1
00:00:07,680 --> 00:00:09,840
hello blue team village at def con 30

2
00:00:09,840 --> 00:00:12,480
attendees my name is matt sheer you may

3
00:00:12,480 --> 00:00:14,920
follow me on twitter at

4
00:00:14,920 --> 00:00:17,920
c3rkah my talk is called lend me your

5
00:00:17,920 --> 00:00:20,960
irs a slide deck is available by going

6
00:00:20,960 --> 00:00:24,000
to slides.dfirmat.com

7
00:00:24,000 --> 00:00:25,439
which will take you to my github

8
00:00:25,439 --> 00:00:27,439
repository

9
00:00:27,439 --> 00:00:29,679
what i do is i work for a big well-known

10
00:00:29,679 --> 00:00:31,920
organization as an assistant vice

11
00:00:31,920 --> 00:00:33,840
president of computer security and

12
00:00:33,840 --> 00:00:36,320
incident response however i have many

13
00:00:36,320 --> 00:00:38,399
years of hands-on technical experience

14
00:00:38,399 --> 00:00:40,640
including digital forensics and incident

15
00:00:40,640 --> 00:00:44,160
response i'm also a podcast host for

16
00:00:44,160 --> 00:00:46,160
threat reel

17
00:00:46,160 --> 00:00:48,399
where i volunteer is i am an official

18
00:00:48,399 --> 00:00:51,199
hacking is not a crime advocate i am

19
00:00:51,199 --> 00:00:53,840
also a wamsa which is the women's

20
00:00:53,840 --> 00:00:56,079
security alliance technical mentor

21
00:00:56,079 --> 00:00:57,600
please check out their websites for

22
00:00:57,600 --> 00:00:59,039
additional details on those

23
00:00:59,039 --> 00:01:01,199
organizations

24
00:01:01,199 --> 00:01:03,039
a quick disclaimer is that yes i have a

25
00:01:03,039 --> 00:01:05,760
day job however opinions expressed are

26
00:01:05,760 --> 00:01:07,520
based solely on my own independent

27
00:01:07,520 --> 00:01:09,840
security research and do not express or

28
00:01:09,840 --> 00:01:11,600
reflect the views or opinions of my

29
00:01:11,600 --> 00:01:13,360
employer

30
00:01:13,360 --> 00:01:15,200
my objectives are to show demo

31
00:01:15,200 --> 00:01:17,840
reenactments of real attacks

32
00:01:17,840 --> 00:01:20,159
how these real world attacks worked how

33
00:01:20,159 --> 00:01:23,040
and why they defeated security solutions

34
00:01:23,040 --> 00:01:24,799
and then show incident responses to

35
00:01:24,799 --> 00:01:26,400
these attacks

36
00:01:26,400 --> 00:01:28,880
demo investigation tools and techniques

37
00:01:28,880 --> 00:01:30,720
and discuss lessons learned in key

38
00:01:30,720 --> 00:01:32,640
takeaways

39
00:01:32,640 --> 00:01:34,159
just so we're all starting on the same

40
00:01:34,159 --> 00:01:36,720
page some acronyms that will be used are

41
00:01:36,720 --> 00:01:40,000
ioc or ioc which is an indicator of

42
00:01:40,000 --> 00:01:41,200
compromise

43
00:01:41,200 --> 00:01:44,560
ir which is incident response and dfir

44
00:01:44,560 --> 00:01:46,560
which is digital forensics and incident

45
00:01:46,560 --> 00:01:48,159
response

46
00:01:48,159 --> 00:01:51,840
other disclaimers demos are based on 100

47
00:01:51,840 --> 00:01:54,399
true stories these demos dutifully

48
00:01:54,399 --> 00:01:57,439
recreate actual attacks however some

49
00:01:57,439 --> 00:01:59,360
details were altered

50
00:01:59,360 --> 00:02:02,240
also investigation demos are sped up

51
00:02:02,240 --> 00:02:04,479
considerably in the interest of allotted

52
00:02:04,479 --> 00:02:06,560
presentation time

53
00:02:06,560 --> 00:02:08,639
and i will be doing demos on a live

54
00:02:08,639 --> 00:02:09,679
system

55
00:02:09,679 --> 00:02:12,160
however please pretend that's a sandbox

56
00:02:12,160 --> 00:02:14,480
because one should only perform these

57
00:02:14,480 --> 00:02:16,879
techniques in a dedicated

58
00:02:16,879 --> 00:02:19,200
and securely isolated and volatile

59
00:02:19,200 --> 00:02:20,480
sandbox

60
00:02:20,480 --> 00:02:22,800
my first scenario is called the mystery

61
00:02:22,800 --> 00:02:24,400
attachment

62
00:02:24,400 --> 00:02:26,239
let me preface this scenario by saying

63
00:02:26,239 --> 00:02:28,000
there was a news headline from august

64
00:02:28,000 --> 00:02:30,879
17th of 2018 and the headline was

65
00:02:30,879 --> 00:02:33,760
mousebam campaign targets banks using

66
00:02:33,760 --> 00:02:35,599
microsoft publisher

67
00:02:35,599 --> 00:02:37,519
this was very unusual

68
00:02:37,519 --> 00:02:40,400
not that mouseman campaigns or targeting

69
00:02:40,400 --> 00:02:42,319
banks is unusual but it was the fact

70
00:02:42,319 --> 00:02:44,080
that the threat actors were using

71
00:02:44,080 --> 00:02:46,400
microsoft publisher to deliver their

72
00:02:46,400 --> 00:02:47,599
payload

73
00:02:47,599 --> 00:02:49,440
you expect to find those type of

74
00:02:49,440 --> 00:02:52,319
payloads in microsoft word or microsoft

75
00:02:52,319 --> 00:02:53,360
excel

76
00:02:53,360 --> 00:02:55,040
things that

77
00:02:55,040 --> 00:02:57,519
can have macros you might even expect to

78
00:02:57,519 --> 00:03:00,959
see them within adobe pdf files but to

79
00:03:00,959 --> 00:03:02,720
see this distributed through microsoft

80
00:03:02,720 --> 00:03:05,760
publisher was very unusual

81
00:03:05,760 --> 00:03:07,680
the headline was the flawed amy rat was

82
00:03:07,680 --> 00:03:09,680
part of the nakur's botnet as reported

83
00:03:09,680 --> 00:03:12,720
by researchers at trustwave and there's

84
00:03:12,720 --> 00:03:15,040
a link in the slide deck to that article

85
00:03:15,040 --> 00:03:17,440
after that was released it was picked up

86
00:03:17,440 --> 00:03:21,200
by a number of other news agencies

87
00:03:21,200 --> 00:03:23,280
the following week as i'm sitting at my

88
00:03:23,280 --> 00:03:25,760
desk dutifully multitasking on a lot of

89
00:03:25,760 --> 00:03:28,480
things i had somebody run up to my desk

90
00:03:28,480 --> 00:03:30,560
and they are very anxious

91
00:03:30,560 --> 00:03:33,360
in a frantic manner they're saying matt

92
00:03:33,360 --> 00:03:34,159
help

93
00:03:34,159 --> 00:03:36,560
one of our vips with access to lots of

94
00:03:36,560 --> 00:03:38,879
very sensitive information just got hit

95
00:03:38,879 --> 00:03:40,959
in that recent mousebam campaign

96
00:03:40,959 --> 00:03:43,920
targeting banks it matches the iocs from

97
00:03:43,920 --> 00:03:46,480
reports of that new flawed amy rat which

98
00:03:46,480 --> 00:03:48,640
is part of the nikers botnet the

99
00:03:48,640 --> 00:03:50,319
recipient attempted to open the

100
00:03:50,319 --> 00:03:52,080
microsoft publisher attachment on their

101
00:03:52,080 --> 00:03:54,480
smartphone i need you to drop whatever

102
00:03:54,480 --> 00:03:56,959
you are doing and investigate this we'll

103
00:03:56,959 --> 00:03:59,760
get you the attachment asap

104
00:03:59,760 --> 00:04:01,920
in this instance i'm not particularly

105
00:04:01,920 --> 00:04:03,760
the best mobile

106
00:04:03,760 --> 00:04:06,640
forensics person or the most best mobile

107
00:04:06,640 --> 00:04:08,239
incident responder

108
00:04:08,239 --> 00:04:10,560
but there really wasn't anybody else

109
00:04:10,560 --> 00:04:13,120
qualified to look at it so i agreed that

110
00:04:13,120 --> 00:04:15,200
i would be happy to do it

111
00:04:15,200 --> 00:04:16,880
and

112
00:04:16,880 --> 00:04:19,839
when i first came up to my desk i'm

113
00:04:19,839 --> 00:04:21,759
really focused on thinking through what

114
00:04:21,759 --> 00:04:23,199
i'm going to do with the investigation

115
00:04:23,199 --> 00:04:24,880
because they stood there and continued

116
00:04:24,880 --> 00:04:26,160
talking

117
00:04:26,160 --> 00:04:27,199
really

118
00:04:27,199 --> 00:04:29,680
they sort of got me amped up and worked

119
00:04:29,680 --> 00:04:30,400
up

120
00:04:30,400 --> 00:04:33,280
because of their anxiety

121
00:04:33,280 --> 00:04:35,120
so to talk through the investigation of

122
00:04:35,120 --> 00:04:36,800
this scenario we're going to open up the

123
00:04:36,800 --> 00:04:40,320
file in the sandbox now in my case i'm

124
00:04:40,320 --> 00:04:42,880
doing this on a live linux system i do

125
00:04:42,880 --> 00:04:45,040
not have microsoft publisher available

126
00:04:45,040 --> 00:04:47,120
to me so i'm going to open the file

127
00:04:47,120 --> 00:04:49,600
inside of libreoffice draw and for our

128
00:04:49,600 --> 00:04:51,840
purposes we'll just have to pretend that

129
00:04:51,840 --> 00:04:53,919
is the professional sandbox that has

130
00:04:53,919 --> 00:04:56,639
microsoft publisher in it i'm going to

131
00:04:56,639 --> 00:04:59,199
do a strings demo

132
00:04:59,199 --> 00:05:01,759
and then i'm going to hash the file and

133
00:05:01,759 --> 00:05:02,880
show

134
00:05:02,880 --> 00:05:05,199
everyone what the search look like

135
00:05:05,199 --> 00:05:07,280
now that's a very small snippet i

136
00:05:07,280 --> 00:05:09,360
actually spent a lot of time

137
00:05:09,360 --> 00:05:11,440
investigating researching and reading

138
00:05:11,440 --> 00:05:12,400
about

139
00:05:12,400 --> 00:05:15,039
flawed amy reading about and occurs

140
00:05:15,039 --> 00:05:16,400
looking for

141
00:05:16,400 --> 00:05:19,360
indicators to compromise looking for any

142
00:05:19,360 --> 00:05:21,440
details that would help explain what

143
00:05:21,440 --> 00:05:24,240
this does and how it works and then

144
00:05:24,240 --> 00:05:26,560
finally i will take a look at the exit

145
00:05:26,560 --> 00:05:29,360
data and demo that as i ponder my next

146
00:05:29,360 --> 00:05:31,759
steps

147
00:05:31,840 --> 00:05:34,400
so let's go and take a look at the file

148
00:05:34,400 --> 00:05:37,440
again this is inside of libreoffice draw

149
00:05:37,440 --> 00:05:39,120
in microsoft publisher i couldn't

150
00:05:39,120 --> 00:05:41,680
actually find where the macros were at

151
00:05:41,680 --> 00:05:44,080
and i myself never use microsoft

152
00:05:44,080 --> 00:05:46,880
publisher so i was a little lost

153
00:05:46,880 --> 00:05:48,720
what was interesting though is the

154
00:05:48,720 --> 00:05:50,720
publisher file itself sort of looked

155
00:05:50,720 --> 00:05:52,479
like this it came up and stated that

156
00:05:52,479 --> 00:05:54,639
macros had to be enabled to display the

157
00:05:54,639 --> 00:05:57,039
contents of the document and i had an

158
00:05:57,039 --> 00:05:59,759
instruction to clip click on the enable

159
00:05:59,759 --> 00:06:01,280
content button

160
00:06:01,280 --> 00:06:03,520
in my situation i could never get the

161
00:06:03,520 --> 00:06:07,199
enable content button to essentially pop

162
00:06:07,199 --> 00:06:09,440
up i couldn't find the macros in the

163
00:06:09,440 --> 00:06:11,360
file and

164
00:06:11,360 --> 00:06:12,800
when the

165
00:06:12,800 --> 00:06:15,199
analysis was complete in the sandbox it

166
00:06:15,199 --> 00:06:17,280
actually gave the file a relatively

167
00:06:17,280 --> 00:06:19,440
clean bill of health it did not detect

168
00:06:19,440 --> 00:06:21,360
anything malicious about it which i

169
00:06:21,360 --> 00:06:24,800
thought was highly unusual especially

170
00:06:24,800 --> 00:06:27,120
given what i was looking at

171
00:06:27,120 --> 00:06:29,360
so i wanted to do a little bit more

172
00:06:29,360 --> 00:06:30,960
research on it

173
00:06:30,960 --> 00:06:32,800
one thing i like to do as well is just

174
00:06:32,800 --> 00:06:35,120
to see if there's anything hidden

175
00:06:35,120 --> 00:06:37,360
in the file that i don't know about

176
00:06:37,360 --> 00:06:39,360
so what the strings command will do is

177
00:06:39,360 --> 00:06:40,960
the strings command will essentially

178
00:06:40,960 --> 00:06:43,360
pull human readable text out of any

179
00:06:43,360 --> 00:06:45,680
particular file now what i like to do

180
00:06:45,680 --> 00:06:47,680
personally is i like to pipe out the

181
00:06:47,680 --> 00:06:50,720
strings command into the less command

182
00:06:50,720 --> 00:06:52,960
that way when i run it i can essentially

183
00:06:52,960 --> 00:06:54,880
arrow up and down and navigate through

184
00:06:54,880 --> 00:06:57,680
the file without everything scrolling by

185
00:06:57,680 --> 00:07:00,160
past my ability to read it and at the

186
00:07:00,160 --> 00:07:03,360
top there's some interesting things here

187
00:07:03,360 --> 00:07:06,080
as i did research i found out these

188
00:07:06,080 --> 00:07:08,479
look very much in place for what you

189
00:07:08,479 --> 00:07:10,560
would expect for a genuine microsoft

190
00:07:10,560 --> 00:07:12,160
publisher file

191
00:07:12,160 --> 00:07:14,720
i did arrow down and read through a

192
00:07:14,720 --> 00:07:16,080
whole lot of stuff i didn't find

193
00:07:16,080 --> 00:07:17,680
anything particularly interesting about

