00:00:00.000-->00:00:05.125 >>Thank you ar- all for coming to this, eh, afternoon, eh, Def Con session about the adventures 00:00:05.125-->00:00:12.417 of AV and the le-leaky sandbox. Eh. to- Together with me we have here, eh, Itzik Kotler the CTO 00:00:12.417-->00:00:20.000 and cofounder of SafeBreach. And yours truly is the VP Security Research of SafeBreach. So what- 00:00:20.000-->00:00:26.875 what we’re going to cover today, eh, is, eh, exfiltration from highly secure enterprise. We are 00:00:26.875-->00:00:35.125 talking about eh, mainly, eh, two, eh, scenarios. One where in the, eh, enterprise has its end 00:00:35.125-->00:00:41.208 point- end points with a restricted internet access. That means that only, eh, traffic, 00:00:41.208-->00:00:49.500 eh, to s uh -s closed set- a very small, closed set of, eh, whitelisted hosts are allowed a 00:00:49.500-->00:00:53.167 pair, er, endpoint. Such hosts can be for example Windows Update servers, antivirus 00:00:53.167-->00:00:59.167 servers, and so forth. Hosts that are really needed for the proper functioning of the, eh, 00:00:59.167-->00:01:05.583 endpoint. And the second variant is even, eh, stricter where as endpoints simply do not have any 00:01:05.583-->00:01:11.917 internet access whatsoever. They do have, of course, visibility into the enterprise network, or 00:01:11.917-->00:01:19.083 in a set of, eh, update management servers, eh, reside on a separate eh land segment 00:01:19.083-->00:01:26.500 are allowed to access, eh, internet eh hosts so that the endpoints eventually pull, eh, 00:01:26.500-->00:01:31.667 or-or get pushed with, eh, Windows Updates and Antivirus Updates from the management 00:01:31.667-->00:01:41.542 servers, eh, that-that preside on premise. So let’s say now that the instead of, eh, 00:01:41.542-->00:01:47.917 traditional antivirus, we have cloud-enhanced antivirus. Eh Obviously, a lot of people now 00:01:47.917-->00:01:54.167 are very- now are in love with, eh, the whole cloud thing- wisdom of the clouds and so 00:01:54.167-->00:02:00.417 forth, and obviously a in a cloud enhancement is, as the name implies, an enhancement. 00:02:00.417-->00:02:07.833 What can possibly go wrong? So we say that, yes, something can go wrong. Adding cloud antivirus 00:02:07.833-->00:02:15.000 can degrade the security of the endpoint. How? Like we said, we are going to exfiltrate data 00:02:15.000-->00:02:21.375 from the enterprise. Again, we are assuming that they- we are talking about highly secure 00:02:21.375-->00:02:26.792 enterprise with restricted or no direct internet connection for the endpoints, and we are going 00:02:26.792-->00:02:32.333 to use the cloud antivirus to- actu-actually exfiltrate data from the endpoint, where with 00:02:32.333-->00:02:41.667 traditional antivirus we could not achieve this goal. A-an important fea- property of our 00:02:41.667-->00:02:45.917 attack is that the attacker can be anywhere in the internet. There’s no, eh, requirement for 00:02:45.917-->00:02:50.542 that attacker to be in proximity, either geographic or, eh, network topology wise. So 00:02:50.542-->00:02:54.958 for example we are not talking about, necessarily, an attacker that resides in the same ISP or 00:02:54.958-->00:03:00.917 that attacker that owns ISP servers and so forth. The attacker can practically be 00:03:00.917-->00:03:07.750 anywhere on the internet and the feature of the cloud antivirus that we are going to exploit is 00:03:07.750-->00:03:16.583 the antivirus Sandbox. Now before I describe the technique, we are going to go very quickly 00:03:16.583-->00:03:23.000 on some related work to make sure that we understand the context of this new attack. So 00:03:23.000-->00:03:28.667 obviously exfiltration at large, eh, is already known and researched for several decades 00:03:28.667-->00:03:34.833 with lots of works covering, eh, lots of eh, eh, exfiltration techniques- all those 00:03:34.833-->00:03:39.208 exfiltration techniques assume unrestricted internet connection and clearly this is not the 00:03:39.208-->00:03:46.667 case, eh, in the scenarios that we, eh, look at. Uh. Also there’s a lot of work on, eh, 00:03:46.667-->00:03:53.542 eh, air-gapped endpoints the other extremities, but- and this great and amusing work from a 00:03:53.542-->00:03:59.000 Bangor University research group- but all those attacks require eventually that the 00:03:59.000-->00:04:03.417 attacker is in close physical proximities. Can be either somewhere between meters and 00:04:03.417-->00:04:10.500 hundreds of meters from the, eh, eh, network. This is again a very restricted, a most 00:04:10.500-->00:04:18.500 restricting eh requirement that we do not, eh, eh, have in our technology. Uh, there are some 00:04:18.500-->00:04:24.125 works on third party sites, eh, on exfiltration of our third party sites that could have been 00:04:24.125-->00:04:30.125 theoretically be applied in the situation where the third party side eh, is the- updates server 00:04:30.125-->00:04:36.208 for one- for, eh, for Microsoft or from the antivirus. But for reasons that we, uh, go into 