1 00:00:00,000 --> 00:00:02,680 How we hack their C2s. 2 00:00:03,760 --> 00:00:07,720 Our presentation will have three parts. 3 00:00:08,120 --> 00:00:14,240 First, we will introduce ourselves, our work and basic knowledge about Android. 4 00:00:14,240 --> 00:00:19,680 Second, we will introduce Android malware scenes and analysis of some families. 5 00:00:20,100 --> 00:00:24,300 Third, we will look at how we exploit C2s. 6 00:00:25,800 --> 00:00:28,980 I am Kursat and my co-speaker is Mert. 7 00:00:28,980 --> 00:00:32,680 We both security engineers at Trendule and Blackbox Security. 8 00:00:34,500 --> 00:00:38,580 We are finding Android malware samples and analyze them. 9 00:00:38,580 --> 00:00:42,100 We find IOCs and hack them to purge stolen data. 10 00:00:45,040 --> 00:00:47,780 Now let's look at Google Play Store. 11 00:00:47,780 --> 00:00:52,780 To fight Android malware, Google introduced Bonsur as an anti-malware tool. 12 00:00:52,780 --> 00:00:57,100 But it has distinct feature and you can easily detect it. 13 00:00:57,860 --> 00:01:03,400 When you upload your APK file, it uploads it to an emulator. 14 00:01:03,400 --> 00:01:07,180 This emulator has only one contact to photos. 15 00:01:07,180 --> 00:01:12,740 You can also detect Bonsur IP range while it's running your APK with you. 16 00:01:12,740 --> 00:01:16,740 You can also use it to evade Bonsur. 17 00:01:19,380 --> 00:01:24,560 Because you can detect its feature, you can use different techniques to bypass it. 18 00:01:24,560 --> 00:01:30,760 Implementing anti-analyze and anti-emulator techniques is just some examples of it. 19 00:01:30,780 --> 00:01:36,840 You can also download your malicious text file separately and load into your APK. 20 00:01:36,840 --> 00:01:41,320 With this, Bonsur can't even see your malicious code. 21 00:01:44,290 --> 00:01:47,710 Android was by design not that secure back then. 22 00:01:47,710 --> 00:01:51,670 But nowadays, they are implementing new features to harden it. 23 00:01:51,670 --> 00:01:57,910 With Android P, battery encryption, process isolation, and authentication is implemented. 24 00:01:57,910 --> 00:01:59,310 Not just that. 25 00:01:59,310 --> 00:02:06,010 But Google Play Store changed its rules to prevent SMS and call log permission to be used in apps. 26 00:02:07,790 --> 00:02:11,630 With Android Q, even more hardening is introduced. 27 00:02:12,010 --> 00:02:17,730 Android Q removed clipboard monitoring, background activity, and limited screen recording. 28 00:02:17,730 --> 00:02:22,970 It also restricts Bubble's API, which is commonly used for phishing by its adapters. 29 00:02:22,970 --> 00:02:29,310 Also, Google introduced AppDefense Alliance to combat malware in Google Play Store. 30 00:02:29,310 --> 00:02:33,550 Alliance itself includes companies which specialize in mobile malware. 31 00:02:37,210 --> 00:02:39,890 Let's look at Android malware scene. 32 00:02:39,890 --> 00:02:43,010 There are five types of malware common in Android. 33 00:02:43,010 --> 00:02:44,690 First is AdWare. 34 00:02:44,690 --> 00:02:48,190 It shows your open advertisement in a hidden manner. 35 00:02:48,190 --> 00:02:49,750 Second is Spyware. 36 00:02:49,750 --> 00:02:55,010 Spyware commonly steals personal information in order to sell it. 37 00:02:55,210 --> 00:02:56,810 Third is Trojan. 38 00:02:56,810 --> 00:03:00,730 They are commonly used to steal banking information. 39 00:03:00,730 --> 00:03:02,450 Fourth is Ransomware. 40 00:03:02,450 --> 00:03:07,390 They are commonly used as a feature in bank bots nowadays. 41 00:03:07,390 --> 00:03:12,630 When you try to remove malware, it activates Ransomware feature. 42 00:03:12,690 --> 00:03:15,090 And lastly, Crypto Miners. 