Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/669 Thanks!
Jesse himself
is a hardcore
Moers searcher, reverse engineer.
And he also likes to break code
and my voice is breaking to him.
Sorry for that.
So stage is open
to Jesse.
Let's visit the DrippiN.
Thank you very much.
So, yes, Simon Muroi, such a walking
at ease, said Montreal.
And during the past two years we have
been monitoring a group called Sennett's
with my two colleagues, Ron Tooma.
They can be here.
Can be with me here today,
sadly.
And this talk is based on a technical
white paper publicly available on
our blog. If you want to read it.
So, as I said this, we call this group
Senate. But depending on the result
shells, they have other names like
a beauty, 28 fancy bales of AC.
And this is a group of Goldwing
targeted attacks since at least 2004.
And their interest is mainly about
geopolitics.
As you might have seen in the news, they
are very famous at the moment.
They are supposedly behind the hike of
the Democratic National Committee
and also the World Anti-Doping Agency.
And in this presentation, I will start by
giving you some context around this
group.
After that, I will describe a textbook
case of their current operations
during which we will dig into their tool
set.
And after that, I will present a
different and strange operation
also run by the Senate, go up during the
last few years.
And finally, I will conclude with some
lesson learned and open questions.
So let's start with some context around
the Senate group.
So what kind of people people are they
after?
And for once, we know very precisely
some of their targets because they made a
mistake during one of their fishing
campaigns.
The operators used the Bitly service to
shorten the fishing year olds,
but followed to, say, the Bitly profit
privates. So we had access to around
4000 salt on your arms during
six months in 2015.
Here's an example for you all that was
Shotton in court.
It contains the e-mail
address of the targets and also
its real name.
So at this point, identifying the targets
was Pretty's.
In this list, there are embassies and
ministries of more than 40 countries.
There is NATO and EU institutions.
And finally, there is a lot of
individuals involved in Eastern Europe
politics.
To inspect those targets, they pulled out
several Zoetis.
Here you can see a timeline with the
Sendejo, these exploits for 2015
only.
And all this will nobilities have been
reported since.
And I'm not even talking here about the
revamped exploit they use.
There is many of them also.
And we are going to see that later.
The story doesn't end in 2016,
just as an example, the Google threat
analysis go disclosed
vulnerabilities in Flash and in the
Windows channel like a month
ago, I think.
And the exploits was using the in
their ability to gain control on the
remote computer and the win.
We know Win32 Caven ability
to escalate is privileges
and bypass the sandbox.
I won't describe the exploit here.
There is enough information on dunnarts,
but this shows the Senate group
is quite resourceful.
So this is the kind of group that
deployed many custom softwares
of over the past 10 years
from the Hopewell's to encryption proxy
tools, including different types of back
Durrell's.
In short, they developed quite a lot.
And before going further, I want to
mention a few disclaimers
first, even if we track the Senate, go
pretty closely during the last three
years, we might be missing both of the
pictures.
And Azmera itself sells.
We call it a group based on the tool kit.
Even they might be divided in some teams.
And finally, we are not competent to do
any sort of attribution, but
our research might provide you insight
that may be useful that.
So let's start I'll join in the Senate
tool kit with Serge.
Salad is actually a good name for
Fictionalize and the target, he
works for government and has access to
sensitive information.
The chain of events and the timing that I
am going to describes are in line with
several real cases.
We've investigated doing the last meals
and we just sail, such as a textbook case
to prison, part of the Senate tool kit.
So somewhere recently, it's Monday, nine
three a.m.
and sounds, Rob arrives at work and
he opens an e-mail.
This e-mail supposedly came from
Stratfor, which provides regular
reports on geopolitics, except
that if you look closely at the euro,
we will note is that the Dumain mimics
the legitimate threat bottoming, but
also the UI is the same as not to go
on the legitimates what Web site,
except that an idea was incertain
inserted in the middle poley to identify
the target.
But let's say sales clicks on the euro.
And this is when sales Mitt Sevket,
which is the Senate, exploit it.
And it is only useful targeted attacks.
As we just saw, its entry points
is usually your homes
mimicking legitimate websites
and the exploit the infection usually
start from targeted phishing emails.
But we've also seen a
from direction from search it from
hacked Web sites.
We found Surjit in September 2014
for the first time and it is still news.
So as a classic expert kit, when you
visit it, you receive a landing page that
will build a reconnaissance report on the
mission.
Said Get Lending Page contains around 200
lines of JavaScript and the code stayed
the same above the last year.
You can see here a glorified extract of
this landing page.
First, it will retrieve the time zone and
then it will enumerate the properties of
JavaScript object called navigate end
screens.
And finally, it will enumerate the plugin
installed in the browser.
As you can see, there is a special case
for Internet Explorer.
Well, Java and Flash are
detected by special methods.
By the way, the comments here are from
the developers.
So to give you an idea, here is the
report from Cellcom Showdown.
It's a Jizan file.
