1
00:00:00,000 --> 00:00:04,420
All right. Everyone, thank you. We're going to kick off our next speaker. Being in Vegas,

2
00:00:04,580 --> 00:00:08,740
right, we're going to have something with a little bit of theme, right? You're no George

3
00:00:08,740 --> 00:00:12,360
Clooney, and this ain't Ocean's Eleven. So welcome our next speaker.

4
00:00:17,640 --> 00:00:22,520
Hi, everybody. So I heard that this is my first time speaking at DEF CON, although this is

5
00:00:22,520 --> 00:00:29,180
my 25th DEF CON that I've attended. Thank you. There's a tradition that you're supposed

6
00:00:29,180 --> 00:00:35,720
to take a shot as your first thing on the stage. So I'm not a big heavy drinker, but I do

7
00:00:35,720 --> 00:00:40,500
believe in responsible enjoyment of your weekend in Las Vegas. So everyone, cheers to you.

8
00:00:40,580 --> 00:00:53,120
Thank you. So I'm Andrew Brandt. I'm a security researcher and analyst for XOPS. And this talk is

9
00:00:53,120 --> 00:00:59,020
about a little bit about social engineering and a lot about malware that's dropped by

10
00:00:59,020 --> 00:00:59,160
social media. So I'm going to talk a little bit about social engineering and a lot about

11
00:00:59,160 --> 00:01:07,140
XOPS. Sorry. These things are really important. So I want to take one minute, though, to do a

12
00:01:07,140 --> 00:01:13,200
land acknowledgment, which I don't know has been done at DEF CON at this year so far. So for

13
00:01:13,200 --> 00:01:19,660
the past 31 years, DEF CON has been held on this land that is the traditional land of a tribe

14
00:01:19,660 --> 00:01:25,180
called the Nu'uvi. They're also known as the Southern Paiute Tribe. And there are sub-tribes

15
00:01:25,180 --> 00:01:29,140
within the Nu'uvi that include a tribe that is specifically based in Las Vegas, which is the

16
00:01:29,140 --> 00:01:33,860
land of the Nu'uvi, based here in Las Vegas. The lands of the Nu'uvi stretch all the way from

17
00:01:33,860 --> 00:01:43,440
central Utah to almost the border of Mexico, Mexicali. The tribe spanned this enormous area and

18
00:01:43,440 --> 00:01:50,640
lived here for hundreds of years, but then started to fail in the 19th century. So in 1826,

19
00:01:51,680 --> 00:01:58,780
settlers came to Nevada to do trapping and hunting. And then the U.S. government took control of this entire

20
00:01:58,780 --> 00:02:06,700
area in 1848, and accordingly, the tribe suffered, was moved along, and it wasn't until 1970 that

21
00:02:06,700 --> 00:02:15,360
the tribe finally gained, like, official status and, you know, earned itself a reservation here in

22
00:02:15,360 --> 00:02:24,860
the area, 122 years after the first white people came here. So a little bit about myself and what I do.

23
00:02:24,920 --> 00:02:28,760
I already mentioned I work at SOPHOS. I'm a former journalist who, in my own experience, has had a lot of

24
00:02:28,780 --> 00:02:32,700
malware analyst it's a weird transition but actually it seems like a lot of

25
00:02:32,700 --> 00:02:36,800
people who are tech journalists seem to be working for vendors these days I also

26
00:02:36,800 --> 00:02:40,360
volunteer at a retro computing museum in Boulder Colorado called the media

27
00:02:40,360 --> 00:02:44,720
archaeology lab so if you're ever out in Boulder feel free to come by if you ever

28
00:02:44,720 --> 00:02:49,500
wanted to play with a Apple 2 or Commodore 64 or play on an Atari 2600

29
00:02:49,500 --> 00:02:53,060
we have all that stuff and then there's something else I wanted to mention just

30
00:02:53,060 --> 00:02:59,680
briefly is that so I am in the process I turned off the screen I am in the

31
00:02:59,680 --> 00:03:06,760
process of running for political office this is a challenging time thank you in

32
00:03:06,760 --> 00:03:14,300
in this country and and this community is some of the smartest and kindest and

33
00:03:14,300 --> 00:03:21,200
you know have the most creativity of people that I have ever met so I'm

34
00:03:21,200 --> 00:03:22,920
running for school board in the local area

35
00:03:22,920 --> 00:03:23,040
where I work and I'm working for a school board and I'm working for a

36
00:03:23,060 --> 00:03:28,980
where I live I would very much welcome your support and donations as this is a

37
00:03:28,980 --> 00:03:34,140
off-year campaign there are literally no off years these days I am running on a

38
00:03:34,140 --> 00:03:38,360
very progressive platform to protect you know groups of people that are

39
00:03:38,360 --> 00:03:43,040
currently under threat around the country I also have a lot of like

40
00:03:43,040 --> 00:03:48,220
policy ideas about just teaching kids tech and I would love to have a national

41
00:03:48,220 --> 00:03:52,860
standard for educating kids in cyber security and safety and online privacy

42
00:03:52,860 --> 00:03:58,700
so that we are not continuously doing these same war stories about people

43
00:03:58,700 --> 00:04:04,280
getting tricked by scummy criminals every year for the next 31 years so I

44
00:04:04,280 --> 00:04:05,500
hope I can get your support

45
00:04:06,240 --> 00:04:11,340
all right so let's talk about a little bit what we're going to talk about today

46
00:04:11,340 --> 00:04:14,620
so there's gonna be a few reaction gifts of George Clooney but mostly we're

47
00:04:14,620 --> 00:04:20,960
talking about sort of normal people who who don't pretend to be like Debonir

48
00:04:20,960 --> 00:04:21,400
like

49
00:04:21,400 --> 00:04:22,600
you know Esquire

50
00:04:22,600 --> 00:04:22,840
Michael

51
00:04:22,840 --> 00:04:28,000
model guys, you know, walking into casinos to break into the safe with their whole team

52
00:04:28,000 --> 00:04:34,440
of like super hackers. No, these are just schlubby guys figuring out how to get on the

53
00:04:34,440 --> 00:04:39,520
right side of the victim and convince them to do something that they shouldn't be doing

54
00:04:39,520 --> 00:04:43,080
or that they, you know, wouldn't want to do under normal circumstances. There's going

55
00:04:43,080 --> 00:04:46,140
to be a little bit about the social engineering and a lot about the attack.

56
00:04:47,460 --> 00:04:52,400
So, and I keep pushing the wrong button. Let's talk about the first one. So, in, earlier

57
00:04:52,400 --> 00:04:59,520
this year, the ex-ops team working with our managed data response team did an investigation

58
00:04:59,520 --> 00:05:05,940
into what we discovered was a pretty widespread attack in this country of social engineers

59
00:05:05,940 --> 00:05:10,640
who were targeting tax accountants. So, these are like small businesses, sometimes just

60
00:05:10,640 --> 00:05:15,920
one employee, sometimes like five or ten. People were, these tax accountants were,

61
00:05:17,400 --> 00:05:22,140
receiving really interesting solicitation notices. They were getting emailed by people

62
00:05:22,140 --> 00:05:27,400
who said, hey, I just lost my accountant. I got to get my taxes done. You know, are

63
00:05:27,400 --> 00:05:32,760
you accepting new clients? And so, the beginning of the attack was just this like back and

64
00:05:32,760 --> 00:05:38,560
forth engagement conversation with the, between the attacker and the victim. And what ended

65
00:05:38,560 --> 00:05:44,480
up happening was eventually the attackers would say, okay, so do you need to see my

66
00:05:44,480 --> 00:05:45,580
last year's tax returns?

67
00:05:45,920 --> 00:05:49,840
And let me send you a file from Dropbox, right? And so, they would send them an email

68
00:05:49,840 --> 00:05:53,920
with a link to a zip file that they said was their tax returns. I'm sure you can guess

69
00:05:53,920 --> 00:05:55,360
this was not their tax returns.

70
00:05:56,540 --> 00:06:01,240
Inside of these zip files that they were sending to these accountants, they were all password

71
00:06:01,240 --> 00:06:07,860
protected with the same password. There was two files inside of each archive. There was

72
00:06:07,860 --> 00:06:14,400
a decoy file and there was a Windows shortcut link. And so, the first thing that the person

73
00:06:14,400 --> 00:06:15,820
would do is that they might open.

