start	end	text
67540	73660	Hello everyone and thank you for switching to the Red Team channel. I'm going to present
73660	81600	how to compromise critical bank systems with very old hacker techniques. But firstly, a disclaimer.
83560	91300	This talk represents my opinion and doesn't represent any position of my current or past
91300	98220	employer. The information that I'm going to present today is widely public, available on
98220	105920	the internet. These vulnerabilities have been mitigated for the financial entity.
106300	112760	The information related to the claims was never compromised and the systems have been tested
112760	119240	only with restricted investigation purposes to find and mitigate critical vulnerabilities
119240	129180	on the systems. So this is the agenda for today. We are going to review quickly
129540	136800	what is speed, speed and spay, the previous attacks in those systems, critical steps
137960	146740	of the attack that I performed and some mitigation and detection for those critical steps.
148220	153980	But before that, a little info about me.
156480	166480	Right now I'm working in one of the world's largest insurance companies. I love to learn new
166480	174540	things and in my free time I participate in book bounties and CTFs with a pretty bad place in the
174540	185500	world. Also, this is my second talk in DEFCON. The first one was called how to obtain 100
185500	193420	Facebook accounts per day through internet searches. If you wanted to look at that talk,
193420	199840	you can search the video in the DEFCON channel. So let's begin.
200640	208760	What are SWIFT, speed and spay? Mainly there are systems used to transfer money between
208760	217600	financial institutions with some difference. SWIFT was born to fulfill a need to establish
218580	226750	a universal way to get money from one country to another and set standards for financial transactions.
226750	235240	So the Society for Worldwide Interbank Financial Telecommunication was created.
235310	242370	Now SWIFT also sells software and services to financial institutions,
242680	253290	much of it for use on the SWIFTnet network as ISO 9362. Normally SWIFT use
253850	260430	bank identifier codes, popularly known as SWIFT codes.
264400	273880	Now, SWIFT is a domestic payment system for U.S. dollar transfers developed and operated by
273880	283160	Banco Mexico. SWIFT sells same-day payments in U.S. dollars among health in Mexican banks
283160	294850	in Mexican territory. And SPAY is a system to facilitate payments between financial institutions
295450	307030	through their accounts and on behalf of their account holders in near real time, 24 hours a day,
307030	314150	every day of the year, in Mexican territory also.
317130	323110	Those systems have suffered many security breaches in the past because
323650	328150	the interest in these systems is high.
329870	336070	They manage all the transactions between financial entities and the rest of the world.
336070	343650	As such, these systems could be an enormous risk because the goals of the
343650	348910	threat actors are very profitable and easy to monetize.
351310	360270	If we do a close-up in Mexico, a while ago there was a cybercrime group called Bandidos
360270	367850	Revolution Team with headquarters in Mexico. They came to cybercrime through large-scale
368590	376830	operations. They were charged with running one of the biggest cybersecurity breaches in Mexican
377390	386920	financial history. Unluckily, they compromised the state systems in terms of banks in Mexico.
388440	395460	The official report says that the Bandidos Revolution Team never compromised the central
395460	406360	systems of the state. They only took advantage of the weak environment that runs those critical
406360	416920	systems. The interesting part of this history is that they were not arrested by Mexican
416920	424340	cybersecurity police or any other related cybersecurity authority. It was only possible
424340	433000	after a private financial institution filled a complaint about electronic fraud that the
433000	442900	investigation began. Later, a financial authority started digging around the case.
443180	453520	They reviewed the activities for an individual that owned three football soccer teams and had
453520	466410	intention of buying yet another team that they decided to step in. The attorney general's office
466410	476930	in Mexico then ordered a search of 11 properties in Guanajuato state and they found everything
477730	487430	from drugs, weapons, and cash, all the way to luxury vehicles like Ferrari,
487430	495730	McLaren, Lamborghini, etc. Six men and two women were arrested that day.