And you can see it contains a lot of
information such that the server
can select its the targets
very precisely, not only based on
the configuration, but also based on the
language they speak in the time zones.
Or are they are in.
However, we don't know precisely what the
authorities are looking for.
We crawled, the expert did, with various
configuration and different IP addresses.
Sometimes it works, sometimes it doesn't
works. And so far, we don't really know
why.
But let's say that soldiers selected to
be exploited.
And this is one sales visit.
The Senate exploit factory.
So here's the list of exploit that we saw
from setted since its beginning.
And as you can see, three of them also to
exploit at the time they were used.
Also, interestingly, there was an exploit
for my Cupo, which is a cleaning tool for
Oyston made by a company from
Ukraine.
And it is probably mainly used by people
from Eastern Europe.
And the other exploits are recent
exploits. And I am going to describe one
of them right now.
So let's exploit Target the city.
2014 six three, three, two.
And there's been no abilities in to go a
flaw in the entire Explore Uber
script engine that allows
arbitrary right operations
with socity delivering an expert for the
city in October 2015.
And in this case, it was only reusing
APRC to disable the safe mode
and to download a payload with partial.
But at the beginning of the year, we
found a very different version of this
exploit, a more complex
one that was used in February 2016.
This expert didn't disable the safe mode
but were actually executed a rope chain.
The code is pretty big, around 400 lines
of VB script. And interestingly, it's
custom.
Someone tried to read everything, but
here's the beautiful code of the
function, building the rope chain.
And just to give you an example,
we can see here a function to retrieve
the code section at risk of a deal
on Windows seven.
As you can see, that's a lot of effort.
Turns out that part of this code is
actually based or inspired
by a presentation made at Black USA
2014.
And once again, the same group are not
afraid of digging into complex
exploit to make use of them in real life
examples.
But to south stage now.
Let's say that exploit the loads, the
payload.
This is this is when cells meets cell
upload.
So the cell uploads usually downloaded by
such like in such case.
And this component actually includes two
binaries, a doper.
And it's embedded payload.
It is generally the first component
deployed on the victim.
And we dated the operation of solar
product. In March 2015.
So let's start with the doorbell now.
You can see here is very simple workflow,
but it contains some interesting vigils.
The first one is a weird anti analysis
trick.
So he'll just nip it, extract form x
rays.
So first it will allocate they allocate
a 10 byte before.
And it said the last bit to the value 42.
And then it will create its file with
a very specific name.
It will then, right?
One million. I mean, this file and then
with one million time in the same file.
After all that, it will check if the last
bite of the 10 bite before still contains
the value 42.
If it doesn't.
So the plot alternate its execution.
So this could who's kind of strange, but
we believe this is naming stimulation
three because they replaced it with a
more common one in the most recent
simple.
And also, it might create intensive
harddrive operation that may delay the
execution of the software.
Also, it may detect emulators
wrongly implementing the memory
management.
So the next step is to decrypt the
payload and to decompress it.
These operations are implemented in C++
class named uploader by the developer
Elles. You can see it here on the screen.
I've taught at the Doppelt may use a
local privileges colation exploits
depending on the simple.
One of these two civies may be used.
The first one was as Yoda at the time
they used it. And the second one
is another gift from the hacking team.
Alex.
And finally, the rope made the bill of
best assistant on the system.
Interestingly, with so many different
techniques used of other Passman.
Some of them only used when the doorbell
runs with system privileges.
You can see here just to show them like
the windows come object hijacking
and the JavaScript code executed with the
run the URL for it, too.
Those two techniques were first seen in
other Mel Wells, and
seeking inspiration in crime is something
very common for the Senate group.
At this moment, the pillared is running
on such a computer and
the payload is actually a bricking this
and small well. And you can see here
somebody if I walk again,
establishing the network connection with
the sensors ever would be the first step.
It changed several times in the last few
months. But
first, it will try to reach
Google dot com.
And if it works, it moves on.
However, if it doesn't work, it will
retrieve the particular initials, for
instance, or Firefox.
The payload looks for the pull file file
and it will pass it.
If it succeed, it will contact the census
of all via the proxy using those
credentials.
And then if all the previous techniques
didn't work, it will wait
for the user to launch a browser in order
to inject into it.
The next step is to send the first stage
report on this to the census, although
this report begins with an idea generated
to identify the computer.
And also it will send the process list
some information on disk, a build
number, which is hard coded and binary.
And then it send this encrypted through
the networking that was previously
established is rather a small
report, but it is possibly in
order to filter out security researchers
and automated sandboxes.
The final step is retrieving a
configuration file from the since the
server. Here are different values
handled by the last version of the
product panel.
I will not go through them. They are
quite explicit. But the main purpose
is to download another binary and to
execute it as an executable
audio.
Now, let's go back to our chain of
events.
Well, still, day one sells computer
is infected with the product.
Same day, 30 minutes later,
the operator are now sure that soldiers
is tomorrow is also
said Ricoh is done ordered on such
computer up by said the.
So this is a classic backdoor with
Nomura's come.