00:04:36.208-->00:04:42.375 detail in our white paper, eh, all those techniques are irrelevant because we are 00:04:42.375-->00:04:49.417 talking about an update server not a regular, uh, uh, browsing website eh not a regular eh 00:04:49.417-->00:04:59.125 website. Umm. There’s a lot of research, of course, on antivirus sandboxes. Ehh Tho- 00:04:59.125-->00:05:03.917 It’s great research, uh, discussing all kind of properties of, uh, antivirus 00:05:03.917-->00:05:11.625 sandboxes. But, um, all that research, eh, all that research leaked data from the sandboxes 00:05:11.625-->00:05:17.875 themselves- not from the endpoint of an, e-enterprise. So again, eh, love the research, 00:05:17.875-->00:05:27.625 but does not help directly in our case. Um. And of- there’s one case of Tavis Ormandy- the, 00:05:27.625-->00:05:33.250 eh, leaking data from the endpoint using the eh Comodo sandbox. But again, eh, this 00:05:33.250-->00:05:37.833 research, eh, assumed that there’s no restriction on the internet connections from the 00:05:37.833-->00:05:44.667 endpoints. So, again, that’s irrelevant in our case. And so we really are, eh, convinced 00:05:44.667-->00:05:54.708 that this is, eh, a new and, eh, much, eh, eh, improved, eh, attack over, eh, existing, eh, 00:05:54.708-->00:06:02.167 techniques and technologies. So here is the technique that, uh, we devised. We need two building 00:06:02.167-->00:06:11.208 blocks. One is the ability, eh, for, eh, malicious code to trigger an antivirus event. Uh. 00:06:11.208-->00:06:18.708 And, uh, in one of the previous links- i-in one of, in-in one of the slides, eh, that I just, eh, 00:06:18.708-->00:06:26.667 went through, has a very nice compilation of, uh, such, uh, triggering, eh, of techniques to 00:06:26.667-->00:06:33.250 trigger, eh, an antivirus product. And, uh, d-due to time restrictions, we only used two 00:06:33.250-->00:06:40.417 very simple triggers. One is writing the EICAR file. To this- EICAR file is a standard 68 00:06:40.417-->00:06:47.333 bytes non Window 32 executable file, that is, eh, by definition, supposed to be 00:06:47.333-->00:06:56.500 detected by each and every antivirus, eh, product. The other one is installing, uh, is- 00:06:56.500-->00:07:02.792 is having the malware install itself or persist itself on the machine- on the machine in 00:07:02.792-->00:07:08.917 question- on the endpoint by, eh, moving or copying its binary to under the Windows starter 00:07:08.917-->00:07:16.417 folder. Of course there are tons of other, eh, eh, triggering, eh, techniques. These are but 00:07:16.417-->00:07:22.833 very simple two techniques, but even with those two simple techniques, we got a very, eh, 00:07:22.833-->00:07:32.500 eh, interesting and- and meaningful results. The second building block is simply 00:07:32.500-->00:07:41.500 exfiltrating data from an internet connected machine with no internet, eh, restriction or 00:07:41.500-->00:07:45.333 with reasonable internet restrictions. Again, there are multiple ways of doing that. Uh. 00:07:45.333-->00:07:51.125 That, uh, slide about exfiltration at large lists some, eh, three, eh, papers that 00:07:51.125-->00:07:56.708 provide compilation of such, uh, techniques. And again due to time restrictions we had to 00:07:56.708-->00:08:03.708 limit ourself to only two techniques. One is simple sending an HTTP or HTTPS request 00:08:03.708-->00:08:12.000 to the attacker host where the, eh, HTTP body section contains the, eh, data to be exfiltrated. 00:08:12.000-->00:08:19.500 And the second one is slightly more sophisticated. It involves forcing a DNS resolution on the 00:08:19.500-->00:08:28.083 attacker owned domain. And, eh, using a subdomain that contains the data to be exfiltrated. Of 00:08:28.083-->00:08:33.708 course the subdomain could only contain a small chunk of such data. So a series of 00:08:33.708-->00:08:41.667 DNS-ris-queries, eh, are needed effectively to exfiltrate large amounts of data. And the idea 00:08:41.667-->00:08:49.583 here is that, eh, using DNS Source Solutions or by forcing a DNS resolene- resolution using 00:08:49.583-->00:08:55.625 Get Host by Name or getting EDR info the malware, for- tells the operating system to resolve this 00:08:55.625-->00:09:03.875 hostname. The operating system usings its, eh, configuring, eh, DNS resolver to do- to actually 00:09:03.875-->00:09:11.125 do the resolution. And the DNS resolver has to do all the, eh, hard, eh, DNS work starting from 00:09:11.125-->00:09:16.708 the, eh, root server, eh, theoretically, and going all the way through the, eh, 00:09:16.708-->00:09:21.667 authoritative server that is owned by the attacker and which is served by the attacker’s 00:09:21.667-->00:09:27.500 authoritative main server. So the final, eh, step in resolution has the DNS resolver 00:09:27.500-->00:09:34.208 sending the hostname to the, eh, authoritative DNS server owned by the attacker. And the 00:09:34.208-->00:09:40.667 attacker just needs to obstruct the, eh, subdomain or the hostname- eh, the- the host part 00:09:40.667-->00:09:48.250 of the, uh, of the DNS name. And assemble