[00:09.860 --> 00:13.880] All right, so I'm going to get started today with a malware talk. [00:14.520 --> 00:18.280] Some of you just rolled out of bed, so that's good, that you made it this early in the morning. [00:19.880 --> 00:21.780] Sure, last night was pretty rough for you. [00:23.660 --> 00:32.480] So I'm talking about basically malware on the network today, you know, is it going to blend, and what it's actually looking like these days. [00:34.020 --> 00:35.600] But first, I'll introduce myself. [00:36.300 --> 00:37.240] My name is Mike Sikorski. [00:37.460 --> 00:40.760] I'm based actually here in New York City, so this is very convenient for me. [00:41.400 --> 00:44.060] I've been at Mandium for seven years now. [00:44.440 --> 00:46.840] First, I was a sort of jack-of-all-trades consultant there. [00:47.200 --> 00:53.500] Moved on to be more of a focused malware analyst and reverse engineer, and built out a team there that does stuff like that. [00:54.240 --> 01:01.100] My research is primarily focused on classifying, you know, malware as good or bad, or binaries as good as bad or bad. [01:01.100 --> 01:04.720] And then also clustering, basically taking malware and grouping it together. [01:06.260 --> 01:09.560] And I also do a lot of knowledge sharing, so I teach a lot. [01:09.940 --> 01:16.520] I taught at Black Hat the last seven years, and going out to Vegas in the desert yet again this summer in August. [01:18.300 --> 01:25.200] And my background is, right out of college, I went to work for the NSA, and then did a stint of research up at MIT Lincoln Laboratory. [01:25.660 --> 01:29.960] And for fun, I do triathlons, and that's me just getting out of the Hudson River. [01:30.060 --> 01:36.240] I'm actually jumping in the Hudson again, which I highly recommend, especially when you get kicked in the face and take a gulp of water. [01:36.360 --> 01:37.020] It's really healthy. [01:38.980 --> 01:42.860] But luckily, you get some current, so you're out of there as quick as possible. [01:43.140 --> 01:49.120] But I'll be jumping in there August 3rd, so if anybody's around at 5 in the morning, just come stop by. [01:49.780 --> 01:54.020] And I also am on quests to find, like, the best beers in the world. [01:54.040 --> 01:58.160] So I've been to, like, you know, Belgium and, like, monasteries and stuff like that. [01:58.180 --> 02:03.960] And then that's me up in Vermont, like, not too long ago, hauling back a couple cases of Hetty Topper. [02:04.040 --> 02:07.280] If anybody's a beer connoisseur, come chat with me later. [02:07.740 --> 02:09.120] Like, everybody loves that beer. [02:10.580 --> 02:11.980] And you can find me on Twitter. [02:12.140 --> 02:14.380] I don't tweet too much compared to a lot of people. [02:14.980 --> 02:19.200] Anyway, this is just, you know, who do I work for now? [02:19.480 --> 02:25.820] So now that there's been this, like, sort of transition, you know, Mandiant was kind of in the news with, you know, all the Chinese hacking stuff. [02:25.820 --> 02:30.600] And then, you know, Edward Snowden came out and stole our thunder and nobody cared about us anymore. [02:30.980 --> 02:37.600] But luckily, you know, we got acquired by FireEye not too long ago. [02:37.600 --> 02:46.160] And actually what I did was took the malware team at Mandiant and created this group called Flare, which is basically the advanced reverse engineering team is what we're calling it. [02:47.340 --> 02:50.400] And basically focused on all the reversing needs of the whole company. [02:50.740 --> 02:54.820] And then also basically just focused on knowledge sharing. [02:55.140 --> 02:56.500] You know, what kind of things can we release? [02:56.600 --> 03:00.600] So we're going to be releasing a whole blog series on IDAPro scripts to help you with your reversing. [03:01.100 --> 03:03.160] And we also released this challenge recently. [03:03.380 --> 03:07.320] I don't know if anybody in here has done it, but we've had over 4,000 participants actually. [03:07.320 --> 03:08.420] in just two weeks. [03:09.180 --> 03:12.820] And it's sort of, you know, do it at your own pace. [03:12.960 --> 03:16.600] It's not like a traditional CTF where you got like a couple hours, something like that. [03:16.740 --> 03:17.760] This is basically just to... [03:17.760 --> 03:23.720] If you want to grab some binary challenges and puzzles, they're not all malware focused. [03:24.140 --> 03:26.920] But they do span a wide variety of things. [03:27.120 --> 03:33.400] Everything from like .NET to Linux to actual malware to, you know, a whole variety of things that we cover. [03:33.860 --> 03:36.400] So if you want to take the challenge, go for it. [03:36.400 --> 03:38.980] And you can fly it at flare-on.com. [03:39.140 --> 03:41.560] I have one more last thing before we get to the talk. [03:42.000 --> 03:43.860] Is NoStarch Press is actually here. [03:43.960 --> 03:45.640] I was fortunate enough to write a book with them. [03:45.740 --> 03:46.640] They're an awesome publisher. [03:47.280 --> 03:49.140] And Bill just wrote me into... [03:49.140 --> 03:50.380] He's the owner of NoStarch. [03:50.380 --> 03:55.340] He wrote me into doing like an impromptu, like, book signing right outside the room after this talk. [03:55.500 --> 03:59.100] So if you want to come hang out, talk about malware, I'll be right outside. [04:00.180 --> 04:01.220] So, to talk. [04:01.900 --> 04:05.820] I'm going to start with, by covering, sort of give you a quick history of malware on the network. [04:06.180 --> 04:12.100] After that, we'll open up the malware vault, show you some of the samples that I've actually seen used in the wild. [04:12.960 --> 04:19.360] And then we'll talk about how analyzing malware can help you make more efficient and better signatures to be able to find malware on the network. [04:20.380 --> 04:26.860] And we'll also talk about, basically, how you have to really go to this in-depth reversing level to get the best signatures possible. [04:28.060 --> 04:30.080] So, brief history of malware on the network. [04:30.920 --> 04:37.300] You know, back in the day when things were first established was, like, sort of, you know, arbitrary ports, arbitrary protocols. [04:37.540 --> 04:39.360] Malware could do, really, whatever it wanted to do. [04:39.460 --> 04:41.780] There maybe was a couple roadblocks with, like, NAT or something. [04:41.980 --> 04:43.860] But it was pretty wild west out there. [04:44.000 --> 04:45.760] And it was really easy for them to get around. [04:45.980 --> 04:49.220] But then, you know, defenders started restricting ports they could use. [04:50.260 --> 04:53.660] You know, first they just were focused on inbound stuff, right? [04:53.800 --> 04:55.460] You know, plugging everything that could come inbound. [04:55.840 --> 04:59.000] But then later, outbound as well, they started plugging up. [04:59.220 --> 05:06.800] And then, basically, this pushed the attackers to just focus on ports that they're allowed to go on, such as, like, 80 and 443, obviously. [05:08.360 --> 05:11.320] After that, defenders started restricting the protocols. [05:11.540 --> 05:19.380] So they started inspecting the protocols that were actually running over these ports and confirming that, hey, this is actually HTTP or whatever it might be. [05:20.040 --> 05:23.160] And then also requiring all their web traffic to go through proxies. [05:24.560 --> 05:34.980] So what happened then is, you know, attackers started using SSL and started focusing on whatever it is that you allow on your network is sort of the protocols that they moved to. [05:35.140 --> 05:37.560] I'm going to get into all these things much more in-depth in a second. [05:37.560 --> 05:49.480] And then, finally, you know, defenders started reversing malware and creating more signatures in the forms of snort sigs or whatever it might be and focused on domain names, IP addresses, anything that they could block. [05:51.240 --> 05:53.820] So, what is malware looking like today? [05:54.640 --> 05:56.900] Well, it's hiding in plain sight, okay? [05:57.800 --> 06:01.900] It's... the attacker's goal is to avoid being detected, right? [06:01.980 --> 06:08.760] Because if you detect them, well, they're going to not have access to your system, not going to be able to steal your documents, whatever it is they're trying to take from you money. [06:09.160 --> 06:10.040] We've seen it all. [06:10.820 --> 06:18.220] And then also, you know, they have a risk of being detected in the future, right? [06:18.280 --> 06:27.700] If you start detecting them on your network, maybe you share signatures with somebody else, and then all of a sudden their malware is found on all the networks that they're infecting, right? [06:27.800 --> 06:31.040] So they don't want to be caught because it's going to take them down. [06:32.020 --> 06:36.460] And they use many different tactics to be able to do this. [06:37.020 --> 06:39.540] And I'm going to go through each one, one by one. [06:39.700 --> 06:52.460] But it's, you know, mimicking the protocols that are out there, using... reusing infrastructure that's already out there, and focusing on, you know, calling out from the inside the network instead of coming into the network from the outside. [06:54.180 --> 07:00.920] So attackers love protocols that you use on your network, like HTTP, HTTPS, and also DNS. [07:01.960 --> 07:03.680] It lets them, you know, blend in. [07:03.840 --> 07:06.600] You know, malware back in the day would use IRC and stuff like that. [07:06.700 --> 07:10.860] A lot of people started blocking that on their network because of the fact that malware was using it, right? [07:11.140 --> 07:14.240] So they're going to stay in those protocols that you allow, right? [07:14.360 --> 07:16.380] Because otherwise they're going to really stick out quickly. [07:18.040 --> 