43 00:03:15,090 --> 00:03:28,370 They were common back then, but nowadays, due to some restrictions, like background activities, are no longer a thing in Android's operating system. 44 00:03:28,370 --> 00:03:30,810 They are decreasing. 45 00:03:31,430 --> 00:03:36,830 Threat actors usually tip companies through social media advertisements to separate malware. 46 00:03:39,910 --> 00:03:43,090 There is also malware as a service malware. 47 00:03:43,090 --> 00:03:47,130 At first, there was GMBot, which espies Marcher. 48 00:03:47,130 --> 00:03:53,210 After Marcher, Exabot emerges and it evolves into a Red Alert. 49 00:03:53,210 --> 00:03:57,970 Red Alert has distinct features which also carry on to anomalies. 50 00:03:57,970 --> 00:04:03,630 Nowadays, serverless malware is active and popular as a service scene. 51 00:04:03,630 --> 00:04:07,290 They evolve in time as threat actors change. 52 00:04:07,290 --> 00:04:10,970 They all use anti-techniques and droppers. 53 00:04:13,970 --> 00:04:19,710 Exabot uses dropper to distribute itself in Google Play Store. 54 00:04:21,090 --> 00:04:29,730 It also uses root detection and anti-monitor with checking device ID, country, and operator in device. 55 00:04:29,730 --> 00:04:37,670 It also tries to run shell command to find sub-binary which is present when the device is rooted. 56 00:04:40,720 --> 00:04:44,060 You can see what Exabot looks for in settings. 57 00:04:46,200 --> 00:04:50,600 You can bypass anti-monitor with filter like this. 58 00:04:51,240 --> 00:04:54,920 And root detection like this. 59 00:04:55,560 --> 00:04:57,980 Red Alert uses Twitter for C2. 60 00:04:57,980 --> 00:05:00,640 The last tweet contains IP of C2. 61 00:05:00,640 --> 00:05:08,320 It fakes last tweet to find out current C2 and upload the data it stolen there. 62 00:05:11,660 --> 00:05:15,860 It asks for device admin permission to take over poll. 63 00:05:18,940 --> 00:05:23,360 It also checks Linux apps to look for specific apps. 64 00:05:25,700 --> 00:05:27,980 Anubis is a good bankbot example. 65 00:05:27,980 --> 00:05:30,060 It operates as a service. 66 00:05:30,060 --> 00:05:35,980 It has multiple versions which legend has multiple different developers. 67 00:05:37,620 --> 00:05:43,220 It uses fake apps and phishing campaigns to distribute samples. 68 00:05:43,300 --> 00:05:46,840 These are all Turkish bank or popular applications. 69 00:05:50,040 --> 00:05:52,720 It also uses dropper. 70 00:05:54,260 --> 00:05:57,880 And uses obfuscation in dropper sample. 71 00:06:00,400 --> 00:06:03,360 Dropper Anubis samples is encrypted. 72 00:06:05,540 --> 00:06:11,480 Once you decrypt it, you can see it uses call forwarding for bank numbers. 73 00:06:14,490 --> 00:06:17,970 And it uses overlay attack to steal banking credentials. 74 00:06:18,710 --> 00:06:22,270 If you try remove it, ransomware feature activates. 75 00:06:25,750 --> 00:06:31,250 Anubis decrypts inside memory and writes decrypted code to a jar file. 76 00:06:31,250 --> 00:06:36,670 After that, it loads jar file into inside which contains malicious function. 77 00:06:37,010 --> 00:06:43,390 This FIRA script changes delete function so that you can fetch decrypted file from device. 78 00:06:43,390 --> 00:06:46,670 You can fetch decrypted code like this. 79 00:06:48,870 --> 00:06:51,960 And like this if native code is used. 80 00:06:54,120 --> 00:06:56,300 Hydra Hydra is another service. 81 00:06:56,300 --> 00:06:59,740 It imitates government apps to distribute itself. 82 00:07:01,750 --> 00:07:07,190 Once you create Hydra sample in panel, it has time limit to activate. 