it. Eh. Collect all those, eh, queries. Assemble 00:09:48.250-->00:09:54.750 them. And ge- get them, eh, deserialized them back to the original, eh, message- the data- 00:09:54.750-->00:10:03.833 to be exfiltrated. So… And now I’m going to describe the technique. Umm. Again the 00:10:03.833-->00:10:10.792 assumptions that we, eh, make are that we have antivirus product and agent installed on 00:10:10.792-->00:10:19.417 endpoints. Eh. And it submits, eh, samples to the antivirus cloud. This submission can be 00:10:19.417-->00:10:26.625 directly by establishing a connection to the antivirus, eh, server or indirectly by, uh, 00:10:26.625-->00:10:32.042 sending this, eh, file to the antivirus management server and have the management server send 00:10:32.042-->00:10:38.042 it, eh, to the antivirus, uh, cloud. And the cloud service uses a sandbox which can 00:10:38.042-->00:10:43.625 directly connect to the internet. That’s the secret source of the- of- of part of 00:10:43.625-->00:10:50.167 the secret source. And the attacker process is a, eh, malware is assumed to be already 00:10:50.167-->00:10:55.167 running on the endpoint. How do we get a mal- an endpoint to be infected in the first place? 00:10:55.167-->00:11:03.292 It’s out of scope for this research. Obviously we can use, eh, several techniques. I’m sure 00:11:03.292-->00:11:11.125 that you’re familiar and I don’t really need to, em, to go over the- the techniques for 00:11:11.125-->00:11:16.708 infection. But in this case, think for example, about an in-infected or malicious, eh, 00:11:16.708-->00:11:25.250 USB stick. And the attack flow goes as the following. Eh. We are going to use two components. 00:11:25.250-->00:11:32.708 One is the main malware. We call it the Rocket. The Rocket is responsible for the data 00:11:32.708-->00:11:38.000 collection. The sensitive data collection can collect, eh, documents, eh, powerpoints, eh, 00:11:38.000-->00:11:46.625 slides, eh, eh, excel files, eh, database queries, and database files, whatnot from the, eh, 00:11:46.625-->00:11:55.333 endpoint. And the Rocket contains hss- a copy inside it- inside the binary- inside the 00:11:55.333-->00:12:02.542 process mem- the, eh, process memory. It contains a small a- a small additional executable 00:12:02.542-->00:12:11.625 called the satellite. And, eh, the Satellite is responsible for the actual exfiltration. It has 00:12:11.625-->00:12:18.917 logic for, eh, triggering anti-antivirus agent. And also it has logic, eh, for, eh, eh, 00:12:18.917-->00:12:29.208 generic exfiltration. So as- as we said, the assumption- the first- the zeroth step, is to 00:12:29.208-->00:12:35.417 have the machine-the endpoint infected at- with the main malware with the Rocket. As you 00:12:35.417-->00:12:42.917 can see the Rocket contains the Satellite inside it. Then the Rocket co- ehe Rocket collects 00:12:42.917-->00:12:47.375 the sensitive data from the endpoint and embeds it into the Satellite. The Satellite has 00:12:47.375-->00:12:55.250 inside its own binary. The Satellite has a static buffer preallocated. And into this 00:12:55.250-->00:13:10.917 buffer, The Rocket writes the sensitive data to be exfiltrated. So or let’s call it 00:13:10.917-->00:13:11.167 the payload. Then the Rocket writes the Satellite with the collected data inside it to 00:13:11.167-->00:13:17.958 disc and executes it using, for example, a system or any other standard, eh, execution method. 00:13:17.958-->00:13:24.125 So now two malicious processes are running side-by-side. The original main malware, the 00:13:24.125-->00:13:33.500 Rocket, and the Satellite which contains inside its binary, eh, form the collected data. Now the 00:13:33.500-->00:13:40.167 Satellite runs its, eh, triggering, eh, logic. And so it triggers the antivirus agent. 00:13:40.167-->00:13:45.833 The antivirus agent maybe quarantines satellite, stops the satellite, but also sends the 00:13:45.833-->00:13:57.500 s-sample, eh, to the cloud for further inspection. Now in the cloud, the antivirus server 00:13:57.500-->00:14:06.875 opens the, eh, eh, sample into the sandbox and runs it inside the sandbox. The sandbox, I 00:14:06.875-->00:14:13.500 remind you, is- a-allows some form of internet connection. And so the Satellite using this, eh, 00:14:13.500-->00:14:23.708 internet connection to send the data to the, eh, attacker’s command and control server. We 00:14:23.708-->00:14:31.833 have, uh, a market share research from OPSWAT’s, showing, eh, eleven, eh, leading, eh, eh, 00:14:31.833-->00:14:37.333 antivirus vendors. We, again due to time, eh, restrictions, we only tested ten of them. We had 00:14:37.333-->00:14:47.792 to omit, eh, Spybot. And the results are that Avira Antivirus Pro, ESET NOD32, Kaspersky Total 00:14:47.792-->00:14:55.000 Security, and Comodo Client security were found vulnerable to this, eh, attack technique. 00:14:55.000-->00:15:03.375 So four out of ten. Do notice that this attack technique is not to sub that we are 00:15:03.375-->00:15:09.333 triggering an antivirus agent. So we are expecting some pop ups and logs and rec-and and audits 00:15:09.333-->00:15:17.042 and whatnot. But also its, eh, at the same time too late for the enterprise to, eh, react. 