Okay. Maybe a little lower. Maybe not a little lower. Okay. I think we're good. So good
morning, everyone. My name is Joe, Joe Slowik. I currently run CTI and a few other things for a
company called Huntress. They might not really like some of the stuff I'm talking about today,
so we'll just kind of leave it at that. I've been lots of other places, too, or whatever, but
this is the first time I've ever spoken to main stage DEF CONs. I was really excited about
this because I never thought I would. Because I am not the hacker type. I am more of the
defender type or whatever. But I think this talk on burrowing through the network and really
contextualizing something called the Vulcan leaks or Vulcan papers is something that's not just
really valuable for my community, talking like blue teamers and so forth, but also provides a
really good insight into how high-level advanced stage cyber operations work for our real
high-end state-sponsored entities.
Thank you.
So with that, our agenda today is we're going to talk about, like, what the fuck are the Vulcan
files or whatever. Like, I showed up here or whatever. I don't even know what these things are.
So we'll level set on that and then get into how Vulcan relates to the ecosystem of Russian
cyber operations and then orient what Vulcan looks like within the context of greater cyber
history. Because I think as a relatively young discipline, we still do a real shit job in
understanding what has come before and how it all links together.
And comes evolves over time. With that in mind, we'll then talk about what the future looks like
for cyber operations, offensive espionage and other, and close out with some conclusions and
hopefully I'm not over time at that point because they will throw me off the stage if I am.
So the Vulcan files. What are the Vulcan files? So the Vulcan files were a are a cache of
documents that were disclosed to primarily two German journalists, Hakan Tanrivardi and Hannes
Munzinger who were both former at Süddeutsche Zeitung. They're now working for the German
state broadcaster and for this effort they worked with Der Spiegel. Hundreds and hundreds of
pages of project documentation, contracting documents and similar for a bunch of cyber
operation tools and effects payloads sponsored by various Russian agencies. Really cool
stuff. It was a pleasure to help out Hakan and Hannes or whatever on this work.
But there was also coverage in English in the Washington Post. Ellen Nakashima and others
published on this as well for American audiences. And you had cyber firms or whatever like
Mandiant now part of Google Cloud, part of something or other, Alphabet, whatever that chain
looks like, who did a deep dive on this as well. Some really good contextualization from like
you know the so what cyber defense perspective on these things. So that was all pretty cool.
We'll get back to like well why am I not hearing about this until today or whatever for I'm
guessing a
non-trivial number of folks in the room. But in looking at what the Vulcan leaks are, they
involve a company called NTC Vulcan, which is located in Russia. The leaks themselves, I already
said like hundreds and hundreds of pages of materials or whatever like primary source
documents that I think for historians will be quite interesting or whatever as we write the
story of what cyber looked like in the 2020s and 2010s. And then the significance of these
things. So in looking at NTC Vulcan, this is a computer technology firm that is
owned and operated by Russian military veterans with the approval or authorization to perform
classified or sensitive work for Russian state organizations. Not all that different for how many
veteran owned businesses you'll see scattered up and down you know the highway or whatever
between say Northern Virginia and Southern Maryland and whatnot. So you know other folks have
contractors or whatever that are coming out of dot gov space, dot mil space and starting up their
own dot coms or whatever for twice the salaries and so forth.
The leaks themselves came from an unknown entity. There is some discussion that this was an entity who was
upset and disgusted with his country's policies towards Ukraine and that this was an act of protest for some of the
capabilities that they were responsible for or linked to in development, but obviously for their safety, they have not been revealed.
Lord knows where they are right now or whatever, hopefully somewhere far away from Russia at this point in time, but provided this documentation to the journalists I mentioned earlier who then went through a
consortium of paper cut media in order to disseminate this to a variety of other news organizations, The Guardian, I can't remember if it was Le Monde or Le Figaro, but anyway, French publications, Washington Post, et cetera, to try to get this far and wide.
And then the significance of these, like we don't see this kind of shit very often. We see it a lot when it comes to say the US space, and I'll get to that a little later on, and some leaks that have come about from western sources or whatever, but like other
than things, like if you're familiar with the Intrusion Truth Twitter account and some of the work that they've done in publicizing Chinese nexus operations, seeing this sort of leak or disclosure or whatever from an insider doesn't happen terribly often, and we haven't seen a whole lot of this coming from the Russian space.
And so really getting this view into the nuts and bolts of cyber network or computer network operations is pretty cool and pretty interesting shit. So here's Vulcan. I don't know if they're still in this building or not, but that's the Google Strip.
We have a great view from the address that was up to date as of like 2021. So hi guys. I'm not going to call them assholes because we're all kind of in this together, and who among us has not provided, like, you know, controversial tools to government agencies or whatever as part of our employment?
Don't answer that question, I suppose.