194
00:07:17,680 --> 00:07:20,560
the file i was analyzing

195
00:07:20,560 --> 00:07:21,520
so

196
00:07:21,520 --> 00:07:23,360
what i wanted to do next was essentially

197
00:07:23,360 --> 00:07:25,919
hash the file in my case

198
00:07:25,919 --> 00:07:29,759
all of our tools used shaw 256 which is

199
00:07:29,759 --> 00:07:32,080
something i was comfortable with

200
00:07:32,080 --> 00:07:34,720
gathering and then looking within our

201
00:07:34,720 --> 00:07:37,199
security toolkits

202
00:07:37,199 --> 00:07:38,960
when you're looking for malware and

203
00:07:38,960 --> 00:07:41,199
looking for known samples md5 is

204
00:07:41,199 --> 00:07:42,880
probably sufficient

205
00:07:42,880 --> 00:07:44,639
if

206
00:07:44,639 --> 00:07:46,800
you have md5 in your environment and

207
00:07:46,800 --> 00:07:49,120
that's the preferred hashing algorithm

208
00:07:49,120 --> 00:07:51,039
that's probably what you want to use in

209
00:07:51,039 --> 00:07:53,199
our case it was shaw256

210
00:07:53,199 --> 00:07:54,800
but you can essentially do that either

211
00:07:54,800 --> 00:07:55,680
way

212
00:07:55,680 --> 00:07:58,080
so i run that command i'm able to get a

213
00:07:58,080 --> 00:08:00,720
hash value for the particular file

214
00:08:00,720 --> 00:08:03,919
and essentially search on that if i did

215
00:08:03,919 --> 00:08:07,039
want to run the md5 sum i can do that as

216
00:08:07,039 --> 00:08:09,039
well

217
00:08:09,039 --> 00:08:12,400
and get the results for that

218
00:08:12,400 --> 00:08:15,120
so what i did when i had the hash is i

219
00:08:15,120 --> 00:08:16,800
started searching for it and of course

220
00:08:16,800 --> 00:08:18,800
one of the first go-to places for me

221
00:08:18,800 --> 00:08:21,520
personally was virustotal

222
00:08:21,520 --> 00:08:23,759
and it may be difficult to read but in

223
00:08:23,759 --> 00:08:26,240
the address field of the browser you can

224
00:08:26,240 --> 00:08:27,599
actually see

225
00:08:27,599 --> 00:08:30,400
the hash value in there

226
00:08:30,400 --> 00:08:32,240
in this case no match is found on

227
00:08:32,240 --> 00:08:34,399
virustotal which i thought was unusual

228
00:08:34,399 --> 00:08:36,640
because virustotal gets an awful lot of

229
00:08:36,640 --> 00:08:38,640
samples

230
00:08:38,640 --> 00:08:41,279
jotty maurer scan is uh doesn't have as

231
00:08:41,279 --> 00:08:43,919
many scan engines as virus total but

232
00:08:43,919 --> 00:08:46,480
it's a similar type of uh

233
00:08:46,480 --> 00:08:48,880
solution and when i looked out there

234
00:08:48,880 --> 00:08:51,519
again i found nothing of interest or

235
00:08:51,519 --> 00:08:52,720
value

236
00:08:52,720 --> 00:08:54,320
you can see the hash file there and you

237
00:08:54,320 --> 00:08:56,880
can see the hash was not found

238
00:08:56,880 --> 00:09:00,080
so i went into hybrid analysis and again

239
00:09:00,080 --> 00:09:03,040
no results for the engine while querying

240
00:09:03,040 --> 00:09:05,519
the hash value

241
00:09:05,519 --> 00:09:07,600
and finally i just actually did a google

242
00:09:07,600 --> 00:09:09,519
search just to see if anything at all

243
00:09:09,519 --> 00:09:11,440
would come back and it really came back

244
00:09:11,440 --> 00:09:14,880
that no documents nothing was matched so

245
00:09:14,880 --> 00:09:17,279
i wasn't quite sure exactly

246
00:09:17,279 --> 00:09:20,880
what i wanted to do next at that point

247
00:09:20,880 --> 00:09:22,959
again i spent a lot of time researching

248
00:09:22,959 --> 00:09:26,080
things and so forth uh

249
00:09:26,080 --> 00:09:27,200
and then

250
00:09:27,200 --> 00:09:30,480
i'm thinking well this mobile device

251
00:09:30,480 --> 00:09:31,279
it's

252
00:09:31,279 --> 00:09:33,120
sort of at risk

253
00:09:33,120 --> 00:09:35,360
is this something that we want to get

254
00:09:35,360 --> 00:09:37,360
from the end user

255
00:09:37,360 --> 00:09:38,880
and essentially

256
00:09:38,880 --> 00:09:41,040
what do we do with it is it sufficient

257
00:09:41,040 --> 00:09:44,720
to do a security wipe on the device and

258
00:09:44,720 --> 00:09:46,800
give it back to the user

259
00:09:46,800 --> 00:09:50,480
do we confiscate this thing

260
00:09:50,480 --> 00:09:53,120
what exactly is a good course of action

261
00:09:53,120 --> 00:09:54,560
i didn't feel

262
00:09:54,560 --> 00:09:57,680
that uh essentially saying well

263
00:09:57,680 --> 00:09:59,200
the chances microsoft publisher

264
00:09:59,200 --> 00:10:03,120
infecting an iphone are small that just

265
00:10:03,120 --> 00:10:05,760
wasn't acceptable level of risk i also

266
00:10:05,760 --> 00:10:08,000
wasn't sure i was even comfortable with

267
00:10:08,000 --> 00:10:08,959
the

268
00:10:08,959 --> 00:10:10,560
risk of

269
00:10:10,560 --> 00:10:12,320
wiping the device and letting the user

270
00:10:12,320 --> 00:10:14,399
have it back in fact i can tell you that

271
00:10:14,399 --> 00:10:17,519
i wasn't comfortable with that at all

272
00:10:17,519 --> 00:10:21,680
and so another thought i had was

273
00:10:21,680 --> 00:10:24,160
let me look into it this particular user

274
00:10:24,160 --> 00:10:27,360
was not due for a device refresh yet

275
00:10:27,360 --> 00:10:28,320
and

276
00:10:28,320 --> 00:10:31,040
but they were very close to it so

277
00:10:31,040 --> 00:10:33,519
i was almost thinking well perhaps we

278
00:10:33,519 --> 00:10:35,839
can confiscate the device

279
00:10:35,839 --> 00:10:37,600
shut it down

280
00:10:37,600 --> 00:10:39,839
and then put it in our forensics lab and

281
00:10:39,839 --> 00:10:41,920
then get this individual new device

282
00:10:41,920 --> 00:10:43,920
issued they were close enough to the

283
00:10:43,920 --> 00:10:45,360
date where we definitely could have

284
00:10:45,360 --> 00:10:46,959
justified that

285
00:10:46,959 --> 00:10:48,800
as i'm thinking through these and other

286
00:10:48,800 --> 00:10:50,399
thoughts and spending time research i

287
00:10:50,399 --> 00:10:52,079
thought well this is sort of silly but i

288
00:10:52,079 --> 00:10:54,160
actually have not looked at the exif

289
00:10:54,160 --> 00:10:56,720
data for the file now in windows that's

290
00:10:56,720 --> 00:10:58,800
simply right clicking in the file going

291
00:10:58,800 --> 00:11:00,480
into the properties and drilling into

292
00:11:00,480 --> 00:11:02,240
the details to see what you can learn

293
00:11:02,240 --> 00:11:04,399
about it you always have to take exit

294
00:11:04,399 --> 00:11:06,959
data with a grain of salt though because

295
00:11:06,959 --> 00:11:09,760
exit data can be spoofed

296
00:11:09,760 --> 00:11:11,040
and so

297
00:11:11,040 --> 00:11:13,600
it's not perfectly reliable but i

298
00:11:13,600 --> 00:11:16,640
thought well maybe there's another

299
00:11:16,640 --> 00:11:18,880
artifact i can find in exit data that

300
00:11:18,880 --> 00:11:20,560
will tell me something interesting about

301
00:11:20,560 --> 00:11:23,200
the file so let me go back to my command

302
00:11:23,200 --> 00:11:24,640
prompt let me go ahead and clear the

303
00:11:24,640 --> 00:11:26,480
screen

304
00:11:26,480 --> 00:11:28,720
and in my case since i'm on linux i'm

305
00:11:28,720 --> 00:11:31,279
going to run the plural exit tool

306
00:11:31,279 --> 00:11:35,360
on this particular publisher file

307
00:11:35,600 --> 00:11:37,279
and when i do that

308
00:11:37,279 --> 00:11:39,360
some interesting information i have the

309
00:11:39,360 --> 00:11:42,560
file name at the top i can see the date

310
00:11:42,560 --> 00:11:45,360
time stamps and so forth uh this was

311
00:11:45,360 --> 00:11:47,120
interesting the file type and file

312
00:11:47,120 --> 00:11:49,040
extension

313
00:11:49,040 --> 00:11:51,040
fpx not something i'd really seen before

314
00:11:51,040 --> 00:11:52,320
but then again i'd never really looked

315
00:11:52,320 --> 00:11:54,959
at publisher files before my research

316
00:11:54,959 --> 00:11:57,120
told me that those were legitimate

317
00:11:57,120 --> 00:12:00,240
things that you expect to find uh

318
00:12:00,240 --> 00:12:01,519
within a

319
00:12:01,519 --> 00:12:04,720
publisher file the mime type image

320
00:12:04,720 --> 00:12:06,480
vnd.fpx

321
00:12:06,480 --> 00:12:09,120
and then the

322
00:12:09,120 --> 00:12:11,120
later on you see that it is microsoft

323
00:12:11,120 --> 00:12:13,279
publisher i get to the author and it

324
00:12:13,279 --> 00:12:16,639
didn't exactly say test fish it wasn't

325
00:12:16,639 --> 00:12:18,560
quite that blatant but let's go ahead

326
00:12:18,560 --> 00:12:21,200
and talk about what it was uh really for

327
00:12:21,200 --> 00:12:23,760
me personally it was a face palm moment

328
00:12:23,760 --> 00:12:25,519
just simply realizing that the email

329
00:12:25,519 --> 00:12:27,200
attachment i spent all this time

330
00:12:27,200 --> 00:12:29,760
analyzing actually came from our test

331
00:12:29,760 --> 00:12:32,240
fishing vendor now i said the exit data

332
00:12:32,240 --> 00:12:34,399
can be spoofed and that is true so i

333
00:12:34,399 --> 00:12:38,160
didn't just accept that as definitive

334
00:12:38,160 --> 00:12:40,720
what i did do though is i went through

335
00:12:40,720 --> 00:12:43,839
and i looked at our email system and i

336
00:12:43,839 --> 00:12:45,920
double checked the message headers and

337
00:12:45,920 --> 00:12:48,720
they were what i expected

338
00:12:48,720 --> 00:12:51,600
it came from the ip address associated

339
00:12:51,600 --> 00:12:53,839
with our test phishing vendor

340
00:12:53,839 --> 00:12:56,160
mail servers uh of course when i'm

341
00:12:56,160 --> 00:12:58,560
looking at it i'm reading yes matt this

342
00:12:58,560 --> 00:13:00,399
really is your test fishing vendor's ip

343
00:13:00,399 --> 00:13:02,000
address you don't

344
00:13:02,000 --> 00:13:03,600
it's okay if you want to laugh at my

345
00:13:03,600 --> 00:13:06,720
pain this was a definite painful lesson

346
00:13:06,720 --> 00:13:07,920
learned

347
00:13:07,920 --> 00:13:10,000
in this particular case

348
00:13:10,000 --> 00:13:12,079
but uh

349
00:13:12,079 --> 00:13:13,839
what went wrong in my case is i got

350
00:13:13,839 --> 00:13:14,959
caught up in the moment by

351
00:13:14,959 --> 00:13:16,880
subconsciously letting somebody else

352
00:13:16,880 --> 00:13:18,959
influence my investigation

353
00:13:18,959 --> 00:13:20,880
so their anxiety and bad assumptions

354
00:13:20,880 --> 00:13:22,320
were off on me

355
00:13:22,320 --> 00:13:24,639
one should always start with the message

356
00:13:24,639 --> 00:13:27,279
headers when they're conducting uh

357
00:13:27,279 --> 00:13:29,680
an investigation of a phishing email and

358
00:13:29,680 --> 00:13:33,040
the contents and ironically i've given

359
00:13:33,040 --> 00:13:35,440
talks on phishing forensics and i've

360
00:13:35,440 --> 00:13:37,519
always always always stated to start

361
00:13:37,519 --> 00:13:39,600
with the message headers but this one

362
00:13:39,600 --> 00:13:41,519
time i got tunnel visioned on the

363
00:13:41,519 --> 00:13:44,079
attachment and so i abandoned my own

364
00:13:44,079 --> 00:13:46,480
standards this one time by focusing on

365
00:13:46,480 --> 00:13:48,880
the attachment first and it really came

366
00:13:48,880 --> 00:13:50,800
back to bite me

367
00:13:50,800 --> 00:13:52,480
in this case there really were no

368
00:13:52,480 --> 00:13:54,959
remediation steps as it was

369
00:13:54,959 --> 00:13:57,279
what you might consider a false alarm

370
00:13:57,279 --> 00:13:59,680
the road to redemption in this case were

371
00:13:59,680 --> 00:14:02,000
painful lessons learned for my reminders

372
00:14:02,000 --> 00:14:03,920
to stick to my standard investigative

373
00:14:03,920 --> 00:14:06,240
processes and procedures if i had

374
00:14:06,240 --> 00:14:08,320
started my investigation by inspecting

375
00:14:08,320 --> 00:14:10,639
the message headers first i could have

376
00:14:10,639 --> 00:14:12,560
closed out the investigation in minutes

377
00:14:12,560 --> 00:14:14,160
instead of hours

378
00:14:14,160 --> 00:14:16,880
and then in this particular instance no

379
00:14:16,880 --> 00:14:20,160
further technical actions were required

380
00:14:20,160 --> 00:14:22,399
my second scenario is called security

381
00:14:22,399 --> 00:14:24,480
scanner evasion

382
00:14:24,480 --> 00:14:26,240
i'd like to preface this scenario by

383
00:14:26,240 --> 00:14:28,240
stating that there were identical

384
00:14:28,240 --> 00:14:30,399
phishing emails and they started hitting

385
00:14:30,399 --> 00:14:31,680
inboxes

386
00:14:31,680 --> 00:14:33,279
we were actually getting wide scale

