[Music]
welcome
my name is mark loveless i am a security
researcher at get lab
i'm very pleased to be presenting here
at adversary village as a part of the
overall def con experience here in 2021
today the topic is advanced persistent
threats
otherwise known as apt i know a few of
you out there are probably
hoping to learn a few things
that you can use for red teaming and
penetration testing
so i'll point out some important
differences between those and apt
but i know a lot of you are just
interested in the topic
i'll discuss how one goes about tracking
apt actors over time
i'll cover some elements of attribution
although as you will see
in this presentation that's not
necessarily
as important to at least so frontline
defenders
i'm going to cover some technical
details from an actual attack
that i dealt with against my home
systems from
a very uh well-known
apt group and i'm hoping that all of
this information will kind of bring the
entire subject into focus
it should be noted that some of the data
associated with
ip address assignments and domains
discussed later in this presentation
are no longer current also all specific
data i am discussing has been referenced
in public by other parties
or came directly off of my home systems
so i'm not revealing any state secrets
but
first i wanted to give you some relevant
information on my background as well as
some
of the history of the term apt
and hopefully all that will give you a
little perspective
for the rest of this presentation
um a couple of decades ago i formed a
hacking group known as
nmrc we did the usual goofy hacker
things but we did have a serious side
when occasionally help out to a
group that needed some technical support
now we were doing this
for free most of these organizations
we'd help were involved with human
rights
some were activists who were working
against a repressive
government and other like-minded
activities we didn't make a lot of this
work public
for obvious reasons we didn't want to
tip the hands of these governments
nor did we want them to know who we were
doing this work for all right let me
give you a quick example
of something that we did that probably
got us on the radar i was working at
uh buying view which is later acquired
by semantic
we were developing a web scanner that
would look for known security flaws
things like
bad cgi scripts and whatnot
we needed to stress test it so we
decided we would try to scan a whole
bunch of websites at the same time
and since china had a fairly poor
reputation when it came to human rights
we aimed this thing at the entirety of
china's
allocated ip address space now
technically
it was only looking for the existence of
a file on a website not code execution
we thought no harm no foul
but when we did scan certain websites it
would occasionally elicit an interesting
response
usually in the form of a ddos attack i
mean we weren't trying to really hide
where we were scanning from i was doing
this from my house
so after we collected uh
scan results a couple of us had copies
of all this data and we
provided it to those that we knew were
fighting the good fight so to speak
mainly repressed chinese nationals who
were angry at their government
now in retrospect this was pretty poor
opsec
on my part i had static ip addresses
it wouldn't be too hard to figure out
that this scan led to
this type of an attack etc etc
uh and in particular when i started
doing things like uh
talking in public about how i didn't
like what the uh the chinese government
was doing as far as human rights goes
so it wasn't too hard to be able to
track me down and get my feelings on the
subject now
another area that probably impacted this
uh
just as greatly was a my employer
i used to work at mitre corporation and
which is a
basically a us government think tank
where
despite my hacker background i somehow
managed to get a security clearance
which has now expired while i was at
mitre i worked on a number of projects
including frontline battling of apt
attackers against that organization now
because of these hacker activities my
employers a few other issues and
scenarios i won't belabor the point with
i was on the radar i've apparently been
added to a list of assets
that some of these apt groups might want
to compromise
i have might have access to something
interesting as far as they're concerned
where i may be in contact with someone
that they're trying to target
uh between direct contact from friends
that work in government agencies and a
rather interesting exit debriefing when
i left mitre
i realized that while it's not
life-threatening i was on a list of
potential targets
i'm not saying i'm a special snowflake
by any means
i'm just saying that there are a number
of us that have worked in this arena
before
and all of a sudden we've become kind of
a target so to speak so in general my
perspective in this is a little more
than simple curiosity
about the subject so apt
let's talk about the history of the
actual term
itself apt
in the 90s the us military used the term
advanced persistent threat
or apt for short to refer to
small self-autonomous enemy commando
units
in 2006 the term
was applied to cyberbase groups where
it's stuck
probably because of the similar
independent nature of these groups
instead of the usual distract disrupt
delay mandate of the commando units
the based units were all about
information acquisition
at the time these cyber based groups
main goal was intellectual property