Again, Vulcan files covering lots of stuff, but three primary programs of interest, one of which we'll focus on today. So the one that we'll focus and spend the most amount of time on is Scan or ScanV.
Which is a little bit of a different one.
which is a scanning suite, but it's a lot more than that.
We'll get into the significance of that shortly.
A information operations platform called Amazit,
which, while we're not gonna spend too much time on that,
very interesting from a forward-deployed
information operations sort of capability space.
And then there was another tool called Crystal2V,
which we're not gonna talk about that much at all,
because I frankly don't find it all that interesting
other than that it exists,
that looks to be a sort of like a testing
or penetration testing platform
for industrial control environments and similar,
but doesn't appear to be as concerning or whatever
as some of the malware we've seen coming out of Russia,
like Triton and Destroyer and similar.
But to get back to ScanV, what we're talking about here
is a really interesting program combining multiple networks
to set up a scanning enumeration, exploitation,
and data collection platform that goes across
several different networks.
And that's what we're talking about here,
is that we're looking at different information domains.
So I don't have a pointer or anything here,
but if you look at this, we go from the external internet,
where systems that are set up with a bunch of
publicly available and non-publicly available exploits
or knowledge of vulnerabilities and exploit payloads
for those vulnerabilities, being able to deploy those
to victim nodes as well as extract information
and task exploited nodes to then move into
a processing environment that, if you can make it out,
it's a little small, you see on the right, with that,
that red network and the green network in the corner,
CD and CD, so talking true sneaker net operations
and moving data into classified processing platforms
for further analysis and evaluation.
This is cool shit.
This is like how the sausage gets made
when it comes to state-sponsored cyber operations.
You'll notice I'm not saying nation state,
because if you say nation state,
it hits you in the head with a sock with a bar of soap in it.
But anyway, the idea here being is that ScanV, by design,
is a distributed multi-component system
with various information boundaries, public internet,
private internal network that has internet connectivity,
and then having out-of-band networks, not air gaps,
because we are sneaker netting shit over there,
to classify processing mechanisms.
It's designed for the automated tasking and action
within pre-programmed capabilities.
So we're talking about basically standing up a platform
to do exploitation and subversion at scale.
The purpose of this,
well, we can't really,
there's not an explicit purpose document
that I was able to find, at least in the Vulcan documents,
which, by the way, you can download
if you want to look at them and read Russian.
It's linked at the end of this presentation.
But really looks to combine external scanning functionality
with a catalog of vulnerable software and exploits.
So go after all of the Forda OS
like everyone else in the world,
or here's your Citrix devices or whatever and pop those,
and we'll talk to how this links
to other Russian operations here in a little bit,
but the main idea here is automating
or increasing the efficiency of cyber operations
as well as infrastructure harvesting.
Not just identifying endpoints that are valuable
in themselves as sources of information
or targets of disruption,
but setting up the sort of network intermediaries
that could be used to tunnel and launder network traffic
so it doesn't look as malicious.
It's coming from Susie's home router or whatever
from their ISP and not directly from GRU headquarters
located on the outskirts of Moscow.
Umizit is another program that I,
again, we're not gonna spend too much time on that here
because again, we only have 45 minutes
and so we have many miles to go before we sleep and such.
But it is interesting in that it provides a platform
that by physically connecting to mobile
and information networks,
so installing hardware in the switching center
or at the BSC or BTS if we're talking cellular networks
and so forth, that it provides the ability
of not just reading traffic and you can see the panel,
on the left, that we have Twitter,
the contact live journal I think is up here.
I guess that's still popular in Russia, who the hell knows.
But various posting and social media platforms,
not just for a collection perspective,
but also providing the capabilities of injecting into
and modifying those communication streams.
That's pretty interesting because it moves beyond espionage
to being able to do things like modify or send tweets
impersonating individuals to influence conversations
and do other sort of info
ops activities.
So in looking at this, we have Amazit as an information
operations and collections platform.
There's also some like ICS, OT shit or whatever
related to that as well.
Dragos did a deep dive into that.
If you're curious, we're not gonna get too much
into that here today.
It's interesting because it's capable of capturing
and processing communication streams,
not just for collection,
but for that manipulation piece as well.
And that has potential applications
because this is a mobile sort of system.
So it's not just about deploying this in Dagestan or Chechnya
or something like that for internal communication monitoring,
but you could imagine, although there has not been evidence
of this to date that we are aware of,
of taking this into occupied areas of Ukraine or similar
in order to establish some degree of population influence
or control through capturing and manipulating
social media streams.
So scary stuff as shit or whatever,
people really getting their tentacles into
these sorts of areas.
So that's all cool and scary and cybery and whatnot,
but the response to the Vulcan leaks was kind of meh.
It was really unfortunate because I thought
this was some cool shit,
but after the week that all this came out,
seemed like no one really cared.