496230	505750	Sounds like the plot of a hacker movie, right? But do you really need to be an elite hacker to
505750	524130	compromise those systems? We are going to check the critical steps of my attack and we can draw
524130	535890	your own conclusions. Now, let's rewind a couple of years before that. A client asked me to perform
535890	543450	an assessment and the scope was, as you might guess, some of the critical systems in their
543450	553030	environment. Swift, Speed, and Spade systems. For the assessment, I need to emulate a cyber threat
553030	561710	with access through the network and with the ability to gain local administrative access.
565890	573360	Now, let me show you the steps that I followed to compromise Swift, Speed, and Spade.
575880	585660	Using valid access through the network previously provided by the client, commonly called
587340	596560	white card, I start for scanning to identify some common services stealthily.
599060	609600	And techniques like not being scanned, specifying ports, and using a complete connection are very
609600	623390	effective to perform that scans. With the information previously obtained, I found a very
623390	632130	common port, SSH, and I tried to gain access to the systems performing a brute force attack
632130	642050	with default credentials. I used a common dictionary from Kali and I tested the same username as password.
643630	654870	I found a default valid database user. The next step was logging into the system and
654870	667850	enumerated valid user stored in etc.passwd. Then, I created a custom dictionary with
667850	677330	the users and then I tested users with the same password policy. Same password as username.
682850	690710	Later, I found another maintenance account with more privileges and interactive shell.
690810	700950	That user was in 80% of the host in my scope and it used the same bad password policy.
700950	706290	So, I was capable to log in a lot of hosts but
708710	710910	I had a problem.
712570	720390	I realized that none of the conventional hacking tools were working well. They not only didn't
720390	728750	support Solaris environments, but even worse, the client had an outdated version of Solaris.
728750	736610	Also, most of the tools are designed to be used in Windows. There isn't even a native
736610	745310	interpreter for that version of Solaris and Coal Strike doesn't have any auxiliary modes for that.
747730	754930	I spent a lot of time in enumeration like some offensive circuit exam.
754930	761760	And long after, I found that the system runs Java.
766150	774720	I was so excited but in a moment of rush and without believing my TTPs before, I uploaded
776060	782950	a Java interpreter. Then, obviously, since the interpreter is a well-known binary,
782950	791770	it was deleted instantly by some endpoint protection. A common node error.
796620	804800	I had to figure out a way to create an undetectable Java quickly since the time assignment for the
804800	811620	execution was running out. And all the tools available to do this are designed for Windows
811620	821900	such as Bail, Shelter Pro, etc. I found a very basic solution like all the techniques
821900	828580	reviewed today. But powerful. In an entry from Nullbyte's blog called
828580	839100	use MSF console to generate command to obfuscate payloads and evade antivirus detection.
841530	850090	The entry in the Nullbyte's blog was current. Only one year before my engagement. So, I will be
850090	874930	very reliable. And finally, I have an undetectable Java interpreter. And an interpreter's callback.
877740	883620	At this point, I didn't have a root account yet.
883700	889280	In my research to find how to obtain root privilege in those systems,
889280	896560	I read some previous investigative works that indicated that the NSA hacking group,
896560	909820	Equation Group, had compromised a lot of Swift systems. I found the leak made by the
909820	921220	shadow brokers and it had documentation names of Swift systems compromised. And of course,
921220	929560	exploits. Also, this is a very good tool for conspiracy theory.
945130	951330	I found a tool in the shadow brokers dump used to elevate privilege
951950	961030	in outdated Solaris systems called Extreme Parts. And finally, I was rooting the systems.
965280	974700	After that, the client asked me to wrap things up and not touch any database information clients
974700	980220	or systems because the assessment was running in an operational environment.
980780	987350	Lastly, this is a request for my attack with 18 critical assets compromised.
993080	1004690	Yeah, these slides could be a success in the hall. Also, the hacksort part is exciting.
