Hello, everyone. My name is Paramarket and I welcome you to O365 Squatting.
If you are not already joined in the Discord chat, please go to the BlueTeamVillage.org website, click on the Discord link and join.
Please give a warm welcome to Juan Francisco and Jose Miguel.
Thank you. Thank you. Thank you very much. Thank you for coming to this virtual talk.
We're going to talk about the tool that we have developed, O365 Squatting, but we are going to make a very brief introduction.
I'm working, I'm Juan Francisco Bolivar, working as a manager on IT security in a pharma company.
I have been working during the last years in security. I have published a book and I am also collaborating with 11Paths as chief security envoy.
Hey, guys. This is Jose Miguel Gomez. I've been working in security from the very beginning in my working life.
I've been, my main role has been IT security analyst.
Nowadays, I'm working in a pharma sector company, but I am also a researcher and cybersecurity enthusiast.
I've been working with several multinational enterprise companies, assisting and helping them to do a more secure company.
And also, I've been studying for a more red team acknowledged as OSCP and OSCE.
So, let's start with the real part. The challenge in Azure.
Of course, all of us know that Azure and the cloud in general, it's helping all of us and also the IT people to create easy services and domains.
So, there is a clear benefit.
However, the attacker has also a really good benefit.
When you create an account on Azure, you have associated a domain on Microsoft.com for your account.
So, you are getting a Microsoft domain for you.
And this is something that we are going to see during this speak.
That is something that attackers are going to exploit.
This research and this tool has been performing our experience and the cases that we are seeing every day coming from the attackers.
So, what is going on with the Microsoft domain?
When you create, let's say, an account called DEF CON with this three and an O in the middle on Azure,
you are automatically granted on Microsoft domain dot your username.
So, if you try to find what is on the DNS, how is it resolved?
It is resolved directly to the Azure DNS.
And, of course, the whois is talking about is part of the Microsoft.
So, it's a good starting point that we are being able to have domain on Microsoft.
So, what is the problem?
The problem is that you can use this domain in order to create exchange servers.
And, of course, the hackers and the attackers are going to be using this technique.
This technique will allow you to see a kind of image like this.
We have seen that it was requesting some payments and was coming from a Microsoft domain.
Of course, the first idea of a blue teamer is, okay, let's block that domain.
But it's not a really good idea to block a Microsoft domain.
It will have a lot of impact into your infrastructure and to real emails.
So, other of the problems is below, beyond this small black box,
the attacker was trying also to create confusion, creating similar domains to the original one.
So, it was increasing the problem for the users to identify these emails.
So, we were finding, we encountered a problem and we tried to find a solution.
We started to analyze the headers.
Of course, all the headers are gaming from old look domains and protection old look domains.
So, everything looks good, good that is coming from Microsoft.
We analyzed one of the IP addresses and, of course, was belonging to Microsoft domain.
So, we cannot block it neither because it was part of the old look infrastructure
and it will, again, have a lot of impact on our users.
Also, part of the header was the message ID.
Again, pointing to old look domains and also we were considering the SPF part.
The SPF part was not working mainly because Microsoft has configured to none
and none is equal to neutral.
What it will not block by using this protection, the receiving of emails.
There is other headers like transport or anti-spam mailbox and anti-spam message.
So, a lot of protections are there.
So, we were finding a problem.
We are creating, attackers are creating domains on Microsoft and using it to send it to spam
but we are not able to detect it.
So, something that we detect is as soon as you create an account,
not only the Microsoft account or domain is created,
it's also creating automatically a SharePoint site with your name following this pattern.
So, if the original one is the first, the attackers will be going to start to create
all these similar typosquatting attacks related with on Microsoft.
So, what is the case?
We need to be able to detect these domains and we need to be able to block it.
We are not able to do it with on Microsoft because it's not creating a real website.
It's only on the Azure DNS. It's not in the public DNSs.
So, it's something that we need to work with.
We detected the SharePoint.com and we applied this technique of detection of these websites to detect this.
So, we are going to spam code.
We are going to detect these domains on this new creation based on SharePoint.com.
It's not possible neither to detect these SharePoint domains based on reputation.
We have been using Malvertise that is a well-known reputation site for checking the reputation of the sites.
And we detected that the ones that have been already sending spam or sending users as a phishing was detected,
was already detected as a SharePoint.com.
However, the ones that are created but still not used wasn't found.
So, we as a blue team, we need to be able to protect before the attack happens.
And we thought, okay, let's do something by ourselves to check how to block it.
So, what we do is we created a list of possible domains of our company or the company that you want,
using typo-squaring, omission, bit-squaring, homoglyph.
And then we found a pattern.
We found a pattern that all the domains related to SharePoint have two answers.
If the domain exists, then it has a 302 server direction answer
and it's going to the login page of Azure.
If the domain does not exist or is still not created by the attacker,
then it's a 503 service available and we can detect it.
So, why to do it manually?
Let's automate the attack and then let's export it to a JSON or a CIF file in order to import into our systems.
So, this is the idea of our tool, how to demonstrate these steps.
And my colleague, Jose, will show you a little bit more about how to work with it.
Here, guys.
So, we are just leaving the presentation part.
Let's go with the well-known part of this.
What we're going to show you is how this tool is working.
