[Music]
hello thank you thank you for being here
for being here um I have given like more
than 40 talks in in my researcher career
and this is the first one that I live so
late at night I feel like I'm more ready
for drinks than for giving a talk so
let's see what how it goes but thank you
for being here and instead of like
drinking already um I feel more
important than
alcohol so what I want wanted to discuss
uh today is uh the extent of the
sophistication behind RDP uh
attacks uh so like kind of we'll discuss
kind of the hackers Playbook okay and
how the human is implicated but also
like yeah the extent of this
sophistication and we can
argue for a very long time about what
means sophistication but you'll
understand what I mean in this talk and
then we can discuss it all night after
that okay so uh the remote desktop
protocol just to make sure everyone is
following it allows the users to connect
to computer
remotely uh and the pandemic I will not
surprise anybody here but the pandemic
radically increased amount of people
using RDP services to work from home uh
so uh so it made it has made RDP one of
the favorite point of entry for criminal
hacker looking for breaking into an
organization
network uh so the attack over the
Internet do not do not necessarily need
uh very expensive tools and this tool
can be like U Shar between the
attackers but uh you know already that
they they can have very devastating
consequences those attacks uh so the
point that I wanted to raise in this uh
in this presentation is that when a
human or an organization is a bit more
implicated in an automated attack a bit
more motivated it can increase radically
the the level of of dangeros is it a
word in English no the the level of
danger sorry
um and and it becomes like we we are
staying away from the kind of
opportunistic spring and praying attack
and we are going through a more targeted
attack so it's more
dangerous uh uh so the objective of this
study was very to measure the level of
Engagement of the human behind the
automated attack so uh right before
jumping in I will take a second to
introduce myself so uh how did I
end up here I'm sorry I study psychology
I studied criminology I did my I got my
PhD from Montreal University um but I
was
always uh uh looking at attackers
Behavior this is my principal uh subject
of
research and then I I got HED uh by go
secure which is a cyber security company
who uh gives uh product and services uh
to to uh cyber security product and
services to to other companies
uh but they also have this independent
laboratory where I work okay so it's not
R&D it's really research and I'm the
researcher I I'm responsible for
conducting all the research and and
choosing what we are looking at and and
presenting the result and educating and
you
know uh getting the information out
there uh and I'm also implicated in the
in the infosec community uh in the
organization of nsec which happened in
Montreal you are all cordially invited
to uh to this uh to this conference in
May and I'm also the scientific director
of open an open source research group of
Montreal University uh so yeah when I
was doing my PhD I was working with the
special unit uh of child exploitation
material uh with the Provincial Police
in
Canada and um of course there was this
aspect of like how people get uh access
to this illegal material through P2P or
uh or the dark web and everything so
there there was this like technical part
of of of the psychology behind it um but
also I was always interested in policing
right and you may have noticed the web
police is not very efficient right now
right there like the web police in my
point of view is is you it's us because
we are investigating the web and we are
pro trying to protect people so
like I'm not so far away from my
criminology study in my point of view Al
so uh we might have like very different
objective uh according to our different
roles in cyber security but we all work
in the same direction which is like
protecting people as much as we
can um so the objective of my whole
research program is always to understand
the attackers strategies in order to
hopefully develop preventing uh tool and
uh like
thinking together of what we can do to
uh to reduce the attacks and and protect
people and and of course kind of
investigating uh as much as possible to
to get as close as uh as possible to the
an the animize attackers and all this is
done of course to to increase their cost
and because if they have to change their
way of doing things it's increasing like
their time it's more time consuming for
them it's more like problematic for them
and this is one one of the sub objective
of all this
research so we'll look at the remote
desktop protocol very quickly um uh we
have unipod I'll take I'll talk a bit
about about our unipod and then the data
set that I use to specifically look at
indicator of human intervention versus
more machine like Behavior I'll explain
all to this in some minutes and then the
results um yeah so of course behind
every attack there is a human I'm I'm
conscious of that and and because we are
talking about cyber crime there's also a
machine implicated at some point so we
know that already but then like the
human can be the human intervention in
those attack can be seen on a Continuum
of like this is a simple script versus I
really thought out about my attack and
and and and my Victim and and so this is
a Continuum of of danger basically
so uh the remote desktop protocol is a
mro Microsoft protocol allowing user to
access a graphical interface of remote
computers uh and as I said uh with the
shift of of remote work companies have
relied on remote access tool to manage
corporate devices to keep operation
running during the pandemic um so there
is there are uh some less security aware
uh organization that get their RDP
exposed to the internet okay so
basically usually you'll have a VPN in
front of your RDP uh but some companies
