1
00:00:03,620 --> 00:00:08,360
Okay. Maybe a little lower. Maybe not a little lower. Okay. I think we're good. So good

2
00:00:08,360 --> 00:00:13,980
morning, everyone. My name is Joe, Joe Slowik. I currently run CTI and a few other things for a

3
00:00:13,980 --> 00:00:18,660
company called Huntress. They might not really like some of the stuff I'm talking about today,

4
00:00:18,760 --> 00:00:23,140
so we'll just kind of leave it at that. I've been lots of other places, too, or whatever, but

5
00:00:23,140 --> 00:00:26,280
this is the first time I've ever spoken to main stage DEF CONs. I was really excited about

6
00:00:26,280 --> 00:00:33,420
this because I never thought I would. Because I am not the hacker type. I am more of the

7
00:00:33,420 --> 00:00:37,560
defender type or whatever. But I think this talk on burrowing through the network and really

8
00:00:37,560 --> 00:00:42,200
contextualizing something called the Vulcan leaks or Vulcan papers is something that's not just

9
00:00:42,200 --> 00:00:46,660
really valuable for my community, talking like blue teamers and so forth, but also provides a

10
00:00:46,660 --> 00:00:53,620
really good insight into how high-level advanced stage cyber operations work for our real

11
00:00:53,620 --> 00:00:56,080
high-end state-sponsored entities.

12
00:00:56,080 --> 00:00:56,260
Thank you.

13
00:00:56,280 --> 00:01:03,040
So with that, our agenda today is we're going to talk about, like, what the fuck are the Vulcan

14
00:01:03,040 --> 00:01:05,900
files or whatever. Like, I showed up here or whatever. I don't even know what these things are.

15
00:01:06,140 --> 00:01:11,660
So we'll level set on that and then get into how Vulcan relates to the ecosystem of Russian

16
00:01:11,660 --> 00:01:17,760
cyber operations and then orient what Vulcan looks like within the context of greater cyber

17
00:01:17,760 --> 00:01:23,040
history. Because I think as a relatively young discipline, we still do a real shit job in

18
00:01:23,040 --> 00:01:25,760
understanding what has come before and how it all links together.

19
00:01:25,760 --> 00:01:32,020
And comes evolves over time. With that in mind, we'll then talk about what the future looks like

20
00:01:32,020 --> 00:01:36,740
for cyber operations, offensive espionage and other, and close out with some conclusions and

21
00:01:36,740 --> 00:01:39,800
hopefully I'm not over time at that point because they will throw me off the stage if I am.

22
00:01:40,480 --> 00:01:48,720
So the Vulcan files. What are the Vulcan files? So the Vulcan files were a are a cache of

23
00:01:48,720 --> 00:01:55,680
documents that were disclosed to primarily two German journalists, Hakan Tanrivardi and Hannes

24
00:01:55,680 --> 00:02:00,660
Munzinger who were both former at Süddeutsche Zeitung. They're now working for the German

25
00:02:00,660 --> 00:02:06,860
state broadcaster and for this effort they worked with Der Spiegel. Hundreds and hundreds of

26
00:02:06,860 --> 00:02:13,440
pages of project documentation, contracting documents and similar for a bunch of cyber

27
00:02:13,440 --> 00:02:20,460
operation tools and effects payloads sponsored by various Russian agencies. Really cool

28
00:02:20,460 --> 00:02:25,280
stuff. It was a pleasure to help out Hakan and Hannes or whatever on this work.

29
00:02:25,680 --> 00:02:30,260
But there was also coverage in English in the Washington Post. Ellen Nakashima and others

30
00:02:30,260 --> 00:02:36,060
published on this as well for American audiences. And you had cyber firms or whatever like

31
00:02:36,060 --> 00:02:40,900
Mandiant now part of Google Cloud, part of something or other, Alphabet, whatever that chain

32
00:02:40,900 --> 00:02:45,680
looks like, who did a deep dive on this as well. Some really good contextualization from like

33
00:02:45,680 --> 00:02:50,580
you know the so what cyber defense perspective on these things. So that was all pretty cool.

34
00:02:50,740 --> 00:02:54,900
We'll get back to like well why am I not hearing about this until today or whatever for I'm

35
00:02:54,900 --> 00:02:55,380
guessing a

36
00:02:55,680 --> 00:03:00,720
non-trivial number of folks in the room. But in looking at what the Vulcan leaks are, they

37
00:03:00,720 --> 00:03:06,100
involve a company called NTC Vulcan, which is located in Russia. The leaks themselves, I already

38
00:03:06,100 --> 00:03:10,060
said like hundreds and hundreds of pages of materials or whatever like primary source

39
00:03:10,060 --> 00:03:14,640
documents that I think for historians will be quite interesting or whatever as we write the

40
00:03:14,640 --> 00:03:20,280
story of what cyber looked like in the 2020s and 2010s. And then the significance of these

41
00:03:20,280 --> 00:03:25,660
things. So in looking at NTC Vulcan, this is a computer technology firm that is

42
00:03:25,660 --> 00:03:31,820
owned and operated by Russian military veterans with the approval or authorization to perform

43
00:03:31,820 --> 00:03:37,160
classified or sensitive work for Russian state organizations. Not all that different for how many

44
00:03:37,160 --> 00:03:40,920
veteran owned businesses you'll see scattered up and down you know the highway or whatever

45
00:03:40,920 --> 00:03:47,060
between say Northern Virginia and Southern Maryland and whatnot. So you know other folks have

46
00:03:47,060 --> 00:03:52,240
contractors or whatever that are coming out of dot gov space, dot mil space and starting up their

47
00:03:52,240 --> 00:03:54,960
own dot coms or whatever for twice the salaries and so forth.

48
00:03:55,660 --> 00:04:00,960
The leaks themselves came from an unknown entity. There is some discussion that this was an entity who was

49
00:04:02,300 --> 00:04:09,400
upset and disgusted with his country's policies towards Ukraine and that this was an act of protest for some of the

50
00:04:09,400 --> 00:04:15,380
capabilities that they were responsible for or linked to in development, but obviously for their safety, they have not been revealed.

51
00:04:15,760 --> 00:04:25,600
Lord knows where they are right now or whatever, hopefully somewhere far away from Russia at this point in time, but provided this documentation to the journalists I mentioned earlier who then went through a

52
00:04:25,660 --> 00:04:40,860
consortium of paper cut media in order to disseminate this to a variety of other news organizations, The Guardian, I can't remember if it was Le Monde or Le Figaro, but anyway, French publications, Washington Post, et cetera, to try to get this far and wide.

53
00:04:41,520 --> 00:04:55,580
And then the significance of these, like we don't see this kind of shit very often. We see it a lot when it comes to say the US space, and I'll get to that a little later on, and some leaks that have come about from western sources or whatever, but like other

54
00:04:55,660 --> 00:05:12,780
than things, like if you're familiar with the Intrusion Truth Twitter account and some of the work that they've done in publicizing Chinese nexus operations, seeing this sort of leak or disclosure or whatever from an insider doesn't happen terribly often, and we haven't seen a whole lot of this coming from the Russian space.

55
00:05:13,140 --> 00:05:25,640
And so really getting this view into the nuts and bolts of cyber network or computer network operations is pretty cool and pretty interesting shit. So here's Vulcan. I don't know if they're still in this building or not, but that's the Google Strip.

56
00:05:25,660 --> 00:05:39,380
We have a great view from the address that was up to date as of like 2021. So hi guys. I'm not going to call them assholes because we're all kind of in this together, and who among us has not provided, like, you know, controversial tools to government agencies or whatever as part of our employment?

57
00:05:39,640 --> 00:05:41,020
Don't answer that question, I suppose.

58
00:05:43,780 --> 00:05:54,340
Again, Vulcan files covering lots of stuff, but three primary programs of interest, one of which we'll focus on today. So the one that we'll focus and spend the most amount of time on is Scan or ScanV.

59
00:05:55,220 --> 00:05:55,640
Which is a little bit of a different one.

60
00:05:55,660 --> 00:05:58,880
which is a scanning suite, but it's a lot more than that.

61
00:05:58,960 --> 00:06:00,540
We'll get into the significance of that shortly.

62
00:06:00,940 --> 00:06:04,380
A information operations platform called Amazit,

63
00:06:04,500 --> 00:06:07,140
which, while we're not gonna spend too much time on that,

64
00:06:07,380 --> 00:06:10,240
very interesting from a forward-deployed

65
00:06:10,240 --> 00:06:12,740
information operations sort of capability space.

66
00:06:13,260 --> 00:06:15,640
And then there was another tool called Crystal2V,

67
00:06:15,800 --> 00:06:17,460
which we're not gonna talk about that much at all,

68
00:06:17,500 --> 00:06:19,300
because I frankly don't find it all that interesting

69
00:06:19,300 --> 00:06:20,500
other than that it exists,

70
00:06:20,760 --> 00:06:24,000
that looks to be a sort of like a testing

71
00:06:24,000 --> 00:06:25,480
or penetration testing platform

72
00:06:25,820 --> 00:06:28,100
for industrial control environments and similar,

73
00:06:28,300 --> 00:06:31,180
but doesn't appear to be as concerning or whatever

74
00:06:31,180 --> 00:06:34,240
as some of the malware we've seen coming out of Russia,

75
00:06:34,400 --> 00:06:40,160
like Triton and Destroyer and similar.

76
00:06:40,780 --> 00:06:43,860
But to get back to ScanV, what we're talking about here

77
00:06:43,860 --> 00:06:47,120
is a really interesting program combining multiple networks

78
00:06:47,540 --> 00:06:50,280
to set up a scanning enumeration, exploitation,

79
00:06:50,640 --> 00:06:53,180
and data collection platform that goes across

80
00:06:53,180 --> 00:06:53,980
several different networks.

81
00:06:53,980 --> 00:06:54,080
And that's what we're talking about here,

82
00:06:54,080 --> 00:06:54,740
is that we're looking at different information domains.

83
00:06:55,140 --> 00:06:57,040
So I don't have a pointer or anything here,

84
00:06:57,200 --> 00:07:00,180
but if you look at this, we go from the external internet,

85
00:07:00,380 --> 00:07:03,860
where systems that are set up with a bunch of

86
00:07:03,860 --> 00:07:07,280
publicly available and non-publicly available exploits

87
00:07:07,280 --> 00:07:10,200
or knowledge of vulnerabilities and exploit payloads

88
00:07:10,200 --> 00:07:12,800
for those vulnerabilities, being able to deploy those

89
00:07:12,800 --> 00:07:15,120
to victim nodes as well as extract information

90
00:07:15,120 --> 00:07:18,480
and task exploited nodes to then move into

91
00:07:18,480 --> 00:07:21,120
a processing environment that, if you can make it out,

92
00:07:21,180 --> 00:07:23,960
it's a little small, you see on the right, with that,

93
00:07:23,960 --> 00:07:25,880
that red network and the green network in the corner,

94
00:07:26,120 --> 00:07:29,680
CD and CD, so talking true sneaker net operations

95
00:07:29,680 --> 00:07:32,560
and moving data into classified processing platforms

96
00:07:32,560 --> 00:07:34,660
for further analysis and evaluation.

97
00:07:35,180 --> 00:07:36,080
This is cool shit.

98
00:07:36,240 --> 00:07:38,560
This is like how the sausage gets made

99
00:07:38,560 --> 00:07:41,160
when it comes to state-sponsored cyber operations.

100
00:07:41,620 --> 00:07:42,940
You'll notice I'm not saying nation state,

101
00:07:43,100 --> 00:07:44,160
because if you say nation state,

102
00:07:44,320 --> 00:07:46,920
it hits you in the head with a sock with a bar of soap in it.

103
00:07:47,400 --> 00:07:52,380
But anyway, the idea here being is that ScanV, by design,

104
00:07:52,380 --> 00:07:55,100
is a distributed multi-component system

105
00:07:55,100 --> 00:07:57,960
with various information boundaries, public internet,

106
00:07:58,220 --> 00:08:01,400
private internal network that has internet connectivity,

107
00:08:01,700 --> 00:08:04,980
and then having out-of-band networks, not air gaps,

108
00:08:05,120 --> 00:08:06,980
because we are sneaker netting shit over there,

109
00:08:07,160 --> 00:08:09,220
to classify processing mechanisms.