387
00:14:33,279 --> 00:14:35,440
reports of phishing

388
00:14:35,440 --> 00:14:36,240
and

389
00:14:36,240 --> 00:14:38,320
the link what was interesting about the

390
00:14:38,320 --> 00:14:40,320
link is when i looked at it in a

391
00:14:40,320 --> 00:14:42,720
security scanner tool is it appeared

392
00:14:42,720 --> 00:14:45,440
that the page was already offline

393
00:14:45,440 --> 00:14:47,440
if that were truly the case then it

394
00:14:47,440 --> 00:14:48,880
might be a situation where it was

395
00:14:48,880 --> 00:14:51,440
nothing to worry about i wasn't quite

396
00:14:51,440 --> 00:14:53,600
ready to accept that at face value so

397
00:14:53,600 --> 00:14:55,600
let's go ahead and investigate this and

398
00:14:55,600 --> 00:14:56,959
find out

399
00:14:56,959 --> 00:14:57,920
what we're going to do for our

400
00:14:57,920 --> 00:14:59,360
investigation is we're going to take a

401
00:14:59,360 --> 00:15:01,839
look at the email message and the source

402
00:15:01,839 --> 00:15:04,639
code we're going to note any hyperlinks

403
00:15:04,639 --> 00:15:06,720
and then we're going to check out the

404
00:15:06,720 --> 00:15:09,360
landing page with our security scanner

405
00:15:09,360 --> 00:15:11,680
and that's something i'm just sort of

406
00:15:11,680 --> 00:15:13,199
simulating here

407
00:15:13,199 --> 00:15:14,399
uh then we're going to take a look at

408
00:15:14,399 --> 00:15:16,639
the landing page source code and then

409
00:15:16,639 --> 00:15:18,079
finally we're going to open up the

410
00:15:18,079 --> 00:15:21,600
phishing page in a sandbox and again i'm

411
00:15:21,600 --> 00:15:24,880
on my local machine here doing demos

412
00:15:24,880 --> 00:15:27,360
so this is going to be a simulated uh

413
00:15:27,360 --> 00:15:29,680
pretend sandbox if you will let's go and

414
00:15:29,680 --> 00:15:32,240
take a look at the email message itself

415
00:15:32,240 --> 00:15:35,360
and so here's a sample email message um

416
00:15:35,360 --> 00:15:38,240
and so the from field in this particular

417
00:15:38,240 --> 00:15:41,519
one i've called it from evil dot scammer

418
00:15:41,519 --> 00:15:43,920
promise we are legit dot com

419
00:15:43,920 --> 00:15:46,560
the subject in this email message is

420
00:15:46,560 --> 00:15:49,199
this link is totally safe

421
00:15:49,199 --> 00:15:51,759
and in this case it's coming to phishing

422
00:15:51,759 --> 00:15:54,160
target which is unwitting.victim

423
00:15:54,160 --> 00:15:57,120
randomtarget.org

424
00:15:57,120 --> 00:15:58,800
email message simply reads hello

425
00:15:58,800 --> 00:16:00,720
phishingtarget we have a really

426
00:16:00,720 --> 00:16:02,720
important message for you to retrieve

427
00:16:02,720 --> 00:16:05,920
your message click here and that's not

428
00:16:05,920 --> 00:16:08,560
real subtle it stands out about as much

429
00:16:08,560 --> 00:16:11,279
as it could possibly stand out regards

430
00:16:11,279 --> 00:16:13,440
spoof sender now i've had a lot of

431
00:16:13,440 --> 00:16:15,279
people ask me matt have you actually

432
00:16:15,279 --> 00:16:18,560
used this as a test fishing template

433
00:16:18,560 --> 00:16:21,680
to do phishing testing for user

434
00:16:21,680 --> 00:16:23,839
educational purposes and the answer is

435
00:16:23,839 --> 00:16:25,360
no

436
00:16:25,360 --> 00:16:27,120
and part of that is i'm not sure i

437
00:16:27,120 --> 00:16:29,120
really want to know because my deepest

438
00:16:29,120 --> 00:16:30,720
fear is there's still going to be that

439
00:16:30,720 --> 00:16:33,279
one person in the organization that's

440
00:16:33,279 --> 00:16:34,880
still going to be gullible enough to

441
00:16:34,880 --> 00:16:37,279
actually click on this hyperlink

442
00:16:37,279 --> 00:16:39,360
and so even though there's more red

443
00:16:39,360 --> 00:16:41,279
flags in this particular email than

444
00:16:41,279 --> 00:16:43,920
vladimir putin has in his garages

445
00:16:43,920 --> 00:16:46,800
souvenirs from his old kgb days my fear

446
00:16:46,800 --> 00:16:48,480
is somebody would still actually click

447
00:16:48,480 --> 00:16:49,440
on it

448
00:16:49,440 --> 00:16:50,800
in this case

449
00:16:50,800 --> 00:16:52,880
a lot of people will tell you to hover

450
00:16:52,880 --> 00:16:55,839
over to get the hyperlink in an email

451
00:16:55,839 --> 00:16:56,959
message

452
00:16:56,959 --> 00:16:58,480
i don't like to do that for a couple

453
00:16:58,480 --> 00:17:00,560
reasons one is you might accidentally

454
00:17:00,560 --> 00:17:03,519
click on the link and two i'm just sort

455
00:17:03,519 --> 00:17:06,079
of leery back in the distant past there

456
00:17:06,079 --> 00:17:08,720
used to be some issues with certain male

457
00:17:08,720 --> 00:17:12,000
clients and webmail where javascript

458
00:17:12,000 --> 00:17:14,559
might run on a mouse over or

459
00:17:14,559 --> 00:17:18,079
uh and on hover that kind of thing so uh

460
00:17:18,079 --> 00:17:20,319
i tend to go the extra cautious route

461
00:17:20,319 --> 00:17:22,799
and i'm going to go ahead and

462
00:17:22,799 --> 00:17:25,199
come in here into the view menu and pull

463
00:17:25,199 --> 00:17:27,039
up the message source

464
00:17:27,039 --> 00:17:28,559
i'll make this a little bit bigger so

465
00:17:28,559 --> 00:17:30,559
it's not such an eye chart to try and

466
00:17:30,559 --> 00:17:31,520
read

467
00:17:31,520 --> 00:17:34,080
and what i like to do in an email

468
00:17:34,080 --> 00:17:37,280
message is if i just do a search a text

469
00:17:37,280 --> 00:17:39,360
search for http

470
00:17:39,360 --> 00:17:40,880
i'm generally going to find what i'm

471
00:17:40,880 --> 00:17:42,480
looking for

472
00:17:42,480 --> 00:17:45,440
in this case i have one result and it

473
00:17:45,440 --> 00:17:48,080
found my hyperlink and so i'm going to

474
00:17:48,080 --> 00:17:50,960
go ahead and copy this particular link

475
00:17:50,960 --> 00:17:53,120
and see what we have

476
00:17:53,120 --> 00:17:56,880
and let me go back to my command line

477
00:17:56,880 --> 00:17:58,400
and there's a couple things that we can

478
00:17:58,400 --> 00:18:02,480
do to obtain the source code for this

479
00:18:02,480 --> 00:18:04,799
before i do that let me go ahead and

480
00:18:04,799 --> 00:18:07,200
show what it actually looks like inside

481
00:18:07,200 --> 00:18:08,480
of my

482
00:18:08,480 --> 00:18:09,919
test sandbox

483
00:18:09,919 --> 00:18:12,080
so if i open up the page

484
00:18:12,080 --> 00:18:13,600
i get what appears to be a normal

485
00:18:13,600 --> 00:18:16,160
looking 404 page saying that the file or

486
00:18:16,160 --> 00:18:18,480
the directory is not found if this were

487
00:18:18,480 --> 00:18:20,480
truly the case it could be a situation

488
00:18:20,480 --> 00:18:22,799
where this has already been cleaned up

489
00:18:22,799 --> 00:18:24,480
and there's nothing to worry about

490
00:18:24,480 --> 00:18:26,160
because it would appear that the

491
00:18:26,160 --> 00:18:28,559
malicious site is offline

492
00:18:28,559 --> 00:18:30,240
not wanting to take that at face value

493
00:18:30,240 --> 00:18:31,840
there's a couple ways we can look at the

494
00:18:31,840 --> 00:18:33,679
source code for that

495
00:18:33,679 --> 00:18:36,080
one of them is we can use the curl

496
00:18:36,080 --> 00:18:37,200
command

497
00:18:37,200 --> 00:18:40,080
and we can paste in the address

498
00:18:40,080 --> 00:18:42,799
and i can output the results to a file

499
00:18:42,799 --> 00:18:46,000
of my choosing so for output

500
00:18:46,000 --> 00:18:47,280
let me go ahead and call this something

501
00:18:47,280 --> 00:18:49,039
like first page

502
00:18:49,039 --> 00:18:50,799
i'm sorry let me go ahead and call this

503
00:18:50,799 --> 00:18:52,080
unknown

504
00:18:52,080 --> 00:18:54,400
dot html

505
00:18:54,400 --> 00:18:56,559
and it retrieves the file

506
00:18:56,559 --> 00:18:59,520
um there's other ways to do this uh if

507
00:18:59,520 --> 00:19:01,520
you don't have curl available on the

508
00:19:01,520 --> 00:19:03,919
system you could always try wget and see

509
00:19:03,919 --> 00:19:06,480
if wget is installed and with that i'm

510
00:19:06,480 --> 00:19:08,160
gonna go ahead and re-paste the address

511
00:19:08,160 --> 00:19:10,400
in here it's going to retrieve the file

512
00:19:10,400 --> 00:19:11,600
for me

513
00:19:11,600 --> 00:19:14,320
this case let me clear off this stuff

514
00:19:14,320 --> 00:19:16,720
and so i've retrieved the file a couple

515
00:19:16,720 --> 00:19:19,360
different ways

516
00:19:19,360 --> 00:19:22,960
forensically it doesn't gonna make a big

517
00:19:22,960 --> 00:19:26,080
difference which way i use

518
00:19:26,080 --> 00:19:28,400
to prove that let me go ahead and take a

519
00:19:28,400 --> 00:19:31,200
look at the html files in here now we've

520
00:19:31,200 --> 00:19:33,440
got different names based on how i

521
00:19:33,440 --> 00:19:36,480
uh output those results but what we can

522
00:19:36,480 --> 00:19:40,320
tell is that roughly we have the same

523
00:19:40,320 --> 00:19:43,120
file byte size on these now one thing

524
00:19:43,120 --> 00:19:45,440
it's an artifact of demoing this on a

525
00:19:45,440 --> 00:19:47,520
local system that's running a local web

526
00:19:47,520 --> 00:19:51,280
server is that the wget actually retains

527
00:19:51,280 --> 00:19:54,720
the original date that that was created

528
00:19:54,720 --> 00:19:58,240
uh that's really just an artifact of uh

529
00:19:58,240 --> 00:20:00,480
the fact that it's on a local system

530
00:20:00,480 --> 00:20:03,120
typically when you run wget on line

531
00:20:03,120 --> 00:20:05,520
you're going to get the current time

532
00:20:05,520 --> 00:20:07,760
when it was retrieved just like my curl

533
00:20:07,760 --> 00:20:09,600
output here but you can see that we

534
00:20:09,600 --> 00:20:12,400
definitely have the same file sizes and

535
00:20:12,400 --> 00:20:14,960
again just to prove that these really

536
00:20:14,960 --> 00:20:16,880
are the same file

537
00:20:16,880 --> 00:20:19,280
i'm going to go ahead and run a sha-256

538
00:20:19,280 --> 00:20:22,480
sum on all of the

539
00:20:22,480 --> 00:20:25,360
html files in here and what we can see

540
00:20:25,360 --> 00:20:27,840
is it doesn't matter if we use curl or

541
00:20:27,840 --> 00:20:29,919
if we use w get

542
00:20:29,919 --> 00:20:32,840
these results really are

543
00:20:32,840 --> 00:20:35,120
identical and so

544
00:20:35,120 --> 00:20:37,520
what we want to do is actually take a

545
00:20:37,520 --> 00:20:38,880
look at these

546
00:20:38,880 --> 00:20:40,640
one of these files

547
00:20:40,640 --> 00:20:42,640
so let me just go ahead and pop up one

548
00:20:42,640 --> 00:20:48,039
of these inside of a text editor here

549
00:20:49,919 --> 00:20:51,919
and it doesn't really matter which text

550
00:20:51,919 --> 00:20:54,400
editor you use i'm just using something

551
00:20:54,400 --> 00:20:56,640
that's simple that i can

552
00:20:56,640 --> 00:20:58,799
make bigger that hopefully isn't too

553
00:20:58,799 --> 00:21:01,360
difficult to read on screen now whether

554
00:21:01,360 --> 00:21:04,159
you can actually read the javascript or

555
00:21:04,159 --> 00:21:06,720
not i'm going to explain how this works

556
00:21:06,720 --> 00:21:09,039
so here at the top we have our standard

557
00:21:09,039 --> 00:21:10,720
html file

558
00:21:10,720 --> 00:21:12,960
it's declaring script and in this case

559
00:21:12,960 --> 00:21:15,360
it's going to be javascript

560
00:21:15,360 --> 00:21:17,840
and what we start seeing is we see

561
00:21:17,840 --> 00:21:20,480
an if else

562
00:21:20,480 --> 00:21:21,840
loop

563
00:21:21,840 --> 00:21:25,120
and so what it's looking for is

564
00:21:25,120 --> 00:21:28,720
user agents so navigator.useragent

565
00:21:28,720 --> 00:21:30,400
and so we see things that should be

566
00:21:30,400 --> 00:21:32,640
recognizable here

567
00:21:32,640 --> 00:21:35,760
and so this one in particular is chrome

568
00:21:35,760 --> 00:21:36,960
and

569
00:21:36,960 --> 00:21:38,960
what we see is

570
00:21:38,960 --> 00:21:41,600
it's doing an if if it's chrome then

571
00:21:41,600 --> 00:21:43,840
replace the window location or in other

572
00:21:43,840 --> 00:21:46,240
words redirect the traffic to another

573
00:21:46,240 --> 00:21:47,280
page

574
00:21:47,280 --> 00:21:49,600
and we have near identical code except

575
00:21:49,600 --> 00:21:52,000
down here we're looking at microsoft

576
00:21:52,000 --> 00:21:54,320
edge we're looking at firefox we're

577
00:21:54,320 --> 00:21:57,039
looking at microsoft internet explorer

