Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/333 Thanks!
Hi, everybody, how are you doing today?
Welcome to
yeah, whatever.
So
it's a pleasure having you here tonight.
We're going to give you a give you a
great show. Everybody around.
Applause Come on.
It seems I can swear, right,
I can swear to you.
Yes, swearing, yes, no,
shut the fuck up.
I missed my cue because all the so
first of all, we want to apologize.
There was a thing we discovered about the
thingee and we had to change the name of
the talk.
Yeah, that's right. So if you have seen
an early version of the plan
that had a different title on it.
And so what we're going to talk about is
some some case that we analyzed.
And while doing so, we figured that
we were dealing with something much
bigger. So originally we thought that we
were looking at some industrial economic
espionage attack and
then later on it turned into
a high
profile, probably nation
state.
So we're going to finish
at the end with attribution.
But the thing is, attribution is really,
really hard. You can't ever really
tell who it is.
So we're going to be very careful about
our attribution.
But we can sit, we can say at the very
high likelihood this is a nation state.
So we are not going to say this
is a nation state attack, but rather this
is a 99 percent point nine percent,
ninety nine point nine percent a nation
state attack, because we were just
those kind of guys
will go through this again.
We'll get there if we can.
So let's get started.
I think it was against nation state or
was by a nation state or what where?
All right. So getting started.
This is John Ungarie.
First of all, there is the required sunny
joke at this conference.
It's just required, right?
I mean, we can't go on without it.
Told you he came over and said,
Gary, I'm looking to slide.
You have to enact it without my
permission because he said there have
been too many Sony jokes.
It's now old news.
And I had to fight him over this one
of us.
So
they started these really are these
really sort is out there ready to get
your complaints, abuse responses, needs
for help, whatever it is you want to do.
Thank you.
Tillman is basically
very, very humble and it's not up to you.
But that's beside the point.
It's very, very humble and you'll see
it in a second way.
And he basically says he's a reverse
engineer. It's called strike, which is
true enough.
Um, I'm required
to put a few titles up there.
So I removed my entire bio I
CEO of material, which is a startup.
I'm chairman of the board of the Israeli
CERT, which is
kind of handled this presentation, this
instant response.
And it's some things over
there which happened or didn't happen,
whatever. So Dielman, it's
not about pizzas.
That's what you should know about him
before we get started, that his bio.
And I'm a dancing snob.
I dance West Coast swing
now to the topic at hand.
This is the story, the back story.
It was on a dark leaked
April night.
And I'm getting this phone call from a
guy, a really, really nice guy who
understands security and all completely
different things. And he says, Guddi,
somebody just tried to attack us.
It looks like an empty.
Are you interested in that?
No. So he
started selling it started by just
basically saying, send it over to me.
Let's see what's going on.
And you'll see in a second how it worked.
And that's why where I started
looking for somebody to help us handle
it. Technically, we have our people,
but is very volunteer oriented,
eventually found Tullman.
And that's when I asked him for his help.
And he was.
Yeah, look it over, right?
Yeah, pretty much.
And we didn't find much at first.
I'll let you take that one.
I missed that part, so we didn't find
much at first, we didn't find much at
first. So somebody came to me and
said, hey, we need some help with the
technical analysis of this thing.
So I'm always
interested in new stuff, in challenging
stuff. So I took a look and
it was very, very weird because
everything started with a spear fishing
campaign. You guys familiar with
spearfishing? Right.
So there was a targeted,
manually specially crafted email that was
sent to this victim organization that he
was talking about.
And that email
had an Excel document attached to
it. And the text was
designed in a way to trick the user
into opening the the Excel document.
And, of course, the document,
when you would open it, would drop the
payload. So that was the thing.
Right.
And he was bored by it.
He said, well, it looks interesting.
I'll get back to you.
It was basically the beginning of it.
Right.
And I didn't for
a long time, for about a month in
which we worked other cases.
And then things started to get
interesting. And that's where we go into
our story.
So.
Before we begin even tonight, but, you
know, that's the biggest argument
to Monday night head, should we call this
an appetizer? Not because some
of this is really low level salad.
This is really advanced and is everything
we see out there from the Chinese, for
example, and APEC, is it advanced?
Is it a buzzword?
So this is honestly the biggest
time waster in preparing this stuff was
an epiphany. Is it an epiphany or not?
So that's the beginning of our story, if
it's an appetizer or not.
And are we going to talk about it?
So maybe we need to give some to provide
some context for this picture here.
The interesting thing is that this
spearfishing campaign that we initially
looked at was
relying on user interaction.
And that's why there is
I think the guys called Dave over there.
So, you know, other people, they they
they use zero day exploits or something
like that to break into
a target machine and then they deploy
there.
They're the back door tool on there
and steal information or something like
that. This particular threat
relied on the user clicking, OK?
And I mean, if you do that, then
all the technology up there, like
firewalls, antivirus and so on, doesn't
help much, you know, if they click.
OK, so going on from there.
Yeah, we saw spear fishing message.
That was the first one.
Hey guys, whatever.
Here's the message. Next message.
Hey, guys, I'm sorry. Here is the next
message.
Hey, guys, I forgot to follow again.
Here it is.
Now, that's
one of the reasons John basically told
me, forget about it, man. It's not
interesting. Maybe these guys are smart
or not. We'll get to that. But that was
just plain weird.
We just don't see that kind of thing.
Or maybe they just wanted to wanted
to target to become really, really
curious about that file.
We can all psychologically, I'm not an
expert. It could possibly be that
I would pass spam filters.
It could possibly be that's how they gain
interest from the users.
It could possibly be they are just
really, really bad at operations.
