start	end	text
0	2680	How we hack their C2s.
3760	7720	Our presentation will have three parts.
8120	14240	First, we will introduce ourselves, our work and basic knowledge about Android.
14240	19680	Second, we will introduce Android malware scenes and analysis of some families.
20100	24300	Third, we will look at how we exploit C2s.
25800	28980	I am Kursat and my co-speaker is Mert.
28980	32680	We both security engineers at Trendule and Blackbox Security.
34500	38580	We are finding Android malware samples and analyze them.
38580	42100	We find IOCs and hack them to purge stolen data.
45040	47780	Now let's look at Google Play Store.
47780	52780	To fight Android malware, Google introduced Bonsur as an anti-malware tool.
52780	57100	But it has distinct feature and you can easily detect it.
57860	63400	When you upload your APK file, it uploads it to an emulator.
63400	67180	This emulator has only one contact to photos.
67180	72740	You can also detect Bonsur IP range while it's running your APK with you.
72740	76740	You can also use it to evade Bonsur.
79380	84560	Because you can detect its feature, you can use different techniques to bypass it.
84560	90760	Implementing anti-analyze and anti-emulator techniques is just some examples of it.
90780	96840	You can also download your malicious text file separately and load into your APK.
96840	101320	With this, Bonsur can't even see your malicious code.
104290	107710	Android was by design not that secure back then.
107710	111670	But nowadays, they are implementing new features to harden it.
111670	117910	With Android P, battery encryption, process isolation, and authentication is implemented.
117910	119310	Not just that.
119310	126010	But Google Play Store changed its rules to prevent SMS and call log permission to be used in apps.
127790	131630	With Android Q, even more hardening is introduced.
132010	137730	Android Q removed clipboard monitoring, background activity, and limited screen recording.
137730	142970	It also restricts Bubble's API, which is commonly used for phishing by its adapters.
142970	149310	Also, Google introduced AppDefense Alliance to combat malware in Google Play Store.
149310	153550	Alliance itself includes companies which specialize in mobile malware.
157210	159890	Let's look at Android malware scene.
159890	163010	There are five types of malware common in Android.
163010	164690	First is AdWare.
164690	168190	It shows your open advertisement in a hidden manner.
168190	169750	Second is Spyware.
169750	175010	Spyware commonly steals personal information in order to sell it.
175210	176810	Third is Trojan.
176810	180730	They are commonly used to steal banking information.
180730	182450	Fourth is Ransomware.
182450	187390	They are commonly used as a feature in bank bots nowadays.
187390	192630	When you try to remove malware, it activates Ransomware feature.
192690	195090	And lastly, Crypto Miners.
195090	203730	They were common back then, but nowadays, due to some restrictions, like background activities,
203730	208370	are no longer a thing in Android's operating system.
208370	210810	They are decreasing.
211430	216830	Threat actors usually tip companies through social media advertisements to separate malware.
219910	223090	There is also malware as a service malware.
223090	227130	At first, there was GMBot, which espies Marcher.
227130	233210	After Marcher, Exabot emerges and it evolves into a Red Alert.
233210	237970	Red Alert has distinct features which also carry on to anomalies.
237970	243630	Nowadays, serverless malware is active and popular as a service scene.
243630	247290	They evolve in time as threat actors change.
247290	250970	They all use anti-techniques and droppers.
253970	259710	Exabot uses dropper to distribute itself in Google Play Store.
261090	266910	It also uses root detection and anti-monitor with checking device ID,
266910	269730	country, and operator in device.
269730	277670	It also tries to run shell command to find sub-binary which is present when the device is rooted.
280720	284060	You can see what Exabot looks for in settings.
286200	290600	You can bypass anti-monitor with filter like this.
291240	294920	And root detection like this.
295560	297980	Red Alert uses Twitter for C2.
297980	300640	The last tweet contains IP of C2.
300640	308320	It fakes last tweet to find out current C2 and upload the data it stolen there.