for competitive or military advantage
often targeted were things like defense
plans including details of various
weapons
troop operations what projects are being
funded
certainly any other form of intelligence
additional additionally things like a
network diagrams
software inventory information email
addresses of
personnel to further existing and future
cyber based operations were sought
basically they would try to gather
information that revealed military or
economic weakness
or gave them a military or economic
advantage and gave them a way
back into the place that they were
trying to get into
so the atp battle plan was roughly as
follows
there would be a fairly detailed
reconnaissance of a target
that would include not just what type of
systems the target might have
but also identify some of the people and
what their jobs were
to help with things like spearfishing uh
they develop an infrastructure for an
attack
such as email accounts to send phishing
emails from
uh registered domains and set up
websites or
compromise existing ones code up and get
ready to deploy command and control
systems and so on
based upon the reconnaissance attack at
that point
using a method that should work on the
target
once compromised attempt to move
laterally to as many systems as possible
uh back door as much as possible to
allow for remote command and control as
well as
potential future entry points in case of
discovery
and being kicked out they could get back
in and if this was a return visit to a
site perhaps they might be going after
specific assets fairly quickly once they
get in there
they would then perform the main
objective which it could be to
exfiltrate data
or something else such as maybe
backdooring source code etc
and then of course they're constantly
adjusting things
over that entire time as needed to
maintain
that all-important foothold
okay for some reason attribution has
been
a hot topic particularly in the past
uh when this entire apt thing began to
be known in public circles
the main argument the main arguments i
should say
i heard were the following first
an attacker as an attacker who cares who
it is just keep them out right
well that's true uh you we should be
doing that
uh in any case but uh that's not the
entire point and we'll get to that here
in a little bit
um number two consulting companies were
using the term apt
in their marketing to sell goods and
services and so a lot of people just
deemed this to be
uh overblown marketing just some type of
weird marketing ploy
uh true that was happening but no that
wasn't uh
that really wasn't the necessarily the
problem
uh the third argument was that the term
apt
advanced persistent threat advanced
being the key word here
was rather offensive to a number of
people
the main argument was that someone read
a report from let's say
fireeye and see that an attack group had
used a
year old bug to gain access to a target
and some people would say things like oh
that's not advanced if i if it were me
i'd be using
zero day not some lame six month old bug
now this last one really pissed me off
uh
to me uh as a hacker who used to
actually break into systems in my youth
i fully understood why you would not
want to waste or
essentially burn a zero day on a target
unless you really really wanted into
that target
uh a number of people saying it wasn't
advanced
they did red teaming or pen testing as a
part of their job
and they had a different perspective
completely different inspector
um true attacking
truly committing felonies involves
cheating for lack of a a better term
when you're pen testing
usually for looking for multiple ways in
and documenting all of them and
there are some off assets that might be
off limits
or out of scope and
some techniques might be completely off
the table such as
denial of service red teaming often
involves testing subsections of the
infrastructure it might start with the
idea that
assume we got root on xyz or some other
scenario
just trying to test detection systems
themselves there are lots of different
things to go and
go into it in other words there are
limitations that are imposed
on those groups now with apt
there are no limits you can launch a
ddos attack against
one part of the infrastructure or
unleash a
piece of nasty malware just something to
keep the admins busy
and then use your crafted attack to slip
by defenses
nothing is out of scope nothing is off
limits
i was i'm giving an example of this i
was aware of a very large software
company
where dozens of isps in the area of its
headquarters
were targeted and
the attackers were all looking for vpn
connections
uh from home systems and these large
software
uh this large software company
headquarters
uh those home systems were targeted
and all of these vpns for this
particular organization
allowed for split tunneling which in
turn allowed for the attackers to gain a
foothold
in this large software company now
apt attackers are in general better at
this kind of thing than usual
run-of-the-mill attackers
i mean this is their full-time job uh
they're good at it and so this gives you
kind of a rough idea of what i'm talking
about
attribution attribution is uniquely
identifying a particular apt group
in classified are political circles
knowing the nation state behind the
attack is important
otherwise that part actually doesn't
really matter
ttps the tactics techniques and
procedures
help with this identification process
now by gathering
ttps and other indicators patterns will