00:15:17.042-->00:15:23.375 The data is already on its way to the cloud. And once it gets executed, sometimes within 00:15:23.375-->00:15:33.000 seconds, eh, the data is exfil- practically exfiltrated. While doing this research, uh, we got- 00:15:33.000-->00:15:42.792 we co- we, uh, collected a lot of, eh, insights on cloud antivirus sandboxes. As some- 00:15:42.792-->00:15:49.708 some sandboxes like ESET blocked HTTP but not DNS. Some sandboxes blocked access to environment 00:15:49.708-->00:15:56.125 variables so when we tried to enumerate them we get an empty list. Some have nonstandard 00:15:56.125-->00:16:02.625 software and environment variables; we’ll see an example shortly. Em. Of interest is the 00:16:02.625-->00:16:06.792 effect that the- the som-somewhat surprising fact that some of the antivirus 00:16:06.792-->00:16:13.500 sandboxes do not try to hide themselves. Eh. In almost all of them, at least one of the below 00:16:13.500-->00:16:19.875 list was the static or indicative of, eh, of sandboxing, eh, the computer 00:16:19.875-->00:16:25.250 name, disc volume serial number, MAC address which is either static or indicative of 00:16:25.250-->00:16:31.833 sandboxing like, for example VMware, eh, the VMware eh, eh, Vendor MAC and performance 00:16:31.833-->00:16:38.583 counter frequency which again can be indicative of, eh, sandboxing. Some sandboxing 00:16:38.583-->00:16:47.250 infrastructure is shared among several vendors. Uh. Lead time- time from submission to getting 00:16:47.250-->00:16:55.333 data exfiltrated varied wildly. We had sub minutes, actually. We had some cases where it took ten 00:16:55.333-->00:17:04.208 or twenty seconds to cases where it took, eh, two to three hours. Um. Of also peculiarity is that 00:17:04.208-->00:17:10.792 we saw some cases where multiple executions, eh, were carried out. So we assumed- the- all- 00:17:10.792-->00:17:17.083 oh- we kind of assumed that when a sample is uploaded to the sandbox, it is uploaded to the 00:17:17.083-->00:17:22.417 cloud, it gets executed once in the sandbox. Well, clearly that’s not always the case. 00:17:22.417-->00:17:29.625 Sometimes it is executed multiple times. And finally, ehm, eh, somewhat amusing is 00:17:29.625-->00:17:37.000 that some antivirus a-agents also go-started getting suspicious about the Rocket- the 00:17:37.000-->00:17:42.917 main malware. And they noticed that this main malware contains a small executable inside it. So 00:17:42.917-->00:17:50.292 they obstructed the small executable in its vanilla form- that is, before, eh, data was 00:17:50.292-->00:17:56.583 embedded into it- and executed it in- executed or sent- executed it- this vanilla 00:17:56.583-->00:18:02.375 sandbox in, em, vanilla, I’m sorry, satellite inside the sandbox. At first it was a great 00:18:02.375-->00:18:16.917 surprise, but later we figured out what’s going on. Um. We, uh, obstructed thirty-seven sandbox 00:18:16.917-->00:18:26.417 sample, eh, sandbox computer names. Uh and um somewhat interestingly, in 2015 two years 00:18:26.417-->00:18:39.750 ago, Hexacorn, eh, published a list of over 800 names of, eh, antivirus sandboxes. And- and 00:18:39.750-->00:18:45.000 our list, eh, coincided, eh, with the Hexacorn long list in seven cases. So seven out of the 00:18:45.000-->00:18:53.167 thirty-seven names, are ones that were in- that were known to be sandbox, eh, eh, antivirus 00:18:53.167-->00:19:03.542 sandbox computer names in 2015. So we see that this word is slowly changing a-and, but on 00:19:03.542-->00:19:10.917 the other hand that in some cases, it did not change for over two years. And here’s an 00:19:10.917-->00:19:18.833 example of the environment variables from a particular eh Comodo sandbox machine. Eh. Uh 00:19:18.833-->00:19:25.083 This machine has not made any attempt to eh hide its MAC address, disc volume number, or 00:19:25.083-->00:19:30.250 domain which remains static throughout multiple executions on that particular machine. But 00:19:30.250-->00:19:36.083 had it actually tried to randomize the MAC address, disc volume number, and domain we’d 00:19:36.083-->00:19:44.000 still be able to detect it. How? Because we have eh some, eh, environment variables that are 00:19:44.000-->00:19:52.833 interconnected- that are re-related. Em. So for example, i-in this case, so there are 00:19:52.833-->00:20:00.667 actually two representations of the present time in the lefthand side of the, eh, bottom, eh, eh, 00:20:00.667-->00:20:07.000 bullets. One uses a human-readable format with three environment variables: eh, 00:20:07.000-->00:20:13.125 tempH, tempM, and tempS, representing hours, minutes, and seconds. And the other one is 00:20:13.125-->00:20:20.208 this TNOW which is the seconds since midnight. These two actually represent the same 00:20:20.208-->00:20:28.375 quantity, time of day in two different ways. So if we find a machine that has this 00:20:28.375-->00:20:34.750 combination of, eh, environment variables, we