Regardless, this is the beginning
of what we saw.
So just to get a little bit of a hint of
what we're seeing up to now in December,
there have been several complaints that
we have had
some sort of coverage into.
Not everything is covered on this
timeline, but there
is more than just the original
company that's adjacent to defense and
aerospace in Israel that we saw.
So starting with that fiction vector,
we've got the spearfishing.
So the doctor sent a specially crafted
email. We saw that one.
Right, was very sophisticated
now.
So we don't disturb me.
So next up, we had
a macro enabled dropper.
Anybody since the 90s have seen a macro
enabled dropper out there.
We've seen a few, but it's not something
that happens a lot. As John just said, we
usually use of unknowability or
something. Next up, the
user needs to abort.
Next up, the backdoor is deployed to
go into all that. It's pretty cool.
And then it downloads and installs
yet another version of itself as a
service for, for instance.
So this is an example of what the XO
looks like. You can see it was Tullman
took the screenshot because German up
there to the giveaway.
Um, this is an example of
Allure and Excel that was sent.
We just want to give you guys immediately
some of the information.
Um, if you look closely,
it might look like it's Austrian.
We don't know it's allured.
We are guessing it's aimed at German
language entity.
We know it's a defense related, uh,
entity, but we can't tell if it's
Austrian or German or anything else.
Just the lure to open the
document is apparently
Austrian.
So largely, yes, so so
the way this works is when
the user first opens the Excel document,
they see the picture from the previous
slide. There are they are asked to
enable macros or to allow macros to run.
And then they do that.
The payload gets deployed and the macro
also switches to another worksheet, I
guess is the term and this is the
decoy worksheet that they're presented
with that's displayed to the user.
And obviously, as you pointed out,
I mean, it's in German language.
So we kind of know that the target, as
is probably German speaking and
there there's also a military context.
OK, moving on.
This is you.
That's me. OK, so those of you
are familiar with the with
the open XML,
the office open XML document format.
That is the default document format.
Since I think Microsoft Office 2007,
if I'm not mistaken, know that
these documents are really zip
files.
Right, zip archives.
And as with any
other zip archive, you can extract that,
you can extract the files from the
archive and this is what you get when you
list the archives content from the
original spearfishing attack.
And we highlighted some of the
more interesting entries for you.
Let me start at the bottom here.
So there's a directory called
the Pops Document Properties.
That's where all the metadata is stored,
like who created the document, when was
it created, when was it last edited and
stuff like that.
And that's all in this caudate XML
file over there.
And then the macro is
in the first red line Excel
Vrba project.
I mean, the macro language for Microsoft
Office is visual basic for applications,
as you guys know.
And that's where the macro is stored.
It's in binary form.
So it's not like readable code, but
you can easily convert it back into
the original macro.
So where is the payload?
The payload obviously is in the third
read file, their Excel custom property
one.
But then again, it's
encoded. What the macro does is it
loads this file on this property, which
is a property of the document, decodes
the payload, drops it to a file
and runs it.
OK, so that's where all the all
the meat is.
All right, so
one of the first things I
guess most analysts do when they deal
with something like this is they look at
information that statically available,
you know, I mean, you can as well put the
document in a in a sandbox and open
it there and watch it
drop its payload.
But you can take a look at the metadata
first. And this is what's in the core
XML file.
So you can see there and we added the
indenting for better readability.
It's usually not indented, but you
can see there there is a creator
XML tag and that contains
the handle woolen hat
in it leetspeak.
OK, and it was also last modified by one
hat. And when was that?
It was created on April 20th
3rd and it was also last
modified just a few hours, about two
hours after that.
OK, so what we have, unless
this information is spoofed, what
we have here is an indicator as
a hint about when this attack
took place or when it was prepared
if we are to believe this information.
OK, so this is interesting.
And later on, you will see
how we use this kind of information
to find other related campaigns.
OK, so this is all statically available
metadata.
This is the custom property
file that stores the payload
and you can see this is Unicode
or white character encoding, so
every other byte is zero byte.
But if you look at the at the right hand
side of this text, you can see some
integer numbers there.
So you can see the first number is a 77,
the decimal number.
Then comes a
pipeline type character and then the
second number is 90, and
then the next number is 144 and so on.
So if you take these numbers and
convert them into the corresponding
binary values and the binary byte values
and write those to a file, what you end
up is what you end up with is
a an executable, a
file.
OK.
So this is the relevant part of the
macro, as I've told you,
you can easily convert the binary
object back into the VBA
code and this is the relevant
part of that. You can see it splits
the text and reads from the property
thing with the character, and
then it does start to use a profile
to so to the user's profile directory and
assist.
And and
then runs it by calling shall
execute with open parameter.
Okay, so this is how the payload gets
involved.
All right, so now we know
how the infection is carried out, there
is this document you asked to click, OK,
I want lawmakers to run and
then shall execute
runs the drop payload.
So what's in the payload?
What is the payload?
And what you can do is you can load that
up into, like, either pro or, you know,
your your preferred reverse engineering
tool. And take a look at the structure
of the data that's in there.
And this is what you see here in this
colored graph. So at the beginning, you
see this this green stuff there,
that's C standard library code.
So that stuff like, I don't know, like
like malac or, uh,
I don't know.
Right. Or send or something like that.
So the basic basic low level API calls
right.
Then the blue stuff is code
that relates to code that has
been written for, for this binary.
So that's the actual code with
the functionality of this thing.
And then Ingrey, you have constant
data.
So in the beginning, there is this little
gray piece of hardware
that contains strings, hard
coded strings, as well as space
for function pointers.