74
00:06:15,820 --> 00:06:20,920
Like, this thing that was a PDF or a JPEG and then they would double click it. Well,

75
00:06:21,020 --> 00:06:26,380
it was actually not that type of file. So, the computer would throw an error and then

76
00:06:26,380 --> 00:06:31,200
they would try to double click the shortcut, which is where all the trouble began. It

77
00:06:31,200 --> 00:06:35,920
was a little bit goofy. Yeah, what most people saw was something like this. So, if you tried

78
00:06:35,920 --> 00:06:40,520
to double click something that's not a PDF and it says PDF, this is going to happen.

79
00:06:40,720 --> 00:06:44,180
And so, what we did was we, you know, retrieved a bunch of these samples.

80
00:06:44,180 --> 00:06:51,300
And the file that was the decoy is this MP3. Now, I don't know how to do the volume control.

81
00:06:51,580 --> 00:06:56,600
So, guys on the board, like, be ready to turn it down. But I'm just going to play a few

82
00:06:56,600 --> 00:06:57,640
seconds of this music.

83
00:07:04,060 --> 00:07:10,740
So, this is, the instrument is called an oud. And it's a traditional instrument of the

84
00:07:10,740 --> 00:07:11,280
Middle East.

85
00:07:14,180 --> 00:07:17,740
some music professors at CU Boulder and they don't know what the song is but

86
00:07:17,740 --> 00:07:21,920
they were they assured me that this is actually Ood music and what a weird

87
00:07:21,920 --> 00:07:30,340
thing to be sending to someone as a fake file all right so that that aside the

88
00:07:30,340 --> 00:07:33,500
next thing like the person would click that it wouldn't work they wouldn't know

89
00:07:33,500 --> 00:07:36,340
what to do so they click the shortcut and what happens when they click the

90
00:07:36,340 --> 00:07:39,800
shortcut is it starts the attack but when we as analysts start looking at the

91
00:07:39,800 --> 00:07:42,780
shortcut I mean the first thing I'm gonna do is right-click that shortcut

92
00:07:42,780 --> 00:07:48,120
and say where is it going so I do that and it's blank what the heck it is a

93
00:07:48,120 --> 00:07:53,340
completely empty shortcut and it even says PDF document in the in the comments

94
00:07:53,340 --> 00:08:00,920
field turns out this is a this is a year a year old exploit that was discovered

95
00:08:00,920 --> 00:08:06,920
by a guy and written up on his blog in April last year and it is a trick to

96
00:08:06,920 --> 00:08:11,040
basically fool Windows into being able to do a shortcut without actually

97
00:08:11,040 --> 00:08:12,280
showing anybody what the

98
00:08:12,280 --> 00:08:12,760
destination is.

99
00:08:12,760 --> 00:08:18,200
And it's by a prepending like a ton of like blank like null value bytes at the

100
00:08:18,200 --> 00:08:22,020
beginning of the shortcut command line and that's all it took to basically

101
00:08:22,020 --> 00:08:27,600
bypass this by the way the researcher who reported this bug and like broke

102
00:08:27,600 --> 00:08:31,840
posted about it on his blog reported it to Microsoft Microsoft declined to fix

103
00:08:31,840 --> 00:08:36,780
it saying it is not a bug is just an unusual circumstance so they just they

104
00:08:36,780 --> 00:08:42,520
have not fixed it and probably will not inside of this shortcut though and you

105
00:08:42,520 --> 00:08:47,520
can see what the screen looked like that was the actual shortcut file was this

106
00:08:47,520 --> 00:08:54,440
long command line and it had this invoke web request and then pointed at a URL

107
00:08:55,120 --> 00:08:58,740
and this was something that actually made me really excited because it was

108
00:08:58,740 --> 00:09:02,060
something that I had not seen in a long time but if you can see I don't know if

109
00:09:02,060 --> 00:09:10,820
you can read the URL it says HTTP colon slash slash 0 X C 2 dot 11808 979 what

110
00:09:10,820 --> 00:09:11,820
the heck is that.

111
00:09:11,920 --> 00:09:12,500
That is not a bug.

112
00:09:12,500 --> 00:09:20,240
a tld and that is not an ip address that is what we call a dotless ip address and it is actually

113
00:09:20,240 --> 00:09:27,260
two forms of dotless ip address that they have combined in a weird way to make it work together

114
00:09:27,260 --> 00:09:34,380
and and actually be a it will point at an ip address but does not resemble one in any normal

115
00:09:34,380 --> 00:09:41,100
way that you would expect so there is a hexadecimal form of dotless ip and there is a decimal form of

116
00:09:41,100 --> 00:09:46,120
dotless ip and they have managed to sort of concatenate it in this weird thing and the the

117
00:09:46,120 --> 00:09:52,160
reason that i got excited when i saw what this was is that so as i said i've been going to defcon for

118
00:09:52,160 --> 00:10:00,460
25 years this is a 25 year old vulnerability in the windows tcp ip stack that has never been

119
00:10:00,460 --> 00:10:05,180
uh adequately addressed is lit is core to the way that the tcp ip stack works

120
00:10:05,620 --> 00:10:10,820
um and it was exploited in two different ways against internet explorer for

121
00:10:11,100 --> 00:10:16,500
and internet explorer 5 back in the ancient times of before the millennium

122
00:10:16,980 --> 00:10:25,000
and um and i was so excited to see this because i'm like what is going on um i was working as an

123
00:10:25,000 --> 00:10:34,040
editor at pc world and he had come to my first defcon in 1998 and then saw this and um figured

124
00:10:34,040 --> 00:10:39,800
out how it worked and wrote and now i'm not a programmer i was trained as a i'm an english major

125
00:10:39,800 --> 00:10:41,080
and have no formal knowledge of the internet explorer and internet explorer 5 and internet

126
00:10:41,080 --> 00:10:42,000
explorer 4 and internet explorer 5 and internet explorer 5 and internet explorer 4 and internet explorer 5 and

127
00:10:42,000 --> 00:10:46,680
apologies for anybody who thought they were going to you know learn about uh getting into

128
00:10:46,680 --> 00:10:52,560
the code here but i am very good uh with spreadsheets and so i built myself this little

129
00:10:52,560 --> 00:10:59,560
calculator in excel that is basically demonstrates how to make a dotless ip address from a regular

130
00:10:59,560 --> 00:11:06,100
four dotted uh ipv4 address and flip it back again and i had not touched this spreadsheet

131
00:11:06,100 --> 00:11:11,040
since 1999. so i had to pull it out um take a look at it

132
00:11:11,040 --> 00:11:16,240
and then i made this little addendum at the bottom to sort of amend this spreadsheet but let me just

133
00:11:16,240 --> 00:11:22,240
explain briefly how it works so normal dotted ip address is four sets of numbers from zero to 255.

134
00:11:22,640 --> 00:11:28,540
if you were to take any of those sets of numbers and translate it into its hexadecimal equivalent

135
00:11:29,420 --> 00:11:32,920
that's the first you basically can take that for each of those

136
00:11:33,760 --> 00:11:40,440
octets and you can concatenate those those bytes together that is your hexadecimal dotless ip

137
00:11:41,040 --> 00:11:47,220
if you take that concatenated um hexadecimal and just convert that to decimal you end up with like

138
00:11:47,220 --> 00:11:53,520
a 12 digit number so you can literally have like http and a bunch of numbers with no dots

139
00:11:53,980 --> 00:11:58,760
that works as well and what they did in this case what the goo loader attackers did who who

140
00:11:58,760 --> 00:12:05,060
were distributing this malware was they they mixed it up the first octet they just left the hexadecimal

141
00:12:05,600 --> 00:12:11,020
dot and then the next three hexadecimal values converted to decimal was the rest of the url

142
00:12:11,400 --> 00:12:17,040
and it was so cool to see this happen right and there were so many of these like this was just

143
00:12:17,040 --> 00:12:22,920
one example like in one day's worth of data of collecting samples from the addresses where the

144
00:12:22,920 --> 00:12:27,940
uh where the bad guys were hosting their their files um we pulled out like all these different

145
00:12:27,940 --> 00:12:34,140
like shortcuts pointed each one of these is pointed at a different uh visual basic script

146
00:12:34,140 --> 00:12:40,500
that was hosted on one of these three ip addresses here so bad ip addresses bad neighborhood um so

147
00:12:53,880 --> 00:13:04,300
the next thing you notice is um the process code um and i will go back and see if someone has

148
00:13:04,300 --> 00:13:08,060
spent too much time careful classifying this but what this actually does is what the process code

149
00:13:08,060 --> 00:13:10,780
does is you basically it acts on its own

150
00:13:11,900 --> 00:13:17,140
And in every version of the script, they modified the variable names.