And interestingly, it has the ability to
extend its behavior by loading external
plugins.
It is usually deployed after a successful
infection. In such case,
and while this component may be old,
we know for a fact that it is still in
use today.
So so arrive on the system and put it
in the dropper, which usually installed
the payload and its configuration,
it will drub the configuration at two
places on the disk.
The first place will be in the file
name MSJ, and it
will also copy the exact same data
in the Windows registry.
And of course, since the configuration is
installed by the payload issue,
only have the payload, you won't be able
to determine the configuration used with
its.
Now, let's talk about the configuration.
You can see here the encrypted version.
It comes with a small header and
the data is dissolved with a six byte key
located at the beginning of the header.
And it is randomly generated by the
dropper following the key.
You have 20 bytes each bytes
representing the size of a field
in the data.
Everything else is the encrypted data.
Now we have the content once decrypted
and here is the better representation of
the extracted fields.
So those values are just values time
outs. I don't I don't find them really
interesting.
Here is cells captured on AIM.
Here you have a flag to specify whether
or not the kilojoule should be enabled.
Here are the three.
Since the cell fails, the first one is
the main one that Waddell's are
fallbacks.
Here is what we believe to be an
operation name.
We have Fonso found several
of them during the investigation.
Some of them are shown on the screen.
And as I mentioned before said, Ricoh
has the ability to load axolotl plugins
when loading one plugin.
It will stall the path of this plugin at
the end of the configuration.
The there is room for 10 plug ins and in
the initial config configuration, all
those fields are empty because the build
is dropped without any plugins.
So now let's have a look at this payload.
It comes with 26 Cumins, and
it's its command is identified by a
unique number.
Those come on the register and registered
during the runtime using an export
function named Registe on
your command.
And you can see here the registration of
the few commands like, for example.
So can read.
Right. And you find on the disk, it can
also list all running processes.
It can manipulate the registry.
Also, it can update itself, its
configuration or load on node
external plugin.
Speaking of plugins, they come as JLL
and they will be loaded in the same
address space than the payload.
And thanks to that, they can use any
function of the main bill.
So as shown on the picture, here's what
happens when the bill is initialized.
A plugin it calls the plugin in its
export putzing.
Some function addresses as arguments.
In particular, it provides the addresses
of the function handling the output
formatting and also the common
registration.
So the plugin can register any additional
come on if needed.
And here's an example of a plugin used.
In part it was, said Ricoh, this mother
was just registering a new
come on this time opening initiative to
be channel with the census celo
and also silico is terminating.
It will include every plugin by calling
that an export.
In this case, the export only deletes the
previously. Or just don't come and
let's go back to option. And if you don't
know now, we are still day one and silico
was deployed 30 minutes after the initial
infection.
Same day, four hours later,
search meets ex agent, which
was downloaded by said, I don't like said
Ricot X agent is
a millaa backdoor written in C++
and foraged. There is at least a Windows,
a Linux in US and an Android version
X agent is the flagship backdoor of the
Senate group. They used it in most of
their operation over the
last few years and usually, after
all, the reconnaissance phase light in
sales case,
we dated exigent operation around
November, November 2012
and it is still in use.
So at this point, at this point, you
might expect some C++
reverse engineering on Oxygen Biner
is right.
Except that due to a mistake from
the operators, we recently got access to
the source code of X agent.
And here's the next flight of this
extract of the source files
we found.
It is a fully working C++ project
corresponding to the Linux version of
Exigent, and it was compiled in
July 2015, which we know
because there is
a bin folder with a binary in it which
was created at this date.
And the source code contains around
18 Kaitlyn's of code among 59 classes.
So it is pretty big.
We believe this new source code
derives from the Windows version of
oxygen because at several places
the lapels just come on those some Win32
EPA calls to replace them, to replace
them by Linux API calls,
like in this case, for threat
termination.
And they're all civil
version of exigent.
The source code is a major version, too.
And the country just biner result.
Version three.
But it's still much as the core logic
of the Vietri binaries.
As you would expect in such a big
project, the source code is heavily
commented.
The comments are a mix of a badly written
English with some Russian,
sometimes some, as you all, to describe
the structures.
But with that being said, let's look at
the communication, Warbelow.
So here we got a simplified view
of the communication Mofro indecision to
give you an idea at the Center
on the exigent infected computer, the
counter run method is an infinite loop
which fetches the messages from the
module. Notice that the kernel is
in its cell phone module.
Those messages are unencrypted C++
objects, which are serialized
and encrypted by the channel and then
given to the channel controller.
The channel controller is the stuff I
interface to contact the senses salvo
and forwards the messages to the sensor
salvo in
the other direction.
The Channel Control regularly asks
the senses of iPhone encrypted messages
message for each module, and the
message is then given to
the channel which and serialize
and decrypts it and then gives it to
the intendant module.
One of the beauty behind this simple
design is that the channel controller
is aware of the current actual
implementation of the network channel,
which can be based on
ETP or emails.
