WEBVTT 01:07.540 --> 01:12.400 Hello everyone and thank you for switching to the Red Team channel. 01:12.400 --> 01:19.280 I'm going to present how to compromise critical bank systems with very old hacker techniques. 01:19.280 --> 01:21.600 But firstly, a disclaimer. 01:23.560 --> 01:32.680 This talk represents my opinion and doesn't represent any position of my current or past employer. 01:32.680 --> 01:39.820 The information that I'm going to present today is widely public, available on the internet. 01:39.820 --> 01:45.920 These vulnerabilities have been mitigated for the financial entity. 01:46.300 --> 02:01.500 The information related to the claims was never compromised and the systems have been tested only with restricted investigation purposes to find and mitigate critical vulnerabilities on the systems. 02:04.040 --> 02:07.320 So this is the agenda for today. 02:07.320 --> 02:26.740 We are going to review quickly what is speed, speed and spay, the previous attacks in those systems, critical steps of the attack that I performed and some mitigation and detection for those critical steps. 02:28.220 --> 02:33.980 But before that, a little info about me. 02:36.480 --> 02:43.800 Right now I'm working in one of the world's largest insurance companies. 02:44.260 --> 02:55.500 I love to learn new things and in my free time I participate in book bounties and CTFs with a pretty bad place in the world. 02:58.020 --> 03:01.780 Also, this is my second talk in DEFCON. 03:01.780 --> 03:09.740 The first one was called how to obtain 100 Facebook accounts per day through internet searches. 03:09.880 --> 03:17.340 If you wanted to look at that talk, you can search the video in the DEFCON channel. 03:18.020 --> 03:19.840 So let's begin. 03:20.640 --> 03:24.380 What are SWIFT, speed and spay? 03:24.640 --> 03:32.580 Mainly there are systems used to transfer money between financial institutions with some difference. 03:32.960 --> 03:46.750 SWIFT was born to fulfill a need to establish a universal way to get money from one country to another and set standards for financial transactions. 03:46.750 --> 03:55.240 So the Society for Worldwide Interbank Financial Telecommunication was created. 03:55.310 --> 04:11.030 Now SWIFT also sells software and services to financial institutions, much of it for use on the SWIFTnet network as ISO 9362. 04:11.030 --> 04:20.430 Normally SWIFT use bank identifier codes, popularly known as SWIFT codes. 04:24.400 --> 04:29.960 Now, SWIFT is a domestic payment system for U.S. 04:29.960 --> 04:35.680 dollar transfers developed and operated by Banco Mexico. 04:35.680 --> 04:39.380 SWIFT sells same-day payments in U.S. 04:39.380 --> 04:46.820 dollars among health in Mexican banks in Mexican territory. 04:49.430 --> 05:14.150 And SPAY is a system to facilitate payments between financial institutions through their accounts and on behalf of their account holders in near real time, 24 hours a day, every day of the year, in Mexican territory also. 05:17.130 --> 05:28.150 Those systems have suffered many security breaches in the past because the interest in these systems is high. 05:29.870 --> 05:36.070 They manage all the transactions between financial entities and the rest of the world. 05:36.070 --> 05:48.910 As such, these systems could be an enormous risk because the goals of the threat actors are very profitable and easy to monetize. 05:51.310 --> 06:04.150 If we do a close-up in Mexico, a while ago there was a cybercrime group called Bandidos Revolution Team with headquarters in Mexico. 06:04.150 --> 06:09.930 They came to cybercrime through large-scale operations. 06:09.930 --> 06:19.730 They were charged with running one of the biggest cybersecurity breaches in Mexican financial history. 06:19.730 --> 06:26.920 Unluckily, they compromised the state systems in terms of banks in Mexico. 06:28.440 --> 06:38.320 The official report says that the Bandidos Revolution Team never compromised the central systems of the state. 06:38.320 --> 06:48.160 They only took advantage of the weak environment that runs those critical systems. 06:50.260 --> 07:02.620 The interesting part of this history is that they were not arrested by Mexican cybersecurity police or any other related cybersecurity authority. 07:02.620 --> 07:15.260 It was only possible after a private financial institution filled a complaint about electronic fraud that the investigation began. 07:15.260 --> 07:22.900 Later, a financial authority started digging around the case. 07:23.180 --> 07:40.580 They reviewed the activities for an individual that owned three football soccer teams and had intention of buying yet another team that they decided to step in. 07:43.670 --> 08:10.330 The attorney general's office in Mexico then ordered a search of 11 properties in Guanajuato state and they found everything from drugs, weapons, and cash, all the way to luxury vehicles like Ferrari, McLaren, Lamborghini, etc. 08:10.330 --> 08:15.730 Six men and two women were arrested that day. 08:16.230 --> 08:21.390 Sounds like the plot of a hacker movie, right? 