578
00:21:57,039 --> 00:22:00,240
the opera web browser and the safari web

579
00:22:00,240 --> 00:22:02,000
browser

580
00:22:02,000 --> 00:22:04,480
and so we have all these different if

581
00:22:04,480 --> 00:22:05,840
statements

582
00:22:05,840 --> 00:22:08,720
and then down here we have our final

583
00:22:08,720 --> 00:22:12,080
else so if none of these things matched

584
00:22:12,080 --> 00:22:13,840
then it should replace the window

585
00:22:13,840 --> 00:22:17,039
location with a 404 page

586
00:22:17,039 --> 00:22:20,320
now that's interesting because these

587
00:22:20,320 --> 00:22:23,280
are really all of the common web

588
00:22:23,280 --> 00:22:26,159
browsers that most systems would tend to

589
00:22:26,159 --> 00:22:30,080
have so in other words if a visitor is

590
00:22:30,080 --> 00:22:32,320
going to a website using a popular web

591
00:22:32,320 --> 00:22:34,880
browser it's going to send the traffic

592
00:22:34,880 --> 00:22:37,600
one place and if it doesn't match any of

593
00:22:37,600 --> 00:22:39,840
that it's sending it to this 404 page

594
00:22:39,840 --> 00:22:42,000
and if you remember from our security

595
00:22:42,000 --> 00:22:45,360
scanner demo that what we had was in

596
00:22:45,360 --> 00:22:47,919
fact a 404 page

597
00:22:47,919 --> 00:22:49,360
and so

598
00:22:49,360 --> 00:22:51,120
it's interesting because the result

599
00:22:51,120 --> 00:22:53,520
doesn't necessarily match what has been

600
00:22:53,520 --> 00:22:56,880
hidden underneath the scenes down here

601
00:22:56,880 --> 00:22:58,480
so

602
00:22:58,480 --> 00:23:01,440
this tells us an awful lot and to give

603
00:23:01,440 --> 00:23:03,840
everybody an idea of what this actually

604
00:23:03,840 --> 00:23:06,159
looks like if we open up the web page in

605
00:23:06,159 --> 00:23:07,360
a browser

606
00:23:07,360 --> 00:23:10,240
google actually tells us hey this looks

607
00:23:10,240 --> 00:23:12,960
somewhat sketchy and when i pull it up

608
00:23:12,960 --> 00:23:14,080
here

609
00:23:14,080 --> 00:23:15,840
what i get is

610
00:23:15,840 --> 00:23:19,039
what very much appears to be a typical

611
00:23:19,039 --> 00:23:22,960
microsoft office 365 type of login so we

612
00:23:22,960 --> 00:23:25,280
can actually see what's happening when

613
00:23:25,280 --> 00:23:27,760
the site is visited by a common web

614
00:23:27,760 --> 00:23:29,039
browser

615
00:23:29,039 --> 00:23:30,559
so let's go ahead and talk about this a

616
00:23:30,559 --> 00:23:32,320
little bit

617
00:23:32,320 --> 00:23:34,480
we looked at the browser user agent

618
00:23:34,480 --> 00:23:36,720
string redirection

619
00:23:36,720 --> 00:23:39,600
i sort of explained how that works

620
00:23:39,600 --> 00:23:42,559
taking this a step further

621
00:23:42,559 --> 00:23:44,720
in this case i got lucky because the

622
00:23:44,720 --> 00:23:47,279
threat actors had used javascript so i

623
00:23:47,279 --> 00:23:49,600
could tell their red directs happening

624
00:23:49,600 --> 00:23:51,440
and i could tell exactly how they were

625
00:23:51,440 --> 00:23:54,000
happening if the threat actors had used

626
00:23:54,000 --> 00:23:56,480
a server side language and there's

627
00:23:56,480 --> 00:23:57,760
certainly a number of them here

628
00:23:57,760 --> 00:24:00,640
including php python and and several

629
00:24:00,640 --> 00:24:02,960
others i have listed by no means is that

630
00:24:02,960 --> 00:24:05,120
an all-inclusive list

631
00:24:05,120 --> 00:24:08,080
but those are very common to find as

632
00:24:08,080 --> 00:24:10,559
server-side languages uh what's

633
00:24:10,559 --> 00:24:12,880
interesting is you can't view source

634
00:24:12,880 --> 00:24:15,600
code on server-side languages

635
00:24:15,600 --> 00:24:18,000
in a standard properly secured web

636
00:24:18,000 --> 00:24:20,960
server configuration

637
00:24:20,960 --> 00:24:24,320
what is also interesting is that if

638
00:24:24,320 --> 00:24:26,320
let's say for example the thread actors

639
00:24:26,320 --> 00:24:28,000
had a

640
00:24:28,000 --> 00:24:30,240
payload that only worked within the

641
00:24:30,240 --> 00:24:32,720
firefox web browser for example they

642
00:24:32,720 --> 00:24:35,679
could actually target the payload based

643
00:24:35,679 --> 00:24:38,480
on a specific web browser so that it

644
00:24:38,480 --> 00:24:39,600
would only

645
00:24:39,600 --> 00:24:42,000
round rob and execute a malicious

646
00:24:42,000 --> 00:24:43,520
download

647
00:24:43,520 --> 00:24:46,080
for example when people using the

648
00:24:46,080 --> 00:24:48,080
firefox web browser might visit a

649
00:24:48,080 --> 00:24:50,400
particular page

650
00:24:50,400 --> 00:24:53,520
those same code

651
00:24:53,520 --> 00:24:56,640
snippets i showed could be further

652
00:24:56,640 --> 00:24:58,080
targeting

653
00:24:58,080 --> 00:25:01,440
specific browser versions within those

654
00:25:01,440 --> 00:25:05,600
brands so for example if we had a

655
00:25:05,600 --> 00:25:08,159
version of an exploit that worked only

656
00:25:08,159 --> 00:25:10,480
on certain browsers below a certain

657
00:25:10,480 --> 00:25:12,880
version number uh those checks could be

658
00:25:12,880 --> 00:25:15,360
baked into the code and they would be

659
00:25:15,360 --> 00:25:17,279
very hard to

660
00:25:17,279 --> 00:25:20,000
sort of analyze then

661
00:25:20,000 --> 00:25:22,640
but also typically that round robin

662
00:25:22,640 --> 00:25:25,760
could redirect a user so fast that they

663
00:25:25,760 --> 00:25:27,520
wouldn't even notice

664
00:25:27,520 --> 00:25:29,120
that the page

665
00:25:29,120 --> 00:25:31,120
took time to load but it would also make

666
00:25:31,120 --> 00:25:34,000
it very tricky to analyze so those are

667
00:25:34,000 --> 00:25:35,520
sort of things that thread actually

668
00:25:35,520 --> 00:25:38,880
could do to make this worse and honestly

669
00:25:38,880 --> 00:25:40,880
i think i've sort of seen some of these

670
00:25:40,880 --> 00:25:42,720
type of things in the wild

671
00:25:42,720 --> 00:25:44,640
it's just very hard if you don't have

672
00:25:44,640 --> 00:25:47,440
direct control or access to a web server

673
00:25:47,440 --> 00:25:50,000
to know for certain

674
00:25:50,000 --> 00:25:52,159
in this case our remediation steps were

675
00:25:52,159 --> 00:25:53,679
we determined the actual phishing

676
00:25:53,679 --> 00:25:55,760
landing page and we blocked it through

677
00:25:55,760 --> 00:25:57,679
web content filtering

678
00:25:57,679 --> 00:25:59,840
we also worked with our secure email

679
00:25:59,840 --> 00:26:01,760
gateway vendor to block the active

680
00:26:01,760 --> 00:26:03,520
phishing campaign

681
00:26:03,520 --> 00:26:05,760
my second scenario is called security

682
00:26:05,760 --> 00:26:07,840
scanner evasion

683
00:26:07,840 --> 00:26:09,679
i'd like to preface this scenario by

684
00:26:09,679 --> 00:26:11,679
stating that there were identical

685
00:26:11,679 --> 00:26:13,760
phishing emails and they started hitting

686
00:26:13,760 --> 00:26:16,320
inboxes we were actually getting wide

687
00:26:16,320 --> 00:26:18,799
scale reports of phishing

688
00:26:18,799 --> 00:26:19,679
and

689
00:26:19,679 --> 00:26:21,760
the link what was interesting about the

690
00:26:21,760 --> 00:26:23,760
link is when i looked at it in a

691
00:26:23,760 --> 00:26:26,159
security scanner tool is it appeared

692
00:26:26,159 --> 00:26:28,799
that the page was already offline

693
00:26:28,799 --> 00:26:30,799
if that were truly the case then it

694
00:26:30,799 --> 00:26:32,320
might be a situation where it was

695
00:26:32,320 --> 00:26:34,799
nothing to worry about i wasn't quite

696
00:26:34,799 --> 00:26:37,039
ready to accept that at face value so

697
00:26:37,039 --> 00:26:38,960
let's go ahead and investigate this and

698
00:26:38,960 --> 00:26:40,320
find out

699
00:26:40,320 --> 00:26:41,279
what we're going to do for our

700
00:26:41,279 --> 00:26:42,720
investigation is we're going to take a

701
00:26:42,720 --> 00:26:45,279
look at the email message and the source

702
00:26:45,279 --> 00:26:48,000
code we're going to note any hyperlinks

703
00:26:48,000 --> 00:26:50,080
and then we're going to check out the

704
00:26:50,080 --> 00:26:52,720
landing page with our security scanner

705
00:26:52,720 --> 00:26:55,039
and that's something i'm just sort of

706
00:26:55,039 --> 00:26:56,799
simulating here

707
00:26:56,799 --> 00:26:58,000
then we're going to take a look at the

708
00:26:58,000 --> 00:27:00,080
landing page source code and then

709
00:27:00,080 --> 00:27:01,440
finally we're going to open up the

710
00:27:01,440 --> 00:27:04,960
phishing page in a sandbox and again i'm

711
00:27:04,960 --> 00:27:08,240
on my local machine here doing demos

712
00:27:08,240 --> 00:27:10,720
so this is going to be a simulated

713
00:27:10,720 --> 00:27:13,120
pretend sandbox if you will let's go and

714
00:27:13,120 --> 00:27:15,600
take a look at the email message itself

715
00:27:15,600 --> 00:27:18,799
and so here's a sample email message

716
00:27:18,799 --> 00:27:21,600
and so the from field in this particular

717
00:27:21,600 --> 00:27:23,600
one i've called it from

718
00:27:23,600 --> 00:27:26,600
evil.scammer.promisewearlegit.com

719
00:27:27,360 --> 00:27:29,919
the subject in this email message is

720
00:27:29,919 --> 00:27:32,559
this link is totally safe

721
00:27:32,559 --> 00:27:35,120
and in this case it's coming to fishing

722
00:27:35,120 --> 00:27:37,520
target which is unwitting.victim at

723
00:27:37,520 --> 00:27:40,480
randomtarget.org

724
00:27:40,480 --> 00:27:42,159
email message simply reads hello

725
00:27:42,159 --> 00:27:44,080
phishing target we have a really

726
00:27:44,080 --> 00:27:46,159
important message for you to retrieve

727
00:27:46,159 --> 00:27:49,279
your message click here and that's not

728
00:27:49,279 --> 00:27:52,000
real subtle it stands out about as much

729
00:27:52,000 --> 00:27:54,720
as it could possibly stand out regards

730
00:27:54,720 --> 00:27:56,880
spoof sender now i've had a lot of

731
00:27:56,880 --> 00:27:58,640
people ask me matt have you actually

732
00:27:58,640 --> 00:28:02,720
used this as a test fishing template to

733
00:28:02,720 --> 00:28:05,679
do phishing testing for user educational

734
00:28:05,679 --> 00:28:08,799
purposes and the answer is no

735
00:28:08,799 --> 00:28:10,559
and part of that is i'm not sure i

736
00:28:10,559 --> 00:28:12,559
really want to know because my deepest

737
00:28:12,559 --> 00:28:14,080
fear is there's still going to be that

738
00:28:14,080 --> 00:28:16,399
one person in the organization

739
00:28:16,399 --> 00:28:18,159
that's still going to be gullible enough

740
00:28:18,159 --> 00:28:20,720
to actually click on this hyperlink

741
00:28:20,720 --> 00:28:22,720
and so even though there's more red

742
00:28:22,720 --> 00:28:24,640
flags in this particular email than

743
00:28:24,640 --> 00:28:27,279
vladimir putin has in his garages

744
00:28:27,279 --> 00:28:30,240
souvenirs from his old kgb days my fear

745
00:28:30,240 --> 00:28:31,919
is somebody would still actually click

746
00:28:31,919 --> 00:28:32,799
on it

747
00:28:32,799 --> 00:28:34,240
in this case

748
00:28:34,240 --> 00:28:36,240
a lot of people will tell you to hover

749
00:28:36,240 --> 00:28:39,200
over to get the hyperlink in an email

750
00:28:39,200 --> 00:28:40,320
message

751
00:28:40,320 --> 00:28:41,919
i don't like to do that for a couple

752
00:28:41,919 --> 00:28:43,919
reasons one is you might accidentally

753
00:28:43,919 --> 00:28:46,080
click on the link and two

754
00:28:46,080 --> 00:28:48,559
i'm just sort of leery back in the

755
00:28:48,559 --> 00:28:50,159
distant past there used to be some

756
00:28:50,159 --> 00:28:52,960
issues with certain mail clients and

757
00:28:52,960 --> 00:28:56,399
webmail where javascript might run on a

758
00:28:56,399 --> 00:28:59,679
mouse over or an on hover that kind of

759
00:28:59,679 --> 00:29:01,039
thing so

760
00:29:01,039 --> 00:29:03,760
uh i tend to go the extra cautious route

761
00:29:03,760 --> 00:29:06,240
and i'm going to go ahead and

762
00:29:06,240 --> 00:29:08,640
come in here into the view menu and pull

763
00:29:08,640 --> 00:29:10,480
up the message source

764
00:29:10,480 --> 00:29:12,000
i'll make this a little bit bigger so

765
00:29:12,000 --> 00:29:13,919
it's not such an eye chart to try and

766
00:29:13,919 --> 00:29:14,960
read

767
00:29:14,960 --> 00:29:17,520
and what i like to do in an email

768
00:29:17,520 --> 00:29:20,720
message is if i just do a search a text

769
00:29:20,720 --> 00:29:23,440
