five days in the life of a cms brute forcing malware
play

FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna - PowerPoint PPT Presentation

Sep 29, 2022 •169 likes •605 views

FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna Shirokova Veronica Valeros Cognitive Threat Analytics Cognitive Threat Analytics @ AnnaBandicoot @ verovaleros WHO WE ARE? Anna Veronica Threat Researcher Threat Researcher

  1. FIVE DAYS IN THE LIFE OF A CMS BRUTE FORCING MALWARE Anna Shirokova Veronica Valeros Cognitive Threat Analytics Cognitive Threat Analytics @ AnnaBandicoot @ verovaleros

  2. WHO WE ARE? Anna Veronica • Threat Researcher • Threat Researcher Cognitive Threat Analytics, Cognitive Threat Analytics, Prague, Czech Republic Prague, Czech Republic • Co-founder of MatesLab Hackerspace in Argentina • Core member of Security Without Borders (@swborders)

  3. ACKNOWLEDGEMENT Sebastian García: http://ar.linkedin.com/in/sebagarcia https://www.researchgate.net/profile/Sebastian_Garcia6 https://stratosphereips.org/category/dataset.html @eldracote

  4. WHAT THIS TALK IS ABOUT?

  5. WHAT THIS TALK IS NOT ABOUT?

  6. POPULAR TARGET ~5% of the Internet websites built with WordPress

  7. AUTHENTICATION METHOD /wp-login.php /xmlrpc.php /administrator/index.php ` ?option=com login /?q=user /?q=user/login /xmlrpc.php

  8. BRUTE FORCING ATTACK Trying different credentials until the correct one found

  9. SIMPLE AUTOMATED WORKS

  10. SATHURBOT

  12. MODULAR BOTNET • backdoor • downloader • web crawler • brute forcer

  13. URL PATTERN OF THE INFECTED TORRENTS

  14. INFECTION

  15. CRAWLER

  16. SEARCH ENGINES QUERY http://www.bing.com/search?q= makers %20 manage %20 manual

  19. p,k,c,a r,j,g,q t,e,d,o f,c,m,t g,g,k,o d,p,b,r k,n,q,b k,o,j,l n,q,j,i g,d,j,e e,k,s,m l,l,j,l p,p,o,c o,c,l,l f,h,b,s r,c,s,h p,l,b,b q,i,d,t o,i,k,e l,h,t,b g,g,k,q d,d,g,p d,j,b,a j,f,h,m o,l,i,g g,q,b,t g,i,o,l d,k,l,m t,c,g,p n,t,m,k j,s,j,i e,k,o,e c,g,h,d r,i,e,b g,e,n,t e,q,d,i

  20. WORDPRESS FRAMEWORK CHECK http://[domain_name]/wp-login.php

  21. BRUTE FORCE MODULE

  22. ATTACK WITH XML-RPC POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 231 Host: www.venuscursos[REDACTED].com.br <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodName> wp.getUsersBlogs </methodName> <params> <param><value>venuscursos[REDACTED]</value></param> <param><value> magic </value></param> </params> </methodCall>

  23. STANDARD CREDENTIAL’S COMBO User name[domain_name]Password POST /wp-login.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 232 Host: www.sanat[REDACTED].org log=sanat[REDACTED] & pwd=magic &wp-submit=Log+In&testcookie=1

  24. NON STANDARD CREDENTIAL’S COMBO User name[special_name]Password POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Content-Length: 227 Host: www.vodokanal[REDACTED].ru <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodName>wp.getUsersBlogs</methodName> <params> <param><value> vdknl2017admin </value></param> <param><value> swimming </value></param> </params> </methodCall>

