start	end	text
0	6880	So, the next speaker is Vitor Ventura, who's going to be talking about an interesting topic,
6880	12720	which is getting ahead of bad guys, right? We are all good hackers. Here, he's going
12720	19360	to... hmm, interesting. I will not say much. I will let him speak. I'm not going to break
19360	21060	the suspense here.
22680	29980	So, hello everyone. So, I'm Vitor Ventura. I work for Cisco Talos. I'm a Threat Research
30000	34920	Researcher. This presentation was done along with my colleague, Arnaud, who unfortunately
34920	40820	could not be here with me. So, yeah, I will be doing this alone. But if anything goes
40820	43600	wrong, it's his fault, okay? Let's just keep it like that.
45400	50160	So, the objective here is getting ahead of the bad guys. We always, whenever we are doing
50160	54920	our works, trying to defend, we always want to get ahead. We don't want to be reactive,
54920	58900	we want to be proactive. Most of the times, all the data that is scanned on the internet
58900	66380	is like Shodan or Synthesis or whatever is, okay, let me see what that IP has because
66380	70600	it was attacking me. Let me see what's there because it's attacking me or let me see how
70600	73220	my security is from the outside.
73280	79680	So, the idea here is that, okay, that's good, but maybe we can get ahead by using this data
79680	84540	in our favor, by querying the right things to these kind of tools. So, this is what we
84540	89200	want to talk about. So, first of all, the internet is really big, so it's really hard
89200	95120	to pinpoint where the bad guys are unless we have some prior information. So, in order
95120	101880	to get ahead of that, maybe we can do some analysis, we can look into our IOCs, we can
101880	106320	look into leaked data, we can do all sorts of things. But still, the results are not
106320	112160	100% what we really want. We want to know where are the bad guys. And we cannot just
112160	117240	go ahead and just block IP addresses because chances are we'll have a false positive and
117240	123020	we'll end up stopping our business and we'll have a CEO really, really pissed at us. So,
123020	130340	the idea is we need to be almost 100% sure that we can block an IP address ahead of time.
130340	135960	And that's our goal. So, that's one thing. The other thing is if we don't have any business
135960	140480	on Tor sites, for instance, maybe we want to block any Tor exits because we don't want
140480	145540	our communication going from inside to Tor exit because maybe that's a way for the bad
145540	149580	guys to exfiltrate information. Same thing with VPNs. We need to know our business in
149580	154460	order to block it so that when we are doing some of these kind of blocks ahead of time,
154460	161360	we are not getting into any risks that things can go wrong. Same thing with IOCs. We all
161360	166200	see a lot of IOCs, lists, feeds, and all that kind of thing. But no one really blocks an
166200	171040	IP address for a really, really long time. Because if you do, chances are they will rotate,
171040	174720	bad guys move to another site, and then you are blocking something that is legitimate.
174880	178900	Or for instance, if you just go ahead and block IP addresses, just imagine what happens
179520	183360	with sites which are on shared hosts. You block an IP address and all of a sudden you
183360	188780	are blocking 100,000 websites, some of which you might need to access. So, all of these
188780	195920	are problems that we need to solve ahead of time in order to prevent our proactive efforts
195920	202100	from becoming a problem for us. So, that's how we actually see things, and that's how
202100	207500	we can actually move forward. So, first of all, we want to have a behavioral analysis.
207500	211760	We just don't want to go ahead and block things from IOCs. We want to have a behavioral analysis.
212000	219140	And a lot of you, I'm sure, have heard about, for instance, Cobalt Strike. How many of you
219140	226100	have actually installed it? One, two, three... two of you work with me. That's not... you
226100	232200	don't count. So, three. See, a full room of people that want to defend. Everyone knows
232200	237040	about Cobalt Strike, and no one... most of you have never installed it. So, there's a
237040	241060	lot to gain to actually install these tools on your own systems to get knowledge on how
241060	246320	they work. And I'm talking about Cobalt Strike as an example, but of course we can talk about
246320	253560	Sliver, Brutal, all of these C2s that are out there on GitHub or on other repositories.
