1
00:00:14,180 --> 00:00:15,580
Hello, everyone.

2
00:00:15,700 --> 00:00:19,700
My name is Paramarket and I welcome you to O365 Squatting.

3
00:00:19,700 --> 00:00:27,400
If you are not already joined in the Discord chat, please go to the BlueTeamVillage.org website, click on the Discord link and join.

4
00:00:27,400 --> 00:00:31,340
Please give a warm welcome to Juan Francisco and Jose Miguel.

5
00:00:36,230 --> 00:00:36,950
Thank you.

6
00:00:36,950 --> 00:00:37,350
Thank you.

7
00:00:37,350 --> 00:00:38,010
Thank you very much.

8
00:00:38,010 --> 00:00:41,710
Thank you for coming to this virtual talk.

9
00:00:41,710 --> 00:00:50,710
We're going to talk about the tool that we have developed, O365 Squatting, but we are going to make a very brief introduction.

10
00:00:50,790 --> 00:00:56,350
I'm working, I'm Juan Francisco Bolivar, working as a manager on IT security in a pharma company.

11
00:00:56,350 --> 00:01:00,530
I have been working during the last years in security.

12
00:01:00,530 --> 00:01:07,110
I have published a book and I am also collaborating with 11Paths as chief security envoy.

13
00:01:07,110 --> 00:01:09,650
Hey, guys.

14
00:01:09,650 --> 00:01:10,950
This is Jose Miguel Gomez.

15
00:01:10,950 --> 00:01:16,630
I've been working in security from the very beginning in my working life.

16
00:01:16,630 --> 00:01:21,070
I've been, my main role has been IT security analyst.

17
00:01:21,150 --> 00:01:28,070
Nowadays, I'm working in a pharma sector company, but I am also a researcher and cybersecurity enthusiast.

18
00:01:28,150 --> 00:01:37,090
I've been working with several multinational enterprise companies, assisting and helping them to do a more secure company.

19
00:01:37,810 --> 00:01:45,550
And also, I've been studying for a more red team acknowledged as OSCP and OSCE.

20
00:01:46,550 --> 00:01:50,390
So, let's start with the real part.

21
00:01:50,470 --> 00:01:51,870
The challenge in Azure.

22
00:01:51,870 --> 00:02:03,090
Of course, all of us know that Azure and the cloud in general, it's helping all of us and also the IT people to create easy services and domains.

23
00:02:03,090 --> 00:02:04,810
So, there is a clear benefit.

24
00:02:04,810 --> 00:02:08,610
However, the attacker has also a really good benefit.

25
00:02:08,610 --> 00:02:19,790
When you create an account on Azure, you have associated a domain on Microsoft.com for your account.

26
00:02:19,790 --> 00:02:23,450
So, you are getting a Microsoft domain for you.

27
00:02:23,450 --> 00:02:26,810
And this is something that we are going to see during this speak.

28
00:02:26,810 --> 00:02:29,910
That is something that attackers are going to exploit.

29
00:02:29,910 --> 00:02:39,550
This research and this tool has been performing our experience and the cases that we are seeing every day coming from the attackers.

30
00:02:39,550 --> 00:02:43,490
So, what is going on with the Microsoft domain?

31
00:02:43,490 --> 00:02:57,950
When you create, let's say, an account called DEF CON with this three and an O in the middle on Azure, you are automatically granted on Microsoft domain dot your username.

32
00:02:57,950 --> 00:03:04,270
So, if you try to find what is on the DNS, how is it resolved?

33
00:03:04,270 --> 00:03:07,390
It is resolved directly to the Azure DNS.

34
00:03:07,790 --> 00:03:12,490
And, of course, the whois is talking about is part of the Microsoft.

35
00:03:12,490 --> 00:03:19,290
So, it's a good starting point that we are being able to have domain on Microsoft.

36
00:03:19,670 --> 00:03:21,510
So, what is the problem?

37
00:03:21,510 --> 00:03:27,630
The problem is that you can use this domain in order to create exchange servers.

38
00:03:27,630 --> 00:03:32,750
And, of course, the hackers and the attackers are going to be using this technique.

39
00:03:32,750 --> 00:03:38,050
This technique will allow you to see a kind of image like this.

