00:00:00.208-->00:00:06.000 >>Aloha and welcome to my talk on offensive malware analysis. My name is Patrick, I am the 00:00:06.000-->00:00:10.042 chief security researcher at Synack. Briefly, Synack does crowdsourced vulnerability 00:00:10.042-->00:00:14.250 discovery with vetted security researchers. So, if you're interested in getting paid to 00:00:14.250-->00:00:19.833 find bugs in our customers apps and websites uh, check out Synack dot com, or come chat 00:00:19.833-->00:00:24.125 with me. So, today we're going to start by looking at an interesting piece of malware 00:00:24.125-->00:00:28.375 called fruitfly, and we're then going to talk about some monitoring tools and 00:00:28.375-->00:00:33.208 capabilities I wrote for Mac OS, then how I built a custom command and control server, 00:00:33.208-->00:00:37.792 following this how then I used that server to task the malware, in order for it to reveal its 00:00:37.792-->00:00:42.000 capabilities to me. And then Finally, what happened when I put this command and control 00:00:42.000-->00:00:48.583 server on the internet. So, our goal here is to analyze fruitfly, comprehensively, but 00:00:48.583-->00:00:53.125 do so in a rather efficient way. So, traditionally, when you analyze malware you use 00:00:53.125-->00:00:57.833 disassemblers and debuggers. And with stress these methods definitely work, but they're 00:00:57.833-->00:01:03.417 kind of slow. Now, I didn't have access to a command and control server but, I figured if I'd 00:01:03.417-->00:01:09.542 write my own, then be able to task the malware and observe how it responded, I would be able to 00:01:09.542-->00:01:15.208 basically coerce the malware into revealing its capabilities to me, just by asking it the 00:01:15.208-->00:01:18.833 right questions. I thought this would be a lot faster of a technique than spending many 00:01:18.833-->00:01:23.625 hours reverse engineering. So, I mentioned the target is going to be a mac malware specimen named 00:01:23.625-->00:01:28.625 fruitfly. But, before we can build this custom command and control server to task it, we 00:01:28.625-->00:01:33.542 need two things. We first need to figure out the address that the malware is trying to connect 00:01:33.542-->00:01:37.458 to, where it's looking to connect to for a command and control server. And then, what 00:01:37.458-->00:01:42.500 protocol does it speak? Because this will allow us to create a compatible command and control 00:01:42.500-->00:01:48.000 server, which will then allow us to task the malware. So, fruitfly was discovered in 00:01:48.000-->00:01:52.875 January, uh initially it was undetected by antivirus engines on virus portal. Uh, my good 00:01:52.875-->00:01:57.208 friend Thomas Reed who is here in attendance, an incredible Mac security researcher, did the 00:01:57.208-->00:02:02.042 initial analysis, wrote a great blog, articulating the components of the malware, it's 00:02:02.042-->00:02:06.667 perses, it's persistence techniques, and also, some of it's capabilities. It's fairly 00:02:06.667-->00:02:11.458 standard, but fully featured Mac backdoor, but it has some interesting interactive 00:02:11.458-->00:02:16.625 capabilities, also the ability to turn on the webcam. Now, we don't know the infection vector, 00:02:16.625-->00:02:20.500 we never found an installer which is interesting, but perhaps it was via an email 00:02:20.500-->00:02:25.750 attachment or pirated or trojaned application. Today we're going to be looking at 00:02:25.750-->00:02:31.292 variant b, a friend send me, sent me a hash of this sometime in late January, at the time, 00:02:31.292-->00:02:36.042 variant a was already being detected, but variant b was still undetected. It was 00:02:36.042-->00:02:41.417 submitted to virustotal with the name of fpsaud, which is designed to mimic a common flash 00:02:41.417-->00:02:47.833 player, and like variant a, it's main component was an obfuscated perl script. That's kind of odd. 00:02:47.833-->00:02:53.250 As I mentioned, we want to build a custom command and control server. We need the address that 00:02:53.250-->00:02:58.500 the malware tries to connect to and we also need to understand its protocol. So, let's briefly 00:02:58.500-->00:03:04.333 triage this malicious script, to get this information. So, the first thing we do is we beautify 00:03:04.333-->00:03:10.208 the script, which allows us to read it easier, because it's now formatted better. We can see it 00:03:10.208-->00:03:15.667 starts with some imports, followed by some subroutines and finally is the main logic of the 00:03:15.667-->00:03:21.583 malware. Briefly, if we look at these subroutines we can see there names and descriptions in 00:03:21.583-->00:03:25.750 the table on the slide. Now, these