07:28.660] And then, you know, we've obviously seen a huge push of malware using GET and POST requests because everybody allows browsers on their network and people to browse the Internet, right? [07:28.780 --> 07:31.500] So it's really easy for them to hide in that kind of area. [07:31.860 --> 07:34.220] They also want to reuse existing infrastructure. [07:35.260 --> 07:36.660] This is extremely common. [07:36.780 --> 07:40.860] We do a lot of investigations for companies. [07:41.060 --> 07:46.140] And, you know, if malware just set up its own server, it would just stick out like a sore thumb, right? [07:46.140 --> 07:50.480] You just take that down and then that sample really wouldn't be doing much. [07:50.940 --> 07:52.560] Instead, what they do is they'll infect... [07:52.560 --> 07:58.740] They'll take down a web server that is, you know, a company or something like that and infect it with the malware or whatever. [07:58.900 --> 08:04.160] And so that way when the malware beacons out, it'll actually communicate with, you know, real, actual servers. [08:04.260 --> 08:15.960] You can imagine if there's some Google server, you allow people on your network to go to Google, but imagine if that got compromised and the malware author had control of it, you'd be able to... you wouldn't really notice because you're allowing Google, [08:16.080 --> 08:16.180] right? [08:18.120 --> 08:20.880] And this helps them basically mask the things they're doing. [08:23.180 --> 08:28.140] And due to NATs and proxies and everybody being so locked down from the outside, right? [08:28.660 --> 08:34.800] Most network security, not all, but most, are very good at not letting people in from the outside. [08:34.800 --> 08:36.860] So what do the attackers do? [08:37.180 --> 08:47.080] They're going to do client-initiated beacon, which is basically, you know, being inside your network and calling out and then establishing a connection to be able to do its bad stuff, right? [08:47.080 --> 08:55.660] So it's going to get into your network via some other means via, you know, a phishing, a spear phishing campaign or something like that to be able to get malware running on your system. [08:55.820 --> 09:07.440] Once it's running on your system, it can then communicate out because people's security is much less focused on the things that are leaving, their network than they are the things coming into their network. [09:16.380 --> 09:21.020] But this makes it very difficult for the attacker to realize basically where they're coming from, right? [09:21.100 --> 09:24.520] They might have infected just some random machine on your network and you don't know where they're coming from. [09:25.340 --> 09:28.880] Or that the attacker themselves don't know where their malware is coming from. [09:29.040 --> 09:31.420] So what they do is they start to embed things like a system survey. [09:31.620 --> 09:35.120] It says, hey, I'm on this host so that you know. [09:35.320 --> 09:40.140] And so if you want to move laterally and go to infect servers and things like that, this is where I'm at. [09:40.140 --> 09:46.800] And that basically gives the malware author knowledge into where they are in the network. [09:48.120 --> 09:55.060] Understanding how this is working is often one of the best steps you can take in order to find malware on the network. [09:56.480 --> 09:59.120] And I'll get into that when I get into the reversing side more. [09:59.280 --> 10:09.120] But it's very often that you're going to have to do some reverse engineering of the malware to figure out how it's basically telling the bad guy where they are on the network. [10:12.660 --> 10:17.280] So malware often wants the ability to not let you block them so easily. [10:17.480 --> 10:21.520] And so they use things like domain generation algorithms. [10:21.840 --> 10:27.440] This is basically malware's ability to generate addresses at runtime, right? [10:27.440 --> 10:34.720] So rather than just go out to do a DNS request and get an IP address back and go to that IP address, well, it's pretty easy. [10:34.780 --> 10:39.160] You just block either the IP that the DNS is returning or you just block the DNS, right? [10:40.180 --> 10:44.500] So there's a variety of ways that malware has tried to overcome this. [10:44.880 --> 10:48.420] And one is you just have a lot of requests. [10:48.940 --> 10:50.820] A lot of botnets use this kind of thing. [10:50.980 --> 10:54.080] You can think of Configure was a big one that uses this. [10:54.460 --> 10:55.980] Zeus was a big one that uses this. [10:56.460 --> 10:59.580] But basically you do have an algorithm and you do numerous requests. [11:00.040 --> 11:05.600] And it could be the algorithm just basically generates domains that with some sequence that the malware author knows. [11:05.940 --> 11:11.160] Here's an example of, you know, www dot and then the date today, right? [11:11.560 --> 11:18.840] So you can imagine if that beaconed out every hour like that for that domain and, you know, it went from 11 o'clock to 12 o'clock to 1 o'clock. [11:19.420 --> 11:25.780] The attacker could predict, oh, in three days this DNS request is going to come out. [11:25.980 --> 11:27.380] That's where I'm going to set up my infrastructure. [11:28.560 --> 11:33.160] Unfortunately, as a defender, you don't really know when they're going to actually set up that infrastructure, right? [11:33.340 --> 11:37.080] Because you don't know which date they're picking or hour they're picking, for that matter. [11:39.320 --> 11:45.440] Attackers often use... we'll take a subdomain and then actually derive a fully qualified domain. [11:45.440 --> 11:47.600] That actually has information in it. [11:47.900 --> 11:54.680] For example, I keep talking about this host survey that might be important where it says, hey, I'm at this place in your network. [11:55.300 --> 12:00.680] This is an example of real malware where obviously the domain's been changed, but evil.domain.com. [12:00.800 --> 12:08.540] And what they would do is actually tack on a subdomain there, which is an encoded host name, which tells them, you know, which machine they've actually infected in the network. [12:09.540 --> 12:13.620] I've also seen malware do multiple requests to calculate an IP address. [12:13.620 --> 12:28.040] So they'll do a request for one legitimate website and another legitimate website and get the two returned IP addresses, do a calculation on them to compute a new IP address, and that's the actual IP address that they communicate to. [12:28.460 --> 12:42.300] So, you know, you can't just... you know, and if they're going to legitimate domain names to calculate that, How could you possibly figure that out without reversing the malware and figuring out how they're combining those IP addresses to generate the one that they're going to? [12:44.440 --> 12:51.080] So obviously, all of these are set to... all these methods, I should say, are set to break, you know, blacklisting. [12:51.180 --> 12:59.780] You can't just take a bunch of domain names and say, okay, our people on our network can't go to these, we're not going to return the DNS, it's just black hole, but that's not going to work, right? [13:01.720 --> 13:03.920] All right, so samples from the vault. [13:04.120 --> 13:06.180] So I reverse a lot of malware. [13:07.060 --> 13:13.120] And so there's obviously a lot of samples we see that sort of communicate in the network in a variety of ways. [13:13.320 --> 13:19.120] So I'm going to kind of go through some of the interesting samples we've seen on the network. [13:23.410 --> 13:26.310] So, like I said, you know, ports are very restricted, right? [13:26.470 --> 13:33.850] You know, the web servers on your network hopefully only allow the things you want, resources, you want people to access, like maybe port 443. [13:34.670 --> 13:43.890] And sometimes an attacker has a legacy piece of malware or something like that, where they, you know, use old ports, like maybe they want to use port 1, 2, 3, 4, 5. [13:44.250 --> 13:52.470] And they don't want to rewrite all their malware, but they want it to still work over port 443, because that's the only way they're going to have access, right? [13:53.130 --> 13:58.110] So they compromise a web server, and the firewall is going to say, it's locked down. [13:58.250 --> 13:59.570] Only 443 is allowed. [14:00.450 --> 14:03.910] But, you know, the attacker wants, still wants access to this back door. [14:04.850 --> 14:09.090] So what they could do is, and what we've seen them do, is they'll still run their back door. [14:09.250 --> 14:10.730] It's listening on 1, 2, 3, 4, 5. [14:10.930 --> 14:12.430] Can't be accessed by anybody. [14:12.970 --> 14:28.710] But what they do is they'll install a kernel mode, root kit, or basically a device driver on the system, which will actually reroute packets automatically at the network layer without, you know, anybody seeing anything at the user space level. [14:29.150 --> 14:38.750] And so what it'll do is they'll see a packet coming in for port 443, and it'll look for a signature, and to know that, oh, this packet's actually not for 443. [14:38.850 --> 14:42.750] I need to rewrite the headers of the packet and send it over to 1, 2, 3, 4, 5. [14:44.410 --> 14:48.450] So this is great for the malware author, because they don't have to rewrite any of their samples. [14:48.570 --> 14:53.750] They just get this driver loaded, and then they have full access to be able to just reuse all their tools. [14:54.790 --> 15:03.870] And the really interesting part about this sample that I thought was we actually saw this on somebody's network on both their Linux servers and their Windows servers, the same exact method. [15:04.190 --> 15:09.450] So that requires a huge difference between malware, right? [15:09.550 --> 15:13.750] Because to have a root kit that's