okay
let's get started first of all
thank you for having me as a speaker in
this village it's my great pleasure to
give a talk here today i'm going to give
a talk about
the basics of adversary infrastructure
tracking
and also how to automate tracking tasks
with a tool
which i'm developing
before starting let me introduce myself
i'm ninoseki on
github and twitter
so if you have a question after this
event
please feel free to ask me a question be
a direct message
and i'm working as a she thought and
trust on
safety chain engineer in a japanese
company
so i guess you already know that
that english is not my native tongue
and i'm sure that my speaking is not
good
so please be patient with me for a while
and i'm interested in ocean gti
and making things yeah that's all
this is the agenda of today's
my presentation i will explain the
basics
of adversary infrastructure tracking
and how to automate tracking with a tool
which is named mihari
basics of adversary in philosophy
talking stroking
adversary adversaries are
not always but sometimes they are good
friends with bad habits
they reuse source code components and
they reuse infrastructures for example
ip address ssl certificate ssh
host key and who is reserved
reusing something increases a
possibility of tracking
let's say it's a fingerprint in a crime
scene
you can track a criminal based on a
fingerprint in
jail excuse me
this is a very simplified threat hunting
group
you have to do all tasks
in jail to track on advanced track and
adversary but
in this presentation i will focus on
adversary in crossover tracking
it can bring new sheets address
new landing page and the new samples
this is my my mind map
for adversary in class of jet working
you can see you can use those
fingerprints for tracking for example
if a host has um ssl certificate
x1 x509 fingerprint and jam
and j3 hash value can be used as a
fingerprint
and also if a host has um
http or http service
i mean if it is a website you can use
html javascript style sheet cookie
and the trucker fabicon as a fingerprint
there are two ways to track fingerprints
on the internet
the first one is active tracking
do scanning by yourself by using
admob mascara that map and so on
another one is passive tracking using
third-party services like showdown
census
binary edge by aristotle or
possible total
of course there are pros and cons
active tracking can find active targets
but it consumes a large number of
computing resources
in positive tracking there is no need to
have your own scanning infrastructure
but you should pay for pay a fee to use
in general
and you may find inactive targets
through passive tracking but
in general possible tracking is more
cost effective than having your own
scanning infrastructure so
i will focus on possible tracking in
this presentation
let me show examples of fingerprints
taking https example.com as an
example it's a website so
it has an html and those
html html hash values can be used as a
used as fingerprints also it has
ssf certificate so it's sheer number
and sha-256
hash value can be used as
fingerprint yep
for example
the its html mh3 hash value
can be used for children such and
x509 shear number it's
also it can be also used for short and
such
it's sha1 hash value can be used for
census
and sha256
hash value or certificate it can be used
all senses such
here is a small chip to take
fingerprints of our website
i published a python-based web up
to calculate the basic fingerprints of
our website
it is published on github so you can use
it for free
let me show a quick demo of this app
you should put url in
form and just push
calculate button then it calculated
fingerprints or example.com
dns record with record on the
hashes of html unfortunately
it's example.com doesn't have hobbycon
there is no hash of whatcom yeah it has
certificates so these are harsh
hashes or ssl certificate and you can
make a search
for example let's make a search on
showdown
like that example.com
example domain also you can make a
search based on certificate
example.com
and yeah for example you can make a
search on
your scan i o based on html's
sha-256 hash value example.com
example.com
and let me make another example
google.com i believe it has a hobbycon
so yep it has fabicon that i see
also which is a hashes of
public on and you can make a search
based on fabicon hash value
yeah this is a you know
google icon
that's all
i'd like to demonstrate how to automate
tracking tasks with a tool which
is named mihari
mihari is a framework for continuous
based threat hunting it is a
tool to automate partial tracking tasks
it is written in ruby and it is packaged
as a ruby gem so it's very easy to
install
just execute this command jam install me
hari
and just unload me
means look out or god in japanese
let me explain how it works
mehari can get input from over
15 services by default for example
showdown senses virustotal positive
total
and brever and so on and also it can
integrate custom sources i will
i will explain it later
