- [Man] I'm gonna turn it over
to our first speaker of November Attackcon PowerHour,
Allie Mellen from Cybereason.
- Hi everyone, it's a pleasure to be here with you today.
I'm especially honored to be your first speaker,
even if that's just because they went alphabetically
and my name starts with A.
I've lucked out because of that before.
Today, I'm gonna be talking about Mapping the EventBot
Mobile Banking Trojan with MITRE Attack for Mobile.
A little background on me before we dive in.
I've been in tech for about a decade.
I spent five of those years
actually as a mobile app developer.
So I have a real appreciation for mobile
as its own industry and its own space
and I actually got into security shortly after that
from completing some internet
of things device, security research.
And from there, I started working at Cybereason.
I'm now a security strategist in our security team.
I work on our infrastructure security and product security.
So I'm very excited to talk to you guys
about what MITRE Attack is,
why we at Cybereason really think it's important
to align to it.
I want to give this really cool example
of mobile malware research that our research team saw,
and then talk about why it's important
to align to MITRE Attack for Mobile
and why it's really important for the future too
because it's not just about what we're doing right now,
it's about laying that foundation
and I think that's one of the reasons why MITRE Attack
is so important.
So as an organization, we think about MITRE Attack a lot,
our research team aligns every piece of research
that we put out to MITRE Attack
and whether it's mobile malware or just typical attacks
on the endpoint and there are a couple of reasons why,
and they really do come down to knowledge sharing.
Whether that's purple teaming,
whether that's having a red team
be actually able to communicate with the blue team
of what they're doing and why.
It's really important to have a common language
by which to communicate that
and that's what MITRE Attack really provides to us.
So it's really about not just classifying
the tactics, techniques and procedures that we're seeing,
but also about being able to share that in a common language
with the community, whether it's internally,
with partners, with customers
or just with the business
in order to really communicate value.
Taking that a step further,
why we actually map to MITRE Attack for Mobile
is one, because it's really cool.
They offer a really innovative approach to this problem
that at the end of the day, not a decent number,
but not as many as we want to be seeing
over the next few years are really working to approach
this mobile security problem.
The second is that mobile
is actually a really important target
that enterprises need to take seriously.
60% of corporate data is accessed through mobile devices
and that's a huge amount.
And we don't even really think about it
in classical traditional defense
and security within enterprises,
so it's really important to address.
And the last thing that's really important
is communicating value in a clear way.
What I really love about MITRE Attack
and MITRE Attack for Mobile is that we're actually
able to use it to abstract the problem
in such a way that it's now easy to understand
and communicate to others.
We can take this really complicated piece of research
that's really technical.
Our blogs are like 40 pages long on this stuff,
and we can condense it into something
that anyone can understand and that's really powerful.
So let's talk about this piece of mobile malware.
This is a threat that our Cybereason nocturnists team,
which is our threat research team, found called EventBot.
It is a mobile banking Trojan,
targeting financial services applications.
It's looking to collect user data
and it was specifically targeting the U.S. and Europe.
What's so fascinating about this attack
besides it being pretty cool
and it's just with this information
is that it actually targets
over 200 different financial applications
on Android devices.
And these are not just some financial applications,
these are really well-known applications,
things like Capital One UK,
we're talking about PayPal business.
We've got Revolut in here, there's Santander UK.
There's TransferWise, which I personally have on my phone
and love to use for getting money from overseas.
There's also Coinbase, we've got ING Direct and UniCredit.
So what's important to note about this
is I assume that a lot of people
that are actually on the Zoom right now
have one of these apps on their devices, but more than that,
they're not all just targeted at the consumer.
Some of these are also targeted at the enterprise,
things like, as we mentioned, PayPal business.
They're looking to gather information and credentials
from business applications
as well as individual user applications.
And that's super important when we're thinking about
how things like mobile malware
are actually going to affect the enterprise.
So what our team did for this piece of research
and what our team does for every piece of research
is align to MITRE Attack.
What was really exciting about this is MITRE Attack
actually has MITRE Attack for Mobile
so we can align mobile malware we're seeing
to each tactic that MITRE Attack has for mobile,
and you can see them here
and for anyone who's really familiar with MITRE Attack,
you can see how they're organized
from tactics to techniques.
And this gives us a really easy way
to understand these different attacks
and understand exactly what's going on and take a step back
from the really technical details
so we can get a better perspective for those people
who may not want to dig into the research
or may not want to be doing the research
or may have other priorities.