do not have that unfortunately even if
we keep telling it telling them to do so
um and the cyber security and
infrastructure Security Agency reported
an increase of
127% of RDP endpoint exposed to the
internet since 2021 okay it's it's huge
it's a lot of uh of uh of exposed and
RDP end point uh so it led to a dramatic
spike in in successful server side
attack and contributed to the RDP
becoming one of the most attack Vector
used by cyber criminal and more
specifically for ransomware groups um so
so you understand the urgency in
understanding attackers uh behavior and
and proposing solution to uh to improve
protection and attack
prevention um so to study all this to
study credential attack to study RDP
attack we operate eye interaction on on
the internet okay so onot is like the
real definition just to make sure uh
everyone knows what I'm talking about
it's a a computer security mechanism set
to detect deflect or in some manner
counteract attempt at unauthorized use
of information system so the purpose the
purpose purpose I cannot say this word
sorry the
purpose anyway you know what okay you
know what word I'm trying to say the
objective of using a Honeypot
environment may vary but we are
concerned with research hyot of course
uh so they are isolated from from a
system and then collect information
about attacker's behavior and all their
information so our specific onot consist
in open source RDP interception uh tool
that we called PDP uh and it's in front
of a uh window server
environment uh and since uh November
2021 p supports the capture of net NM
nlm ashes uh of all connection attempts
so not only those who were able to
compromise the system but also everyone
who tries to do it so uh uh
today I'm talking about those attempt to
log to the to the system so the tool
collected more than three million
credential in
2022 uh and so uh right before I show
you briy what PDP does I just wanted to
present to you the the genius behind it
uh Olivier is an engineer and he's the
director of research at at go secure he
has been working on on PDP for like the
past seven year or something like that
so he worked really hard and uh the tool
um have been introduced officially in
2018 and it's very well maintained okay
and it is open source and you can use it
and um so yeah I just wanted to make a
small parenthesis on PDP because it's a
very powerful tool
um so basically it's a monster in the
middle that makes RDP uh interception
and it saves everything okay so we have
like a video of what people do when uh
once they get
in uh so I can I can see in you can see
it in real time even the the the
Takeover by the attacker you can see it
in real time or you can of course course
watch it l later because we we save
everything uh but I see everything I see
what they type on their keyboard I see
where they click I see uh when they
enter their credential for for their
telegram account or Gmail account I see
everything and that that's very fun to
watch uh so and there is no way for the
attacker to know that it is a nonot
since it is in front of a real window
server so he can does everything you
want and we can of course scrap the
session so we stop doing the bad stuff
um so this is a very powerful tool and
as I said you can use it it's open
source um so however for today the the
the part to which uh we were interested
in the present research was uh was
really like the the before the comprom
mission so the logging attempts and and
of course it will be a pleasure to come
back another year to show you the videos
the actual videos of what they do once
once they compromise the the service the
the
system uh so how do they compromise our
RDP system it's not like vulnerabilities
or back doors or anything it's simply a
Brute Force attack uh so they basically
try the most username and passwords as
they
can uh you know to try to to to enter
that's as simple as that uh so usually
many attempts per second like they are
they are at work they're really trying
to get in so I took for this uh this
this project a subset of three months uh
from July to September U and the
information that are collected is the
time stamp like the pinpoint in time
where the attack happened um the IP
address and the credential the TR so the
username and the password that the
attacker try at that time H and it's I
I'm very excited to present you how far
we can go into understanding their
behavior just from those three
information you'll see um and and so at
uh in the end in this subset of three
months we had like three more than 3.5
uh million attack and and it came from
uh more than well 10
15,29 uh different IP address and I will
refer to those to those IP address as
the
attackers uh so to start I'll show you
just a bit of uh the descriptive
analysis of the sample it's always
interesting to know uh to know to know
where they come from from what they try
as as
credential uh so already we can see with
this map that the attack come from all
over the world and in more uh it's more
intense from from Russia and and
Europe um so of course like IP addresses
are are allocated geographically but we
know I will not uh it's not surprising
to you uh that they can use like proxies
and compromise comp computer so it might
not be like the real origin of the
attacker uh but still like using proxies
that are geographically closer to you is
most likely more efficient very often uh
so so it gives a a very interesting
evidences uh so here's is the list of
logging attemps by
continent uh I have classified Russia in
to Asia because it depends from
researcher to researcher sometime we
classify it in in Europe but because
their behavior was very similar to what
China was doing I classified them with
with Asia so we see Asia Europe and
North America is the is where it
principally where it come from and here
we have the more precise
distribution uh the top 10 country uh in
in the database so most Atta come from
Russia Panama and China but I should say