And I don't really know why that is.
Certainly there's a lot going on in the world right now.
You've seen the meme or whatever of aliens land on Earth
and dude or whatever is in the corner smoking.
It's like, dude, I got a lot going on right now.
I can't do this.
So what else has been going on?
Well, we've got this asshole getting indicted or whatever.
So, you know, I'm trying to figure out what's going on.
Stuff like that.
We've got, you know, Taylor Swift taking over the world.
You know, other things to attract our attention.
And you know, we've got UFOs out there.
So maybe people were just busy.
I don't know.
But that's one of the reasons why I thought
this would be a useful presentation to a wider audience
because not just what was reported in the news,
but also connecting Vulcan to the history
of cyber operations, which we'll get into here momentarily.
So in diving into the Vulcan leaks,
they represent a significant event in the history
of cyber operations.
Now we just need to review what the hell
is inside these things after that short overview.
So in looking at the Vulcan leaks,
we have NTC Vulcan as an entity.
And then these programs, ScanV, Amazit, Crystal2V, also
MiniDuke, which Google's tag associated
with Russian operations and linked it based upon the Vulcan
leaks to NTC Vulcan as well.
So four software programs, one not explicitly documented
in the leaks themselves that link to this one organization.
But more importantly, we've got a bunch of software programs.
And more importantly, these items also directly link
to various elements of Russian cyber operations.
ScanV is associated quite directly
with the Russian military intelligence GRU unit 74455,
also known as Sandworm, which is a pretty gnarly actor
that does lots of asshole-ish shit or whatever all
across the world, and especially in Ukraine these days.
Amazit, as an information operations platform,
was linked to the Radio Research Institute in Russia,
which is also associated
with the Russian Federal Security Service, or FSB.
So internal intelligence and security services,
but certainly with an external mission as well.
And then MiniDuke was linked back to SVR operations,
our APT29 and whatever mess that is these days between Nobellium
and throw a bunch of other stupid names or whatever
at the problem or whatever.
But we're seeing NTC Vulcan working
with each leg of the Russian CNO tripod, which
is kind of interesting.
Because for various reasons.
Especially between the civilian intelligence agencies,
like SVR and FSB, and then the GRU,
if you looked at something like Mark Gagliotti's Russian Putin's
Cyber Hydra or whatever, a lot of these organizations don't
get along very well and are actually quite competitive
with each other.
Yet NTC Vulcan is doing work for all three roughly
simultaneously, which is kind of interesting.
It's not completely unique, but it is sort of rare to see
that sort of spread across multiple facets of cyber
operations.
Instead of having just one or two dedicated customers
as part of this.
So with that, we see that Russian cyber operations
has a variety of links to the private sector.
So one example that I actually presented at Virus Bulletin
last year is SNKM, T-S-N-I-A-K-H-M, a research
institute associated with Russia's Ministry of Defense,
and an entity referred to as Xenotime, which we're not
quite sure where it aligns with Russian cyber operations.
It seems GRU-ish, but not necessarily.
So there's some nuanced reasons for that that we can't get
into today for timing reasons.
But we've also seen organizations like the SVA
Institute, another research organization in ties to the
SVR, or ODT, yet another public private research
organization tied to the FSB's front on botnet that was used
in disruptive operations.
A KVANT Institute, another public private research
organization linked to the FSB in supporting and enabling
operations and sanctioned by the US Department of the
Treasury.
And also, InController and Pipedream.
Wait a minute.
No one linked InController and Pipedream to Russia, right?
We talked about that here, I think, in track four last year.
A former colleague of mine, Jimmy Wiley,
did a deep dive into Pipedream and InController,
which was quite fascinating.
But if you look around enough or whatever,
you'll see that there are folks that have tied InController
or Pipedream, depending on which vendor you're going with a naming
schema, to an organization called Advanced System
Technologies, a contracting entity in Russia.
So again.
And seeing this nexus of private sector organizations
developing and deploying tooling,
such as Droverub, also associated with AST,
and that was the subject of a fairly lengthy malware analysis
report released by the United States during COVID,
which again kind of floated off the radar a little bit.
But the idea of this privatization
of cyber warfare, oh, I said it.
I'm sorry.
But the idea being is that we're maximizing on capabilities
by extending beyond the silos of government organizations
to take advantage.
We're taking advantage of public-private relationships
and research institutions, as well as
outright commercial entities to support state-directed efforts.
So in looking at this, NTC Vulcan is both an example
and a pioneer, in a way, of increasingly outsourced
cyber development and engineering
for state-directed operations.
However, it's important to note, this is not just Russia.
This is not just happening there by any stretch of the imagination.
And there were probably some people at that other event
or whatever up the strip earlier today that had booths that are
just as involved in this.
But it's also happening in the security space, as well.