151
00:13:19,920 --> 00:13:22,320
But basically the flow was the same, right?

152
00:13:22,380 --> 00:13:27,380
So they work in tandem with the Windows registry and PowerShell to do a bunch of bad stuff.

153
00:13:27,800 --> 00:13:29,280
So what is it doing?

154
00:13:29,520 --> 00:13:36,800
So it decodes the IR8 variable, decodes into another script, a PowerShell script that is

155
00:13:36,800 --> 00:13:43,300
filled with hexadecimal chunks, which then the script takes all these individual chunks

156
00:13:43,300 --> 00:13:50,700
of just a few bytes each chunk and concatenates that, BXORs the concatenated data, and then

157
00:13:50,700 --> 00:13:55,840
Base64 decodes that into yet another script and then executes that.

158
00:13:56,560 --> 00:14:00,920
So in the parlance of XOps, we call this Matryoshka malware.

159
00:14:01,240 --> 00:14:05,640
So Matryoshka doll is the little Russian nesting dolls that you open it up and there's always

160
00:14:05,640 --> 00:14:06,300
a smaller one.

161
00:14:06,300 --> 00:14:08,380
There's always a smaller one until you get to the one that's like a little tiny nugget

162
00:14:08,380 --> 00:14:11,680
and that is how this attack was working.

163
00:14:12,260 --> 00:14:18,640
And then that content that gets loaded out of the registry that comes out of the 07 variable.

164
00:14:18,900 --> 00:14:22,380
So it's actually too big to fit on one screenshot.

165
00:14:22,540 --> 00:14:23,740
It was a gigantic file.

166
00:14:24,880 --> 00:14:29,800
So it writes a bunch of data into the Windows registry, which I'm going to show you in a

167
00:14:29,800 --> 00:14:30,940
minute what that does.

168
00:14:31,360 --> 00:14:36,280
And in addition to creating all these registry keys, it is...

169
00:14:36,280 --> 00:14:41,040
It's also changing, like, environment variables on the device, so it created an environment

170
00:14:41,040 --> 00:14:46,620
variable called SALTOQ that was pointed at PowerShell and a bunch of other variables.

171
00:14:46,920 --> 00:14:54,280
And the way that that worked was basically it creates a run key in the registry that

172
00:14:54,280 --> 00:14:59,940
was called overproduce and it invokes that SALTOQ variable to run a PowerShell command.

173
00:15:00,280 --> 00:15:06,260
The PowerShell command pulls out that data out of a registry that's HKEY, current user,

174
00:15:06,280 --> 00:15:12,860
user slash clog-like, and it had a giant amount of VBS inside of that command.

175
00:15:13,200 --> 00:15:15,260
And that VBS was...

176
00:15:15,260 --> 00:15:20,460
It was like a blossoming flower, like, the more you let it run, the more stuff it, like,

177
00:15:20,460 --> 00:15:22,440
would just pull out of different places.

178
00:15:22,800 --> 00:15:28,380
And eventually what you end up with was this malware called GOOLOADER that injected itself

179
00:15:28,380 --> 00:15:35,720
and, again, ironically, into a old, disused Internet Explorer component called IELOWUTIL,

180
00:15:36,280 --> 00:15:40,340
which is actually the microphone tuning utility for Internet Explorer 11.

181
00:15:41,060 --> 00:15:42,380
So yeah, that was...

182
00:15:42,380 --> 00:15:43,740
So that was GOOLOADER, right?

183
00:15:43,840 --> 00:15:49,140
And that's just one of these cases where it just started with a very simple thing and

184
00:15:49,140 --> 00:15:53,580
just cascades out of control until you've got this malware that is...

185
00:15:53,580 --> 00:15:58,700
It is physically present and persistent on the machine, but there is nothing in the file

186
00:15:58,700 --> 00:16:01,100
system, nothing to work with.

187
00:16:01,860 --> 00:16:05,540
The cleanup is basically just go into the registry and clean it up.

188
00:16:06,280 --> 00:16:06,620
All right.

189
00:16:06,880 --> 00:16:07,400
Stopping.

190
00:16:07,400 --> 00:16:08,080
Having a drink.

191
00:16:08,640 --> 00:16:09,160
Cheers.

192
00:16:12,540 --> 00:16:14,000
Thank you very much.

193
00:16:14,680 --> 00:16:15,420
All right.

194
00:16:15,760 --> 00:16:23,180
So for the second attack, this was an incident that we were called in to investigate last

195
00:16:23,180 --> 00:16:29,800
year, and we sat on this for a little while because we really wanted to sort of disclose

196
00:16:30,140 --> 00:16:31,640
this attack at DEF CON.

197
00:16:31,860 --> 00:16:34,720
So this is the first time that anyone has heard about this.

198
00:16:34,840 --> 00:16:36,200
We published our blog.

199
00:16:36,200 --> 00:16:38,720
We published our blog about it yesterday on our website.

200
00:16:38,940 --> 00:16:42,000
So you can go to news.sophos.com and read about it.

201
00:16:42,020 --> 00:16:44,980
We call it the Image Spam Attack, and I'll tell you why in a minute.

202
00:16:45,360 --> 00:16:46,700
So yeah.

203
00:16:47,060 --> 00:16:48,440
So this one was a...

204
00:16:48,440 --> 00:16:51,300
I find these kinds of stories so interesting.

205
00:16:51,420 --> 00:16:55,220
The regular conventional malware is so boring, but these are great stories.

206
00:16:55,440 --> 00:16:57,840
So let me set the stage for the attack.

207
00:16:58,100 --> 00:17:00,060
So there's a lot of text here.

208
00:17:00,140 --> 00:17:01,300
I'm not going to read the whole slide.

209
00:17:01,460 --> 00:17:04,420
You can read along, but I'm basically going to just tell you the story.

210
00:17:04,580 --> 00:17:05,700
So these attackers...

211
00:17:06,560 --> 00:17:12,740
They had done their homework, and they found a target that they wanted to target.

212
00:17:13,000 --> 00:17:16,700
And they figured out who they wanted to contact at that target.

213
00:17:16,880 --> 00:17:20,520
And they got their contact information, they figured out what department they worked in,

214
00:17:20,700 --> 00:17:23,980
they learned all they could about the target, and then they struck.

215
00:17:24,220 --> 00:17:29,280
And the way that they struck was on a Friday afternoon, they called this company and called

216
00:17:29,280 --> 00:17:35,420
this guy's line directly and said, hey, we're calling from a shipping company, and we've

217
00:17:35,420 --> 00:17:40,200
got this priority package, and we were supposed to deliver to the other office for your company,

218
00:17:40,380 --> 00:17:44,240
and they were closed, and there was no one there to take it, so we need to redirect it

219
00:17:44,240 --> 00:17:47,860
to your office, and you're the only person that we were able to reach.

220
00:17:48,260 --> 00:17:52,380
And the person answering the phone, they don't normally receive packages, right?

221
00:17:52,420 --> 00:17:53,840
They work in this office.

222
00:17:54,180 --> 00:17:55,420
And they said, oh, okay.

223
00:17:55,520 --> 00:17:56,600
Well, so is it addressed to me?

224
00:17:56,620 --> 00:17:56,900
No, no.

225
00:17:56,960 --> 00:18:03,960
It's addressed to your boss, but he was unavailable, but can we deliver it to you for you to give

226
00:18:03,960 --> 00:18:04,460
it to him?

227
00:18:05,420 --> 00:18:08,800
And, you know, this person was, you know, of course, you know, this sounds like a high

228
00:18:08,800 --> 00:18:09,400
priority thing.

229
00:18:09,540 --> 00:18:10,320
You couldn't reach anybody.

230
00:18:10,500 --> 00:18:15,480
They knew that this person's boss was out of town, so he was just the only person there

231
00:18:15,480 --> 00:18:16,760
to accept the package.