on Linux or a root kit on Windows is a huge difference. [15:13.770 --> 15:18.770] But the fact that they were doing the same thing means they put a lot of thought into it so that their malware would still run on both systems. [15:19.410 --> 15:25.750] And I think that's the first time I ever saw that, where it was actually, you know, the same malware on two different operating systems. [15:26.930 --> 15:29.590] And yes, there is Linux malware, and yes, there is Mac malware. [15:30.890 --> 15:32.070] Most people don't think there is. [15:34.910 --> 15:37.210] So let's think about what you allow on your network. [15:37.550 --> 15:39.070] These are all things you allow, right? [15:39.150 --> 15:42.390] You let people... you... web browse, right? [15:42.710 --> 15:43.770] You access web malware. [15:43.930 --> 15:45.230] You go to Gmail at work, probably. [15:45.230 --> 15:50.110] I mean, I've heard of a few companies locking that down and not allowing that, but it's pretty rare. [15:50.750 --> 15:52.790] Also, you allow chat programs, right? [15:52.890 --> 15:54.370] Maybe Skype, something like that. [15:55.970 --> 15:59.050] Calendars, Outlook, all these things people use at their job, right? [15:59.190 --> 16:01.510] So... so is the bad guy. [16:02.530 --> 16:07.650] So here's an example of... and I have, like, the obligatory screenshot of Vita Pro. [16:08.170 --> 16:11.250] I have to have that in a talk to keep my street cred up. [16:13.250 --> 16:15.390] Anyway, this was a piece of malware. [16:16.070 --> 16:23.170] We were doing an investigation, and the bad guy just kept getting in via the Linux server. [16:23.450 --> 16:25.930] And we, you know, did friends... took a look at the server. [16:26.170 --> 16:28.490] Nothing was really, you know, jumping out at us. [16:28.570 --> 16:30.150] They didn't really have logging turned on. [16:32.170 --> 16:38.230] And... and then we decided to pull apart the SSH daemon, because we thought, hey, maybe there's something going on there. [16:38.470 --> 16:46.550] And we realized that, hey, there's this gotanyroots string in there that's being checked right before they validate the user. [16:46.850 --> 16:54.310] And basically, anybody... what they did was they backdoored the SSH daemon, so that way anybody who's logging in, they just provide the password gotanyroots. [16:54.370 --> 16:55.450] Doesn't matter what your user name is. [16:55.550 --> 16:57.570] Just provide that as your password, and you get into the system. [16:57.810 --> 17:00.450] And so that was their backdoor, back way into the system. [17:00.690 --> 17:11.010] And nobody knows because, hey, they allowed SSH connections in, and, hey, they didn't have logging turned on, so it's not like they could search the logs and see, oh, there's people logging in with gotanyroots. [17:12.250 --> 17:16.030] And so it's pretty interesting how this stayed under the radar for so long. [17:18.250 --> 17:25.430] ICMP, a lot of people don't focus on or even think about this protocol too much, and sometimes it's allowed, and we've seen it used before. [17:26.230 --> 17:32.550] I don't know how many of you are familiar with ICMP, but it's mostly used for, like, sending error messages. [17:32.710 --> 17:35.910] Traceroute uses it to basically figure out how many hops away it is. [17:36.330 --> 17:38.770] If anybody... does anybody know NextGenHacker101? [17:39.270 --> 17:40.390] Yeah, that guy does. [17:40.730 --> 17:44.710] So if you go to YouTube and check out this kid, he's awesome. [17:44.710 --> 17:58.450] He just, like, basically takes, like, tools, like, in this case, Traceroute, which on Windows, it's TracerT, so he calls it TracerT, and basically just makes up how the tool works on the fly. [17:58.730 --> 17:59.870] And it is awesome. [18:00.070 --> 18:02.090] It is absolutely hilarious. [18:02.190 --> 18:02.710] You have to see it. [18:02.790 --> 18:06.110] So, for example, here, he'll be like, all right, this is how Traceroute works. [18:06.170 --> 18:09.590] And if you know how Traceroute works, it basically, you know, you do... [18:09.590 --> 18:13.850] Here, the example is, you know, Tracerouting to Google, and so it's 14 hops away. [18:13.990 --> 18:16.450] Basically, it's going through 14 routers to get to Google, right? [18:17.290 --> 18:18.850] But he just makes it up a fly. [18:18.950 --> 18:21.270] He's like, all right, TracerRT to Google. [18:21.470 --> 18:22.870] This is how many users are connected to Google. [18:23.010 --> 18:23.830] 14 right now. [18:25.150 --> 18:26.810] And this is their IP addresses. [18:27.250 --> 18:28.790] And this is their connection speeds. [18:28.870 --> 18:33.670] And you can see how their connection speeds trail off sometimes or speed up, depending on how close they are. [18:34.290 --> 18:38.330] And this other person, you know, I think it's like, oh, and this one person's at AT&T. [18:38.530 --> 18:40.990] So, you know, and it's just, it's really good. [18:41.070 --> 18:43.430] So, if you have a chance to check it out, it's got a lot of hits on YouTube. [18:43.630 --> 18:46.930] But I love NextGenHacker101. [18:49.090 --> 18:53.910] Anyway, ICMP is leveraged maliciously to be able to... [18:54.510 --> 18:56.170] Basically, there's a data field inside of it. [18:56.250 --> 19:02.430] And since nobody's looking at this protocol, we've seen attackers just basically use it to communicate. [19:02.430 --> 19:07.430] And since there's a data field, you can embed things like a reverse shell really simply, right? [19:07.590 --> 19:12.170] And you can imagine the bad guy, because bad guys who are attacking your network, they always wear masks like that. [19:12.330 --> 19:19.530] And so, yeah, they could just have a simple reverse shell that they put on your network and use via that protocol. [19:20.530 --> 19:23.990] Obviously, keep talking about how attackers were pushed to HTTP. [19:25.510 --> 19:30.550] And, you know, so in this example, there's a get request for badsite.com. [19:30.550 --> 19:35.430] And there's actually a get request, and it's this long number. [19:35.870 --> 19:44.690] Once again, this long number is going to be that host survey beacon that basically tells the attacker what system's infected. [19:46.810 --> 19:50.990] And not a lot of people are doing inspection of their URIs, surprisingly. [19:51.770 --> 19:54.150] And so, malware like this still works. [19:56.650 --> 20:01.970] And I'll talk more about why URI inspection is very important. [20:03.770 --> 20:05.650] Also, there's the user agent field. [20:06.150 --> 20:09.450] So, in this example, a request is going out. [20:09.670 --> 20:17.030] And, you know, user agents is used to basically identify your browser to a web server to basically say this is Chrome or this is Firefox or an iPhone or whatever. [20:18.950 --> 20:24.670] And what this is doing is the malware actually embedded that survey inside the user agent. [20:24.790 --> 20:28.190] Obviously, this should stick out like a sore thumb if you're doing inspection of your HTTP. [20:29.390 --> 20:30.910] But a lot of people are not. [20:31.130 --> 20:36.330] So, a lot of user agent signatures are able to be written out there. [20:37.070 --> 20:38.250] Also, HTML comments. [20:38.430 --> 20:40.010] This is sort of the famous one, right? [20:40.070 --> 20:41.870] This was in the APT1 report. [20:41.870 --> 20:44.570] This is the Comment Crew, Web C2. [20:44.930 --> 20:46.690] There's like 50 different names for this group. [20:46.830 --> 20:53.030] But this is sort of like the original thing that they used. [20:53.610 --> 20:59.370] And they would have Base64 encoded HTML comments on their page. [20:59.570 --> 21:02.230] And when the first time I ever saw this was many years ago. [21:02.810 --> 21:04.870] And I was at a client. [21:05.550 --> 21:11.270] This is when we used to go on-site to reverse engineer malware because I don't know why we thought we could only do it on-site. [21:11.270 --> 21:13.050] So, I forget where we were. [21:13.670 --> 21:17.670] But anyway, you know, nothing was showing up in the logs. [21:17.890 --> 21:18.730] But we had the malware. [21:19.170 --> 21:24.810] And then I saw the malware was connecting to like this dog kennel company in like Nebraska or somewhere. [21:24.950 --> 21:28.470] And I'm like, why would malware be connecting to a dog kennel company? [21:28.850 --> 21:32.030] And this is before all this information came out. [21:32.210 --> 21:34.610] And so, I realized that they were pulling down HTML comments. [21:34.610 --> 21:47.710] And so, what actually ended up happening was the attacker compromised this dog kennel, thus reusing infrastructure, which I was talking about earlier, to be able to serve up web pages that they've modified. [21:47.990 --> 21:50.850] In this case, an HTML page you see there. [21:50.970 --> 21:52.470] That's not what shows up in your browser. [21:53.010 --> 21:55.390] But that's actually what it looks like over the wire. [21:56.550 --> 22:04.350] And anything that starts with that sort of exclamation point at the beginning, as you see on the bottom, that's not going to show up inside your browser. [22:04.510 --> 22:05.970] And so, it's an easy way for them to hide. [22:06.670 --> 22:12.850] So, this was really popular for a while until, you know, people started realizing it was going on. [22:14.950 --> 22:18.290] MSN Messenger, so you obviously allow chat on your network. [22:18.570 --> 22:20.150] Well, not obviously, but a lot of you do. [22:22.090 --> 22:28.670] And MSN Messenger is actually one of my favorite pieces of malware for just for how simple it was and for how cool it was. [22:29.070 --> 22:35.690] Basically, this network was... they were pretty... their security of the company was pretty strong. [22:36.090 --> 22:39.070] But they did allow MSN Messenger on their network. [22:39.610 --> 