311660	315860	It asks for device admin permission to take over poll.
318940	323360	It also checks Linux apps to look for specific apps.
325700	327980	Anubis is a good bankbot example.
327980	330060	It operates as a service.
330060	335980	It has multiple versions which legend has multiple different developers.
337620	343220	It uses fake apps and phishing campaigns to distribute samples.
343300	346840	These are all Turkish bank or popular applications.
350040	352720	It also uses dropper.
354260	357880	And uses obfuscation in dropper sample.
360400	363360	Dropper Anubis samples is encrypted.
365540	371480	Once you decrypt it, you can see it uses call forwarding for bank numbers.
374490	377970	And it uses overlay attack to steal banking credentials.
378710	382270	If you try remove it, ransomware feature activates.
385750	391250	Anubis decrypts inside memory and writes decrypted code to a jar file.
391250	396670	After that, it loads jar file into inside which contains malicious function.
397010	403390	This FIRA script changes delete function so that you can fetch decrypted file from device.
403390	406670	You can fetch decrypted code like this.
408870	411960	And like this if native code is used.
414120	416300	Hydra Hydra is another service.
416300	419740	It imitates government apps to distribute itself.
421750	427190	Once you create Hydra sample in panel, it has time limit to activate.
427190	429470	Like some step to finish time.
429470	434530	It uses overlay attack to steal banking and other personal information.
437280	440540	You can bypass time limitation like this.
441560	447200	And like this if native code is used.
447960	453100	Cerberus is most updated and dangerous one among them.
453100	458700	They are highly active on Twitter and regularly updates Cerberus malware.
458700	464080	Which commonly bypass sponsor and can be found in Google Play Store.
465060	468220	It uses sensor data to detect emulator.
468220	472180	You can imitate sensor movement and bypass this check.
475140	480820	C2s are mainly used to distribute samples and manage both.
480820	483140	And they contain stolen information.
485380	492120	You can use this script to automate C2 extraction for some samples.
492120	498580	Not every sample has automated C2 extraction decryptor or unpacker.
498580	507340	But you can find some useful ones in the GitHub page that helps you to analyze samples faster.
507340	511640	Now let's look at some vulnerabilities we found C2s.
511640	516200	Note that most of the C2s are a part of SSRS.
516480	520060	So if you find vulnerability in one panel,
520060	524680	it's highly present on the other panels using the same malware.
526220	530300	Red Alert panels has direct-to-realistic vulnerability.
530300	534220	You can fetch infected device information from panels.
536040	541260	You can find all infected phone data and stolen information.
543950	547330	And also find encryption keys.
549320	551800	Let's look at another panel.
551800	556200	One of custom malware panel had password in page source.
559200	561960	Using this, you could log into panel.
565340	569420	It has many effective hosts and functions to control.
569640	572520	It also had file upload feature.
574910	578170	Exploiting file upload, we got shell.
578170	582210	We purge all data and shut down its operation.
585370	588590	Some other custom panel had SQL injection.
590590	595470	We log in as admin with it and take over the panel.
598230	602250	All Twitter phishing campaigns and malware distribution campaigns
602250	604870	had stored XSS vulnerability.
608180	610740	With this, you can sniff admin token to log in
610740	614460	and see all stolen information.
617770	620850	And all stolen credit card data.
624860	627060	And social security numbers.
627060	629760	We set up a cron job to delete them daily.
632940	635680	Main takeaways for our presentation are
635680	638660	we identified malware as a service users
638660	642220	and hacked their sites to purge stolen data.
642220	645700	We also shared our findings with task force
645700	649180	and had 13 threat actors got arrested.
649540	654120	If you have any questions, we will be on Discord to answer them.
654120	658820	Don't forget to check your downloaded apps from Google Play Store.
659000	660920	Never trust any application.
661800	663960	Thank you all for listening.
664900	667480	It was a pleasure to be here today.
667980	670420	Welcome to our presentation.
670500	675260	We will talk about Android malware and how we hacked their C2S.