232
00:18:17,000 --> 00:18:22,180
So they say, okay, look, we're going to send you an email.

233
00:18:23,160 --> 00:18:24,760
We already know your email address.

234
00:18:24,900 --> 00:18:26,760
We're sending you an email right now.

235
00:18:26,820 --> 00:18:32,440
While the guy's on the phone with them, the person who got this phone call gets this email

236
00:18:32,440 --> 00:18:35,360
message and says, you know, it says...

237
00:18:35,420 --> 00:18:40,740
Hey, inside this email is a tracking number, and you need to read the tracking number

238
00:18:40,740 --> 00:18:47,280
back to me so we can validate that you, the recipient, are the appropriate person to be

239
00:18:47,280 --> 00:18:48,200
getting this package.

240
00:18:48,380 --> 00:18:53,240
He literally turned the authentication process back on the victim.

241
00:18:53,880 --> 00:18:57,380
You would imagine, right, like most people would say, like, hey, do you really want to

242
00:18:57,380 --> 00:18:59,400
be, you know, who are you?

243
00:18:59,420 --> 00:19:00,880
How do you prove that you are who you are?

244
00:19:00,940 --> 00:19:03,220
Well, in the middle of the call, the email came in.

245
00:19:03,280 --> 00:19:04,760
And, you know, he says, like, okay.

246
00:19:04,760 --> 00:19:09,160
So just open up the thing that's in this email and read me the number out of it, and

247
00:19:09,160 --> 00:19:12,300
then we'll be by in, you know, ten minutes to drop off the package.

248
00:19:12,400 --> 00:19:14,200
I'm just, you know, about a mile away.

249
00:19:14,880 --> 00:19:15,840
So yeah.

250
00:19:15,900 --> 00:19:21,020
So this redirection technique, it was really weird.

251
00:19:22,300 --> 00:19:24,340
This is the email message that he got.

252
00:19:24,500 --> 00:19:27,040
So it is written in French.

253
00:19:27,880 --> 00:19:33,540
The person who received it, the company and the person is based in Switzerland.

254
00:19:33,560 --> 00:19:33,920
And...

255
00:19:34,760 --> 00:19:38,920
As everyone here knows, the national languages are French, German, and Italian.

256
00:19:39,920 --> 00:19:45,220
And so it would be totally normal for anybody who works for a Swiss company to receive an

257
00:19:45,220 --> 00:19:46,800
email in any of those three languages.

258
00:19:47,800 --> 00:19:52,880
The message body of this says, your documents had been sent by a delivery service that hasn't

259
00:19:52,880 --> 00:19:54,180
had contact with the destination.

260
00:19:54,660 --> 00:19:59,500
And it goes on to say that for reasons of security, delivery isn't possible unless you

261
00:19:59,500 --> 00:20:03,920
provide the correct code to the shipper, and you have to get the code from the attached

262
00:20:03,920 --> 00:20:04,460
PDF.

263
00:20:05,060 --> 00:20:06,740
You want to guess what that is?

264
00:20:06,880 --> 00:20:07,860
Not a PDF.

265
00:20:09,100 --> 00:20:13,800
The email also indicated that the shipment was something that weighs about the same as

266
00:20:13,800 --> 00:20:18,240
a letter, and it had elevated government agency priority.

267
00:20:18,620 --> 00:20:19,840
So whatever that means.

268
00:20:20,060 --> 00:20:24,680
I mean, you know, when I get my tax returns, I don't get government agency priority.

269
00:20:26,500 --> 00:20:31,500
So yeah, anyway, there was a few things that were wrong with the email message.

270
00:20:31,700 --> 00:20:34,640
Number one, the entire body of the email.

271
00:20:34,640 --> 00:20:40,940
Everything below the headers was one giant embedded image, including the line that looks

272
00:20:40,940 --> 00:20:41,840
like an attachment.

273
00:20:42,160 --> 00:20:44,300
It's just one big picture.

274
00:20:44,520 --> 00:20:45,820
There is no attachment.

275
00:20:46,120 --> 00:20:51,620
The big picture fills the entire screen and looks like it's designed to look exactly like

276
00:20:51,620 --> 00:20:53,560
a message in Office 365.

277
00:20:54,300 --> 00:21:01,240
In addition, because there's no attachment, the entire image is basically one giant hot

278
00:21:01,240 --> 00:21:01,500
link.

279
00:21:01,660 --> 00:21:04,180
And it points to a redirection.

280
00:21:04,180 --> 00:21:09,620
You are all that was posted on some random website that belongs to a company that had

281
00:21:09,620 --> 00:21:16,000
some like ad redirect script on there that basically accepted any input to redirect someone

282
00:21:16,000 --> 00:21:17,140
to any other website.

283
00:21:17,420 --> 00:21:21,420
So so in this case, it redirected.

284
00:21:21,420 --> 00:21:26,680
It was this abusable redirect script that basically pointed people to another website

285
00:21:26,680 --> 00:21:27,120
and you can.

286
00:21:27,140 --> 00:21:31,000
I've blocked out a little bit of the URL, but what you can see is that it was it was

287
00:21:31,000 --> 00:21:34,000
actually sending the user via this other.

288
00:21:34,180 --> 00:21:39,580
Website to safe delivery dash company dot com, which is, you know, I like safe deliveries.

289
00:21:41,180 --> 00:21:45,200
Here's another view of like what the what the payload looked like, what the the email

290
00:21:45,200 --> 00:21:45,960
body looked like.

291
00:21:46,040 --> 00:21:50,620
It was basically a completely empty message with just an image link and an anchor tag.

292
00:21:52,380 --> 00:21:52,920
Yeah.

293
00:21:53,020 --> 00:21:54,620
So I mentioned safe delivery company dot com.

294
00:21:54,720 --> 00:22:00,140
We also discovered after the fact that another in another attack that had happened that we

295
00:22:00,140 --> 00:22:04,100
subsequently discovered that they were using air courier dash company dot com.

296
00:22:04,180 --> 00:22:08,160
So either way, you know, either your air courier or your safe delivery is bad.

297
00:22:09,720 --> 00:22:11,340
So what happened next?

298
00:22:11,500 --> 00:22:14,500
The employee basically went along with all of this.

299
00:22:14,620 --> 00:22:15,760
They double clicked the thing.

300
00:22:15,920 --> 00:22:17,420
They got a code.

301
00:22:17,560 --> 00:22:22,900
They read the code to the to the person on the telephone person on this phone said, great.

302
00:22:23,180 --> 00:22:24,240
That's the right code.

303
00:22:24,420 --> 00:22:25,200
I'll be right over.

304
00:22:25,280 --> 00:22:26,120
Hangs up the phone.

305
00:22:26,460 --> 00:22:28,040
Nobody ever hears from them again.

306
00:22:28,380 --> 00:22:29,580
Fifteen minutes passes.

307
00:22:29,880 --> 00:22:31,320
The employee starts to get nervous.

308
00:22:31,600 --> 00:22:33,800
The employee calls the security team.

309
00:22:34,180 --> 00:22:36,980
And says, I might have done a bad.

310
00:22:37,620 --> 00:22:38,660
What happened?

311
00:22:39,000 --> 00:22:41,760
And they said, don't turn off your computer.

312
00:22:41,960 --> 00:22:43,300
Pull out the ethernet cable.

313
00:22:43,480 --> 00:22:44,300
And the employee did it.

314
00:22:44,400 --> 00:22:48,480
And it preserved all of the evidence, which is fantastic.

315
00:22:49,120 --> 00:22:54,040
When we finally got called in a couple of weeks later, when this company decided that

316
00:22:54,040 --> 00:22:57,520
they needed somebody to do a postmortem on this attack, they called us in.

317
00:22:57,640 --> 00:23:00,120
We discovered everything up until this point.

318
00:23:00,340 --> 00:23:03,860
And but the website that the.

319
00:23:04,180 --> 00:23:07,040
That the malware had come from was already shut down.

320
00:23:07,200 --> 00:23:12,160
And what was funny is that it's they use this ReactJS template that's called Deadline.

321
00:23:12,360 --> 00:23:16,620
And we keep seeing this pop up like there's a lot of criminals that use this template

322
00:23:16,620 --> 00:23:20,660
as like a placeholder for when they host something bad on their website.