aren't the core of the malware per say, they're rather 00:03:25.750-->00:03:31.250 helper functions. But, what we can do is provide insight especially into the protocol of 00:03:31.250-->00:03:35.875 malware which is essential for us to understand. So, for example, the g subroutine sends 00:03:35.875-->00:03:40.375 data back to the command and control server. So, we see a command invoking the g method, 00:03:40.375-->00:03:44.042 we can determine how many bytes it's going to send, so then our custom command and control 00:03:44.042-->00:03:49.667 server can handle that response. Similarly, the j subroutine receives some number of bytes 00:03:49.667-->00:03:54.583 from the command and control server. So if we see a command say invoking j, 9, we know it 00:03:54.583-->00:04:01.000 expects 9 additional bytes that we must send form our command and control server. Now after 00:04:01.000-->00:04:06.167 the subroutines the malware decodes some strings which turn out to be the uh addresses of 00:04:06.167-->00:04:11.000 both the primary and the backup command and control server. The easiest way to analyze these and 00:04:11.000-->00:04:15.083 decode these is to step over them in a debugger. Don't want to spend a ton of time 00:04:15.083-->00:04:19.208 debugging, but again, once I stepped over this and printed out the strings I could see they 00:04:19.208-->00:04:24.667 were URLs and IP addresses, albeit reversed, of both the primary and backup command and 00:04:24.667-->00:04:30.625 control servers. Now, before the malware connects to the command and control server in that main 00:04:30.625-->00:04:36.250 processing block, it does a few other things. It processes some command line arguments which we 00:04:36.250-->00:04:42.125 can see is looking for an IP address or an IP address and port of the command and control 00:04:42.125-->00:04:46.625 server. This is awesome, because it means we can specify our own, for example when we execute the 00:04:46.625-->00:04:50.875 malware in a vm and have it connect to our custom com, command and control server. So 00:04:50.875-->00:04:56.292 this greatly facilitates analysis. It also hides its process by just changing arcs of 00:04:56.292-->00:05:01.500 zero, this will fool tools like ps, and then finally decodes some binary data which turns out 00:05:01.500-->00:05:07.667 to be an embedded mach o binary. Finally we get to the main processing loop and this does 00:05:07.667-->00:05:11.375 two things, it checks in with the custom command and control server, or the command and 00:05:11.375-->00:05:16.417 control server sending some information like the host and user name and then it invokes 00:05:16.417-->00:05:21.958 the j subroutine to receive one byte from the command and control server which it then 00:05:21.958-->00:05:28.375 processes in a massive else if else loop. What this is doing is basically just receiving a 00:05:28.375-->00:05:32.667 numeric command from the command and control server, processing that and then returning the 00:05:32.667-->00:05:38.708 response to the server. Ok, so now we know the address of the command and control servers and 00:05:38.708-->00:05:42.417 actually we determined that the malware will connect out to whatever you specify on the 00:05:42.417-->00:05:47.583 command line. And also we understand the basic protocol. Now, before we start building 00:05:47.583-->00:05:52.083 our custom command and control server though, let's talk about how we can passively monitor 00:05:52.083-->00:05:56.708 malware. This is important because if we task the malware but we can't observe what it 00:05:56.708-->00:06:02.042 does if it just sends us back a zero or one, we really have gained to insight in which, into 00:06:02.042-->00:06:07.833 which that command actually did. So, what do we want to monitor? Well, pretty much everything. 00:06:07.833-->00:06:13.375 Uh, a given command might you know create files, write files, it might spawn off processes, 00:06:13.375-->00:06:17.583 execute shell commands, might interact with the mouse and keyboard, or send interesting 00:06:17.583-->00:06:22.625 data back, via the network. We should monitor for all of the events so that when we task for 00:06:22.625-->00:06:29.042 malware, we can determine what its doing via this simple tasking. So let's take a closer 00:06:29.042-->00:06:33.125 look at each of these now. Uh, we'll start with network monitoring, back os this is 00:06:33.125-->00:06:39.000 pretty easy to do you can use tcpdump or wireshark uh, we'll talk about tasking a little bit 00:06:39.000-->00:06:44.667 in um shortly, but at the bottom of the slide you can see the wireshark capture when the, the 00:06:44.667-->00:06:49.625 malware is responding to command number 13. Now originally, I