40
00:03:38,050 --> 00:03:43,870
We have seen that it was requesting some payments and was coming from a Microsoft domain.

41
00:03:43,870 --> 00:03:47,790
Of course, the first idea of a blue teamer is, okay, let's block that domain.

42
00:03:47,790 --> 00:03:51,810
But it's not a really good idea to block a Microsoft domain.

43
00:03:51,810 --> 00:03:56,430
It will have a lot of impact into your infrastructure and to real emails.

44
00:03:56,430 --> 00:04:09,350
So, other of the problems is below, beyond this small black box, the attacker was trying also to create confusion, creating similar domains to the original one.

45
00:04:09,350 --> 00:04:14,690
So, it was increasing the problem for the users to identify these emails.

46
00:04:14,690 --> 00:04:20,730
So, we were finding, we encountered a problem and we tried to find a solution.

47
00:04:21,030 --> 00:04:23,010
We started to analyze the headers.

48
00:04:23,010 --> 00:04:28,590
Of course, all the headers are gaming from old look domains and protection old look domains.

49
00:04:28,590 --> 00:04:33,390
So, everything looks good, good that is coming from Microsoft.

50
00:04:33,390 --> 00:04:38,490
We analyzed one of the IP addresses and, of course, was belonging to Microsoft domain.

51
00:04:38,490 --> 00:04:48,110
So, we cannot block it neither because it was part of the old look infrastructure and it will, again, have a lot of impact on our users.

52
00:04:49,170 --> 00:04:53,890
Also, part of the header was the message ID.

53
00:04:53,890 --> 00:04:59,610
Again, pointing to old look domains and also we were considering the SPF part.

54
00:04:59,610 --> 00:05:07,030
The SPF part was not working mainly because Microsoft has configured to none and none is equal to neutral.

55
00:05:07,030 --> 00:05:12,930
What it will not block by using this protection, the receiving of emails.

56
00:05:12,930 --> 00:05:20,210
There is other headers like transport or anti-spam mailbox and anti-spam message.

57
00:05:20,210 --> 00:05:22,430
So, a lot of protections are there.

58
00:05:23,710 --> 00:05:26,130
So, we were finding a problem.

59
00:05:26,130 --> 00:05:33,070
We are creating, attackers are creating domains on Microsoft and using it to send it to spam but we are not able to detect it.

60
00:05:33,070 --> 00:05:47,890
So, something that we detect is as soon as you create an account, not only the Microsoft account or domain is created, it's also creating automatically a SharePoint site with your name following this pattern.

61
00:05:47,890 --> 00:05:57,130
So, if the original one is the first, the attackers will be going to start to create all these similar typosquatting attacks related with on Microsoft.

62
00:05:57,130 --> 00:05:58,870
So, what is the case?

63
00:05:58,870 --> 00:06:05,210
We need to be able to detect these domains and we need to be able to block it.

64
00:06:05,250 --> 00:06:11,010
We are not able to do it with on Microsoft because it's not creating a real website.

65
00:06:11,010 --> 00:06:12,790
It's only on the Azure DNS.

66
00:06:12,790 --> 00:06:14,750
It's not in the public DNSs.

67
00:06:15,270 --> 00:06:17,830
So, it's something that we need to work with.

68
00:06:17,830 --> 00:06:25,370
We detected the SharePoint.com and we applied this technique of detection of these websites to detect this.

69
00:06:25,370 --> 00:06:27,010
So, we are going to spam code.

70
00:06:27,010 --> 00:06:33,290
We are going to detect these domains on this new creation based on SharePoint.com.

71
00:06:34,630 --> 00:06:38,810
It's not possible neither to detect these SharePoint domains based on reputation.

72
00:06:38,810 --> 00:06:46,390
We have been using Malvertise that is a well-known reputation site for checking the reputation of the sites.

73
00:06:46,390 --> 00:06:56,110
And we detected that the ones that have been already sending spam or sending users as a phishing was detected, was already detected as a SharePoint.com.

74
00:06:56,110 --> 00:07:01,230
However, the ones that are created but still not used wasn't found.

75
00:07:01,230 --> 00:07:07,130
So, we as a blue team, we need to be able to protect before the attack happens.