323
00:23:20,820 --> 00:23:22,260
And then they want to take it down real quick.

324
00:23:22,360 --> 00:23:26,380
But they want the website to stay live so that it still shows up in the search results

325
00:23:26,380 --> 00:23:26,940
as benign.

326
00:23:27,160 --> 00:23:28,360
So yeah.

327
00:23:28,460 --> 00:23:30,560
Anyway, so very, very clever.

328
00:23:30,760 --> 00:23:32,380
Sorry, this isn't a George Clooney.

329
00:23:32,500 --> 00:23:33,280
This is Muldoon.

330
00:23:33,280 --> 00:23:35,120
Muldoon from Jurassic Park played by Bob Peck.

331
00:23:35,240 --> 00:23:36,580
I just like this reaction gif.

332
00:23:37,740 --> 00:23:42,260
So we finally did the postmortem and we found some really interesting stuff.

333
00:23:42,480 --> 00:23:44,120
So a couple of details.

334
00:23:44,280 --> 00:23:50,840
So the attacker only was able to access the computer, the machine for 15 minutes.

335
00:23:51,280 --> 00:23:53,540
They download during that 15 minutes.

336
00:23:53,640 --> 00:23:54,620
They were very busy.

337
00:23:54,720 --> 00:23:57,180
They downloaded and ran a bunch of PowerShell scripts.

338
00:23:57,360 --> 00:24:02,460
They were running they had deleted the original payload, which wasn't executable.

339
00:24:03,280 --> 00:24:04,860
Which we then we didn't have.

340
00:24:05,360 --> 00:24:07,900
We knew that they had downloaded this executable.

341
00:24:08,000 --> 00:24:09,020
We knew its file name.

342
00:24:09,260 --> 00:24:10,720
It wasn't on VirusTotal.

343
00:24:10,860 --> 00:24:16,020
So we had to figure out like a roundabout way of trying to figure out exactly how this

344
00:24:16,020 --> 00:24:16,400
worked.

345
00:24:16,980 --> 00:24:21,560
And then we did see some flow data that had like the IP addresses and the domain names

346
00:24:21,560 --> 00:24:24,160
of where the victim had clicked.

347
00:24:24,520 --> 00:24:27,960
And so we saw some of those pieces had been preserved.

348
00:24:28,400 --> 00:24:31,980
But then the things that were left behind on the machine just...

349
00:24:31,980 --> 00:24:33,260
We're stuck.

350
00:24:33,260 --> 00:24:34,820
We're so weirded out by them.

351
00:24:35,180 --> 00:24:38,020
And the MDR team, you know, didn't know what to do with them.

352
00:24:38,120 --> 00:24:39,500
So that's when they called us.

353
00:24:41,060 --> 00:24:46,600
So one of the things that they found on that machine was a full installation of Notepad++,

354
00:24:47,020 --> 00:24:52,100
which I mean, I don't know about you, but like that is a really we see all kinds of

355
00:24:52,100 --> 00:24:56,980
threat actor activity where they're going to install enterprise level remote access

356
00:24:56,980 --> 00:24:57,880
tools, right?

357
00:24:57,960 --> 00:25:02,980
So lots of ransomware actors will like throw any desk or some other, you know, remote shell

358
00:25:02,980 --> 00:25:03,980
program on there.

359
00:25:04,060 --> 00:25:09,060
Not just cobalt strike, but like the real commercial stuff so that it evades endpoint

360
00:25:09,060 --> 00:25:10,460
protection detection.

361
00:25:10,860 --> 00:25:14,860
But yeah, no, you don't really see people like installing like a text editor.

362
00:25:15,100 --> 00:25:16,860
Like it was such a weird thing.

363
00:25:17,500 --> 00:25:21,900
We also saw that there had been a bunch of like certificate authority certs installed

364
00:25:21,900 --> 00:25:25,940
into the certificate store on the machine.

365
00:25:26,360 --> 00:25:30,360
And those certificates were odd because, you know, we didn't...

366
00:25:30,360 --> 00:25:31,800
It looked like it was legit.

367
00:25:31,800 --> 00:25:35,420
But like why would you add a certificate to the certificate store?

368
00:25:35,900 --> 00:25:41,820
One of the other things that was really odd was that the copy of Notepad++, even though

369
00:25:41,820 --> 00:25:45,060
it was just basically benign executable, they had some...

370
00:25:45,060 --> 00:25:50,020
For some reason, they had signed it with another code signing certificate.

371
00:25:50,220 --> 00:25:55,200
So it was not signed by the valid certificate that was used by...

372
00:25:55,200 --> 00:26:00,260
When you download, you know, Notepad++, it's got like it's signed code.

373
00:26:00,260 --> 00:26:02,380
This was signed by a different certificate.

374
00:26:02,540 --> 00:26:03,560
Why would they do that?

375
00:26:03,620 --> 00:26:04,640
It would make no sense.

376
00:26:05,360 --> 00:26:08,700
It seems like it just kind of raised more questions than it answered.

377
00:26:08,980 --> 00:26:13,180
And then once we dug into that installation of Notepad, wow.

378
00:26:13,520 --> 00:26:15,980
That was a hot mess.

379
00:26:16,320 --> 00:26:23,160
What they left behind was a directory full in addition to just the full installation.

380
00:26:23,320 --> 00:26:25,760
So hey, if you want to like use Notepad++, you're great.

381
00:26:25,960 --> 00:26:28,040
But like in the updater directory.

382
00:26:28,220 --> 00:26:28,800
Like this...

383
00:26:28,800 --> 00:26:33,580
This installation of Notepad comes with a self-update tool.

384
00:26:33,780 --> 00:26:35,680
It's part of like the normal installation.

385
00:26:36,040 --> 00:26:40,200
But it usually only has like one program that's called update and a DLL.

386
00:26:40,480 --> 00:26:44,860
And you can see here that there were tons of Linux libraries.

387
00:26:45,180 --> 00:26:51,780
There was a Windows version of a Linux tool called SoCat which is used for opening, you

388
00:26:51,780 --> 00:26:55,180
know, just raw sockets for either listening or sending data.

389
00:26:55,760 --> 00:26:58,360
There was a complete portable Tor.

390
00:26:59,100 --> 00:27:00,720
Installation in a subdirectory.

391
00:27:01,220 --> 00:27:04,680
There were multiple copies of the curl library for some reason.

392
00:27:04,740 --> 00:27:06,200
Just a bunch of weird things.

393
00:27:06,440 --> 00:27:07,420
What are you doing?

394
00:27:07,640 --> 00:27:08,780
And then even...

395
00:27:08,780 --> 00:27:09,400
So like...

396
00:27:09,400 --> 00:27:13,640
And as you know, Notepad++, it's an open source project, right?

397
00:27:13,680 --> 00:27:15,040
So they have a GPL license.

398
00:27:15,560 --> 00:27:20,920
Even the license was tampered with so that they could do some kind of spying on it.

399
00:27:21,000 --> 00:27:24,800
And what was inside of that license was the weirdest thing.

400
00:27:25,180 --> 00:27:25,700
It was...

401
00:27:25,700 --> 00:27:26,060
No.

402
00:27:26,060 --> 00:27:29,800
The normal license is like 8K of just lawyer speak, right?

403
00:27:29,920 --> 00:27:31,140
And no one ever looks at them.

404
00:27:31,200 --> 00:27:32,300
No one ever reads them.

405
00:27:32,420 --> 00:27:39,100
This was 8K of lawyer speak followed by almost 60K of base 64 encoded data.

406
00:27:39,500 --> 00:27:43,640
And we're like, well, that is license terms that I do not like.

407
00:27:44,680 --> 00:27:50,640
So once we decoded that, we figured out that it was another PowerShell script that they

408
00:27:50,640 --> 00:27:53,420
managed to sort of like bury inside of the license.

409
00:27:53,520 --> 00:27:55,540
Which is, again, worst license ever.

410
00:27:56,060 --> 00:28:01,460
The script included levels of additional scripts that were encoded.

411
00:28:01,580 --> 00:28:07,260
So again, we're into this like Matryoshka malware where the more you crack open, the

412
00:28:07,260 --> 00:28:09,700
more smaller little pieces that you find.

413
00:28:10,000 --> 00:28:15,080
And what we discovered was, oh, this is how the certificate got inserted into the certificate

414
00:28:15,080 --> 00:28:15,460
store.

