d amp d of malware with exotic c amp c
play

D&D of malware with exotic C&C D&D = Description & - PowerPoint PPT Presentation

Mar 13, 2023 •423 likes •781 views

D&D of malware with exotic C&C D&D = Description & Detection C&C = Command & Control Automotive Consumer Energy & Chemicals Paul Rascagneres - @r00tbsd Eric Leblond - @Regiteric D&D of malware with exotic C&C

  1. D&D of malware with exotic C&C D&D = Description & Detection C&C = Command & Control Automotive Consumer Energy & Chemicals Paul Rascagneres - @r00tbsd Eric Leblond - @Regiteric D&D of malware with exotic C&C | Hack.lu | October 2014 Life Sciences & Healthcare

  2. Introduction About us - Paul Rascagnères: malware analyst at G DATA SecurityLabs - Eric Leblond: co-founder of Stamus Networks, Suricata developer D&D of malware with exotic C&C | Hack.lu | October 2014 2

  3. Introduction Why this talk? - to explain advanced communication channel used by modern malware; - to explain how to correctly detect and contain attacks (to be blind in your network is the worst situation); - to show strength of Suricata; - to show why incident response team should work with network team; - and … D&D of malware with exotic C&C | Hack.lu | October 2014 3

  4. Introduction Why this talk? - because: D&D of malware with exotic C&C | Hack.lu | October 2014 4

  5. Introduction Suricata Intrusion Detection System - Protocol recognition and dedicated keywords - File extraction Network Security Monitoring - Protocol request journalisation - EVE format: JSON output for all events and alerts D&D of malware with exotic C&C | Hack.lu | October 2014 5

  6. Introduction The described cases All malware appearing in this presentation are not fictitious. Any ressemblance to real malware, living or dead, is not purely coincidental. We only describes case in the wild, sorry no BadBIOS during the next 30 minutes… D&D of malware with exotic C&C | Hack.lu | October 2014 6

  7. Case 1 HTTP communication Ex: Havex Quick description: havex is a Remote Administration Tool (RAT) uses on targeted attacks. The group mainly targets petrol companies. Network protocol: this malware uses common HTTP query with a specific pattern D&D of malware with exotic C&C | Hack.lu | October 2014 7

  8. Case 1 HTTP communication D&D of malware with exotic C&C | Hack.lu | October 2014 8

  9. Case 1: Detection HTTP communication The naive approach : - Detect 'havex' string in the flow - Use content keyword for that alert tcp any any -> any any (msg:"havex HTTP"; content:"<!--havex"; sid:1; rev:1;) Problem - All TCP flows are inspected - We want http coming from server D&D of malware with exotic C&C | Hack.lu | October 2014 9

  10. Case 1 : Detection HTTP communication Select the flow : This is HTTP communication Use Suricata http keywords : Dynamic detection of protocol independent of port - Flow with content to detect comes from server alert http any any -> any any (msg:"havex HTTP"; flow:established,from_server; pcre:"/<\!--havex.*havex-->/"; sid:1; rev:1;) - Content has to be find in http body: use Pcre modifier alert http any any -> any any (msg:"havex HTTP"; flow:established,from_server; pcre:"/<\!--havex.*havex-- >/Q"; sid:1; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 10

  11. Case 1#BringBackOurPerf HTTP communication Problem - Fire a regexp for all HTTP content - In the body Solution - Do a pre match on partial content Simple string matching no pcre complexity - Choose it as fast pattern Tell suricata rule multi pattern matching that the string is on differenciator alert http any any -> any any (msg:"havex HTTP"; flow:established,from_server ; content:"<!--havex"; http_server_body; fast_pattern; pcre:"/<\!--havex.*havex-->/Q"; sid:1; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 11

  12. Case 2 HTTPS + GZIP communication Ex: IcoScript Quick description: IcoScript is a Remote Administration Tool (RAT) used on targeted attacks. Network protocol: It uses it own scripting language to manipulate the user’s browser (thanks to COM and CoCreateInstance() ). The malware uses popular webmail as C&C (for example Yahoo). D&D of malware with exotic C&C | Hack.lu | October 2014 12

  13. Case 2 HTTPS + GZIP communication Ex: IcoScript The orders are present in the content of an email stored on Yahoo webmail. The command is located between <<<<<< and >>>>>>. To detect this pattern, we need to solve two difficulties: - Yahoo uses SSL to encrypt the network flow; - The web content is compressed thanks to GZIP algorithm. D&D of malware with exotic C&C | Hack.lu | October 2014 13