76
00:07:07,130 --> 00:07:12,150
And we thought, okay, let's do something by ourselves to check how to block it.

77
00:07:12,270 --> 00:07:23,230
So, what we do is we created a list of possible domains of our company or the company that you want, using typo-squaring, omission, bit-squaring, homoglyph.

78
00:07:23,230 --> 00:07:25,690
And then we found a pattern.

79
00:07:25,690 --> 00:07:30,890
We found a pattern that all the domains related to SharePoint have two answers.

80
00:07:30,890 --> 00:07:39,090
If the domain exists, then it has a 302 server direction answer and it's going to the login page of Azure.

81
00:07:39,110 --> 00:07:47,930
If the domain does not exist or is still not created by the attacker, then it's a 503 service available and we can detect it.

82
00:07:47,930 --> 00:07:49,370
So, why to do it manually?

83
00:07:49,370 --> 00:07:57,210
Let's automate the attack and then let's export it to a JSON or a CIF file in order to import into our systems.

84
00:07:57,210 --> 00:08:01,270
So, this is the idea of our tool, how to demonstrate these steps.

85
00:08:01,530 --> 00:08:05,790
And my colleague, Jose, will show you a little bit more about how to work with it.

86
00:08:05,950 --> 00:08:07,030
Here, guys.

87
00:08:07,190 --> 00:08:09,450
So, we are just leaving the presentation part.

88
00:08:09,450 --> 00:08:14,710
Let's go with the well-known part of this.

89
00:08:15,550 --> 00:08:18,370
What we're going to show you is how this tool is working.

90
00:08:18,370 --> 00:08:36,990
Francisco told us that we are going to create a number of well-known domain squatting techniques to create this list of potential domains that could be impersonating a company in the Microsoft infrastructure.

91
00:08:37,730 --> 00:08:41,590
So, with all this, we are working with our tool.

92
00:08:41,590 --> 00:08:47,010
These are all algorithms you can use.

93
00:08:47,010 --> 00:08:51,850
You can check by one single domain in the Microsoft infrastructure.

94
00:08:52,230 --> 00:08:59,310
You can also check for one single domain and start generating all possible domains.

95
00:08:59,650 --> 00:09:05,850
And you can also use a file with a list of domains that you want to monitor.

96
00:09:05,850 --> 00:09:11,550
It's just the same as a single domain, but you can do more bulky jobs with this.

97
00:09:11,550 --> 00:09:18,030
The rest of the arguments are just for helping you guys with a script.

98
00:09:18,070 --> 00:09:19,810
You can create a service.

99
00:09:19,810 --> 00:09:21,710
It's very service-friendly.

100
00:09:21,710 --> 00:09:23,570
You can create a cron job with all this.

101
00:09:23,950 --> 00:09:26,910
So, you are entering into business.

102
00:09:27,190 --> 00:09:33,370
You want to check for one single domain.

103
00:09:33,370 --> 00:09:35,230
This is the response it's giving you.

104
00:09:35,230 --> 00:09:36,410
The domain is up.

105
00:09:36,410 --> 00:09:42,990
But if you are trying for one single that we already know is not existing, it's not available.

106
00:09:43,250 --> 00:09:48,470
But if you take a closer look at this, this is one of the domains that is up.

107
00:09:48,650 --> 00:09:55,910
And since you are, of course, a Microsoft company, you need to monitor all this response.

108
00:09:56,270 --> 00:09:59,750
But, of course, if you want the full list, you can create this.

109
00:09:59,750 --> 00:10:12,010
And you can have some kind of verbose output and record the output on a file with a format in CEF format.

110
00:10:12,390 --> 00:10:22,070
So, this is where the script starts checking in Microsoft.com infrastructure what kind of domains are up and running.

111
00:10:22,070 --> 00:10:25,230
In the meantime, we are going to show you part of the code.

112
00:10:26,410 --> 00:10:31,410
This is where we are starting to do some tests in Microsoft infrastructure.

113
00:10:32,990 --> 00:10:39,930
Single domain is creating all domain squaring possible domains.

114
00:10:39,970 --> 00:10:49,550
And all these have been passed to the test on Microsoft function for every one instance in the list.

115
00:10:49,850 --> 00:10:54,630
With all this, we are just having the rest of the job is done.