83 00:07:07,190 --> 00:07:09,470 Like some step to finish time. 84 00:07:09,470 --> 00:07:14,530 It uses overlay attack to steal banking and other personal information. 85 00:07:17,280 --> 00:07:20,540 You can bypass time limitation like this. 86 00:07:21,560 --> 00:07:27,200 And like this if native code is used. 87 00:07:27,960 --> 00:07:33,100 Cerberus is most updated and dangerous one among them. 88 00:07:33,100 --> 00:07:38,700 They are highly active on Twitter and regularly updates Cerberus malware. 89 00:07:38,700 --> 00:07:44,080 Which commonly bypass sponsor and can be found in Google Play Store. 90 00:07:45,060 --> 00:07:48,220 It uses sensor data to detect emulator. 91 00:07:48,220 --> 00:07:52,180 You can imitate sensor movement and bypass this check. 92 00:07:55,140 --> 00:08:00,820 C2s are mainly used to distribute samples and manage both. 93 00:08:00,820 --> 00:08:03,140 And they contain stolen information. 94 00:08:05,380 --> 00:08:12,120 You can use this script to automate C2 extraction for some samples. 95 00:08:12,120 --> 00:08:18,580 Not every sample has automated C2 extraction decryptor or unpacker. 96 00:08:18,580 --> 00:08:27,340 But you can find some useful ones in the GitHub page that helps you to analyze samples faster. 97 00:08:27,340 --> 00:08:31,640 Now let's look at some vulnerabilities we found C2s. 98 00:08:31,640 --> 00:08:36,200 Note that most of the C2s are a part of SSRS. 99 00:08:36,480 --> 00:08:44,680 So if you find vulnerability in one panel, it's highly present on the other panels using the same malware. 100 00:08:46,220 --> 00:08:50,300 Red Alert panels has direct-to-realistic vulnerability. 101 00:08:50,300 --> 00:08:54,220 You can fetch infected device information from panels. 102 00:08:56,040 --> 00:09:01,260 You can find all infected phone data and stolen information. 103 00:09:03,950 --> 00:09:07,330 And also find encryption keys. 104 00:09:09,320 --> 00:09:11,800 Let's look at another panel. 105 00:09:11,800 --> 00:09:16,200 One of custom malware panel had password in page source. 106 00:09:19,200 --> 00:09:21,960 Using this, you could log into panel. 107 00:09:25,340 --> 00:09:29,420 It has many effective hosts and functions to control. 108 00:09:29,640 --> 00:09:32,520 It also had file upload feature. 109 00:09:34,910 --> 00:09:38,170 Exploiting file upload, we got shell. 110 00:09:38,170 --> 00:09:42,210 We purge all data and shut down its operation. 111 00:09:45,370 --> 00:09:48,590 Some other custom panel had SQL injection. 112 00:09:50,590 --> 00:09:55,470 We log in as admin with it and take over the panel. 113 00:09:58,230 --> 00:10:04,870 All Twitter phishing campaigns and malware distribution campaigns had stored XSS vulnerability. 114 00:10:08,180 --> 00:10:14,460 With this, you can sniff admin token to log in and see all stolen information. 115 00:10:17,770 --> 00:10:20,850 And all stolen credit card data. 116 00:10:24,860 --> 00:10:27,060 And social security numbers. 117 00:10:27,060 --> 00:10:29,760 We set up a cron job to delete them daily. 118 00:10:32,940 --> 00:10:42,220 Main takeaways for our presentation are we identified malware as a service users and hacked their sites to purge stolen data. 119 00:10:42,220 --> 00:10:49,180 We also shared our findings with task force and had 13 threat actors got arrested. 120 00:10:49,540 --> 00:10:54,120 If you have any questions, we will be on Discord to answer them. 121 00:10:54,120 --> 00:10:58,820 Don't forget to check your downloaded apps from Google Play Store. 122 00:10:59,000 --> 00:11:00,920 Never trust any application. 123 00:11:01,800 --> 00:11:03,960 Thank you all for listening. 124 00:11:04,900 --> 00:11:07,480 It was a pleasure to be here today. 125 00:11:07,980 --> 00:11:10,420 Welcome to our presentation. 