had no idea what command number 13 00:06:49.625-->00:06:54.625 was, but we'll see when we task the malware if we look at the network capture, we can see this 00:06:54.625-->00:06:59.208 command returns the location where the malware is installed. So, this is basically how we 00:06:59.208-->00:07:05.417 revealed the capability via this network monitor. Next up, we have file monitoring, we can use 00:07:05.417-->00:07:11.083 the built in fs usage utility, uh this is a mac os utility that allows you to monitor file io 00:07:11.083-->00:07:17.083 events. We'll see that various commands when you task the malware will cause it to drop or 00:07:17.083-->00:07:22.000 save the embedded mach o binary, you can see from the file monitor its saved to slash tmp 00:07:22.000-->00:07:26.042 slash client. Now we can grab that binary and do some analysis. But, we'll see we 00:07:26.042-->00:07:29.750 don't have to actually fully reverse engineer this because we'll reveal it's capabilities 00:07:29.750-->00:07:35.458 just via tasking. Next up is process monitoring, again this is important because I assume 00:07:35.458-->00:07:40.667 the malware probably spawned off of other processes or executed other shell commands. Uh, since 00:07:40.667-->00:07:45.625 detritus is neutered on recent versions of mac, there's no easy good way to do process 00:07:45.625-->00:07:50.375 monitoring user mode, so I wrote an open source free process monitoring library that allows 00:07:50.375-->00:07:54.708 us to see what the malware is doing. For example, here when can see that when we task 00:07:54.708-->00:08:00.333 malware with command number 11 it executes the pwd command to get the current working 00:08:00.333-->00:08:06.542 directory. I also wanted to sniff the mouse and keyboard to look for simulated mouse and 00:08:06.542-->00:08:11.375 keyboard events. I found some old proof of concept code that would intercept and modify mouse 00:08:11.375-->00:08:15.333 and keyboard events, so I updated this, this will be online available for free as 00:08:15.333-->00:08:20.667 well, open source and it allows us now to capture mouse and keyboard events. So, on the 00:08:20.667-->00:08:26.083 slide you can see when I type and move the mouse our sniffer will now detect and log those 00:08:26.083-->00:08:32.625 events. Okay, onto building our custom command and control server. Recall, we can specify 00:08:32.625-->00:08:36.833 the address of the custom command and control server via the command line, and we also 00:08:36.833-->00:08:41.208 understand the protocol of the malware. We know it connects out, sends some client 00:08:41.208-->00:08:45.667 information of the infected host, and then expects a single byte which is the command it 00:08:45.667-->00:08:51.417 will then act upon. So we start by just creating some basic python code, uh we then listen 00:08:51.417-->00:08:56.625 on a port, we then execute the malware in a vm, give it the address of this python custom 00:08:56.625-->00:09:00.500 command and control server, and, we see that the malware connects. Now, nothing too 00:09:00.500-->00:09:05.792 exciting here but, baby steps. So, yeah when does the malware send when it originally checks 00:09:05.792-->00:09:11.625 in? Well, we can triage the malicious perl script, we can see it sending things like 00:09:11.625-->00:09:16.917 version string, the host name and the user name. So now we can extend our custom command and 00:09:16.917-->00:09:22.250 control server to basically parse the format of this data, so when the malware connects, we 00:09:22.250-->00:09:27.625 can dump this client information. Now the meat of the custom command and control 00:09:27.625-->00:09:32.833 server is obviously tasking and handling commands. Turns out there is about 25 commands and a 00:09:32.833-->00:09:38.042 variety of these had subcommands, bringing the total to about 50. So, I built the 00:09:38.042-->00:09:41.667 custom command and control server to support all of these. Now again, it's important to 00:09:41.667-->00:09:46.083 understand that originally I did not know what these commands actually did, like command 00:09:46.083-->00:09:51.833 number 2, no idea. So, what I did for each command is I would basically triage the command 00:09:51.833-->00:09:56.458 with the goal of understanding its protocol. Did it receive additional bytes from the 00:09:56.458-->00:10:00.875 command and control server, and then what is the format of the response? So here's a simple 00:10:00.875-->00:10:06.917 example, command number eleven, we can see it res, expects no additional, uh address or bytes 00:10:06.917-->00:10:11.250 from the command and control server. But then responds with a byte and a variable length 00:10:11.250-->00:10:16.458 string. So we can extend our custom command and control server to parse this response 00:10:16.458-->00:10:21.458 and then we can see this is the malware setting back its custom, current working directory. 