Welcome back to salta - my name's Steve Regan today
We're going to talk about honey pots and some interesting things you can do with pot nuts we'll be right back
Welcome back again, my name is Steve Reagan senior staff writer at CSO online and host of salted hash all this week
I am out here at RSA in San Francisco today. I'm talking with cyber reason, and this is their sea so Israel Barack
It's good to see you again
thanks for coming out and hanging out with us, so you guys have put out a study here recently and
You set up some honey pots and you let the bots go nuts so tell me about this this
Research you guys have been doing what you found out well this time
We've set up a honey pot that master is a financial services company
There was about a hundred machines in the back hand there which you know included user behavior
Emulation the honey pot itself exposed a number of services to the outside world mail services web services
DevOps services and we basically try to build us as realistically as possible with a website LinkedIn pages etcetera etcetera
The goal was to really see how the bot
Landscape was changing in terms of what type of bots are we seeing out there how prevalent they are
What are their operational goals? What do they actually do in their post penetration phase?
So how quickly?
Once you get to set up online how quickly did you start seeing bot traffic within hours within hours after setting up the infrastructure
registering the new domain names and
Getting the internet connected
We got a hell of a lot of bot activity so were you seeing just like basic level scans like you would expect to see
Across, you know an entire suite of IPs or were you actually seeing
brute force attempts and actual infiltration
So usually you see two types of bots
In this case we actually saw a third type that became the focal point of our research, but the first two types are generally
You know Jenny level one bot is as a bot that would take advantage of a vulnerable
Service to you know initiate or support one type of business activity, so they would take advantage of a vulnerable
email server to send out spam or they would take advantage of a vulnerable server to deploy a
Cryptocurrency minor or a DDoS bot that's essentially what they do
A second-level bot is a bot that tries to take information off of this river
Usually for black-market resale I information like you know cookies cash credentials
browser history
Etc etc user information from the server
Payment card information if they're able to extract it from the server, and then just resell that data
The third type of bottom the level 3 bot that we saw and that's definitely something that we did not expect to see
Definitely not as quickly as we saw it and as intensively as we saw it is the bot that
Doesn't facilitate one particular business activity
But actually opens up an infrastructure to a human attacker does a lot of the grunt work
For that human attacker before they actually let the person go in
So you talk about a bot that that exploits an external service or a public face service?
and then kind of sets up like the reverse shells or drops whatever payloads needs to be dropped and
Basically clears the way for a human actor to sit down in the keyboard and be like whose victim number five today
Absolutely absolutely, and it's it's even more than that right so after the Bont came in this particular
Bot the you know establish multiple persistence mechanisms on that vulnerable server
With multiple backup users. What kind of persistence were you saying so mostly persistence in terms of
Overwriting operating system modules so when the operating system reloads the the bots get realize or that's mechanisms get reload
backdoor is like using the hotkey to
Be you know so you can get a shell even without logging into an RDP session so a number of these persistence mechanisms
They're generally well known. It's just in in this case they were set up by the bot as
You know different options for the human attacker to come back in
Establishing multiple alternative user accounts so if someone changes the password of the original user that the BOD got in through
they'll have other options that come in through but in addition to
persistence and
alternative authentication options the bun actually did a lot of other things that
Establish the business value for the human attacker to come in
and actually harvest that information on
Credentials take credentials off of that end point took the history of the browser
whether this user go or what type of cookies, can you find on that server a
Very long list of retail sites that it was looking for financial services sites dating sites
General web. You know what interesting web resources valuable grab resources
And it basically
Exfiltrated the whole thing alongside with network
Reconnaissance the names of the machines in the network and essentially built a business case for the human attacker
That come in and see what they can get so do you think the bot was actually building a profile so that later someone could?
Say all right
Here's Israel's company and here's you know his account we know what he's doing we know why he's doing it so for $1,000
I'm gonna give you everything you need to go find him and you can have your
You do whatever you want to do with this company after that point you think that's what they're building out
I think I think that there's definitely a probability that what the bot was doing it was building a post in one of those
Black-market forums maybe for a machine for sale because the type of data that was collected from the machine
Aligns very well with the type of data that you would see in one of these posts, okay?