126 00:11:10,500 --> 00:11:15,260 We will talk about Android malware and how we hacked their C2S. 127 00:11:16,820 --> 00:11:20,680 Our presentation will have three parts. 128 00:11:21,020 --> 00:11:27,220 First, we will introduce ourselves, our work and basic knowledge about Android. 129 00:11:27,220 --> 00:11:33,040 Second, we will introduce Android malware scenes and analysis of some families. 130 00:11:33,060 --> 00:11:37,240 Third, we will look at how we exploit C2S. 131 00:11:38,740 --> 00:11:41,920 I am Kursat and my co-speaker is Mert. 132 00:11:41,920 --> 00:11:45,670 We both security engineers at Trendule and Blackbox Security. 133 00:11:47,460 --> 00:11:51,580 We are finding Android malware samples and analyze them. 134 00:11:51,580 --> 00:11:55,030 We find IOCs and hack them to purge stolen data. 135 00:11:57,610 --> 00:12:00,790 Now, let's look at Google Play Store. 136 00:12:00,790 --> 00:12:05,710 To fight Android malware, Google introduced Bonsur as an anti-malware tool. 137 00:12:05,710 --> 00:12:10,190 But it has distinct feature and you can easily detect it. 138 00:12:10,870 --> 00:12:16,290 When you upload your APK file, it uploads it to an emulator. 139 00:12:16,290 --> 00:12:20,150 This emulator has only one contact to photos. 140 00:12:20,150 --> 00:12:29,690 You can also detect Bonsur IP range while it's running your APK can also use it to evade Bonsur. 141 00:12:32,380 --> 00:12:37,560 Because you can detect its feature, you can use different techniques to bypass it. 142 00:12:37,700 --> 00:12:43,740 Implementing anti-analysis and anti-emulator techniques is just some examples of it. 143 00:12:43,800 --> 00:12:49,880 You can also download your malicious text file separately and load into your APK. 144 00:12:49,880 --> 00:12:54,300 With this, Bonsur can't even see your malicious code. 145 00:12:56,830 --> 00:13:00,910 Android was by design not that secure back then. 146 00:13:00,910 --> 00:13:04,710 But nowadays, they are implementing new features to harden it. 147 00:13:04,710 --> 00:13:10,650 With Android P, battery encryption, process isolation, and authentication is implemented. 148 00:13:10,910 --> 00:13:19,030 Not just that, but Google Play Store changed its rules to prevent SMS and call log permission to be used in apps. 149 00:13:20,750 --> 00:13:24,950 With Android Q, even more hardening is introduced. 150 00:13:24,950 --> 00:13:30,730 Android Q removed clipboard monitoring, background activity, and limited screen recording. 151 00:13:30,730 --> 00:13:35,950 It's also Restrict Bubbles API which is commonly used for phishing by its editors. 152 00:13:35,950 --> 00:13:42,310 Also, Google introduced AppDefense Alliance to combat malware in Google Play Store. 153 00:13:42,310 --> 00:13:46,890 Alliance itself includes companies which specialize in mobile malware. 154 00:13:50,600 --> 00:13:52,900 Let's look at Android malware scene. 155 00:13:52,900 --> 00:13:55,780 There are five types of malware common in Android. 156 00:13:55,780 --> 00:13:57,760 First is Adware. 157 00:13:57,760 --> 00:14:01,300 It shows your open advertisement in a hidden manner. 158 00:14:01,300 --> 00:14:02,960 Second is Spyware. 159 00:14:02,960 --> 00:14:07,880 Spyware commonly steals personal information in order to sell it. 160 00:14:08,120 --> 00:14:09,720 Third is Trojan. 161 00:14:09,720 --> 00:14:13,680 They are commonly used to steal banking information. 162 00:14:13,680 --> 00:14:15,440 Fourth is Ransomware. 163 00:14:15,440 --> 00:14:20,360 They are commonly used as a feature in bank bots nowadays. 164 00:14:20,360 --> 00:14:25,520 When you try to remove malware, it activates ransomware feature. 