search for http uh i'm generally going

770
00:29:23,440 --> 00:29:26,399
to find what i'm looking for and in this

771
00:29:26,399 --> 00:29:29,840
case i have one result and it found my

772
00:29:29,840 --> 00:29:31,760
hyperlink and so i'm going to go ahead

773
00:29:31,760 --> 00:29:34,399
and copy this particular link

774
00:29:34,399 --> 00:29:36,559
and see what we have

775
00:29:36,559 --> 00:29:40,240
and let me go back to my command line

776
00:29:40,240 --> 00:29:41,760
and there's a couple things that we can

777
00:29:41,760 --> 00:29:45,840
do to obtain the source code for this

778
00:29:45,840 --> 00:29:48,240
before i do that let me go ahead and

779
00:29:48,240 --> 00:29:50,640
show what it actually looks like inside

780
00:29:50,640 --> 00:29:51,840
of my

781
00:29:51,840 --> 00:29:55,440
test sandbox so if i open up the page

782
00:29:55,440 --> 00:29:57,039
i get what appears to be a normal

783
00:29:57,039 --> 00:29:59,520
looking 404 page saying that the file or

784
00:29:59,520 --> 00:30:01,840
the directory is not found if this were

785
00:30:01,840 --> 00:30:03,840
truly the case it could be a situation

786
00:30:03,840 --> 00:30:06,240
where this has already been cleaned up

787
00:30:06,240 --> 00:30:07,919
and there's nothing to worry about

788
00:30:07,919 --> 00:30:09,520
because it would appear that the

789
00:30:09,520 --> 00:30:12,000
malicious site is offline

790
00:30:12,000 --> 00:30:13,679
not wanting to take that at face value

791
00:30:13,679 --> 00:30:15,279
there's a couple ways we can look at the

792
00:30:15,279 --> 00:30:17,039
source code for that

793
00:30:17,039 --> 00:30:19,440
one of them is we can use the curl

794
00:30:19,440 --> 00:30:20,559
command

795
00:30:20,559 --> 00:30:23,520
and we can paste in the address

796
00:30:23,520 --> 00:30:26,240
and i can output the results to a file

797
00:30:26,240 --> 00:30:29,440
of my choosing so for output

798
00:30:29,440 --> 00:30:30,640
let me go ahead and call this something

799
00:30:30,640 --> 00:30:32,399
like first page

800
00:30:32,399 --> 00:30:34,159
i'm sorry let me go ahead and call this

801
00:30:34,159 --> 00:30:35,440
unknown

802
00:30:35,440 --> 00:30:37,760
dot html

803
00:30:37,760 --> 00:30:40,720
and it retrieves the file

804
00:30:40,720 --> 00:30:43,279
there's other ways to do this if you

805
00:30:43,279 --> 00:30:45,279
don't have curl available on the system

806
00:30:45,279 --> 00:30:47,440
you could always try wget and see if

807
00:30:47,440 --> 00:30:49,919
wget is installed and with that i'm

808
00:30:49,919 --> 00:30:51,120
going to go ahead and re-paste the

809
00:30:51,120 --> 00:30:53,279
address in here it's going to retrieve

810
00:30:53,279 --> 00:30:55,039
the file for me

811
00:30:55,039 --> 00:30:57,679
this case let me clear off this stuff

812
00:30:57,679 --> 00:31:00,080
and so i've retrieved the file a couple

813
00:31:00,080 --> 00:31:02,799
different ways

814
00:31:02,799 --> 00:31:05,279
forensically it doesn't gonna

815
00:31:05,279 --> 00:31:07,519
make a big difference

816
00:31:07,519 --> 00:31:10,720
which way i use uh to prove that let me

817
00:31:10,720 --> 00:31:12,960
go ahead and take a look at the html

818
00:31:12,960 --> 00:31:15,120
files in here now we've got different

819
00:31:15,120 --> 00:31:16,880
names based on how i

820
00:31:16,880 --> 00:31:19,120
uh output those results

821
00:31:19,120 --> 00:31:21,760
but what we can tell is that roughly we

822
00:31:21,760 --> 00:31:23,760
have the same

823
00:31:23,760 --> 00:31:26,559
file byte size on these now one thing

824
00:31:26,559 --> 00:31:28,880
it's an artifact of demoing this on a

825
00:31:28,880 --> 00:31:30,880
local system that's running a local web

826
00:31:30,880 --> 00:31:34,640
server is that the wget actually retains

827
00:31:34,640 --> 00:31:38,399
the original date that that was created

828
00:31:38,399 --> 00:31:41,600
that's really just an artifact of

829
00:31:41,600 --> 00:31:43,919
the fact that it's on a local system

830
00:31:43,919 --> 00:31:46,480
typically when you run wget on line

831
00:31:46,480 --> 00:31:48,960
you're going to get the current time

832
00:31:48,960 --> 00:31:51,120
when it was retrieved just like my curl

833
00:31:51,120 --> 00:31:53,039
output here but you can see that we

834
00:31:53,039 --> 00:31:55,840
definitely have the same file sizes and

835
00:31:55,840 --> 00:31:58,399
again just to prove that these really

836
00:31:58,399 --> 00:32:00,799
are the same file i'm going to go ahead

837
00:32:00,799 --> 00:32:03,519
and run a sha-256 sum

838
00:32:03,519 --> 00:32:05,840
on all of the

839
00:32:05,840 --> 00:32:08,799
html files in here and what we can see

840
00:32:08,799 --> 00:32:11,279
is it doesn't matter if we use curl or

841
00:32:11,279 --> 00:32:13,279
if we use w get

842
00:32:13,279 --> 00:32:14,559
these results

843
00:32:14,559 --> 00:32:17,200
really are identical

844
00:32:17,200 --> 00:32:18,559
and so

845
00:32:18,559 --> 00:32:20,880
what we want to do is actually take a

846
00:32:20,880 --> 00:32:22,240
look at these

847
00:32:22,240 --> 00:32:24,080
one of these files

848
00:32:24,080 --> 00:32:26,000
so let me just go ahead and pop up one

849
00:32:26,000 --> 00:32:30,720
of these inside of a text editor here

850
00:32:33,279 --> 00:32:35,360
and it doesn't really matter which text

851
00:32:35,360 --> 00:32:37,760
editor you use i'm just using something

852
00:32:37,760 --> 00:32:40,080
that's simple that i can

853
00:32:40,080 --> 00:32:42,240
make bigger that hopefully isn't too

854
00:32:42,240 --> 00:32:44,720
difficult to read on screen now whether

855
00:32:44,720 --> 00:32:47,519
you can actually read the javascript or

856
00:32:47,519 --> 00:32:50,159
not i'm going to explain how this works

857
00:32:50,159 --> 00:32:52,480
so here at the top we have our standard

858
00:32:52,480 --> 00:32:55,760
html file uh it's declaring script and

859
00:32:55,760 --> 00:32:58,720
in this case it's going to be javascript

860
00:32:58,720 --> 00:33:01,279
and what we start seeing is we see

861
00:33:01,279 --> 00:33:03,919
an if else

862
00:33:03,919 --> 00:33:08,559
loop um and so what it's looking for is

863
00:33:08,559 --> 00:33:12,080
user agents so navigator.useragent

864
00:33:12,080 --> 00:33:13,760
and so we see things that should be

865
00:33:13,760 --> 00:33:17,200
recognizable here uh and so this one in

866
00:33:17,200 --> 00:33:19,120
particular is chrome

867
00:33:19,120 --> 00:33:20,320
and

868
00:33:20,320 --> 00:33:23,519
what we see is uh it's doing an if if

869
00:33:23,519 --> 00:33:26,000
it's chrome then replace the window

870
00:33:26,000 --> 00:33:28,399
location or in other words redirect the

871
00:33:28,399 --> 00:33:30,640
traffic to another page

872
00:33:30,640 --> 00:33:33,039
and we have near identical code except

873
00:33:33,039 --> 00:33:35,360
down here we're looking at microsoft

874
00:33:35,360 --> 00:33:37,760
edge we're looking at firefox we're

875
00:33:37,760 --> 00:33:40,399
looking at microsoft internet explorer

876
00:33:40,399 --> 00:33:43,679
the opera web browser and the safari web

877
00:33:43,679 --> 00:33:45,360
browser

878
00:33:45,360 --> 00:33:47,840
and so we have all these different if

879
00:33:47,840 --> 00:33:49,200
statements

880
00:33:49,200 --> 00:33:52,080
and then down here we have our final

881
00:33:52,080 --> 00:33:55,519
else so if none of these things matched

882
00:33:55,519 --> 00:33:57,279
then it should replace the window

883
00:33:57,279 --> 00:34:00,480
location with a 404 page

884
00:34:00,480 --> 00:34:03,679
now that's interesting because these

885
00:34:03,679 --> 00:34:06,720
are really all of the common web

886
00:34:06,720 --> 00:34:09,599
browsers that most systems would tend to

887
00:34:09,599 --> 00:34:13,520
have so in other words if a visitor is

888
00:34:13,520 --> 00:34:15,679
going to a website using a popular web

889
00:34:15,679 --> 00:34:18,239
browser it's going to send the traffic

890
00:34:18,239 --> 00:34:20,960
one place and if it doesn't match any of

891
00:34:20,960 --> 00:34:23,199
that it's sending it to this 404 page

892
00:34:23,199 --> 00:34:25,359
and if you remember from our security

893
00:34:25,359 --> 00:34:28,800
scanner demo that what we had was in

894
00:34:28,800 --> 00:34:31,359
fact a 404 page

895
00:34:31,359 --> 00:34:32,800
and so

896
00:34:32,800 --> 00:34:34,560
it's interesting because the result

897
00:34:34,560 --> 00:34:36,879
doesn't necessarily match what has been

898
00:34:36,879 --> 00:34:40,320
hidden underneath the scenes down here

899
00:34:40,320 --> 00:34:41,918
so

900
00:34:41,918 --> 00:34:44,879
this tells us an awful lot and to give

901
00:34:44,879 --> 00:34:47,199
everybody an idea of what this actually

902
00:34:47,199 --> 00:34:49,520
looks like if we open up the web page in

903
00:34:49,520 --> 00:34:52,320
a browser uh google actually tells us

904
00:34:52,320 --> 00:34:55,599
hey this looks so much sketchy and when

905
00:34:55,599 --> 00:34:59,200
i pull it up here uh what i get is

906
00:34:59,200 --> 00:35:02,400
what very much appears to be a typical

907
00:35:02,400 --> 00:35:06,400
microsoft office 365 type of login so we

908
00:35:06,400 --> 00:35:08,720
can actually see what's happening when

909
00:35:08,720 --> 00:35:11,200
the site is visited by a common web

910
00:35:11,200 --> 00:35:12,480
browser

911
00:35:12,480 --> 00:35:14,000
so let's go ahead and talk about this a

912
00:35:14,000 --> 00:35:15,680
little bit

913
00:35:15,680 --> 00:35:17,920
we looked at the browser user agent

914
00:35:17,920 --> 00:35:20,079
string redirection

915
00:35:20,079 --> 00:35:23,040
i sort of explained how that works

916
00:35:23,040 --> 00:35:25,920
taking this a step further

917
00:35:25,920 --> 00:35:28,079
in this case i got lucky because the

918
00:35:28,079 --> 00:35:30,400
thread actors had used javascript

919
00:35:30,400 --> 00:35:32,400
so i could tell their redirects

920
00:35:32,400 --> 00:35:34,480
happening and i could tell exactly how

921
00:35:34,480 --> 00:35:36,960
they were happening if the threat actors

922
00:35:36,960 --> 00:35:39,440
had used a server side language and

923
00:35:39,440 --> 00:35:41,200
there's certainly a number of them here

924
00:35:41,200 --> 00:35:44,000
including php python and and several

925
00:35:44,000 --> 00:35:46,320
others i have listed by no means is that

926
00:35:46,320 --> 00:35:48,480
an all-inclusive list

927
00:35:48,480 --> 00:35:51,520
but those are very common to find as

928
00:35:51,520 --> 00:35:53,599
server-side languages

929
00:35:53,599 --> 00:35:55,920
what's interesting is you can't view

930
00:35:55,920 --> 00:35:59,040
source code on server side languages

931
00:35:59,040 --> 00:36:01,440
in a standard properly secured web

932
00:36:01,440 --> 00:36:04,400
server configuration

933
00:36:04,400 --> 00:36:07,680
what is also interesting is that if

934
00:36:07,680 --> 00:36:09,760
let's say for example the thread actors

935
00:36:09,760 --> 00:36:11,440
had a

936
00:36:11,440 --> 00:36:13,599
payload that only worked within the

937
00:36:13,599 --> 00:36:16,079
firefox web browser for example they

938
00:36:16,079 --> 00:36:19,119
could actually target the payload based

939
00:36:19,119 --> 00:36:21,839
on a specific web browser so that it

940
00:36:21,839 --> 00:36:24,720
would only round rob and execute a

941
00:36:24,720 --> 00:36:26,880
malicious download

942
00:36:26,880 --> 00:36:29,520
for example when people using the

943
00:36:29,520 --> 00:36:31,440
firefox web browser might visit a

944
00:36:31,440 --> 00:36:33,760
particular page

945
00:36:33,760 --> 00:36:36,960
those same code

946
00:36:36,960 --> 00:36:40,000
snippets i showed could be further

947
00:36:40,000 --> 00:36:41,520
targeting

948
00:36:41,520 --> 00:36:44,880
specific browser versions within those

949
00:36:44,880 --> 00:36:48,960
brands so for example if we had a

950
00:36:48,960 --> 00:36:51,599
version of an exploit that worked only

951
00:36:51,599 --> 00:36:53,920
on certain browsers below a certain

952
00:36:53,920 --> 00:36:55,280
version number

953
00:36:55,280 --> 00:36:57,280
those checks could be baked into the

954
00:36:57,280 --> 00:37:00,640
code and they would be very hard to

955
00:37:00,640 --> 00:37:03,359
sort of analyze then

956
00:37:03,359 --> 00:37:06,079
but also typically that round robin

957
00:37:06,079 --> 00:37:09,119
could redirect a user so fast that they

958
00:37:09,119 --> 00:37:12,480
wouldn't even notice uh that the page

959
00:37:12,480 --> 00:37:14,560
took time to load but it would also make

960
00:37:14,560 --> 00:37:17,359
it very tricky to analyze so those are