So let's go into ScanV and Sandworm,
because that's kind of the most interesting item
from my perspective, especially because I'm kind
of an infrastructure analyst at heart when it comes
to what I do in the security space.
So Sandworm historically leverages compromised,
legitimate infrastructure.
They don't spin up their own, like,
Hetzner or HostSailor or AWS Node.
They'll go out and compromise someone else's server
or whatever and tunnel traffic through there
as an OPSEC mechanism.
And to try to break the trail going back and forth.
And to try to get back to them and their organization.
And there's multiple examples of this.
Going all the way back to, like,
Indestroyer from the 2016 Ukraine event,
where they used what appeared to be compromised Tor exit nodes
as the last step command and control infrastructure
before accessing the infrastructure
where Indestroyer was deployed.
But also more recent items like VPN filter and Cyclops Blink.
We'll get back to those here in a minute.
But the important thing is that,
what ScanV represents is a way of getting
this sort of burnable, deniable infrastructure
and doing it and tasking it at scale
and in a semi-automated fashion.
So being able to hack the planet
in a way that allows an operator to enter in some criteria
and then step off keyboard.
So when looking at this,
we can operationalize this sort of idea
by stockpiling vulnerabilities.
And as anyone here who does any sort of red teaming knows,
it doesn't have to be a damn zero day.
People don't pat shit for years,
especially when it comes to infrastructure crap.
But coming up with a list of publicly known
plus one day vulnerabilities
and then sprinkle in a couple of zero days
if you really have to, I suppose,
and you have a quiver of arrows
to launch at a variety of targets
in order to get points of presence
in a variety of networks.
Then I just need to identify vulnerable nodes.
And what's interesting is that ScanV does have a Shodan plug-in.
So yay.
A little unfortunate,
but you can't avoid these sorts of things, I imagine.
But also it does its own scanning and evaluation
and so forth and looking for these vulnerabilities.
And then through exploitation,
marshal victims into proxy chains for operations.
So that I can go from GRU HQ
where my operators are doing operations
to some Soho microteak or whatever
that's out there in the wild
to my ultimate victim.
And probably having multiple steps in the middle there
so that all my net flow analysis or whatever
that scare the shit out of Ron Wyden and other folks
really kind of goes down the toilet
because I'm doing chained communication
or whatever across multiple items along the way.
And so what I get is this.
Not like just some creepy old man
staring into the Palantir
or whatever the hell this orb is or whatever.
But really, check out my orb.
Operational relay boxes.
People who say command and control nodes
and call them orbs,
you can probably guess
either they worked somewhere previously
or they're LARPing as someone
that worked somewhere previously.
The idea being is that you get
burnable, reusable infrastructure
that's not directly linked to yourself
in order to execute operations
to avoid tracing back
and to also allow for you to burn that infrastructure
without losing something more valuable
in the process.
So what's the so what behind these sorts of items?
Like, okay, it's cool hacking programs
that got leaked or whatever.
Big fucking deal, dude.
Well, there's this focus on scalability
and control of widespread operations.
If you want to be in an intelligence agency
in the 21st century at this point,
there's a lot of shit out there
in order to get
whatever you want in order to go after.
And doing this on a very human scale basis
just doesn't scale all that effectively
unless you can throw thousands of bodies at it,
which is what some people assume China is doing,
which seems almost borderline racist
in a certain sort of way.
But the idea being is that you either need
lots and lots of operators
or you need to figure out a way to do this
in an automated fashion.
So getting that greater efficiency
and extent of cyber activity
as enabled by a platform such as ScanV
gets you to that point
where I can do more with less.
This is the whole impetus behind detection as code
and DevSecOps and whatnot,
is that just like we are in the defender's face
trying to do more with less because,
I don't know, we do have the people,
many of them have unfortunately been laid off
over the last eight months or whatever,
which really fucking sucks.
But even still, anyone who worked their salt
within this space knows that we can't just
continually throw bodies at security problems
and expect good things.
Well, it kind of works on the offensive side too
as you have more and more stuff floating
into information space.
And so we're really talking about moving beyond
one operator, one op campaigns
to massive distributed operations
enabled by this platform
of gathering information,
collecting infrastructure for use
and then doing a combination of unclassified
and classified network processing
and tasking of what has been compromised.
Alright, that's cool, but is this unique?
What's Vulkan look like in cyber history?
Well, is Vulkan activity unique?
I've already given you this answer,
like fuck no, it's not unique.
This sort of shit's been around for a bit.
So what's it look like though previously?
So have we seen similar examples?
Yes we have, we've seen similar examples in Russia.
We've seen similar examples in China.
Maybe we've seen similar examples in the US?
I don't know, we'll get to that here in a minute.
But really we can just choose our hacker.