can tell that this is Comodo sandbox likewise we 00:20:34.750-->00:20:41.750 have, eh, another set of, eh, environment variables that represent the time plus 202 00:20:41.750-->00:20:47.292 seconds. Not sure what this magic number represents- possibly a time limit for a 00:20:47.292-->00:20:54.083 sandbox execution. And again, two representations of the same time, and again, enabling us to 00:20:54.083-->00:21:01.833 detect this, eh, sandbox as a Comodo, eh, sandbox even if the, eh, obvious MAC address, disc 00:21:01.833-->00:21:11.000 volume number, and domain are randomized. We kept talking about, eh, cloud sandboxes. But 00:21:11.000-->00:21:16.958 in fact this research also applies to on premise antivirus sandboxes, which are considered 00:21:16.958-->00:21:24.250 a more secure alternative to cloud or live sandboxes. But if those on premise antivirus 00:21:24.250-->00:21:29.875 sandboxes allow internet connections, and the, eh, enterprise firewall also allows 00:21:29.875-->00:21:36.458 internet connections or the subset- two subsets of internet connections that has- that have 00:21:36.458-->00:21:43.458 nonempty intersection, then the, eh, satellite can abuse, eh, this nonempty intersection to 00:21:43.458-->00:21:49.458 exfiltrate data through the internet ports or protocols that are both allowed by the sandbox 00:21:49.458-->00:21:56.292 and by the corporate firewall and achieve the exfiltration. We did not test this, but, eh, we 00:21:56.292-->00:22:04.458 assumed that there are some systems out there that, eh, are vulnerable to the attack. To 00:22:04.458-->00:22:10.292 generalize what, eh, we, eh, just described, you can think that- you- you can actually say 00:22:10.292-->00:22:14.792 that any sample sharing outside the enterprise or in case of on-premise sandbox if it’s 00:22:14.792-->00:22:20.417 inside the enterprise can facilitate exfiltration. So we should be weary of security 00:22:20.417-->00:22:26.208 mailing lists and file or sample repositories or expert analysis services. If we provide them 00:22:26.208-->00:22:35.000 with executables from our enterprise we can, by that action, facilitate exfiltration. 00:22:35.000-->00:22:39.250 And particularly when we are looking at , eh, submission to VirusTotal and friends, eh, 00:22:39.250-->00:22:47.625 this, eh, becomes eh- a, real, eh, real problem. Eh. If such services- if online or cloud 00:22:47.625-->00:22:54.750 sandboxes scanning services- I used as a decant for a malware detection and change, then this 00:22:54.750-->00:23:01.625 becomes a problem. And even if, and of course if, eh, VirusTotal or Joe Sandbox or Payload 00:23:01.625-->00:23:06.833 Security products, eh, services, I’m sorry, are used manually- and obviously if this, eh- if 00:23:06.833-->00:23:12.833 this sample share happens to be a satellite type of sample, then, eh, we actually, eh, 00:23:12.833-->00:23:20.333 facilitate exfiltration. And we did manage to do that with Google VirusTotal, with Joe 00:23:20.333-->00:23:29.750 Security Sandbox Cloud, and Payload Security Hybrid Analysis. So for a little demo, 00:23:29.750-->00:23:48.167 I’m handing it over to Itzik. >>Thank you. So as Amit has presented, um, we have released 00:23:48.167-->00:23:54.542 the tool, um, that basically I’m going to demo in, um, right now. It is already on GitHub so once 00:23:54.542-->00:24:09.375 I’m able to present this user back, you can see the URL and download. Okay. Let’s see let’s 00:24:09.375-->00:24:18.375 see. Cool. So the tool’s name is spacebin and basically what it does is, is exactly what Amit 00:24:18.375-->00:24:23.167 described. We have developed two components. One of them is the Rocket. One of them is the 00:24:23.167-->00:24:28.042 Satellite. And I’m going to make a presentation here that shows exactly how it works. For the 00:24:28.042-->00:24:33.167 first time, what I’m going to show right now is a local simulation on my own laptop. So 00:24:33.167-->00:24:38.375 basically this is a Windows 10 machine running within my Mac. And I’m going to compile right 00:24:38.375-->00:24:45.375 now a Rocket and a simulation. The purpose of that exercise is to leak the stream Hello DC25. 00:24:45.375-->00:24:54.375 So we are using Python basically to generate, um, a C plus plus skeleton and within this 00:24:54.375-->00:24:59.708 skeleton we embed the actual file- the actual string that we would like to exfiltrate from 00:24:59.708-->00:25:07.000 that purpose company. Um. As a- as a way to embed information, we are using a magic number. So 00:25:07.000-->00:25:11.667 it will not actually compile anything the Satellite as uh Amit presented- the vanilla 00:25:11.667-->00:25:16.708 version basically contains a buffer within the executable which is then will be rewritten 00:25:16.708-->00:25:22.083 with information once the attacker wants to exfiltrate it. So the process that happened 00:25:22.083-->00:25:29.208 right now, I’ve compiled the Rocket… >>Bigger! >>Sorry? Bigger? Ok. I’ll try to make it 00:25:29.208-->00:25:46.625 a little bit bigger. Um. So we have compiled the actual. um. Hold up one second. Ok. So, uh, 00:25:46.625-->00:25:51.542 we have actually run a Python script. That Python script generated a C plus plus file 00:25:51.542-->00:25:55.833 that will beat the Rocket. And within in it, we’ve provided the string that we’d like to steal. 