961
00:37:17,359 --> 00:37:18,880
sort of things that threat actually

962
00:37:18,880 --> 00:37:22,240
could do to make this worse and honestly

963
00:37:22,240 --> 00:37:24,240
i think i've sort of seen some of these

964
00:37:24,240 --> 00:37:26,160
type of things in the wild

965
00:37:26,160 --> 00:37:28,000
it's just very hard if you don't have

966
00:37:28,000 --> 00:37:30,800
direct control or access to a web server

967
00:37:30,800 --> 00:37:33,440
to know for certain

968
00:37:33,440 --> 00:37:35,520
in this case our remediation steps were

969
00:37:35,520 --> 00:37:37,520
we determined the actual fishing landing

970
00:37:37,520 --> 00:37:39,440
page and we blocked it through web

971
00:37:39,440 --> 00:37:41,119
content filtering

972
00:37:41,119 --> 00:37:43,200
we also worked with our secure email

973
00:37:43,200 --> 00:37:45,200
gateway vendor to block the active

974
00:37:45,200 --> 00:37:46,880
phishing campaign

975
00:37:46,880 --> 00:37:48,800
my third scenario is called the rabbit

976
00:37:48,800 --> 00:37:51,800
hole

977
00:37:53,440 --> 00:37:55,920
i want to preface this scenario by

978
00:37:55,920 --> 00:37:57,920
saying that i received a request from a

979
00:37:57,920 --> 00:38:00,880
user to investigate an email message

980
00:38:00,880 --> 00:38:02,640
they received to determine if it was

981
00:38:02,640 --> 00:38:04,960
legitimate or not the email appeared

982
00:38:04,960 --> 00:38:07,119
fishy at first glance but i had to ask

983
00:38:07,119 --> 00:38:11,359
is it just suspicious or is it malicious

984
00:38:11,440 --> 00:38:13,359
for the investigation i can tell from

985
00:38:13,359 --> 00:38:15,200
the message headers that the source i p

986
00:38:15,200 --> 00:38:17,839
address was a mismatch from the sender's

987
00:38:17,839 --> 00:38:19,200
domain

988
00:38:19,200 --> 00:38:20,800
however the message source was

989
00:38:20,800 --> 00:38:22,640
particularly interesting because the

990
00:38:22,640 --> 00:38:24,880
link text did not match the hyperlink

991
00:38:24,880 --> 00:38:26,880
destination and we're going to do a

992
00:38:26,880 --> 00:38:28,800
quick demo of that

993
00:38:28,800 --> 00:38:31,040
and then the malicious threat actors

994
00:38:31,040 --> 00:38:33,200
objective appeared to be credential

995
00:38:33,200 --> 00:38:35,520
harvesting for the purposes of account

996
00:38:35,520 --> 00:38:38,400
takeover so let's go ahead and take a

997
00:38:38,400 --> 00:38:40,800
look at the email message and then also

998
00:38:40,800 --> 00:38:44,640
take a look at the hyperlink

999
00:38:44,880 --> 00:38:47,760
so here's our email message

1000
00:38:47,760 --> 00:38:51,359
and so it comes from paypal support but

1001
00:38:51,359 --> 00:38:55,280
the address is pp support at pwned

1002
00:38:55,280 --> 00:38:57,119
server.org

1003
00:38:57,119 --> 00:38:59,920
the subject is paypal bank account

1004
00:38:59,920 --> 00:39:01,760
change confirmation

1005
00:39:01,760 --> 00:39:04,160
and it's to phishing target which again

1006
00:39:04,160 --> 00:39:06,280
is our unwitting.victim

1007
00:39:06,280 --> 00:39:09,280
randomtarget.org the email simply reads

1008
00:39:09,280 --> 00:39:11,839
dear paypal customer we received your

1009
00:39:11,839 --> 00:39:13,839
request to update your bank account on

1010
00:39:13,839 --> 00:39:16,400
file this process will complete in the

1011
00:39:16,400 --> 00:39:18,880
next four hours if you did not request

1012
00:39:18,880 --> 00:39:20,720
these changes to your paypal account

1013
00:39:20,720 --> 00:39:22,640
please log in to reject the pending

1014
00:39:22,640 --> 00:39:23,760
activity

1015
00:39:23,760 --> 00:39:26,160
and here is a link

1016
00:39:26,160 --> 00:39:29,760
that would actually take you to paypal's

1017
00:39:29,760 --> 00:39:31,920
actual login page

1018
00:39:31,920 --> 00:39:34,880
if that is where you were being sent

1019
00:39:34,880 --> 00:39:36,960
and then in this case sincerely paypal

1020
00:39:36,960 --> 00:39:38,640
support

1021
00:39:38,640 --> 00:39:40,640
and i mentioned in there that the link

1022
00:39:40,640 --> 00:39:42,800
text reads one thing but the actual

1023
00:39:42,800 --> 00:39:45,280
hyperlink can go somewhere quite a bit

1024
00:39:45,280 --> 00:39:46,480
different

1025
00:39:46,480 --> 00:39:48,000
so let's go ahead and take a look at the

1026
00:39:48,000 --> 00:39:49,760
message source code here so i'm going to

1027
00:39:49,760 --> 00:39:51,760
go into the view menu pull up the

1028
00:39:51,760 --> 00:39:53,280
message source

1029
00:39:53,280 --> 00:39:55,119
and make this a little more readable for

1030
00:39:55,119 --> 00:39:56,640
everyone

1031
00:39:56,640 --> 00:39:59,200
and so if i search on http it will find

1032
00:39:59,200 --> 00:40:01,440
http https

1033
00:40:01,440 --> 00:40:03,280
traffic and so

1034
00:40:03,280 --> 00:40:05,440
here we have

1035
00:40:05,440 --> 00:40:07,520
the paypal

1036
00:40:07,520 --> 00:40:09,599
sign in address that we just looked at

1037
00:40:09,599 --> 00:40:13,119
moment ago in the live email message but

1038
00:40:13,119 --> 00:40:15,200
what gets interesting is when we see the

1039
00:40:15,200 --> 00:40:18,000
actual hyperlink in the source code it's

1040
00:40:18,000 --> 00:40:20,000
actually going somewhere completely

1041
00:40:20,000 --> 00:40:21,040
different

1042
00:40:21,040 --> 00:40:22,400
so i'm going to go ahead and copy that

1043
00:40:22,400 --> 00:40:23,440
address

1044
00:40:23,440 --> 00:40:24,400
and

1045
00:40:24,400 --> 00:40:26,400
have that here so we can do some

1046
00:40:26,400 --> 00:40:28,720
analysis on this

1047
00:40:28,720 --> 00:40:30,800
let's go ahead and

1048
00:40:30,800 --> 00:40:32,560
see what this looks like on a live

1049
00:40:32,560 --> 00:40:34,560
website

1050
00:40:34,560 --> 00:40:36,079
and so again this would be something you

1051
00:40:36,079 --> 00:40:38,160
would typically do in your sandbox

1052
00:40:38,160 --> 00:40:40,960
environment to see what's going on here

1053
00:40:40,960 --> 00:40:43,119
and it certainly has the look and feel

1054
00:40:43,119 --> 00:40:46,240
for a paypal login page when we go there

1055
00:40:46,240 --> 00:40:48,640
but what we want to do is understand

1056
00:40:48,640 --> 00:40:50,319
what is actually happening behind the

1057
00:40:50,319 --> 00:40:53,119
scenes when we investigate this so we've

1058
00:40:53,119 --> 00:40:55,440
taken a look at the link text we see

1059
00:40:55,440 --> 00:40:57,200
that the hyperlink is going somewhere

1060
00:40:57,200 --> 00:40:59,200
else we know the threat actors are

1061
00:40:59,200 --> 00:41:01,200
trying to harvest user names and

1062
00:41:01,200 --> 00:41:02,720
passwords for

1063
00:41:02,720 --> 00:41:04,720
paypal so that they can log in as the

1064
00:41:04,720 --> 00:41:09,359
user and deplete the account of funds

1065
00:41:09,359 --> 00:41:12,079
maybe make fake purchases

1066
00:41:12,079 --> 00:41:15,280
essentially committing financial fraud

1067
00:41:15,280 --> 00:41:16,720
so what we're going to do is we're

1068
00:41:16,720 --> 00:41:18,640
taking a look at the first

1069
00:41:18,640 --> 00:41:21,359
destination and we took a look at the

1070
00:41:21,359 --> 00:41:23,520
source code just a moment ago

1071
00:41:23,520 --> 00:41:26,400
and we know it's going to a web host in

1072
00:41:26,400 --> 00:41:28,240
a foreign country

1073
00:41:28,240 --> 00:41:29,280
but we're going to go ahead and take a

1074
00:41:29,280 --> 00:41:31,839
look at that so let's do that now

1075
00:41:31,839 --> 00:41:34,800
i'm going to go ahead and run curl and

1076
00:41:34,800 --> 00:41:36,160
i'm going to paste in the address i

1077
00:41:36,160 --> 00:41:39,119
copied moment of tarot ago

1078
00:41:39,119 --> 00:41:42,079
and i'm going to output this

1079
00:41:42,079 --> 00:41:43,839
and i'm going to call it something like

1080
00:41:43,839 --> 00:41:48,599
first page dot html

1081
00:41:48,640 --> 00:41:51,280
retrieve that and so i want to take a

1082
00:41:51,280 --> 00:41:52,800
look at this file and see what it

1083
00:41:52,800 --> 00:41:55,040
actually looks like so i can understand

1084
00:41:55,040 --> 00:41:57,359
the source code of the page and what's

1085
00:41:57,359 --> 00:41:58,560
happening

1086
00:41:58,560 --> 00:41:59,520
and

1087
00:41:59,520 --> 00:42:01,680
again what we see in the address here is

1088
00:42:01,680 --> 00:42:04,000
a be

1089
00:42:04,000 --> 00:42:05,760
top-level domain which we know is the

1090
00:42:05,760 --> 00:42:07,680
country of belgium

1091
00:42:07,680 --> 00:42:10,000
certainly if we're an american customer

1092
00:42:10,000 --> 00:42:12,319
on paypal we shouldn't be going to a

1093
00:42:12,319 --> 00:42:14,319
belgium domain

1094
00:42:14,319 --> 00:42:16,800
and everything in that phishing email

1095
00:42:16,800 --> 00:42:19,359
essentially tells the user hey you have

1096
00:42:19,359 --> 00:42:21,520
four hours to essentially save your

1097
00:42:21,520 --> 00:42:23,520
account information so people

1098
00:42:23,520 --> 00:42:24,400
will

1099
00:42:24,400 --> 00:42:26,640
unfortunately maybe fall for that lure

1100
00:42:26,640 --> 00:42:28,400
and think that they're acting in good

1101
00:42:28,400 --> 00:42:30,160
faith to protect their account when the

1102
00:42:30,160 --> 00:42:32,319
reality is they're actually handing over

1103
00:42:32,319 --> 00:42:34,000
all their credentials to the threat

1104
00:42:34,000 --> 00:42:35,920
actors so let's go and take a look at

1105
00:42:35,920 --> 00:42:38,079
this source code and see what it looks

1106
00:42:38,079 --> 00:42:40,319
like

1107
00:42:42,640 --> 00:42:44,160
and i'll make this just a little bit

1108
00:42:44,160 --> 00:42:45,359
bigger here

1109
00:42:45,359 --> 00:42:48,079
uh for an active web page this doesn't

1110
00:42:48,079 --> 00:42:50,079
look like it has a whole lot of

1111
00:42:50,079 --> 00:42:52,000
information in here we see it is a

1112
00:42:52,000 --> 00:42:55,599
conventional html file uh and we see you

1113
00:42:55,599 --> 00:42:57,760
know title please log in

1114
00:42:57,760 --> 00:42:59,440
what's interesting down here is we have

1115
00:42:59,440 --> 00:43:01,119
this http

1116
00:43:01,119 --> 00:43:02,160
um

1117
00:43:02,160 --> 00:43:04,960
equiv equals refresh inside of this meta

1118
00:43:04,960 --> 00:43:08,000
tag this is a meta redirect

1119
00:43:08,000 --> 00:43:10,400
and content equals zero means it's going

1120
00:43:10,400 --> 00:43:12,400
to happen instantaneously in other words

1121
00:43:12,400 --> 00:43:15,200
it's not going to be a five second delay

1122
00:43:15,200 --> 00:43:17,680
it's going to do it immediately and what

1123
00:43:17,680 --> 00:43:19,599
we see here

1124
00:43:19,599 --> 00:43:22,000
based on the source code

1125
00:43:22,000 --> 00:43:23,839
is it's not going

1126
00:43:23,839 --> 00:43:26,800
to paypal certainly it's not even

1127
00:43:26,800 --> 00:43:28,720
staying in the belgium domain here we

1128
00:43:28,720 --> 00:43:31,599
have a dot d e domain which we know is

1129
00:43:31,599 --> 00:43:34,240
in germany and this is

1130
00:43:34,240 --> 00:43:36,400
certainly highly unusual because now we

1131
00:43:36,400 --> 00:43:39,359
have something where the

1132
00:43:39,359 --> 00:43:41,440
link text did not match the hyperlink

1133
00:43:41,440 --> 00:43:44,640
which went to belgium now we have a web

1134
00:43:44,640 --> 00:43:47,599
page being served up we believe in

1135
00:43:47,599 --> 00:43:50,480
germany and these are all very likely

1136
00:43:50,480 --> 00:43:53,680
compromised uh web servers in these

1137
00:43:53,680 --> 00:43:56,560
foreign countries

1138
00:43:56,640 --> 00:43:57,440
so

1139
00:43:57,440 --> 00:43:59,200
now that we have copied the second

1140
00:43:59,200 --> 00:44:01,680
destination address the landing a page

1141
00:44:01,680 --> 00:44:04,000
appears to be a compromise web host in a

1142
00:44:04,000 --> 00:44:05,680
foreign country but we're going to take

1143
00:44:05,680 --> 00:44:07,839
a look at this get the source code and

1144
00:44:07,839 --> 00:44:10,319
figure out what how this looks behind

1145
00:44:10,319 --> 00:44:11,760
the scenes

1146
00:44:11,760 --> 00:44:14,640
so similar to what we did before i'm

1147
00:44:14,640 --> 00:44:16,240
going to run curl i'm going to go ahead

1148
00:44:16,240 --> 00:44:18,720
and paste in the address for our second

1149
00:44:18,720 --> 00:44:21,720
destination

1150
00:44:22,079 --> 00:44:23,520
this time i'm going to output it to

1151
00:44:23,520 --> 00:44:25,839
something called second page

1152
00:44:25,839 --> 00:44:27,920
that html

1153