And in fact, the channel will the channel
controller will switch automatically to a
different channel if the junta used one
is not working.
Now, let's dig a little bit into the
email channel.
How is it working?
So the work for the walkthrough is quite
simple.
When the channel control I just described
has a message for the the SLA,
the MELSA now sends an email
with the message as an attachment
to an inbox, depending on the simple.
The inbox can be a free mail address, a
Senate address or hacked email
address
and the census of all.
Then retrieve the email from the inbox
and processes the attachment
in the other direction.
If the census ever has a message for one
exigent module, it sends a message
as an attachment in an email to a
different inbox from which
its agent melts and retrieves that email.
So it sounds easy, right?
But the thing is, when you use e-mails
to implement a command and control
channel, first you need to have
a way to distinguish your e-mail from
unrelated e-mails like spam
or legitimate e-mails in the inbox.
And second, you need to bypass spam
filters on your way to the inbox.
And for those reasons, the Senate
developed was implemented where they
called the scheme, which they describe
as a level two protocol.
This protocol defines how exigent
e-mails are built.
And here's an example of an e-mail
following the protocol.
So the protocol defines
the subject of the e-mail as the best 64
encoding of a value following this
format, which is thought with a
random key, then a value code
called such token result with
the key. And finally, the agent Agent
Idee Zolt with the same key.
The such token is known by
both the Senses, Salvo and the estate
agent. And that's how they can
distinguish their e-mails from and
related e-mails.
They decode the subject and check if the
substance can is here in practice.
In many exigent samples, such
token is a seven by values that Tansley
contains the China.
The PUTU protocol also defines the body
of the e-mails and the attachment
name. Remember that the attachment
contained the actual message.
So those are simply the basic functioning
of some random values.
So that's the PITU protocol.
But actually, in Oleynik source
code, the developers replaced the beta
protocol with some hard coded values.
We call it the Jörgen all because
those veloute values are worn in the
Jörgen language.
For example, the e-mail subject is set
to QR in memory, which refers to a
national I.D. numbers in Georgia.
And the body is set to get Mudjimba,
which means hello.
And the attachment name begins with that.
You're right, which means detail in
Georgia, followed by a timestamp.
So this way. This was probably done in
order to not attract attention
in the judge and infrastructures or maybe
in a hack jörgen inbox
and to come to the next agent now and has
a bonus.
I just want to say, if she was on oxygen
since infrastructures, because once
again, we've got access to some source
code and the source code this time
was left in an open directory
on the Senate server, and it was
indexed by Google Search that we found it
by some queries for the
beta protocol previously described.
So this school is actually a practice of
server or back in since Selva.
And you can see from the source files
here that it is developed in Biton
and was used between
April and June 2015, which
we know because there are some fine
with that with timestamps in it.
It contains around 12 K lines of code
because this is actually more than this
simple, really.
What it does is it will translate the
e-mail protocol from excisions infected
computers
into request. Well, it should be protocol
for the backend since he salver
those listed to be request follow a
specific format called the P3 protocol
level three protocol.
And by the way, we believe they use the
same kind of setup for
the ETP channel rather than the e-mail
channel.
Even if this particular proxy is just for
the mail channel.
So enough with oxygen now.
Let's come back to the Chernobyl event.
We are still there one after the initial
infection. So like it was deployed,
oxygen was deployed and at this point
suddenly got to spying back doors on the
target at the same time, such
that if one of them is detected, they
don't lose access to the computer.
And the next days are going to be the
time for information, exfiltration
and lateral movement.
So during the next three days,
Senate is going to drop and captured on
some parts extract of tools, they
often use a set of tools called security
experts that are freely available on the
Internet.
And those tools can extract passwords
from a variety of software and such
like Broza or email clients.
The problem is they are of they are
well-known and they are often detected by
antivirus.
So Senator Robb, their own boss, will
instruct all tools in particular.
There is one for windows laid amount that
is dropped on Sal's computer.
It has been compiled specifically for him
as it searches for the buzzword
in the hardcoded path that only exists
on such computer.
Of course, doper adults tried to retrieve
the Windows Pass wall and Seth's computer
for that. They got some custom tools to
them. Windows, passwords from
registry hives and without surprise,
they use Mimi, Kate.
Mimi gets a lots and the output
is often stored in a file named by
the log.
All this all these tools may be deployed
with the LP exploits depending on the
target configuration.
Sales may also meet this controller,
which is a small custom tool.
They're made to take screenshots
when it is executed.
It takes just instant shut in rapid
succession when the most moves.
And it does that 15 times in a row.
And finally sells meets external,
which is a custom, that word proxy tool
to contact computers that not our
normally reachable from Internet using
the infected computer as a pivot.
This component appeared in May 2013
and it is still in use.
So how does it work exactly?
Here's the initial situation.
The Senate since the summer is on
Internet search computer is
in its organization at work and is
infected with external
computer and computer, are in the same
network, but they are not reachable
from Internet and they are not under the
Senate control,
but they are reachable from such
computer, so
external begins and encryption, a
handshake with the census cell.