676820	680680	Our presentation will have three parts.
681020	687220	First, we will introduce ourselves, our work and basic knowledge about Android.
687220	693040	Second, we will introduce Android malware scenes and analysis of some families.
693060	697240	Third, we will look at how we exploit C2S.
698740	701920	I am Kursat and my co-speaker is Mert.
701920	705670	We both security engineers at Trendule and Blackbox Security.
707460	711580	We are finding Android malware samples and analyze them.
711580	715030	We find IOCs and hack them to purge stolen data.
717610	720790	Now, let's look at Google Play Store.
720790	725710	To fight Android malware, Google introduced Bonsur as an anti-malware tool.
725710	730190	But it has distinct feature and you can easily detect it.
730870	736290	When you upload your APK file, it uploads it to an emulator.
736290	740150	This emulator has only one contact to photos.
740150	744950	You can also detect Bonsur IP range while it's running your APK
744950	749690	can also use it to evade Bonsur.
752380	757560	Because you can detect its feature, you can use different techniques to bypass it.
757700	763740	Implementing anti-analysis and anti-emulator techniques is just some examples of it.
763800	769880	You can also download your malicious text file separately and load into your APK.
769880	774300	With this, Bonsur can't even see your malicious code.
776830	780910	Android was by design not that secure back then.
780910	784710	But nowadays, they are implementing new features to harden it.
784710	790650	With Android P, battery encryption, process isolation, and authentication is implemented.
790910	794270	Not just that, but Google Play Store changed its rules
794270	799030	to prevent SMS and call log permission to be used in apps.
800750	804950	With Android Q, even more hardening is introduced.
804950	810730	Android Q removed clipboard monitoring, background activity, and limited screen recording.
810730	815950	It's also Restrict Bubbles API which is commonly used for phishing by its editors.
815950	822310	Also, Google introduced AppDefense Alliance to combat malware in Google Play Store.
822310	826890	Alliance itself includes companies which specialize in mobile malware.
830600	832900	Let's look at Android malware scene.
832900	835780	There are five types of malware common in Android.
835780	841300	First is Adware. It shows your open advertisement in a hidden manner.
841300	847880	Second is Spyware. Spyware commonly steals personal information in order to sell it.
848120	853680	Third is Trojan. They are commonly used to steal banking information.
853680	860360	Fourth is Ransomware. They are commonly used as a feature in bank bots nowadays.
860360	865520	When you try to remove malware, it activates ransomware feature.
865520	873620	And lastly, Cryptominers. They were common back then but nowadays due to some restrictions
873620	881420	like background activities are no longer a thing in Android operation system.
881420	883860	They are decreasing.
884420	889880	Threats occur usually to companies through social media advertisements to separate malware.
893260	896140	There is also malware as a service malware.
896140	900120	At first, there was GMBot which inspires Marcher.
900120	906240	After Marcher, Exabot emerges and it evolves into a Red Alert.
906240	910960	Red Alert has distinct feature which also carried on to Anubis.
910960	916640	Nowadays, serverless malware is active and popular in as-a-service scene.
916640	920260	They evolve in time as the threat actors change.
920260	923940	They all use anti-techniques and droppers.
926760	932420	Exabot uses dropper to distribute itself in Google Play Store.
934500	942720	It also uses root detection and anti-monitor with checking device ID, country and operator in device.
942720	950680	It also tries to run shell command to find sub-binary which is present when the device is rooted.
953680	957020	You can see what Exabot looks for in strings.
959200	963720	You can bypass anti-monitor with filter like this.
964240	967980	And root detection like this.
968560	970960	Red Alert uses Twitter for C2.
970960	973620	The last tweet contains IP of C2.
973620	981320	It fakes last tweet to find out current C2 and upload the data it stolen there.
984660	988660	It asks for device admin permission to take over poll.
991760	996360	It also checks Linux apps to look for specific apps.
998680	1001000	Anubis is a good bankbot example.
1001000	1003060	It operates as-a-service.