110
00:08:09,620 --> 00:08:12,260
It's designed for the automated tasking and action

111
00:08:12,260 --> 00:08:13,780
within pre-programmed capabilities.

112
00:08:14,160 --> 00:08:17,520
So we're talking about basically standing up a platform

113
00:08:17,520 --> 00:08:20,560
to do exploitation and subversion at scale.

114
00:08:21,160 --> 00:08:22,200
The purpose of this,

115
00:08:22,200 --> 00:08:23,360
well, we can't really,

116
00:08:23,920 --> 00:08:26,180
there's not an explicit purpose document

117
00:08:26,560 --> 00:08:28,580
that I was able to find, at least in the Vulcan documents,

118
00:08:28,740 --> 00:08:29,800
which, by the way, you can download

119
00:08:29,800 --> 00:08:31,960
if you want to look at them and read Russian.

120
00:08:32,240 --> 00:08:33,700
It's linked at the end of this presentation.

121
00:08:35,160 --> 00:08:38,220
But really looks to combine external scanning functionality

122
00:08:38,680 --> 00:08:41,140
with a catalog of vulnerable software and exploits.

123
00:08:41,340 --> 00:08:43,360
So go after all of the Forda OS

124
00:08:43,360 --> 00:08:44,720
like everyone else in the world,

125
00:08:44,880 --> 00:08:47,800
or here's your Citrix devices or whatever and pop those,

126
00:08:48,100 --> 00:08:49,380
and we'll talk to how this links

127
00:08:49,380 --> 00:08:51,800
to other Russian operations here in a little bit,

128
00:08:51,800 --> 00:08:54,460
but the main idea here is automating

129
00:08:54,460 --> 00:08:56,660
or increasing the efficiency of cyber operations

130
00:08:56,920 --> 00:08:58,640
as well as infrastructure harvesting.

131
00:08:58,980 --> 00:09:01,460
Not just identifying endpoints that are valuable

132
00:09:01,460 --> 00:09:03,440
in themselves as sources of information

133
00:09:03,920 --> 00:09:05,460
or targets of disruption,

134
00:09:05,800 --> 00:09:08,440
but setting up the sort of network intermediaries

135
00:09:08,440 --> 00:09:11,720
that could be used to tunnel and launder network traffic

136
00:09:11,720 --> 00:09:13,220
so it doesn't look as malicious.

137
00:09:13,400 --> 00:09:15,900
It's coming from Susie's home router or whatever

138
00:09:15,900 --> 00:09:18,900
from their ISP and not directly from GRU headquarters

139
00:09:19,500 --> 00:09:21,300
located on the outskirts of Moscow.

140
00:09:23,180 --> 00:09:25,060
Umizit is another program that I,

141
00:09:25,160 --> 00:09:27,340
again, we're not gonna spend too much time on that here

142
00:09:27,340 --> 00:09:28,740
because again, we only have 45 minutes

143
00:09:28,740 --> 00:09:31,840
and so we have many miles to go before we sleep and such.

144
00:09:32,060 --> 00:09:34,900
But it is interesting in that it provides a platform

145
00:09:35,560 --> 00:09:38,720
that by physically connecting to mobile

146
00:09:38,720 --> 00:09:40,380
and information networks,

147
00:09:40,600 --> 00:09:43,440
so installing hardware in the switching center

148
00:09:43,440 --> 00:09:46,980
or at the BSC or BTS if we're talking cellular networks

149
00:09:46,980 --> 00:09:49,140
and so forth, that it provides the ability

150
00:09:49,140 --> 00:09:51,780
of not just reading traffic and you can see the panel,

151
00:09:51,780 --> 00:09:53,480
on the left, that we have Twitter,

152
00:09:53,780 --> 00:09:57,480
the contact live journal I think is up here.

153
00:09:57,620 --> 00:10:00,040
I guess that's still popular in Russia, who the hell knows.

154
00:10:01,340 --> 00:10:04,100
But various posting and social media platforms,

155
00:10:04,340 --> 00:10:05,660
not just for a collection perspective,

156
00:10:06,000 --> 00:10:08,660
but also providing the capabilities of injecting into

157
00:10:08,660 --> 00:10:11,000
and modifying those communication streams.

158
00:10:11,400 --> 00:10:14,040
That's pretty interesting because it moves beyond espionage

159
00:10:14,040 --> 00:10:17,260
to being able to do things like modify or send tweets

160
00:10:17,260 --> 00:10:20,280
impersonating individuals to influence conversations

161
00:10:20,280 --> 00:10:21,660
and do other sort of info

162
00:10:21,780 --> 00:10:22,520
ops activities.

163
00:10:23,320 --> 00:10:25,820
So in looking at this, we have Amazit as an information

164
00:10:25,820 --> 00:10:27,420
operations and collections platform.

165
00:10:27,740 --> 00:10:30,180
There's also some like ICS, OT shit or whatever

166
00:10:30,750 --> 00:10:31,620
related to that as well.

167
00:10:31,800 --> 00:10:33,240
Dragos did a deep dive into that.

168
00:10:33,320 --> 00:10:34,780
If you're curious, we're not gonna get too much

169
00:10:34,780 --> 00:10:35,560
into that here today.

170
00:10:37,260 --> 00:10:39,400
It's interesting because it's capable of capturing

171
00:10:39,400 --> 00:10:41,120
and processing communication streams,

172
00:10:41,300 --> 00:10:42,200
not just for collection,

173
00:10:42,240 --> 00:10:44,260
but for that manipulation piece as well.

174
00:10:44,860 --> 00:10:46,400
And that has potential applications

175
00:10:46,400 --> 00:10:48,420
because this is a mobile sort of system.

176
00:10:48,520 --> 00:10:51,340
So it's not just about deploying this in Dagestan or Chechnya

177
00:10:51,340 --> 00:10:54,620
or something like that for internal communication monitoring,

178
00:10:54,960 --> 00:10:57,180
but you could imagine, although there has not been evidence

179
00:10:57,180 --> 00:10:59,160
of this to date that we are aware of,

180
00:10:59,200 --> 00:11:02,800
of taking this into occupied areas of Ukraine or similar

181
00:11:03,140 --> 00:11:05,920
in order to establish some degree of population influence

182
00:11:05,920 --> 00:11:09,240
or control through capturing and manipulating

183
00:11:09,240 --> 00:11:10,440
social media streams.

184
00:11:10,860 --> 00:11:12,360
So scary stuff as shit or whatever,

185
00:11:12,520 --> 00:11:14,480
people really getting their tentacles into

186
00:11:14,880 --> 00:11:16,180
these sorts of areas.

187
00:11:16,580 --> 00:11:19,420
So that's all cool and scary and cybery and whatnot,

188
00:11:19,420 --> 00:11:22,840
but the response to the Vulcan leaks was kind of meh.

189
00:11:23,220 --> 00:11:24,860
It was really unfortunate because I thought

190
00:11:24,860 --> 00:11:25,680
this was some cool shit,

191
00:11:25,800 --> 00:11:27,840
but after the week that all this came out,

192
00:11:28,760 --> 00:11:30,220
seemed like no one really cared.

193
00:11:30,460 --> 00:11:31,840
And I don't really know why that is.

194
00:11:32,720 --> 00:11:34,740
Certainly there's a lot going on in the world right now.

195
00:11:35,060 --> 00:11:37,600
You've seen the meme or whatever of aliens land on Earth

196
00:11:37,600 --> 00:11:39,580
and dude or whatever is in the corner smoking.

197
00:11:39,680 --> 00:11:41,140
It's like, dude, I got a lot going on right now.

198
00:11:41,200 --> 00:11:41,760
I can't do this.

199
00:11:43,960 --> 00:11:45,740
So what else has been going on?

200
00:11:46,000 --> 00:11:48,440
Well, we've got this asshole getting indicted or whatever.

201
00:11:48,640 --> 00:11:49,400
So, you know, I'm trying to figure out what's going on.

202
00:11:49,400 --> 00:11:49,940
Stuff like that.

203
00:11:50,400 --> 00:11:53,040
We've got, you know, Taylor Swift taking over the world.

204
00:11:53,360 --> 00:11:55,520
You know, other things to attract our attention.

205
00:11:56,080 --> 00:11:57,460
And you know, we've got UFOs out there.

206
00:11:57,620 --> 00:11:58,700
So maybe people were just busy.

207
00:11:58,780 --> 00:11:59,140
I don't know.

208
00:11:59,360 --> 00:12:01,560
But that's one of the reasons why I thought

209
00:12:01,560 --> 00:12:04,040
this would be a useful presentation to a wider audience

210
00:12:04,040 --> 00:12:07,320
because not just what was reported in the news,

211
00:12:07,380 --> 00:12:10,420
but also connecting Vulcan to the history

212
00:12:10,420 --> 00:12:13,120
of cyber operations, which we'll get into here momentarily.

213
00:12:13,860 --> 00:12:15,540
So in diving into the Vulcan leaks,

214
00:12:15,680 --> 00:12:17,460
they represent a significant event in the history

215
00:12:17,460 --> 00:12:18,440
of cyber operations.

216
00:12:18,440 --> 00:12:20,980
Now we just need to review what the hell

217
00:12:20,980 --> 00:12:23,380
is inside these things after that short overview.

218
00:12:24,640 --> 00:12:25,920
So in looking at the Vulcan leaks,

219
00:12:26,020 --> 00:12:27,580
we have NTC Vulcan as an entity.

220
00:12:27,880 --> 00:12:31,820
And then these programs, ScanV, Amazit, Crystal2V, also

221
00:12:31,820 --> 00:12:35,200
MiniDuke, which Google's tag associated

222
00:12:35,680 --> 00:12:38,920
with Russian operations and linked it based upon the Vulcan

223
00:12:38,920 --> 00:12:40,780
leaks to NTC Vulcan as well.

224
00:12:41,020 --> 00:12:44,880
So four software programs, one not explicitly documented

225
00:12:44,880 --> 00:12:47,340
in the leaks themselves that link to this one organization.

226
00:12:47,740 --> 00:12:48,420
But more importantly, we've got a bunch of software programs.

227
00:12:48,420 --> 00:12:50,600
And more importantly, these items also directly link

228
00:12:50,600 --> 00:12:52,720
to various elements of Russian cyber operations.

229
00:12:53,340 --> 00:12:55,940
ScanV is associated quite directly

230
00:12:55,940 --> 00:13:01,480
with the Russian military intelligence GRU unit 74455,

231
00:13:01,760 --> 00:13:05,660
also known as Sandworm, which is a pretty gnarly actor

232
00:13:05,660 --> 00:13:08,080
that does lots of asshole-ish shit or whatever all

233
00:13:08,080 --> 00:13:10,280
across the world, and especially in Ukraine these days.

234
00:13:10,900 --> 00:13:13,120
Amazit, as an information operations platform,

235
00:13:13,340 --> 00:13:16,500
was linked to the Radio Research Institute in Russia,

236
00:13:16,660 --> 00:13:17,680
which is also associated

237
00:13:17,680 --> 00:13:20,580
with the Russian Federal Security Service, or FSB.

238
00:13:20,800 --> 00:13:23,980
So internal intelligence and security services,

239
00:13:24,160 --> 00:13:25,860
but certainly with an external mission as well.

240
00:13:26,180 --> 00:13:29,880
And then MiniDuke was linked back to SVR operations,

241
00:13:30,060 --> 00:13:34,140
our APT29 and whatever mess that is these days between Nobellium

242
00:13:34,140 --> 00:13:38,020
and throw a bunch of other stupid names or whatever

243
00:13:38,020 --> 00:13:38,980
at the problem or whatever.

244
00:13:39,180 --> 00:13:41,560
But we're seeing NTC Vulcan working

245
00:13:41,560 --> 00:13:45,280
with each leg of the Russian CNO tripod, which

246
00:13:45,280 --> 00:13:45,900
is kind of interesting.