And the purpose of this handshake is to
share also 40 to encrypt the
communications between the two of them.
To do so external and distance
of all. Both have a copy of
a big table filled with random
looking bytes.
Let's call this table.
Dennis Tinnell randomly picks and I've
said all in the table.
And the 32 byte row starting at this
office at all is the key that
expert wants to share with it.
Since you saw the.
But external does not send the key.
Of course, it sends the upset all.
Plus the proof that SNL really knows
the table to.
This proof is another Rove to
located at the fixed offset, this time an
encrypted with the chosen.
The census of all checks.
The proof. And if it's correct, that is
if it gives the expected value wants
decrypted.
And Ansell's. OK.
And said it's also for key to the 32
byte row starting at the offset.
So at this point, although that data
exchange between the census of our next
tunnel will be awesome for encrypted with
the chosen key, note
is that sending the upset that the key
prevents the decryption of the traffic
by his roper
also since 2014.
Is this encrypted link is encapsulated
into tell us, which is not a bad idea
except that external does not verify the
certificate of the census.
Other.
And now the next step.
Once the encrypted link has been
established, the census can ICANN Eisner
to open.
That's now with a target computer using
an IP address or domain name.
And that's simply both.
No external then
opens a discipline connection with the
target computer.
Yeah. Computer A.
And start filling data between computer
and the census ever in both direction.
That is that the link between external
and computer is not encrypted
so that any kind of discipline that can
be forwarded to the target computer.
We don't know exactly what kind of
traffic they are.
The ballots are usually sent through the
external, but it has been reported to be
used with, yes, exact like tools
that allow the execution of come on on
the remote computer without having
an agent running on this computer.
Finally, Turner is identified
by an I.D.
search that external can management
several of them.
And so, for example, another tunnel can
be open with
the computer.
And it's not we'll take care of the
wording of the traffic in the tunnel.
So to summarize, the Senate census, can
no rich computer a computer be of
our Tsipi using sales computer
as a pivot?
And if it's a no no, let's go back to
chain of events.
We just had three days of information,
exfiltration and lateral movement.
The last action from the operator during
this first week would be to set up an
additional persistance method on such
computer. For long term monitoring.
So Friday, around 11:00 a.m.,
the long term persistence method consists
in a special exigence binary code byte in
the Microsoft Office folder under the
name MSA, the Delta.
This copy operation is done by another
binary dropped dimension.
You can see it here and right in
the office folder on this binary needs to
have administrative rights and followed
it felt execute a local privilege,
escalation, exploit.
And then it copies the exigent binary
name MSRA, the jalloh in the office
folder
to understand what will happen next.
First, we need to know that there is a
legitimate Windows JLL named MSA,
the dealer stored in the System
32 folder.
Is this zero is usually
used by office application in particular.
And also you need to know that the
insurgent binary exports
the exact same function names.
Then there's legitimate dealer.
So this at this point, you said to me
just what happened next.
This time, cells start Hovis exigent
MSA, the dealer is loaded
and that the legitimate MSA, the dealer,
because it is in the local folder of
office and thus it is found before the
system 30 to file
excision, then lost the real M inside
Ajello from the system to look for them.
And it fields its own export table with
the addresses of the function
of the legitimate dealer such that each
called to exigent export will actually go
to the legitimate dealer and the
application one Krush.
Finally, it stopped its malicious logic.
In other words, it's so simple, such
order highjacking based on the fact that
they can write into the office folder.
And by the way, we have also seen
recently this sales for the hijacking
technique with a linking for the Delane
dropped into the Windows folder.
So that concludes the story of sales,
this textbook case of what
happened to the son targets
during the fifth day of infection.
No, we have a pretty good idea
of what the Sinitta custom looks like.
Let's have a look at the world case we
found last year.
Some day in September 2015,
we received the unusual symbol.
It was a doorbell pledges to use by
Senate.
And it was showing this document as a
decoy.
As you can see, it is a legitimate
invitation for geopolitics conference.
And this document is actually publicly
available on the Internet.
Sadly, the pilots just did
the lowdown and even worse, it is written
in dolefully. And since we are good at
naming things, we need to dumb down
the world for his simple although it
don't know the configuration file and
based on this configuration, it will
deliver and executes another
payload.
The best method was just the run with the
3G. So nothing really exciting so
far except that
we found another Dundar deployment
in 2013 this time.
And this graph describes the deployment
at the time. You can see we had done that
and battered the same Toppo.
And this time with a small help out and
that would get inStar.
So even if this digital infect embryo
based system, this instead it will infect
multiple versions of Windows running
on the X 86 Processo.
So here are the first set of the list.
After all, the successful infection
the Felstead dealt with is
the new malicious embryo.
The second sector is the original embryo
code Zord with a one by Chey
and starting at the third sector.
We have the core of the Richard code old
on Six-fold at last.