08:21.750 --> 08:28.010 But do you really need to be an elite hacker to compromise those systems? 08:38.750 --> 08:46.190 We are going to check the critical steps of my attack and we can draw your own conclusions. 08:49.970 --> 08:53.570 Now, let's rewind a couple of years before that. 08:53.570 --> 09:04.750 A client asked me to perform an assessment and the scope was, as you might guess, some of the critical systems in their environment. 09:05.530 --> 09:09.050 Swift, Speed, and Spade systems. 09:09.130 --> 09:21.710 For the assessment, I need to emulate a cyber threat with access through the network and with the ability to gain local administrative access. 09:25.890 --> 09:33.360 Now, let me show you the steps that I followed to compromise Swift, Speed, and Spade. 09:35.880 --> 09:56.560 Using valid access through the network previously provided by the client, commonly called white card, I start for scanning to identify some common services stealthily. 09:59.060 --> 10:18.170 And techniques like not being scanned, specifying ports, and using a complete connection are very effective to perform that scans. 10:18.170 --> 10:34.370 With the information previously obtained, I found a very common port, SSH, and I tried to gain access to the systems performing a brute force attack with default credentials. 10:34.370 --> 10:42.050 I used a common dictionary from Kali and I tested the same username as password. 10:43.630 --> 10:45.190 I found 10:48.390 --> 10:51.250 a default valid database user. 10:51.250 --> 11:01.710 The next step was logging into the system and enumerated valid user stored in etc.passwd. 11:02.430 --> 11:14.950 Then, I created a custom dictionary with the users and then I tested users with the same password policy. 11:14.950 --> 11:17.330 Same password as username. 11:22.850 --> 11:30.710 Later, I found another maintenance account with more privileges and interactive shell. 11:30.810 --> 11:40.950 That user was in 80% of the host in my scope and it used the same bad password policy. 11:40.950 --> 11:50.910 So, I was capable to log in a lot of hosts but I had a problem. 11:52.570 --> 11:58.470 I realized that none of the conventional hacking tools were working well. 11:58.470 --> 12:08.750 They not only didn't support Solaris environments, but even worse, the client had an outdated version of Solaris. 12:08.750 --> 12:14.410 Also, most of the tools are designed to be used in Windows. 12:14.410 --> 12:25.310 There isn't even a native interpreter for that version of Solaris and Coal Strike doesn't have any auxiliary modes for that. 12:27.730 --> 12:34.930 I spent a lot of time in enumeration like some offensive circuit exam. 12:34.930 --> 12:41.760 And long after, I found that the system runs Java. 12:46.150 --> 12:57.760 I was so excited but in a moment of rush and without believing my TTPs before, I uploaded a Java interpreter. 12:57.960 --> 13:09.390 Then, obviously, since the interpreter is a well-known binary, it was deleted instantly by some endpoint protection. 13:09.930 --> 13:11.770 A common node error. 13:16.620 --> 13:27.020 I had to figure out a way to create an undetectable Java quickly since the time assignment for the execution was running out. 13:27.020 --> 13:36.500 And all the tools available to do this are designed for Windows such as Bail, Shelter Pro, etc. 13:37.300 --> 13:44.000 I found a very basic solution like all the techniques reviewed today. 13:44.000 --> 13:45.760 But powerful. 13:45.760 --> 13:59.100 In an entry from Nullbyte's blog called use MSF console to generate command to obfuscate payloads and evade antivirus detection. 14:01.530 --> 14:06.190 The entry in the Nullbyte's blog was current. 14:06.190 --> 14:08.970 Only one year before my engagement. 14:08.970 --> 14:12.670 So, I will be very reliable. 14:16.520 --> 14:22.280 And finally, I have an undetectable Java interpreter 14:30.370 --> 14:31.330 . 14:31.330 --> 14:34.930 And an interpreter's callback. 14:37.740 --> 14:43.620 At this point, I didn't have a root account yet. 14:43.700 --> 15:02.960 In my research to find how to obtain root privilege in those systems, I read some previous investigative works that indicated that the NSA hacking group, Equation Group, had compromised a lot of Swift systems. 15:05.700 --> 15:19.480 I found the leak made by the shadow brokers and it had documentation names of Swift systems compromised. 15:19.480 --> 15:23.280 And of course, exploits. 15:24.240 --> 15:29.560 Also, this is a very good tool for conspiracy theory. 15:45.130 --> 15:57.830 I found a tool in the shadow brokers dump used to elevate privilege in outdated Solaris systems called Extreme Parts. 15:57.830 --> 16:01.030 And finally, I was rooting the systems. 16:05.280 --> 16:20.220 After that, the client asked me to wrap things up and not touch any database information clients or systems because the assessment was running in an operational environment. 16:20.780 --> 16:27.350 Lastly, this is a request for my attack with 18 critical assets compromised. 