00:25:55.833-->00:26:01.333 That string was Hello DC25, obviously as a POC that is the purpose of it- it can actually 00:26:01.333-->00:26:05.292 be enhanced to do actual more files and whatnot. Again, in order to overcome the idea of 00:26:05.292-->00:26:10.875 how we will write information in real time, with allocating the buffer, and using these magic 00:26:10.875-->00:26:16.208 numbers, to basically know exactly within the executable, where we can rewrite with the 00:26:16.208-->00:26:24.458 actual information. So the Satellite once it’s executed, and here it’s named, um, TMPP 00:26:24.458-->00:26:30.083 has- um, is going to try a number of different ways to basically communicate outside. 00:26:30.083-->00:26:35.458 So the first one will be, DNS and the second one will be a bunch of different words. So 00:26:35.458-->00:26:49.667 let’s see that it’s working. Let’s see if we have internet connection [sniffs] Em. So 00:26:49.667-->00:26:54.917 basically for the purpose of this exercise, Amit and I, we have registered a domain. And 00:26:54.917-->00:26:59.708 this domain- we basically own the name server as you can see here. And basically we have 00:26:59.708-->00:27:05.250 received this heat on our- on our, um, tail. Which means that we have actually communicated 00:27:05.250-->00:27:10.917 from my Window stand through DNS tunneling to our server. So just to prove that the information 00:27:10.917-->00:27:16.875 that is packed here is the same as we have, um, initially decided, let’s decode the base 00:27:16.875-->00:27:22.708 64 string and see what’s the, um, the output. Obviously we need to make sure it’s paired 00:27:22.708-->00:27:27.708 completely. Em. As you can see, it’s the same string that we intended to link in the 00:27:27.708-->00:27:33.333 beginning. We have enhanced the tool ever since and we have created a-a version which allows 00:27:33.333-->00:27:38.417 also to try different DCP and UDP sockets. Again all for the purpose to examine what kind of 00:27:38.417-->00:27:44.750 information can be now stolen from the the sandbox. Um. As Amit presented, there is two 00:27:44.750-->00:27:49.833 types of, um, sandboxes we are going to present a demo that we have recorded with VirusTotal. 00:27:49.833-->00:27:54.375 So we actually going to present how is it going to look like if someone’s going to use 00:27:54.375-->00:28:03.958 VirusTotal. And I’m basically going to narrate it as I’m playing the demo over here. So 00:28:03.958-->00:28:08.708 as you can see here, we have a split for three screens. On the left side- the upper left side 00:28:08.708-->00:28:13.792 of the screen, we’re going to basically bind a bunch of very common DCP and UDP ports from 00:28:13.792-->00:28:19.125 the assumption that if the sandbox is open, that will allow the information to flow through. 00:28:19.125-->00:28:25.083 Um. On the bottom, as you can see, we’re going to tail our bind DNS service and, again, in 00:28:25.083-->00:28:30.333 the hope to see the sandbox will allow the DNS request to go out. We are now compiling on the 00:28:30.333-->00:28:34.958 right side. That’s the hacker point of view. We’re actually compiling the, um, the same 00:28:34.958-->00:28:41.625 Rocket as I’ve tested on on my computer. Here we are going to use a different payload. Now 00:28:41.625-->00:28:46.000 stepping into VirusTotal- that’s the same website that you guys are seeing. The same website 00:28:46.000-->00:28:51.083 that you guys are using. I have no special access to it or no special mode. The rationale 00:28:51.083-->00:28:55.167 behind this particular demo as I mentioned is you are a threat analyst, soc analyst, there is 00:28:55.167-->00:28:59.500 some kind of a sample that you would like to examine. Now you’re going to to to VirusTotal 00:28:59.500-->00:29:03.083 and you’re going to submit that sample. 1. So far, so good. It sounds like a great solid 00:29:03.083-->00:29:08.500 workflow. So I’m going to do exactly that. I’m going to upload the created satellite 00:29:08.500-->00:29:15.250 into, um, VirusTotal and it will start processing. It will take about uh a minute until it will 00:29:15.250-->00:29:20.583 actually, uh, connect back. Take into consideration the order, uh, that the sandboxes are being 00:29:20.583-->00:29:26.542 activated. We cannot control it. As Amit specified, it can be seconds, minutes, or hours. Um. 00:29:26.542-->00:29:30.708 In this particular demo, it’s about a minute. So as you can see VirusTotal is actually 00:29:30.708-->00:29:36.708 processing the sample, not doing what it’s always doing. Now let’s put attention on the left 00:29:36.708-->00:29:41.667 side of the screen. Uh, what’s going to happen here is that we’re going to see information 00:29:41.667-->00:29:48.625 coming both on the- on the tcp, udp sockets as well as on the DNS. So let’s let it run its 00:29:48.625-->00:30:08.917 course. In reality, I spend a lot of time in front of that screen waiting for results to 00:30:08.917-->00:30:17.375 show up. I just showed it it here in the demo. [applause] Thank you. Thank you. So what 00:30:17.375-->00:30:22.458 we’re seeing on the left side is that VirusTotal al- totally allowed connection to this 00:30:22.458-->00:30:30.000 different port. Anything from 6667 IRC all the way to NTP, 123 UDP, and other popular services. 