begin to emerge
the more you gather the more defined the
patterns are
a set of these highly defined and
related patterns
uh it's called a campaign and a campaign
is basically
an apt group now after gathering data
from
dozens of attacks extremely refined
patterns
emerge and one can ask if certain
patterns are similar over time
which could mean a repeat attacker and
this is the true
reason you do attribution based upon the
historical
data what is their next move
if for example a particular group
attacks on tuesdays
every four to six weeks with a phishing
email from a yahoo.com address
you can anticipate that kind of attack
and even stop it
uh data from launching that executable
from the last attack on your
honey net tells you how they move and
exploit access
so if they do get in you know their next
move that's
a big big part of this will they crazy
ivan
if you haven't seen the movie the hunt
for red october i
highly recommend it now in this film the
enemy soviet submarine would sometimes
stop
and turn to look for someone tailing
them
uh typically they'd be looking for the
americans and this was referred to as
crazy ivan
by these americans uh chasing these
people in their
in their submarines so uh some apt
groups did something fairly similar
uh where they swap out back doors every
week or so
some even left a few of the old uh back
doors on a couple of computers so that
if that particular back door was
discovered
and then all of those machines were
wiped uh
the victim would think they'd cleaned up
the the attack and were okay
whereas the abt actor was actually still
in there
because they were using multiple back
doors
now tools used to collect this data
we can't include honey pots honey nets
even honey clients it also can include
data from
when you're going through and looking at
the remnants of a
of a successful attack on their part
this data uh gathered is stored at mitre
it was done using a software package
called crits
which is now an open source project this
started uh
at mitre who was dealing with this uh
a apt data collection and is still
out there and you can still download it
and use it uh
data sharing if you want to be able to
share data with others this can actually
help
with others in your industry for example
uh
it can be crucial uh particularly if you
know your buddy down the street gets
attacked on
thursday by you know one particular apt
a group then you're going to get it on
the following monday you hear from them
that it's thursday and they got attacked
monday you know what to expect so that
becomes important
so that that kind of gives you
a a little bit of an idea
about attribution
let's talk about an actual campaign this
attack was from a group known as
apt-18 or dynamite panda
i knew them by the name wekby webby is
still active to this day
this particular particular attack took
place a few years ago
i don't know if you remember the company
hacking team
and the breach they suffered in 2015
as a part of that breach they had an
adobe flash zero day which was leaked
so it was going to be patched fairly
quick now when we saw this breach
within days they had launched a campaign
with a fully weaponized evil flash file
while it is possible that they managed
to get the evil file
file working flawlessly uh
without causing a crash and deploying
the payload and all this accurately
it is more likely they already had this
particular
flash zero day and decided now is the
time to use it
because all of a sudden it had a limited
shelf life
they quickly developed a spearfish
and i personally received this fish as
did other select individuals
and various organizations
here are the raw headers of the fishing
phishing email i received
okay so the ttps
are in blue and the important data
associated with that is
in red this shows just some of the
dozens if not hundreds of things that
are collected
when doing a data gathering now here is
the body of the email there are
obvious mistakes in the email probably
because webby was in a hurry to get this
out the door but the ip address
of 137.175.4.132
really caught my eye i recognized it
immediately thought of wekby
i did go and look at the page that it
was
pointing to and downloaded the movie.swf
file uh the page and the sfvf were
there for maybe three or four days maybe
less
i don't know who took them down probably
wekby
movie.swf had a payload that simply
downloaded insta
and installed a remote access trojan
also known as a rat so i manually
downloaded it
and took a look at it the rat was known
as ghost
and there are ghost variants these were
often used
by wekby to use a a ghost variant
a bit of analysis on the ip address
reveal
revealed more information that i
remembered as wekby
as did the rat including the command and
control ip address
now ghost is an http browser
style rat in that it does periodic
queries and it looks for new responses
which helps
direct the next command that ghost will
run on the target
in this particular case it's using dns
text records for command and control
so ghost traffic looked like dns queries
and for a typical victim location this
type of traffic would not be blocked and
would very easily make it outbound
as you can see there is the potential
for
dozens and dozens of different
attributes one can use
to track individual attack groups
depending upon the campaign
i have seen ttps in the hundreds for
a single campaign when you compare these
for looking for patterns and let's say
that you get 80
that are common between a newly