00:10:21.458-->00:10:27.542 Alright, now we task. So again, we have our monitoring capabilities, and this custom 00:10:27.542-->00:10:32.417 command and control server. Now unfortunately, I don't have time to go through all the commands 00:10:32.417-->00:10:36.667 but we'll look at some of the more interesting ones. Again, when I began tasking the 00:10:36.667-->00:10:42.292 malware, I really had no idea what these commands actually did. So, the first command is 00:10:42.292-->00:10:48.708 command number 2. If we look at a malicious perl script, we can see this command via the j 00:10:48.708-->00:10:53.125 subroutine expects an additional byte from the command and control server, it then invokes 00:10:53.125-->00:10:58.125 the v subroutine, to execute the embedded mach o binary, and then invokes the g subroutine to send 00:11:00.417-->00:11:04.875 the response some information back to the server. So now we know, understand the protocol, 00:11:04.875-->00:11:08.250 we, we know it's requires an additional byte and then it's going to send us back some 00:11:08.250-->00:11:13.167 variable length data. But again, we have no idea what this command actually does. So we 00:11:13.167-->00:11:17.708 send the, the malware command number 2 and for the second byte we just send it as zero, and via 00:11:17.708-->00:11:21.875 the file mon we can see it dropping that embedded mach o binary and then via the process 00:11:21.875-->00:11:27.958 monitor, we can see it executing that embedded binary as well. Now, via the network capture, we 00:11:27.958-->00:11:32.375 can then send it, we can then see it sending back about a meg of data. So, we extend our 00:11:32.375-->00:11:36.542 custom command and control server to receive this data and drop it or save it to the file 00:11:36.542-->00:11:40.583 system. We can then dump it in a hex editor or run the file command and it turns out then 00:11:40.583-->00:11:44.792 its an image a png file, and when we open it, we can see it's a screen capture of the infected 00:11:44.792-->00:11:50.500 host. So now we know that command number 2 is a screenshot utility, screen capture, and 00:11:50.500-->00:11:56.875 again just via tasking. Now remember though, this command takes a second byte and at the 00:11:56.875-->00:12:01.292 time again I had no idea what this was I had sent it as zero and it sent me this nice color 00:12:01.292-->00:12:05.917 png. But we have the ability to task the malware, so, instead of having to spend time to reverse 00:12:05.917-->00:12:10.792 engineer, let's just keep tasking command number 2, and change the values of that second 00:12:10.792-->00:12:16.583 parameter. We can see the table contains the results, basically that second byte influences the 00:12:16.583-->00:12:21.875 type and quality of the capture. So, for example, if we send a 1 for that second byte, it gives 00:12:21.875-->00:12:28.375 us back a low res black and white png, while a 10 gives us a low res color jpg image. 00:12:28.375-->00:12:34.417 Alright, onto command number 8, again we triage the command we see it expects an additional 9 00:12:34.417-->00:12:40.083 bytes, and again drops and execs that embedded mach o binary. In terms of its response though it 00:12:40.083-->00:12:44.500 just sends us back a zero or a one, so unlike the screen capture command we have no 00:12:44.500-->00:12:50.083 insight into what this command does by looking at its response. But, if we task this, send the 00:12:50.083-->00:12:55.958 command number eight and then for the additional 9 bytes just send 0,1,2,3,4,5,6, we can see 00:12:55.958-->00:13:00.667 the mouse sniffer registers event it moves to the x,y coordinate. So, watch closely, 00:13:00.667-->00:13:05.000 we're going to task the malware with this command and what it's going to do, it's going to move 00:13:05.000-->00:13:11.375 the mouse, amazing right? [chuckles] Gets a little more exciting, okay, what about that 00:13:11.375-->00:13:17.333 second byte? Again, we didn't know what it was but we now know the 8 bytes after that are x,y 00:13:17.333-->00:13:22.500 coordinates. So again, we can just task the malware, varying this second byte, we can see as 00:13:22.500-->00:13:27.625 it shows on the table in the slide, this is a subcommand, it basically tells the malware what 00:13:27.625-->00:13:33.042 type of mouse command to do, left click, double click, right click, drag. This is a really 00:13:33.042-->00:13:38.042 neat capability because it allows the attacker to actually interact with UI elements of the 00:13:38.042-->00:13:42.417 host. For