16:33.080 --> 16:37.600 Yeah, these slides could be a success in the hall. 16:40.880 --> 16:44.690 Also, the hacksort part is exciting. 16:46.730 --> 16:56.600 It is important to talk about how to mitigate and detect these simple activities in a critical system such as DoF. 16:57.520 --> 16:59.620 So, let's begin. 16:59.620 --> 17:14.460 To mitigate port and vulnerability scans, you need to ensure that unnecessary ports and services are closed to prevent the use of discovery and potential exploitation. 17:14.460 --> 17:26.920 Also, the use of an IPS and proper network segmentation helps to protect to protect critical servers and devices. 17:30.900 --> 17:37.560 To detect it, you need to review the systems and network events. 17:37.560 --> 17:45.780 And with the help of a network intrusion detection system, you can identify scanning activity. 17:45.860 --> 17:50.920 It is a basic attack but very difficult to detect. 17:50.920 --> 17:57.780 So, the data and events should not be viewed in isolation. 18:08.080 --> 18:22.380 But rather as a part of chain of behaviors that could lead to another activity such as lateral movements based on the information obtained. 18:24.900 --> 18:36.680 To create a custom detection of this, I recommend creating a monitoring honeypot service in a common port that the technology doesn't use. 18:36.680 --> 18:43.240 For example, 22, 40, 43, 80, etc. 18:49.800 --> 19:14.840 To avoid successful brute force attacks, you need to use a robust password policy to prevent password from being guessed and the use of multi-factor authentications and solutions using passwordless logging, using SSH keychain, for example. 19:15.240 --> 19:27.220 For detection, you need to monitor authentication logs for system and application logging failures of valid accounts. 19:27.340 --> 19:40.560 If authentication failures are high, then there might be a brute force going on to access to the systems using legitimate credentials. 19:41.700 --> 19:53.520 Also, monitor failed authentication attempts across various accounts that may result from password spray attempts. 19:53.720 --> 20:14.320 I recommend creating honeypot accounts and monitoring failed attempts in the critical host and training users to not use the same password for multiple accounts and limit credential overlap across accounts and systems. 20:17.220 --> 20:31.920 Now, for the enumeration, this type of attacks cannot be easily mitigated with preventive control since it is based on the abuse of the system features. 20:31.920 --> 20:44.020 You can monitor process and command line arguments for actions that could be taken to gather system and network information. 20:44.340 --> 20:54.960 I suggest monitoring the access to etc.passwd and etc.shadow files and log failed access attempts. 21:00.440 --> 21:13.980 If the obfuscation itself is not possible, it might be possible to detect the malicious activity that caused the obfuscated file. 21:13.980 --> 21:26.900 For example, the method that was used to write, read, or modify the file on the system. 21:27.620 --> 21:33.620 The obfuscation tools can be used to detect these indicators in payloads. 21:33.620 --> 21:41.920 Obfuscation used in payloads for initial access can be detected at the network. 21:41.920 --> 21:52.480 Use network intrusion detection systems to identify compressive and encrypted attachments and scripts. 21:52.900 --> 22:02.000 This is a difficult one, but you can use next generation endpoint security tools and monitor the possible future actions. 22:05.210 --> 22:14.050 So, to summarize, those are the general recommendations. 22:14.230 --> 22:38.990 The main problems with those security gaps were using legacy systems, default and reuse users, and passwords with a bad password policy, no monitoring of privileged accounts, and the general recommendation to avoid those security gaps. 22:39.170 --> 22:46.150 Use a patch policy and its enforcement in critical assets. 22:46.150 --> 22:48.970 Isolate the legacy systems. 22:48.970 --> 22:57.990 Use a password and user policy that includes not the file usernames with password rotation. 22:57.990 --> 23:02.930 Add those and allow users to reuse passwords. 23:03.290 --> 23:08.310 Also, enforce activity monitoring in critical assets. 23:11.030 --> 23:20.270 With all this info, do you really need to be an elite hacker to compromise those systems? 23:31.090 --> 23:37.130 From my perspective, you don't need to be an elite hacker. 23:37.130 --> 23:44.110 Some critical systems have very basic vulnerabilities with a very bad security engine. 23:44.110 --> 23:52.750 Financial entities need to enforce their security controls because the risk is real. 23:52.750 --> 23:59.770 As I showed you in the previous slides. 24:01.950 --> 24:09.870 Well, thank you very much if you reached this point in my talk. 24:09.990 --> 24:15.950 If you want to share some gags with me, this is my Twitter. 24:16.390 --> 24:21.070 Also, I want to give a shout out to all the 19th floor team. 24:21.070 --> 24:26.190 And the Q&A will be on the Redteam Village Discord. 24:26.530 --> 24:27.990 And thank you for watching.