Francisco told us that we are going to create a number of well-known domain squatting techniques
to create this list of potential domains that could be impersonating a company in the Microsoft infrastructure.
So, with all this, we are working with our tool.
These are all algorithms you can use.
You can check by one single domain in the Microsoft infrastructure.
You can also check for one single domain and start generating all possible domains.
And you can also use a file with a list of domains that you want to monitor.
It's just the same as a single domain, but you can do more bulky jobs with this.
The rest of the arguments are just for helping you guys with a script.
You can create a service.
It's very service-friendly.
You can create a cron job with all this.
So, you are entering into business.
You want to check for one single domain.
This is the response it's giving you.
The domain is up.
But if you are trying for one single that we already know is not existing, it's not available.
But if you take a closer look at this, this is one of the domains that is up.
And since you are, of course, a Microsoft company, you need to monitor all this response.
But, of course, if you want the full list, you can create this.
And you can have some kind of verbose output and record the output on a file with a format in CEF format.
So, this is where the script starts checking in Microsoft.com infrastructure what kind of domains are up and running.
In the meantime, we are going to show you part of the code.
This is where we are starting to do some tests in Microsoft infrastructure.
Single domain is creating all domain squaring possible domains.
And all these have been passed to the test on Microsoft function for every one instance in the list.
With all this, we are just having the rest of the job is done.
Just for letting you know what kind of technique we are registering, we are having, for instance here, all domain squatting being registered for keyboard typos.
We are having here for bit squatting, homoglyph, because you are comparing every single letter in the language with similar ones that are likely to be used for impersonating the companies.
And after this, as you can see on the left, you have the output of the file.
You can see that you are having a very beautiful output for a CEF format that either Syslog or something can interpret.
You can pass this to your CM tools and you can start monitoring this kind of domains.
And that's all for the tool.
After this, we are working to upload this tool on GitHub.
This is the link where you have available the source code.
And this is not the end of this project.
We are working for, have a lot of work the next month.
We would like to have some kind of automation for the domain takeover.
We also want to convert it in a container to be published in Docker Hub, because we know there's a lot of blue team fellows that would like to have this in their Kubernetes.
We also want to expand the tech in other domains in Azure, because it's not over with only a monitor SharePoint.
We believe that there is more things to do in the Microsoft infrastructure.
And very important, we should expand this to other big company clouds, such as Amazon or Google.
We are looking for partners that will help us and will have our tool to monitor this kind of impersonations.
We also would like to hear your voice and know what kind of other output would be fine for this tool.
And every idea is welcome.
And also, why not check reputation and abuse public databases?
Because we would like to help these public databases to create more information.
When we detect one of our domain detected, it could be nice to be reported automatically if we check that something is wrong, something is trying to harm our company.
Prior, because keep in mind that this is just anticipation.
There is no attack yet.
We are just covering the potential attackers in domain squad.
And after this, I believe we are done.
Any questions? Thank you for your time.
We know it's for you guys Saturday morning.
You have still a long way today in Blue Team Village.
I hope you enjoy our talk and our tool.
You can also access to the GitHub and start using it in your companies.
If you want to talk to us, here you have our Twitter.
You can also contact us in our GitHub.
And we are welcome for any suggestions or help.
So still, thank you guys.
Thank you very much.
And any questions?
I don't have any questions, yeah.
Yeah, we are seeing the link is not available.
We are deploying the code after this talk.
Because we did not want to, because, you know, this is a...
We are in a cloud, so we would like to have this working up and running right before this talk.
So now we are going to deploy this code.
Yeah, on the next day you will have available on this GitHub the full code.
So don't worry.
It will be not later than Monday, okay?
Is there any kind of throttling you ran into with the tool like with others?
No, I believe not.
We did not have any throttling.
The thing is we were...
The very first step was like we were attacking a lot Microsoft infrastructure because we were throwing a lot of requests, you know.
So far, we've been only detecting without any issues.
And every single domain is what we detected, and it was not fine for us.
It had been reported to Microsoft.
Yeah, this is answering the question if we have been contacting with Microsoft.
We are contacting with Microsoft each time that we detect a fake report or a fake domain.
We are reporting it to abuse.
You know all these abuse websites that request thousands of data from the information.
So we need something more agile in order to protect our infrastructure.
So we always report this kind of active domains.
But before the attack, we're importing it into our solution.
But yes, we are contacting Microsoft reporting these domains.
Yes, for Cyborg42 is asking, can the tool be used to generate a list of type of squatting domains in JSON XML format which can be imported into ELQ or Splunk?
The answer is yes, you can.
Well, and yes and no, because you can create a list of detected, generated and detected domains.
But for the part that is a list of type of squatting domains not being detected, there are already several tools in the wild that you can use for your own purpose.
But if you are looking for a JSON well-formatted file that includes all detected domains in the Microsoft infrastructure, yes.
It's one of the outputs allowed by our tool.
Yeah, we see.
Yeah, thank you for the offer. You work in...
In Azure.
Yeah, if you need something smart, just let us know. You have our contact, so feel free to reach us, okay? Thanks.
Any other questions, guys?
I think that's all. We solved all the questions on each other, right?
Yeah.
All right.
Thank you for your time, then, and continue with the plan on DEFCON Blue Team. It's a lot of information and a lot of good values there.
So, thank you for this time and thank you for your good feedback about the talk.