415
00:28:15,660 --> 00:28:18,260
So you run that first PowerShell script.

416
00:28:18,360 --> 00:28:24,140
It had three giant blobs of base 64 and the code to decode them and run whatever came

417
00:28:24,140 --> 00:28:24,520
out.

418
00:28:24,520 --> 00:28:30,720
And the first one, it drops the certificate on the machine and installs it into the Windows

419
00:28:30,720 --> 00:28:31,440
certificate store.

420
00:28:31,620 --> 00:28:34,060
The second one dropped the same certificate out of the machine.

421
00:28:34,260 --> 00:28:39,320
And if Firefox was present, it would install it into Firefox's certificate store because

422
00:28:39,320 --> 00:28:43,460
Firefox has to be special and have its own certificate store that's separate from the

423
00:28:43,460 --> 00:28:44,140
operating system.

424
00:28:44,460 --> 00:28:50,760
And then the third thing that it did was it created a scheduled task that once a day at

425
00:28:50,760 --> 00:28:53,300
a certain time would check into Tor.

426
00:28:53,300 --> 00:28:59,680
And communicate with a website that there were a list of five onion addresses that were

427
00:28:59,680 --> 00:29:00,940
embedded in the script.

428
00:29:01,260 --> 00:29:03,960
And it would just pick one at random and check in with it.

429
00:29:06,000 --> 00:29:08,600
So why would you put a CA certificate on a machine?

430
00:29:08,840 --> 00:29:15,920
So I used to work for a company that made a box that was a machine in the middle TLS

431
00:29:15,920 --> 00:29:17,880
decryption box for security purposes.

432
00:29:18,180 --> 00:29:22,340
And the way that it works is you would generate a CA certificate.

433
00:29:22,340 --> 00:29:24,520
And you have to install it in the certificate store.

434
00:29:24,700 --> 00:29:32,160
And then when someone wants to browse to an HTTPS website, instead of getting that warning

435
00:29:32,160 --> 00:29:34,280
pop-up that says, hey, there's a certificate problem.

436
00:29:34,500 --> 00:29:35,200
This doesn't match.

437
00:29:35,380 --> 00:29:35,940
Something's wrong.

438
00:29:36,220 --> 00:29:38,340
It would do the certificate resigning automatically.

439
00:29:38,800 --> 00:29:40,920
And the end user would never notice.

440
00:29:41,040 --> 00:29:45,440
But then on the back end, you could decrypt that data and sort of see everything that

441
00:29:45,440 --> 00:29:47,840
they were viewing on an HTTPS website.

442
00:29:48,740 --> 00:29:49,780
So yeah.

443
00:29:49,860 --> 00:29:52,060
Kind of an interesting technique to be using.

444
00:29:52,060 --> 00:29:52,200
And I think that's what I'm going to talk a little bit more about in a little bit.

445
00:29:52,200 --> 00:29:53,940
But I'm going to talk a little bit more about what they were using for a Notepad++ installation.

446
00:29:54,640 --> 00:29:57,700
What they were doing was they were doing TLS interception.

447
00:29:57,900 --> 00:30:05,680
And the certificate that they created was made to mimic a real one issued by the certificate

448
00:30:05,680 --> 00:30:06,700
provider Komodo.

449
00:30:07,300 --> 00:30:09,060
But it was not issued by them.

450
00:30:10,400 --> 00:30:10,960
Yeah.

451
00:30:11,080 --> 00:30:18,660
And then the third script was triggering the, as I mentioned, it was that scheduled task thing.

452
00:30:18,800 --> 00:30:19,700
And it would trigger.

453
00:30:19,700 --> 00:30:26,180
One of these two files that were in the updater folder, one was called gup.exe and one is

454
00:30:26,180 --> 00:30:28,540
called gup.exe.

455
00:30:28,640 --> 00:30:31,960
And both of them were used for phone home.

456
00:30:32,140 --> 00:30:34,980
And it would pick either of them at random.

457
00:30:35,160 --> 00:30:39,860
And then it would pick one of those five onion addresses at random and use that to

458
00:30:39,860 --> 00:30:47,060
phone in once a day to just check in and let everyone know that it was home and had been

459
00:30:47,060 --> 00:30:47,460
reached.

460
00:30:48,160 --> 00:30:51,040
That was not the only bad thing that we found.

461
00:30:51,900 --> 00:30:59,960
Once we started digging into event logs and other sort of like collected telemetry, we found we had

462
00:30:59,960 --> 00:31:01,740
found the end result of this.

463
00:31:01,820 --> 00:31:05,940
But we didn't find the PowerShell script that created it until we dug through the event logs.

464
00:31:06,160 --> 00:31:06,860
And this is great.

465
00:31:06,940 --> 00:31:12,200
Like if you can turn on the event logs, you can actually record any PowerShell script that gets

466
00:31:12,200 --> 00:31:17,300
run and then retroactively you can go back and find and recreate those scripts even if they get like

467
00:31:17,460 --> 00:31:20,160
self-deleted or if the threat actor deletes them.

468
00:31:20,360 --> 00:31:26,800
So we recreated it and what we found was this thing that writes out a file called matches.txt.

469
00:31:27,320 --> 00:31:34,480
And the matches file, it would scrape data and collect it in this matches file.

470
00:31:34,800 --> 00:31:39,920
It was scraping from accounting software like QuickBooks.

471
00:31:40,120 --> 00:31:42,440
It was pulling down a full system configuration.

472
00:31:43,230 --> 00:31:46,160
It would look for any passwords that were saved in the browser.

473
00:31:46,160 --> 00:31:52,460
Any cryptocurrency wallets and the cookies, browsing history and list of installed plug-ins from

474
00:31:52,460 --> 00:31:58,620
every major web browser platform and by every major platform, I mean Firefox, Opera, Edge, Brave,

475
00:31:58,820 --> 00:32:03,860
Chrome, Chromium, Vivaldi and Tencent's QQ, which is only used in China really, right?

476
00:32:03,920 --> 00:32:04,580
Who uses QQ?

477
00:32:04,660 --> 00:32:05,800
Anybody in here using QQ?

478
00:32:06,140 --> 00:32:07,100
Don't use QQ.

479
00:32:07,200 --> 00:32:07,660
All right.

480
00:32:08,980 --> 00:32:10,380
And don't use this.

481
00:32:10,720 --> 00:32:12,660
So what happens next?

482
00:32:12,820 --> 00:32:16,020
So they had deleted this executable.

483
00:32:16,160 --> 00:32:17,440
They had deleted this executable that did all this stuff, right?

484
00:32:17,480 --> 00:32:20,080
The PDF that had the tracking number in it.

485
00:32:21,020 --> 00:32:41,600
Hey, funny enough, if you go on VirusTotal and you look for that weird license file that was embedded in there that had that base64 in it and then you look for related files, you can find all sorts of executables that dropped that same weird notepad++ with all the configuration stuff and all those extra files in it.

486
00:32:41,680 --> 00:32:43,920
And we found the original one.

487
00:32:43,920 --> 00:32:47,160
That was sent to the people in Switzerland.

488
00:32:47,720 --> 00:32:51,620
We also found one that was sent to someone in France.

489
00:32:51,920 --> 00:33:08,560
And then while we were working on this and I was having a chat with the MDR team and just sort of letting them know the status of how this is going, one of them spoke up and said, oh, hey, yeah, back in September, we had a customer in Australia who had this happen to them, too.

490
00:33:08,680 --> 00:33:09,460
It's so weird.

491
00:33:09,540 --> 00:33:11,460
Like it was almost exactly the same thing.

492
00:33:11,560 --> 00:33:13,760
And we had preserved that one.

493
00:33:13,920 --> 00:33:15,080
So we took a look at that.

494
00:33:15,140 --> 00:33:16,480
They were all identical.

495
00:33:16,820 --> 00:33:21,860
So we have attackers who are targeting people in Australia, in France, in Switzerland.

496
00:33:22,080 --> 00:33:41,600
They were basically all over the world trying to figure out ways of breaking into companies and then using this very like kludged together hodgepodge of like files to do some pretty sophisticated like data collection and exfiltration of data and hiding their tracks by going over Tor.

497
00:33:42,340 --> 00:33:43,520
I mean, this was...