00:44:27,920 --> 00:44:30,560
and this again will retrieve the source

1154
00:44:30,560 --> 00:44:34,079
code from the second web page and we

1155
00:44:34,079 --> 00:44:35,920
want to take a look at this and

1156
00:44:35,920 --> 00:44:37,920
understand what's happening

1157
00:44:37,920 --> 00:44:40,480
so let's go ahead and run g edit again

1158
00:44:40,480 --> 00:44:42,319
and in this case

1159
00:44:42,319 --> 00:44:43,680
i'm going to go ahead and pull up second

1160
00:44:43,680 --> 00:44:46,000
page and you can certainly use whatever

1161
00:44:46,000 --> 00:44:48,240
referred editor again i'm just doing

1162
00:44:48,240 --> 00:44:50,400
demos here and trying to make this

1163
00:44:50,400 --> 00:44:52,880
somewhat easy the ampersand should just

1164
00:44:52,880 --> 00:44:55,200
open in a disassociated process and

1165
00:44:55,200 --> 00:44:57,760
return the terminal back to normal let

1166
00:44:57,760 --> 00:44:59,839
me go ahead and make this bigger

1167
00:44:59,839 --> 00:45:02,400
now this is not the same thing

1168
00:45:02,400 --> 00:45:05,520
that we had for our redirect before this

1169
00:45:05,520 --> 00:45:07,200
looks just a little bit different one

1170
00:45:07,200 --> 00:45:08,960
you can tell it's obviously a little bit

1171
00:45:08,960 --> 00:45:11,680
bigger uh html file

1172
00:45:11,680 --> 00:45:12,880
uh we

1173
00:45:12,880 --> 00:45:15,520
have http meta information but not a

1174
00:45:15,520 --> 00:45:17,760
refresh here

1175
00:45:17,760 --> 00:45:19,119
what's interesting is there is a

1176
00:45:19,119 --> 00:45:21,920
declared title on the page of log into

1177
00:45:21,920 --> 00:45:24,000
your paypal account

1178
00:45:24,000 --> 00:45:25,520
which will be something that would pop

1179
00:45:25,520 --> 00:45:28,079
up and appear within the web browser

1180
00:45:28,079 --> 00:45:30,079
what's different this time though is we

1181
00:45:30,079 --> 00:45:32,240
have an iframe

1182
00:45:32,240 --> 00:45:34,800
and the iframe has a

1183
00:45:34,800 --> 00:45:37,359
another web address in it

1184
00:45:37,359 --> 00:45:39,200
so this is actually not serving up the

1185
00:45:39,200 --> 00:45:42,160
web page we saw this is actually serving

1186
00:45:42,160 --> 00:45:43,280
up in

1187
00:45:43,280 --> 00:45:45,839
a an iframe and what we can tell here

1188
00:45:45,839 --> 00:45:48,800
with absolute positioning and 100 width

1189
00:45:48,800 --> 00:45:49,839
and height

1190
00:45:49,839 --> 00:45:52,079
and no border that it's a seamless

1191
00:45:52,079 --> 00:45:53,280
iframe

1192
00:45:53,280 --> 00:45:55,359
so in other words when somebody visits

1193
00:45:55,359 --> 00:45:58,000
this particular page it

1194
00:45:58,000 --> 00:46:01,359
it won't look any different um

1195
00:46:01,359 --> 00:46:03,359
that they went to but the reality is

1196
00:46:03,359 --> 00:46:05,359
it's actually serving up content from

1197
00:46:05,359 --> 00:46:07,440
this different address

1198
00:46:07,440 --> 00:46:08,800
so this is definitely getting very

1199
00:46:08,800 --> 00:46:11,040
interesting very quickly

1200
00:46:11,040 --> 00:46:13,440
let's go ahead and take a look at the

1201
00:46:13,440 --> 00:46:16,800
third destination address uh and so you

1202
00:46:16,800 --> 00:46:19,839
know again we have if we look at the

1203
00:46:19,839 --> 00:46:21,839
where this is going

1204
00:46:21,839 --> 00:46:25,280
uh we can tell that uh

1205
00:46:25,280 --> 00:46:28,480
very soon

1206
00:46:28,480 --> 00:46:31,359
that we have dot n l as our top level

1207
00:46:31,359 --> 00:46:34,000
domain so that is something in the

1208
00:46:34,000 --> 00:46:36,720
netherlands um so we've we're going

1209
00:46:36,720 --> 00:46:38,960
ahead and curling this page

1210
00:46:38,960 --> 00:46:41,040
we're going to go ahead and output this

1211
00:46:41,040 --> 00:46:44,759
and we'll call it thirdpage.html

1212
00:46:45,200 --> 00:46:47,839
and we'll get that and so before we've

1213
00:46:47,839 --> 00:46:51,760
looked at these different kinds of files

1214
00:46:51,760 --> 00:46:53,599
and we've retrieved them we'll go ahead

1215
00:46:53,599 --> 00:46:55,520
and do the same here

1216
00:46:55,520 --> 00:46:56,640
and so

1217
00:46:56,640 --> 00:46:57,920
i'm going to do

1218
00:46:57,920 --> 00:47:00,000
my editor

1219
00:47:00,000 --> 00:47:02,800
and start typing in third page

1220
00:47:02,800 --> 00:47:04,720
do an ampersand

1221
00:47:04,720 --> 00:47:07,200
and what we get this time isn't the

1222
00:47:07,200 --> 00:47:09,839
nice source code that we've looked at

1223
00:47:09,839 --> 00:47:11,119
recently

1224
00:47:11,119 --> 00:47:13,680
we have really what is not human

1225
00:47:13,680 --> 00:47:16,480
readable gobbledygook

1226
00:47:16,480 --> 00:47:18,480
and if we scroll through here there's

1227
00:47:18,480 --> 00:47:20,160
really very little

1228
00:47:20,160 --> 00:47:21,839
other than the script

1229
00:47:21,839 --> 00:47:24,240
tag down here

1230
00:47:24,240 --> 00:47:26,800
that tells us much of anything

1231
00:47:26,800 --> 00:47:28,960
we know based on the top that it is

1232
00:47:28,960 --> 00:47:31,440
javascript

1233
00:47:31,440 --> 00:47:34,240
and what's interesting here is we have

1234
00:47:34,240 --> 00:47:35,359
something

1235
00:47:35,359 --> 00:47:37,440
called an unescape

1236
00:47:37,440 --> 00:47:38,800
and i'm going to explain this a little

1237
00:47:38,800 --> 00:47:42,880
bit so this is an unescaped sequence

1238
00:47:42,880 --> 00:47:45,200
and then what we have down here

1239
00:47:45,200 --> 00:47:48,000
we have something that's df

1240
00:47:48,000 --> 00:47:49,920
and this believe it or not i actually

1241
00:47:49,920 --> 00:47:52,000
made this a little more human readable

1242
00:47:52,000 --> 00:47:53,680
and you might be thinking matt this is

1243
00:47:53,680 --> 00:47:56,400
not readable at all and that's true but

1244
00:47:56,400 --> 00:47:58,400
bear in mind when you see this stuff in

1245
00:47:58,400 --> 00:48:00,880
real life there may be no white spacing

1246
00:48:00,880 --> 00:48:04,559
at all to separate out uh what this is

1247
00:48:04,559 --> 00:48:08,640
now if i come here at the very end of

1248
00:48:08,640 --> 00:48:11,520
uh the first lines

1249
00:48:11,520 --> 00:48:12,800
you know we can see

1250
00:48:12,800 --> 00:48:16,160
here at the end our unescape sequence

1251
00:48:16,160 --> 00:48:19,200
based on what's happening here i'm going

1252
00:48:19,200 --> 00:48:22,400
to go ahead and guess that this might be

1253
00:48:22,400 --> 00:48:24,319
some sort of a function

1254
00:48:24,319 --> 00:48:26,720
uh certainly not human readable

1255
00:48:26,720 --> 00:48:29,760
and back in the old days to understand

1256
00:48:29,760 --> 00:48:31,040
what was happening here we would

1257
00:48:31,040 --> 00:48:32,480
actually have to

1258
00:48:32,480 --> 00:48:35,040
get the unescaped sequence and then we

1259
00:48:35,040 --> 00:48:37,760
would have to feed the function back

1260
00:48:37,760 --> 00:48:40,640
into our unescape sequence to translate

1261
00:48:40,640 --> 00:48:42,240
this into something that we might be

1262
00:48:42,240 --> 00:48:43,839
able to read

1263
00:48:43,839 --> 00:48:45,440
let's go back to our slide deck real

1264
00:48:45,440 --> 00:48:47,920
quick we've got our source code we've

1265
00:48:47,920 --> 00:48:51,359
perused it um and so what we can tell

1266
00:48:51,359 --> 00:48:53,680
again is that the threat actors use

1267
00:48:53,680 --> 00:48:56,160
javascript encoding to avoid analysis

1268
00:48:56,160 --> 00:48:58,640
and detection while also hiding the page

1269
00:48:58,640 --> 00:48:59,520
source

1270
00:48:59,520 --> 00:49:00,800
so we're going to take a look at

1271
00:49:00,800 --> 00:49:02,400
decoding the page source using the

1272
00:49:02,400 --> 00:49:05,440
built-in browser developer tools

1273
00:49:05,440 --> 00:49:07,760
the important thing to remember here is

1274
00:49:07,760 --> 00:49:10,400
that anything that can be rendered in a

1275
00:49:10,400 --> 00:49:13,440
web browser has to be something that can

1276
00:49:13,440 --> 00:49:14,319
be

1277
00:49:14,319 --> 00:49:17,119
decoded uh in order

1278
00:49:17,119 --> 00:49:19,200
to serve up the page so in other words

1279
00:49:19,200 --> 00:49:22,000
it's somewhere it has to be readable uh

1280
00:49:22,000 --> 00:49:24,880
here we actually have the destination

1281
00:49:24,880 --> 00:49:27,280
from the iframe itself

1282
00:49:27,280 --> 00:49:29,040
let's go ahead and pull up the browser

1283
00:49:29,040 --> 00:49:31,119
developer tools and we can actually

1284
00:49:31,119 --> 00:49:32,720
leverage those

1285
00:49:32,720 --> 00:49:35,280
as a faster method to actually

1286
00:49:35,280 --> 00:49:37,200
understand what the source of the page

1287
00:49:37,200 --> 00:49:39,760
is doing let me come back in here and do

1288
00:49:39,760 --> 00:49:41,760
a quick refresh

1289
00:49:41,760 --> 00:49:44,640
and what we have when we look at this

1290
00:49:44,640 --> 00:49:46,400
is

1291
00:49:46,400 --> 00:49:48,880
on the network tab inside of our browser

1292
00:49:48,880 --> 00:49:50,400
developer tools

1293
00:49:50,400 --> 00:49:52,160
right now we're looking at everything

1294
00:49:52,160 --> 00:49:54,640
and we're going to see headers

1295
00:49:54,640 --> 00:49:56,839
and so here we have

1296
00:49:56,839 --> 00:49:59,520
our uh web page and we can see what the

1297
00:49:59,520 --> 00:50:01,520
headers look like and and that sort of

1298
00:50:01,520 --> 00:50:02,960
thing

1299
00:50:02,960 --> 00:50:04,400
and a little bit of the source code but

1300
00:50:04,400 --> 00:50:06,160
we really don't see a whole heck of a

1301
00:50:06,160 --> 00:50:08,559
lot here if i come back into the

1302
00:50:08,559 --> 00:50:10,000
elements tab

1303
00:50:10,000 --> 00:50:12,720
uh i've got some code here but it

1304
00:50:12,720 --> 00:50:15,200
doesn't really break down a whole lot of

1305
00:50:15,200 --> 00:50:17,839
detail in other words what i'm seeing on

1306
00:50:17,839 --> 00:50:19,599
the screen i'm not really seeing a whole

1307
00:50:19,599 --> 00:50:21,280
lot of code for

1308
00:50:21,280 --> 00:50:24,000
uh and what i mentioned before

1309
00:50:24,000 --> 00:50:26,800
uh the good thing is that this stuff has

1310
00:50:26,800 --> 00:50:29,440
to be decodable or else the web page

1311
00:50:29,440 --> 00:50:31,680
itself would never render and the threat

1312
00:50:31,680 --> 00:50:33,760
actors would not be able to do account

1313
00:50:33,760 --> 00:50:38,240
takeovers uh so if i do it edited html

1314
00:50:38,240 --> 00:50:40,720
uh this starts to look

1315
00:50:40,720 --> 00:50:44,319
very similar to what we had before

1316
00:50:44,319 --> 00:50:46,720
and we have again our unescaped sequence

1317
00:50:46,720 --> 00:50:48,240
here

1318
00:50:48,240 --> 00:50:51,200
the same stuff we were just looking at

1319
00:50:51,200 --> 00:50:53,440
but what gets really nice is once we get

1320
00:50:53,440 --> 00:50:55,839
past this blob of

1321
00:50:55,839 --> 00:50:57,760
javascript encoded

1322
00:50:57,760 --> 00:51:00,079
stuff that isn't human readable

1323
00:51:00,079 --> 00:51:02,000
in our browser developer tools we

1324
00:51:02,000 --> 00:51:04,480
actually do get to a point where we get

1325
00:51:04,480 --> 00:51:06,880
to actual source code and here we can

1326
00:51:06,880 --> 00:51:09,760
actually see the unescaped sequence in

1327
00:51:09,760 --> 00:51:12,000
here uh it's already done the heavy

1328
00:51:12,000 --> 00:51:15,520
lifting for us and again i was just

1329
00:51:15,520 --> 00:51:17,359
guessing based on how the code looked

1330
00:51:17,359 --> 00:51:20,480
that that might be a function and sure

1331
00:51:20,480 --> 00:51:22,480
enough here we see

1332
00:51:22,480 --> 00:51:24,720
that it is trying to do some sort of a

1333
00:51:24,720 --> 00:51:27,680
function call uh based on the unescape

1334
00:51:27,680 --> 00:51:31,280
sequence um and what we notice here is

1335
00:51:31,280 --> 00:51:33,680
that this is readable code for the most

1336
00:51:33,680 --> 00:51:35,359
part we see the title log into your

1337
00:51:35,359 --> 00:51:37,599
paypal account

1338
00:51:37,599 --> 00:51:39,839
what gets really weird though is that we

1339
00:51:39,839 --> 00:51:42,000
have more stuff that isn't exactly human

1340
00:51:42,000 --> 00:51:44,079
readable when we get around to this

1341
00:51:44,079 --> 00:51:45,680
section

1342
00:51:45,680 --> 00:51:48,720
and what it tells us here is a shortcut

1343
00:51:48,720 --> 00:51:51,760
icon and we look at the mime type it's

1344
00:51:51,760 --> 00:51:56,960
data image x icon base 64.