  25. ENUMERATION SCAN Requesting numerical user IDs to reveal usernames

  26. MORE THAN ONE TRY & PASSWORD TIME:02:17:11.265496 TIME:06:15:32.848090 POST /xmlrpc.php HTTP/1.1 POST /xmlrpc.php HTTP/1.1 Connection: Keep-Alive Connection: Keep-Alive Accept: */* Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1 Gecko/20100101 Firefox/40.1 Content-Length: 226 Content-Length: 226 Host: www.raduapostol[REDACTED].ro Host: www.raduapostol[REDACTED].ro <?xml version="1.0" encoding="iso-8859-1"?> <?xml version="1.0" encoding="iso-8859-1"?> <methodCall> <methodCall> <methodName>wp.getUsersBlogs</methodName> <methodName>wp.getUsersBlogs</methodName> <params> <params> <param><value> raduapostol[REDACTED] </value></param> <param><value> raduapostol[REDACTED] </value></param> <param><value> mokito </value></param> <param><value> system </value></param> </params> </params> </methodCall> </methodCall>

  28. TOP 20 PASSWORDS TRIED

  29. TRIES TO BRUTE FORCE QUORA: GET http://www.quora.com/wp-login.php GIPHY: 
 GET http://giphy.com/wp-login.php SNAPCHAT: 
 GET http://snapchat.com/wp-login.php TWITTER: 
 GET http://twitter.com/wp-login.php SOUNDCLOUD : 
 GET http://soundcloud.com/wp-login.php SHOPIFY: 
 GET http://www.shopify.com/wp-login.php

  30. MOST COMMON TLDS TARGETED gTLD com 1552601 org 139582 net 102798 info 23288 xyz 16076 eu 14732 ccTLD de 68078 uk 59681 nl 45528 cc 45419 cn 36527 au 35410 it 32400 br 28158 pl 26216 fr 25319 ca 24766 ru 21802 es 17372 se 14284

  31. INFRASTRUCTURE

  32. DIFFERENT VERSIONS 2015 SHA-256: 28f1cb771de05473b0c1cc2c21f3c437dc50cc6ab3c4c15ceefb21ea6e6b95fa URL: asdas2qw2aswasasdasd.in/wordpress.php?g=4bc87ed0379a11e5acf3080027535333&b=0&v=1 2016 SHA-256: - URL: edasdfdfwedzsczxczxcawaw1.xyz/wordpress.php?g=5f64c9690c7911e68d7c00155d0a1117&b=0&v=1 2017 SHA-256: 20ae9e5f8f26635c627afce5eaeeb749af459f55138c80f29da9d787ecc38f92 URL: forcedsharetraktor.live/cocos/driver.php?g=e71847216cbc11e7b4e0080027e1e38a&v=3

  33. LINKED EMAIL URL: asdas2qw2aswasasdasd.in/wordpress.php?g=4bc87ed0379a11e5acf3080027535333&b=0&v=1

  34. CONNECTION SEQUENCE 3rd C&C 4th C&C 1st C&C uromatalieslave.space megafreecontentdelivery.club forcedsharetraktor.live 217.23.6.215 217.23.6.155 2nd C&C DNS TXT Record zeusgreekmaster.xyz Connectivity check google.com Brute forcing Crawling

  35. DOMAINS FORCE MASTER asdkjnasdiu3kadsomiljsd force .xyz zeusgreek master .xyz forced sharedtraktor.live apollogreek master .xyz new forced domainsherenow.club jhasdkjanskdjnahsn master .xyz justanother forced domain.xyz jhasdkjanskdjnahsn master .info SLAVE BOOM uromatalie slave .space boom boom boomway.xyz mr slave lemmiwinkstwo.xyz bada boom mail.xyz artemiso slave .xyz bada boom sharetracker.xyz crazyfucking slave mudak.xyz