documented attack
and one that's happened previously you
can almost be
certain it was the same attacker
especially when you consider
that maybe the second place contender
for common ttps might only have say
10 anyway
enough about our attack attempt now
let's talk about some
fun facts about apt in general
all right some of our fun facts the
initial intrusion
is going to be the easiest way in for
the attacker
if sending in an email asking the person
to run an attachment called backdoor.exe
does the job they'll do that more
sophisticated targets
might require some more advanced
techniques up to and including zero day
credentials tokens keys of all kinds
are going to be harvested end user
devices
servers containers are all infiltrated
and the more sophisticated attackers
will rotate their back doors
these are the apt
basics that seem to happen at every
intrusion
the main objectives still happen but the
basics they do seem to be fairly
consistent
advanced attackers will compromise
a target software and their services for
downstream attacks
the 2001 attack on rsa
attributed to wekby by the way was an
early version of this
solar winds is a probably a good example
of a more recent one of a
kind of a downstream style attack now
these
supply chain attacks might be cheaper
for the attacker
as there is a lot more bang for the buck
so to speak
although the risk of detection is higher
the larger the spread of the attack
uh the more potential surfaces that are
touched
this could result in a breach being
detected
and that was the case for example with
solar winds
um now as far as the nation state
themselves uh there are a few big
players
in this uh that includes china or russia
israel france and the usa
uh there is also a kind of a next tier
group that includes countries like india
pakistan iran and north korea
now as far as who is best of the best
uh that would definitely be i would put
that as a usa
uh russia and israel hands down
they're gonna be the top ones
security people do need to understand
these types of
threats they're not common but they
exemplify the sharpest
attacker that you will ever face if you
sell goods or services to customers
that are the type of victims that apt
actors
are going to go after you can should
consider yourself a target
the rsa attack in 2011 is probably
uh the best example i can think of of
this
uh not all of your customers would
potentially face an apt threat but
some might so just keep that concept in
mind
over time the tracking of ttps
tends to show uh general adaptiveness so
secure barriers go up in one place
attackers will try
others give me a quick example of this
uh spearfishing worked a lot
uh for apt attackers and then at some
point it wasn't working quite as much
so they would try to become friends with
these people on say linkedin
and then pretty much is like hey you're
my friend can you
check out my resume and tell me what i
need to do i got a job
interview coming up tell me what looks
good
sure let me take a look at your resume
okay here you go victim
here's a nice zero day in a pdf file
that
has now owned your system and your
organization
so that's like an example of how they
might adapt
to and take on other attack scenarios
so just remember that the whole
information acquisition mandate
and all of the associated tactics that
are used
by apt actors are being adopted
by non-apt attackers as well these
non-apt attackers
say such as ransomware attackers they
see what's working and they
they'll go ahead and try to use it so
defending against a potential
direct apt attack does have some
advantages
all right let's talk about some
mitigations
the basic security tech we have such as
using two-factor authentication uh
automating our patching on endpoint
systems immediately
all that helps if i were to go
further in general terms i'd say not
using
windows and being an all remote
cloud-based company
also helps because that's not as common
and it creates a much harder target
than what the apt actors are going to be
used to
using uh things like uh google's
gcp uh amazon's aws this helps because
they've been hit themselves pretty hard
in the past and they do a lot of stuff
that happens
behind the scenes uh to help secure
things
so moving to that cloud environment if
you haven't already
uh is definitely a a big help just
for that alone uh get aggressive
use your red team and employ outside
pentest firms and
with extremely broad mandates
remember apt attackers cheat
and ask these people to cheat
on your systems if they're going to give
them a fair
shake fix everything they find
don't just check off the box of we did
the annual test and then
and then wait until next year and do it
again
uh test frequently with phishing
campaigns this is a
i think this is still the number one way
that uh
apt actors manage to gain a foothold is
through
uh stealing of credentials in some form
or fashion so
make sure that you do
fishing campaigns finally do not punish
users when when you get breached reward
them
when they report things even if it's a
false positive
okay they are not the security experts
we are okay
so help them want to help you
and that will obviously help in so many
different ways
okay that's the end of the presentation
at this point
i want to thank you very much for your
attention
uh there is contact information uh where
you can reach me
and just reach out to me if you have any
questions
and i'll answer them as best i can and
thank you very much
[Music]
you