253560	257820	And even from some APT data that you can actually get the samples, get the implants, get them
257820	263320	to run on your sandboxes, and try to understand what they do. Because often, we get information
263320	268720	about these C2s, we get information about these APT groups, but we don't get what really
268720	274680	can help you to defend ahead of time. And that's what we are looking for. We are trying
274680	278680	to do reconnaissance ahead of time. I don't want to be waiting for anyone to tell me,
278680	283040	this IP address is malicious. If I can get that information for myself, then that's great,
283040	289380	and that's what I want to do. So, we need to understand, install it, try it, see which
289380	293240	kind of certificates there exist, which kind of... what's the behaviors that you can actually
293240	297700	incorporate that into your own infrastructure. Then there's the searches that we were talking
297700	305340	about initially. So, on Shodan, you can search for a lot of stuff. You can search how your
305340	311120	systems are, but more often, you can actually search for indicators of IP addresses that
311120	316220	are serving malicious payloads. And then you can analyze those and block them ahead of
316220	321440	time. I imagine that you can actually go into Shodan and search, tell me all the IPs that
321440	329140	when I do a request to the web port, gives me a Cobalt Strike Beacon. Those I want to
329140	334440	block. If I can get the configuration, if I'm absolutely sure, I want to block those.
334440	339200	There's no reason why my organization should be accessing an IP address that, by default,
339200	343180	when I access port 80, will give me a Cobalt Strike Beacon. And that's a false positive,
343180	349260	almost null. So, there are that kind of searches that you can actually do. This is a different
349260	358460	example for the Mythic 5 Beacon data, but the principle is the same. You want to query
358460	362800	these kind of platforms for stuff that you know that are malicious, and then from there,
362800	368960	you move on to block them. Of course, it's not 100% like that. There are some caveats
368960	373000	to this. In some cases, you need to do a little more work. In other cases, you need to do
373000	380040	less work. Synthesis can also help you with this kind of information. So, if you have
380160	384360	a Yara rule that you can actually search for an IP address, this is a more practical example.
384360	388860	You can actually search for... on Shodan, you can search for words, but you can also
388860	393700	search for byte strings. So, if you search for the mz header, you know that that will
393700	399300	be serving an executable. So, you can actually go there and do that, but Shodan will not
399300	403300	give you the full payload. It will give you... it will truncate the data, so there's not
403300	410940	100% of the data. But, if you have a rule that somehow matches... that can match data
410940	415580	in the amount of bytes that Shodan actually gives you, you have a good way to identify
415580	420380	malicious stuff. So, this is what we did, basically. We have rules that just run on
420380	425480	the first bytes, and with that, we can actually check if it's malicious or not. In this case,
425480	430080	you start by checking if it's an executable. You cannot block all the IP addresses that
430080	434980	are on Shodan delivering executables. There are a lot of good reasons for them to deliver
434980	441200	you an executable. But, because the data is long enough, you can actually get the part
441200	445740	of the data that will tell you if it's a Cobalt Stripe beacon or not, because the configuration
445740	451440	is on the first bytes. So, you can actually do that. So, the idea is, you can look for
451440	457540	the data, have some rules on the beginning of the payload, and identify. Another good
457540	463640	example is that Metapeter Android payloads. This is actually how the whole project started.
463740	469040	So, in this case, we know that this will be an implant for Android. There is no reason
469040	475020	why we should be actually allowing this. So, the idea is, let's go into these kind of platforms,
475020	479420	get all the data, make sure that we don't have any false positives, and then, well,
479420	483260	we just can get creative and search for the stuff. I've just given you a few examples.
483400	487980	You can also search for bus history. There's even some cases, well, I think it's a little
487980	494300	ahead, where we found entire VMs, which had a lot of information, really nice information,
494300	500860	actually. So, we need to just keep in mind, be creative. Don't use that data just for
500860	505800	what you actually, yourself, go ahead of time. But then, you need to automate it. There's
505800	512240	all kinds of results that you can get from this. This is just a huge amount of them.
512240	516480	You just need to figure out what do you think that you might get hit you. Every time you
516480	520520	get something that hits your organization, just try to create some kind of search that
520520	524700	you can go and show that and see if it's giving you back that. And if it is, then you can
524700	530360	actually get the process in automated process that will actually help you to protect ahead
530360	536300	of time, instead of only reactively. So, as for the VM, well, if you search for VM
536300	541240	and Cobalt, you might just get a Gobal Strike VM, fully ready to use, without encryption.
541240	544860	I will not tell you where it is, but, well, you can check out by the kind of language
544860	550040	and all of that. So, just go and it's there. And you have the IP address, you can download
550040	554380	it and you can just actually go and see what they are using, how they are using it, what
554380	557960	they are, all the tools that go along with it, and it will give you a lot of information.