22:41.930] And I don't know why anybody would do that, but... [22:43.230 --> 22:48.390] And what this malware did was it pretended to be just an MSN Messenger client. [22:49.410 --> 22:54.510] And so, it actually... the cool thing about it was it communicated with genuine Microsoft servers. [22:54.930 --> 23:07.050] So, how would you... there's no way from a network standpoint for you to notice the difference, right, from a user who's just accessing the MSN Messenger infrastructure or somebody else. [23:07.210 --> 23:08.710] And the malware had accounts and passwords. [23:09.810 --> 23:12.410] And I guess I should say, MSN Messenger is very much like Skype. [23:13.330 --> 23:14.090] And so... [23:16.110 --> 23:18.390] And this protocol is actually not proprietary. [23:18.390 --> 23:23.810] So, there's a lot of APIs out there to be able to write software that communicates with these servers. [23:24.450 --> 23:26.670] And a lot of open-source projects you could copy. [23:27.050 --> 23:32.670] And the cool thing about this malware is it would log in and it would go to a chat room. [23:33.110 --> 23:35.010] And the chat room there was actually the bad guy. [23:35.270 --> 23:39.350] And so, the bad... the attacker would actually... if you can imagine, you know, you're in a chat room. [23:39.450 --> 23:40.670] You have all your friends in your chat room. [23:40.770 --> 23:41.450] You hang out and talk. [23:42.250 --> 23:43.170] Those aren't your friends. [23:43.290 --> 23:45.110] They're actually all compromised machines. [23:45.110 --> 23:47.770] And so, you could just talk to each individual friend. [23:47.850 --> 23:50.310] But you're actually talking to a compromised machine. [23:50.510 --> 23:51.810] And so, you have your whole chat list. [23:52.070 --> 23:55.270] And you're just communicating to each one, one by one. [23:55.370 --> 23:57.370] And saying, oh, get this file off this system. [23:57.550 --> 23:59.030] Oh, upload this piece of malware. [23:59.290 --> 24:00.890] Oh, move laterally in this way. [24:01.010 --> 24:01.590] Do this command. [24:01.930 --> 24:02.810] And you're just having... [24:02.810 --> 24:06.330] And so, the attackers are sitting back and just having a chat... [24:06.330 --> 24:08.050] Basically, just hanging out in a chat room. [24:08.050 --> 24:10.110] But actually, what they're doing is they're... [24:10.110 --> 24:11.750] They're doing all the bad stuff they want to do. [24:11.890 --> 24:13.250] And grab all the files off your systems. [24:16.670 --> 24:18.110] So, do you allow chat? [24:18.330 --> 24:18.870] Do you allow Skype? [24:19.290 --> 24:20.130] Yahoo Messenger? [24:20.330 --> 24:20.650] Jabber? [24:20.830 --> 24:21.630] I've seen them all. [24:21.810 --> 24:23.470] So, it's not just MSN Messenger. [24:23.770 --> 24:25.170] It's every single one of these. [24:25.970 --> 24:27.910] There's APIs out there to be able to use them. [24:28.110 --> 24:29.810] Or somebody reverse engineered the protocol. [24:30.070 --> 24:31.070] And that's available to them. [24:31.350 --> 24:34.330] So, just know that, you know, they're... [24:34.330 --> 24:35.550] They're snooping around. [24:35.710 --> 24:36.930] They're going out via chat. [24:38.770 --> 24:41.850] Also, Webmail, Gmail, Yahoo, whatever it is that you use. [24:42.330 --> 24:43.710] We've seen them use that as well. [24:44.450 --> 24:47.990] This is, you know, malware will actually log in to Gmail. [24:49.330 --> 24:50.990] And check if there's any messages. [24:51.210 --> 24:53.430] If there's any messages saying... telling it what to do. [24:53.910 --> 24:54.610] Hey, go... [24:54.610 --> 24:55.210] Excuse me. [24:55.630 --> 24:57.090] Go compromise this server. [24:57.790 --> 24:59.850] Or go, you know, DOS this website. [24:59.970 --> 25:00.870] Whatever it needs to do. [25:01.290 --> 25:02.350] It's just sent email. [25:02.550 --> 25:06.030] So, the bad guy is just sitting back and just having email conversations. [25:06.790 --> 25:07.910] Similar to the chat. [25:10.090 --> 25:15.050] Also, we've seen for large uploads, them use Google Drive or Dropbox as well. [25:16.130 --> 25:19.250] And also, we've seen calendar malware as well. [25:19.630 --> 25:22.690] So, Google Calendar is one that I've seen recently. [25:23.210 --> 25:26.470] Where they use the client login authentication API from Google. [25:26.670 --> 25:30.170] To be able to basically write their malware and interact with the Google Calendar. [25:30.170 --> 25:31.090] And what it does is... [25:31.090 --> 25:33.930] You normally just check your calendar, see what you've got going on today. [25:34.250 --> 25:35.430] The malware does the same thing. [25:35.630 --> 25:38.090] So, you just check their calendar and say, what do I have to do today? [25:38.170 --> 25:38.790] What are my tasks? [25:38.950 --> 25:41.390] Oh, at 11 o'clock, I'm supposed to DOS this website. [25:41.570 --> 25:42.730] And at noon, I'm supposed to do this. [25:42.990 --> 25:44.910] And it's basically, they just set up the calendar. [25:46.070 --> 25:47.090] And that's how they go. [25:47.270 --> 25:48.510] They roll that way. [25:48.670 --> 25:52.090] So, and I know a lot of people access those web calendars. [25:52.090 --> 25:55.690] And so, from a network signature perspective, you know, what do you do? [25:57.710 --> 26:00.270] Also, there's this concept of translating for proxy. [26:00.990 --> 26:04.110] So, let's say you allow Google.com on your network. [26:04.230 --> 26:05.670] You allow your users to go to that website. [26:06.350 --> 26:10.770] But you blacklist DynDNS because malware often uses that. [26:10.910 --> 26:13.390] So, you want to not allow people to go to those websites. [26:14.550 --> 26:21.690] Well, you probably allow translate.google.com or babblefish.yahoo.com or microsofttranslator.com. [26:21.690 --> 26:24.670] You allow all these websites to go. [26:24.870 --> 26:30.050] So, what you could do is, you could say, hey, Google, translate that DynDNS website for me. [26:30.550 --> 26:33.610] So, I could see what content's on there because I can't get to it myself. [26:34.050 --> 26:41.510] And so, what happens is, is translate.google.com goes to that website, which doesn't actually need to be translated, and does the web request on your behalf. [26:41.850 --> 26:49.570] And so, this is a neat way that I first saw malware to basically get around the blacklisting that was happening on their network. [26:49.570 --> 26:51.310] So, first I'll try and go to the DynDNS. [26:51.510 --> 26:52.110] Doesn't work? [26:52.270 --> 26:52.570] Okay. [26:52.810 --> 26:56.370] Well, I'll let, you know, Google translate do it for me. [26:57.190 --> 27:03.730] And this is, this goes back to what I was saying earlier, which is, you got to inspect the full URL for your DNS names. [27:04.230 --> 27:04.590] Okay. [27:04.670 --> 27:12.750] You can't just look at the DNS name itself because in this case, in this first example, you would just look for a translate.google.com and be like, oh, that domain's allowed. [27:12.750 --> 27:22.470] What you need to do is actually look at the entire URL and say, oh, is the DynDNS, or whatever it is you're trying to block, your entire blacklist, for that matter, is inside that URL. [27:22.750 --> 27:27.510] Because it, so you got to start looking at a deeper level, not just, you know, blacklisting DNS names. [27:27.770 --> 27:33.150] And we already talked, covered a whole amount of information as to why just blacklisting DNS doesn't work. [27:33.150 --> 27:39.750] So, check out the whole thing and maybe you'll find some URLs in there, malware trying to go to these translation sites. [27:43.100 --> 27:44.120] You hit the forums. [27:44.940 --> 27:51.120] A lot of attackers want to be infiltrating companies that have a lot of IP, especially software IP, right? [27:51.240 --> 27:53.240] They want to be able to, to get stuff like that. [27:53.660 --> 27:56.600] And you, so you, developers hit the forums, you hit the forums. [27:57.440 --> 27:58.940] It's all allowed on your network. [27:59.860 --> 28:04.600] And so, we've seen malware that hits up Microsoft forums. [28:04.800 --> 28:07.960] In this case, you know, they go to Tim's site here. [28:08.280 --> 28:10.340] And Tim's obviously not a real developer. [28:10.400 --> 28:14.260] But he does have sort of this gibberish on the bottom. [28:14.700 --> 28:16.960] And what that is, is actually just encoded data. [28:17.900 --> 28:24.700] And what that data actually is, once you decode it, is it just says, hey, malware, go to sleep for a couple days and come back. [28:24.700 --> 28:29.700] And maybe I'll have posted something to the forum by then for you to, on what you should do next. [28:30.420 --> 28:35.960] And so, malware just can, you know, hit up the forums and basically get data that way as well. [28:36.280 --> 28:40.300] And everybody allows that outside their network, right? [28:40.520 --> 28:43.240] You allow people to go to forums and stuff like that. [28:45.460 --> 28:46.760] Now there's malware that tweets. [28:47.320 --> 28:49.860] So, it wants to interact. [28:50.440 --> 28:52.700] You know, what it could do is just follow someone. [28:53.100 --> 28:54.700] And that's not actually someone. [28:54.960 --> 28:56.680] It's the bad guy posting commands. [28:57.040 --> 28:59.900] This is a very obvious example for this illustration purposes. [29:00.060 --> 29:00.560] But this is real. [29:02.800 --> 29:08.080] And, you know, obviously, Twitter's trying their best to prevent people from doing this. [29:08.220 --> 29:12.220] Like, you know, DOS, this IP address 50,000 times or whatever, you know. [29:12.600 --> 29:15.820] Or, well, a lot more than 50,000 because they're multiplying by that number beforehand. [29:15.820 --> 29:20.780] But, you know, you know, that kind of stuff, Twitter can try and help block. [29:20.900 --> 29:22.340] But there's ways for them to encode that. [29:22.440 --> 29:24.840] Because they could say, you know, you know, hi, mom. [29:24.960 --> 29:25.400] How's it going? [29:25.440 --> 29:25.820] Or something. [29:26.040 --> 29:28.120] And that actually means you should do that, right? [29:28.220 --> 29:30.320] So, there's ways for them to encode that in a variety of ways. [29:30.580 --> 29:34.680] And so, but basically, there's a lot of APIs out there. [29:34.780 --> 29:38.620] It's really easy for malware authors to write software that connects to Twitter. [29:38.980 --> 29:40.080] They could follow people. [29:40.260 --> 29:41.180] They could tweet themselves. [29:41.420 --> 29:42.660] Say, oh, hey, I'm here. [29:42.660 --> 29:44.240] And that's actually them tweeting. [29:44.480 --> 29:46.200] So, the bad guy is following them. [29:46.380 --> 29:48.380] And there's some user account that they're embedded with, right? [29:49.620 --> 29:54.980] And so, there's been some malware out there that just follows, you know, just one person. [29:55.160 --> 29:56.900] All the malware follows the same person. [29:57.100 --> 30:01.180] And they're able to basically set up a botnet really easily and get their commands via that way. [30:05.060 --> 30:06.680] The Outlook Assistant malware. [30:07.260 --> 30:10.740] So, a lot of people use Outlook at work. [30:12.100 --> 30:13.480] And the bad guy knows this. [30:13.640 --> 30:22.140] And so, they want to be able to, you know, basically send email from your account without you knowing. [30:23.120 --> 30:29.360] And so, the way Outlook works is it actually creates this MAPI session on your Windows machine. [30:29.540 --> 30:31.940] Which is basically sort of like a messaging interface. [30:32.960 --> 30:36.640] And what the malware will do is it will actually create a shared MAPI session. [30:36.960 --> 30:48.340] Which basically says, oh, if anybody's authenticated via Outlook, you know, to Exchange Server or something like that, they, then I just want to share that session with them. [30:49.240 --> 30:55.040] What that enables them to do, it gets them notifications when messages come in, when messages go out. [30:55.400 --> 30:58.860] They could even set rules in your Outlook box with this. [30:59.160 --> 31:03.640] To basically, you know, log things as deleted before you get the chance to read them. [31:05.040 --> 31:13.320] And also, they could check for things like, let's, in this example, this piece of malware, it actually checked for any JPEG attachments. [31:13.320 --> 31:22.200] And if they had a special character inside the name of the file, it would automatically, you know, download that file and run it on the system. [31:23.180 --> 31:28.620] After decoding, because they tried to make it look as much like a real, legitimate image as possible. [31:28.820 --> 31:33.000] But it wasn't actually a legitimate image, it was really more malware to run on the system. [31:35.380 --> 31:40.380] And all email will actually originate and look like it's coming from your account. [31:40.380 --> 31:43.620] Because they're using the shared session and it shares it with your account. [31:45.400 --> 31:49.280] So, it basically provides an awesome mask for them, right? [31:49.500 --> 31:52.540] Because who... there's almost nobody that checks outbound email. [31:53.080 --> 31:55.540] Especially if it's really subtle and it just looks like messages. [31:56.100 --> 31:58.800] And what this malware did, they even took it a step further to blend in. [31:58.800 --> 32:03.960] Instead of like sending very obvious header, you know, subject lines and stuff like, you know, this is malware or something. [32:04.140 --> 32:10.200] They would check your past subjects and, you know, tack forward colon, right? [32:10.280 --> 32:11.520] Because your forward email, they do that. [32:11.680 --> 32:14.320] Or tack RE, you know, regarding this or whatever. [32:14.560 --> 32:17.160] And then copy that out of some old message you had. [32:17.460 --> 32:20.640] And then also copy some contents out of the old messages you had. [32:20.640 --> 32:23.800] So, it actually looks just like a message you've already sent. [32:24.500 --> 32:29.780] However, they're sending it to their own, you know, email address that they already have control of. [32:30.140 --> 32:38.520] And, oh, by the way, they were embedded with many different email addresses that looked very similar to, you know, people that you would be emailing. [32:38.600 --> 32:42.260] Whether it be, you know, Gmail people or just people at other companies. [32:42.620 --> 32:46.240] So, they even had accounts compromised at other companies. [32:46.240 --> 32:51.680] And so, it would look like they were just, you're just sending an email to somebody you send it to all the time. [32:52.060 --> 32:55.300] Problem is, they have this Outlook assistant also running on their machine too. [32:55.460 --> 33:00.080] And so, they can kind of work their way around sending messages without getting caught. [33:02.980 --> 33:03.810] So, what can you do? [33:06.220 --> 33:07.760] So, there's some tools out there. [33:08.000 --> 33:10.740] I'm going to talk about, there's basically two things you can do. [33:10.940 --> 33:17.330] One is, you know, you could try and do this sort of low-level triage of malware to be able to find out as much information you can about it. [33:18.060 --> 33:20.540] And then, there's the more in-depth reversing, right? [33:20.830 --> 33:26.420] And being able to do, basically, you know, look at the malware at an even more in-depth level. [33:26.590 --> 33:32.400] So, but first, I'm going to cover the dynamic tools that are out there, publicly available, that you can use. [33:32.840 --> 33:34.000] The first is FakeNet. [33:35.020 --> 33:41.040] This tool is really, the point of it was to make it as easy to run as possible. [33:41.590 --> 33:45.540] So, you just, you know, double-click it on your Windows system is the easiest way to run it. [33:45.920 --> 33:49.290] And basically, it sets up a fake network, right? [33:49.400 --> 33:53.940] So, you want to trick malware into thinking it's connected to the Internet when it's actually not, right? [33:54.020 --> 33:54.940] That's how you analyze malware. [33:55.870 --> 34:02.790] So, what this does is it allows you to trick the malware and keep it running as much as possible. [34:03.160 --> 34:08.320] So, if malware implements a lot of tricks to be able to say, oh, I don't have an IP address. [34:08.380 --> 34:10.110] Oh, I don't have an actual network connection. [34:10.260 --> 34:11.780] I should just go to sleep and not do anything. [34:12.280 --> 34:18.420] But if you're analyzing malware, you want it to execute and do as much bad stuff as possible so that you can see what it does. [34:19.440 --> 34:21.460] So, that's sort of why FakeNet was built. [34:21.590 --> 34:26.920] And so, it uses a variety of protocol, the most common protocols like DNS, HTTP, SSL. [34:28.610 --> 34:31.190] And it can actually be used just as a web server. [34:31.340 --> 34:36.440] So, if you just need a web server setup and need files serving up, you could just use this to do that kind of thing. [34:36.520 --> 34:37.500] I've used that before. [34:38.050 --> 34:42.480] But really, what you're using it for is to try and tease out as much information from the malware as possible. [34:42.730 --> 34:53.670] The way it works is it's a layered service provider, which basically enables you to hook all of the Windows Winsock functions, basically all the networking functions on a Windows machine. [34:53.670 --> 34:59.420] So, that way you can figure out what the malware is connecting to and things of that nature. [34:59.670 --> 35:06.170] We also have a DNS module that allows you to have the DNS resolved to whatever IP address you want. [35:06.340 --> 35:12.690] Most people choose to use localhost because that's where FakeNet is running and it's emulating all these services, right? [35:13.420 --> 35:18.190] And then there's also the concept of NX domain, which is basically non-existent domain. [35:18.840 --> 35:23.340] A lot of times when you're analyzing malware, you want to tease out as many domains as possible, right? [35:23.340 --> 35:27.210] It's possible that malware has, you know, it's not embedded with just one domain. [35:27.550 --> 35:31.780] And most tools, if you use them, it'll just go to one domain, do its bad stuff, and that's it. [35:31.860 --> 35:34.340] Because it got the connection to that domain, right? [35:34.400 --> 35:35.360] It got the IP address back. [35:36.260 --> 35:45.460] But what you could do is use this NX domain feature to be able to have it basically return, oh, no, that domain doesn't exist, sorry. [35:46.360 --> 35:50.710] And then hopefully it'll go through, the malware will go through and cycle through all of its different domain names. [35:52.040 --> 35:59.110] I also made this basically extensible, so with plugins, so you can write Python to be able to add to it. [35:59.320 --> 36:02.980] And there's an example SMTP plugin for it as well. [36:03.900 --> 36:08.900] And the great thing about FakeNet is it works like not just if DNS is going on. [36:09.000 --> 36:11.420] A lot of other tools, it only works for DNS. [36:11.820 --> 36:18.190] This doesn't matter because it's running on the host and it has sort of this layered service provider concept going on. [36:18.650 --> 36:33.340] It's able to work no matter what port the malware connects to, if the malware connects directly to an IP address, if the malware goes to a domain, all of that will be caught and automatically captured and so that's FakeNet. [36:33.440 --> 36:36.260] Oh, and also, it also does PCAP automatically. [36:36.610 --> 36:44.040] So it'll automatically take all the packets from the malware, put it into a PCAP so that you can