Upload File

big game hunting - peculiarities in nation state malware research

  • Home
  • Engineering
  • Big Game Hunting - Peculiarities In Nation State Malware Research
88
BIG GAME HUNTING Peculiarities In Nation State Malware Research

Upload: pinkflawd

Post on 08-Feb-2017

1.577 views

Category:

Engineering


3 download

Report

TRANSCRIPT

Page 1: Big Game Hunting - Peculiarities In Nation State Malware Research

BIG GAME

HUNTINGPeculiarities In

Nation State Malware Research

Page 2: Big Game Hunting - Peculiarities In Nation State Malware Research

WHOIS

Page 3: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 4: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 5: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 6: Big Game Hunting - Peculiarities In Nation State Malware Research

Stux

Page 7: Big Game Hunting - Peculiarities In Nation State Malware Research

~D

Page 8: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 9: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 10: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 11: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 12: Big Game Hunting - Peculiarities In Nation State Malware Research

Offense

Going

Commercial

Page 13: Big Game Hunting - Peculiarities In Nation State Malware Research

AV 2.0

… where the customer is the product

How Anti-Virus went Threat-Intel

Malware.. ‘watching’

Actor tracking

Publicity

APT numbering, logos & names

Page 14: Big Game Hunting - Peculiarities In Nation State Malware Research

http://fc01.deviantart.net/fs11/i/2006/253/8/f/BASIC_TERMS__Sewing_Needle_by_mmp_stock.jpg

Page 15: Big Game Hunting - Peculiarities In Nation State Malware Research

http://cdn2.landscapehdwalls.com/wallpapers/1/haystack-837-1920x1200.jpg

Page 16: Big Game Hunting - Peculiarities In Nation State Malware Research

Haystack Processing

~70.000 – 300.000

new samples/day(Depending which report you trust)

Sample trading

Automated processing

http://cdn2.landscapehdwalls.com/wallpapers/1/haystack-837-1920x1200.jpg

Page 17: Big Game Hunting - Peculiarities In Nation State Malware Research

Needle Processing

Threat Intelligence

Telemetry Data

Leaked Documents

Infected Machines

Gossip

http://fc01.deviantart.net/fs11/i/2006/253/8/f/BASIC_TERMS__Sewing_Needle_by_mmp

_stock.jpg

Page 18: Big Game Hunting - Peculiarities In Nation State Malware Research

Endpoint Wars

Endpoint agents

Threat indicators

Mitigation tactics

Silent data exchange

Page 19: Big Game Hunting - Peculiarities In Nation State Malware Research

AgentThreat detection

& mitigation

Threat

Indicators

Q&A Data

Signature hitsTimestampsHit frequenciesBinaries

Endpoint Wars

Page 20: Big Game Hunting - Peculiarities In Nation State Malware Research

•Signature generation & testing

•Silent signatures

•Binaries

•Telemetry

•‘Free’ security products

Endpoint Wars backstage

Page 21: Big Game Hunting - Peculiarities In Nation State Malware Research

Frenemies & The Fungus

AmongusOr: When Malware Became

Intellectual Property

Page 22: Big Game Hunting - Peculiarities In Nation State Malware Research

Frenemies & The Fungus Amongus

Or: When Malware Became

Intellectual Property

Page 23: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 24: Big Game Hunting - Peculiarities In Nation State Malware Research

[REDACTED] “Where did you find this malware?”

Me: “It was sent to me by targeted

activists.”

[REDACTED] “That’s Cheating.”

Page 25: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 26: Big Game Hunting - Peculiarities In Nation State Malware Research

Taymour KarimSyrian Activist

Page 27: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 28: Big Game Hunting - Peculiarities In Nation State Malware Research

“My computer was arrested before me.”

Page 29: Big Game Hunting - Peculiarities In Nation State Malware Research

Ala’a ShehabiBahrainWatch

Co-founder

Page 30: Big Game Hunting - Peculiarities In Nation State Malware Research

FinFisher Patient-Zero

Page 31: Big Game Hunting - Peculiarities In Nation State Malware Research

Ghazi Farhan

Page 32: Big Game Hunting - Peculiarities In Nation State Malware Research

Ahmed Mansoorand the

UAE Five

Page 33: Big Game Hunting - Peculiarities In Nation State Malware Research

Ahmed Mansoor and the UAE Five

Page 34: Big Game Hunting - Peculiarities In Nation State Malware Research

Hahaha.