Hong Kong more precisely because like
for those who can see the very small
little blue bar in in in top of the the
China column uh you see like the red is
from Hong Kong and then the the
everywhere else in in China is the very
small blue line okay so mostly from Hong
Kong here we have the 12 most triy
username on our onot so we understand
that there is more than 700,000
different username in the data set but
here are the top 12 um an account with
the username administrator is set up by
default on on Windows we know that uh
it's not surprising then that the user
the the username administrator is by far
the most popular uh among
attackers uh it's like all the the
variation of the word administrator is
like 60% of the of the data
set using the username and um so admin
administrator is very present but then I
wanted to draw your attention on like
two or three things here first we have
our uh certificate name okay which is
offshore bang.com this is what we name
our RDP system okay uh so and it's there
so they know what our RDP certificate
name is and the other one is the is the
O name the EC ec2 amas is is our host
name so they kind of got this
information and then used it and
leverage it to uh to insert in their
username so that's clever um most of of
previous research said that like the the
username and the credential that were
used in in those kind in those type of
attack were very basic were like leak
from that were already available on
internet uh but what we have as a result
here is that it's not really the case
they use information our information uh
to try to uh to Target more the
victim and another thing is wup time.com
which is very weird I thought maybe you
all know already what is what of I
didn't I was like what's that it's not
it's not a normal username to to use uh
so what of time is a template that
people can download uh can can use to
download or to install Microsoft uh
Windows operating system on digital
ocean droplet okay uh so and so they
they assumed that we were using digital
ocean droplet and they were they were
very uh right on this point so
um we yeah so when we like when when the
system was installed We Begin by putting
like the IDP and the
PDP uh system on Linux because obviously
right like we we want to work with with
Linux and then we uh we realized that we
would not be able to put the Windows
server in on digital ocean so we were
already with digital ocean and then we
didn't know about what time.com uh so we
took like another uh server and we went
on a Amazon server a us uh to put the
the the Windows system you know so
there's like two part uh and it works
very well but we didn't know about what
of time frame me maybe uh one day we
will just do it do the thing do the
thing differently but yeah this is how
it's so they they saw that we were that
we were on a digital ocean and then they
just assumed that we might be using this
Tool uh to so it's another evidence that
they use the information against
us um and now the the password because I
was talking about the usernames that
they they were trying now the password
um so there's three
three more important observation that we
the quick observation that we can uh we
can take is well they they try a lot of
variation of the RDP certificate uh they
try the many variation of the word
password and then they use Simple chain
of number uh like 10 or less number here
so we always say like for like since the
90 we say to people that their password
have to be like strong not being like so
simple chain of character not being a
variation of the word password and not
using personal information we count the
RDP certificate as a personal
information here um but this is what we
are are telling people like since
forever but it's still very important
because this is how the attacker proceed
right
um anyway and some observation very
quickly that uh that I thought were were
interesting so when a user name are
analyze in relation with the country of
origin of the attack we can identify
like specialized
strategies uh by each country so here
are some strong example uh when we
expose like the well the the RDP
certificate name that I I I showed you
was was a strategy that was used by
Russia and uh and China
like uh exclusively okay so this
strategy came from there uh so it's
that's interesting and and username ADM
which is obviously a diive dimentive of
of administrator was used exclusively by
Nicaragua and Panama I don't know what
trend there is there that they use this
but I mean it's interesting um there was
also 15% of attackers uh who tried
thousand of different password but with
the five the same five usernames so they
are very confident in those five
username which could be a good strategy
I mean there's also 21% of attacks in 1%
of attack attackers use the same
username as they use for the password so
administrator administrator you know
it's another strategy but assuming that
the user is like very uh
lazy in 41% of attack attacker use the
combination uh the same combination of
username password more than once as if
it would work a second time I don't know
what they have in mind but this is like
this um drove us to to to make some
hypothesis about this that maybe they
are there are teams okay teams not very
well organized but teams of people who
are just trying like they have shift and
then and this is something that is
documented documented documented sorry
uh actually like in China they have like
those offices uh with people with shift
day shift and night shift that are
trying to compromise uh um systems so
this might be something like that and
they just like do not check what list of
credential was already used by by one of
one of them of their colleague and just
do the same I don't know this is this is
my hypothesis on that but I'm still
looking at at this uh yeah so I'm done
with the descriptive analysis let's dive
real quick into our the research
question so as I said I perceive the
attacker to be on a Continuum of human