example, security pop-ups, again watch closely, we're going to task the malware 00:13:42.417-->00:13:48.375 and via the malware dismiss a security prompt. Kind of a neat feature. The final commands 00:13:48.375-->00:13:53.750 we're going to talk about are 16 and 17. Again, we triage the command, we see that in, it 00:13:53.750-->00:13:57.833 invokes j to get one extra byte from our command and control server. So we know okay, our 00:13:57.833-->00:14:02.125 custom command and control server should send one additional byte. It then 00:14:02.125-->00:14:07.542 executes again the v subroutine which drops and executes the embedded mach o binary, the file 00:14:07.542-->00:14:11.750 mon and process monitor show this happened, uh but most interestingly then, the keyboard 00:14:11.750-->00:14:17.958 sniffer lights up. So for example if we send command number 16, with a value of 65 00:14:17.958-->00:14:23.375 for the second byte, the keyboard sniffer shows a keydown event for the letter a. If we 00:14:23.375-->00:14:29.208 then execute command number 17, passing in a 65 as well for the second byte we can see it 00:14:29.208-->00:14:34.125 generates a key alphabet. So this allows the hacker to remotely type on the infected 00:14:34.125-->00:14:39.667 host. So again on the slide we're going to send it a command to type in H and then an I. 00:14:39.667-->00:14:46.542 Okay, so what I did was I repeated this process for all the commands. So this allowed me 00:14:46.542-->00:14:52.292 to understand comprehensively the capabilities of the malware. Right? They say communication is 00:14:52.292-->00:14:57.125 key, apparently, people say this applies to humans, but in this case it also applies to malware 00:14:57.125-->00:15:01.333 as well. So we talked about some of the more interesting commands, but of course the 00:15:01.333-->00:15:05.500 malware supports other interesting commands as well, it allows you to execute system 00:15:05.500-->00:15:11.000 commands, shell commands, process listing, upload files, etcetera. The most interesting 00:15:11.000-->00:15:15.500 one though is the malware actually has the capability to alert the attacker when the user 00:15:15.500-->00:15:20.667 is using the computer. This is a very interesting capability, obviously this malware was 00:15:20.667-->00:15:24.708 designed for interactive operations, and when you're doing interactive operations, 00:15:24.708-->00:15:30.083 for example moving the mouse, maybe typing, perhaps turning on the webcam, you obviously don't 00:15:30.083-->00:15:34.042 want the user to be there because they will observe these very observable actions and this 00:15:34.042-->00:15:38.875 will be a dead give away for what that the system is infected. Alright, so we now 00:15:38.875-->00:15:44.583 have a fully compatible custom command and control server, let's go hunt some flies. So if 00:15:44.583-->00:15:49.417 you ping the primary command and control servers, they are all offline. But, recall we 00:15:49.417-->00:15:53.917 encrypted some backup command and control servers, and guess what, they were available for 00:15:53.917-->00:16:00.125 registration. So, I hopped on line, registered the URLs of these backup command and control 00:16:00.125-->00:16:04.625 servers, pointed them to my custom command and control server, and immediately hunder, 00:16:04.625-->00:16:09.542 hundreds of infected victims started to connect. And again, recall for each victim the 00:16:09.542-->00:16:13.667 malware when it checks in sends the username and the computer name which when coupled with an 00:16:13.667-->00:16:18.708 IP address gives us a very good, pretty accurate way to identify victims. For example, if I was 00:16:18.708-->00:16:24.292 infected, you would see an IP address in Hawaii, you would see username Patrick and host name 00:16:24.292-->00:16:30.083 be Patrick Wardle's Macbook cause by default mac uses first and last names for the 00:16:30.083-->00:16:34.125 hostnames. So, I looked into who these victims were, geolocation and there names, and it turned 00:16:34.125-->00:16:38.917 out a vast majority of them were in the U.S. and also, they appear to be just normal 00:16:38.917-->00:16:43.792 everyday people. So, this was interesting, again we have a piece of malware that looks like 00:16:43.792-->00:16:49.458 it has surveillance type of capabilities, uh for example webcam capture etcetera, but its 00:16:49.458-->00:16:53.500 targeting everyday people. Now, everyday people are normally targeted by financially 00:16:53.500-->00:16:58.458 motivated cyber crime malware. And malware that has this more spying capability is usually 00:16:58.458-->00:17:01.833 associated with nation states which are not going to be targeting those kinds of people, 