So we will on one of the next slides,
we will talk a little bit about
how API calls are resolved,
which means the code generates function
pointers, the function pointers are
stored in this area, and then you see
some more code blue stuff and then
you see some other gray areas for
for other for more constant data.
And what you find in there,
if you know what you're looking for, is,
for example.
Yes, crypto constants.
So a yes is symmetric
crypto algorithm. Right.
You have these boxes in there and
some stuff like that.
So that's all stored, stored over there.
And then you can also see a tiny little
blue slice at
the end.
And this is where the main function
lives. So when you start to execute, this
binary execution starts at the main
function, obviously, and this is where
that main function is, which is kind of
odd that it's at the end.
But, you know, whatever.
OK, and also we provide the
the five in the Nasha 256
hash here for you.
So if you're interested, if you're
curious, grab that file from
the Internet and take a look
at it yourself.
OK, so we did the same thing as with
this Excel document we first
took a look at at that data
that statically available and
the first thing we looked at was
everything that's part of the header
of the file header.
OK, so what you see in the in the
header of this executable is the debug
so-called debug directory.
The directory is where
debugging information is stored.
So for those of you who are more familiar
with the Unix world or the Linux world,
you guys know that you can have like
symbols in their function, names and
stuff like that. So there is also debug
information available in the Windows
world P binaries.
You have that in the debug directory.
However, when
you're actually debugging something, most
of that information is not embedded
into the binary. It's stored in an in an
external file, a so-called PDB
file PDB stands for program
database. If I'm not mistaken.
OK, so this debug
directory that's part of the executable
has to store a pointer, a link,
the path of the PDF file.
And that's what you see in blue at the
bottom of the slide.
So you can tell by looking at that
again, unless it's spoofed that
this was compiled
in on the drive
in that directory here
under this name. And obviously it's a
Win32 program.
OK,
OK, so that was one thing.
But we didn't we didn't quite
know what to what to make out of this.
So that didn't help us much with our
analysis. But it was interesting that
that path was in there.
Then the next thing we did was we looked
at resources.
So in a binary you can
store additional
arbitrary data.
You can store, for example, Miles
Cursus or you can store icons
or you can store whatever.
Right. And these additional
chunks of data are stored in so-called
resources. So you have an additional
directory in such a file, which is the
resource directory or the resource table.
And what you can see here is
the list of resources in that
binary. And what's interesting is that
each resource has a language
code associated with it.
That's the stuff in blue and also in
black down there. So the stuff.
But what's
interesting here is that the language
code codes in blue stand for
Argentinian, which
could mean perhaps
that this binary was compiled on an
Argentinian system,
which might mean that the the
person who compiled this was running the
system or they just
changed it to the AP when they needed to
choose where to compile it from.
Yeah, or that. So, I mean, of course, you
always have to question this kind of
stuff when you analyze it, but yeah.
So there was this Argentinian nexus to
the whole thing.
But when we when I remember when says
Nexuses Misconnection Argentinean
connections that everybody knows.
I was confused by that for months.
All right. So yeah.
But I mean, we've both been confused
because when we first discussed this, we
said that doesn't really make sense.
I mean, Argentina attacking
an Israeli, uh,
defense and space company.
I mean, I can see other states attacking
Israel or that sector in Israel, but
perhaps not Argentina.
But I mean, I remember personally, I'm
not a politician or anything like that.
Right. So so.
Yeah. So that didn't quite make sense to
us. So we said, OK, we
got to reverse engineer the functionality
and understand what this thing really
does.
And that was our next step.
So this slide is supposed to give
you a high level overview, we will touch
on some of the things that you
see on here in the next
few slides, but this is a high level
overview. So the first thing we noticed
was.
This is more complex,
more advanced, more sophisticated than
the stuff that we usually get to look at.
OK, so this was like really high
quality code. It was well written and so
on. And it has some interesting
characteristics. One was the
entire code was completely
position independent.
So you can load that
at any memory offset offset
and then run it from there.
And it wouldn't rely on any offsets or
relocation or stuff like that for those
of you who are familiar with these
concepts. Right.
So usually you when you want when you do
something like this, when you write
position, independent code that can run
anywhere in memory, you do that
because you want to take this code and
inject it into another process
and because you don't know where you will
happen, we will end up in memory.
You have to keep the code position
independent, OK?
And I mean, injecting code
into another process is always,
let's say,
a little hostile or, you
know, a little
definitely not not
not friendly in most cases
API calls.
So the Windows APIs like write fire,
create file and so on, those are all
resolved dynamically.
So they are not resolved through
import and export tables that
usually haven't been reached.
They are all resolved manually and
dynamically during runtime, which
is part of the position independent
independence paradigm
here.
And there are also calls through BAPA
functions. So, you know, whenever
the code wants to say a file
or send data on to the
network or I
don't know, change the registry key, you
name it, it does that through a wrapper
function that calls the actual function
that does the thing OK.
And we were wondering why, because it
makes the code more complex, but
we didn't really understand why at that
point in time.
And the next thing we noticed was
whenever the code has to deal with
immediate.
Or Constance, as
as you can also say, it
would not use these constants
directly, but it would consult
to look up table.
So let's say
let's say it wants to open an
IP socket.
OK, so in that case, it would
have to use the content to for
for the socket type. Right.
But it wouldn't use the number of two.
It would look
at this lookup table for another constant
then, you know, find the mapping for
that concert and then that would give
them the number two and they would use
that in the in the actual
API call. So we said, why?
Why is it doing that?
And then suddenly we figured, OK,
the code is written in a way that
it exposes a generic
a unified interface.
OK, so you can easily
take this code in ported to, say,
a unique system or a Mac
or BSD, which
is also Unix and other
systems. Right. Other platforms
and keep the.