558440	564280	It can get to the point, it can get to way too much information, like the previous speaker
564280	568920	was talking about leaks, well, maybe these guys don't always delete the data from their
568920	573980	victims on these kind of VMs, so they just move them around from system to system, so
573980	580160	maybe you'll get other information there. So, and it's not, it's just a query on show
580160	587780	that, or census, or whatever platform you have of the same kind. So, now that we have
588320	592940	our behavior, we know how it works, we know how to hunt for it on show that, now we need
592940	597420	to actually qualify the results. So, just having the MZ address is not enough, as I
597420	603040	was telling you, you want to get more information. Sometimes it is incomplete, as we talked about,
603040	608720	so we need to actually be able to get it out, be able to analyze it, and kind of start to
608720	616280	build your own database for it. Of course, because we also use a lot of ClamAV, we'll
616280	620460	use ClamAV to actually analyze it, the first byte, you can use ClamAV, it can be Yari,
620460	625320	rules, whatever. Whatever you find, you need to qualify it into something that you are
625320	630600	absolutely sure that you can block. Remember, a lot of this information may lead you to
630600	637000	false positives, and that's what you don't want that. The first, these kind of projects,
637000	642480	they're always really fun, and everyone likes it, until you stop the business. That's when
642480	647780	everything goes away. So, you want to be sure that, give little incremental steps, but sure
647780	652660	steps that you won't be messing with the business. That's kind of a key, you need to earn their
652660	658240	trust for some reason, yeah. So, in this case, what we do is that we download the Cobalt
658240	663420	Stripe beacons, we get the information, we start to process it every day, we scan the
663420	667960	internet every day for the JARM signatures, and we try to collect as much information
667960	674140	as we can about certain IP addresses, and as time goes along, we start to build a profiling,
674140	678460	basically. And we know that some actors will get an IP address, then it will go away when
678460	682300	they get exposed, and sometimes they will go back into the same IP address because they
682300	688600	have that little set of hosting providers that they like. So, we start to get a good
688600	694400	idea of how, what's the likelihood of that IP address becoming bad over time, and then
694400	700600	good and then bad. So, it's our process of automation, it's just query, okay, query the
700600	705520	results, query what we know about it, filter the results, and go back to the active scan.
705560	710280	Remember that Sheldon will not give you everything, so in some cases, you might need to have your
710280	714680	own scanning process to get it. So, you get an IP address that probably is malicious,
714680	717960	but there's not, the full date is not there, so you might do your own scanning to that
717960	722480	IP address to make sure that it's actually malicious before you want to block it. It's
722480	728520	just a question of, okay, trust but verify. Because again, we don't want any false positives.
729960	739200	And again, store everything. A lot of what we get, of course, it's open out there, but
739200	744020	we need to establish a profile. You need to keep, in order to avoid false positives, you
744020	748300	need to keep a profile of what's going on. On that IP address, there will be times that
748300	751900	we'll have IP addresses with a C2, but there will be times that that IP address, before
751900	756060	it has a C2, it has an open D where you can get information from it. So, you start to
756060	760440	build a profile of what's going on, and more confidence you'll have that when you block
760440	764540	it, instead of blocking it for just one day and every day verify it, maybe start blocking
764540	770400	two days and verify every three days, you kind of get that confidence, because you don't
770400	775660	have the limited resources. You won't be able to scan all of these IP addresses every
775660	779300	day. Unless you have a lot of money, in that case that doesn't really matter, but most
779300	785300	companies don't. So, you need to start to actually build a confidence level on your
785300	789360	analysis so that over time, instead of scanning the same IP every day, you'll scan it every
789360	794260	two days or every three days, and then you go back. And for that, you need to have more
794260	797500	information. You need to keep and store all the information you can.
798760	802340	So, for us, we have a little database that will allow us to give you context, to know
802340	807960	what it was, when it was, where the information came from. It's not really complex, we try
807960	813080	to keep it as simple as we can, but it's important for us to have a context. So, we know that
813080	817700	over this period of time, this IP address has had this kind of information, it came
817700	822400	from these sources. And this allows us to build a confidence level for what we are doing.
824120	828240	So, and then, of course, you need to share it. You are doing this for yourselves. I'm
828240	832480	not saying you should share it outside your company, but you definitely should and must
832480	837120	share it within your company, because that's where the value of what you are doing actually
837120	842580	reflects. So, you are scanning this, and you need to block it. Maybe you don't, you cannot
842580	846720	block it yourself, you need to share it with whoever takes care of the firewalls or the
846720	855080	rules or whatever. But also, you might want to share this with your instant response guys.