247
00:13:46,480 --> 00:13:47,660
Because for various reasons.

248
00:13:47,680 --> 00:13:51,240
Especially between the civilian intelligence agencies,

249
00:13:51,380 --> 00:13:53,860
like SVR and FSB, and then the GRU,

250
00:13:53,960 --> 00:13:57,380
if you looked at something like Mark Gagliotti's Russian Putin's

251
00:13:57,380 --> 00:14:00,180
Cyber Hydra or whatever, a lot of these organizations don't

252
00:14:00,180 --> 00:14:02,100
get along very well and are actually quite competitive

253
00:14:02,100 --> 00:14:02,740
with each other.

254
00:14:03,160 --> 00:14:07,460
Yet NTC Vulcan is doing work for all three roughly

255
00:14:07,460 --> 00:14:09,140
simultaneously, which is kind of interesting.

256
00:14:09,420 --> 00:14:14,200
It's not completely unique, but it is sort of rare to see

257
00:14:14,200 --> 00:14:17,340
that sort of spread across multiple facets of cyber

258
00:14:17,340 --> 00:14:17,660
operations.

259
00:14:17,680 --> 00:14:20,880
Instead of having just one or two dedicated customers

260
00:14:20,880 --> 00:14:21,700
as part of this.

261
00:14:22,180 --> 00:14:25,680
So with that, we see that Russian cyber operations

262
00:14:25,960 --> 00:14:28,040
has a variety of links to the private sector.

263
00:14:28,220 --> 00:14:31,120
So one example that I actually presented at Virus Bulletin

264
00:14:31,120 --> 00:14:37,200
last year is SNKM, T-S-N-I-A-K-H-M, a research

265
00:14:37,200 --> 00:14:39,380
institute associated with Russia's Ministry of Defense,

266
00:14:39,680 --> 00:14:42,100
and an entity referred to as Xenotime, which we're not

267
00:14:42,100 --> 00:14:44,480
quite sure where it aligns with Russian cyber operations.

268
00:14:44,700 --> 00:14:47,260
It seems GRU-ish, but not necessarily.

269
00:14:47,680 --> 00:14:50,480
So there's some nuanced reasons for that that we can't get

270
00:14:50,480 --> 00:14:51,880
into today for timing reasons.

271
00:14:52,300 --> 00:14:54,760
But we've also seen organizations like the SVA

272
00:14:54,760 --> 00:14:57,800
Institute, another research organization in ties to the

273
00:14:57,800 --> 00:15:02,580
SVR, or ODT, yet another public private research

274
00:15:02,580 --> 00:15:06,520
organization tied to the FSB's front on botnet that was used

275
00:15:06,520 --> 00:15:07,560
in disruptive operations.

276
00:15:08,460 --> 00:15:11,200
A KVANT Institute, another public private research

277
00:15:11,200 --> 00:15:14,520
organization linked to the FSB in supporting and enabling

278
00:15:14,520 --> 00:15:16,960
operations and sanctioned by the US Department of the

279
00:15:16,960 --> 00:15:17,280
Treasury.

280
00:15:17,780 --> 00:15:19,660
And also, InController and Pipedream.

281
00:15:19,840 --> 00:15:20,520
Wait a minute.

282
00:15:20,720 --> 00:15:22,940
No one linked InController and Pipedream to Russia, right?

283
00:15:23,100 --> 00:15:26,020
We talked about that here, I think, in track four last year.

284
00:15:26,180 --> 00:15:27,760
A former colleague of mine, Jimmy Wiley,

285
00:15:27,980 --> 00:15:30,740
did a deep dive into Pipedream and InController,

286
00:15:30,860 --> 00:15:31,680
which was quite fascinating.

287
00:15:32,160 --> 00:15:34,420
But if you look around enough or whatever,

288
00:15:34,560 --> 00:15:37,220
you'll see that there are folks that have tied InController

289
00:15:37,220 --> 00:15:40,000
or Pipedream, depending on which vendor you're going with a naming

290
00:15:40,000 --> 00:15:43,500
schema, to an organization called Advanced System

291
00:15:43,500 --> 00:15:46,220
Technologies, a contracting entity in Russia.

292
00:15:46,440 --> 00:15:47,080
So again.

293
00:15:47,080 --> 00:15:49,480
And seeing this nexus of private sector organizations

294
00:15:50,020 --> 00:15:51,740
developing and deploying tooling,

295
00:15:51,980 --> 00:15:54,560
such as Droverub, also associated with AST,

296
00:15:54,820 --> 00:15:57,820
and that was the subject of a fairly lengthy malware analysis

297
00:15:57,820 --> 00:16:01,180
report released by the United States during COVID,

298
00:16:01,340 --> 00:16:03,680
which again kind of floated off the radar a little bit.

299
00:16:04,140 --> 00:16:06,200
But the idea of this privatization

300
00:16:06,200 --> 00:16:08,460
of cyber warfare, oh, I said it.

301
00:16:08,520 --> 00:16:08,820
I'm sorry.

302
00:16:09,560 --> 00:16:12,760
But the idea being is that we're maximizing on capabilities

303
00:16:12,760 --> 00:16:15,580
by extending beyond the silos of government organizations

304
00:16:15,580 --> 00:16:16,500
to take advantage.

305
00:16:16,500 --> 00:16:18,260
We're taking advantage of public-private relationships

306
00:16:18,260 --> 00:16:20,600
and research institutions, as well as

307
00:16:20,600 --> 00:16:24,000
outright commercial entities to support state-directed efforts.

308
00:16:24,720 --> 00:16:27,660
So in looking at this, NTC Vulcan is both an example

309
00:16:27,660 --> 00:16:31,460
and a pioneer, in a way, of increasingly outsourced

310
00:16:31,460 --> 00:16:32,740
cyber development and engineering

311
00:16:32,740 --> 00:16:34,260
for state-directed operations.

312
00:16:34,780 --> 00:16:37,580
However, it's important to note, this is not just Russia.

313
00:16:37,680 --> 00:16:39,880
This is not just happening there by any stretch of the imagination.

314
00:16:40,360 --> 00:16:42,520
And there were probably some people at that other event

315
00:16:42,520 --> 00:16:45,420
or whatever up the strip earlier today that had booths that are

316
00:16:45,420 --> 00:16:46,380
just as involved in this.

317
00:16:46,500 --> 00:16:46,980
But it's also happening in the security space, as well.

318
00:16:47,780 --> 00:16:49,880
So let's go into ScanV and Sandworm,

319
00:16:50,000 --> 00:16:51,900
because that's kind of the most interesting item

320
00:16:51,900 --> 00:16:53,940
from my perspective, especially because I'm kind

321
00:16:53,940 --> 00:16:55,840
of an infrastructure analyst at heart when it comes

322
00:16:55,840 --> 00:16:57,800
to what I do in the security space.

323
00:16:58,200 --> 00:17:00,780
So Sandworm historically leverages compromised,

324
00:17:01,080 --> 00:17:01,840
legitimate infrastructure.

325
00:17:02,240 --> 00:17:03,980
They don't spin up their own, like,

326
00:17:03,980 --> 00:17:06,400
Hetzner or HostSailor or AWS Node.

327
00:17:06,740 --> 00:17:09,040
They'll go out and compromise someone else's server

328
00:17:09,040 --> 00:17:10,840
or whatever and tunnel traffic through there

329
00:17:10,840 --> 00:17:13,420
as an OPSEC mechanism.

330
00:17:13,580 --> 00:17:16,480
And to try to break the trail going back and forth.

331
00:17:16,500 --> 00:17:17,920
And to try to get back to them and their organization.

332
00:17:18,300 --> 00:17:20,080
And there's multiple examples of this.

333
00:17:20,200 --> 00:17:21,760
Going all the way back to, like,

334
00:17:21,760 --> 00:17:24,200
Indestroyer from the 2016 Ukraine event,

335
00:17:24,360 --> 00:17:28,960
where they used what appeared to be compromised Tor exit nodes

336
00:17:28,960 --> 00:17:33,580
as the last step command and control infrastructure

337
00:17:34,420 --> 00:17:36,240
before accessing the infrastructure

338
00:17:36,240 --> 00:17:38,380
where Indestroyer was deployed.

339
00:17:38,880 --> 00:17:42,960
But also more recent items like VPN filter and Cyclops Blink.

340
00:17:43,020 --> 00:17:44,400
We'll get back to those here in a minute.

341
00:17:44,620 --> 00:17:46,100
But the important thing is that,

342
00:17:46,500 --> 00:17:48,640
what ScanV represents is a way of getting

343
00:17:48,640 --> 00:17:51,260
this sort of burnable, deniable infrastructure

344
00:17:51,260 --> 00:17:53,860
and doing it and tasking it at scale

345
00:17:53,860 --> 00:17:55,340
and in a semi-automated fashion.

346
00:17:55,680 --> 00:17:57,360
So being able to hack the planet

347
00:17:57,360 --> 00:18:00,200
in a way that allows an operator to enter in some criteria

348
00:18:00,200 --> 00:18:01,460
and then step off keyboard.

349
00:18:02,760 --> 00:18:03,960
So when looking at this,

350
00:18:04,140 --> 00:18:07,080
we can operationalize this sort of idea

351
00:18:07,080 --> 00:18:08,220
by stockpiling vulnerabilities.

352
00:18:08,720 --> 00:18:11,180
And as anyone here who does any sort of red teaming knows,

353
00:18:11,460 --> 00:18:13,240
it doesn't have to be a damn zero day.

354
00:18:13,340 --> 00:18:14,720
People don't pat shit for years,

355
00:18:14,720 --> 00:18:16,520
especially when it comes to infrastructure crap.

356
00:18:16,840 --> 00:18:20,280
But coming up with a list of publicly known

357
00:18:20,760 --> 00:18:22,160
plus one day vulnerabilities

358
00:18:22,500 --> 00:18:24,360
and then sprinkle in a couple of zero days

359
00:18:24,360 --> 00:18:25,620
if you really have to, I suppose,

360
00:18:25,960 --> 00:18:29,280
and you have a quiver of arrows

361
00:18:29,280 --> 00:18:31,100
to launch at a variety of targets

362
00:18:31,100 --> 00:18:32,380
in order to get points of presence

363
00:18:32,380 --> 00:18:33,420
in a variety of networks.

364
00:18:33,860 --> 00:18:35,900
Then I just need to identify vulnerable nodes.

365
00:18:36,220 --> 00:18:38,880
And what's interesting is that ScanV does have a Shodan plug-in.

366
00:18:39,420 --> 00:18:40,180
So yay.

367
00:18:41,580 --> 00:18:42,840
A little unfortunate,

368
00:18:42,840 --> 00:18:45,260
but you can't avoid these sorts of things, I imagine.

369
00:18:45,540 --> 00:18:47,540
But also it does its own scanning and evaluation

370
00:18:47,540 --> 00:18:49,580
and so forth and looking for these vulnerabilities.

371
00:18:50,160 --> 00:18:51,400
And then through exploitation,

372
00:18:51,840 --> 00:18:54,920
marshal victims into proxy chains for operations.

373
00:18:55,220 --> 00:18:57,920
So that I can go from GRU HQ

374
00:18:57,920 --> 00:18:59,840
where my operators are doing operations

375
00:18:59,840 --> 00:19:02,740
to some Soho microteak or whatever

376
00:19:02,740 --> 00:19:03,860
that's out there in the wild

377
00:19:03,860 --> 00:19:05,200
to my ultimate victim.

378
00:19:05,320 --> 00:19:07,400
And probably having multiple steps in the middle there

379
00:19:07,400 --> 00:19:09,940
so that all my net flow analysis or whatever

380
00:19:09,940 --> 00:19:12,140
that scare the shit out of Ron Wyden and other folks

381
00:19:12,140 --> 00:19:14,440
really kind of goes down the toilet

382
00:19:14,440 --> 00:19:17,340
because I'm doing chained communication

383
00:19:17,340 --> 00:19:19,940
or whatever across multiple items along the way.

384
00:19:20,220 --> 00:19:21,580
And so what I get is this.