The interface,
the same right you can use to keep using
the same constants, you can call the same
Rappa functions that then internally call
for different functions.
But this is like an abstract abstraction
layer between the system that the thing
is running on and some other components
that's interfacing with.
OK, so
there's more we found that was
interesting.
The whole thing has to manage, has
to maintain some sessions.
You can talk to it over the network.
That means you have to establish a
session and so on.
Certain management is
is tricky and
you have to keep keep track of sessions
of active sessions.
This thing does it by hashing.
But the hashing method that's used here
is related to Blobfish.
It uses Blobfish, the Krypto scheme
for hashing, which is kind of unusual,
right?
Maybe it sounds a little overengineered,
but you can I mean, it's alright.
You can use billfish for that.
That's a legitimate application,
but it's special.
You know, you don't usually see that
that often.
And then and this is probably the most
important point.
At some point we realized that the stuff
that we were looking at was a generic API
called proxy.
And we will explain what that is
in a minute.
So then we took these last two.
So originally we said Cisco, a proxy,
and then later on we changed that to API
call proxy in our in our notes
so that we took these two terms, Cisco,
our proxy, and we took Blobfish
and we entered that into Google.
Actually, a friend, friend of mine did
that I am working with.
And the first
hit we encountered was supposed
to be a newsletter that come from
over 10 years ago.
And that was an announcement by a company
called Core Security that
is based in Argentina, coincidentally,
and also in America in
Boston. And they announced a new
technology, a new product of theirs that
now runs on some BSD system
as well.
And that was a Cisco proxy and
there was Blobfish involved.
So with this pointer, we went
back to our analysis and confirmed that
the thing that we were looking at was
their product. It was a product called
core impact for those
of you who are familiar with it.
So this is a
little bit odd. We have seen the adapters
using crime.
Where we've seen it after is developing
their own special crafty
tools. But using compact is just
something we have not seen before.
And we've talked to many other
researchers who have not seen that
before. We encounter two others.
We suspected it.
So No. One core security is based
out of Argentina. And based on the
general information, they are completely
white hat. They're good people.
They've been around for a long, long
time. They are very, very innovative.
They did point
in pantheist or point ad hoc, if you
like. But when nobody even thought about
it, at least not on that
level of a scale of a tool that
is so automated
and out there
next, there have been this sounds a
bit corny, but seriously, these guys have
been helping organizations out there
for more far more than a decade
to protect themselves and get better at
security.
They have a patent on this Cisco thing,
which is important to say, and they even
lectured about it in Blacket, there are
very, very open and visible.
But what they do now.
We talk to them and they
helped us throughout this process.
They really tried
to be
as straightforward as they can and as
visible as they can with us in responding
to this incident.
And that's their statement, which we
promised to include.
But the important part is for me and
everybody read that statement,
please. The important part for me is
that these are good guys.
Somebody took their tool like we have
seen happen before and used it for
malicious purposes.
So far, so good.
What June is starting to say now,
new threat tangent to my starting
to say is that, yes, this
is to impact.
But it's also extremely advanced.
It's hot off the shelf technology.
And it is used by a nation state level
threat actor.
That is the first twist in our story
where we really realized something
different is going on.
Yeah, so to give you an idea, I mean,
when we first looked at the thing,
nothing really made sense.
We said, well, Argentina, Argentina
probably not doesn't
sound reasonable.
And then we were speculating maybe,
you know, there are other states or other
advanced threat actors that are known for
knowing how to implement cryptography
properly.
And we saw cryptography being
being implemented properly here in here.
So we said maybe it's coming from that
corner and then we had to change our
assessment again and so on until we
figured, OK, it's this it's
this thing.
It's the core impact agent.
And I will explain what that means in
just a second.
And then it also became
clear to us why we thought
this is like enterprise quality code that
we were looking at because it's a
commercial product.
So just listen to what you just said,
enterprise level code.
When have we last seen
too many malware samples out there that
were actually enterprise level code?
I did not come from a nation state.
That's just the beginning of what's
interesting about this.
All right, so I guess we have to talk a
little bit about your impact and then
I'll continue with that slide here.
So for those of you who aren't familiar
with it and I haven't been familiar we
haven't been familiar with it before this
analysis either
it's a penetration testing framework
and what you do with the
control panel or the console or whatever
you want to call it, that's the software
you're operating.
What you do with that is you deploy
a tiny component, which is called
the agent on a target system.
That's a system you want to test
or one of the systems you want to
penetration test.
OK, and the power
of the tool lies in the ability
to pivot from that system
onto other systems behind it.
OK, so you you
deploy the agent on one system and then
you use that system as a stepping stone
to reach through it to other
systems behind it.
OK, and that's as far as I understand,
I haven't used the product ever.
But that as far as I understand or we
understand, this is the
main feature that makes
our impact so powerful.
In other words, check their websites.
Right.
All right. So we want to talk
about some of the technical I mean, we
could talk talk about the technical
details and the technical
specialties forever.
You can talk about the technical details
forever if you say so.
So, yeah.
So but we don't want to bore you
with too much of it. But there are some
stuff that we that we chose
just to show you how advanced this
is.
This is the the code that you see down
here. This is a lookup table for
constants. So you can see it takes
a key or the lookup
value as an argument and then iterate
over the map and looks
for that other I mean, that's how you how
you perform lookups in a lookup table.
Right.
So that is that is that
part here.
There is another one, there's one for
status codes or area codes, as they're
called here. And there is another one for
for actual constants like the IP socket,
one I just talked about.
OK,
but really the
key feature is this API call proxy,
so quick show of hands, maybe.