and it me harry can output
findings to a database struck
the hype misp and make webhook
general webhook so
you can get the notification if there is
a new finding
which is matched with a search query
then
you can take a look at it
here is a very basic usage of
this command makes a search query in a
service
and stores material artworks in your
database
mihari has a built-in web
up so you can check finding spg web
up i will do a demo of it later
mehari has a dslr to combine a set of
queries
as a blue it is inspired by
three g7 infrastructure tracking scheme
this is a very powerful method to track
adversary so let me explain it in detail
this is me harvey's your schema
let me simplify it
required attributes are title
description and queries yep
that's all
for example please remember fingerprints
of
example.com this is a rule to find
post which sub html same as
example.com
mh3h value for showdown
and sha one value for census
and sh 256 for
binary edge under your scan so
it means you can combine multiple such
queries in a single rule like this
let me explain two practical use cases
the first one is tracking dangerous
password
dangerous password which is also known
as
crypto core we return
mimic is an apt group
that targets cryptocurrency exchanges
around the world
sometimes it reuses the same
infrastructure for a certain period
for example this is an ip address
used by dangerous password as a running
page
you can see it is used for months
so you can know new domains for running
pages by monitoring passive dns
i'm using virustotal hunting to find a
new dropper that
is used by dangerous password and if
there is a new connecting domain a
dropper
i will check or i will check a record
of that domain and register it in
mihari do like like this
and then i can get a notification
if there is a new related domain through
possible dns
the next one is
which is also known as x-radar
it is an android malware target south
korea
taiwan japan germany and so on
this is a mihari rule to track mo khao
landing pages
macau uses a self-signed certificate
for running pages so i use showdown and
census to track
track the host which uses that
certificate
and also
localhost have a very unique web-based
pink tracker and it thinks that
ping tracker can be found by an html
hash
or title of
an html and combination of open ports
interestingly uses pinterest
to broadcast phishing messages
it embeds a message in a profile of a
pinterest account
so you can get a new phishing domain via
pinterest
by monitoring those windows accounts
let's automate this task with mihari
in memory you can create create an
analyzer to ingest a custom source
by writing a ruby script
this is a part of custom bihari analyzer
to track
phishing domains in pinterest accounts
so
it means you can do more than querying
with miari
excuse me mihari is written
in ruby so you have to create an
analyzer with ruby
but if you are not familiar with ruby
you can make um input via wrestle api
let me do demo over me holy wave up
yeah it's a merry rip up and
you can see these artifacts
are found by rule i
explained before mukha rule
and these ip addresses are matched with
uh mokou rule beautiful mock power
and yeah let's take a look at it
let's look up it on paris total
and it has many
dns records
the macau uses how to say
dynamic dna services dynamic dna
dynamic service so it has many
domain in general
[Music]
okay let's let's validate
whether it is
let's access this domain
[Music]
how has the how do i say
it checks user agent so
let's access it be
android android phones ua
galaxy s5
yup it is written in japanese but
it impersonates uh how to say
it impersonates a company in japan and
it develops apk it's i believe it's an
android marker yep
like that you can combine uh
such queries in a single and track
targets
drag on other person like that
yeah i'm using me hari to track my cow
for years
so there are many artifacts
like this
also i said that i explained that
mihari can make um notification
through notification to slack
it's like that
it's same value i i demonstrated before
but yeah you can get a notification like
that
and you can make uh policy people
on these buttons for example
look upon pirate's daughter
or look upon
or senses
i said that mohawk uses self-sign
certificate
this is that one it's very
unique one so it's very easy to track
more call
by the way yep okay
conclusion
adversary infrastructure tracking brings
new insights
and findings so it's very powerful
techniques
to track activities of
adversary about
you should combine it with static and
dynamic analysis
and yara hunting to get get the whole
picture
mihari is a tool to make the tracking
easy
mihari provides a unified way to
interact with various services
showdown senses by the soda and so on
and mihari pings you when there are new
findings so
it it will help your research
and you can get better coverage by
combining a set of
queries in a room yeah
that's all thank you for listening is
there any question
i'm willing to answer it thank you
everything