My name is Edd Black. I've been doing institutional defense and wonder for
companies throughout the Midwest for over ten years at this point. I'm on Twitter, I also blog when my workplace
allows me to do so. This talk was born out of frustration of dealing with offenders. What
we'll talk about is skilled persistent threat. Everybody's heard of
an APT. And then every heard of a script read. As if there's nothing in
between that you need to worry about to defend efforts. Oh, we are going to
clarify that over the course of this talk. So why? There's a classic idea that we fear
what we don't understand. And left to devices especially in securities we're
dealing with leadership and governance anybody else involved that fear will run
rampant. Now a lot of this is we have adversaries that always come up when you
talk to a vendor, that you have, you know from the matrix that it's going to be hacker that
we're from anywhere on planet earth, steal all of your data and if you don't
have our product, there's absolutely nothing you can do about it because he
will always be better than you. At some point, even the adversary has to start at
the beginning with no skill-set. That skill-set does not just suddenly turn on one
day like their a sleeper agent who's been activated.
It grows over time. And as adversaries will tend to continue to go after the
same targets as persistent, you can track the information gained through
laws from their attacks against or infrastructure, to then build their life
cycle and see their learning curve and when they have figured out, what
different processes to increase their capabilities and tool sets. And
understandably, this empowers the defender.
They don't, at one point we've all heard the bad guy who only has to be right once to
get in your network. Well the goal is to make sure they have to be right a lot of
times once so they get their foot in the door. Plus I've said
there's more than script kiddies on the one side who graduate into APTs.
There's this concept that if you're dealing with the Chinese, if you're
dealing with the Russians, any other nation state, any other major APT group
like you fin-seven or somebody that, their people suddenly one day wake
up and they're jacked into the matrix and they can do all this. Almost as if
there's some modern-day Leavenworth program for China and Russia to breed
out genius hackers out of a pot and then they're coming after you.
Truth is, it's more like a Pokemon evolution. You learn, you build your skill
sets, make mistakes, build your skill sets, make mistakes,
rinse, repeat. It's a slow evolution. This is true for us we learn to become better
defenders, this is equally true for any adversary you will face. So as I said,
there's this belief, you have your pot born people straight out the matrix.
Russia the matrix. China and they're ready to go
the moment they sit down at keyboard. Once again, growth in stages.
So we're going to have a case study to help understand this growth in stages. Now due
to the magic world of MBAs that you deal with in information security
specialist defender. There's going to be a good deal of this that is redacted. So
we're going to talk long terms without getting into specific indicators. Because
it was the only way I was allowed to do this talk. So in this situation, I
haven't run out of the school of God help me, hopefully not before any of you were
born. Who's working for his only Western
College as his assistant. Now, he had an issue where there was a brand new impersonation
that went after the college but in a weird way that the college was more a
byproduct like the HVAC company that led them to the
target, but without the network actually being breached. It was branded
impersonation that was being used to profit off of the alleged connection of
his fake identity to that brand. Now one of the things we
learned is, colleges docking used, or at least the reputable ones. Most of them do not
register that dot com address. Adversaries are very willing to do that. Now in this
situation the adversary registered a domain with a similar name added dot com to
the university, claiming to be a project spun off from the MBA school that does
business in a very specific region. The goal was if you are in a country that is
not aligned with the US, and not necessarily Russia or Iran, but somebody
who's just not considered an ally. It might be difficult for you to do
business in the United States but this business working with this Midwestern
MBA school will have they help you set up a business entity in start doing work
in the United States for the classic nominal fee so my buddy called me in is
that we have this issue and we're digging around we haven't found anything
he didn't look at us so you do a basic look because they have
a Sonny because they were going to fight that they turn somebody did business
with this site it didn't work out so they call the college to find out where
their money this is how they discovered the site now like a good adversary who
is purely privacy guard and so there's no information available it's a common
European host for anybody because the defense you've probably heard of the AG
print and if you really dig into this kind of a person Asian of those letters
money you know 1% closer to his children there was no identifying information you
can pull at this point and the way they were spinning their IDs through this
hosting site they would run it up on a different IP almost like theirs
using DHCP and then they were pulling information directly from the college
site pictures text graphics and just Auto loading it into whatever fate is in
sight they were putting up now if you've heard of got Twitter I have a series of
Maxim's I then you plug the information security in life number one with the