Page 35: Big Game Hunting - Peculiarities In Nation State Malware Research

Sometimes Attribution isn’t Tricky

83.111.56.188

inetnum: 83.111.56.184 – 83.111.56.191

netname: minaoffice-EMIRNET

descr: Office Of Sh. Tahnoon Bin Zayed Al Nahyan

descr: P.O. Box 5151 , Abu Dhabi, UAE

country: AE

Page 36: Big Game Hunting - Peculiarities In Nation State Malware Research

Alberto

Nisman

Page 37: Big Game Hunting - Peculiarities In Nation State Malware Research

Alberto Nisman

Page 38: Big Game Hunting - Peculiarities In Nation State Malware Research

Todo parece indicar que Nisman fue engañado.

A su teléfono Motorola xt626 llegó un archivo

con el título “estrictamente secreto

y confidencial.pdf.jar”. Acasocreyendo que se trataba de un documento

importante, lo abrió sin advertir la extensión

“.jar”. Allí estaba el virus.

•3445a61556ca52cf5950583e0be4133de7a4f6a8

Page 39: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 40: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 41: Big Game Hunting - Peculiarities In Nation State Malware Research

Attribution IS tricky?

• Network based indicators point to

Argentina and Uruguay

• Also use of hosting services in the

US, Germany, and Sweden

Page 42: Big Game Hunting - Peculiarities In Nation State Malware Research

Babar

PET Persistent Elephant Threat

Page 43: Big Game Hunting - Peculiarities In Nation State Malware Research

http://dopemichael.deviantart.com/art/Dead-Bunny-Wallpaper-119327469

Bunny

Page 44: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 45: Big Game Hunting - Peculiarities In Nation State Malware Research

LUUUKE I am

your father!!

You.. Sure?

Page 46: Big Game Hunting - Peculiarities In Nation State Malware Research

Misery Business

Who wrote the malware?

Who controlled the malware?

Who were the victims?

What was the aim of the operation?

Page 47: Big Game Hunting - Peculiarities In Nation State Malware Research

BINARY CONTEXT

BINARYBINARY IN

A CONTEXT

Misery Business

Page 48: Big Game Hunting - Peculiarities In Nation State Malware Research

SH* Academics saySource code authorship

attribution

Automatic detection of stylistic features in

binary code

Problems?

Page 49: Big Game Hunting - Peculiarities In Nation State Malware Research

Datafication of RE results

Different domains & lots of attributes

Any attribute can be faked or random

Assumption: Impossible that all vary in all cases

Goal: Even out individual human / compiler influence

Page 50: Big Game Hunting - Peculiarities In Nation State Malware Research

STRING CONSTANTS

Error messages

String formatting style

English grammar mistakes

C&C commands

Timestamp formatting

IMPLEMENTATION TRAITS

Memory allocation habits

Use of global variables

Multi-threading model

Software architecture and design

Constructor design

Dynamic API loading technique

Exception handling

Usage of public source code

Programming language and compiler

Compilation time stamps and time zones

CUSTOM FEATURES

Obfuscation techniques

Stealth and evasion techniques

Use of encryption and compression algorithms

Encryption keys

Re-used source code

Malware specific features

System infiltration

Propagation mechanisms

Artifact naming schemes / algorithms

Data exfiltration techniques

System / OS version determination technique

C&C command parsing implementation

INFRASTRUCTURE

C&C servers

Countries / languages used for domain hosting and naming

Beaconing style

Communication protocol and port

Communication intervals

Page 51: Big Game Hunting - Peculiarities In Nation State Malware Research

Science, yo

Page 52: Big Game Hunting - Peculiarities In Nation State Malware Research

JSON

Page 53: Big Game Hunting - Peculiarities In Nation State Malware Research

BUNNYspearphish

ing with 0-

days

DINOspying in

Iran

CASPERactive in

Syria in

2014

BABARlinked to

French

government

NBOTDenial-of-

Service

Stylometry in

Attribution

Page 54: Big Game Hunting - Peculiarities In Nation State Malware Research

What It’s Not

No authorship attribution

Manual work

Not feasible for automation / machine learning

Interpretation in the eye of the analyst

Page 55: Big Game Hunting - Peculiarities In Nation State Malware Research

Soft Attribution

vs

Hard Attribution

Page 56: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 57: Big Game Hunting - Peculiarities In Nation State Malware Research

“Check out this

super interesting

.cn apt malware

that I found…”

Page 58: Big Game Hunting - Peculiarities In Nation State Malware Research

“uhh… I’m not sure

that’s China...”