165 00:14:25,520 --> 00:14:28,160 And lastly, Cryptominers. 166 00:14:28,160 --> 00:14:41,420 They were common back then but nowadays due to some restrictions like background activities are no longer a thing in Android operation system. 167 00:14:41,420 --> 00:14:43,860 They are decreasing. 168 00:14:44,420 --> 00:14:49,880 Threats occur usually to companies through social media advertisements to separate malware. 169 00:14:53,260 --> 00:14:56,140 There is also malware as a service malware. 170 00:14:56,140 --> 00:15:00,120 At first, there was GMBot which inspires Marcher. 171 00:15:00,120 --> 00:15:06,240 After Marcher, Exabot emerges and it evolves into a Red Alert. 172 00:15:06,240 --> 00:15:10,960 Red Alert has distinct feature which also carried on to Anubis. 173 00:15:10,960 --> 00:15:16,640 Nowadays, serverless malware is active and popular in as-a-service scene. 174 00:15:16,640 --> 00:15:20,260 They evolve in time as the threat actors change. 175 00:15:20,260 --> 00:15:23,940 They all use anti-techniques and droppers. 176 00:15:26,760 --> 00:15:32,420 Exabot uses dropper to distribute itself in Google Play Store. 177 00:15:34,500 --> 00:15:42,720 It also uses root detection and anti-monitor with checking device ID, country and operator in device. 178 00:15:42,720 --> 00:15:50,680 It also tries to run shell command to find sub-binary which is present when the device is rooted. 179 00:15:53,680 --> 00:15:57,020 You can see what Exabot looks for in strings. 180 00:15:59,200 --> 00:16:03,720 You can bypass anti-monitor with filter like this. 181 00:16:04,240 --> 00:16:07,980 And root detection like this. 182 00:16:08,560 --> 00:16:10,960 Red Alert uses Twitter for C2. 183 00:16:10,960 --> 00:16:13,620 The last tweet contains IP of C2. 184 00:16:13,620 --> 00:16:21,320 It fakes last tweet to find out current C2 and upload the data it stolen there. 185 00:16:24,660 --> 00:16:28,660 It asks for device admin permission to take over poll. 186 00:16:31,760 --> 00:16:36,360 It also checks Linux apps to look for specific apps. 187 00:16:38,680 --> 00:16:41,000 Anubis is a good bankbot example. 188 00:16:41,000 --> 00:16:43,060 It operates as-a-service. 189 00:16:43,060 --> 00:16:48,980 It has multiple versions which legend has multiple different developers. 190 00:16:50,620 --> 00:16:55,820 It uses fake apps and phishing campaigns to distribute samples. 191 00:16:56,320 --> 00:16:59,980 These are all Turkish bank or popular applications. 192 00:17:02,850 --> 00:17:05,710 It also uses dropper. 193 00:17:07,030 --> 00:17:10,910 And uses obfuscation in dropper sample. 194 00:17:13,400 --> 00:17:16,370 Dropper Anubis samples is encrypted. 195 00:17:18,520 --> 00:17:24,520 Once you decrypt it, you can see it uses call forwarding for bank numbers. 196 00:17:27,450 --> 00:17:31,000 And it uses overlay attack to still banking credentials. 197 00:17:31,690 --> 00:17:35,450 If you try remove it, ransomware feature activates. 198 00:17:38,670 --> 00:17:44,250 Anubis decrypts insert memory and writes decrypted code to a jar file. 199 00:17:44,250 --> 00:17:49,710 After that, it loads jar file into insert which contains myUse function. 200 00:17:50,010 --> 00:17:56,370 This filter script changes delete function so that you can fetch decrypted file from device. 201 00:17:56,370 --> 00:17:59,710 You can fetch decrypted code like this. 202 00:18:01,770 --> 00:18:04,980 And like this if native code is used. 203 00:18:07,080 --> 00:18:09,300 Hydra Hydra is another service. 204 00:18:09,300 --> 00:18:12,800 It imitates government apps to distribute itself. 205 00:18:14,590 --> 00:18:20,210 Once you create Hydra sample in panel, it has time limit to activate. 