCESSING
SLIDE 29
DATA PROCESSING
SLIDE 30
DATA PROCESSING
SLIDE 31
DATA PROCESSING
ELASTICSEARCH
SLIDE 32
DATA PROCESSING
STRINGS, SED, AWK, GREP, CUT, HEXDUMP, FILE, ETC...
SLIDE 33