How many of you are familiar with the
concept of so-called proxy?
Anybody?
OK, a few people.
So who is familiar with
the concept of userspace and kernel
space?
Awesome.
So that is great.
So the idea behind Cisco, a proxy
thing is to have.
The colonel to use the colonel space of
one system, and that's the system that
I'm penetration testing or attacking or
whatever, but this
system is only running a small step
executable and the userspace
is offloaded to another system.
And this system communicates over the
network with the stop component here.
So you basically offload
the userspace onto another system and
then this userspace and this colonel
space communicate over the network.
Why do you want to do something like
that? Sounds really crazy, right?
If you if you implement such a generic
stuff binary that just takes a musical
identifier and some parameters and then
runs it here, you can keep all the
logic outside of the stuff binary.
The stuff binary can be really, really
tiny and you can
implement all the logic here on your
console, on your system.
OK, so if you want to add another feature
to your attack tool, you only have to do
that here.
You can leave that part alone and you're
not.
It's also obsequies less risky for the
operation. You don't necessarily need to
put everything in one place.
You can change it up.
Exactly.
So you end up with a very tiny executable
that generically proxy's system
calls from your userspace
somewhere else in the world to your
target.
One thing that's not very technical, if
you consider modular malware, if you want
to, if you're in operation nation state
or somebody very serious, you'd create
something modular.
And as you compile new agents,
you'd put different aspects of it
depending on the target.
Now, if you can do it on the fly after
you're in the target without risking
anything to begin with or much,
that is pretty cool shit.
I said, just because this is C.C.C.
and it's obligatory to say that.
OK, so does that make sense to people?
All right, so what what they have
in their in their tool, what
we have seen in the tool is not quite
as this proxy because it's one level
above the Cisco level.
I mean, when you write code for the
Windows system, you don't usually call it
is called you call
API functions that are more high level,
like bright file is a high level API
function that translates users call
maybe, but there are other high level
ones. So what they did was they
implemented the same concept, but on the
API level. So you have the control panel
over there, you have the agent
deployed over here, the box and loop, and
then an underlying winner system
that exposes an API and
all the communication takes place over
the network or whatever.
OK, and then
can you switch back to the previous slide
for one second? So and then as I've
said before, this agent can
then be instructed to channel
connections, basically to proxy
connections or channel is maybe a
better word because otherwise
we can confuse it with the proxy term
over there. Then you can tunnel
connections to a third system
and do the same thing.
So we can basically I don't know if I
should use the term onion routing routing
because.
But yet you can do something like that.
OK, so that's really cool
and off. Of course, they also implemented
their own network protocol for that.
So we called this in our PC
network protocol because really this
reminded us of remote procedure calls or
right. Files turned into a remote
procedure call in this case.
So Gary said we have to include an
either pro screenshot, so here it is,
this is either pro this is the send
payload function. That's what we labeled
it as.
You can either send it encrypted or you
can send it unencrypted the code.
Don't you guys think I know I'm just
disturbing you right now, heckling him,
but that's part of the fun. It's 11 p.m.
11, 30.
So don't you guys think that if we just
put assembly code up there or
if we took out a pro screenshot that
looks cooler?
No, seriously, hands up, everybody thinks
it looks cooler.
OK, let's do it another way.
Everybody take your hand up with me.
Everybody take your end up.
Now, everybody who doesn't think it's
cool.
Go ahead.
All right, but
let's talk about the cryptography they
use. So what they do is for every
session they generate a
ASUDA random session, Kicillof, 256
bits, and they
use this for as encryption.
So that's their.
But in order to securely transfer
that key to the other system
they're talking to, they have
to use something like, you know, some
some asymmetric crypto.
In this case, they use RSA, they
use 1024 bit RSA,
which means there must be a public key
in the binary.
And in fact, there is a hard coded key in
the binary and that public key
changes across campaign.
So you can by looking at the public key,
you can say this is a sample that belongs
to this campaign and this is a sample
that belongs to another campaign.
All right.
One more thing to note here, we have seen
malware before that uses three beat RSA,
if that makes any sort of sense.
But but still using
this small key is kind of
weird in a way.
I personally don't really see how weird
it is, but Tullman insists and he just
forgot. So I'm reminding him.
All right, so let's skip over this
rather quickly, so this is the blowfish
harshing that they use to track and keep
track of sessions you can see down there.
They use this low level blobfish function
to hash an integer,
which is the I think if
I remember correctly, the five
descriptor, a number of the socket that
the session relates to.
OK, next slide.
So here's some more assembly
there is I told you that the code is
position independent, but
the problem with position independent
code is that you cannot really
very easily configure it.
You cannot easily pass
parameters to it.
But they need to have some kind
of configuration data like the
RSA key, maybe
command controls over IP address or.
Command control server sounds so
offensive. Maybe you should say a
control panel, IP address
and then also maybe a campaign I.D.,
something like that. So there is are some
parameters that are used to configure the
dashboard dashboard.
Dashboard, yet
operators interface, so what
they do is they they the blue
blue box down there is the code is
the entry point that they really want to
call or that where they really want to
start. But before they do, they need to
prepare an environment.
They need to push some
some arguments on the stack, so to speak.
Right.
So what they do is they started the gray
box up there, jump down
to the second red box, then call back up
and then do some more stuff and then
jump down to the blue box.
And you can you can see some assembly
code that relates to this chart.
So you can see the jump at the very top
and that takes us down and that's on
the slide anymore. And then you can see
you call back up. And then that second
line there, the Poppea basically
then pops the instruction point off
from the stack into the register.
For those of you who are familiar with
that.
Right. And then you can see these
putschists there of the long,
these long, immediately, these
are ASCII strings.
