start	end	text
14180	19700	Hello, everyone. My name is Paramarket and I welcome you to O365 Squatting.
19700	27400	If you are not already joined in the Discord chat, please go to the BlueTeamVillage.org website, click on the Discord link and join.
27400	31340	Please give a warm welcome to Juan Francisco and Jose Miguel.
36230	41710	Thank you. Thank you. Thank you very much. Thank you for coming to this virtual talk.
41710	50710	We're going to talk about the tool that we have developed, O365 Squatting, but we are going to make a very brief introduction.
50790	56350	I'm working, I'm Juan Francisco Bolivar, working as a manager on IT security in a pharma company.
56350	67110	I have been working during the last years in security. I have published a book and I am also collaborating with 11Paths as chief security envoy.
67110	76630	Hey, guys. This is Jose Miguel Gomez. I've been working in security from the very beginning in my working life.
76630	81070	I've been, my main role has been IT security analyst.
81150	88070	Nowadays, I'm working in a pharma sector company, but I am also a researcher and cybersecurity enthusiast.
88150	97090	I've been working with several multinational enterprise companies, assisting and helping them to do a more secure company.
97810	105550	And also, I've been studying for a more red team acknowledged as OSCP and OSCE.
106550	111870	So, let's start with the real part. The challenge in Azure.
111870	123090	Of course, all of us know that Azure and the cloud in general, it's helping all of us and also the IT people to create easy services and domains.
123090	124810	So, there is a clear benefit.
124810	128610	However, the attacker has also a really good benefit.
128610	139790	When you create an account on Azure, you have associated a domain on Microsoft.com for your account.
139790	143450	So, you are getting a Microsoft domain for you.
143450	146810	And this is something that we are going to see during this speak.
146810	149910	That is something that attackers are going to exploit.
149910	159550	This research and this tool has been performing our experience and the cases that we are seeing every day coming from the attackers.
159550	163490	So, what is going on with the Microsoft domain?
163490	170090	When you create, let's say, an account called DEF CON with this three and an O in the middle on Azure,
170090	177950	you are automatically granted on Microsoft domain dot your username.
177950	184270	So, if you try to find what is on the DNS, how is it resolved?
184270	187390	It is resolved directly to the Azure DNS.
187790	192490	And, of course, the whois is talking about is part of the Microsoft.
192490	199290	So, it's a good starting point that we are being able to have domain on Microsoft.
199670	201510	So, what is the problem?
201510	207630	The problem is that you can use this domain in order to create exchange servers.
207630	212750	And, of course, the hackers and the attackers are going to be using this technique.
212750	218050	This technique will allow you to see a kind of image like this.
218050	223870	We have seen that it was requesting some payments and was coming from a Microsoft domain.
223870	227790	Of course, the first idea of a blue teamer is, okay, let's block that domain.
227790	231810	But it's not a really good idea to block a Microsoft domain.
231810	236430	It will have a lot of impact into your infrastructure and to real emails.
236430	241890	So, other of the problems is below, beyond this small black box,
241890	249350	the attacker was trying also to create confusion, creating similar domains to the original one.
249350	254690	So, it was increasing the problem for the users to identify these emails.
254690	260730	So, we were finding, we encountered a problem and we tried to find a solution.
261030	263010	We started to analyze the headers.
263010	268590	Of course, all the headers are gaming from old look domains and protection old look domains.
268590	273390	So, everything looks good, good that is coming from Microsoft.
273390	278490	We analyzed one of the IP addresses and, of course, was belonging to Microsoft domain.
278490	284070	So, we cannot block it neither because it was part of the old look infrastructure
284070	288110	and it will, again, have a lot of impact on our users.
289170	293890	Also, part of the header was the message ID.
293890	299610	Again, pointing to old look domains and also we were considering the SPF part.
299610	304350	The SPF part was not working mainly because Microsoft has configured to none
304350	307030	and none is equal to neutral.
307030	312930	What it will not block by using this protection, the receiving of emails.
312930	320210	There is other headers like transport or anti-spam mailbox and anti-spam message.
320210	322430	So, a lot of protections are there.
323710	326130	So, we were finding a problem.
326130	331050	We are creating, attackers are creating domains on Microsoft and using it to send it to spam
331050	333070	but we are not able to detect it.
333070	337950	So, something that we detect is as soon as you create an account,
337950	342050	not only the Microsoft account or domain is created,
342050	347890	it's also creating automatically a SharePoint site with your name following this pattern.
347890	352390	So, if the original one is the first, the attackers will be going to start to create
352390	357130	all these similar typosquatting attacks related with on Microsoft.