Page 59: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 60: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 61: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 62: Big Game Hunting - Peculiarities In Nation State Malware Research

“Looking at the code closely, we

conclude that the “QWERTY”

malware is identical in

functionality to the Regin 50251

plugin.”

Page 63: Big Game Hunting - Peculiarities In Nation State Malware Research

"Blind Freddy

could see E_QWERTY

is a REGIN plugin"

Page 64: Big Game Hunting - Peculiarities In Nation State Malware Research

Legal Spies are obliged to lie

Page 65: Big Game Hunting - Peculiarities In Nation State Malware Research

“There is absolutely no

evidence that links us to

those samples…”

Page 66: Big Game Hunting - Peculiarities In Nation State Malware Research

Denials

In response to the United Nations

panel, the company responded this

January that they were not currently

selling to Sudan.

Page 67: Big Game Hunting - Peculiarities In Nation State Malware Research

Oooops

Internal records show that in 2012,

Sudan’s National Intelligence and

Security Service in Kartoum paid 960,000

euros for Remote Control System.

“We absolutely need to avoid being

mentioned in these documents.”

Page 68: Big Game Hunting - Peculiarities In Nation State Malware Research

C

Page 69: Big Game Hunting - Peculiarities In Nation State Malware Research

C

Page 70: Big Game Hunting - Peculiarities In Nation State Malware Research

“Mr. Marquis-Boire has been a tireless

wolf-crier on the issue of privacy as

he defines it […] that’s a perfect

formula for criminals or terrorists

who routinely use the Web, mobile

phones and other devices.”

It‘s just business

Page 71: Big Game Hunting - Peculiarities In Nation State Malware Research

I’m sure it’s not personal...

"Marquis-Boire" - 117 mentions

"Morgan Mayhem" - 29 mentions

"headhntr" - 15 mentions

Page 72: Big Game Hunting - Peculiarities In Nation State Malware Research

C

Page 73: Big Game Hunting - Peculiarities In Nation State Malware Research

But hey….

Page 74: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 75: Big Game Hunting - Peculiarities In Nation State Malware Research

Cheshire Cat

Page 76: Big Game Hunting - Peculiarities In Nation State Malware Research

SSOOOUU...

e2ca6cca598d47dee311f06920c1efde - 2002-11-05 02:02:19

4e0a3498438adda8c50c3e101cfa86c5 - 2007-08-13 11:02:54

3ba57784d7fd4302fe74beb648b28dc1 - 2008-08-13 15:20:23

7b0e7297d5157586f4075098be9efc8c – 2009-05-03 20:43:05

fa1e5eec39910a34ede1c4351ccecec8 - 2011-05-16 16:55:17

Page 77: Big Game Hunting - Peculiarities In Nation State Malware Research

2002

String obfuscation with XOR 9Bh

Checking for running

security processes (and dummyyy.exe)

Page 78: Big Game Hunting - Peculiarities In Nation State Malware Research

2002

Control component talking to a device driver \\.\asr2892

Sending IOCTLs 220004 & 220008

Orchestrator component executing

binaries from disk

Drops ‘msrun.exe’ from .rsrc section

Redirects standard handles of

spawned process, piping output back to

launcher

Page 79: Big Game Hunting - Peculiarities In Nation State Malware Research

2002

Prepared to run on _old_ Windows versions

Using APIs deprecated after Win95/98/ME

Function to check for the MZ value,

the PE value and the NE value

Page 80: Big Game Hunting - Peculiarities In Nation State Malware Research

2007-2009

Implementation traits and user agent string

indicate Win NT 4.0 as target platform

Persists as shell extension for the icon handler

Wants to run in the context of the ‘Progman’ window

Page 81: Big Game Hunting - Peculiarities In Nation State Malware Research

2007-2009

Implant to monitor terminal server sessions

Global hook to filter for WM_KEYFIRST,

WM_SYSKEYDOWN, WM_CHAR, WM_SYSCHAR

Loads msob4k32.dll and 6 exports by ordinal

Page 82: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 83: Big Game Hunting - Peculiarities In Nation State Malware Research