So if you would take these and render
them as ASCII strings, you would see that
the first one is an IP address.
The second one is a campaign identifier,
and the third one is the
what we call the R parameter.
But we don't know what the purpose is.
OK, so once you're able to
extract this kind of information,
you can collect samples.
And, you know, and
mine that data a little bit, and we did
that and we came across this command and
control server IP addresses.
Now you can see that or at least
the first four kind of live in the same,
you know, in the same
proximity.
They live in related network ranges.
In fact, each of them belongs
to its own very tiny network range
of 27 or 28 or something
like that. And these ranges are
all operated by a German company.
In fact, it's called IBG.
I forget what that stands for.
But there there are a technology
company in Munich and
they also offer satellite
services. So they're probably operating
some satellite or something like that,
and they're offering satellite links
as a service. So Internet connectivity
through satellites, which means
when you do geolocation lookups for those
IP addresses, you get something like
this.
Yeah, and
an interesting note about the crowd,
you're not many of you are not
operating your networks because only a
couple of you took up a camera and took
a photo of these irises.
Interesting. The other crowd.
OK, so we got to give props
to a friend of ours called
much lesser,
much lesser runs, Internet wide
scans for interesting data.
For example, he does Internet sweeps
for SSL certificates,
and that's the reason why we reached out
to him. So we
figured that one of the IP addresses was
or one of the the campaigns from the
previous slide used
an SSL enabled version of Compact's.
So the command control connection was
as well protected, which means
there must be a certificate involved.
So we talk to Mark and said, hey,
can you because that IP
address was no longer online, can you
dig into your database?
Can you see if you had the certificate
from that IP address?
And he found the certificate
and as you can see there, it's a
certificate that was issued to
two core security technologies.
This is the Isaac Isidore's
a I think so
in 2009.
It's not valid anymore.
But I mean, of course, you can still use
it.
Turns out whenever you use compact
or at least as far as we know
with SSL, you will
end up using this certificate here.
So by scanning for SSL services
that use the certificate or offer this
certificate, you can identify compact's
youchoose. So we asked Mark, hey,
can you give us any other IP addresses
that were hosting this certificate?
And he did. And that's how we identified
some more of the campaign's.
So thank you, Mark, for that.
So let's talk a little bit, what
campaigns do you want to take over again?
Sure, you take this load out.
OK, so first thing
we did was we took a look at all the
law documents, the Excel
spreadsheets that we found that we
collected. OK, as you remember,
hopefully from one of the first slides,
there is this metadata in there that
gives you the create data and that gives
you the modification date.
And then there is also the the handle
of the creator and the handle of the last
modifier. And that's what you see in this
table.
Now, the create data isn't very telling
because you can take a document that was
created 10 years ago and then modify
it and use it for this campaign.
Thank you.
So that is the third column,
the modification dates and that
chronologically order.
As you can see, the first attack
we came across occurred in April.
Twenty Third World,
that was the guy.
And it was targeting this
Israeli target that we talked about.
And then on the same day, there was
another attack against another Israeli
target and so on and so on.
So then in in
July, you can see various attacks
against European targets.
And we will talk more about those in a
second.
And the last one was actually from this
month, we had to redact
some of the operator names, creator
names, because they were they identified
the target, the victim.
They probably the thing is, we didn't
really know whether somebody used
this is metadata.
Right. So we can we don't really think
somebody tried to use metadata
to pass through scanners or to pass
through the human eye to what we think
happened. Some of these documents were
created specifically as laws
and some of the others. What other ones
were stolen from
the victim, whether it's open source or
not, we can't we're not sure.
We didn't find them and
put their names.
Their names were on the document.
Now, if you want to see one thing that we
didn't redact a second from
the bottom, the name NOM, it
actually is really just as a say.
So moving on.
I would take that one, too.
All right, so the next thing,
of course, was the impact Darians
that we came across. I told you earlier
that there is this this is anarchy
in there. There is a campaign identifier.
So we did the same thing.
We met them onto the document
modification dates.
So these are the dates, the first column
that we found in the documents that drop
the respective executables.
In the second column, we have the IP
addresses that you already saw,
then we have a campaign identifier
and then we have the Arzak and you can
see there is a clear correlation between
RSA key campaign ad agency to IP address.
So it seems like they keep
their infrastructure, meaning
command control servers for
the different campaigns separate.
OK, so they use different key to
a different Arzak and a different
campaign ID for each campaign
that they're running.
Intelligence wise, if you go to previous
slide for a second and you look at the
operation, you can see the creation
date of the actual allures
is usually earlier a little bit than
the actual attack.
So if you can identify
these modifiers
and you can detect the law ahead of time,
you can probably prevent the attack
altogether depending on your operational
security. And if you have this type of
intelligence capability in-house,
whether from your own intelligence or
something, trying to get it into your
network or from outside of it.
And just to be just to be very clear, we
limited ourselves to
law documents that fit
into our pattern or into
this this modus operandi,
we didn't consider any other core impact
samples we came across because, of
course, it's possible to find others,
but they are not related to activity by
this by this threat actor here.
OK.
Um, so we're going to look at some decoy
spreadsheets.
This one is against an Israeli target.
We are the first target, as we discussed,
with an organization adjacent to
the defense and aerospace industries,
but very quickly spread through Europe
and through Israel, some academic
institutions and some defense agencies
across Europe.
So this is one of the lures just
looking very real.
Colgrove, I don't know how accurate
the data is for the organization,
but still pretty impressive.
And you will not see something impressive
like that. Again, their graphic designer
sucks.