So, this is really what I see as the best part
of MITRE Attack for Mobile
is that you can really abstract the problem
in such a way that it's really easy to understand
and communicate to other people.
And as a computer engineer, I love extraction,
so this takes the cake.
But what's really cool about it, at least to me,
is what it allows us to do
when we're talking about communicating this
because we have that table,
which is already useful on its face,
but it's very useful for people
who are in the security industry.
But what's awesome is that gives us the basis
to actually communicate this threat
in a way that someone
who's not even technical can understand.
I'm gonna show you that here with this timeline.
So we took that same piece of mobile malware,
and we broke it down
into a timeline starting with initial access.
What's happening in this research is an unsuspecting user
is downloading EventBot,
which is masquerading as a legitimate application.
And what's so cool about this is we saw this so early on
that we were actually able to see this application,
this malware iteratively improving itself
in order to appear legitimate,
ultimately with the goal
of getting on the Google Play Store.
Although we didn't see it on the Google Play Store
because it was so early in the process,
that was its end goal.
Next it looks to get control of accessibility features
just by asking for them.
And it starts to run in the background because again,
it's convinced people that it's legitimate,
that it's an application they should trust
because they want to access the calculator
or whatever they're pretending
that this application is gonna do.
Next comes discovery
where since they have control of the accessibility features,
which gives them such a wide control
of the different ways that the device is choosing
to collect information,
that they can actually really dig into
some important reconnaissance information
like the device info and the names of Android packages.
And that's how they know which applications,
if the applications that they're trying to target
are on the device.
They go further than that
and they start actually tracking the device pin
and collecting financial information,
personal data, keystrokes, and even passwords.
So for anyone here and I'm sure no one here has done it
because they are all good security professionals,
but for anyone here who has actually copy pasted
from their notes application,
their password into one of their banking applications,
this malware has that info now.
Of course, we see them exfiltrate that
to the attacker C2 server,
but this is where things get interesting
because of course, as security professionals,
we have two factor authentication enabled.
And so when the attacker goes to log into these accounts
with the credentials that it just stole,
perhaps we think I'm such a good security professional,
I have two factor authentication so I will know
and be able to stop this person
from getting into my account.
But here's the problem.
The attacker has access to the place
where most two factor authentication goes.
In many forms of two factor authentication,
you get a text sent to your device
and this malware immediately steals that message,
sends any necessary information back to the attacker
and then deletes it.
So not only do they have control of your device,
they're tracking everything that you're typing,
but then they're able to delete messages at will
so that they can prevent you from knowing
when they're accessing your accounts.
So I, first of all, find this attack fascinating,
but what I find really fascinating
is how we're actually able to communicate this
in a way where
when I talk about this to non-technical people,
it clicks for them why mobile malware is really scary
and that's because of the mapping that we have
to MITRE Attack for Mobile.
So what's really important
and what I really want to think about
and what you guys think about
when you're thinking about this problem
is how is this a step in the right direction
to actually being able to map these attacks more completely,
and to be able to communicate which as an industry
we know is one of the biggest problems that we have
is just communication and being able to communicate problems
to other people.
How can MITRE Attack really help us to get out of the weeds
and then actually communicate these issues to other people?
And I think that I hope that this example
really illustrates that and gives us an idea
of what could possibly come next.
Because I think that not only do we have MITRE Attack
for enterprise, we have MITRE Attack for Mobile
and I can see a world where those two need to combine
because attacks don't stop at mobile devices,
they don't stop at traditional end points,
they can go across both.
That's one of the main goals of mobile malware attacks
is to get to other devices, to get to other end points.
And so I imagine there will be a future
where we actually consider these to be all one in the same
and my hope is that we can use MITRE Attack for Mobile
as the basis as we think about other types of attacks
like attacks on IOT devices
or other devices down the line that we see.
So I want to thank you guys so much for attending my talk.
I also want to give a big thank you
to the MITRE Attack team.
They really made this so easy and so fun,
and I really appreciate it
and I'm happy to take any questions.
You can feel free to email me if you have questions too,
check out our blog and feel free to contact me on Twitter
or follow me @hackerxbella.
- Excellent talk, Allie
and thanks again for all the reporting
and all the contributions we've gotten from your team.
It's been excellent collaborating with you.