bullet is deeper your adversary every opportunity to make a mistake once again
we're not perfect we have stumbles in our growth and our
learning and I'm a long enough timeline everybody will make a mistake it turns
out this happens here did like my corner - the bigger mistakes is is the idea of
a baseball's perfect game they're only been 14 15 of them in history Randy
Johnson threw a perfect game which means you threw 678 programs so the stakes are
out there and they're more common than professional so I was having a
discussion with my friends we turned up nothing
there's not much we can find here to do something about this and he said imagine
the phrase he says this god this is just like last time they did it again again
tell me about again what happened the first time
well a few years ago this exact same thing happened
plus the money there were some problems they went dark the difference was the
domain name was one letter different all right let's go take a look at that old
domain name now we can see you know using like web archive work because you
catch things is ultimately the design of it and the text and it was basically the
carbon copy what they were doing down and then we went use passive DNS to look
at the Whois data you have privacy privacy privacy one day where we have a
fool who is listing privacy privacy privacy privacy and as you track it down
at one point the atmosphere is switched hosting providers got a better deal was
checked out of we're used to be you who knows when he made that switch in the
process of big events which that little check box that says TV private wasn't
right so your registers that your who donated its everything so and then just
email realizes wait I'm not I'm not private I need to hide this information
so then they went back in and immediately on the same day made that
change probably soon as they registered it registered in and had everything
going dark now with that change there was one moment
when everything was visible we have your standard list phone number we have an
email address we have a street address so using that committee to vote or Ghosn
we find tied to that street address for the other websites it show but email got
us 12 more websites phone number got 12 more websites so one little hiccup and
now the pictures start bell tonight now this is the point where we get to start
building a timer we have a fixed point where we have data at that point you can
track are many different ways the tool that I find most useful had loath beyond
belief I'm sure go on access to its all its tell if you've done any kind of
hunting forensics threat intelligence diagram any work you will use this tool
a lot and hopefully you do so without getting really really angry so what we
can do here is we can charter on any of these different sheets based on where do
we see their email address where do we see any of these street address data and
more importantly as we get different points along those lines we can build a
master timer so they're going to see what somebody does when now the concept
of TCP says you're not familiar with its tactics techniques and procedures it is
at the top of the indicator chain let's the idea that
zebras have stripes she does have spots they cannot change these it's similar to
when you making scrambled eggs in the morning
you're making the same way every time it's how you learn your boat you're
still set and you continue from there so if yours are cute little InfoSec craft
we'll talk about or if the evolution of our atmosphere so if we took the data
and go from when they are at their best and work backward what we first saw it
is yes they learn to just make sure privacy Gardens to be able under who has
at all times then fact wouldn't go farther and we get
before practice er we see that they were using different email addresses to run
the scams against a bunch of different zones primarily English reason selves
reaching out to people who are not friendly to those different countries so
you see different email addresses registered before doing business in the
different regions you start seeing the website that they're usually over and
over and over over time they started updating but then you go far enough back
in the timeline since you've all just spent over brand-new or just I can just
use the throwaway infrastructure this gives us another data link that
correlates inside so we can see the lips or the web server version correlate that
at the time and it's another two identity a trust but verify stability is
going in the right direction now eventually they figured out we want to
be out of bullet through post in one of those countries where we know they're
not going to kick us off the service anymore no farther back you look at the
phone number the first phone number that popped up
was a Google Voice number you'll farther back you see an original Google Voice
number that had an area code that was tightly the address that had been
constant through all these registrations now you go farther back you have a home
phone number that it's not the Google Voice number that also lines up to the
original address that we used to pin to get all of the data and eventually you
get to a point where they realize these you only
one of these Bhutanese purser that is if something gets caught they really burned
one part of their operation now bill timeline we reached something that is a
bit of a unicorn in the information security space we found the original
Legend this web server was it really bad national to see the birth of coding or
HTML learning CSS and God help them it still had the default condense the sent
so take a look inside you can see all the lovely from their logs which god
bless when they turned out of their own laws if you take a look at where all the