So, I mean, the data, the data on there,
I mean, like this table up there is not
really interesting. What's interesting
for us from an intelligence perspective
is we take a look at this and
we try to figure out who the target was
because obviously the the
decoy has
been designed for a specific target.
And that's why we are going to show you
some of the other spreadsheets here now.
So, for example, this one
is listing Israeli holidays
or other types of observance
days. Nothing very interesting,
more than open source for the past
several thousand years.
But
if you want to go to the Bible,
well, to be pedantic, some of these are
not in the Bible, but still, it's pretty
clear, nothing very, very special,
not a very good lure, but it does have
information, looks very,
I guess, safe.
Next up, this is really horrible
graphically.
I mean, who is the graphic designer?
Seriously, would anybody click on Enable
after they see this, would you?
So that's another example, which are
pretty nice.
So we didn't figure out the target of
this one, by the way, so this is this is
an attack from May.
We don't know who the target was.
So if you're in the audience, got this
message and got past the horrible the
graphic design, please tell us
this is really boring yet again,
not very impressive, but
maybe they were you know, if I was them,
I would actually play with human beings
to try and see what they would click.
What other reason have they got to do
this?
This is from an Israeli target.
You can see that it's, again, innocuous
information, nothing very special there,
but it seems to be internal to the
organization.
Um, this is a little bit interesting
that it took us a while, we went to town,
I went to reverse image search, we
searched Google for any logos
with triangles and circles.
We did everything we possibly could
eventually and found it.
Does anybody know what what this who this
is is going to know what they know?
What is it? Nobody's going to tell us
anybody, huh?
So if we had time,
I would say let's play a really annoying
game and try to find it on Google and
whoever wins gets a beer or something,
but or pizza in our
case.
But this is actually a Georgian
organization that's related to Naito.
You can read the Wikipedia page.
Again, not very interesting, except for
the logo.
But there is this military, you know,
this you've always seen, it's one
of the more elaborate documents
it's convincing, even has a little
bit of graphic design, although I don't
know who the designer is again.
And that's probably a stolen document.
I find it hard to believe they actually
created it.
Now, again, we must stress
there is some there are some things in
there that look like they're from
Venice and Vienna, but this is a German
language law.
We don't know who the actual target is.
Could be anywhere that speaks German,
but it is a defense organization.
Um, this
is just a list of names it
generals, capitÃ¡n,
admiral, calling major what is
called a major
made up rank.
Again, not very impressive, but it was
targeting the same organization as the
previous one. So it's obvious
that. Thank you.
It's obvious that they were targeting
the military sector, the
German speaking military organization.
This one is also probably a stolen
document.
Also, German speaking,
you can look at the logo,
which is kind of nice, but doesn't that
look very interesting?
Yet another lure, we can start skipping
them, unless you really want to see
what's interesting here is that that this
seems to target embassies.
German speaking at so embassies
in the German speaking country.
I mean, there are not that many, but that
just to be clear, the attacks, as we
saw in the time earlier, were not just
against Israeli targets and
German speaking targets.
There are also ones in Eastern Europe and
others all over the place.
Another one.
And this one is interesting a little bit,
because we tried to find out how to
decode this thing and
we think
we think they're just messing with us and
did this on purpose because everything
repeats.
I think they mess this up.
It is well used to call this Chinese
whenever it wouldn't decode the Hebrew
and just say,
oh, don't take the microphone that
Cyrillic.
Cyrillic, but it does what Russian looks
like if you if you select the wrong code
page, so it could be Cyrillic, but
if it is fake and not the court page
for Windows for Carelink, but in
Latin one, it looks like this, but it
still doesn't.
I don't know, maybe you need to try this,
but it still have an accent that is
repeating over the whole spreadsheet.
But if you take we have Russian enabled
on my laptop and I didn't see it, but
we'll try anyway.
Well, but if you if you take the title
column and you search for that on the
Internet, you will find that this is a
table of missile
launch events
that is on Wikipedia.
So they probably try to use
that as a lure or a decoy.
This last one is personally not very
interesting to me, do you have anything
to say about that? No, but it did
say if you want all the information NSA
started putting in instructions.
They didn't just want people to click
enable anymore.
If you like. If you want to see more,
please click, click, enable.
And they actually misspelled the view,
which is kind of nice.
I guess their conversion rates were low.
This one is interesting for several
reasons. Number one, again, it's a stolen
document, it's against an Israeli target.
But what's more interesting for me is
that it was sent around the date of
an actual event happening in Israel.
So if you sell it to academia,
which was some of the targets, you can
actually notice that it
improves your conversion rate.
If they know of the event, they might
click on it more. But that's just a
wild guess about trying to time the
events in real life to something
else, which showed a little bit more
operational sophistication.
It shows there this is one of the later.
I believe it's one of the later
campaigns.
Yeah. So this is from
December 1st.
This is from this month just now.
So it shows they are really, really
interested in the academic sector in
Israel. And they're trying to their
operational capability is growing, even
if a little bit trying to tie in
to something that will convert people by
their interests.
There's another example of that, which is
the same conference, once again,
just an agenda.
And they once again try to give you
instructions to increase conversion.
I don't know if it's related to the
previous one, what their conversion rates
were. We'll discuss that a little bit
later.
But it's interesting nonetheless.
This is you.
OK, so just one more
thing, we
know there is a very old rule in the
antivirus world of do not use
the attackers name nowadays.
You don't really follow it.
But for me, it was still important.
We didn't really want to call it what the
attacker called us.
So we start thinking of a name.
And I just said, let's call it name
credential stealer.
And we went with that.
All right, so I think we need
to hurry up a little bit because we're
running out of time, so you need to come
here for a while.