We have also four encrypted driver
and the installer also hide Tudela in the
registry, but I will come through it
later.
So let's describe a very simplified
version of this workflow.
First, the measures NPR is executed
in a very classic way, it will hook the
entire Doyce 13, which handles
all low level read and write
operations.
And by doing that, it is able to
intercept every bite's
read from the desk during the loading.
Thanks to that. The soldiers, the memory
for some specific bites in order to batch
them.
Those bites belong to them jar, which is
the next step into the boot chain, as
explained before.
So at this point, Wythenshawe is perched.
And then the kid takes control again.
This and this time it will buche
the function OSL asked himself to channel
look it in will load that you see, which
is the next step in the bitchen,
like the net, like the name suggests,
this function will call the counter entry
point.
So we know there's no budget and the
kid takes control of the execution before
the cameras execute it.
At this point, the Colonel and all its
basic drivers are mapped into the virtual
memory and the integrated checks
are already performed.
So what this do does now is
it will look at the function.
M-m up your space and it will set the
Russel's section of the ECPA drive out to
executable before hiding some code
in it. It will also hook the ACBL
driver entry point to execute this code.
The budget need to save all those
important addresses somewhere because the
physical address won't be accessible
after the kind of initialization.
So it will save everything in the canon
header. You can see.
Hit it here.
We have the base address, the address
of the function and then map your space
and also the original bytes of
the ECPA entry points.
Now the device punched
and when the driver is loading, the hook
would be executed.
So fast, the code hidden in the resource
section will write back the original
entry point instructions to avoid
being detected by the kernel production.
And this is where the widgets will come
up. It's a physical address into the
virtual address space by calling the
function M-m up space.
And after that, it will be able to
decrypt the hidden driver.
So there is three components involved at
this moment.
The British driver will decrypts of felt
dealer name, the U.S armored component by
the developers.
And it will manually map it into its
products exit.
Then this use armored components will
decrypt and load Dunwell itself
hidden in the registry as well.
But this workflow was kind of odd because
the driver could have loaded Donder
directly and looking at the use armored
components.
We have fun evidences that Dundar wasn't
the intended payload used with this
booklet that felt more precisely.
When injecting dumbbells, it sets this
specific exported via through.
But the variable doesn't exist in any
known samples of dandruff.
So then there was polling that the
original pill.
We believe that the budget or at
least the driver is connected to
the black energy MOTHERWELL
because we have found some zero several
Shell features between the two families.
It is almost component is manually mapped
into the X memoria.
And all this code is shared between
Dunwell and some Ellis'
samples of black NLG.
And to do so, there is three exports used
in the drive, ultralow the use of the
component respectively entry epee
data. And then those exports are
also present in black and LG
and used in the exact same way.
So this might indicate that the
developers have access to black energy
source code or however, we are
not aware of any budget coming with
black and other toolkits
anyway and offer that Wickett.
Let's go back to Don Delph.
Looking at some other samples of
Dunwell, we have found another deployment
in 2014,
and this time Dundar came with a cannon,
Mudcrutch it.
So the Rikard-Bell poses to unshelled on
their persistence on this system by
injecting it into its products.
And also to hide everything related
to dumbbells, to the user, into the
system. So you can see anything on the
disk.
Thanks for that. The lapel. They just
left all kind of debugging information in
the samples. So here's the exact
debugging output during the driver
loading.
We can see the folder on the registry to
hide, the driver to load and the dialog
to inject.
We have to buy into this, Richard.
The first version, though, Richard, was
targeting Windows XP computers
and was doing some simple absurdity
hooking.
And the other version is a manipulative
driver. It was targeting more recent
version of Windows.
And it is based on an open source example
man made by Microsoft.
Also, we have found a 64 bit sample
in the wild. But we are missing the drop
out, so we don't really know how it
managed to bypass the rival signing
policy.
And interestingly,
it looks like some drive are made for
specific configuration, like in this like
this one possibly targeting a computer,
running Kaspersky Internet security.
So to summarize, we
only found a few samples of their use
during the past three years, which is not
a lot.
They were very careful with it.
Maybe they only used it for some specific
targets.
The census of all those samples were
reporting on was active doing two years.
It went although under the radar for
quite a long time.
And they used the budget
working on XP and more
recent version of Windows.
They made multiple roosted for the same
operating system versions.
In short, they worked very hard on the
best science methods, which is unusual
in such cases.
And finally, we know that there was just
to download Sirico External
and Exigent mentioned
earlier on. So this is definitely
connected to Senate.
So it is now time to conclude with some
speculative mumblings, because after
looking at so many Senate binaries,
the dentition is bigged rose, some
general conclusions.
And I am not talking about the software
and not talking about attribution the
more about the software
in particular.
There is a question we were often arguing
between us as we tried to show
in this presentation.
The diversity of the Senate software is
quite impressive.
You should think about it. There is a
Delfi download our complete windows,
but could a model of C++ Back-Door.
And there is an explicit infrastructure
with a lot of JavaScript and custom
exploits and the list goes on.