So when you correlate the data being collected?
Versus what you're seeing on the post then at any point during this this trial you ran this forward two months, right?
About two months did you ever see evidence of a human actor interactive so when you saw the human actor
What were they doing so about two days after the bot finished its work?
It's the bud that bot worked for about two days right collecting information
Exfiltrating and gets this information over the RDP Channel, and then two days after the bot finished its work
We got a human attacker to come in now
We know that it's a human attacker that used the bot infrastructure because of two things oh yeah
we
Haven't looked for that. You know we should we should but we we saw it because of two reasons
But that's a great idea one. We'll look for it
number one the
The attacker the caiman did not use the original compromised user that the bot got in through
But actually one of the users that the bot created
So we know that the that in that new attacker used the but the infrastructure that the Bob laid out
The second thing they used the UI applications they opened up Windows Server management windows interacted with those windows
right clicked in different places
changed server configuration opened up additional command control options with win RM
So we know that there's really no reason for the bot to do it right the bot actually did the whole thing with
Command shells write an API calls. It's really just a human that would open up those windows
Maybe not even as a very sophisticated human no
It's so didn't at any point
Did it look like the human realized that wait? This isn't what I think it is
This is or were
They completely fooled by the setup so the human attacker went in about two days after the bot finished its job
And then decided what they want to take out and they did deploy a mass mailer a true if sufferer called turbo mailer
And that's that's what they used to exfiltrated about three gigs of data
From this environment, and they took out that three gigs of data took about four days
They data kind of low and slow took three gigs of data, and we never hurt, and we never saw that human attacker again
so they worked from
April 2nd April 6 after April 6 no sign of that human attacker again have you seen any sign of the data?
That was I mean obviously it was all worthless data, but there were markers surely, so have you seen those markers appear anywhere?
So if the the attacker was to look at the data itself that the exfiltrating would immediately be like Oh
Son of a that. It's it's just completely garbage
That was that was really just junk data, so I imagine either the human attacker looked at the data
And then figured out that it wasn't very interesting very valuable or they
Suspected that were they're probably on to a honeypot. Well. I mean obviously the the big fear is if I go back
I'm gonna get Vande, so they wouldn't want to return, but you get them wonder kiri
I see if you're like okay, if this is garbage
Dude, then what the hell was that and they go back in and start poking around more
You know there's gonna be somebody who's curious
You've finished this this particular test in two months. Are you planning to do additional tests?
so are you going to stick with the financial services, or you're gonna try to look at other verticals, and we're gonna look at
industrial control systems air control systems
So we're gonna try to we're gonna try to establish
honey pots around different verticals and try to see if we're looking at different profiling any
Consideration the setup a hospital, I think that could be a wonderful option. I think that could be a wonderful option
that would be kind of fun to see how the bots interact with a heart monitor for example or a
remote
diagnostic tool for pacemakers and things to see what they're they're playing with
But that would if you do I'd certainly like to see that that would be fun so
Aside from the test results. I know you guys are out here in RSA having meetings. What else you working on coming up
Wow well we got we got a lot coming up right so outside of the you know the incident detection
visibility response infrastructure
And the ng a V or the preventative capabilities or at we're adding threat Intel
integration on top of that so you can essentially
Actually, you can create actionable threat Intel right the idea is to for each of our detections
You'd be able to get the broader context of what else we've seen around that particular actor or that particular TTP
right based on extensive threat Intel sources
You'll see in addition to that
significant effort on
additional
contextualization
Right so one of the things that we obviously focus on a lot is how do we make an incident?
Clear in terms of its full context to an analyst so we're investing heavily
And you'll see that here in further explaining that full context and to end
Story attack story to an analyst that's using our technology nice nice, so Israel where if people wanted to keep up with you
online like you say on one of those social channels or just outside of the business context where can they find you well, that's
Probably best to either go on LinkedIn
or Twitter
Israel Barack three nice nice, so this is fit salted hash. I'm your host Steve Reagan
Thanks again for coming out and talking with us. I appreciate it like I said earlier
we are out here all week during RSA and I'll be shooting some things so if
You would like to keep up with cyber reason or myself stay tuned to CSO online.com, and we'll see you next time. Thanks a lot
You