So this this threat of this group
here doesn't only use court impact.
They also have their own custom tools.
And this is one of them.
And this has one purpose and one purpose
only, and that is stealing
credentials. And instead of showing
you more more white
background slides with black text on it,
we said, let's show you some code,
because this thing here is written
in that language, which means you
can decompiled it back
into some form of the original source
code. You can recover some form of the
original source code.
And of course, that's what we did.
And then you can read source code instead
of machine code assembly
code.
So we'll
skip over this really quickly.
So there's some stuff happening here that
we're not going to talk about.
But then here you can see,
first of all, there is this e-mail
address here. Right?
And we already know that handle.
Right. So this was not only
dropped by a law document
that followed the same the same
concept, it also contained that handle
up there. So it's pretty obvious that
this is related to the same threat.
What this does is it takes a look at the
Firefox profile directory and then
steals these two files.
The Cylons escalated and Keith RDB,
these are the files were different
Firefox versions, store
browser credentials, usernames,
passwords. Right.
And if you use your browser to log into
your Gmail or whatever
web mail
portal, then you
you know, not you.
But some people store their credentials
in those files.
And by sealing those, you get access to
these things. And then you can use that
data, for example, to design another
spearfishing campaign.
And then it sends that off to this exact
this very address here,
which is a Gmail address.
And that's why it's talking to SMPTE,
Gmail dot com.
And it even has.
Yeah. And we call it credential, which is
we have to take those out.
So moving on quickly.
Moving on quickly.
We have conclusion's.
So this is likely again, we
are not going to commit to the 20 percent
because we believe attribution is never
100 percent until somebody comes out and
says we did it.
But this is very likely a nation state.
We have other reasons to believe this as
well, which we can't disclose at this
stage.
They have limited operational and
technical capabilities, although they're
getting better.
We have seen a remote, sophisticated
remote access tool. We want to say even
very advanced. But you can't really
compare these things. Some things are
very advanced and one thing, others are
other another.
The implant itself is a legitimate
production tool. It's off the shelf,
though, it's advanced and it's misused.
And the big thing is everybody can now
use this. They know that is out there.
They should have known before.
But honestly, this is instead of just
being yet
another crime, we're think now it's
a nation state level tool
that has been used once actively,
more than once in many, many campaigns.
And other people can now have this
capability for a certain amount, money or
stealing it.
Although quarterback does their best to
keep this safe.
We want to give some quick props.
We stand on the shoulders of giants.
There's been some research on one of
these campaigns was called Gauley
by removing all the Sky.
And there are some others worked on this.
We want to give them an anonymous credit
right now because they deserve it.
But if you want somebody else's, you
can also e-mail us or check the report in
a few days.
We want to thank the Israeli air strike,
N.S.A. for all their help,
our appreciation to search pwned because
they helped us all in the incident
response.
And that's about it. Now, questions
we know what the first question is going
to be. Don't a lot of to just skip that
one.
Did you mention the report?
What did you mention to report it?
Yes, we're going to release it in a few
days.
So there is a technical so we
have way more information then than
we're able to touch on during this
presentation. We have a technical report,
a very technical report, I should say,
50 pages, something that
we are going to release to the
public.
And just very soon now,
I'm going to skip the first question.
We want this to be theatrical.
We don't know who the nation state, what
the nation state is or whatever.
And one does not simply you like the
text right after the text based
on this alone.
That said,
we don't know who's behind this.
Right. We don't know it is right.
We can't really tell you.
Come on, come here.
So you folks take a picture.
So we probably have time for one more
question. Does anybody have questions at
this stage?
First of all, thank you, God,
plenty 22 W..
We do have one question from the
Internet. And for those in the room,
please leave in front of the microphones
if you do have questions.
So did you log into the Gmail account?
No, we did not think
that we probably could get some
victim data from there about their
success, but we decided not to break the
law.
Somebody else is going to do that.
We can break the law because they are the
law.
I am the law. OK, any other questions
anybody left microphone to?
I think it's a smart move that you can
see spammers do
to focus on really dumb people and they
try to scam you.
They make it really obvious that it's a
scam so that the people who do fall for
it are really dumb and it's
not going to be noticed for a while.
So maybe we'll see some pickup of that
tactic in the AP world.
Now, the idea is that this is now,
even though it was widely used in the
90s, it's new.
We have only been seeing it.
Tullman can speak of this more in the
past year, but right now it's putting
filters and it's getting work done.
Yeah, I didn't get the question, by the
way, how you're going to see that.
So, yeah, no, we actually
talked to all the victims that we could
identify and some of them have been aware
of this activity.
Fortunately,
not all.
Any other questions, please, for number
three, I think you'll end up first.
Hi. I was wondering who controls
the U.S. servers?
Is it compact or is it the.
No, no impact. It's very important to
say, again, Quarrie impact is not related
to this. They're good guys.
The attackers are controlling.
But I mean, there
is probably the
the controller component of impact
running somewhere.
I think we think that these IP
addresses that we showed, they're
probably just acting as proxies, as
network proxies and relay traffic to
the real back end. But the Republicans is
probably running the impact console
and we can't really say it is at this
stage.
And the reason I'm asking is because the
certificates were signed by court
security. Right.
That's difficult for the actual size of
the same security is the same certificate
for any inefficiency
or do they sign each one specifically?
So we only saw an
SSL enabled version in one case,
all the others didn't use
as encryption
arrived.
Thank you very much.
This guy is really important to your
question. Yes, I understand.
But we are we are out of time
and that talk will actually start or
some thirty seconds.
Thanks a lot.
If you're kind enough, please handle this
question. I'll start and give them, uh,
give them some applause.
Thank you.