And by the way, if anyone in the audience knows
or is responsible for creating this image,
please let me know because I've wanted to make
stickers or shirts of this for years
and I can't find the original source for it.
So pick me up or whatever because I want to make sure
that you get recognition and whatever else
or whatever out of that because I think that
that picture's frickin' awesome.
Anyway, so as we're choosing our hackers here
and figuring out who's been doing this sort of
rationalization of cyber operations,
we have to look at Russia and cyber manipulation
and where this aligns with Russian
cyber operations history.
So we have two facets here,
looking at Sconvy and Amazit.
We have building compromised networks
and monitoring and manipulating information.
From those overall mission profiles,
we've seen previous examples of this.
So we've seen VPN filter and Cyclops Blink
from an infrastructure perspective
and SORM,
the system for domestic monitoring
within the Russian Federation
when it comes to information collection
and operations.
So in looking at this,
VPN filter and Cyclops Blink
are two capabilities somewhat related
that were network device targeting capabilities.
Like find a bunch of vulnerable microtiques,
knock them over,
and rope these in to collect
network collections of nodes
that can be tasked for various purposes.
In the case of VPN filter,
it looked like this was being built into a large
distributed denial of service network
likely to target Ukrainian entities
although it was disrupted
by US authorities in conjunction with
private sector and some others
before it could be used.
But these could also be used to proxy traffic
and that appears to be the case for Cyclops Blink
when it was deployed as a similar capability
of again targeting network devices
in order to take advantage of
unpatched or vulnerable systems
to proxy traffic for follow-on operations.
But there's also evidence
that there were further capabilities
at least in review if not in outright use
such as a Modbus protocol
capability associated with VPN filter.
It was only able to collect Modbus,
a OT-based traffic protocol
for those unfamiliar,
but if you're gathering that information
presumably you're doing so for a reason
that could lead to follow-on exploitation,
manipulation, man-in-the-middle that stuff
or similar.
So as a result, ScanV
represents a mechanism to automate,
control and manage these sorts of capabilities
that Russian organizations,
principally Sandworm,
have already deployed,
but gaining that scalability and efficiency
to make these operations more realistic
and essentially more efficient
and cheaper to run at scale.
But from an information operations perspective
we've also seen this with respect to SORM
which is related to a Russian law
that allows for, well requires
that the Russian security services bolt in
hardware into telco providers
and similar in order to
gather up traffic and perform surveillance
at scale.
So this has been around for over 10 years at this point
and has been documented by
a variety of organizations
whether we're talking about commercial press
or things like the European Council
of Human Rights and so forth.
But the thing is that SORM requires
putting hardware into the telco providers
network and then stepping away.
Where SORM gives way
to something like Amazit is the ability
to forward deploy that
and allow for information influence operations
to move beyond just the network backbone
that's already under direct physical
and legal control by the authorities in question.
But they begin deploying that
in say the occupied areas of Ukraine
or similar regions
to sort of extend that sort of visibility
and capability into areas where it would otherwise
take significantly more effort
in order to try to rebuild and re-architect
the backbone behind the communication
networks in such organizations.
I can instead take a suitcase, plug it into the base
station controller of a given area
and boom, I start collecting information
especially across social media platforms.
So okay, we've picked on Russia a lot.
Alright, poor Russia, right?
Actually no, fuck them.
But what about China?
What about China? China's out there too, right?
Aren't they really active in this space?
Well they certainly are and one of the ways
I think a lot of folks are familiar with
is the Great Firewall of China.
This is one of several reasons why I will
as much as I would love to go to China someday
I know it's not going to happen anytime soon
but why VPN services
are such a hot commodity for people
in the Chinese ecosystem
to try to evade Great Firewall
traffic control and traffic interception.
Less heralded
but honestly more interesting in my opinion
there was a capability that was
disclosed by the folks at
Citizen Lab at the Munk School in Toronto
about China's Great Cannon.
So this was a capability that almost
took the same infrastructure behind
the firewall of deep packet inspection
and traffic moderation and added on
the ability to inject into traffic
streams to deliver exploitation
payloads to targets of interest based
upon the traffic recorded.
Certainly things like SSL are your friend
in these sorts of cases unless that is also
being proxied as part of the
firewall operations but the idea here
is providing an effective means to
exploit individual users at scale
based upon selectors identified in traffic
to get endpoints
or compromised endpoints for
dissidents, political opposition,
commercial organizations or whatever
that might be opposed to the regime
or present a risk of some sort
and there's a desired need to monitor.
So we're looking at this
the Great Cannon, that came out in 2015
that's almost ten freaking years ago.
Where was technology ten years ago?
This is a lot different or whatever now
if nothing else we're on generation what for iPhones.
But the idea being
is that shit's changed and as a result
presumably and we've seen this
that the PRC is continuing
to invest and invest quite heavily
in CNO capabilities
and other cyber operations.