analyze that, you know, offline. [36:44.480 --> 36:48.190] So you don't have to have Wireshark up and be capturing in that way or anything like that. [36:51.210 --> 36:58.570] FakeNet configuration is really simple, it's just a text file and you can modify things like what ports different things are listening on. [36:58.840 --> 37:10.960] Obviously, by default, we're listening on every port but you could say, I want this protocol listening on this port and so by default, we, you know, are listening for HTTP on port 80 and 443, we're listening for SSL. [37:11.610 --> 37:19.880] And all of the encrypted traffic like SSL, what we do in FakeNet is we, we actually automatically decrypt it for you. [37:19.960 --> 37:26.300] So you don't have to worry about dealing with SSL and, you know, if you're just analyzing malware and using Wireshark, it's all going to show up as SSL. [37:26.300 --> 37:29.710] What we do is we actually decrypt it all for you and so the PCAP is completely decrypted. [37:30.040 --> 37:32.650] Also, everything that's displayed to the user is decrypted as well. [37:33.590 --> 37:35.320] So its usage is pretty easy. [37:35.460 --> 37:39.380] You just run it and it starts logging stuff to the screen. [37:40.020 --> 37:48.230] And so this is an example where, you know, evil malware.com is the DNS request and then it does a get request for this executable. [37:50.260 --> 37:52.480] We try and serve up as much as we can. [37:52.480 --> 37:54.470] So if the malware requests... [37:55.000 --> 38:01.780] Sometimes malware will try and download an image from, you know, a legitimate website first to check its connection. [38:01.980 --> 38:04.230] Say, oh, can I access this legitimate website? [38:04.400 --> 38:04.590] Okay. [38:04.780 --> 38:07.380] Well, can I also download an image? [38:07.800 --> 38:09.780] And is that image have a valid header? [38:09.960 --> 38:10.520] Something like that. [38:10.630 --> 38:12.090] So we try and serve up as much as we can. [38:12.210 --> 38:16.920] So we'll serve up images, we'll serve up web pages, whatever it is that needs to be done. [38:17.050 --> 38:19.340] And then we'll also serve up even executables. [38:19.340 --> 38:22.230] So in this case, malware is requesting an executable. [38:22.340 --> 38:23.460] We'll give it an executable. [38:23.610 --> 38:27.420] What that executable is, is it's just what we call the fake mini program. [38:27.590 --> 38:28.920] It just does a pop-up on your screen. [38:29.110 --> 38:33.280] As soon as you see the screen, you go, oh, the malware must have downloaded an executable and ran it, right? [38:33.460 --> 38:36.280] Because that's the only way this pop-up would have showed up. [38:36.710 --> 38:38.040] So anyway, you can download that tool. [38:38.400 --> 38:48.780] And FakeNet 2 is coming out this fall, which will have more support for the more modern Windows operating systems and a bunch of cool features as well. [38:49.670 --> 38:51.300] iNet Sim is another tool you could use. [38:51.540 --> 38:54.650] This is, you know, free Linux-based VM that you could download. [38:55.940 --> 39:03.480] It's a little bit more robust as FakeNet, but it's a lot more heavy and more difficult to manage because you basically need, right, another machine. [39:03.500 --> 39:10.380] So if you're doing all your malware analysis on a Windows machine and you want to use iNet Sim, you're also going to need a Linux machine as well. [39:10.440 --> 39:12.320] So you need two machines to be able to get your job done. [39:13.020 --> 39:22.820] But it emulates more services than FakeNet, and it has a lot of dummy services, and it also does that sort of serving up what it can, right? [39:22.900 --> 39:26.630] So you keep the malware running, and you can download it from there. [39:26.730 --> 39:30.760] But this is sort of what the iNet Sim configuration has to look like when you're setting it up. [39:30.860 --> 39:43.040] So you have to have, you know, your Windows virtual machine, your Linux virtual machine, and set up routing properly and things like that so that it all works, especially if the malware is connecting directly to an IP address and not doing DNS. [39:43.550 --> 39:46.570] It sometimes is a little bit of a struggle with iNet Sim. [39:47.690 --> 39:48.840] So, digging deeper. [39:49.920 --> 40:00.570] This is the concept of, yeah, you can use those tools, yeah, you're going to tease out some network signatures, but you can imagine if a sample of malware just starts off and it goes to sleep for two days. [40:01.340 --> 40:05.920] Well, you're not going to sit there waiting for two days for FakeNet or iNet Sim to catch what's going on. [40:06.360 --> 40:12.230] You're going to have to do a more in-depth analysis, and that's where the full reversing comes in, okay? [40:12.380 --> 40:12.940] And there's... [40:14.250 --> 40:17.550] And when you're doing full reversing, there's places you could focus your analysis, right? [40:17.860 --> 40:22.440] Sending and receiving data, obviously, is a good point if you're looking for network stuff, right? [40:22.540 --> 40:25.780] Because that's what the malware is doing when it's communicating on the network. [40:25.920 --> 40:27.040] It's either sending or receiving data. [40:27.690 --> 40:32.780] Also, this concept that I keep bringing up, which the system survey or beacon has to happen, right? [40:32.780 --> 40:34.040] Because there's a... [40:34.040 --> 40:36.630] Malware is using this client side, right? [40:36.800 --> 40:38.300] So inside your network, beaconing out. [40:38.540 --> 40:41.500] And it's got to tell the attacker where it is and things like that. [40:41.650 --> 40:47.420] And so that concept means that, hey, maybe this end data with that first beacon is the place I should look at. [40:47.540 --> 40:50.480] And that's where my most effective network signatures could come from. [40:50.610 --> 40:53.710] Also, it's probably the easiest place to start looking. [40:55.190 --> 40:56.920] So we want to find network code, right? [40:57.070 --> 41:04.150] So what are some functions that are used by malware on Windows systems to be able to communicate? [41:04.550 --> 41:05.420] Well, there's the Winsock. [41:05.520 --> 41:10.320] This is sort of like, you know, your Unix programming days, but on Windows. [41:10.920 --> 41:12.480] So send, receive, connect. [41:12.730 --> 41:14.070] You basically have to manage your own connection. [41:14.900 --> 41:24.550] So if you're using this functionality and you want to do things like HTTP or something like that, you're going to have to manage that whole connection yourself when you use this API. [41:24.920 --> 41:26.590] And get host by name, that does DNS. [41:28.520 --> 41:34.460] But, you know, malware authors don't always want to write all that code to manage all of their connections for HTTP, for example. [41:34.670 --> 41:35.760] So there's higher level APIs. [41:36.670 --> 41:38.780] This is in the form of WinInet. [41:39.190 --> 41:43.400] And this basically gives them a little more flexibility so they don't have to operate at that low level. [41:44.480 --> 41:48.610] And, you know, so it built into this is things like HTTP and FTP. [41:48.960 --> 41:51.040] And so they don't have to worry about those protocols. [41:51.260 --> 41:53.360] It's all managed by the code itself. [41:55.570 --> 42:01.230] And this is basically used for, you know, going to websites and downloading files and things of that nature. [42:02.820 --> 42:04.860] Also, COM is commonly used by malware. [42:05.550 --> 42:11.110] COM is basically a way for programs to share interfaces with each other. [42:11.300 --> 42:17.880] And so the most common one that malware uses for COM is Internet Explorer. [42:18.340 --> 42:25.760] So this is basically enables malware to basically browse using Internet Explorer. [42:25.980 --> 42:40.300] And so if you allow, and let's say you have a host-based firewall or something like that, that is not going to allow the malware to go out, but it will actually allow Internet Explorer to go out, something like that, this is how the malware will automatically run Internet Explorer. [42:40.550 --> 42:50.500] And sometimes it's a little difficult to analyze Because you have to figure out how the interface works, what interface it's using, and so com is a little tricky when you're analyzing it. [42:53.670 --> 43:00.900] So, what places can you focus that are going to help you when you're reversing to write an effective network signature? [43:02.780 --> 43:09.000] You know, if you just look at the network traffic, it's just going to look like random data a lot of the time, but it's not actually random data. [43:09.500 --> 43:13.260] Okay, so just staying and looking at packets only, it's not going to work. [43:13.380 --> 43:14.840] You're not going to write effective network signatures. [43:14.980 --> 43:19.650] So what you're going to want to do is, you're going to want to see, you know, where's the sources of data coming from? [43:19.710 --> 43:24.630] Maybe the data that they're sending over the wires coming from a key logger or something like that. [43:24.730 --> 43:26.610] And that's something you can build into your signature. [43:27.520 --> 43:29.940] Like I said, the beacon is very common. [43:30.050 --> 43:34.170] A lot of times the host name or something like that is embedded in what's being sent out. [43:35.750 --> 43:38.980] And so, you want to focus on the hard-coded data, right? [43:39.130 --> 43:41.070] Because the things that are consistently across runs. [43:41.280 --> 43:42.180] Not the things that are dynamic. [43:42.400 --> 43:47.380] You don't want to signature off of a host name because the host name is going to be unique to the machine that's compromised. [43:47.880 --> 43:51.880] You want to signature off of something that's hard-coded within the malware