116
00:10:56,110 --> 00:11:09,070
Just for letting you know what kind of technique we are registering, we are having, for instance here, all domain squatting being registered for keyboard typos.

117
00:11:09,070 --> 00:11:22,790
We are having here for bit squatting, homoglyph, because you are comparing every single letter in the language with similar ones that are likely to be used for impersonating the companies.

118
00:11:24,330 --> 00:11:30,670
And after this, as you can see on the left, you have the output of the file.

119
00:11:30,830 --> 00:11:42,630
You can see that you are having a very beautiful output for a CEF format that either Syslog or something can interpret.

120
00:11:42,630 --> 00:11:50,610
You can pass this to your CM tools and you can start monitoring this kind of domains.

121
00:11:52,030 --> 00:11:53,370
And that's all for the tool.

122
00:11:54,990 --> 00:12:01,870
After this, we are working to upload this tool on GitHub.

123
00:12:01,870 --> 00:12:07,110
This is the link where you have available the source code.

124
00:12:07,730 --> 00:12:10,370
And this is not the end of this project.

125
00:12:10,370 --> 00:12:14,630
We are working for, have a lot of work the next month.

126
00:12:14,630 --> 00:12:19,650
We would like to have some kind of automation for the domain takeover.

127
00:12:19,970 --> 00:12:32,490
We also want to convert it in a container to be published in Docker Hub, because we know there's a lot of blue team fellows that would like to have this in their Kubernetes.

128
00:12:32,490 --> 00:12:40,170
We also want to expand the tech in other domains in Azure, because it's not over with only a monitor SharePoint.

129
00:12:40,170 --> 00:12:44,990
We believe that there is more things to do in the Microsoft infrastructure.

130
00:12:46,030 --> 00:12:52,430
And very important, we should expand this to other big company clouds, such as Amazon or Google.

131
00:12:52,430 --> 00:13:03,410
We are looking for partners that will help us and will have our tool to monitor this kind of impersonations.

132
00:13:03,850 --> 00:13:11,710
We also would like to hear your voice and know what kind of other output would be fine for this tool.

133
00:13:12,070 --> 00:13:15,170
And every idea is welcome.

134
00:13:15,170 --> 00:13:18,850
And also, why not check reputation and abuse public databases?

135
00:13:18,850 --> 00:13:27,890
Because we would like to help these public databases to create more information.

136
00:13:27,890 --> 00:13:42,670
When we detect one of our domain detected, it could be nice to be reported automatically if we check that something is wrong, something is trying to harm our company.

137
00:13:42,670 --> 00:13:47,330
Prior, because keep in mind that this is just anticipation.

138
00:13:47,330 --> 00:13:48,870
There is no attack yet.

139
00:13:48,870 --> 00:13:55,630
We are just covering the potential attackers in domain squad.

140
00:13:56,370 --> 00:14:00,090
And after this, I believe we are done.

141
00:14:01,830 --> 00:14:03,330
Any questions?

142
00:14:03,330 --> 00:14:05,210
Thank you for your time.

143
00:14:05,670 --> 00:14:09,750
We know it's for you guys Saturday morning.

144
00:14:09,750 --> 00:14:14,530
You have still a long way today in Blue Team Village.

145
00:14:14,650 --> 00:14:18,250
I hope you enjoy our talk and our tool.

146
00:14:18,250 --> 00:14:22,970
You can also access to the GitHub and start using it in your companies.

147
00:14:22,970 --> 00:14:27,710
If you want to talk to us, here you have our Twitter.

148
00:14:27,710 --> 00:14:30,950
You can also contact us in our GitHub.

149
00:14:31,570 --> 00:14:35,350
And we are welcome for any suggestions or help.

150
00:14:35,350 --> 00:14:37,910
So still, thank you guys.

151
00:14:37,910 --> 00:14:38,750
Thank you very much.

152
00:14:38,750 --> 00:14:40,110
And any questions?

153
00:14:40,110 --> 00:14:41,590
I don't have any questions, yeah.

154
00:14:47,240 --> 00:14:50,180
Yeah, we are seeing the link is not available.

155
00:14:51,340 --> 00:14:55,520
We are deploying the code after this talk.