And we've seen this reflected in widespread
intrusion operations like the
proxy shell, proxy logon
exploitation campaigns going back to
last year to something that OrangeSci
eventually presented at Black Cat I believe
as well as DEFCON but that was
weaponized by Chinese threat actors
for quite some time due to
mysterious items around the disclosure
of those vulnerabilities to Microsoft.
Also more recent campaigns targeting
Barracuda email security gateways
and other infrastructure.
That China's going just like wild
on popping infrastructure right now
and we can see hints of the automation
aspect when it comes to something like
the Great Cannon.
So looking at the combination of
Great Firewall and Cannon functionality
starts giving us glimpses of similar ambitions
and similar programs that we see in
the Russian space with the main question
being the scalability and management
of these capabilities and how they would
benefit from widespread intrusion campaigns.
Could China build their own ScanV essentially?
My answer is like yeah they're pretty fucking smart
of course they could build it if they want to
and now that this information is out there
probably incentivized to do so at some point
in the future.
But wait, there's more.
Hey, remember the Snowden leaks?
Like that wasn't too long ago right?
That was only like 15, 10 years ago?
Yeah 10 years ago like a month ago.
So note and obligatory cover my ass
or whatever statement here that the
following slides are based on public commentary
and posting and neither confirm nor deny
the accuracy or veracity of the items
discussed. These are all theoretical things
that people have posted about that have
analyzed the Snowden files or Snowden
links directly. Anyway,
that out of the way, the leaks and their
implications is that we had a popular
conception that mostly revolved around the
PRISM program. That was a
questionable program for
domestic surveillance and so forth
targeting a variety of communication
platforms and social media and so forth
that was certainly important and arguably
very, very bad. But
that wasn't the only thing leaked which is
why there's questions about Mr. Snowden's
motivations and so forth
based upon the other things that were
cast out into the
world as well. Because there
were additional programs disclosed
including Snowden and potentially
others because we've seen things like
shadow brokers and other sorts of
entities come along over time
disclosing significant information
on computer network operation
capabilities such as widespread
automated exploitation and control
frameworks that were being used by
NSA and
5i partners according to reporting
prior to those leaks coming wild
or coming into the wild.
So we can talk about a quantum of exploitation.
So looking at Fox IT
and other organizations
there was an item
in the Snowden leaks concerning a
program called Quantum that essentially
provided a man on the side capability
of monitoring traffic through
various observation points
and then when traffic of interest is identified
injecting into that traffic stream and
trying to then achieve exploitation
based upon selectors.
Sounding a little different because there's
that man in the middle portion of events
but from the automated exploitation and control
perspective like this is looking a little bit like
ScanD in certain aspects.
And there were fun diagrams or whatever
noting how the internet or whatever
was basically targeted
or whatever in such a way to allow for
identification of traffic of interest that would
then result in not just exploitation
but then marshalling those exploited end nodes
into intelligence agency
controlled apparatus.
So fun stuff there.
The main thing with this sort of automated exploitation
at scale is that they represent
automated exploit systems similar to
what we're seeing with ScanV.
Disclosed publicly and certainly you started seeing
articles in Wired and the
Fox IT article and some hacker forum
posts and like how you can do this on your own
started popping
up about 2012,
2013 or whatever.
Not that long after or 2013, 2014
not that long after the leaks.
But what's interesting is that what was FiveEye
alleged state of the art almost
15 years ago at this point
given the likely origin of when
the documents actually were emerged
that Mr. Snowden then decided to yeet out
to the world.
We see artifacts of this now
reflected in Russian and Chinese operations.
So the point is that if
true these Snowden leaks were
arguably a disaster for the United States
related to CNO and SIGINT capabilities
by deploying, disclosing methodology
like as an intelligence agency that's
very very fucking bad.
However, it also appears that multiple other
parties were paying attention and taking notes
on how to build similar or potentially
even more ambitious programs based on
these disclosures. Disclosures
whether we're talking Snowden, Vulcan
or anything in between like
Vault 7 or Shadow Brokers and we've seen this with
Shadow Brokers eventually leading to
WannaCry. This shit doesn't happen
in a void. Just because some research
or journalist or whatever pushes this out there
doesn't mean like oh capabilities are burned
move on. Like nope. Folks are taking notes and
learning from each other and making sure that they're
trying to adapt to the state of the art of adversaries
or even allies
as they may see fit or necessary
to do so. So what's the
future of offensive cyber then in light of all
this sort of activity? Well
well well
there's a popular conception of cyber
of computer network operations
where you've got one asshole on a keyboard or whatever doing bad stuff
or like if you're a red teamer doing
bad stuff for good reasons
and that's cool and all and maybe
it encapsulates some of what still counts
for red teaming and pen testing or
whatever operations and maybe
for some state sponsored programs
but a more realistic depiction of CNO
these days. You're sitting in a freaking
cube farm man. This is
a discipline
now that has evolved beyond like
one individual executing
a single operation to trying to
develop frameworks to do these sorts
of operations at scale.