385
00:19:21,740 --> 00:19:23,320
Not like just some creepy old man

386
00:19:23,320 --> 00:19:24,500
staring into the Palantir

387
00:19:24,500 --> 00:19:26,240
or whatever the hell this orb is or whatever.

388
00:19:26,480 --> 00:19:28,040
But really, check out my orb.

389
00:19:28,620 --> 00:19:29,600
Operational relay boxes.

390
00:19:30,020 --> 00:19:31,660
People who say command and control nodes

391
00:19:31,660 --> 00:19:32,720
and call them orbs,

392
00:19:32,760 --> 00:19:34,020
you can probably guess

393
00:19:34,020 --> 00:19:35,640
either they worked somewhere previously

394
00:19:35,640 --> 00:19:37,340
or they're LARPing as someone

395
00:19:37,340 --> 00:19:38,640
that worked somewhere previously.

396
00:19:39,300 --> 00:19:41,240
The idea being is that you get

397
00:19:41,860 --> 00:19:43,460
burnable, reusable infrastructure

398
00:19:43,460 --> 00:19:45,180
that's not directly linked to yourself

399
00:19:45,180 --> 00:19:47,120
in order to execute operations

400
00:19:47,120 --> 00:19:49,220
to avoid tracing back

401
00:19:49,220 --> 00:19:51,660
and to also allow for you to burn that infrastructure

402
00:19:51,660 --> 00:19:53,320
without losing something more valuable

403
00:19:53,320 --> 00:19:54,400
in the process.

404
00:19:55,180 --> 00:19:57,320
So what's the so what behind these sorts of items?

405
00:19:57,500 --> 00:19:58,860
Like, okay, it's cool hacking programs

406
00:19:58,860 --> 00:19:59,600
that got leaked or whatever.

407
00:19:59,720 --> 00:20:00,560
Big fucking deal, dude.

408
00:20:01,580 --> 00:20:04,100
Well, there's this focus on scalability

409
00:20:04,100 --> 00:20:06,020
and control of widespread operations.

410
00:20:06,240 --> 00:20:07,660
If you want to be in an intelligence agency

411
00:20:07,660 --> 00:20:09,420
in the 21st century at this point,

412
00:20:09,520 --> 00:20:10,860
there's a lot of shit out there

413
00:20:10,860 --> 00:20:11,220
in order to get

414
00:20:11,240 --> 00:20:11,720
whatever you want in order to go after.

415
00:20:11,880 --> 00:20:14,320
And doing this on a very human scale basis

416
00:20:14,320 --> 00:20:16,140
just doesn't scale all that effectively

417
00:20:16,140 --> 00:20:18,860
unless you can throw thousands of bodies at it,

418
00:20:18,960 --> 00:20:21,280
which is what some people assume China is doing,

419
00:20:21,340 --> 00:20:22,820
which seems almost borderline racist

420
00:20:22,820 --> 00:20:23,740
in a certain sort of way.

421
00:20:24,060 --> 00:20:26,700
But the idea being is that you either need

422
00:20:26,700 --> 00:20:28,000
lots and lots of operators

423
00:20:28,000 --> 00:20:30,200
or you need to figure out a way to do this

424
00:20:30,200 --> 00:20:31,180
in an automated fashion.

425
00:20:31,620 --> 00:20:33,400
So getting that greater efficiency

426
00:20:33,400 --> 00:20:34,860
and extent of cyber activity

427
00:20:34,860 --> 00:20:37,540
as enabled by a platform such as ScanV

428
00:20:37,540 --> 00:20:39,120
gets you to that point

429
00:20:39,120 --> 00:20:40,680
where I can do more with less.

430
00:20:40,680 --> 00:20:43,820
This is the whole impetus behind detection as code

431
00:20:43,820 --> 00:20:45,400
and DevSecOps and whatnot,

432
00:20:45,640 --> 00:20:47,620
is that just like we are in the defender's face

433
00:20:47,620 --> 00:20:49,200
trying to do more with less because,

434
00:20:49,720 --> 00:20:51,620
I don't know, we do have the people,

435
00:20:51,780 --> 00:20:53,380
many of them have unfortunately been laid off

436
00:20:53,380 --> 00:20:54,840
over the last eight months or whatever,

437
00:20:54,960 --> 00:20:55,740
which really fucking sucks.

438
00:20:56,040 --> 00:20:58,020
But even still, anyone who worked their salt

439
00:20:58,020 --> 00:20:59,780
within this space knows that we can't just

440
00:20:59,780 --> 00:21:02,120
continually throw bodies at security problems

441
00:21:02,120 --> 00:21:03,120
and expect good things.

442
00:21:03,340 --> 00:21:05,420
Well, it kind of works on the offensive side too

443
00:21:05,420 --> 00:21:07,480
as you have more and more stuff floating

444
00:21:07,480 --> 00:21:09,040
into information space.

445
00:21:09,040 --> 00:21:11,660
And so we're really talking about moving beyond

446
00:21:11,660 --> 00:21:13,760
one operator, one op campaigns

447
00:21:13,760 --> 00:21:16,080
to massive distributed operations

448
00:21:16,080 --> 00:21:17,880
enabled by this platform

449
00:21:17,880 --> 00:21:19,200
of gathering information,

450
00:21:19,540 --> 00:21:21,480
collecting infrastructure for use

451
00:21:21,480 --> 00:21:24,240
and then doing a combination of unclassified

452
00:21:24,240 --> 00:21:26,000
and classified network processing

453
00:21:26,000 --> 00:21:28,160
and tasking of what has been compromised.

454
00:21:28,980 --> 00:21:30,740
Alright, that's cool, but is this unique?

455
00:21:31,220 --> 00:21:33,200
What's Vulkan look like in cyber history?

456
00:21:33,780 --> 00:21:35,660
Well, is Vulkan activity unique?

457
00:21:35,940 --> 00:21:37,440
I've already given you this answer,

458
00:21:37,440 --> 00:21:38,720
like fuck no, it's not unique.

459
00:21:38,900 --> 00:21:40,360
This sort of shit's been around for a bit.

460
00:21:40,480 --> 00:21:41,780
So what's it look like though previously?

461
00:21:42,460 --> 00:21:43,820
So have we seen similar examples?

462
00:21:44,480 --> 00:21:46,540
Yes we have, we've seen similar examples in Russia.

463
00:21:46,920 --> 00:21:48,760
We've seen similar examples in China.

464
00:21:49,860 --> 00:21:52,120
Maybe we've seen similar examples in the US?

465
00:21:52,380 --> 00:21:54,640
I don't know, we'll get to that here in a minute.

466
00:21:55,000 --> 00:21:56,560
But really we can just choose our hacker.

467
00:21:56,740 --> 00:21:59,560
And by the way, if anyone in the audience knows

468
00:21:59,560 --> 00:22:01,480
or is responsible for creating this image,

469
00:22:01,580 --> 00:22:02,820
please let me know because I've wanted to make

470
00:22:02,820 --> 00:22:04,220
stickers or shirts of this for years

471
00:22:04,220 --> 00:22:06,080
and I can't find the original source for it.

472
00:22:07,440 --> 00:22:08,580
So pick me up or whatever because I want to make sure

473
00:22:08,580 --> 00:22:10,760
that you get recognition and whatever else

474
00:22:10,760 --> 00:22:11,980
or whatever out of that because I think that

475
00:22:11,980 --> 00:22:13,040
that picture's frickin' awesome.

476
00:22:13,420 --> 00:22:15,880
Anyway, so as we're choosing our hackers here

477
00:22:15,880 --> 00:22:18,480
and figuring out who's been doing this sort of

478
00:22:18,480 --> 00:22:20,500
rationalization of cyber operations,

479
00:22:20,960 --> 00:22:23,140
we have to look at Russia and cyber manipulation

480
00:22:23,140 --> 00:22:24,640
and where this aligns with Russian

481
00:22:24,640 --> 00:22:25,860
cyber operations history.

482
00:22:26,360 --> 00:22:28,640
So we have two facets here,

483
00:22:28,760 --> 00:22:30,840
looking at Sconvy and Amazit.

484
00:22:30,940 --> 00:22:32,580
We have building compromised networks

485
00:22:32,580 --> 00:22:34,500
and monitoring and manipulating information.

486
00:22:35,040 --> 00:22:37,280
From those overall mission profiles,

487
00:22:37,440 --> 00:22:39,260
we've seen previous examples of this.

488
00:22:39,480 --> 00:22:42,320
So we've seen VPN filter and Cyclops Blink

489
00:22:42,320 --> 00:22:44,100
from an infrastructure perspective

490
00:22:44,100 --> 00:22:45,520
and SORM,

491
00:22:45,620 --> 00:22:47,460
the system for domestic monitoring

492
00:22:47,460 --> 00:22:49,500
within the Russian Federation

493
00:22:49,500 --> 00:22:51,340
when it comes to information collection

494
00:22:51,340 --> 00:22:52,060
and operations.

495
00:22:53,200 --> 00:22:54,520
So in looking at this,

496
00:22:54,620 --> 00:22:56,560
VPN filter and Cyclops Blink

497
00:22:56,560 --> 00:22:58,620
are two capabilities somewhat related

498
00:22:58,620 --> 00:23:01,240
that were network device targeting capabilities.

499
00:23:01,620 --> 00:23:03,180
Like find a bunch of vulnerable microtiques,

500
00:23:03,260 --> 00:23:03,860
knock them over,

501
00:23:03,980 --> 00:23:06,940
and rope these in to collect

502
00:23:07,440 --> 00:23:09,320
network collections of nodes

503
00:23:09,320 --> 00:23:10,960
that can be tasked for various purposes.

504
00:23:11,480 --> 00:23:12,980
In the case of VPN filter,

505
00:23:13,260 --> 00:23:15,680
it looked like this was being built into a large

506
00:23:15,680 --> 00:23:17,920
distributed denial of service network

507
00:23:17,920 --> 00:23:20,160
likely to target Ukrainian entities

508
00:23:20,160 --> 00:23:21,120
although it was disrupted

509
00:23:21,120 --> 00:23:23,800
by US authorities in conjunction with

510
00:23:23,800 --> 00:23:24,940
private sector and some others

511
00:23:24,940 --> 00:23:25,900
before it could be used.

512
00:23:26,460 --> 00:23:28,900
But these could also be used to proxy traffic

513
00:23:28,900 --> 00:23:31,000
and that appears to be the case for Cyclops Blink

514
00:23:31,000 --> 00:23:32,760
when it was deployed as a similar capability

515
00:23:33,300 --> 00:23:35,240
of again targeting network devices

516
00:23:35,240 --> 00:23:37,360
in order to take advantage of

517
00:23:37,440 --> 00:23:38,860
unpatched or vulnerable systems

518
00:23:38,860 --> 00:23:41,360
to proxy traffic for follow-on operations.

519
00:23:41,920 --> 00:23:43,380
But there's also evidence

520
00:23:43,380 --> 00:23:44,760
that there were further capabilities

521
00:23:44,760 --> 00:23:47,040
at least in review if not in outright use

522
00:23:47,040 --> 00:23:49,220
such as a Modbus protocol

523
00:23:49,220 --> 00:23:52,180
capability associated with VPN filter.

524
00:23:52,380 --> 00:23:53,720
It was only able to collect Modbus,

525
00:23:53,780 --> 00:23:56,000
a OT-based traffic protocol

526
00:23:56,000 --> 00:23:56,680
for those unfamiliar,

527
00:23:57,420 --> 00:23:59,160
but if you're gathering that information

528
00:23:59,160 --> 00:24:01,500
presumably you're doing so for a reason

529
00:24:01,500 --> 00:24:03,460
that could lead to follow-on exploitation,

530
00:24:03,820 --> 00:24:05,520
manipulation, man-in-the-middle that stuff

531
00:24:05,520 --> 00:24:06,760
or similar.