00:30:30.000-->00:30:37.792 This limit of use is Hello Blackhat 2017. that was our we previous talks we prepared the 00:30:37.792-->00:30:40.958 demo for that one. On the bottom side of the screen we can also see hit on our DNS server. 00:30:40.958-->00:30:45.458 Meaning that we actually also allow- also DNS tunneling is also possibility to run from 00:30:45.458-->00:30:50.250 VirusTotal. What I’m going to do now in the demo, is I’m going to take, again, the base64 encoded 00:30:50.250-->00:30:55.042 string and I’m going to decode it. And this is supposed to be the same string that I’ve set in 00:30:55.042-->00:31:12.208 the beginning which is the Hello Blackhat 2017. And that’s that. So I’m gonna just kinda quickly 00:31:12.208-->00:31:16.417 recap what we are seeing right now. So what we’ve seen is, a uh, malware contains another 00:31:16.417-->00:31:21.667 malware. And that the secondary malware will try to communicate out from the sandbox on two 00:31:21.667-->00:31:26.542 different methods. One is the DNS tunneling as shown in the lower bottom of the screen. And 00:31:26.542-->00:31:32.417 then the- on the try to create open sockets on regular services and tried to communicate the 00:31:32.417-->00:31:59.958 string out. So back to you, Amit. >>Thank you, Itzik. Alright. So obviously, we 00:31:59.958-->00:32:06.250 informed the, eh, affected vendors. Eh. Three of them, Avira, ESET, and Comodo fixed 00:32:06.250-->00:32:13.542 their sandboxes we’ll soon explain how. Eh. In fact, Avira did that in less- in less than 00:32:13.542-->00:32:21.875 half a day. Eh. Kaspersky on the other hand opted, eh, not to fix- eh, they said that the-they 00:32:21.875-->00:32:28.167 offered several work-arounds. Eh, but, eh, they did not address, eh, the, eh, core, eh, 00:32:28.167-->00:32:34.250 issue in their eh offering. We also got, by the way, a nice acknowledgement email, eh, a 00:32:34.250-->00:32:42.417 document from, eh, from Itzik. So that’s very nice of him. So that’s about antivirus vendors. 00:32:42.417-->00:32:50.125 As for cloud sandboxes, eh, and malicious services, um, I should say that- I should say very 00:32:50.125-->00:32:55.792 honestly that I- I- we do not consider the issue to be a- a vulnerability in the services. 00:32:55.792-->00:33:03.792 After all, the services are, uh, um, not- eh, committed to the to- or- or not supposed to 00:33:03.792-->00:33:09.167 prevent exfiltration from endpoint machines which are totally not in their 00:33:09.167-->00:33:16.750 jurisdiction. Em. However, we notified all three vendors. Eh VirusTotal, eh, told us, eh, 00:33:16.750-->00:33:21.083 that eh internet connections are needed for, eh, or actually features for the analysis of 00:33:21.083-->00:33:30.292 their, er, the samples. Jo Security decided to fix and Payload Security decided not to 00:33:30.292-->00:33:43.458 comment. [laughs] So what can, a eh, cloud antivirus do, eh, in such case… What we- the obvious 00:33:43.458-->00:33:48.792 suggestion is simply to block all traffic eh, to the internet from the sandbox. But we can be 00:33:48.792-->00:33:56.000 a bit more, eh, delicate and, eh, just, eh, and only allow a sample to interact with the 00:33:56.000-->00:34:01.208 internet if the sample arrives from the internet. Now what do I mean by that? I mean that if a 00:34:01.208-->00:34:09.917 sample gets from the internet to an endpoint, but the AV agent knows- knows that it’s- that it- 00:34:09.917-->00:34:18.292 the sample on disc is byte-wy identical or, em, identifiable or shy too identical to the 00:34:18.292-->00:34:23.875 sample that eh to the binary that arrived from the internet, then it’s safe to send it to the 00:34:23.875-->00:34:32.083 sandbox for, eh, full internet access analysis. However, it’s- it there’s a subtle issue here. 00:34:32.083-->00:34:38.375 It’s not enough for the, eh, sample to arrive from outside the endpoint. Think about in an 00:34:38.375-->00:34:45.125 en-en-enterprise where two endpoints are infected. And in one of them, The Rocket spawns 00:34:45.125-->00:34:51.167 a-a sample- a-a satellite and sends the satellite to the second infected machine. Now th- 00:34:51.167-->00:34:59.958 the second Rocket in the second infected machine executes the satellite. The antivirus looks 00:34:59.958-->00:35:07.583 at the satellite an sa- and- and figures that it’s identical to the one- to the copy on wire to 00:35:07.583-->00:35:14.750 the second endpoint. And so it’s quote, unquote safe for, eh, full internet access eh sandbox 00:35:14.750-->00:35:21.125 analysis. But that’s not the case, because th-the sat- the satellite arrived from within 