And we've seen this in multiple
aspects at this point.
So just looking at this slide we have
ScanV, we have the
Snowden Leaks items and we have
the Great Cannon all representing
attempts. Some successful, some
still maybe notional.
It's debatable if ScanV
actually went live or not. I've been
looking for a ScanV node. If you
find one let me know. I'd be curious to take a look
at it. But the idea being
is that we're looking for a
road to scalable cyber.
And that applies across personnel,
targeting and operational
security. So from a personnel
standpoint, cyber talent while it is
available right now because VCs are laying
people off and they suck,
the talent is still expensive especially if you're
working in the .gov or .mil space and have to
compete with private industry and so forth.
So the ability to codify skills
and capabilities in
programs and in applications
becomes quite useful in extending
and expanding programs so you're not doing
a, you know, arithmetic expansion
like one operator one up but rather
a geometric expansion that I get a couple
of devs and I can get a
exponential increase in the number of potential
operations and endpoints that I can exploit.
That gets us to targeting
where if you are a SIGINT authority
or state sponsored intelligence agency
with any sort of ambition whatsoever
global actions
or global ambitions require global actions.
Being able to successfully
target and manipulate networks
at a vast scale and
just throwing thousands of
you know, a million monkeys on a million
terminals or whatever can maybe exploit
the internet or whatever in a million years and so forth.
But that's not realistic.
So to really come up with a way
to hack the planet so to speak
we need to figure out ways of automating and making
that efficient. But also
top tier threat actors know that they don't
just buy AWS nodes or something
like that these days. Some still do
and there are reasons to do so.
But if you're really trying to do things like
conduct offensive cyber operations
or disruptive operations it behooves you
to start making the
final hop to the victim network
and where you're originally starting operations
from as far apart
as technically feasible
both to maintain your own sources
methods and command and control frameworks
as well as to potentially muddy the waters
around thorny
questions like attribution but also more
importantly retaliation and response
based upon that.
But importantly the Vulcan leaks are now
lagging indicators. This activity
has already taken place. We're looking at
this now in the past tense.
Thus we need to anticipate even
greater degrees of automation
queuing and reactive targeting emerging
over time. Again Five Eyes
were doing these over ten years ago. China
was doing a version of this about six or seven
years ago. Russia was doing something
kind of like this or whatever with VPN
filter and Cyclops Blink and then with
ScanV decided to like go
to 11 on the volume and
really make this into a much more widespread
sort of capability. So this shit's going
on and it's been going on and it's only going to
get better or worse depending
on your perspective for things. So what
should we expect? Well I would
argue that we should expect greater automation
and improved scalability. Just
you know accountants and so forth
or whatever they want to try to make you do more with
less and that applies in dot gov dot
mill space as well so it's going to happen.
That's not a very sexy point but
more interesting is this marshalling of the
neutral web for offensive actions
where
your unpatched Soho router
or whatever becomes a front
line article or whatever in
targeting
excuse me
critical infrastructure in
Ukraine.
So how do we start defending
that and do we start doing things like automated
remediation of vulnerable
nodes or whatever that are in neutral space?
Can we do that? Is that legal? Will that piss people
off? Yes it will piss people off. But
it really becomes a thorny issue for how
we start responding, reacting
and doing things like take downs against these
sorts of capabilities.
There's also and this is actually kind of cool I think
less reliance on rock stars
and more commoditization of capabilities.
So we want to talk about
lowering the barriers to entry
when it comes to cyber. This is one
way that I don't need to rely on like two or three
top tier hacks or whatever in
order to execute all my operations.
Rather I just need to
identify ways of getting
that knowledge that is employed by
those individuals, putting it into
code and then deploying it in some way that
scales effectively. And also
I'll give all the AI
vendors or whatever a lot of shit because
there's so much bullshit out there right now
but there are non-bullshit
applications for artificial intelligence
when it comes to this sort of activity.
So imagine if you will
that in addition to building say an
automated fuzzing platform for vulnerability
identification, you extend that even a little
bit further to a system that can do
system scanning
and classification that say can identify
based upon the system type and vulnerability
what is a reasonable vulnerability
that I could exploit that minimizes my risk
of detection and then what follow on
payload is most suitable for this device
to ensure either it's a lasting
node in my network or I can use it
as an immediately burnable item for say
deploying a wiper against a
system of interest that I want to
take out of the internet.
I apologize, it's like day three
of DEF CON, my voice is going.
Anyway, so
where does that put us?
It's like conclusions, like yeah adversaries innovate man
like that's cool, but
where are we now?