532
00:24:07,440 --> 00:24:08,840
So as a result, ScanV

533
00:24:09,260 --> 00:24:11,100
represents a mechanism to automate,

534
00:24:11,200 --> 00:24:13,660
control and manage these sorts of capabilities

535
00:24:13,660 --> 00:24:15,040
that Russian organizations,

536
00:24:15,440 --> 00:24:16,340
principally Sandworm,

537
00:24:16,520 --> 00:24:17,780
have already deployed,

538
00:24:18,140 --> 00:24:20,260
but gaining that scalability and efficiency

539
00:24:20,260 --> 00:24:22,960
to make these operations more realistic

540
00:24:22,960 --> 00:24:24,720
and essentially more efficient

541
00:24:24,720 --> 00:24:26,620
and cheaper to run at scale.

542
00:24:27,060 --> 00:24:29,240
But from an information operations perspective

543
00:24:29,240 --> 00:24:31,040
we've also seen this with respect to SORM

544
00:24:31,040 --> 00:24:32,460
which is related to a Russian law

545
00:24:32,460 --> 00:24:34,360
that allows for, well requires

546
00:24:34,360 --> 00:24:37,100
that the Russian security services bolt in

547
00:24:37,440 --> 00:24:39,880
hardware into telco providers

548
00:24:39,880 --> 00:24:41,040
and similar in order to

549
00:24:41,040 --> 00:24:43,500
gather up traffic and perform surveillance

550
00:24:43,500 --> 00:24:43,940
at scale.

551
00:24:44,180 --> 00:24:47,260
So this has been around for over 10 years at this point

552
00:24:47,260 --> 00:24:49,500
and has been documented by

553
00:24:49,500 --> 00:24:50,680
a variety of organizations

554
00:24:50,680 --> 00:24:52,560
whether we're talking about commercial press

555
00:24:52,560 --> 00:24:55,460
or things like the European Council

556
00:24:55,460 --> 00:24:56,720
of Human Rights and so forth.

557
00:24:56,960 --> 00:24:58,720
But the thing is that SORM requires

558
00:24:58,720 --> 00:25:01,420
putting hardware into the telco providers

559
00:25:01,420 --> 00:25:03,020
network and then stepping away.

560
00:25:03,360 --> 00:25:05,440
Where SORM gives way

561
00:25:05,440 --> 00:25:07,060
to something like Amazit is the ability

562
00:25:07,440 --> 00:25:08,300
to forward deploy that

563
00:25:08,300 --> 00:25:11,180
and allow for information influence operations

564
00:25:11,180 --> 00:25:13,400
to move beyond just the network backbone

565
00:25:13,400 --> 00:25:15,360
that's already under direct physical

566
00:25:15,360 --> 00:25:17,560
and legal control by the authorities in question.

567
00:25:17,820 --> 00:25:19,220
But they begin deploying that

568
00:25:19,220 --> 00:25:21,140
in say the occupied areas of Ukraine

569
00:25:21,140 --> 00:25:22,960
or similar regions

570
00:25:22,960 --> 00:25:25,100
to sort of extend that sort of visibility

571
00:25:25,100 --> 00:25:27,300
and capability into areas where it would otherwise

572
00:25:27,300 --> 00:25:29,020
take significantly more effort

573
00:25:29,020 --> 00:25:31,080
in order to try to rebuild and re-architect

574
00:25:31,080 --> 00:25:33,280
the backbone behind the communication

575
00:25:33,280 --> 00:25:34,700
networks in such organizations.

576
00:25:35,040 --> 00:25:37,420
I can instead take a suitcase, plug it into the base

577
00:25:37,440 --> 00:25:38,800
station controller of a given area

578
00:25:38,800 --> 00:25:40,700
and boom, I start collecting information

579
00:25:42,220 --> 00:25:44,020
especially across social media platforms.

580
00:25:44,700 --> 00:25:46,280
So okay, we've picked on Russia a lot.

581
00:25:46,460 --> 00:25:47,460
Alright, poor Russia, right?

582
00:25:47,580 --> 00:25:48,380
Actually no, fuck them.

583
00:25:51,480 --> 00:25:56,400
But what about China?

584
00:25:56,700 --> 00:25:59,260
What about China? China's out there too, right?

585
00:25:59,440 --> 00:26:01,760
Aren't they really active in this space?

586
00:26:01,920 --> 00:26:03,460
Well they certainly are and one of the ways

587
00:26:03,460 --> 00:26:04,940
I think a lot of folks are familiar with

588
00:26:04,940 --> 00:26:06,640
is the Great Firewall of China.

589
00:26:07,440 --> 00:26:08,840
This is one of several reasons why I will

590
00:26:08,840 --> 00:26:11,060
as much as I would love to go to China someday

591
00:26:11,060 --> 00:26:12,700
I know it's not going to happen anytime soon

592
00:26:13,320 --> 00:26:15,420
but why VPN services

593
00:26:15,420 --> 00:26:17,260
are such a hot commodity for people

594
00:26:17,260 --> 00:26:19,080
in the Chinese ecosystem

595
00:26:19,080 --> 00:26:21,260
to try to evade Great Firewall

596
00:26:21,260 --> 00:26:23,280
traffic control and traffic interception.

597
00:26:23,780 --> 00:26:25,120
Less heralded

598
00:26:25,120 --> 00:26:27,480
but honestly more interesting in my opinion

599
00:26:27,480 --> 00:26:29,380
there was a capability that was

600
00:26:29,380 --> 00:26:31,080
disclosed by the folks at

601
00:26:31,080 --> 00:26:32,860
Citizen Lab at the Munk School in Toronto

602
00:26:33,440 --> 00:26:35,000
about China's Great Cannon.

603
00:26:35,200 --> 00:26:37,320
So this was a capability that almost

604
00:26:37,440 --> 00:26:39,360
took the same infrastructure behind

605
00:26:39,360 --> 00:26:41,200
the firewall of deep packet inspection

606
00:26:41,200 --> 00:26:43,580
and traffic moderation and added on

607
00:26:43,580 --> 00:26:45,480
the ability to inject into traffic

608
00:26:45,480 --> 00:26:47,300
streams to deliver exploitation

609
00:26:47,300 --> 00:26:49,380
payloads to targets of interest based

610
00:26:49,380 --> 00:26:50,940
upon the traffic recorded.

611
00:26:51,280 --> 00:26:53,300
Certainly things like SSL are your friend

612
00:26:53,300 --> 00:26:55,180
in these sorts of cases unless that is also

613
00:26:55,180 --> 00:26:57,220
being proxied as part of the

614
00:26:57,220 --> 00:26:59,460
firewall operations but the idea here

615
00:26:59,460 --> 00:27:01,120
is providing an effective means to

616
00:27:01,120 --> 00:27:03,280
exploit individual users at scale

617
00:27:03,280 --> 00:27:05,520
based upon selectors identified in traffic

618
00:27:05,520 --> 00:27:07,120
to get endpoints

619
00:27:07,440 --> 00:27:09,480
or compromised endpoints for

620
00:27:09,480 --> 00:27:11,440
dissidents, political opposition,

621
00:27:11,900 --> 00:27:13,600
commercial organizations or whatever

622
00:27:13,600 --> 00:27:14,940
that might be opposed to the regime

623
00:27:14,940 --> 00:27:16,720
or present a risk of some sort

624
00:27:16,720 --> 00:27:19,440
and there's a desired need to monitor.

625
00:27:19,900 --> 00:27:21,060
So we're looking at this

626
00:27:21,060 --> 00:27:23,040
the Great Cannon, that came out in 2015

627
00:27:23,040 --> 00:27:25,200
that's almost ten freaking years ago.

628
00:27:25,380 --> 00:27:26,940
Where was technology ten years ago?

629
00:27:27,120 --> 00:27:28,660
This is a lot different or whatever now

630
00:27:28,660 --> 00:27:31,100
if nothing else we're on generation what for iPhones.

631
00:27:31,520 --> 00:27:33,260
But the idea being

632
00:27:33,260 --> 00:27:35,320
is that shit's changed and as a result

633
00:27:35,320 --> 00:27:37,420
presumably and we've seen this

634
00:27:37,440 --> 00:27:39,360
that the PRC is continuing

635
00:27:39,360 --> 00:27:41,200
to invest and invest quite heavily

636
00:27:41,200 --> 00:27:43,080
in CNO capabilities

637
00:27:43,080 --> 00:27:44,660
and other cyber operations.

638
00:27:45,080 --> 00:27:46,960
And we've seen this reflected in widespread

639
00:27:46,960 --> 00:27:49,060
intrusion operations like the

640
00:27:49,060 --> 00:27:50,540
proxy shell, proxy logon

641
00:27:50,540 --> 00:27:53,320
exploitation campaigns going back to

642
00:27:53,320 --> 00:27:55,380
last year to something that OrangeSci

643
00:27:55,380 --> 00:27:57,220
eventually presented at Black Cat I believe

644
00:27:57,220 --> 00:27:59,440
as well as DEFCON but that was

645
00:27:59,440 --> 00:28:01,240
weaponized by Chinese threat actors

646
00:28:01,240 --> 00:28:02,900
for quite some time due to

647
00:28:02,900 --> 00:28:05,080
mysterious items around the disclosure

648
00:28:05,080 --> 00:28:06,600
of those vulnerabilities to Microsoft.

649
00:28:07,440 --> 00:28:08,920
Also more recent campaigns targeting

650
00:28:09,260 --> 00:28:10,860
Barracuda email security gateways

651
00:28:10,860 --> 00:28:11,700
and other infrastructure.

652
00:28:12,040 --> 00:28:14,320
That China's going just like wild

653
00:28:14,320 --> 00:28:16,040
on popping infrastructure right now

654
00:28:16,040 --> 00:28:18,780
and we can see hints of the automation

655
00:28:18,780 --> 00:28:20,520
aspect when it comes to something like

656
00:28:20,520 --> 00:28:21,040
the Great Cannon.

657
00:28:21,520 --> 00:28:23,800
So looking at the combination of

658
00:28:23,800 --> 00:28:25,460
Great Firewall and Cannon functionality

659
00:28:25,460 --> 00:28:28,020
starts giving us glimpses of similar ambitions

660
00:28:28,020 --> 00:28:30,260
and similar programs that we see in

661
00:28:30,260 --> 00:28:32,660
the Russian space with the main question

662
00:28:32,660 --> 00:28:34,660
being the scalability and management

663
00:28:34,660 --> 00:28:36,560
of these capabilities and how they would

664
00:28:37,440 --> 00:28:38,300
benefit from widespread intrusion campaigns.

665
00:28:38,680 --> 00:28:41,060
Could China build their own ScanV essentially?

666
00:28:41,560 --> 00:28:43,420
My answer is like yeah they're pretty fucking smart

667
00:28:43,420 --> 00:28:44,720
of course they could build it if they want to

668
00:28:44,720 --> 00:28:46,580
and now that this information is out there

669
00:28:46,580 --> 00:28:48,920
probably incentivized to do so at some point

670
00:28:48,920 --> 00:28:49,380
in the future.

671
00:28:50,040 --> 00:28:51,520
But wait, there's more.

672
00:28:51,960 --> 00:28:53,300
Hey, remember the Snowden leaks?

673
00:28:53,520 --> 00:28:55,160
Like that wasn't too long ago right?

674
00:28:55,300 --> 00:28:58,240
That was only like 15, 10 years ago?

675
00:28:58,620 --> 00:29:02,800
Yeah 10 years ago like a month ago.