So this diversity is good for them as
it makes tracking and detection
harder.
But the question is, how did they come up
with this burst of an eco system?
Do they develop themselves or do they
also devlopment?
And we have a few hints.
Forgotten that question.
First, the Senate binaries are often
compiled specifically for a target
and after it has been infected.
The basic example of that is this X
agents sample containing the log in
and password of employees in the Ministry
of Internal Affairs of Georgia
and their well used in the mail channel.
This sample was made specifically to be
run inside this ministry network
and more generally sent
malware in constant evolution, in
particular external.
So the plodder and oxygen changed
a lot since the false version.
In other words, the rope are part of
a team not outside of paid for one time
job.
Also, among the vice chair of the Senate
software, there are some shared
techniques like building a support
key as the concatenation of a hardcoded
value and a random value or
using hardcoded tokens in network
messages.
These are two, just a just two
example of techniques present in several
Senate software developed in
different languages.
So this is not a copy pasted code, but
more like the implementation
of the same idea.
So this may indicate that the same
developers are behind all this software
as.
Another remark on the development process
is that there are some basic programing
mistakes in the sense software,
for example, here in Linux,
X agent, a thread and all named
Handal get buckets is terminated
with petrol exit, but it should
be handled. Send packets, as you can see
from the condition before and the
commented Windows code.
So poorly run copy paste in the Linux
version.
Also there is a here in external
there is a report message was built
for the census ever wanted to know has
been open with the target computer.
The IP address and the both number.
Of the target are written in a six byte
buffer.
Except that the memory pointer is not
incremented between the two rates
and thus the poor of.
All right. The bot overwrites the IP
address and we can assume
the sensor does not even shake the
report. So the mistake has gone
unnoticed.
And this I'll just two quick example
of mistakes you can find in the Senate
code so that the robot
does not have a code review process.
An overall Senate code often
feels really hackish
following this idea.
This is software, some sometimes inspired
by classic crime.
Crime? Well, for example, set up with a
reduced persistence methods from Chimaira
and shells. Some code with Khabab
while Don Delph butchered code bears
some similarities with black.
Some earliest sample of black NLG.
We may be tempted to conclude that the
developer are connected in some way with
some classic Crimewatch communities.
And finally, the exploited Dolapo.
I'll use funny names like Frodo and LOEL
for Timmo Thugs or Mesi that
you know, which is which is a
suck up player for the Ben-Ari to
download from an exploits.
So if they are able to use those
name in production, we
can guess that they are not working in a
very formal environment.
To say the least.
So to summarize the speculation, we
believe that Sinnett has some in-house
killed the lapels walking with little
supervision.
And those guys have ties with Cramer
underground, which is not so
common for this kind of group.
And it you should agree. I would be
glad to discuss about that.
End of speculation now.
It's time to conclude
Senate activity increased a lot during
the last two years.
They are doing targeted attacks on a
lot of different targets now,
and that tool kit is in constant
evolution. So there is definitely,
definitely more fun to come.
Former White House officials.
So thank you very much for your
attention, though, as
I see the.
All right. There is a lot of time for
talks.
We don't have, unfortunately, microphones
that you can pass around in the
audience. Please go to
the microphone.
Microphone stands over there
or here.
OK, let's start with the Internets.
Do we have questions from the Internet?
One question is this Russian
state malware?
I won't answer this question.
I can discuss about that.
We don't do any sort of attribution
because this is very difficult to
do.
Another question from the Internet.
No more serious questions from the
Internet, just no,
please, when you exit.
Please be quiet.
Respect that. There is some people in
here who just want to know
a little bit more.
There is one question over there to the
right guy, if a question.
Indeed.
Let's say the malware period that you
found a lot of
allegedly U.S.
malware or is a molar was found.
Do you see any development in code
that is based upon the ideas that they
get from these malware analysis
that have been made in those periods?
I would say yes, Asians talk
about it in this presentation.
But for example, external
wasn't obfuscated before.
At some points. And then they started to
obfuscate some more recent samples.
So I would say yes.
OK.
Thanks.
More questions. Yes. There is one
question over there.
Will I have to like maybe
obvious question, maybe speculative?
Do you think this group has
some ties to, like Russian government
or Russian secret services or something?
I already told you I
won't. I won't answer this question
because, like, we know they can use
Russian language, but that doesn't mean
anything. Right.
I'm
sorry, I didn't understand the.
We didn't. OK.
So sorry, sorry.
I need. I need to repeat the question.
So your question was, was there
any reaction of your research
on their site?
Right. OK.
Like I said before,
when we started to analyze
this tunnel was we've seen some of
discussion techniques implemented
in the softwares.
Also, the research is quite showing.
It's we published.
We've published it like a few months ago.
So I would wait until
2:00. I would wait a little to see.
They all actively
switching things up.
But they are definitely reading the
paper, I would say.
I think so.
There is one question that back over
there.
Have you found any patterns in the
targets they attacked?