  36. DOMAINS OTHER TORRENT TRACKERS mega freecontentdelivery.com ed asd fdfwedzsczxczxcawaw1.xyz mega freeshare tracke r.club mozilladownloadshare space .xyz blablablablabla traffic .xyz jhkabmasdjm2 asd u7gjaysgdd asd .xyz webdatasource traffic .xyz asxdq2sax ads dawdq2sasaddfsdfsf4ssfuckk.xyz happynewyear traffic .xyz asxdq2sax ads dawdq2sasaddfsdfsf4ssfuck.xyz web traffic success.xyz kj askd hkaudhsnkq3uhaksjndkud3 asd s.xyz freemplemedia tracker .xyz updateserviceshared space .xyz sharetorrentsonline tracker .xyz adq3asd asd a3adfkunssssss. space coolfastcheap tracker .link khkh asd 89u8ojaodsijdkjaksd.link coolfastcheap tracker .xyz kjh askd jhkuhk2qwskjakjshdkjh123kjs2.in mega newblablablan.in asd as2qw2aswasasd asd .in kjanskduhi8 asd askjdkn.in

  37. DETECTION

  38. VERTICAL BRUTE FORCING

  39. HORIZONTAL BRUTE FORCING

  40. WHY IT IS IMPORTANT?

  41. QUESTIONS? Sathurbot pcap https://stratosphereips.org/category/dataset.html Anna Shirokova Veronica Valeros ashiroko@cisco.com vvaleros@cisco.com @AnnaBandicoot @verovaleros

  42. THANK YOU!

Recommend

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing Authors: Phani Vadrevu and Roberto Perdisci Presented by : Ashwag Altayyar CISC850 Cyber Analytics Bare-metal Analysis Environments Forcing the malware sample to run

388 views • 21 slides
Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE

Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE

A RIZONA S TATE U NIVERSITY Malware Forensics Sukwha Kyung The Center for Cybersecurity and Digital Forensics A RIZONA S TATE U NIVERSITY Common Types of Attacks Phishing Malware SQLi XSS MITM DoS Brute-force &amp;

858 views • 55 slides
#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive

#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive

#100DAYSOFQS: MAKING DATA ART FOR 100 DAYS 100 days is a lot of days HI, IM LILLIAN! Ive been tracking data about myself for 11 years. Find what I use at anomalily.net/life-stack#qs (almost) Each year* I compile an annual report

484 views • 29 slides
Automatic Translation Error Analysis or how to brute-force through exponential complexity

Automatic Translation Error Analysis or how to brute-force through exponential complexity

Automatic Translation Error Analysis or how to brute-force through exponential complexity algorithms by abusing beam search Mark Fishel, T ATI Feb. 5, 2011, Theory Days at Nelijrve Outline Approaches to MT evaluation Automatic analysis

418 views • 18 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your

FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your

FRIEND IN BAD DAYS LIFE INSURANCE Life Insurance aims at fulfilling all your dreams, in your Absence too !! Make I&amp;I the Genie for your family! PRESENTATION Policy that suits every pocket MONEY BACK ILLNESS PLAN CRITICAL PLAN

289 views • 3 slides
MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions

MA/CSSE 473 Day 13 Brute Force Divide and Conquer MA/CSSE 473 Day 13 Student Questions Brute force algorithms Divide and Conquer What is the brute force approach to Calculate the n th Fibonacci number? 1. Compute the n th power

387 views • 14 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger

Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger

Coherent adequate forcing and preserving CH Miguel Angel Mota Joint work with John Krueger Forcing and its applications retrospective workshop Introduction The method of side conditions, invented by Todorcevic, describes a style of forcing in

710 views • 54 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND &amp; CONTROL QUESTIONS &amp; ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Forcing axioms in P max extensions Paul Larson Department of Mathematics Miami University

Forcing axioms in P max extensions Paul Larson Department of Mathematics Miami University

Forcing axioms in P max extensions Paul Larson Department of Mathematics Miami University Oxford, Ohio 45056 larsonpb@miamioh.edu March 12, 2014 Forcing axioms in P max extensions P.B. Larson Forcing axioms Large cardinals Martins

820 views • 39 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash Course Coleman Kane

CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash Course Coleman Kane

CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash Course Coleman Kane kaneca@mail.uc.edu January 12, 2017 VirtualBox Virtualization is a feature present in nearly all consumer CPUs these days that enables you to

557 views • 14 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides

More recommend