that's going to make sense. [43:52.480 --> 43:55.920] And so, there's this concept of the hard-coded data versus the ephemeral data. [43:58.370 --> 44:11.120] Basically, malware is, you know, if they use those lower level APIs, then it's going to require them to do more manual work, which means there's more opportunity for them to make mistakes, right? [44:11.420 --> 44:19.780] So you can imagine if the malware author is writing software and they're going to use the low level API, there's more mistakes they can make than if they use the higher level API, right? [44:19.860 --> 44:25.280] Because they have to manage the connection, they probably have to hard code a lot of things, and this enables them to make mistakes. [44:25.280 --> 44:28.800] And they do very often, and you can signature off of those mistakes. [44:29.300 --> 44:32.300] So the most common example of this is in the user agent. [44:32.560 --> 44:37.140] There's a common set of user agents that are allowed out there that exist out there, right? [44:37.260 --> 44:41.420] It's like, you know, it's Mozilla, it's Internet Explorer, it's Chrome, whatever it might be. [44:41.880 --> 44:46.460] And obviously that changes all the time, but there's sort of a common set that you can look at. [44:46.680 --> 44:51.660] And so sometimes malware embeds their own user agent to try and look like a normal browser. [44:51.880 --> 44:53.640] But they might fat finger the name. [44:53.640 --> 44:57.140] For example, you see here Mozilla, they typed a capital Z. [44:57.600 --> 45:00.100] And then boom, you have a network signature just off that capital Z. [45:00.300 --> 45:04.180] And you just block all requests that are using this capital Z. [45:04.320 --> 45:11.580] And then you've effectively blocked that entire malware until, you know, they recompile and reinfect you and come back. [45:11.710 --> 45:15.060] But at least in the meantime, you could signature off something like that. [45:15.210 --> 45:19.400] That's a very simple example, but things like this happen very often in malware. [45:22.270 --> 45:28.080] Also, one thing worth mentioning is that encoding encryption can make this whole thing very tough. [45:28.780 --> 45:36.120] Because, right, what actually is going out over the wire is different than what it is that they're packaging up before they put it on the wire, right? [45:36.200 --> 45:38.340] Because it gets, let's say, encoded in the meantime. [45:39.990 --> 45:43.230] But that doesn't mean you still can't signature off it just because it's encoded. [45:45.070 --> 45:47.080] And I'll show you an example of that in a second. [45:48.030 --> 45:50.700] And so when you're writing a network signature, what do you want to do? [45:50.920 --> 45:52.710] First step, you want to write a signature that works. [45:53.060 --> 45:54.680] Then you want to limit the false positives. [45:54.940 --> 45:59.660] And then you want to make sure it's got actually good performance so it's not bogging down your network sensor or anything like that. [46:01.730 --> 46:03.880] Also, you want to pay attention to the attacker's perspective. [46:04.200 --> 46:08.230] So if they want to try to blend in, I've already talked about that. [46:10.390 --> 46:14.280] And so it's a lot of work for them to update their code, right? [46:14.380 --> 46:16.060] They're software developers like anybody else. [46:16.200 --> 46:19.650] And they don't want to have to, like, recompile and redistribute. [46:20.210 --> 46:22.000] And it's just, like, such a hassle, right? [46:22.000 --> 46:31.160] So, you know, you've got to remember that they have concerns as well as far as their development cycles and things like that. [46:31.280 --> 46:33.440] Just like any other software developer. [46:33.800 --> 46:42.210] And so you're going to want to focus on things that are going to take the attacker a lot of effort to change in their code, right? [46:42.500 --> 46:44.100] Because they're not going to want to make those changes. [46:45.060 --> 46:46.560] So what can you focus on? [46:46.620 --> 46:48.680] You can focus on elements that are on both sides. [46:49.620 --> 46:56.320] So maybe, you know, focus on a signature that's going to require then the change code in both the client side and the server side. [46:56.500 --> 46:58.440] Do you know how much work that is for an attacker? [46:58.680 --> 47:00.680] For them to change their server side and their client side? [47:00.780 --> 47:04.000] Because if they change their server side, they don't have to change every client they have out there. [47:04.480 --> 47:05.340] It's too much work. [47:05.500 --> 47:06.160] They're not going to do it. [47:07.000 --> 47:10.780] And then after that, you could reverse more than others. [47:10.900 --> 47:15.520] Which means what I'm saying here is you want to spend as much time as you can making the most effective signature. [47:15.520 --> 47:29.860] because the more in-depth analysis you do, the more effective the signature is going to be and the longer it's going to last and the more it's going to be related to this concept of making the attacker do a lot of work to overcome what you're doing. [47:30.040 --> 47:39.200] So a simple network signature might be a one-second change for them, but a really in-depth one might require them to take down their entire infrastructure, right? [47:39.200 --> 47:40.760] And they're not going to do that. [47:41.910 --> 47:43.520] So a real quick example. [47:45.440 --> 47:47.760] I'm already starting to run out of time, I think. [47:51.200 --> 47:53.710] Is of how reversing helps, okay? [47:53.900 --> 47:58.230] I want to just show an example of this just to kind of drive home the point. [47:59.140 --> 48:08.080] And the concept here is if you just look at this traffic and this is just one TCP stream from this malware. [48:08.480 --> 48:17.580] There was obviously many, if you had all the different malware variants and saw everything that was actually going on, there was a variety of things. [48:17.900 --> 48:19.400] And you're like, well, what can I signature off of? [48:19.480 --> 48:23.380] Can I signature off of, in this case, you know, servebeer.com? [48:23.380 --> 48:24.780] Can I signature off that? [48:24.960 --> 48:25.780] Well, no. [48:26.180 --> 48:32.460] Because there were many malware or variants of this malware out there that used a variety of domains, right? [48:32.900 --> 48:37.600] Can you, you know, maybe signature off of the CSS? [48:38.100 --> 48:40.200] And, well, that was changing across malware variants. [48:40.860 --> 48:43.080] And then there's this encoded data, right? [48:43.210 --> 48:44.700] Or it looks like encoded data. [48:44.800 --> 48:46.360] It's just a lot of percents and numbers. [48:46.600 --> 48:51.600] And you're like, oh, well, maybe that translates to actual letters and numbers and stuff. [48:51.600 --> 48:55.730] And it's like, well, no, that actually doesn't happen because it is, in fact, encoded. [48:57.200 --> 48:59.120] So what can you signature off of? [48:59.600 --> 49:05.760] You're going to, if you actually reverse engineer, you can figure out what are some of these numbers and what are some of these encodings that's going on. [49:06.000 --> 49:11.460] And you'll actually see the 54 and the 55 there that I've kind of covered in boxes. [49:11.500 --> 49:16.540] And then this sort of key, which I didn't know was a key when I was just looking at the traffic. [49:16.540 --> 49:25.160] It just looked like, you know, another number that it was kind of towards the ending right before the FI that you see there after the 7C. [49:27.540 --> 49:36.300] And what that turns out to actually be is that 7C is just the XOR key that will be used across the whole rest of the sample. [49:36.300 --> 49:41.300] And so 54 XORed with 7C corresponds to open parenthesis. [49:41.580 --> 49:45.560] And 55 XORed with 7C actually corresponds to closing parenthesis. [49:45.710 --> 49:49.040] So it looks like we have open parenthesis and closed parenthesis in there. [49:49.680 --> 49:55.020] But if they use the key other than 7C, which all the Maurer variants did, that's going to change every time. [49:55.020 --> 50:06.380] So you're going to actually have to have logic in your signature to say, okay, let's see if there's right before the FI, if there's a key that I can XOR and then see if there's this open and closed parenthesis. [50:08.040 --> 50:12.280] Also, between the parenthesis is an encoded host name, which is going to vary in size, right? [50:12.710 --> 50:16.700] If the host name could be just a single couple characters or it could be much longer. [50:16.900 --> 50:19.480] And so there's no way to signature off of that length. [50:19.730 --> 50:26.860] So if you thought you were going to just look at the network traffic and a bunch of streams and say, I'm going to be able to find this, it's not going to happen. [50:27.060 --> 50:35.940] You're going to have to reverse engineer it and figure out that there was actually this key concept going on to be able to write the most effective signature possible. [50:38.710 --> 50:39.680] So, conclusion. [50:40.960 --> 50:43.880] The Maurer is getting out, right? [50:44.300 --> 50:46.660] Monitoring by itself is not going to cut it. [50:46.660 --> 50:51.200] And no matter how small a funnel you put, right? [50:51.320 --> 50:54.980] You still got to let your users do work, right? [50:55.100 --> 50:56.500] They got to use their web browsers. [50:56.710 --> 50:57.380] They got to use chat. [50:57.500 --> 50:59.120] Whatever they need to do to get their jobs done. [50:59.560 --> 51:04.060] So the attackers are just going to use that as their means to communicate. [51:05.040 --> 51:08.230] And you're going to have to reverse engineer to get the most effective signatures possible. [51:08.980 --> 51:10.480] And you're going to have to move