357130	358870	So, what is the case?
358870	365210	We need to be able to detect these domains and we need to be able to block it.
365250	371010	We are not able to do it with on Microsoft because it's not creating a real website.
371010	374750	It's only on the Azure DNS. It's not in the public DNSs.
375270	377830	So, it's something that we need to work with.
377830	385370	We detected the SharePoint.com and we applied this technique of detection of these websites to detect this.
385370	387010	So, we are going to spam code.
387010	393290	We are going to detect these domains on this new creation based on SharePoint.com.
394630	398810	It's not possible neither to detect these SharePoint domains based on reputation.
398810	406390	We have been using Malvertise that is a well-known reputation site for checking the reputation of the sites.
406390	413550	And we detected that the ones that have been already sending spam or sending users as a phishing was detected,
413550	416110	was already detected as a SharePoint.com.
416110	421230	However, the ones that are created but still not used wasn't found.
421230	427130	So, we as a blue team, we need to be able to protect before the attack happens.
427130	432150	And we thought, okay, let's do something by ourselves to check how to block it.
432270	439470	So, what we do is we created a list of possible domains of our company or the company that you want,
439470	443230	using typo-squaring, omission, bit-squaring, homoglyph.
443230	445690	And then we found a pattern.
445690	450890	We found a pattern that all the domains related to SharePoint have two answers.
450890	456210	If the domain exists, then it has a 302 server direction answer
456210	459090	and it's going to the login page of Azure.
459110	463270	If the domain does not exist or is still not created by the attacker,
463270	467930	then it's a 503 service available and we can detect it.
467930	469370	So, why to do it manually?
469370	477210	Let's automate the attack and then let's export it to a JSON or a CIF file in order to import into our systems.
477210	481270	So, this is the idea of our tool, how to demonstrate these steps.
481530	485790	And my colleague, Jose, will show you a little bit more about how to work with it.
485950	487030	Here, guys.
487190	489450	So, we are just leaving the presentation part.
489450	494710	Let's go with the well-known part of this.
495550	498370	What we're going to show you is how this tool is working.
498370	509250	Francisco told us that we are going to create a number of well-known domain squatting techniques
509250	516990	to create this list of potential domains that could be impersonating a company in the Microsoft infrastructure.
517730	521590	So, with all this, we are working with our tool.
521590	527010	These are all algorithms you can use.
527010	531850	You can check by one single domain in the Microsoft infrastructure.
532230	539310	You can also check for one single domain and start generating all possible domains.
539650	545850	And you can also use a file with a list of domains that you want to monitor.
545850	551550	It's just the same as a single domain, but you can do more bulky jobs with this.
551550	558030	The rest of the arguments are just for helping you guys with a script.
558070	559810	You can create a service.
559810	561710	It's very service-friendly.
561710	563570	You can create a cron job with all this.
563950	566910	So, you are entering into business.
567190	573370	You want to check for one single domain.
573370	575230	This is the response it's giving you.
575230	576410	The domain is up.
576410	582990	But if you are trying for one single that we already know is not existing, it's not available.
583250	588470	But if you take a closer look at this, this is one of the domains that is up.
588650	595910	And since you are, of course, a Microsoft company, you need to monitor all this response.
596270	599750	But, of course, if you want the full list, you can create this.
599750	612010	And you can have some kind of verbose output and record the output on a file with a format in CEF format.
612390	622070	So, this is where the script starts checking in Microsoft.com infrastructure what kind of domains are up and running.
622070	625230	In the meantime, we are going to show you part of the code.
626410	631410	This is where we are starting to do some tests in Microsoft infrastructure.
632990	639930	Single domain is creating all domain squaring possible domains.
639970	649550	And all these have been passed to the test on Microsoft function for every one instance in the list.
649850	654630	With all this, we are just having the rest of the job is done.
656110	669070	Just for letting you know what kind of technique we are registering, we are having, for instance here, all domain squatting being registered for keyboard typos.
669070	682790	We are having here for bit squatting, homoglyph, because you are comparing every single letter in the language with similar ones that are likely to be used for impersonating the companies.
684330	690670	And after this, as you can see on the left, you have the output of the file.
690830	702630	You can see that you are having a very beautiful output for a CEF format that either Syslog or something can interpret.
702630	710610	You can pass this to your CM tools and you can start monitoring this kind of domains.
712030	713370	And that's all for the tool.
714990	721870	After this, we are working to upload this tool on GitHub.
721870	727110	This is the link where you have available the source code.
727730	730370	And this is not the end of this project.