  14. Case 2 Detection HTTPS + GZIP communication Suricata http handling - Based on libhtp by Ivan Ristic - Libhtp handles gzip transparently - Any match on a gziped HTTP object is done on ungzipped content alert http any any -> any any (msg:"havex HTTP"; flow:established,from_server ; content:"<<<<<"; http_server_body; fast_pattern; pcre:"/<<<<<.*>>>>>/Q"; sid:2; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 14

  15. Case 3 Named pipe communication Ex: Uroburos, r*g*n, Quick description: Uroburos is a rootkit. The purpose is to provide a remote acces on the infected malware and to steal data. This malware was used during targeted attacks against government. Network protocol: this rootkit used several network protocol. This case is only limited to the usage of named pipe between infected machines. D&D of malware with exotic C&C | Hack.lu | October 2014 15

  16. Case 3 Named pipe communication Ex: Uroburos, r*g*n, D&D of malware with exotic C&C | Hack.lu | October 2014 16

  17. Case 3 Named pipe communication Ex: Uroburos, r*g*n, The rootkit uses the following named pipe: - \\machine_name\\pipe\isapi_http - \\machine_name\\pipe\isapi_dg - \\machine_name\\pipe\isapi_dg2 D&D of malware with exotic C&C | Hack.lu | October 2014 17

  18. Case 3 Named pipe communication Ex: Uroburos, r*g*n, Specific context: - Inter desktop communication - Not on internet path - How to capture - Specific parameter on switch - Pcap capture on a host and replay D&D of malware with exotic C&C | Hack.lu | October 2014 18

  19. Case 3 Named pipe communication Network specificity The C&C is characterized by local trafic - IDS place must match Usual way is on the internet path Here IDS must intercept local trafic Local trafic can mean huge trafic - In forensic/analysis : Pcap or custom IDS D&D of malware with exotic C&C | Hack.lu | October 2014 19

  20. Case 3 Named pipe communication First attempt : - Use dce/rpc keywords to detect - Seems to use SMB protocol Back to the roots - Content based detection, offset - Port filtering alert tcp any any -> any 445 (msg:"isapi smb"; flow:established,to_server; content:"|FF|SMB|a2|"; offset:4; content:"|69 00 73 00 61 00 70 00 69|"; sid:5; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 20

  21. Case 4 User Agent communication Ex: Houdini Quick description: Houdini is a Remote Administration Tool (RAT) developed in VBS. It was used during targeted campaign. Network protocol: This malware use common HTTP query. However the communication is perform with the User Agent field. D&D of malware with exotic C&C | Hack.lu | October 2014 21

  22. Case 4 User Agent communication Ex: Houdini D&D of malware with exotic C&C | Hack.lu | October 2014 22

  23. Case 4 User Agent communication Got a characterisation on user-agent - Can use a fast pattern on basic motif - Do a pcre on user agent Using V modifier alert http any any -> any any (msg:"Houdini"; flow:established,from_server ; content:"<|>"; http_user_agent; fast_pattern; pcre:"/.+<|>.+<|>.+<|>/V"; sid:2; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 23

  24. Case 5 DNS communication Ex: FrameworkPOS Quick description: On the G DATA SecurityLabs, we are currently working on new generation of Point Of Sale (POS) malware. The purpose of this kind of malware is to parse the memory of the infected system in order to get credit card data. Network protocol: to exfiltrate the data, the malware uses DNS query. D&D of malware with exotic C&C | Hack.lu | October 2014 24

  25. Case 5 DNS communication Ex: FrameworkPOS D&D of malware with exotic C&C | Hack.lu | October 2014 25

  26. Case 5 DNS communication Ex: FrameworkPOS Example of query: 1234-1234-1234-1234.domain.vilain ( not exactly correct but enough to understand ) D&D of malware with exotic C&C | Hack.lu | October 2014 26

  27. Case 5 DNS communication Ex: FrameworkPOS Methodology Protocol recognition on DNS dns_query keyword alert dns any any -> any any (msg:"Query to supervilain"; dns_query; content:"supervilain.ru"; sid:5; rev:1;) D&D of malware with exotic C&C | Hack.lu | October 2014 27

