11 ms·
Merlin: A cross-platform command and control server and agent written in Go
- qaq 8y agoNice to be a blackhat today so many tools
- alexchamberlain 8y agoIt would be interesting to read an ethical analysis of a tool like this.
- mmaunder 8y agoOne point of view is it's a mafiosi tactic. Create the problem. Sell the security solution. Or, at best, it is irresponsible to enable attackers. Another is that by disclosing security problems and the tools to test and research them, we enable defenders and we fix what might be kept confidential and exploited by attackers. The theory that sunlight is the best disinfectant.
- h1d 8y agoIt's not a magic and if detection tools don't support http/2, then it's their fault and quite frankly anybody could come up with this tool. The "enabled" attackers surely are nothing when they couldn't have come up with anything better themselves. It just made the discussion of such tools public.
- BillinghamJ 8y agoAs noted in the blog post linked from the readme, their red team is using it for internal testing.
- qaq 8y agoThats the funny thing sometimes people ignore alerts on tools that red teams normally use because they think it's their red team
- kiallmacinnes 8y agoIf people are ignoring alerts because it might be the red team then surely when the red team breaks in... those people all look like idiots who can't keep their systems secure? If this is happening, then either the red team needs to be disbanded as nobody cares enough to warrant their existence... or the engineers ignoring the alerts need to be educated on the value of a red team.
- qaq 8y agoVery true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure is complex sometimes things get complicated. E.g. a company undergoing an external pen test and some real incident in the same time window using tools that a pen tester would use (e.g metasploit)
- jerf 8y agoOnce you have the first 5 or 10 such tools, the consequences of the 11th are pretty minimal. And this is probably more like in the hundreds, not the 11th. Plus, they're sort of inevitable anyhow. The technical difference between ansible/puppet/etc. and blackhat C&C servers isn't that great. Definitely non-zero, but not that huge.
- qaq 8y agowell the evasion part is pretty huge diff.
- jerf 8y agoIf you're referring to what is mentioned in this post: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a , I'm not sure "We use HTTP2 and TLS" is that significant of a difference. If there was some elaborate system in place for evasion, sure, but this is just "using a new, but standard, protocol before everybody else understands it yet". Heck, just the fact it's using TLS is about 90% of the evasion; HTTP2 is just icing on the cake. A more significant difference I was thinking of is that ansible et al are more focused on getting the system into a certain state, whereas a C&C server is likely to be oriented around executing commands and keeping certain tasks running. However, since the way you get a system into a certain state is by executing commands, well, the technical differences aren't that significant. Most of that difference would be in organization of the "UI" layer, rather than under the hood.
- qaq 8y agoThey are looking at adding domain fronting :)
- SEJeff 8y agoMy take is that HTTP/2 is more significant than you might expect, primarily because it is a full duplex protocol (unlike the typical request / response of HTTP/1). This makes it like a more efficient websocket, so the C2 bits can move faster than a polling based approach. That said, this makes it easier to detect.
- kerng 8y agoThis is just another one, so there isn't anything really new to discuss ethically.
- xfitm3 8y agoI don’t think the widespread availability of tools like this makes it any easier. This project doesn’t seem to be too active.
- qaq 8y agoHow availability of tools does not make it easier?
- laumars 8y agoI’m not sure but I’m guessing his point is that black hats would more likely write their own software and script kiddies would rather not use abandoned software? In any case, there wasn’t any shortage of tools even in the 90s. Nor places to research them either. Plus systems were less security conscious then too so the barrier for entry was a little lower. Source: my own misspent youth.
- qaq 8y agoThis is not abandoned software there was an active discussion on adding domain fronting just a few weeks back.
- Ne0nd0g 8y agoI make most of my commits to the Dev branch and I am selective about pushing things to the Master branch. Check the releases page for a good indication of activity. I will also be pushing out an update in the next couple of days that adds the ability to execute shellcode using 4 different methods (Windows only).
- pjmlp 8y agoAnd so many systems still writen in C....
- sitkack 8y agoWe can't stop it, but we can put it in a sandtrap and serialize its access to the outside world.
- pjmlp 8y agoIn what concerns UNIX clones, Oracle did it with Solaris and SPARC ADI, which doesn't have a bright future anyway. It remains to be seen what ARM and Google will actually do with the new memory extensions. It remains to be seen what will happen with Fuchsia. Microsoft is pushing for a mix of .NET Native, modern C++ and Rust. Apple is still pushing for Swift, although very incrementally. The big question is how UNIX clones will actually tackle C's unsafety at large, if ever.
- zik 8y agoI know it's trendy to hate on C but most security bugs are not memory access related errors. Most are logic errors which any language is susceptible to.
- pjmlp 8y agoTell that to Google, which presented a report at Linux Kernel Summit 2018, where 68% from Linux kernel CVEs are caused by C's memory corruption features, and has been pushing for the Kernel Self Preservation Project on Linux. The videos are freely available. As for hating C's lack of safety features, it goes back to the earlier 80's from Algol/Pascal/Modula-2/Ada side. So no, it isn't something new, just now the always on Internet and IoT adoption are making it relatively easier to prove our point.
- SEJeff 8y agoI think KSP is Kernel Self Protection and Kees Cook has been pushing it since he was the kernel security guy @ Canonical many years ago: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...
- PhantomBKB 8y agoThe language analysis does not show any % for Golang :D
- Ne0nd0g 8y agoYeah, that part is frustrating. It picks up the PowerShell script in one of the sub directories and marks the whole project as such.