498
00:33:43,520 --> 00:33:44,860
This was wild stuff.

499
00:33:45,080 --> 00:33:45,200
Right?

500
00:33:45,320 --> 00:33:50,740
But then once we found the applications, it was so fun to look at them because look how cheerful that is.

501
00:33:50,880 --> 00:33:51,560
It's beautiful.

502
00:33:51,800 --> 00:33:56,100
Like it was actually just a very fancy electron app.

503
00:33:56,260 --> 00:33:56,400
Right?

504
00:33:56,480 --> 00:34:06,520
And if you don't know what an electron app is, it's basically a self-contained chromium-based browser with just the scripts and images that you would need to like make a self-contained application.

505
00:34:07,800 --> 00:34:09,160
It was really cool.

506
00:34:09,280 --> 00:34:13,500
It had the whole notepad++ plus all these other extra files inside of it.

507
00:34:13,500 --> 00:34:15,740
And it would drop it in the same place.

508
00:34:15,920 --> 00:34:17,800
And it would run that same PowerShell script.

509
00:34:17,980 --> 00:34:19,180
And it was golden.

510
00:34:19,340 --> 00:34:24,300
We could see that flower bloom and blossom into the bad thing that it became.

511
00:34:25,560 --> 00:34:26,520
And judging...

512
00:34:26,520 --> 00:34:28,240
And, you know, we were looking at the dates.

513
00:34:28,380 --> 00:34:36,720
So the file names contained a eight-digit date of, you know, year, month, day in the file names.

514
00:34:36,900 --> 00:34:37,760
And we were able to...

515
00:34:37,760 --> 00:34:42,580
You know, we understood that like the date actually lined up with the attack that we investigated.

516
00:34:42,580 --> 00:34:47,400
The date for the one in Australia lined up with the attack that that analyst investigated.

517
00:34:47,760 --> 00:34:49,500
And then we found a few more of these.

518
00:34:49,600 --> 00:34:54,480
And they corresponded to within the same timeframe but other dates, other languages.

519
00:34:54,880 --> 00:34:58,840
And it seems like these people have been pretty active doing this for a while.

520
00:35:01,040 --> 00:35:02,620
So what did it do?

521
00:35:03,680 --> 00:35:05,980
Once we got it, it was fun to play with.

522
00:35:06,100 --> 00:35:11,080
So one of my hobbies, fun things that I do, I run a lab out of my house.

523
00:35:11,080 --> 00:35:14,500
And it's filled with old laptops running a variety of windows.

524
00:35:14,800 --> 00:35:20,520
And I just infect them with malware and let them run continuously for several days to weeks.

525
00:35:20,980 --> 00:35:23,540
You've all seen the XKCD about the malware zoo.

526
00:35:23,700 --> 00:35:24,360
That's my house.

527
00:35:24,660 --> 00:35:28,960
And so we, you know, I ran this thing and I allowed it to sort of connect.

528
00:35:29,140 --> 00:35:34,020
And immediately what it did was it dropped all these things in their right place.

529
00:35:34,160 --> 00:35:38,080
It created, you know, instantiated Tor and opened a connection.

530
00:35:38,380 --> 00:35:41,060
And then it created three different instances of software.

531
00:35:41,080 --> 00:35:47,120
So that we're running listening on three different ports to just out to the Tor network.

532
00:35:47,740 --> 00:35:51,920
So that if the attacker could find my IP address, they could connect to me.

533
00:35:52,100 --> 00:35:54,960
But, again, I didn't know where they would be coming from.

534
00:35:55,960 --> 00:35:56,920
Very sophisticated.

535
00:35:57,320 --> 00:35:58,980
Although it was so goofy looking.

536
00:35:59,240 --> 00:36:00,340
And it was so cheerful.

537
00:36:00,520 --> 00:36:02,720
I loved the UI that they designed for this.

538
00:36:04,060 --> 00:36:04,540
Yeah.

539
00:36:04,600 --> 00:36:09,760
When we found all these copies of it and they were floating around, we had some in our repositories.

540
00:36:09,860 --> 00:36:11,000
There were some in VirusTotal.

541
00:36:11,080 --> 00:36:13,140
We went out looking for more.

542
00:36:13,280 --> 00:36:14,200
We found a bunch of them.

543
00:36:14,280 --> 00:36:21,980
And basically all of these scripts that we had, you know, found and pulled down, they were all basically identical.

544
00:36:22,180 --> 00:36:26,640
With the one exception of the variable names in all of them were different.

545
00:36:26,800 --> 00:36:31,340
So you can literally see that, like, when I diffed it, you know, all the lines look diffed.

546
00:36:31,360 --> 00:36:34,480
But basically it's just the variable names and just the onion addresses.

547
00:36:34,680 --> 00:36:37,580
And everything else in the script is basically verbatim.

548
00:36:38,520 --> 00:36:45,100
And we also found that same fake Komodo certificate that was embedded in all of these things.

549
00:36:45,200 --> 00:36:51,940
We reported the certificate to Komodo to let them know that they were being, you know, imitated by these guys.

550
00:36:52,100 --> 00:36:53,520
There's nothing they can do about it.

551
00:36:53,600 --> 00:36:58,940
I mean, you can literally make a CA certificate for yourself that has any company's name in it.

552
00:36:59,000 --> 00:37:01,560
It wasn't a valid certificate, but it didn't need to be.

553
00:37:01,640 --> 00:37:06,560
It just needed to be installed in the certificate store so they could do this machine in the middle decryption.

554
00:37:06,560 --> 00:37:08,180
So, yeah.

555
00:37:09,820 --> 00:37:12,340
So what do you do if you answer your phone?

556
00:37:12,660 --> 00:37:15,740
Does anybody here actually answer the phone when anybody calls anymore?

557
00:37:17,260 --> 00:37:19,260
You are a brave person in the back.

558
00:37:19,420 --> 00:37:20,280
Yes, congratulations.

559
00:37:20,760 --> 00:37:22,220
I'm grateful for you.

560
00:37:22,280 --> 00:37:24,580
I keep trying to get my kids to answer the phone as well.

561
00:37:25,240 --> 00:37:26,020
It's terrible.

562
00:37:26,180 --> 00:37:29,860
But listen, there's a few lessons that we can learn, right?

563
00:37:29,920 --> 00:37:32,720
So, like, social engineering, it's really hard to fight.

564
00:37:32,840 --> 00:37:36,540
And especially because human nature is that we all want to learn.

565
00:37:36,560 --> 00:37:37,640
We want to be good to each other.

566
00:37:37,740 --> 00:37:38,800
We want to be helpful.

567
00:37:39,040 --> 00:37:45,480
People get a call and they hear someone who sounds harried and upset and, oh, my God, like, can you please help?

568
00:37:45,560 --> 00:37:46,660
I need to get this thing to you.

569
00:37:46,840 --> 00:37:50,660
They want to do, you know, they want to help to make this person feel better.

570
00:37:52,120 --> 00:37:56,020
I think we've done a good job in training people to avoid phishing attacks.

571
00:37:56,400 --> 00:38:03,660
We've trained people to not just double click any office document that people randomly send to them that they call an invoice, right?

572
00:38:03,760 --> 00:38:05,360
Like the shipping confirmation stuff.

573
00:38:05,360 --> 00:38:06,060
I mean, please.

574
00:38:06,240 --> 00:38:07,660
Like, it's been ten years of this.

575
00:38:07,940 --> 00:38:24,100
But telephones, really hard to, like, you know, and when you've engaged with somebody, especially in the first attack, when the person was reaching out to the tax accountant, there were, you know, small errors in the typing but not enough to make you think that they were a Russian speaker.

576
00:38:24,360 --> 00:38:28,200
Just like, you know, the normal typos that, like, a person who's in a rush might make.

577
00:38:28,960 --> 00:38:34,720
It was a very sophisticated, very low key social engineering attack.

578
00:38:34,720 --> 00:38:46,060
And that is why it's so important to be good to your employees, to not teach them that, like, when they've done something bad, they're going to be made fun of or mocked.

579
00:38:46,060 --> 00:38:50,320
You have to tell them, look, we want you to do the right thing.

580
00:38:50,520 --> 00:38:51,500
Come to us.

581
00:38:51,600 --> 00:38:52,100
It's okay.