  28. Case 5 DNS communication Reverse exfiltration crypto ^ 0xAA ^ 0x9B ^ 0xC3 Equal to ^ 0xF2 D&D of malware with exotic C&C | Hack.lu | October 2014 28

Recommend

Haskell at Barclays: Exotic tools for exotic trades Tim Williams | 5 December 2013

Haskell at Barclays: Exotic tools for exotic trades Tim Williams | 5 December 2013

Haskell at Barclays: Exotic tools for exotic trades Tim Williams | 5 December 2013 Introduction Exotic equity derivative contracts come in a variety of structures and clients are continually requesting new ones. In order to remain competitive

484 views • 47 slides
Exotic Branes and Exotic Branes and Superconformal Field Theories Superconformal Field Theories

Exotic Branes and Exotic Branes and Superconformal Field Theories Superconformal Field Theories

Exceptional Groups as Symmetries of Nature 17 @ KEK July 18, 2017 Exotic Branes and Exotic Branes and Superconformal Field Theories Superconformal Field Theories Tetsuji KIMURA Tokyo Institute of Technology Contents 1. Exotic branes

761 views • 72 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
FRET: FOG COMPUTING FOR REALTIME EXOTIC TRADES 1 FRET: FOG COMPUTING FOR REALTIME EXOTIC

FRET: FOG COMPUTING FOR REALTIME EXOTIC TRADES 1 FRET: FOG COMPUTING FOR REALTIME EXOTIC

FAISAL HABIB CSC 2228 PROJECT PRESENTATION DECEMBER 4, 2019 FRET: FOG COMPUTING FOR REALTIME EXOTIC TRADES 1 FRET: FOG COMPUTING FOR REALTIME EXOTIC TRADES INTRODUCTION Quick Overview of Financial Instruments Problem Description

262 views • 12 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Exotic Superconductivity Exotic Superconductivity A matter of Symmetry and Topology A matter of

Exotic Superconductivity Exotic Superconductivity A matter of Symmetry and Topology A matter of

Exotic Superconductivity Exotic Superconductivity A matter of Symmetry and Topology A matter of Symmetry and Topology Feb 2013 Manfred Sigrist A B Hunting the Higgs - finally a happy end LHC CERN Switzerland P. Higgs P.W. Anderson

970 views • 72 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND &amp; CONTROL QUESTIONS &amp; ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Measurement of exotic hadrons at LHCb Pavel Krokovny on behalf of the LHCb Collaboration Budker

Measurement of exotic hadrons at LHCb Pavel Krokovny on behalf of the LHCb Collaboration Budker

Measurement of exotic hadrons at LHCb Pavel Krokovny on behalf of the LHCb Collaboration Budker INP &amp; Novosibirsk University Outline: LHCb detector &amp; data taking Exotic mesons Exotic baryons LHCb upgrade Summary

814 views • 46 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
Exotic Options: An Overview Exotic options: Options whose characteristics vary from standard call

Exotic Options: An Overview Exotic options: Options whose characteristics vary from standard call

Exotic Options: An Overview Exotic options: Options whose characteristics vary from standard call and put options or K K Exotic options also encompass options which involve combined

348 views • 34 slides
motivation and context: exotic states of QCD spectrum phenomenology and formalism:

motivation and context: exotic states of QCD spectrum phenomenology and formalism:

production and search for exotic mesons at COMPASS and JLab12 Vladiszlav Pauk JPAC @ JLab MESON 2016 Krakow, Poland O U T L I N E - 1- motivation and context: exotic states of QCD spectrum phenomenology and formalism:

631 views • 24 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
$ $ $ Amy P. Smagula Limnologist/Exotic Species Program Coordinator NH DES Right now there are

$ $ $ Amy P. Smagula Limnologist/Exotic Species Program Coordinator NH DES Right now there are

Exotic Aquatic Plant Control in NH: What s the Bottom Line? $ $ $ Amy P. Smagula Limnologist/Exotic Species Program Coordinator NH DES Right now there are 85 infestations on 76 waterbodies. 67 variable milfoil 5 Eurasian milfoil

435 views • 25 slides
(B02 Exotic nuclei for

(B02 Exotic nuclei for

(B02 Exotic nuclei for investigating hierarchical structure of matter (Grp-B02) Takashi Nakamura Tokyo Institute of Technology Kickoff Symposium,

649 views • 25 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides

More recommend