1345
00:51:56,960 --> 00:51:59,040
so i'm going to go ahead and guess that

1346
00:51:59,040 --> 00:52:01,680
this is likely some sort of base64

1347
00:52:01,680 --> 00:52:04,000
encoded content

1348
00:52:04,000 --> 00:52:06,240
and we'll go ahead and kind of scroll

1349
00:52:06,240 --> 00:52:08,400
past that stuff a little bit

1350
00:52:08,400 --> 00:52:10,319
based on what we see here might even be

1351
00:52:10,319 --> 00:52:12,720
an icon file of some sort

1352
00:52:12,720 --> 00:52:15,440
we'll go ahead and go back down and here

1353
00:52:15,440 --> 00:52:18,079
again we actually start seeing our html

1354
00:52:18,079 --> 00:52:21,280
coding that we can actually now read

1355
00:52:21,280 --> 00:52:23,040
what gets interesting is that we get

1356
00:52:23,040 --> 00:52:24,559
down here

1357
00:52:24,559 --> 00:52:27,200
we've got a table item and

1358
00:52:27,200 --> 00:52:30,400
this would appear to likely be an image

1359
00:52:30,400 --> 00:52:34,240
source and here again potentially base64

1360
00:52:34,240 --> 00:52:37,599
encoded probably base64 encoded based on

1361
00:52:37,599 --> 00:52:39,920
the mime type now that's

1362
00:52:39,920 --> 00:52:43,440
defined in here we have data image so

1363
00:52:43,440 --> 00:52:45,599
i'm going to guess that this is an image

1364
00:52:45,599 --> 00:52:46,559
file

1365
00:52:46,559 --> 00:52:50,160
and if we scroll through quite a ways it

1366
00:52:50,160 --> 00:52:51,839
takes us a little while before we get

1367
00:52:51,839 --> 00:52:54,240
back to the actual content

1368
00:52:54,240 --> 00:52:56,000
now this is something that's actually

1369
00:52:56,000 --> 00:52:58,400
relatively simple to

1370
00:52:58,400 --> 00:53:00,960
analyze here within the developer tools

1371
00:53:00,960 --> 00:53:03,200
we go back to our network tab

1372
00:53:03,200 --> 00:53:04,480
and we

1373
00:53:04,480 --> 00:53:07,520
look at uh some of what's in here let me

1374
00:53:07,520 --> 00:53:09,599
make that just a little bit smaller here

1375
00:53:09,599 --> 00:53:13,119
we see what was retrieved uh we have an

1376
00:53:13,119 --> 00:53:16,559
image file that is a jpeg and we have

1377
00:53:16,559 --> 00:53:19,200
base64 encoding and if we were to go

1378
00:53:19,200 --> 00:53:21,599
back and look it's going to be the same

1379
00:53:21,599 --> 00:53:23,520
code that we looked at in that second

1380
00:53:23,520 --> 00:53:26,640
file that was base64 encoded

1381
00:53:26,640 --> 00:53:28,880
and what is really nice is they have a

1382
00:53:28,880 --> 00:53:31,440
preview tab here that actually shows us

1383
00:53:31,440 --> 00:53:34,480
what the file looks like

1384
00:53:34,480 --> 00:53:36,319
we bounced back to our web page where we

1385
00:53:36,319 --> 00:53:39,200
loaded this again in our pretend sandbox

1386
00:53:39,200 --> 00:53:42,400
here's the logo file itself for paypal

1387
00:53:42,400 --> 00:53:44,480
in this particular location

1388
00:53:44,480 --> 00:53:46,319
so we've done this with the browser

1389
00:53:46,319 --> 00:53:49,200
developer tools and we've seen that this

1390
00:53:49,200 --> 00:53:52,400
is indeed all part of this single

1391
00:53:52,400 --> 00:53:54,400
file that we've looked at the source

1392
00:53:54,400 --> 00:53:55,760
code for

1393
00:53:55,760 --> 00:53:58,319
but what you might recall is that there

1394
00:53:58,319 --> 00:54:01,040
were two base64 encoded

1395
00:54:01,040 --> 00:54:02,720
things in here

1396
00:54:02,720 --> 00:54:04,079
and so

1397
00:54:04,079 --> 00:54:05,760
again i'll have to go ahead and click

1398
00:54:05,760 --> 00:54:09,599
edit as html and if i scroll past the

1399
00:54:09,599 --> 00:54:11,599
encoded parts it'll actually give me the

1400
00:54:11,599 --> 00:54:14,480
decoded version of the web page

1401
00:54:14,480 --> 00:54:16,960
and here again i'm guessing that it's an

1402
00:54:16,960 --> 00:54:19,599
icon file in all likelihood

1403
00:54:19,599 --> 00:54:22,319
what i want to do to manually do this

1404
00:54:22,319 --> 00:54:24,160
and what i want to show is how you

1405
00:54:24,160 --> 00:54:27,200
manually decode base64

1406
00:54:27,200 --> 00:54:29,040
items and so i'm going to go ahead and

1407
00:54:29,040 --> 00:54:32,480
copy this whole blob of stuff

1408
00:54:32,480 --> 00:54:34,240
i'm going to

1409
00:54:34,240 --> 00:54:36,959
open up a

1410
00:54:37,119 --> 00:54:39,200
new tab here and i'm going to go ahead

1411
00:54:39,200 --> 00:54:41,440
and paste this in here and what we have

1412
00:54:41,440 --> 00:54:43,839
is this big base64

1413
00:54:43,839 --> 00:54:46,079
encoded

1414
00:54:46,079 --> 00:54:47,200
data

1415
00:54:47,200 --> 00:54:49,760
and i want to go ahead and save this

1416
00:54:49,760 --> 00:54:51,359
particular

1417
00:54:51,359 --> 00:54:53,520
data and i'm going to go ahead and call

1418
00:54:53,520 --> 00:54:56,000
it uh

1419
00:54:56,000 --> 00:54:57,520
unknown

1420
00:54:57,520 --> 00:54:59,040
dot txt

1421
00:54:59,040 --> 00:55:01,200
that's essentially what we have we have

1422
00:55:01,200 --> 00:55:02,240
text

1423
00:55:02,240 --> 00:55:04,000
we can see what's here but it's not

1424
00:55:04,000 --> 00:55:06,640
necessarily human readable and what we

1425
00:55:06,640 --> 00:55:08,720
want to do with this

1426
00:55:08,720 --> 00:55:09,599
is

1427
00:55:09,599 --> 00:55:10,400
show

1428
00:55:10,400 --> 00:55:11,280
how

1429
00:55:11,280 --> 00:55:15,200
we would manually decode base64 content

1430
00:55:15,200 --> 00:55:17,920
so let me go ahead and

1431
00:55:17,920 --> 00:55:20,240
list out

1432
00:55:20,240 --> 00:55:22,079
my text file here

1433
00:55:22,079 --> 00:55:24,200
and here i have it

1434
00:55:24,200 --> 00:55:26,400
unknown.txt let me go ahead and clear

1435
00:55:26,400 --> 00:55:28,160
this as again

1436
00:55:28,160 --> 00:55:29,920
and so what we want to try and do here

1437
00:55:29,920 --> 00:55:31,839
is base64

1438
00:55:31,839 --> 00:55:34,720
for the command we'll do a dash i just

1439
00:55:34,720 --> 00:55:37,520
to sort of ignore any warnings or errors

1440
00:55:37,520 --> 00:55:39,040
or that kind of thing

1441
00:55:39,040 --> 00:55:42,640
we'll do a dash d for decode and let me

1442
00:55:42,640 --> 00:55:46,079
go ahead and pull unknown.txt

1443
00:55:46,079 --> 00:55:47,599
and what i'm going to do is redirect the

1444
00:55:47,599 --> 00:55:49,760
output and what i'm going to redirect

1445
00:55:49,760 --> 00:55:52,880
the output to is fave icon

1446
00:55:52,880 --> 00:55:54,480
ico

1447
00:55:54,480 --> 00:55:58,559
and hit enter and now if i do an ls l

1448
00:55:58,559 --> 00:56:01,359
star dot ico i should see that i have a

1449
00:56:01,359 --> 00:56:05,200
fave icon.ico file

1450
00:56:05,200 --> 00:56:07,760
so this is great it appears like we may

1451
00:56:07,760 --> 00:56:10,799
have decoded this thing successfully and

1452
00:56:10,799 --> 00:56:13,520
here's my favicon.ico file if i double

1453
00:56:13,520 --> 00:56:16,240
click on this open it up in an image

1454
00:56:16,240 --> 00:56:19,359
edit or viewer and i make this much

1455
00:56:19,359 --> 00:56:22,480
bigger than the default uh here we can

1456
00:56:22,480 --> 00:56:25,440
see what would appear to be a fav icon

1457
00:56:25,440 --> 00:56:27,680
within paypal now this is going to be

1458
00:56:27,680 --> 00:56:30,799
somewhat tricky to see here but in the

1459
00:56:30,799 --> 00:56:32,480
browser

1460
00:56:32,480 --> 00:56:35,280
at the top we see our fav icon file up

1461
00:56:35,280 --> 00:56:37,599
here

1462
00:56:37,599 --> 00:56:40,319
this is all interesting stuff

1463
00:56:40,319 --> 00:56:42,960
what we've observed through this is

1464
00:56:42,960 --> 00:56:45,920
that we've seen encoded elements and i'm

1465
00:56:45,920 --> 00:56:47,680
not sure whether the threat actor used

1466
00:56:47,680 --> 00:56:49,839
encoded elements to avoid analysis and

1467
00:56:49,839 --> 00:56:52,160
detection or they simply wanted to keep

1468
00:56:52,160 --> 00:56:55,040
the entire site as a single page file

1469
00:56:55,040 --> 00:56:58,480
but they use base64 encoded elements

1470
00:56:58,480 --> 00:57:01,040
inside of their javascript encoded page

1471
00:57:01,040 --> 00:57:03,440
and we've looked at demos for that

1472
00:57:03,440 --> 00:57:06,480
we've also seen how to decode the base64

1473
00:57:06,480 --> 00:57:08,240
using the built-in browser developer

1474
00:57:08,240 --> 00:57:10,160
tools and we've also

1475
00:57:10,160 --> 00:57:12,079
walked through how to decode those

1476
00:57:12,079 --> 00:57:14,480
elements by hand

1477
00:57:14,480 --> 00:57:16,480
in this case the remediation steps were

1478
00:57:16,480 --> 00:57:18,079
that we determined the final phishing

1479
00:57:18,079 --> 00:57:20,319
landing page and we blocked through web

1480
00:57:20,319 --> 00:57:22,000
content filtering

1481
00:57:22,000 --> 00:57:23,599
we also went ahead and blocked

1482
00:57:23,599 --> 00:57:25,680
intermediary compromised web servers

1483
00:57:25,680 --> 00:57:28,319
through content filtering since we had

1484
00:57:28,319 --> 00:57:30,720
identified numerous

1485
00:57:30,720 --> 00:57:32,799
compromised web hosts in foreign

1486
00:57:32,799 --> 00:57:34,079
countries

1487
00:57:34,079 --> 00:57:36,079
and then we reported the compromise

1488
00:57:36,079 --> 00:57:38,079
websites to domain owners and hosting

1489
00:57:38,079 --> 00:57:39,920
companies through their who is contact

1490
00:57:39,920 --> 00:57:41,119
records

1491
00:57:41,119 --> 00:57:43,040
that's a little bit of a leap of faith

1492
00:57:43,040 --> 00:57:45,440
now because everything is privatized so

1493
00:57:45,440 --> 00:57:47,440
hopefully the

1494
00:57:47,440 --> 00:57:49,680
privacy

1495
00:57:49,680 --> 00:57:51,599
email address is forwarding somewhere

1496
00:57:51,599 --> 00:57:53,680
that's being actively monitored we can

1497
00:57:53,680 --> 00:57:56,400
only control so much on our end but

1498
00:57:56,400 --> 00:57:58,640
those are the remediation steps we took

1499
00:57:58,640 --> 00:58:00,640
in this case that's all i have for this

1500
00:58:00,640 --> 00:58:02,559
presentation i'd like to thank everyone

1501
00:58:02,559 --> 00:58:05,200
for tuning in as you see me hanging out

1502
00:58:05,200 --> 00:58:08,240
on discord or a defgon please share your

1503
00:58:08,240 --> 00:58:10,319
own dfir stories

1504
00:58:10,319 --> 00:58:14,000
friends romans defcon attendees

1505
00:58:14,000 --> 00:58:16,799
lend me your irs

1506
00:58:16,799 --> 00:58:18,880
and with that i will be hanging out on

1507
00:58:18,880 --> 00:58:22,079
the discord to answer any questions

1508
00:58:22,079 --> 00:58:23,680
please feel free to reach out to me

1509
00:58:23,680 --> 00:58:24,559
there

1510
00:58:24,559 --> 00:58:26,720
and i want to thank everybody for tuning

1511
00:58:26,720 --> 00:58:28,799
in and hope everybody enjoys the rest of

1512
00:58:28,799 --> 00:58:32,040
their conference