676
00:29:03,020 --> 00:29:05,720
So note and obligatory cover my ass

677
00:29:05,720 --> 00:29:07,180
or whatever statement here that the

678
00:29:07,440 --> 00:29:09,080
following slides are based on public commentary

679
00:29:09,080 --> 00:29:11,240
and posting and neither confirm nor deny

680
00:29:11,240 --> 00:29:13,120
the accuracy or veracity of the items

681
00:29:13,120 --> 00:29:15,280
discussed. These are all theoretical things

682
00:29:15,280 --> 00:29:17,140
that people have posted about that have

683
00:29:17,140 --> 00:29:19,500
analyzed the Snowden files or Snowden

684
00:29:19,500 --> 00:29:21,180
links directly. Anyway,

685
00:29:21,320 --> 00:29:23,220
that out of the way, the leaks and their

686
00:29:23,220 --> 00:29:24,920
implications is that we had a popular

687
00:29:24,920 --> 00:29:26,940
conception that mostly revolved around the

688
00:29:26,940 --> 00:29:29,060
PRISM program. That was a

689
00:29:29,060 --> 00:29:31,380
questionable program for

690
00:29:31,380 --> 00:29:33,200
domestic surveillance and so forth

691
00:29:33,200 --> 00:29:34,980
targeting a variety of communication

692
00:29:34,980 --> 00:29:37,280
platforms and social media and so forth

693
00:29:37,440 --> 00:29:39,460
that was certainly important and arguably

694
00:29:39,460 --> 00:29:41,280
very, very bad. But

695
00:29:41,280 --> 00:29:43,240
that wasn't the only thing leaked which is

696
00:29:43,240 --> 00:29:45,400
why there's questions about Mr. Snowden's

697
00:29:45,400 --> 00:29:47,080
motivations and so forth

698
00:29:47,080 --> 00:29:49,380
based upon the other things that were

699
00:29:50,200 --> 00:29:51,320
cast out into the

700
00:29:51,320 --> 00:29:53,280
world as well. Because there

701
00:29:53,280 --> 00:29:55,180
were additional programs disclosed

702
00:29:55,180 --> 00:29:57,360
including Snowden and potentially

703
00:29:57,360 --> 00:29:59,180
others because we've seen things like

704
00:29:59,180 --> 00:30:00,800
shadow brokers and other sorts of

705
00:30:00,800 --> 00:30:02,780
entities come along over time

706
00:30:03,540 --> 00:30:05,020
disclosing significant information

707
00:30:05,020 --> 00:30:07,120
on computer network operation

708
00:30:07,440 --> 00:30:09,480
capabilities such as widespread

709
00:30:09,480 --> 00:30:11,360
automated exploitation and control

710
00:30:11,360 --> 00:30:13,240
frameworks that were being used by

711
00:30:14,080 --> 00:30:15,200
NSA and

712
00:30:15,200 --> 00:30:16,820
5i partners according to reporting

713
00:30:17,260 --> 00:30:19,200
prior to those leaks coming wild

714
00:30:19,200 --> 00:30:20,760
or coming into the wild.

715
00:30:21,060 --> 00:30:22,980
So we can talk about a quantum of exploitation.

716
00:30:23,480 --> 00:30:25,260
So looking at Fox IT

717
00:30:25,260 --> 00:30:26,880
and other organizations

718
00:30:27,560 --> 00:30:29,320
there was an item

719
00:30:29,320 --> 00:30:31,280
in the Snowden leaks concerning a

720
00:30:31,280 --> 00:30:33,200
program called Quantum that essentially

721
00:30:33,200 --> 00:30:35,060
provided a man on the side capability

722
00:30:35,060 --> 00:30:37,320
of monitoring traffic through

723
00:30:37,440 --> 00:30:39,320
various observation points

724
00:30:39,320 --> 00:30:41,200
and then when traffic of interest is identified

725
00:30:41,720 --> 00:30:43,420
injecting into that traffic stream and

726
00:30:43,420 --> 00:30:45,440
trying to then achieve exploitation

727
00:30:45,440 --> 00:30:46,740
based upon selectors.

728
00:30:47,660 --> 00:30:49,360
Sounding a little different because there's

729
00:30:49,360 --> 00:30:50,980
that man in the middle portion of events

730
00:30:50,980 --> 00:30:53,260
but from the automated exploitation and control

731
00:30:53,260 --> 00:30:55,120
perspective like this is looking a little bit like

732
00:30:55,120 --> 00:30:56,860
ScanD in certain aspects.

733
00:30:57,380 --> 00:30:59,120
And there were fun diagrams or whatever

734
00:30:59,120 --> 00:31:01,420
noting how the internet or whatever

735
00:31:01,420 --> 00:31:03,360
was basically targeted

736
00:31:03,360 --> 00:31:05,400
or whatever in such a way to allow for

737
00:31:05,400 --> 00:31:07,320
identification of traffic of interest that would

738
00:31:07,440 --> 00:31:09,220
then result in not just exploitation

739
00:31:09,220 --> 00:31:11,380
but then marshalling those exploited end nodes

740
00:31:11,380 --> 00:31:13,340
into intelligence agency

741
00:31:13,340 --> 00:31:14,740
controlled apparatus.

742
00:31:15,180 --> 00:31:16,320
So fun stuff there.

743
00:31:16,760 --> 00:31:19,240
The main thing with this sort of automated exploitation

744
00:31:19,240 --> 00:31:21,160
at scale is that they represent

745
00:31:21,160 --> 00:31:23,300
automated exploit systems similar to

746
00:31:23,300 --> 00:31:24,360
what we're seeing with ScanV.

747
00:31:25,060 --> 00:31:27,280
Disclosed publicly and certainly you started seeing

748
00:31:27,280 --> 00:31:29,280
articles in Wired and the

749
00:31:29,280 --> 00:31:31,340
Fox IT article and some hacker forum

750
00:31:31,340 --> 00:31:33,280
posts and like how you can do this on your own

751
00:31:34,120 --> 00:31:35,280
started popping

752
00:31:35,280 --> 00:31:36,940
up about 2012,

753
00:31:37,440 --> 00:31:38,140
2013 or whatever.

754
00:31:38,500 --> 00:31:40,860
Not that long after or 2013, 2014

755
00:31:40,860 --> 00:31:42,440
not that long after the leaks.

756
00:31:42,680 --> 00:31:44,880
But what's interesting is that what was FiveEye

757
00:31:45,220 --> 00:31:47,120
alleged state of the art almost

758
00:31:47,120 --> 00:31:48,560
15 years ago at this point

759
00:31:48,560 --> 00:31:50,740
given the likely origin of when

760
00:31:50,740 --> 00:31:53,320
the documents actually were emerged

761
00:31:53,320 --> 00:31:55,240
that Mr. Snowden then decided to yeet out

762
00:31:55,240 --> 00:31:55,780
to the world.

763
00:31:57,160 --> 00:31:59,120
We see artifacts of this now

764
00:31:59,120 --> 00:32:01,000
reflected in Russian and Chinese operations.

765
00:32:01,560 --> 00:32:03,140
So the point is that if

766
00:32:03,140 --> 00:32:05,160
true these Snowden leaks were

767
00:32:05,160 --> 00:32:07,240
arguably a disaster for the United States

768
00:32:07,440 --> 00:32:09,280
related to CNO and SIGINT capabilities

769
00:32:09,280 --> 00:32:11,160
by deploying, disclosing methodology

770
00:32:11,160 --> 00:32:13,320
like as an intelligence agency that's

771
00:32:13,320 --> 00:32:14,280
very very fucking bad.

772
00:32:14,620 --> 00:32:17,260
However, it also appears that multiple other

773
00:32:17,260 --> 00:32:19,220
parties were paying attention and taking notes

774
00:32:19,220 --> 00:32:21,060
on how to build similar or potentially

775
00:32:21,060 --> 00:32:23,420
even more ambitious programs based on

776
00:32:23,420 --> 00:32:25,200
these disclosures. Disclosures

777
00:32:25,200 --> 00:32:27,040
whether we're talking Snowden, Vulcan

778
00:32:27,040 --> 00:32:28,760
or anything in between like

779
00:32:28,760 --> 00:32:31,180
Vault 7 or Shadow Brokers and we've seen this with

780
00:32:31,180 --> 00:32:32,900
Shadow Brokers eventually leading to

781
00:32:33,440 --> 00:32:35,480
WannaCry. This shit doesn't happen

782
00:32:35,480 --> 00:32:37,240
in a void. Just because some research

783
00:32:37,440 --> 00:32:39,240
or journalist or whatever pushes this out there

784
00:32:39,240 --> 00:32:41,140
doesn't mean like oh capabilities are burned

785
00:32:41,140 --> 00:32:43,240
move on. Like nope. Folks are taking notes and

786
00:32:43,240 --> 00:32:45,320
learning from each other and making sure that they're

787
00:32:45,320 --> 00:32:47,520
trying to adapt to the state of the art of adversaries

788
00:32:47,520 --> 00:32:48,380
or even allies

789
00:32:49,340 --> 00:32:51,320
as they may see fit or necessary

790
00:32:51,320 --> 00:32:53,340
to do so. So what's the

791
00:32:53,340 --> 00:32:55,260
future of offensive cyber then in light of all

792
00:32:55,260 --> 00:32:56,900
this sort of activity? Well

793
00:32:57,440 --> 00:32:58,640
well well

794
00:32:59,220 --> 00:33:01,240
there's a popular conception of cyber

795
00:33:01,240 --> 00:33:02,640
of computer network operations

796
00:33:02,640 --> 00:33:05,500
where you've got one asshole on a keyboard or whatever doing bad stuff

797
00:33:05,500 --> 00:33:07,100
or like if you're a red teamer doing

798
00:33:07,440 --> 00:33:08,560
bad stuff for good reasons

799
00:33:08,560 --> 00:33:11,360
and that's cool and all and maybe

800
00:33:11,360 --> 00:33:13,320
it encapsulates some of what still counts

801
00:33:13,320 --> 00:33:15,300
for red teaming and pen testing or

802
00:33:15,300 --> 00:33:17,200
whatever operations and maybe

803
00:33:17,200 --> 00:33:18,940
for some state sponsored programs

804
00:33:18,940 --> 00:33:21,120
but a more realistic depiction of CNO

805
00:33:21,120 --> 00:33:23,180
these days. You're sitting in a freaking

806
00:33:23,180 --> 00:33:25,340
cube farm man. This is

807
00:33:25,340 --> 00:33:27,140
a discipline

808
00:33:27,140 --> 00:33:29,160
now that has evolved beyond like

809
00:33:29,160 --> 00:33:31,040
one individual executing

810
00:33:31,040 --> 00:33:33,340
a single operation to trying to

811
00:33:33,340 --> 00:33:35,260
develop frameworks to do these sorts

812
00:33:35,260 --> 00:33:36,740
of operations at scale.

813
00:33:37,440 --> 00:33:39,320
And we've seen this in multiple

814
00:33:39,940 --> 00:33:41,140
aspects at this point.

815
00:33:41,360 --> 00:33:43,260
So just looking at this slide we have

816
00:33:43,260 --> 00:33:45,240
ScanV, we have the

817
00:33:45,240 --> 00:33:47,180
Snowden Leaks items and we have

818
00:33:47,180 --> 00:33:48,900
the Great Cannon all representing

819
00:33:49,360 --> 00:33:51,400
attempts. Some successful, some

820
00:33:51,400 --> 00:33:52,480
still maybe notional.

821
00:33:53,780 --> 00:33:55,420
It's debatable if ScanV

822
00:33:55,420 --> 00:33:57,360
actually went live or not. I've been

823
00:33:57,360 --> 00:33:59,280
looking for a ScanV node. If you

824
00:33:59,280 --> 00:34:01,340
find one let me know. I'd be curious to take a look

825
00:34:01,340 --> 00:34:03,340
at it. But the idea being

826
00:34:03,340 --> 00:34:05,340
is that we're looking for a

827
00:34:05,340 --> 00:34:06,800
road to scalable cyber.

828
00:34:07,440 --> 00:34:08,800
And that applies across personnel,

829
00:34:09,080 --> 00:34:10,920
targeting and operational

830
00:34:11,160 --> 00:34:13,040
security. So from a personnel

831
00:34:13,040 --> 00:34:15,180
standpoint, cyber talent while it is

832
00:34:15,180 --> 00:34:17,100
available right now because VCs are laying

833
00:34:17,100 --> 00:34:18,160
people off and they suck,

834
00:34:18,760 --> 00:34:21,020
the talent is still expensive especially if you're

835
00:34:21,020 --> 00:34:22,880
working in the .gov or .mil space and have to

836
00:34:22,880 --> 00:34:24,760
compete with private industry and so forth.