- w8rbt 8y agoThat happened to a Go repo of mine once as well (except it was a python script causing the misidentification). I fixed it by adding a gitattributes file to the repo. Here it is: https://github.com/w8rbt/netscan/blob/master/.gitattributes https://github.com/w8rbt/netscan/blob/master/.gitattributes
- StavrosK 8y agoWhy is the fix to tell Github that py files are Go? I would have expected the fix to be to tell it that go files are Go instead, no?
- rmetzler 8y agoI would guess, the real fix is to improve linguist, the Ruby gem GitHub uses to determine the programming language. Everything else is a workaround. https://github.com/github/linguist https://github.com/github/linguist
- Ne0nd0g 8y agoThanks!
- moray 8y agoThis reminded me of Back Orifice: https://www.cultdeadcow.com/tools/bo.html https://www.cultdeadcow.com/tools/bo.html aahh the nineties!
- neurobashing 8y agoWe purposefully installed BO to act as a remote control system for machines inside the firewall.
- freedomben 8y agowe did this as well. It was super useful for legit purposes as well as a RAT
- sitkack 8y agoSATAN really drove home how automated our attacks would become. Diversity, defense in depth, compartmentalization. That reminds me, I need to setup my VPN to localhost, TRUST NO ONE! https://en.wikipedia.org/wiki/Security_Administrator_Tool_for_Analyzing_Networks https://en.wikipedia.org/wiki/Security_Administrator_Tool_fo...
- Gibbon1 8y ago/dev/null Trust no one not even yourself.
- accnumnplus1 8y agoAnd netbus!
- pandemicsyn 8y agoAnd Sub7
- zupzupper 8y agoHeh, written in Delphi I think. My earliest PC consulting was cleaning up sub7 infections caused by antivirus packages deleting the main executable. Sub7 associated the .exe format in windows with it's main executable, so if you removed the "infection" you had a really interesting time loading up windows afterwards, explorer.exe and all the others were looking for sub7.exe to load themselves =)
- deleted 8y ago[deleted]
- badrabbit 8y agoNeat project. On HN a lot of people are against TLS interception. How is a defender suppose to detect this traffic? TLS aside snort or yara rules can be implemented. For personal devices of course TLS should not be interceptable. But I've personally gone 180 and support TLS decryption for enterprise networks.
- Ne0nd0g 8y agoTools like JA3 https://github.com/salesforce/ja3 https://github.com/salesforce/ja3 can fingerprint TLS traffic to provide one way to perform some type of evaluation. Defender can detect on a lot of other things like an applications behavior.
- xfs 8y agoThat can be trivially defeated by operating on top of Chrome's net stack though.
- blablabla123 8y ago> How is a defender suppose to detect this traffic? Probably by taking a decentralized approach, that's probably more secure, performant and better to maintain anyways. Also on the server side one could do TLS using Haproxy or nginx, this way it would even be possible to use existing tools - just on localhost though. Or, one can do TLS re-encryption with Haproxy/nginx (or Squid for the other direction), and do checking on the host at the same time.
- architect64 8y agoFor enterprise networks, you can still analyze the pattern of packets to match fingerprints of C2 traffic. There are solutions such as Cisco's Encrypted Traffic Analytics, that do just this: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Encrypted-Traffic-Analytics-Deployment-Guide-2018AUG.pdf https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Camp...
- kerng 8y agoMost modern implants dont directly talk to a C2, they relay over other protocols like pastebin, twitter, or blog storage pictures, or databases to obscure traffic.
- innocentoldguy 8y agoI'm always puzzled by these "Blah blah blah, written in Go" posts. Can't you write the same thing in any other language? Most of the time, isn't "Blah blah blah" just a Go clone of some tool written in another language anyway? Is Go feature-challenged, or nigh unto impossible to use, thus rendering "Blah blah blah, written in Go" newsworthy? I'm sure this sounds sarcastic and to be fair, it is. Still, I really don't understand the need to constantly tout the fact that it is, indeed, possible to write things using Go. As a community, Hacker News doesn't seem to do this, at least not to the same extent, with any other language. However, if a new developer cracks open a Go book, it seems we have to have a "Hello, World! written in Go" article to go along with it. Does anyone else find that weird?
- GrumpyCoder 8y agoLightweight and portable come to mind when I see "written in Go". Those qualities are pretty appealing for the self-hosted crowd.
- innocentoldguy 8y agoI guess that's a possibility; however, Go isn't the most lightweight and portable language out there. Rust and Erlang both seem like better options if those criteria are important.
- GrumpyCoder 8y agoOf course it won't beat Rust or C but it's good enough.
- wieghant 8y agoI just find Go a more pleasant experience. The source code is easily readable and understandable. I don't run into weird wrong version or dependency problems ever. Go get, go build and i'm done. Or if i download the binary, just dump it in a bin folder and it works without even having Go on the system. I haven't written anything in Rust or Erlang yet, but I have run into trouble when building Rust packages from source. Maybe it was the package maintainer's bad every time, the system setup or I'm just dim, but I just need to get stuff done and not go down the rabbit hole. I also personally don't like the hassle with Python version environments.
- equalunique 8y agoI wonder about the possibility of porting to other architectures & operating systems supported by Go, like BSDs, Solaris/Illumos, AIX, Plan9, even WASM...
- equalunique 8y agoInterestingly there is another project called Merlin in the network security space, although it hasn't been updated in almost a year. http://www.frenetic-lang.org/merlin/ http://www.frenetic-lang.org/merlin/ The best documentation available is the paper linked to on the above page, and the examples in the github repo below. https://github.com/merlin-lang/merlin https://github.com/merlin-lang/merlin