156
00:14:55,660 --> 00:15:00,120
Because we did not want to, because, you know, this is a...

157
00:15:00,120 --> 00:15:09,640
We are in a cloud, so we would like to have this working up and running right before this talk.

158
00:15:09,640 --> 00:15:11,960
So now we are going to deploy this code.

159
00:15:11,960 --> 00:15:17,460
Yeah, on the next day you will have available on this GitHub the full code.

160
00:15:17,460 --> 00:15:18,540
So don't worry.

161
00:15:18,540 --> 00:15:22,620
It will be not later than Monday, okay?

162
00:15:25,740 --> 00:15:29,860
Is there any kind of throttling you ran into with the tool like with others?

163
00:15:30,720 --> 00:15:31,960
No, I believe not.

164
00:15:31,960 --> 00:15:34,380
We did not have any throttling.

165
00:15:35,100 --> 00:15:37,800
The thing is we were...

166
00:15:39,280 --> 00:15:52,480
The very first step was like we were attacking a lot Microsoft infrastructure because we were throwing a lot of requests, you know.

167
00:15:52,680 --> 00:15:58,960
So far, we've been only detecting without any issues.

168
00:15:58,960 --> 00:16:04,860
And every single domain is what we detected, and it was not fine for us.

169
00:16:04,860 --> 00:16:06,920
It had been reported to Microsoft.

170
00:16:07,740 --> 00:16:12,080
Yeah, this is answering the question if we have been contacting with Microsoft.

171
00:16:12,080 --> 00:16:20,180
We are contacting with Microsoft each time that we detect a fake report or a fake domain.

172
00:16:20,180 --> 00:16:22,200
We are reporting it to abuse.

173
00:16:23,120 --> 00:16:30,820
You know all these abuse websites that request thousands of data from the information.

174
00:16:30,820 --> 00:16:36,060
So we need something more agile in order to protect our infrastructure.

175
00:16:36,060 --> 00:16:40,340
So we always report this kind of active domains.

176
00:16:40,340 --> 00:16:45,300
But before the attack, we're importing it into our solution.

177
00:16:45,300 --> 00:16:49,800
But yes, we are contacting Microsoft reporting these domains.

178
00:16:52,140 --> 00:17:04,160
Yes, for Cyborg42 is asking, can the tool be used to generate a list of type of squatting domains in JSON XML format which can be imported into ELQ or Splunk?

179
00:17:04,160 --> 00:17:06,510
The answer is yes, you can.

180
00:17:06,820 --> 00:17:14,420
Well, and yes and no, because you can create a list of detected, generated and detected domains.

181
00:17:14,420 --> 00:17:26,320
But for the part that is a list of type of squatting domains not being detected, there are already several tools in the wild that you can use for your own purpose.

182
00:17:26,320 --> 00:17:36,160
But if you are looking for a JSON well-formatted file that includes all detected domains in the Microsoft infrastructure, yes.

183
00:17:36,160 --> 00:17:40,360
It's one of the outputs allowed by our tool.

184
00:17:48,150 --> 00:17:48,970
Yeah, we see.

185
00:17:48,970 --> 00:17:50,670
Yeah, thank you for the offer.

186
00:17:50,790 --> 00:17:52,290
You work in...

187
00:17:52,290 --> 00:17:53,110
In Azure.

188
00:17:53,110 --> 00:17:56,330
Yeah, if you need something smart, just let us know.

189
00:17:56,330 --> 00:18:00,490
You have our contact, so feel free to reach us, okay?

190
00:18:00,490 --> 00:18:01,230
Thanks.

191
00:18:05,090 --> 00:18:06,430
Any other questions, guys?

192
00:18:14,420 --> 00:18:15,780
I think that's all.

193
00:18:15,780 --> 00:18:17,820
We solved all the questions on each other, right?

194
00:18:20,620 --> 00:18:21,500
Yeah.

195
00:18:21,540 --> 00:18:22,460
All right.

196
00:18:22,460 --> 00:18:27,440
Thank you for your time, then, and continue with the plan on DEFCON Blue Team.

197
00:18:27,900 --> 00:18:31,060
It's a lot of information and a lot of good values there.

198
00:18:31,060 --> 00:18:35,120
So, thank you for this time and thank you for your good feedback about the talk.