to the host. [51:10.480 --> 51:13.040] So, don't just look at the network. [51:13.230 --> 51:15.120] Look at the host as well for the Maurer. [51:15.460 --> 51:16.230] But guess what? [51:16.340 --> 51:19.060] They're also blending on the host as well, just like they are in the network. [51:19.980 --> 51:23.320] And they're doing that in the form of rootkits, backdoors, all things like that. [51:23.700 --> 51:27.000] But that's another talk in itself. [51:28.180 --> 51:30.660] So, anyway, that's talk. [51:30.860 --> 51:33.210] And so I can take some questions now. [51:33.210 --> 51:34.320] Yes? [51:34.600 --> 51:34.880] Yeah. [51:35.080 --> 51:35.440] How can, [51:38.680 --> 51:45.900] for instance, amateurs, that kind of thing, keep from being mistaken for malware? [51:46.640 --> 51:52.940] What you're doing is maybe innocent and maybe you'll be partially incompetent if you learn. [51:53.400 --> 51:57.080] But in the meantime, it doesn't look like standard traffic. [51:57.760 --> 51:58.900] You see what I mean? [52:00.100 --> 52:02.040] I'm not sure I understand your question. [52:02.160 --> 52:03.340] You're saying... [52:03.340 --> 52:13.220] If I say I want to set up a search engine of my own to look for things I want to see, rather than what commercial entities want me to see. [52:14.060 --> 52:15.440] So I set up... [52:15.440 --> 52:16.800] So I set up... [52:16.800 --> 52:17.080] So I set up... [52:17.080 --> 52:18.280] So I set up a spider. [52:18.520 --> 52:27.440] I set up a bot to go search the web and gather entries. [52:27.440 --> 52:30.360] And it might not be really competent. [52:30.900 --> 52:32.400] It might look strange. [52:32.800 --> 52:35.480] And yet I don't want to be mistaken for malware. [52:35.800 --> 52:36.600] I have... [52:37.400 --> 52:37.940] Right. [52:44.620 --> 52:46.600] Well, that's the thing is just... [52:46.600 --> 52:47.760] It's this constant battle, right? [52:47.940 --> 52:49.340] Where you're trying to... [52:49.340 --> 52:53.960] You're trying to stop your network, for example, getting infected with malware. [52:54.100 --> 52:58.640] But at the same time, you want to still allow the good things to actually occur. [53:00.560 --> 53:04.700] So I don't know that I could answer that question with a short response. [53:04.880 --> 53:07.000] But other than it's complicated. [53:07.620 --> 53:09.760] Because that's not an easy thing to do. [53:10.600 --> 53:11.680] So anyway, yeah. [53:12.080 --> 53:12.400] Next one. [53:12.400 --> 53:12.800] Okay. [53:13.000 --> 53:15.160] So the signatures. [53:15.400 --> 53:16.460] Signatures of network data. [53:16.640 --> 53:18.140] But a new virus comes around. [53:18.740 --> 53:19.960] A new, you know, botnet. [53:20.140 --> 53:21.480] It'll have different signatures. [53:21.660 --> 53:22.800] You have to want to figure it out again. [53:23.360 --> 53:26.500] What work is being done to look at behavioral stuff? [53:27.840 --> 53:28.640] Because behavior... [53:28.640 --> 53:34.420] Wrong behavior is much more easily protected than the signature you haven't calculated yet. [53:34.640 --> 53:35.040] Yeah. [53:35.280 --> 53:35.880] So exactly. [53:36.080 --> 53:36.580] That's what I was saying. [53:36.700 --> 53:40.620] Like, running on the host and getting on the host is an important part of your... [53:41.700 --> 53:42.840] protecting your network, right? [53:42.840 --> 53:52.060] And so if you're able to be on the host and actually have something host-based, you could recognize when, you know, things are out of ordinary or something's running in a way it shouldn't be. [53:52.740 --> 53:54.000] And so, yeah. [53:54.120 --> 53:56.720] Focusing your efforts there, which a lot of people are. [53:57.280 --> 53:58.840] And so it's kind of two-fold, right? [53:59.020 --> 54:01.340] You want to be able to secure your network as best you can. [54:01.340 --> 54:04.940] Because, hey, you might not be able to focus on every single host on your network. [54:05.160 --> 54:11.020] Because, you know, Jim might have wiped his laptop and still connects out via the network. [54:11.020 --> 54:12.820] So, yeah. [54:12.940 --> 54:13.720] People are doing that. [54:13.800 --> 54:14.240] Absolutely. [54:15.000 --> 54:16.540] Looking for behavior-based stuff. [54:16.760 --> 54:18.580] And there's a lot of behavior signatures. [54:18.720 --> 54:21.760] You can imagine, like I showed the HTML comment concept. [54:22.860 --> 54:27.320] You can write a signature just for generic HTML comments, right? [54:27.440 --> 54:29.040] And be able to find that generically. [54:29.040 --> 54:34.540] So, the goal is, you want to try and make your signatures as least specific as possible. [54:34.660 --> 54:40.680] So that they encompass, basically, maybe an entire concept of attack, right? [54:40.900 --> 54:42.600] And the same goes for being on the host. [54:42.740 --> 54:46.520] There's only a limited number of persistence mechanisms malware can use, or that we know about. [54:47.680 --> 54:50.840] And, hey, can you look for all those persistence mechanisms? [54:50.840 --> 54:56.360] And, hey, it's a very large effort from our author to come up with a new persistence mechanism. [54:56.560 --> 55:03.000] So there's this concept of, hey, can you make your signatures get as close to the attacker as possible? [55:03.400 --> 55:06.120] And I mean by close to them as possible, I mean actually them. [55:06.480 --> 55:12.280] So, like recognize that this piece of software is written by this person or that kind of concept. [55:12.280 --> 55:23.640] So as long as you move as close to that as possible, because obviously that's not a possible thing to do, but get there as close as you can will make the most effective signatures. [55:23.900 --> 55:24.140] Yes? [55:31.150 --> 55:33.430] No, that uninstalls what? [55:37.270 --> 55:43.490] We've seen that before where they have the capability to log into firewalls and then, yeah, modify your rules and mess with you that way. [55:43.610 --> 55:43.950] Absolutely. [55:44.290 --> 55:46.730] That's more, I don't think I've ever seen malware do that. [55:46.790 --> 55:48.030] It's more like the attacker doing that. [55:48.030 --> 55:48.470] Okay. [55:48.770 --> 55:48.890] Yeah. [55:52.750 --> 55:55.950] So, a lot of what you talked about was evading blacklist. [55:56.390 --> 56:00.150] You know, Tumble through ICMP also has the potential to evade whiteness. [56:00.210 --> 56:08.470] Have you seen people doing other stuff like that in terms of structured DNS queries or I don't know what else and that's what I'm asking? [56:10.090 --> 56:10.610] Yes. [56:11.510 --> 56:15.570] Like embedding sort of covert communications over other protocols. [56:15.850 --> 56:16.350] Is that what we were getting at? [56:17.450 --> 56:17.850] Right. [56:17.850 --> 56:18.710] Yeah. [56:18.910 --> 56:25.390] I mean, you could think of like with the DNS requests for, you know, you could embed stuff in the DNS requests, right? [56:25.930 --> 56:26.230] Right. [56:26.230 --> 56:27.430] Same concept as the ICMP. [56:27.650 --> 56:28.010] Absolutely. [56:28.770 --> 56:29.830] And that's going on there. [56:30.130 --> 56:32.610] The thing is that's pretty easy to detect, right? [56:32.690 --> 56:40.010] If you start doing inspection of the DNS or inspection of ICMP or whatever it is that you're allowing in your network, hopefully you can see that. [56:40.810 --> 56:41.170] Yes. [56:41.710 --> 56:42.670] Or wait, I already got one. [56:42.890 --> 56:43.610] I'll go over here. [56:43.770 --> 56:43.850] Yeah. [56:59.540 --> 57:03.720] Yeah, so what I was getting at in the talk is like, those are good starting points. [57:03.840 --> 57:11.500] So you go straight there because you know that's where the malware is actually going to, that's a function, the API functions that the malware uses to communicate out. [57:11.500 --> 57:16.620] So why not focus there first, see if there's any low hanging fruit for your analysis. [57:16.860 --> 57:18.780] It's basically a place you could target really quickly. [57:19.340 --> 57:29.360] And then after that you kind of have to work your way backwards because maybe malware is doing, you know, something weird to be able to, you know, circumvent your analysis from being that easy. [57:30.140 --> 57:30.540] Yes. [57:31.080 --> 57:32.700] One, I think I've got to cut it down. [57:32.780 --> 57:33.580] So one last question. [57:33.860 --> 57:34.460] So is that like, [57:38.170 --> 57:40.450] so you're saying, could it impact it in your mind now? [57:41.150 --> 57:45.090] Could they look really obvious that it's not normally in the AI? [57:46.390 --> 57:47.350] Oh, yeah, absolutely. [57:47.530 --> 57:54.430] There's a lot of people doing, using machine learning and things like that to look for anomalies and DNS names and stuff like that. [57:54.490 --> 58:01.050] So that crazy long DNS name that I showed you, yeah, that should stick out like a sore thumb because that's not something normal that somebody would be going to. [58:01.570 --> 58:05.850] So yeah, there's a lot of work being done out there from that perspective as well. [58:07.250 --> 58:08.530] So anyway, that's all I got. [58:08.670 --> 58:12.070] I'll be outside doing sort of this impromptu no-stars press thing. [58:12.290 --> 58:13.850] So come say hi and talk about malware. [58:14.150 --> 58:15.050] And thanks for your time. [58:39.570 --> 58:40.290] First conference. [58:41.330 --> 58:41.990] Oh, nice. [58:42.190 --> 58:42.570] Good luck. [58:43.290 --> 58:43.650] I [59:13.170 --> 59:14.390] was like, my pocket is empty. [59:16.310 --> 59:18.470] You know, you can feel it, but you're like, in your life. [59:19.670 --> 59:20.430] Don't forget about it. [59:20.430 --> 59:20.530] Don't forget, so. [59:20.810 --> 59:21.550] I'm like, just to grab it. [59:21.550 --> 59:21.570] I'm like, just to there.