00:35:21.125-->00:35:25.875 the enterprise and may contain eh embedded in it sensitive enterprise information. So the 00:35:25.875-->00:35:32.042 sample- the satellite- or, sorry, the sample should arrive from outside an enterprise- 00:35:32.042-->00:35:36.417 should arrive from the real internet. And obviously this suggestion does not apply to 00:35:36.417-->00:35:42.125 cloud scanning an- se- and analysis services like VirusTotal or clueless about the 00:35:42.125-->00:35:51.417 origins of the sample that’s uploaded to them. E- From the offensive point of view there 00:35:51.417-->00:35:58.292 are, er, research directions that, eh, we are, eh, we identified. Eh Again, our 00:35:58.292-->00:36:03.083 research was conducted with some time and re-resource restrictions. Em. So- but. We do 00:36:03.083-->00:36:11.750 have some ideas where this research can be, eh, eh, where this research can be exten- or 00:36:11.750-->00:36:16.167 how this research can be extended. One is obviously to implement additional antivirus 00:36:16.167-->00:36:21.292 triggers. We’re not 100 percent sure it will manage to trigger the antiviruses that, eh, we 00:36:21.292-->00:36:28.125 tested in the lab. Another idea is to add more exfiltration methods. As I, eh, eh, as I 00:36:28.125-->00:36:34.375 mentioned earlier, we are- we only used HDP, NDS in our research. Obviously we could 00:36:34.375-->00:36:40.333 have tried SMTP, IRC, ICMP, and, lots and lots of protocols and techniques to exfiltrate, eh 00:36:40.333-->00:36:49.417 data. Um. One thing that eh can help the Rocket to evade, eh, detection or- or- or to evade 00:36:49.417-->00:36:56.208 getting, eh, suspicious, eh, is encrypting and or compressing the satellite, eh, the vanilla 00:36:56.208-->00:37:03.000 satellite that it carries inside it. Also, eh, when it embeds the collected data, it would be a 00:37:03.000-->00:37:08.917 good idea to compress and encrypt the collected data inside the, eh, satellite. Um. 00:37:08.917-->00:37:16.750 And finally, uh uh. A bit more radical idea would be to simulate the antivirus agent to 00:37:16.750-->00:37:24.500 cloud, eh, server protocol. This would allow the Rocket- the main malware- to submit the satellite 00:37:24.500-->00:37:33.292 directly to the antivirus server instead of having to trigger the local antivirus agent. And this 00:37:33.292-->00:37:42.417 in turn, first, eh, re- relieves us from the need to trigger the antivirus agent. But even more 00:37:42.417-->00:37:52.167 importantly, can result in a less, eh, eh, susp- eh, less conspicuous or- or- or less 00:37:52.167-->00:37:56.375 obvious, eh, trace that something fishy is going on. There will probably won’t be any 00:37:56.375-->00:38:02.083 pop ups as- in the- the ones we captured flew- a few slides ago. And maybe even less logs or 00:38:02.083-->00:38:07.750 maybe with some tampering and with some, eh, eh, sophistication maybe almost no 00:38:07.750-->00:38:18.583 logs at all eh from this, sub-submission. And so it’s more evasive. To conclude this 00:38:18.583-->00:38:27.708 research in what we’ve, eh, eh, seen, um, we summarize it in three points. First one is that 00:38:27.708-->00:38:33.125 antivirus products using internet connected sandboxes can facilitate exfiltration even 00:38:33.125-->00:38:41.875 when very strict restrictions are applied, eh, uh or enforced on the endpoints. This applies 00:38:41.875-->00:38:48.417 both for in the cloud sandbox which is the main object of our study but al-also on on- premise 00:38:48.417-->00:38:57.500 sandbox. We generalize that and say that sharing suspicious or malicious files can facilitate 00:38:57.500-->00:39:03.708 exfiltration unless the file has arrived from the internet and is unmodified. And this 00:39:03.708-->00:39:10.292 particularly applies to eh uploading samples to online or cloud scanning analysis services 00:39:10.292-->00:39:16.125 like VirusTotal and Friends. But also any sample sharing at large. Sending a sample to 00:39:16.125-->00:39:24.958 mailing lists or, eh, sharing it with, eh, security experts and so forth. Finally particularly 00:39:24.958-->00:39:30.833 for antivirus products, Avira, ESET, Comodo fixed their sandboxes so that they no longer 00:39:30.833-->00:39:36.750 allow internet connections. So they’re apparently safe. Kaspersky is presently known to 00:39:36.750-->00:39:41.625 be vulnerable. Unless, of course, its users use any of those, eh, workarounds, eh, 00:39:41.625-->00:39:48.250 suggested by Kaspersky. And with other vendors, we can’t positively say that they are, 00:39:48.250-->00:39:55.417 eh, not vulnerable because we only studied a very small amount of, eh, triggering, eh, eh, 00:39:55.417-->00:40:02.083 techniques and, eh, eh, eh, exfiltration techniques. Uh. But obviously, more research should 00:40:02.083-->00:40:12.250 be applied in this area. And we’d like to, eh, thank, eh, Yoni Fridburg for his help in 00:40:12.250-->00:40:27.042 setting the antivirus research lab. Thank you Yoni wherever you are. Thank you all for, eh, eh, 00:40:27.042-->00:00:00.000 attending our session. [applause]