730370	734630	We are working for, have a lot of work the next month.
734630	739650	We would like to have some kind of automation for the domain takeover.
739970	752490	We also want to convert it in a container to be published in Docker Hub, because we know there's a lot of blue team fellows that would like to have this in their Kubernetes.
752490	760170	We also want to expand the tech in other domains in Azure, because it's not over with only a monitor SharePoint.
760170	764990	We believe that there is more things to do in the Microsoft infrastructure.
766030	772430	And very important, we should expand this to other big company clouds, such as Amazon or Google.
772430	783410	We are looking for partners that will help us and will have our tool to monitor this kind of impersonations.
783850	791710	We also would like to hear your voice and know what kind of other output would be fine for this tool.
792070	795170	And every idea is welcome.
795170	798850	And also, why not check reputation and abuse public databases?
798850	807890	Because we would like to help these public databases to create more information.
807890	822670	When we detect one of our domain detected, it could be nice to be reported automatically if we check that something is wrong, something is trying to harm our company.
822670	827330	Prior, because keep in mind that this is just anticipation.
827330	828870	There is no attack yet.
828870	835630	We are just covering the potential attackers in domain squad.
836370	840090	And after this, I believe we are done.
841830	845210	Any questions? Thank you for your time.
845670	849750	We know it's for you guys Saturday morning.
849750	854530	You have still a long way today in Blue Team Village.
854650	858250	I hope you enjoy our talk and our tool.
858250	862970	You can also access to the GitHub and start using it in your companies.
862970	867710	If you want to talk to us, here you have our Twitter.
867710	870950	You can also contact us in our GitHub.
871570	875350	And we are welcome for any suggestions or help.
875350	877910	So still, thank you guys.
877910	878750	Thank you very much.
878750	880110	And any questions?
880110	881590	I don't have any questions, yeah.
887240	890180	Yeah, we are seeing the link is not available.
891340	895520	We are deploying the code after this talk.
895660	900120	Because we did not want to, because, you know, this is a...
900120	909640	We are in a cloud, so we would like to have this working up and running right before this talk.
909640	911960	So now we are going to deploy this code.
911960	917460	Yeah, on the next day you will have available on this GitHub the full code.
917460	918540	So don't worry.
918540	922620	It will be not later than Monday, okay?
925740	929860	Is there any kind of throttling you ran into with the tool like with others?
930720	931960	No, I believe not.
931960	934380	We did not have any throttling.
935100	937800	The thing is we were...
939280	952480	The very first step was like we were attacking a lot Microsoft infrastructure because we were throwing a lot of requests, you know.
952680	958960	So far, we've been only detecting without any issues.
958960	964860	And every single domain is what we detected, and it was not fine for us.
964860	966920	It had been reported to Microsoft.
967740	972080	Yeah, this is answering the question if we have been contacting with Microsoft.
972080	980180	We are contacting with Microsoft each time that we detect a fake report or a fake domain.
980180	982200	We are reporting it to abuse.
983120	990820	You know all these abuse websites that request thousands of data from the information.
990820	996060	So we need something more agile in order to protect our infrastructure.
996060	1000340	So we always report this kind of active domains.
1000340	1005300	But before the attack, we're importing it into our solution.
1005300	1009800	But yes, we are contacting Microsoft reporting these domains.
1012140	1024160	Yes, for Cyborg42 is asking, can the tool be used to generate a list of type of squatting domains in JSON XML format which can be imported into ELQ or Splunk?
1024160	1026510	The answer is yes, you can.
1026820	1034420	Well, and yes and no, because you can create a list of detected, generated and detected domains.
1034420	1046320	But for the part that is a list of type of squatting domains not being detected, there are already several tools in the wild that you can use for your own purpose.
1046320	1056160	But if you are looking for a JSON well-formatted file that includes all detected domains in the Microsoft infrastructure, yes.
1056160	1060360	It's one of the outputs allowed by our tool.
1068150	1068970	Yeah, we see.
1068970	1072290	Yeah, thank you for the offer. You work in...
1072290	1073110	In Azure.
1073110	1081230	Yeah, if you need something smart, just let us know. You have our contact, so feel free to reach us, okay? Thanks.
1085090	1086430	Any other questions, guys?
1094420	1097820	I think that's all. We solved all the questions on each other, right?
1100620	1101500	Yeah.
1101540	1102460	All right.
1102460	1111060	Thank you for your time, then, and continue with the plan on DEFCON Blue Team. It's a lot of information and a lot of good values there.
1111060	1115120	So, thank you for this time and thank you for your good feedback about the talk.