Capability, inspiration and
proliferation basically. So adversaries
learn from operations and open source
research. Every action comes with
some sort of response or reaction
in some great Newtonian reflection
within the cyber ecosystem.
And thus today's leak or disclosure becomes
the inspiration for or the
hey where the fuck are we doing that
for some other party or whatever
that happens to be involved in this space.
With that, computer network
operations is not a static field
but a constantly evolving one with multiple
factors. Now you want to talk about three body
problems, we're talking about like a five or six body
problem here in terms of
adversary and defender reactions
and relationships as well as
other sort of factors that come into play.
So what's our guidance for defenders and
decision makers, my community? Well
adversaries are constantly
evolving and learning, like no shit Sherlock
of course they fucking are otherwise they'll lose their jobs.
Well,
legacy techniques and tradecraft for defense
and identification will fail. If we're relying
on things like, you know,
block listing or the IP addresses
associated with
C2 frameworks or whatever, it's a losing game.
Why? Because of a thing like ScanV, it's like
oh, you block this node? Well I have fifteen
more or whatever over here for just this one up
and I can get a hundred more if I want
later on.
It's playing whack-a-mole and it's a game that defenders
are going to lose. So instead
we need to start building an emphasis on things
like behavioral analysis of traffic patterns
and anomaly enrichment
are necessary items, which kind of
gets us into that creepy AI space a little bit
but again, if done well and done accurately
without the marketing bullshit around it, can
actually be a viable way of trying to
resolve some of these problems.
So the idea here is that defenders can't
rely on just sort of statically
addressing individual threats
but trying to understand categories of
threat action in order to then take some
sort of defensive response.
Okay, that's my community. What about your community?
For all the red teamers and hackers and such out there
whatever. Well in addition to
thank you for letting me speak to you for a while
and I hope this was interesting, really what
we're looking for is that human driven operations
are rapidly being replaced by
high end threat actors. We're not talking
about like the elite hacker or whatever in the
hoodie or whatever or Mr. Robot tapping away
or whatever in the dark. It's like that shit just
doesn't happen anymore. We're talking about
bureaucracies of dedicated
developers, infrastructure teams, exploit
development teams working in concert in
order to develop and deploy
capabilities for whatever reason.
As a result, actually
emulating adversaries, while
it's really, you know, depending on the organization
that you're working with, some of this goes out the window
because it's like you have single factor auth
on your VPN, like
please, you know, try harder.
You know, for those organizations they're already
screwed. But if we're talking about trying
to emulate adversaries
for more mature organizations as
hackers, red teamers, pen testers,
et cetera, we need to think at a higher
level of like, okay, how does this work?
What sort of operation scale? How can I start
mimicking this sort of activity in a meaningful
way that I'm not just testing defenses
but providing opportunities for defenders
to look at traffic
and actions that are similar to what
my adversaries are doing?
Plus testing and probing will become more
challenging. It's not just about spinning up an
AWS node and then brute forcing
traffic on the single factor VPN anymore
and then migrating to the domain controller
pulling creds and game over, but
really thinking about like, okay, how do I start
really emulating what we've seen
over the last ten years in terms of
infrastructure deployment and then
action on the part of high end threat actors.
So where do we go from here?
Networks of various types will
continue to be weaponized by threat actors
either as end targets, so going
direct to my victim, less likely
for my high end threat actors, but more
likely as means to reaching them.
I'm going after and doing these
exploited scale campaigns
not because these targets are immediately of interest
but because they provide me with a way of
tunneling my traffic to my ultimate
victims and that neutral or third party
web space in between starts to become a very
interesting battleground where there's not
a whole lot of agreement on authorities to
operate and what defenders, let alone
law enforcement, can do to respond to them.
Like if you hack back or whatever on the
C2 server and it's a
application server for a university somewhere,
what have you done? Have you committed a crime?
Arguably yes. Is that
a reasonable response or whatever for that
node being used to send like some
LDOS based wiper or whatever on your network?
Probably not, but how do we figure this out?
These are questions that policy people
should be addressing but instead they're talking about
commercial threat attribution and naming
schemas and other bullshit like that and not really helping out.
That's my world, I'm sorry.
The idea though is that
the increasing scale and velocity of campaigns
will make defense and response challenging
but not impossible. We just need to recognize
the state of where things are and begin
moving and adapting defensive controls
and counter measures in tandem with that
to come up with reasonable solutions.
I have no frickin' idea where I am
on time right now.
I had two minutes?
That's not enough time for questions really.
I'm happy to meet out in the hallway
afterwards if anyone wants to discuss.
I'll hang out like over there somewhere
like by the windows or something.
But this is available on the media server.
Bunch of references and resources
related to these topics if you're interested in going
deeper into these since we really just cover
things at a high level. But thank you so much.
This was a lot of fun. I hope this was interesting for you.