206 00:18:20,210 --> 00:18:22,470 Like some start to finish time. 207 00:18:22,470 --> 00:18:27,930 It uses overlay attack to still banking and other personal information. 208 00:18:30,030 --> 00:18:33,570 You can bypass time limitation like this. 209 00:18:34,590 --> 00:18:40,150 And like this if native code is used. 210 00:18:40,930 --> 00:18:46,090 Cerberus is most updated and dangerous one among them. 211 00:18:46,090 --> 00:18:51,690 They are highly active on Twitter and regularly updates Cerberus malware. 212 00:18:51,690 --> 00:18:57,090 Which commonly bypass sponsor and can be found in Google Play Store. 213 00:18:57,890 --> 00:19:01,210 It uses sensor data to detect emulator. 214 00:19:01,210 --> 00:19:05,210 You can imitate sensor movement and bypass this check. 215 00:19:08,120 --> 00:19:13,820 C2s are mainly used to distribute samples and manage both. 216 00:19:13,820 --> 00:19:16,140 And they contain stolen information. 217 00:19:18,360 --> 00:19:25,140 You can use this script to automate C2 extraction for some samples. 218 00:19:25,140 --> 00:19:31,540 Not every samples has automate C2 extraction decryptor or unpacker. 219 00:19:31,540 --> 00:19:36,460 But you can find some useful ones in the GitHub page. 220 00:19:36,460 --> 00:19:40,440 They helps you to analyze samples faster. 221 00:19:40,440 --> 00:19:44,640 Now let's look at some vulnerabilities we found C2s. 222 00:19:44,640 --> 00:19:49,500 Note that most of the C2s are a part of SSRs. 223 00:19:49,500 --> 00:19:57,680 So if you find vulnerability in one panel, it's highly present on the other panels using the same malware. 224 00:19:59,220 --> 00:20:03,300 Red Alert panels has direct-releasing vulnerability. 225 00:20:03,300 --> 00:20:07,240 You can fetch infected device information from panels. 226 00:20:09,410 --> 00:20:14,690 You can find all infected phone data and stolen information. 227 00:20:16,880 --> 00:20:20,340 And also find encryption keys. 228 00:20:22,560 --> 00:20:24,780 Let's look at another panel. 229 00:20:24,780 --> 00:20:29,180 One of custom malware panel had password in page source. 230 00:20:32,180 --> 00:20:34,960 Using this, you could login to panel. 231 00:20:38,380 --> 00:20:42,400 It has many effective host and functions to control. 232 00:20:42,640 --> 00:20:45,520 It also had file upload feature. 233 00:20:47,890 --> 00:20:51,170 Exploiting file upload, we got shell. 234 00:20:51,170 --> 00:20:55,190 We purge all data and shut down its operation. 235 00:20:58,370 --> 00:21:01,590 Some other custom panel had SQL injection. 236 00:21:03,590 --> 00:21:08,470 We log in as admin with it and take over the panel. 237 00:21:10,970 --> 00:21:17,870 All Twitter phishing campaigns and malware distribution campaigns had Statoroot XSS vulnerability. 238 00:21:21,160 --> 00:21:27,460 With this, you can sniff admin token to login and see all stolen information. 239 00:21:30,850 --> 00:21:33,850 And all stolen credit card data. 240 00:21:37,660 --> 00:21:40,080 And social security numbers. 241 00:21:40,080 --> 00:21:43,120 We set up a cron job to delete them daily. 242 00:21:45,960 --> 00:21:55,200 Main takeaways for our presentation are we identified malware as a service users and hacked their sites to purge stolen data. 243 00:21:55,200 --> 00:22:02,180 We also shared our findings with task force and had 13 threat actors got arrested. 244 00:22:02,520 --> 00:22:06,760 If you have any questions, we will be on Discord to answer them. 245 00:22:07,040 --> 00:22:11,800 Don't forget to check your downloaded apps from Google Play Store. 246 00:22:11,800 --> 00:22:13,960 Never trust any application. 247 00:22:14,820 --> 00:22:16,940 Thank you all for listening.