00:17:01.833-->00:17:06.458 it's going to be targeting like defense contractors and military organizations.So unfortunately, 00:17:06.458-->00:17:11.167 what this means is that this malware was designed to basically spy on everyday people 00:17:11.167-->00:17:16.833 and, and families and that's kind of what I saw by looking at the data. Uh, so I contacted law 00:17:16.833-->00:17:22.500 enforcement and it's progressing. Alright, so let's wrap this up.So, today again we 00:17:22.500-->00:17:27.625 illustrated how to fully analyze a fairly complex piece of malware, just by asking the 00:17:27.625-->00:17:33.542 right questions. Again, in three steps, we built a custom command and control server, then tasked 00:17:33.542-->00:17:39.625 the malware, and we reserved the malware's response to fully reveal its capabilities. Along 00:17:39.625-->00:17:45.333 the way we wrote some cool, uh monitoring tools for mac OS that again will be open source and 00:17:45.333-->00:17:51.708 posted online, and the end result is we had a full analysis of fruitfly variant B. Also 00:17:51.708-->00:17:55.917 then, since we were able to register these custom command and control servers, we were 00:17:55.917-->00:18:01.000 able to uncover a large number of victims and get insight into who these individuals were. 00:18:01.000-->00:18:04.833 Again, worked closely with law enforcement because unfortunately it looks like this 00:18:04.833-->00:18:09.833 malware was designed with a very kind of creepy perverse uh angle which you know is rather s***y. 00:18:12.042-->00:18:15.583 Um we could've also though hijacked all of those victims. I always joke, and I probably 00:18:15.583-->00:18:19.875 shouldn't say this, but you know if all those connections were you know computers in Russia or 00:18:19.875-->00:18:24.875 China, I might have contacted somebody else. Again, this is the power you have with a custom 00:18:24.875-->00:18:29.833 command and control server in that if you can then take over the address of the domain it's 00:18:29.833-->00:18:36.708 talking to, you can task these computers. I was tempted to, but I did not. Now, people always 00:18:36.708-->00:18:41.333 ask me you know how can you protect against something like this threat. Uh, forensic 00:18:41.333-->00:18:46.000 analysis and also some information we have that I can't talk about publicly just yet, 00:18:46.000-->00:18:50.375 indicates that this malware has been around for 5, if not 10 years. Really just flying under 00:18:50.375-->00:18:55.542 the radar again targeting families to basically spy on them perhaps via the webcam. So, 00:18:55.542-->00:19:01.083 my response is always you know use best security practices, uh, install the latest patches, run 00:19:01.083-->00:19:05.875 the latest version of Mac OS, also look into perhaps third party security tools. So in my 00:19:05.875-->00:19:10.708 free time I write some free a lot of open source mac security tools, uh one for example is 00:19:10.708-->00:19:15.167 called blockblock, monitors persistence locations will likely detect the malware when 00:19:15.167-->00:19:20.333 it persists. Another one is called oversight that monitors for the webcam and mic, so if 00:19:20.333-->00:19:26.042 this malware had got on the computer, if the hacker and then turned on the malware to turn on 00:19:26.042-->00:19:30.292 the webcam to spy on the user perhaps when they were walking around in their bedroom in their 00:19:30.292-->00:19:34.917 underwear or less, when the user came back to the computer even if the hacker turned off the 00:19:34.917-->00:19:39.250 webcam, a website would have alerted the user saying hey just to let you know some process was 00:19:39.250-->00:19:44.208 using the webcam basically spying on you. And then I'm just releasing a free open source mac 00:19:44.208-->00:19:48.250 os firewall think little snitch but free and open source, uh this should be out in a few 00:19:48.250-->00:19:52.208 weeks and this would have detected when the malware connected out to the internet. 00:19:52.208-->00:19:57.125 So again, I think creating these free third party security utilities that trigger or alert 00:19:57.125-->00:20:02.333 on these more generic actions is a great way to target these threats. Alright, so that's a 00:20:02.333-->00:20:07.417 wrap uh thanks again for attending my talk, and if you're interested in being you know 00:20:07.417-->00:20:10.833 basically a paid security researcher to find vulnerabilities in you know 00:20:10.833-->00:20:16.250 Synacks customers checkout Synack dot com. I think we have a minute or two for questions, 00:20:16.250-->00:20:20.083 if not I'll be around here and again thank you so much for attending my talk, I really 00:20:20.083-->00:20:25.083 appreciate it [applause].