engagement uh so yes you can
Just Launch a script and it will do what
you intend to do but you also can just
think more about your attack and and
make it more targeted um so there's
evidence pointing toward the use of
automation but there's also evidence
pointing toward the use of human
intervention and this idea come from I
want to bring you in my head with like
I'm super excited with all my data but
I'm like now telling it out loud just to
make sure it makes sense but this is a
very beautiful calendar okay to just to
to look at the patterns of the attack
okay so so you have uh on the on the
left you have all days of of a month and
then uh at the bottom you have like all
the the hours of the day okay so this is
one month for one IP address and you can
see that there is kind of blocks of
attack of attacks and we can imagine
that of because there's so much attack
per second so we can imagine that uh a
list of credential was was launched at
that point at the beginning at the
beginning of the of the block but then
it stops and it does not start again
until a certain time so what happens
during this time maybe the person is not
in front of the computer and a human
intervention is necessary to just like
start the other just notice that the
attack didn't work and then start
another set of credential this is what I
was imagining so um so yeah I'll
continue with the with the indicator uh
so I I'll start with the indicator of
machine like Behavior so the number of
attack uh of course like there's no
human that will do a 100,000 attack in a
month like this is just impossible so uh
so I consider that this is more machine
like Behavior Uh if the password are all
present in the list of uh you know rocku
2021 like this B Big L list of uh of
leaks uh like there's 1.4 8.4 billion
credential in this list so there's a lot
of password in this uh so if all the
password come from this list well you
know it was not very thought out or very
sophisticated so I considered it as more
automated um the constant presence of
the attacker over the observation period
so if they attack us for like three
months in a row of course there's no
human with this time or like motivation
so I consider it like to be more
automated and finally if there's more
several attacks per second even if
you're really good at typing I mean it's
just impossible to uh to enter this set
of credential so this is what is uh
associated with uh machine like Behavior
or we can say like less sophisticated
attacks and then there's the indictive
of humanlike behavior so the start of
the block uh that I was showing you on
the calendar analysis so when there is a
a a block that is started that following
like a very long pause this is
considered as like a human intervention
and then uh when the attack this is
customized to its Target I just I
consider it like more T out uh strategy
and then when there is a delay between
each logging attempt of course you need
to automate this attack for for inst
storring this delay between each uh but
it is for well I I suppose uh to avoid
detection right uh so to to try to
imitate a human behavior uh this way so
I considered it as a bit more
sophisticated so
humanlike so if I give a point for each
of those
uh characteristic or criteria and then I
subtract a point for each of those
criteria we get an engagement score okay
or a sophistication score and uh the the
middle of this graph is not zero is like
after zero because because of the points
uh so we can see that it is a bit more
on The Human Side than on the machine
side so the attacks were more tout out
and were more sophisticated that what we
anticipated and what I thought after
just reading all the all that research
that was that was done on on RDP um so I
was kind of surprised I was not
expecting those kind of result I was
expecting like very very automated basic
not sophisticated attacks so that was uh
really interesting um and now what that
what do we learn from from this it's of
course not exposing RDP without a VPN
like very basic mitigation here uh the
lockout policy would help so much like
the new lockout policy on Windows 11 uh
it's very good like after 10 time you're
just block for 10 minutes uh so it it
makes the the the attack very less
efficient so that's very good and then I
keep telling people that username and
password are important I don't know how
we can do that better uh but but also
that like we talk a lot about password
but the username also is very important
because you need two factor to get in
right so the username is as important as
the password even if it is not ashed or
something um so the next step very
quickly because I'm uh running out of
time uh observe the general Trend in the
attack in with the the calendar type of
of analysis uh we will be looking at the
tool they they use to customize attack
because they might be using tools that
already exist so let's see if uh if we
can grab those those tool and see what
they're doing uh investigate the list of
credential they use um investigate the
the share uh origin of the proxies and
analyze the videoos the actual video
when I'll come back to talk about this
next year um and just before finishing
uh I I have this other research that I'm
conducting right now on the on so we are
releasing AG 20 month a report on the
perception of people about their cyber
security uh versus the reality with our
pentesting result so it allowed to
identify the witness part of cyber
security and propose action to counter
it so uh this project is in
collaboration with the human Centric
partnership the Canadian Human Centric
partnership so if you want to uh fill
the survey for me it will help me so
much it's like Max 10 minutes of your
time okay so um I would be very uh very
glad so do I have time for question I
don't think so I have like one minute no
no question okay so come and see me uh
it will be a pleasure to answer your
question and chat more thank
[Applause]
you