Sorry. And have you found any patterns
in the targets they attacked?
Have they reacted to some of the
well, when when the targets?
Probably they that was the first
question. The second is, have they
reacted to to any of the reactions of
the targets?
What do you mean?
Well, have they had
did they have follow up hacks on
different targets?
Because they found
some some information on the first ones?
Well, like, yeah, because the second
stage back doors are usually the drugs
before the reconnaissance phase.
If the targets isn't interesting, you
won't see them on the computer.
So this is what
you wanted to know now.
I mean, they have targeted.
They had they had some attacks on
specific targets.
Yeah. Hold us.
And so you've probably talked to the
targets.
I don't know.
Why not.
Because, well, some
targets, as you can see, it's like
embassies. So that's not a very specific
people. So we can try to risk them, but
they don't obviously, and saw
us every time.
Sometime people tried to reach us
and they are doing like all
the main man in the middle, I would say.
But I never hear about anything
from the targets, like when I give them
the report on.
Here is one question over their back.
One more time doing
the work you're doing.
Are you concerned about your personal
safety?
I mean, I started this work like
one year ago. So we'll see.
Or questions?
Internet.
More from the Internet.
What do you think of the crowd strike
report? Two people are asking
which one?
They made multiple reports.
The one, the vote, the Democratic
National Committee.
I have no further information right now,
that's us.
They made quite a few.
We've still got enough time for
questions.
Yeah. Here we are one.
Did you find any winner
abilities when when
you investigated the code?
I think my colleagues did found
some
like also when the Google Retno
system released the advisories
about the flash on the window.
This case.
I found the samples
right up there. That's the one
that wanted public.
But some other some
other companies publish something about
that. So sometimes you can find
zeros. It's rare, but you can
find them and follow
up.
Did you find any vulnerabilities in the
communication to the command control
server or something else?
We don't look about like stuff
like this.
I mean, they made some programing
mistakes in their clients side of the
software. But they don't know about the
census salvos and everything.
More questions.
One from the Internet.
Are there any passwords to the fun
names that are used?
I don't think so.
That's an interesting question.
Anything more from the Internet?
Could you. Could you use to make the
microphone, please?
Or that would be great.
Thanks.
Do you believe that
the U.S.
agencies that have done some
sort of attribution,
that they have more information than you,
than me?
More information than me?
Well, more than the present today.
Yeah, probably.
Like I said at the beginning, we might
be missing part of the picture.
And this is why some other companies
operating very good reports.
So differential in.
There is a question over there again,
same microphone.
This might be a dumb question, but you
said the targets
don't usually contact you.
So how do you know about the targets?
Well, we have telemetry system that's
very different. I can't like identified
targets. Like, I know we have
hits.
We have binaries.
We have samples.
We are on the losing them.
And we will finds
some similarities.
We when he's
told me about targets, I was thinking
about the Bitly list
we found. And this is why we
didn't contact any e-mails.
And like I said, if you think
you are targeted, you can come see me and
I will look into this list if
there is like some Tilda's
that might interest you.
Thank you.
You're welcome.
More questions.
Internet.
Yes. Please.
Have there been any mass deployments of
this type of malware?
Or is it only very individual attacks?
Yeah, it's very targeted.
There is not like a widespread infection
or anything.
Anything more
Internet?
Well, we, sir.
Sorry. Clarification on the
previous question.
There is specifically interested in the
report that attributes Russia
to the DNC.
And then there's another related question
asking, are there differences between
crowd strikes, reports and jurors?
I don't believe we're all talking about
the same things, because
when we when we see something
published by, like the exploits about
the recent exploits, we are not like
adding this to the to our people since
it's already on the Internet.
So we are all
white paper is a technical breakdown
of their tool kit, like X agent external.
And I don't think they talked
about this one.
More questions.
Internet audience.
We still got time.
All right, Internet.
Internet. Go ahead.
Internet is asking if the
targets are any better
protected.
If they are a bit like more predicted
while we are detecting the symbol.
So if they are running, you said small
security, maybe. But
the the goal of the white paper
is to provide AOSIS also for the
sysadmins or people that are
managing infrastructures.
So if you're looking for that, you can
download the white paper on the blog and
there is a pretty, pretty extensive list
if you want to protect your
infrastructure.
All the incident response, of course,
because we are not doing that.
OK.
I didn't see questions in here.
Still Internet something
there?
No. It's getting quiet.
Well, then there is one more question
over there.
I know it seems that a lot of attacks are
focused on Windows machines.
Yeah.
Is that make or like I said, they
have a second stage backdoor for us
than us, U.S.
Android, Linux and
Light. The source code of excisions is an
exemption.
And we also have since set up with those
symbols for us.
Then I think if I recall correctly.
So they have like a big small.
OK. Yeah, we got another question over
there. If there are no further questions,
this is my first visit to C.C.C..
Does anyone have a good tip for a goodbar
in guys?
Think social life, we can.
We can discuss a little bit later.
So once again,
metastable cool and.