855340	860040	So, there are some cases where, for instance, you don't know what it was, you have an incident
860040	864960	and you want to know what's this IP address, and you don't know it. But if you go back
864960	869960	to this information, you might know that today I don't know what this IP address has, but
869960	877320	well, a few months ago, it had a C2 for Cobalt Strike. So, you can actually go back and see
877320	881940	that, and you cannot trust 100% all of the scanners, but you know what you have because
881940	887420	you have your own information. So, sharing this with anyone in your organization is important,
888140	892260	because it helps the instant response, it helps researchers, it will help a lot of people.
892780	898160	Not often you share this outside of your organization, because some of these might be more important
898160	901500	to you, it might tell you something about your business, so there is some equilibrium
901500	905880	here, and also because most of this is already in Shodan, but internally, it's really important
905880	909300	for you to share with all of your organization what you know about these IP addresses.
909300	914580	And remember, this is ahead of time. All of that we are doing, it's ahead of time, but
914580	919180	when something happens, well, if you didn't block it, but you have information about it
919180	925100	because you detected it earlier, then that's helpful. And you may reduce and you may contain
925100	931320	an incident much faster. So, and then, well, we go back to the same thing, which is, okay,
931320	937280	let's keep going, let's keep helping, let's keep an eye on it, let's have a circle, it
937280	941060	doesn't stop once, it's something that it keeps repeating. It's interesting that while
941060	945520	we were doing this, we actually noticed that at some point, Cobalt Stripe just went down
945520	950260	in the number of C2s that were online, and at the same time, the sliver just went up.
950260	954000	For some reason, at that point in time, something happened, and we'll see this. For instance,
954000	958280	you'll see that some C2s will actually have more popularity at some point in time because
958400	962620	a new version was released, because something was leaked, because there was some licenses
962620	967820	that were leaked, and you'll see kind of changes in the way that this behaves. But again, this
967820	973220	will tell you, of course, this is historical data, but it will also give you a trend. If
973320	977700	a new version of Cobalt Stripe is coming out, well, you might know that you might have more
977700	982360	stuff about Cobalt Stripe. And this allows you to plan ahead, well, as much as you can,
982360	985840	of course, but it will allow you a little bit of planning ahead instead of just being
985840	995080	reactive. So, in terms of improving, and I did my talk really fast, well, in terms of
995080	998900	improving, it's keeping track of what you're doing, trying to narrow the gaps. There are
999060	1002160	a lot... so, these are the examples that I gave you are just a couple of examples that
1002160	1006240	you come across with, but there are a lot of stuff that you can actually do. So, show
1006240	1013400	them, census and all that. It's not just about reaction. They are scanning the internet.
1013400	1017940	The bad guys, they will have a lot of stuff out there exposed, especially if they don't
1017940	1025940	do any kind of geofencing, if they are not concerned about the geography of their victims.
1025940	1030520	So there will be a lot of data there that will help you to protect ahead of time. Just
1030640	1034880	a question of being creative. Every time you have an incident, try to figure out if you
1034880	1040020	could have detected that ahead of time based on the information that was actually shared
1040020	1044400	available to you and what's on the scanning data. And every time that happens, you can
1044400	1049280	probably improve your process and make it so that you can be alerted ahead of time.
1049280	1053620	Not always. It's about blocking. It might just be about making a rule about having an
1053620	1059320	alert or having some alerts which are not prone to false positives. We always have a
1059320	1065940	lot of alerts in our telemetry and we don't have the resources to reach to them all.
1065960	1070640	So having this kind of information that allows you to define what is a high priority alert
1070640	1074380	because I have more information that allows me to figure out that this is actually a bad
1074380	1079200	thing, I can dedicate the resources to this bad thing instead of going just by the queue
1079200	1084420	one by one, increasing the priority. So it's all about getting ahead of time with the information
1084420	1088520	that is out there, putting it into your own environment and then use it the best way
1088520	1095580	you can. And I always talk too fast. Sorry about that. I'm available for any questions
1095580	1111970	if you have them. No questions? Okay.
1125620	1134180	So we usually prioritize all kinds of C2s. Frameworks, basically. So all of those which
1134180	1139140	are the ones that will give you the next step. And those are the ones that have more
1139140	1145480	prevalence being exposed. So that maximizes our results. Those are our initial priorities.
1145480	1152280	And then we have other stuff that we do which is not as prioritized like looking for ports
1152280	1157340	that are exposing weird stuff like bash scripts or that kind of stuff. But the priority always
1157340	1161640	goes to the frameworks because that will give us a better... they are more exposed for a
1161640	1165620	longer time, the IP address are predictable, there's a lot more into it. Stuff like the
1165620	1169560	executables are also one of the priorities because if they are on that code, it gives
1169560	1174740	you immediate results also. Okay. Okay, thank you.