1003060	1008980	It has multiple versions which legend has multiple different developers.
1010620	1015820	It uses fake apps and phishing campaigns to distribute samples.
1016320	1019980	These are all Turkish bank or popular applications.
1022850	1025710	It also uses dropper.
1027030	1030910	And uses obfuscation in dropper sample.
1033400	1036370	Dropper Anubis samples is encrypted.
1038520	1044520	Once you decrypt it, you can see it uses call forwarding for bank numbers.
1047450	1051000	And it uses overlay attack to still banking credentials.
1051690	1055450	If you try remove it, ransomware feature activates.
1058670	1064250	Anubis decrypts insert memory and writes decrypted code to a jar file.
1064250	1069710	After that, it loads jar file into insert which contains myUse function.
1070010	1076370	This filter script changes delete function so that you can fetch decrypted file from device.
1076370	1079710	You can fetch decrypted code like this.
1081770	1084980	And like this if native code is used.
1087080	1089300	Hydra Hydra is another service.
1089300	1092800	It imitates government apps to distribute itself.
1094590	1100210	Once you create Hydra sample in panel, it has time limit to activate.
1100210	1102470	Like some start to finish time.
1102470	1107930	It uses overlay attack to still banking and other personal information.
1110030	1113570	You can bypass time limitation like this.
1114590	1120150	And like this if native code is used.
1120930	1126090	Cerberus is most updated and dangerous one among them.
1126090	1131690	They are highly active on Twitter and regularly updates Cerberus malware.
1131690	1137090	Which commonly bypass sponsor and can be found in Google Play Store.
1137890	1141210	It uses sensor data to detect emulator.
1141210	1145210	You can imitate sensor movement and bypass this check.
1148120	1153820	C2s are mainly used to distribute samples and manage both.
1153820	1156140	And they contain stolen information.
1158360	1165140	You can use this script to automate C2 extraction for some samples.
1165140	1171540	Not every samples has automate C2 extraction decryptor or unpacker.
1171540	1176460	But you can find some useful ones in the GitHub page.
1176460	1180440	They helps you to analyze samples faster.
1180440	1184640	Now let's look at some vulnerabilities we found C2s.
1184640	1189500	Note that most of the C2s are a part of SSRs.
1189500	1193100	So if you find vulnerability in one panel,
1193100	1197680	it's highly present on the other panels using the same malware.
1199220	1203300	Red Alert panels has direct-releasing vulnerability.
1203300	1207240	You can fetch infected device information from panels.
1209410	1214690	You can find all infected phone data and stolen information.
1216880	1220340	And also find encryption keys.
1222560	1224780	Let's look at another panel.
1224780	1229180	One of custom malware panel had password in page source.
1232180	1234960	Using this, you could login to panel.
1238380	1242400	It has many effective host and functions to control.
1242640	1245520	It also had file upload feature.
1247890	1251170	Exploiting file upload, we got shell.
1251170	1255190	We purge all data and shut down its operation.
1258370	1261590	Some other custom panel had SQL injection.
1263590	1268470	We log in as admin with it and take over the panel.
1270970	1275230	All Twitter phishing campaigns and malware distribution campaigns
1275230	1277870	had Statoroot XSS vulnerability.
1281160	1283640	With this, you can sniff admin token to login
1283640	1287460	and see all stolen information.
1290850	1293850	And all stolen credit card data.
1297660	1300080	And social security numbers.
1300080	1303120	We set up a cron job to delete them daily.
1305960	1308700	Main takeaways for our presentation are
1308700	1311660	we identified malware as a service users
1311660	1315200	and hacked their sites to purge stolen data.
1315200	1318700	We also shared our findings with task force
1318700	1322180	and had 13 threat actors got arrested.
1322520	1326760	If you have any questions, we will be on Discord to answer them.
1327040	1331800	Don't forget to check your downloaded apps from Google Play Store.
1331800	1333960	Never trust any application.
1334820	1336940	Thank you all for listening.