2007-2009

String obfuscation using XOR 9Bh

Evasive when network

sniffer products are running

Super stealthy network communication:

Versatile communication method

9+ C&C servers, infrequent intervals

Communication done through injected

standard browser instance

Page 84: Big Game Hunting - Peculiarities In Nation State Malware Research

2011

Fine tuned

to paddle around

Kaspersky security

products

Page 85: Big Game Hunting - Peculiarities In Nation State Malware Research

~DF

Page 86: Big Game Hunting - Peculiarities In Nation State Malware Research

Attribution is

hard. Use the

magic 8-ball.

Page 87: Big Game Hunting - Peculiarities In Nation State Malware Research
Page 88: Big Game Hunting - Peculiarities In Nation State Malware Research

Morgan

@headhntr

Marion

@pinkflawd

#FREECLAUDIO

@botherder


Hunting Mac Malware with Memory Forensics

HTA-T07R Malware Hunting with the Sysinternals Tools

THE PECULIARITIES AND FARMING CHALLENGES OF …

Peculiarities of ID Fan Vibration Diagnostics

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Threat Hunting & IR - SANS Institute...Threat Hunting & IR Summit & Training 2019 October 2-7 | #ThreatHuntingSummit @sansforensics Venue ... FOR610 Reverse-Engineering Malware: Malware

HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

Malware Hunting with the Sysinternals Tools

Morphological Peculiarities of Apoptosis’ Course in

Hunting malware with volatility v2.0

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Peculiarities of Pediatric Surgical Patient

Peculiarities of Volatilities

Cyber Hunting Exercise Development - CAE Community · 2020-01-05 · Cyber Hunting n Cyber Hunting q Find unknown threats (e.g. malware, insider threats) q Academy need to catch up

Malware & Anti-Malware

PECULIARITIES & CHARACTERISTICS OF INDIAN CONSUMER

create yara rules with a malware zoo for hunting Python ... · Clustering vs Classification Clustering: Automatic grouping of similar objects into sets. Classification: Identifying

NTXISSACSC4 - Artifacts Are for Archaeologists: Why Hunting Malware Isn't Enough

Language Specific Peculiarities Document for

Practicalities and Peculiarities: The Heightened Due

INTERNETO PASLAUGŲ KOKYBĖ YPATUMAI PECULIARITIES …

Peculiarities of Abattoir and Meat Industry

BIG GAME HUNTING: THE PECULIARITIES IN · PDF fileBIG GAME HUNTING: THE PECULIARITIES IN NATION­STATE MALWARE RESEARCH Morgan Marquis­Boire Citizen Lab, University of Toronto

THE PECULIARITIES OF TURKISH REVOLUTIONARY IDEOLOGY

Peculiarities of implementing mechanism of circular

Geschiedenis the debate on german peculiarities

Huntingmalwarewith Volatility v2 - reconstructer.orgreconstructer.org/papers/Hunting malware with Volatility v2.0.pdf · Huntingmalwarewith Volatility v2.0 Frank Boldewin CAST Forum

Malware Hunting with the Sysinternals Tools Mark Russinovich Technical Fellow Windows Azure SIA302

Peculiarities of Neurostimulation by Intense Nanosecond

ULTRASTRUCTURAL PECULIARITIES OF TURNIP MOSAIC VIRUS

di Nanni Bassetti UN ESEMPIO PRATICO DI MEMORY FORENSICS ... · In quest’articolo si tratterà un piccolo esempio di “malware hunting” (caccia al malware) per illustrare come

DATASHEET...• Прокси-сервера с поддержкой протокола ICAP; Group-IB Threat Hunting Framework / Sensor 4 group-ib.com Polygon Malware Detonation &

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

HTA-T07R Malware Hunting with the Sysinternals Tools · 2020. 2. 14. · Learn about Sysinternals tools and techniques for analyzing and cleaning malware Professional antimalware

Peculiarities of Teaching the Russian Language to … · Peculiarities of Teaching the Russian Language to Children ... The proposed system of methodical work of teaching ... Peculiarities