837
00:34:24,980 --> 00:34:27,100
So the ability to codify skills

838
00:34:27,100 --> 00:34:28,920
and capabilities in

839
00:34:29,220 --> 00:34:30,740
programs and in applications

840
00:34:30,740 --> 00:34:33,180
becomes quite useful in extending

841
00:34:33,180 --> 00:34:35,100
and expanding programs so you're not doing

842
00:34:35,100 --> 00:34:37,160
a, you know, arithmetic expansion

843
00:34:37,440 --> 00:34:39,400
like one operator one up but rather

844
00:34:39,400 --> 00:34:41,420
a geometric expansion that I get a couple

845
00:34:41,420 --> 00:34:42,800
of devs and I can get a

846
00:34:43,440 --> 00:34:45,380
exponential increase in the number of potential

847
00:34:45,380 --> 00:34:47,560
operations and endpoints that I can exploit.

848
00:34:48,120 --> 00:34:49,580
That gets us to targeting

849
00:34:49,580 --> 00:34:51,140
where if you are a SIGINT authority

850
00:34:51,140 --> 00:34:53,280
or state sponsored intelligence agency

851
00:34:53,280 --> 00:34:55,480
with any sort of ambition whatsoever

852
00:34:55,480 --> 00:34:57,100
global actions

853
00:34:57,100 --> 00:34:59,640
or global ambitions require global actions.

854
00:34:59,720 --> 00:35:01,240
Being able to successfully

855
00:35:01,240 --> 00:35:03,400
target and manipulate networks

856
00:35:03,400 --> 00:35:05,320
at a vast scale and

857
00:35:05,320 --> 00:35:06,980
just throwing thousands of

858
00:35:07,440 --> 00:35:09,160
you know, a million monkeys on a million

859
00:35:09,160 --> 00:35:11,160
terminals or whatever can maybe exploit

860
00:35:11,160 --> 00:35:13,420
the internet or whatever in a million years and so forth.

861
00:35:13,660 --> 00:35:15,800
But that's not realistic.

862
00:35:16,120 --> 00:35:17,500
So to really come up with a way

863
00:35:17,500 --> 00:35:19,300
to hack the planet so to speak

864
00:35:19,300 --> 00:35:21,240
we need to figure out ways of automating and making

865
00:35:21,240 --> 00:35:23,000
that efficient. But also

866
00:35:23,000 --> 00:35:25,340
top tier threat actors know that they don't

867
00:35:25,340 --> 00:35:27,360
just buy AWS nodes or something

868
00:35:27,360 --> 00:35:28,780
like that these days. Some still do

869
00:35:29,440 --> 00:35:30,680
and there are reasons to do so.

870
00:35:30,920 --> 00:35:33,080
But if you're really trying to do things like

871
00:35:33,080 --> 00:35:35,100
conduct offensive cyber operations

872
00:35:35,100 --> 00:35:37,340
or disruptive operations it behooves you

873
00:35:37,440 --> 00:35:38,720
to start making the

874
00:35:39,440 --> 00:35:41,400
final hop to the victim network

875
00:35:41,400 --> 00:35:43,260
and where you're originally starting operations

876
00:35:43,260 --> 00:35:45,100
from as far apart

877
00:35:45,100 --> 00:35:46,140
as technically feasible

878
00:35:46,140 --> 00:35:49,160
both to maintain your own sources

879
00:35:49,160 --> 00:35:50,880
methods and command and control frameworks

880
00:35:51,200 --> 00:35:53,220
as well as to potentially muddy the waters

881
00:35:53,220 --> 00:35:54,820
around thorny

882
00:35:55,140 --> 00:35:57,220
questions like attribution but also more

883
00:35:57,220 --> 00:35:59,080
importantly retaliation and response

884
00:35:59,080 --> 00:36:00,020
based upon that.

885
00:36:00,520 --> 00:36:03,060
But importantly the Vulcan leaks are now

886
00:36:03,060 --> 00:36:05,120
lagging indicators. This activity

887
00:36:05,120 --> 00:36:07,360
has already taken place. We're looking at

888
00:36:07,440 --> 00:36:08,920
this now in the past tense.

889
00:36:09,400 --> 00:36:11,400
Thus we need to anticipate even

890
00:36:11,400 --> 00:36:12,760
greater degrees of automation

891
00:36:13,300 --> 00:36:15,280
queuing and reactive targeting emerging

892
00:36:15,280 --> 00:36:17,360
over time. Again Five Eyes

893
00:36:17,360 --> 00:36:19,340
were doing these over ten years ago. China

894
00:36:19,340 --> 00:36:21,360
was doing a version of this about six or seven

895
00:36:21,360 --> 00:36:23,480
years ago. Russia was doing something

896
00:36:23,480 --> 00:36:25,240
kind of like this or whatever with VPN

897
00:36:25,240 --> 00:36:27,340
filter and Cyclops Blink and then with

898
00:36:27,340 --> 00:36:29,400
ScanV decided to like go

899
00:36:29,400 --> 00:36:31,000
to 11 on the volume and

900
00:36:31,000 --> 00:36:33,160
really make this into a much more widespread

901
00:36:33,160 --> 00:36:35,360
sort of capability. So this shit's going

902
00:36:35,360 --> 00:36:37,420
on and it's been going on and it's only going to

903
00:36:37,440 --> 00:36:39,300
get better or worse depending

904
00:36:39,300 --> 00:36:41,420
on your perspective for things. So what

905
00:36:41,420 --> 00:36:43,420
should we expect? Well I would

906
00:36:43,420 --> 00:36:45,460
argue that we should expect greater automation

907
00:36:45,460 --> 00:36:47,260
and improved scalability. Just

908
00:36:47,260 --> 00:36:49,420
you know accountants and so forth

909
00:36:49,420 --> 00:36:51,240
or whatever they want to try to make you do more with

910
00:36:51,240 --> 00:36:53,400
less and that applies in dot gov dot

911
00:36:53,400 --> 00:36:55,460
mill space as well so it's going to happen.

912
00:36:55,620 --> 00:36:57,280
That's not a very sexy point but

913
00:36:57,280 --> 00:36:59,400
more interesting is this marshalling of the

914
00:36:59,400 --> 00:37:01,280
neutral web for offensive actions

915
00:37:02,200 --> 00:37:02,720
where

916
00:37:03,200 --> 00:37:05,260
your unpatched Soho router

917
00:37:05,260 --> 00:37:07,280
or whatever becomes a front

918
00:37:07,440 --> 00:37:08,820
line article or whatever in

919
00:37:09,410 --> 00:37:09,640
targeting

920
00:37:12,360 --> 00:37:13,280
excuse me

921
00:37:13,280 --> 00:37:15,220
critical infrastructure in

922
00:37:15,220 --> 00:37:15,500
Ukraine.

923
00:37:18,140 --> 00:37:19,300
So how do we start defending

924
00:37:19,300 --> 00:37:21,420
that and do we start doing things like automated

925
00:37:21,420 --> 00:37:23,520
remediation of vulnerable

926
00:37:23,520 --> 00:37:25,240
nodes or whatever that are in neutral space?

927
00:37:25,460 --> 00:37:27,420
Can we do that? Is that legal? Will that piss people

928
00:37:27,420 --> 00:37:29,380
off? Yes it will piss people off. But

929
00:37:29,380 --> 00:37:31,320
it really becomes a thorny issue for how

930
00:37:31,320 --> 00:37:33,140
we start responding, reacting

931
00:37:33,140 --> 00:37:35,340
and doing things like take downs against these

932
00:37:35,340 --> 00:37:36,060
sorts of capabilities.

933
00:37:37,440 --> 00:37:39,080
There's also and this is actually kind of cool I think

934
00:37:39,740 --> 00:37:41,400
less reliance on rock stars

935
00:37:41,400 --> 00:37:43,080
and more commoditization of capabilities.

936
00:37:43,580 --> 00:37:44,540
So we want to talk about

937
00:37:45,240 --> 00:37:47,520
lowering the barriers to entry

938
00:37:47,520 --> 00:37:49,340
when it comes to cyber. This is one

939
00:37:49,340 --> 00:37:51,420
way that I don't need to rely on like two or three

940
00:37:51,420 --> 00:37:53,420
top tier hacks or whatever in

941
00:37:53,420 --> 00:37:54,780
order to execute all my operations.

942
00:37:55,060 --> 00:37:57,340
Rather I just need to

943
00:37:57,340 --> 00:37:59,280
identify ways of getting

944
00:37:59,280 --> 00:38:01,400
that knowledge that is employed by

945
00:38:01,400 --> 00:38:03,360
those individuals, putting it into

946
00:38:03,360 --> 00:38:05,200
code and then deploying it in some way that

947
00:38:05,200 --> 00:38:07,360
scales effectively. And also

948
00:38:08,200 --> 00:38:09,340
I'll give all the AI

949
00:38:09,340 --> 00:38:11,340
vendors or whatever a lot of shit because

950
00:38:11,340 --> 00:38:12,960
there's so much bullshit out there right now

951
00:38:12,960 --> 00:38:15,340
but there are non-bullshit

952
00:38:15,340 --> 00:38:16,900
applications for artificial intelligence

953
00:38:16,900 --> 00:38:19,280
when it comes to this sort of activity.

954
00:38:19,520 --> 00:38:20,960
So imagine if you will

955
00:38:20,960 --> 00:38:23,320
that in addition to building say an

956
00:38:23,320 --> 00:38:24,980
automated fuzzing platform for vulnerability

957
00:38:24,980 --> 00:38:27,440
identification, you extend that even a little

958
00:38:27,440 --> 00:38:29,080
bit further to a system that can do

959
00:38:29,080 --> 00:38:31,340
system scanning

960
00:38:31,340 --> 00:38:33,580
and classification that say can identify

961
00:38:33,580 --> 00:38:35,260
based upon the system type and vulnerability

962
00:38:35,260 --> 00:38:37,200
what is a reasonable vulnerability

963
00:38:37,440 --> 00:38:39,360
that I could exploit that minimizes my risk

964
00:38:39,360 --> 00:38:41,200
of detection and then what follow on

965
00:38:41,200 --> 00:38:42,880
payload is most suitable for this device

966
00:38:43,260 --> 00:38:45,440
to ensure either it's a lasting

967
00:38:45,440 --> 00:38:47,440
node in my network or I can use it

968
00:38:47,440 --> 00:38:49,160
as an immediately burnable item for say

969
00:38:49,160 --> 00:38:51,200
deploying a wiper against a

970
00:38:51,200 --> 00:38:53,240
system of interest that I want to

971
00:38:53,240 --> 00:38:54,580
take out of the internet.

972
00:38:55,660 --> 00:38:57,520
I apologize, it's like day three

973
00:38:57,520 --> 00:38:58,640
of DEF CON, my voice is going.

974
00:39:06,020 --> 00:39:06,980
Anyway, so

975
00:39:07,440 --> 00:39:08,440
where does that put us?

976
00:39:08,560 --> 00:39:11,180
It's like conclusions, like yeah adversaries innovate man

977
00:39:11,180 --> 00:39:13,080
like that's cool, but

978
00:39:13,800 --> 00:39:14,760
where are we now?

979
00:39:15,740 --> 00:39:17,080
Capability, inspiration and

980
00:39:17,080 --> 00:39:19,560
proliferation basically. So adversaries

981
00:39:19,560 --> 00:39:21,420
learn from operations and open source

982
00:39:21,420 --> 00:39:23,260
research. Every action comes with

983
00:39:23,260 --> 00:39:24,700
some sort of response or reaction

984
00:39:25,240 --> 00:39:27,300
in some great Newtonian reflection

985
00:39:27,300 --> 00:39:28,620
within the cyber ecosystem.

986
00:39:28,960 --> 00:39:31,280
And thus today's leak or disclosure becomes

987
00:39:31,280 --> 00:39:32,940
the inspiration for or the

988
00:39:32,940 --> 00:39:34,520
hey where the fuck are we doing that

989
00:39:34,520 --> 00:39:37,240
for some other party or whatever

990
00:39:37,440 --> 00:39:38,800
that happens to be involved in this space.