1006730	1013720	It is important to talk about how to mitigate and detect these simple activities in a critical
1013720	1023520	system such as DoF. So, let's begin. To mitigate port and vulnerability scans, you need to ensure
1025100	1031800	that unnecessary ports and services are closed to prevent the use of discovery and
1031800	1041560	potential exploitation. Also, the use of an IPS and proper network segmentation helps to protect
1041560	1055300	to protect critical servers and devices. To detect it, you need to review the systems
1055300	1061580	and network events. And with the help of a network intrusion detection system,
1061880	1070920	you can identify scanning activity. It is a basic attack but very difficult to detect.
1070920	1077780	So, the data and events should not be viewed in isolation.
1088080	1095960	But rather as a part of chain of behaviors that could lead to another activity such as
1095960	1102380	lateral movements based on the information obtained.
1104900	1111400	To create a custom detection of this, I recommend creating a monitoring honeypot
1111400	1123240	service in a common port that the technology doesn't use. For example, 22, 40, 43, 80, etc.
1129800	1137860	To avoid successful brute force attacks, you need to use a robust password policy to prevent
1137860	1146080	password from being guessed and the use of multi-factor authentications and solutions
1146080	1154840	using passwordless logging, using SSH keychain, for example.
1155240	1164180	For detection, you need to monitor authentication logs for system and application logging failures
1164660	1173760	of valid accounts. If authentication failures are high, then there might be a brute force
1173760	1180560	going on to access to the systems using legitimate credentials.
1181700	1186420	Also, monitor failed authentication attempts across
1187440	1193520	various accounts that may result from password spray attempts.
1193720	1201080	I recommend creating honeypot accounts and monitoring failed attempts in the critical host
1201080	1208200	and training users to not use the same password for multiple accounts and limit
1209160	1214320	credential overlap across accounts and systems.
1217220	1225100	Now, for the enumeration, this type of attacks cannot be easily mitigated with preventive control
1225100	1235020	since it is based on the abuse of the system features. You can monitor process and command
1235020	1244020	line arguments for actions that could be taken to gather system and network information.
1244340	1254960	I suggest monitoring the access to etc.passwd and etc.shadow files and log failed access attempts.
1260440	1266620	If the obfuscation itself is not possible,
1267120	1273980	it might be possible to detect the malicious activity that caused the obfuscated file.
1273980	1286900	For example, the method that was used to write, read, or modify the file on the system.
1287620	1294480	The obfuscation tools can be used to detect these indicators in payloads. Obfuscation
1294480	1302620	used in payloads for initial access can be detected at the network. Use network
1302620	1312480	intrusion detection systems to identify compressive and encrypted attachments and scripts.
1312900	1318660	This is a difficult one, but you can use next generation endpoint security tools
1318660	1327230	and monitor the possible future actions. So, to summarize,
1330090	1337430	those are the general recommendations. The main problems with those security gaps were
1337990	1348850	using legacy systems, default and reuse users, and passwords with a bad password policy,
1348850	1357750	no monitoring of privileged accounts, and the general recommendation to avoid those security
1357750	1368970	gaps. Use a patch policy and its enforcement in critical assets. Isolate the legacy systems.
1368970	1377990	Use a password and user policy that includes not the file usernames with password rotation.
1377990	1386870	Add those and allow users to reuse passwords. Also, enforce activity monitoring in critical
1386870	1400270	assets. With all this info, do you really need to be an elite hacker to compromise those systems?
1411090	1418990	From my perspective, you don't need to be an elite hacker. Some critical systems have
1418990	1426290	very basic vulnerabilities with a very bad security engine. Financial entities need to
1426290	1439770	enforce their security controls because the risk is real. As I showed you in the previous slides.
1441950	1452290	Well, thank you very much if you reached this point in my talk. If you want to share some gags
1452890	1461070	with me, this is my Twitter. Also, I want to give a shout out to all the 19th floor team.
1461070	1467990	And the Q&A will be on the Redteam Village Discord. And thank you for watching.