582
00:38:52,340 --> 00:39:00,740
You will not get in trouble for telling us that you answered a phone call from some random person and they told you to read something to them on the screen.

583
00:39:00,800 --> 00:39:01,700
We just want to help.

584
00:39:01,960 --> 00:39:04,700
And, you know, that was the lesson that we took away from it.

585
00:39:04,700 --> 00:39:16,280
The lesson that we took away from that company was that they had a very good internal culture where their employee felt empowered to reach out to the IT team without feeling afraid that they might get into trouble or that they would be made fun of.

586
00:39:16,760 --> 00:39:18,700
And it saved their bacon.

587
00:39:19,820 --> 00:39:21,040
And, yeah.

588
00:39:21,340 --> 00:39:28,220
So these are the references, the two blog posts that cover both of the incidents.

589
00:39:29,460 --> 00:39:32,540
At Sophos, we practice radical transparency.

590
00:39:32,540 --> 00:39:37,120
So everything that we possibly can where there's indicators of compromise, we publish those.

591
00:39:37,300 --> 00:39:38,460
Those are on our GitHub.

592
00:39:38,780 --> 00:39:51,320
And then there's the references for those who want to look up some ancient history and learn about the history of the dotless IP and how it was used to break the security zones in Internet Explorer 4.5 and 5.0.

593
00:39:52,300 --> 00:39:54,440
So I'm told there's five minutes left.

594
00:39:54,660 --> 00:39:57,160
And so we have a little bit of time for questions.

595
00:39:57,900 --> 00:39:58,680
Thank you.

596
00:40:08,620 --> 00:40:10,160
Does anybody have questions?

597
00:40:10,960 --> 00:40:11,440
Yes.

598
00:40:11,980 --> 00:40:12,960
Thank you for that.

599
00:40:13,000 --> 00:40:13,660
That was fascinating.

600
00:40:14,580 --> 00:40:20,420
From the start, it looked like spear phishing that second attack because they knew all this information about the person involved and so on.

601
00:40:20,600 --> 00:40:23,160
But the payload looks totally undirected.

602
00:40:23,680 --> 00:40:32,520
Do you think that they're like they've got this just devil purpose malware and then they pick random people and just dox the fuck out of them to deliver this random malware?

603
00:40:32,520 --> 00:40:33,220
Right.

604
00:40:33,380 --> 00:40:34,760
So let me repeat the question.

605
00:40:34,980 --> 00:40:36,200
I will paraphrase.

606
00:40:36,740 --> 00:40:39,040
It looks like a spear phishing attack.

607
00:40:39,700 --> 00:40:43,340
But it also was just very undirected.

608
00:40:43,360 --> 00:40:46,300
Just like they had the kitchen sink that they threw at everybody.

609
00:40:46,580 --> 00:40:51,640
And do they just dox the fuck out of people and then spam it at people until they click it?

610
00:40:52,540 --> 00:40:57,040
Here's the thing that I have not I cannot discuss who the targets are.

611
00:40:57,180 --> 00:41:01,480
But I can tell you that the targets in the case in Australia.

612
00:41:01,480 --> 00:41:10,860
And the case in Switzerland is that they they work in industries that have vital national defense interests.

613
00:41:11,080 --> 00:41:22,640
They were private companies and that they work in the national defense space and that they themselves as a company would have been a pretty legitimate target for espionage.

614
00:41:22,780 --> 00:41:28,700
So while it was it did look like a hot mess of a bucket full of random crap.

615
00:41:28,700 --> 00:41:32,860
I believe that it was actually more directed than it appeared to be.

616
00:41:33,400 --> 00:41:33,920
Yeah.

617
00:41:34,120 --> 00:41:35,080
Any other questions?

618
00:41:35,560 --> 00:41:36,080
Yes.

619
00:41:47,180 --> 00:41:47,700
Okay.

620
00:41:53,740 --> 00:41:54,640
So the question.

621
00:41:54,760 --> 00:41:57,700
So this person is seeing some of these types of obfuscations.

622
00:41:58,480 --> 00:41:58,680
But what are they doing?

623
00:41:58,700 --> 00:41:59,340
What are they looking for in email?

624
00:41:59,920 --> 00:42:01,800
And do we know who the threat actor is?

625
00:42:01,900 --> 00:42:07,820
So in the case of the first incident, we know that it was the malware was called Goo Loader.

626
00:42:08,120 --> 00:42:11,260
And it's a pretty widely distributed malware.

627
00:42:11,460 --> 00:42:19,240
We just had not seen it used distributed in exactly that way with the way the tax accountants received the zip file.

628
00:42:20,600 --> 00:42:22,580
But Sophos doesn't do attribution.

629
00:42:22,700 --> 00:42:23,460
We do defense.

630
00:42:23,780 --> 00:42:27,340
And it's much more important for us as a company to figure out.

631
00:42:27,340 --> 00:42:29,580
Not who the person is that's doing it.

632
00:42:29,640 --> 00:42:31,120
But what they're doing and why.

633
00:42:31,340 --> 00:42:32,760
And try to head it off.

634
00:42:32,920 --> 00:42:40,980
So we have behavioral detections that look for things that are trying to dump out the NTFS key store.

635
00:42:41,320 --> 00:42:44,120
Or looking for things that are poking around in the registry.

636
00:42:44,960 --> 00:42:45,180
Yeah.

637
00:42:45,260 --> 00:42:48,580
But we don't really know who exactly was doing it.

638
00:42:48,660 --> 00:42:51,580
We just know, hey, they're doing some bad stuff.

639
00:42:52,100 --> 00:42:52,240
Yeah.

640
00:42:53,160 --> 00:42:53,860
Anybody else?

641
00:42:55,000 --> 00:42:55,960
How are we doing on time?

642
00:42:55,960 --> 00:42:57,660
Are we good?

643
00:42:58,320 --> 00:42:58,900
All right.

644
00:43:00,440 --> 00:43:00,880
Okay.

645
00:43:01,720 --> 00:43:02,720
Any other questions?

646
00:43:03,100 --> 00:43:03,660
All right.

647
00:43:04,140 --> 00:43:04,580
Yes?

648
00:43:05,800 --> 00:43:06,240
.

649
00:43:13,180 --> 00:43:13,620
Yeah.

650
00:43:13,760 --> 00:43:15,620
So the question is, so it was a little tangential.

651
00:43:15,760 --> 00:43:21,300
But how did they, the company, pursue the investigation on the phone part?

652
00:43:21,480 --> 00:43:25,940
So they, all I know is that after we got the data.

653
00:43:25,940 --> 00:43:28,580
After we issued our report to them and told them what we found.

654
00:43:28,700 --> 00:43:31,620
They reported it to local law enforcement.

655
00:43:31,860 --> 00:43:33,400
And then, you know, they're in Switzerland.

656
00:43:33,640 --> 00:43:36,400
So, like, it was a black box for us.

657
00:43:36,540 --> 00:43:40,640
They don't, law enforcement doesn't come to us and, you know, tell us what they're working on.

658
00:43:40,860 --> 00:43:43,660
So I have no idea what the end result of that was.

659
00:43:43,920 --> 00:43:44,320
Yeah.

660
00:43:44,440 --> 00:43:44,840
Sorry.

661
00:43:45,480 --> 00:43:46,900
It's a little unsatisfying.

662
00:43:46,980 --> 00:43:49,740
I would also like to know who these people are and what they were up to.

663
00:43:50,280 --> 00:43:51,660
They were clearly up to no good.

664
00:43:52,720 --> 00:43:54,200
Was there another question over here?

665
00:43:55,220 --> 00:43:55,640
No?

666
00:43:56,560 --> 00:43:56,980
Maybe?

667
00:43:58,540 --> 00:43:58,960
Yes?

668
00:43:59,160 --> 00:43:59,520
One minute.

669
00:44:00,180 --> 00:44:00,420
Okay.

670
00:44:00,520 --> 00:44:00,960
All right.

671
00:44:00,960 --> 00:44:01,520
We got one minute.

672
00:44:01,900 --> 00:44:06,840
If you have any other questions, if you want to hang out and talk, if you want a CD, come

673
00:44:06,840 --> 00:44:07,520
and meet me outside.

674
00:44:07,820 --> 00:44:10,340
Otherwise, thank you so, so much for coming.

675
00:44:10,500 --> 00:44:11,360
I really appreciate it.