991
00:39:39,600 --> 00:39:41,220
With that, computer network

992
00:39:41,220 --> 00:39:43,000
operations is not a static field

993
00:39:43,000 --> 00:39:45,280
but a constantly evolving one with multiple

994
00:39:45,280 --> 00:39:47,260
factors. Now you want to talk about three body

995
00:39:47,260 --> 00:39:49,180
problems, we're talking about like a five or six body

996
00:39:49,180 --> 00:39:50,980
problem here in terms of

997
00:39:51,580 --> 00:39:53,140
adversary and defender reactions

998
00:39:53,140 --> 00:39:55,320
and relationships as well as

999
00:39:55,320 --> 00:39:56,780
other sort of factors that come into play.

1000
00:39:57,600 --> 00:39:59,320
So what's our guidance for defenders and

1001
00:39:59,320 --> 00:40:01,300
decision makers, my community? Well

1002
00:40:02,320 --> 00:40:03,260
adversaries are constantly

1003
00:40:03,260 --> 00:40:04,940
evolving and learning, like no shit Sherlock

1004
00:40:04,940 --> 00:40:07,120
of course they fucking are otherwise they'll lose their jobs.

1005
00:40:07,440 --> 00:40:07,800
Well,

1006
00:40:09,100 --> 00:40:11,060
legacy techniques and tradecraft for defense

1007
00:40:11,060 --> 00:40:13,240
and identification will fail. If we're relying

1008
00:40:13,240 --> 00:40:14,500
on things like, you know,

1009
00:40:15,020 --> 00:40:17,320
block listing or the IP addresses

1010
00:40:17,320 --> 00:40:18,500
associated with

1011
00:40:19,280 --> 00:40:21,240
C2 frameworks or whatever, it's a losing game.

1012
00:40:21,400 --> 00:40:23,300
Why? Because of a thing like ScanV, it's like

1013
00:40:23,300 --> 00:40:25,300
oh, you block this node? Well I have fifteen

1014
00:40:25,300 --> 00:40:27,420
more or whatever over here for just this one up

1015
00:40:27,420 --> 00:40:29,300
and I can get a hundred more if I want

1016
00:40:30,080 --> 00:40:30,880
later on.

1017
00:40:31,060 --> 00:40:33,080
It's playing whack-a-mole and it's a game that defenders

1018
00:40:33,080 --> 00:40:35,120
are going to lose. So instead

1019
00:40:35,120 --> 00:40:37,280
we need to start building an emphasis on things

1020
00:40:37,440 --> 00:40:39,400
like behavioral analysis of traffic patterns

1021
00:40:39,400 --> 00:40:40,800
and anomaly enrichment

1022
00:40:41,410 --> 00:40:43,520
are necessary items, which kind of

1023
00:40:43,520 --> 00:40:45,440
gets us into that creepy AI space a little bit

1024
00:40:45,440 --> 00:40:47,200
but again, if done well and done accurately

1025
00:40:47,200 --> 00:40:49,240
without the marketing bullshit around it, can

1026
00:40:49,240 --> 00:40:51,360
actually be a viable way of trying to

1027
00:40:51,360 --> 00:40:52,480
resolve some of these problems.

1028
00:40:52,940 --> 00:40:55,380
So the idea here is that defenders can't

1029
00:40:55,380 --> 00:40:57,480
rely on just sort of statically

1030
00:40:57,480 --> 00:40:59,180
addressing individual threats

1031
00:40:59,180 --> 00:41:01,460
but trying to understand categories of

1032
00:41:01,460 --> 00:41:03,400
threat action in order to then take some

1033
00:41:03,400 --> 00:41:04,380
sort of defensive response.

1034
00:41:05,060 --> 00:41:07,060
Okay, that's my community. What about your community?

1035
00:41:07,440 --> 00:41:09,420
For all the red teamers and hackers and such out there

1036
00:41:09,420 --> 00:41:11,420
whatever. Well in addition to

1037
00:41:11,420 --> 00:41:13,280
thank you for letting me speak to you for a while

1038
00:41:13,280 --> 00:41:15,360
and I hope this was interesting, really what

1039
00:41:15,360 --> 00:41:17,620
we're looking for is that human driven operations

1040
00:41:17,620 --> 00:41:19,360
are rapidly being replaced by

1041
00:41:19,360 --> 00:41:21,360
high end threat actors. We're not talking

1042
00:41:21,360 --> 00:41:23,320
about like the elite hacker or whatever in the

1043
00:41:23,320 --> 00:41:25,400
hoodie or whatever or Mr. Robot tapping away

1044
00:41:25,400 --> 00:41:27,260
or whatever in the dark. It's like that shit just

1045
00:41:27,260 --> 00:41:28,860
doesn't happen anymore. We're talking about

1046
00:41:29,700 --> 00:41:31,120
bureaucracies of dedicated

1047
00:41:31,120 --> 00:41:33,380
developers, infrastructure teams, exploit

1048
00:41:33,380 --> 00:41:35,360
development teams working in concert in

1049
00:41:35,360 --> 00:41:36,600
order to develop and deploy

1050
00:41:37,440 --> 00:41:38,800
capabilities for whatever reason.

1051
00:41:39,720 --> 00:41:41,440
As a result, actually

1052
00:41:41,440 --> 00:41:43,400
emulating adversaries, while

1053
00:41:43,400 --> 00:41:45,500
it's really, you know, depending on the organization

1054
00:41:45,500 --> 00:41:47,380
that you're working with, some of this goes out the window

1055
00:41:47,380 --> 00:41:49,360
because it's like you have single factor auth

1056
00:41:49,360 --> 00:41:50,780
on your VPN, like

1057
00:41:51,780 --> 00:41:53,400
please, you know, try harder.

1058
00:41:53,880 --> 00:41:55,500
You know, for those organizations they're already

1059
00:41:55,500 --> 00:41:57,460
screwed. But if we're talking about trying

1060
00:41:57,460 --> 00:41:59,340
to emulate adversaries

1061
00:41:59,340 --> 00:42:01,440
for more mature organizations as

1062
00:42:01,440 --> 00:42:03,520
hackers, red teamers, pen testers,

1063
00:42:03,520 --> 00:42:05,500
et cetera, we need to think at a higher

1064
00:42:05,500 --> 00:42:07,420
level of like, okay, how does this work?

1065
00:42:07,440 --> 00:42:09,220
What sort of operation scale? How can I start

1066
00:42:09,220 --> 00:42:11,040
mimicking this sort of activity in a meaningful

1067
00:42:11,040 --> 00:42:13,060
way that I'm not just testing defenses

1068
00:42:13,060 --> 00:42:15,400
but providing opportunities for defenders

1069
00:42:15,400 --> 00:42:16,860
to look at traffic

1070
00:42:16,860 --> 00:42:19,260
and actions that are similar to what

1071
00:42:19,260 --> 00:42:20,300
my adversaries are doing?

1072
00:42:20,820 --> 00:42:23,260
Plus testing and probing will become more

1073
00:42:23,260 --> 00:42:25,100
challenging. It's not just about spinning up an

1074
00:42:25,100 --> 00:42:27,400
AWS node and then brute forcing

1075
00:42:27,400 --> 00:42:29,240
traffic on the single factor VPN anymore

1076
00:42:29,240 --> 00:42:31,220
and then migrating to the domain controller

1077
00:42:31,220 --> 00:42:33,200
pulling creds and game over, but

1078
00:42:33,200 --> 00:42:35,340
really thinking about like, okay, how do I start

1079
00:42:35,340 --> 00:42:37,360
really emulating what we've seen

1080
00:42:37,440 --> 00:42:39,380
over the last ten years in terms of

1081
00:42:39,380 --> 00:42:41,260
infrastructure deployment and then

1082
00:42:41,260 --> 00:42:43,240
action on the part of high end threat actors.

1083
00:42:44,000 --> 00:42:45,160
So where do we go from here?

1084
00:42:45,800 --> 00:42:46,960
Networks of various types will

1085
00:42:46,960 --> 00:42:49,280
continue to be weaponized by threat actors

1086
00:42:49,280 --> 00:42:51,180
either as end targets, so going

1087
00:42:51,180 --> 00:42:53,360
direct to my victim, less likely

1088
00:42:53,360 --> 00:42:55,320
for my high end threat actors, but more

1089
00:42:55,320 --> 00:42:57,420
likely as means to reaching them.

1090
00:42:57,620 --> 00:42:59,460
I'm going after and doing these

1091
00:42:59,460 --> 00:43:00,740
exploited scale campaigns

1092
00:43:01,420 --> 00:43:03,460
not because these targets are immediately of interest

1093
00:43:03,460 --> 00:43:05,280
but because they provide me with a way of

1094
00:43:05,280 --> 00:43:07,200
tunneling my traffic to my ultimate

1095
00:43:07,440 --> 00:43:09,560
victims and that neutral or third party

1096
00:43:09,560 --> 00:43:11,320
web space in between starts to become a very

1097
00:43:11,320 --> 00:43:13,380
interesting battleground where there's not

1098
00:43:13,380 --> 00:43:15,280
a whole lot of agreement on authorities to

1099
00:43:15,280 --> 00:43:17,360
operate and what defenders, let alone

1100
00:43:17,360 --> 00:43:19,340
law enforcement, can do to respond to them.

1101
00:43:19,540 --> 00:43:21,400
Like if you hack back or whatever on the

1102
00:43:21,400 --> 00:43:23,280
C2 server and it's a

1103
00:43:23,280 --> 00:43:25,300
application server for a university somewhere,

1104
00:43:25,660 --> 00:43:27,500
what have you done? Have you committed a crime?

1105
00:43:27,740 --> 00:43:29,540
Arguably yes. Is that

1106
00:43:29,540 --> 00:43:31,420
a reasonable response or whatever for that

1107
00:43:31,420 --> 00:43:33,020
node being used to send like some

1108
00:43:33,020 --> 00:43:35,560
LDOS based wiper or whatever on your network?

1109
00:43:35,780 --> 00:43:37,420
Probably not, but how do we figure this out?

1110
00:43:37,440 --> 00:43:39,520
These are questions that policy people

1111
00:43:39,520 --> 00:43:41,460
should be addressing but instead they're talking about

1112
00:43:41,460 --> 00:43:43,280
commercial threat attribution and naming

1113
00:43:43,280 --> 00:43:45,600
schemas and other bullshit like that and not really helping out.

1114
00:43:45,940 --> 00:43:47,100
That's my world, I'm sorry.

1115
00:43:48,040 --> 00:43:49,400
The idea though is that

1116
00:43:49,400 --> 00:43:51,500
the increasing scale and velocity of campaigns

1117
00:43:51,500 --> 00:43:53,440
will make defense and response challenging

1118
00:43:53,440 --> 00:43:55,440
but not impossible. We just need to recognize

1119
00:43:55,440 --> 00:43:57,400
the state of where things are and begin

1120
00:43:57,400 --> 00:43:59,600
moving and adapting defensive controls

1121
00:43:59,600 --> 00:44:01,220
and counter measures in tandem with that

1122
00:44:01,220 --> 00:44:02,920
to come up with reasonable solutions.

1123
00:44:03,360 --> 00:44:05,340
I have no frickin' idea where I am

1124
00:44:05,340 --> 00:44:06,180
on time right now.

1125
00:44:09,520 --> 00:44:10,360
I had two minutes?

1126
00:44:10,480 --> 00:44:11,800
That's not enough time for questions really.

1127
00:44:12,340 --> 00:44:13,660
I'm happy to meet out in the hallway

1128
00:44:13,660 --> 00:44:15,260
afterwards if anyone wants to discuss.

1129
00:44:15,480 --> 00:44:17,340
I'll hang out like over there somewhere

1130
00:44:17,340 --> 00:44:18,560
like by the windows or something.

1131
00:44:18,960 --> 00:44:20,840
But this is available on the media server.

1132
00:44:21,760 --> 00:44:23,140
Bunch of references and resources

1133
00:44:23,140 --> 00:44:25,280
related to these topics if you're interested in going

1134
00:44:25,280 --> 00:44:27,340
deeper into these since we really just cover

1135
00:44:27,340 --> 00:44:29,660
things at a high level. But thank you so much.

1136
00:44:29,720 --> 00:44:31,680
This was a lot of fun. I hope this was interesting for you.