We had a couple of questions building up in the Slack,
so definitely hop over there,
but I just kinda wanted to ask one.
I think a lot of the community might resonate with your talk
because like I said, we all have phones,
mine's five feet away from me at any point.
And like you said, a really interesting statistic you shared
was that 60% of our corporate data
is accessible from these devices,
so it's something we really need to take seriously.
But what is your advice to like a security team,
maybe a smaller unit that's just getting started,
maybe they have an enterprise setup,
but they do recognize, like you said,
the importance of mobile.
What are your suggestions for first steps
and how to start taking this seriously?
- Totally, I think that as we all know,
small security teams have much bigger priorities.
So of course it is always a juggling act
with what you're going to prioritize.
One of the reasons why I think that mobile is so important
and so interesting is because we do use it all the time
and especially now that we're working from home,
it becomes so important to stay connected,
even when we're doing household activities.
Like if you have to take your kids for a walk
because they've been stuck inside all day,
you're probably gonna take your phone
and you're probably gonna have Slack or Teams on your phone
and want to be accessing that in case something bad happens.
So I think that the best first step that you can take
is first working with IT very closely because of course,
for most teams, IT controls mobile device management or EMM
and it's really important to make sure
that any policies are up to date
and all of the basics IT hygiene is covered.
And then really try to start doing some awareness training
because not only can you access a lot of corporate data
on the phones,
but you're also three times more likely to fall
for a phishing attack on a small screen, which is crazy.
So it's really important to just get people in that mindset
where not to distrust their mobile devices,
but to think about what they're doing with them more
and not trust them immediately.
Like I think a lot of advertising really convinces us
that they're safe.
- That makes sense.
I think we had an interesting question
from one of our speakers from our last session,
you mentioned the EventBot and kind of the banking element,
do you see any other like major trends
in the mobile malware space?
Like I know typically I think one of the themes
from our last Attackcon
was attacking the human behind the keyboard.
I think in this case,
it applies perfectly to mobile because like you said,
the phones is the gateway into the mind of the human
and there's so many vulnerabilities
that we can't patch.
As techies and engineers, it goes through training,
but I guess long story short,
what are your kind of your forecast for trends,
things that you're seeing now
as well as where do you think the future
of this mobile malware is going?
- It's really fascinating.
There are a couple of things that come to mind immediately.
Of course, phishing, we all think of phishing.
We think of security and like a huge security issue,
but what's fascinating about mobile phishing attacks
is that they're not really coming from email,
they're coming from things like WhatsApp,
they're coming from SMS messages,
they're coming from social media websites.
So I think that having to kind of shift our brains
to thinking about a different type of phishing
than we're typically used to is really important.
As far as trends go to, we've seen, unfortunately,
a lot of people pretending
or masquerading their applications
as things like CDC applications
or World Health Organization applications
and as we really get into what will hopefully be
a vaccine season,
I think we'll probably see a lot more applications
like that that are trying to trick people,
especially when it comes to Android devices.
- And it goes back to trust, like you said,
it kind of seems like a central theme here.
I think one final question come up, a really good one.
Do you have any...
Obviously don't have the statistics off your hand,
but what are kinda your thoughts or themes
regarding the hybrid attacks where people are using mobile
as kind of a gateway to get to enterprise resources?
Do you think that's kind of a very common occurrence
or do you think actors are more kind of content
with just getting device data directly
from like iOS or Android?
- It's funny you say that
cause I actually do have a statistic about this.
90% of mobile malware is trying to access
other connected ports and different devices
that it can get access to, so it really is trying to move.
I think that there are really two ways that mobile malware
or two risks that come with mobile malware.
One, whatever's on the device
and two, accessing the enterprise network
and getting to other devices, we can see this like...
If you don't think much to connect your phone
to a Starbucks wifi,
but what if it's not an actual Starbucks wifi,
and then you go to connect your phone
to the enterprise network,
you can run into all sorts of problems.
And so I think it's really, really important
and that's one of the things that I talk about a lot
when I'm talking about mobile malware
is not just what's happening on the device.
What's really interesting
is when we see it actually going from the device
into the enterprise network and targeting other devices,
so I think that's critical.
- That's an amazing statistic.
So thank you for sharing and thanks again for your talk.
Like I said, it's been fantastic.
I think this resonates with all of us,
really some great knowledge to share.
- [Allie] Thank you so much.
- [Man] Thank you, Jamie and Allie.