logins painful and the oklahoma jority lucky guess and then all of the bottoms
was geo-located to an IP address that lined up with the original phone number
that lined up with the street address so as we say in information security
especially threat intelligence with high confidence and we know who the
adversaries like we can put a name based on the registration of public records to
death street address that we found the god and what was nice as we went did a
google like a Google Earth Google Maps search everyone popped up it showed us
an empty field but as we walked down the street and followed it the one that you
directly to go he figured out that who are the deserving for that didn't line
it up with geographic coordinates so eventually we found a small little
building that had three trailers just outside in the middle of nowhere and he
had a nice little address rocket that had before digits the address on it one
of the buildings had a satellite dish on top and which would cabling run again
when he buried underground and you spun the camera on that Google Earth it
across the street in front of the other other side of robos empty field somebody
had put in a brand new cable box so that they could have fiber fiber : to the
home
all right you got through this early yeah Bart I've come up the basic
takeaways our adversaries level up just like we there's no there is no they
start and they're super it's a little bit they learn they make mistakes those
mistakes can be trapped be patient be diligent there's always more to
influence defiant which means there's always more of a
difference to pivot on and then if you're a defender one of the other
takeaways that comes away from this is it's not always about getting your email
it's not always about getting your servers sometimes the brand of your
institution can have a value in and of itself and sometimes you need to look
externally to make sure you know who's trying to use that brand all right
this was a relatively quick presentation for everybody if you have questions I'm
happy to take questions yes they're good question don't summon a matteri even
they get good they get lazy because if something works why fix it a good
example of that is the Royals if you follow anything apt 28 and 29 have done
there was a big discovery that they talked about if thought count I want to
say two years ago so if across where I came down to give
his talk on they were brought in to do the forensics on the DNS servers and
they have found all this information work you have to brush concedes it
independently guide under the servers didn't build the other team was there
and it started making a lot of noise thinking the other team was necessary
responders and trying to knock them out but then as time is going on like you
look at that the scruple case coming out of London and any of the other actions
by the when has now become one of their chichi
pieces they don't care if they get caught because when they get caught
nobody doesn't so there's there's a certain degree of built-in laziness
depending on the atmosphere or the atmosphere that makes assumptions that
the defender isn't working or they haven't found this by this point so
they're not gonna find us at all and that's where the trade crack can get
laid I brung back another good example was with Assange in the newspaper today
- super - who was leaking all of this information and they finally proved it
was Russian because it was knocking out all this information they could
plausibly deny him a direction by saying he's like me from Romania and then one
day he logged in most a bunch of stuff to Twitter without turning on the view
p.m. and the attritional dependent so this laziness does have like don't mean
Iran ever exactly firing the apt wonderful is the same thing when they
post the report they've been a big deal having a guy out in front of like that
the PLA there are we building in Shanghai
so much it is well protected and as far as your goes the Netherlands is one of
the bigger data center areas in Europe West has a region there in the days
before Uwe was really that big I had worked for a couple other companies who
had European data centers based their partner being where they are was easier
to keep everything cool so it is just a and that's the attention people spin up
data centers and suddenly he's a place to buy cheap servers and then especially
if you're not with something like AWS that we secure our borders they can send
in a new community because the sheer volume of people doing bad things means
it's a lot of time before where runs the actual server farm clean things up
perfectly go for it some drinking it if you
haven't been to the same constant may or may not be a password of course you know
but you know in our sector kind of I'm not familiar with that if you don't know
the password you get to do a funny little dance that is honest ended little
entryway that is on screen that you're putting in the markets to look at like
that so everybody who goes in at least once
just a little dance now although the entrance is down an alleyway
yeah oh god blessing we I think we were there two years you go to three years
ago I'm looking forward to it because there's a speaker bag I get to come back
for my dance but do you normally don't have one there
I do have to know there's a special password to report from a politically I
can't remember where it is well more Casper's cost offering but he's paying
attention this is my way of being nice to all of you for coming to the talk so
thank you very much for stopping by if you have any more questions I want to
reach out about anything I'm on Twitter I'm somewhat active more active than my
blog because it doesn't require that sit down there's nothing else for an
hour thank you
you