8 ms·
As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is public
by mike_d 6y ago
As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here.
For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't being blocked - just the specific implementation. This is why we build our own tools: to demonstrate to defenders that while they are blocking a specific implementation they have not addressed the underlying vulnerability.
I do want to call out FireEye for doing an amazing job recovering from this situation. They did the responsible thing and released fingerprints [2] that could be used to detect every single one of their tools. They effectively burned their entire catalog and put them in to the class of "public" tools that are easily identified. I've browsed over the list of signatures and didn't see anything that popped out as giving a malicious attacker any advantage other than saving them work of building it themselves (of course I don't have access to look at the actual tools so YMMV).
Also, everyone gets hacked. No matter how good you are or how many cyber security engineers you have on staff... there is still Matthew in accounting that will open that invoice attachment so he can pay it.
1. https://github.com/gentilkiwi/mimikatz https://github.com/gentilkiwi/mimikatz
2. https://github.com/fireeye/red_team_tool_countermeasures/tree/master/rules https://github.com/fireeye/red_team_tool_countermeasures/tre...
Edit: To be clear I do work on an internal red team - we hack ourselves. I don't work for FireEye or a competitor.
Edit 2: Don't pick on Matthew. :)
- supercucumber 6y ago> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/
- sjg007 6y agoThe invoice should be a PDF interpreted by pdf.js inside a sandboxed browser. Even better is that the company should have its own internal ordering system.
- Scoundreller 6y ago> Even better is that the company should have its own internal ordering system. This always becomes a war where the seller wants you to send orders 1 way, and the buyer wants to send all orders another way.
- flo123456 6y agoThe invoice shouldn’t have to be a PDF and shouldn’t have to be sent via e-mail. Sadly those are still the best tools we have. It would be really cool to have an invoice format that contains payment and tax information in a machine readable way and a way to send that information around with a verifiable channel.
- corty 6y agoThe invoice will be PDF with an embedded XML blob containing the machine-readable data part, signed with a PDF signature: https://www.pdf-tools.com/pdf20/en/zugferd/ https://www.pdf-tools.com/pdf20/en/zugferd/ pdf.js lacks capabilities to extract the XML or verify signatures, so the usual way will be to use Acrobat Reader or the usual bunch of "industry-standard" invoice-processing crap that now suddenly has to deal with malicious input. The idea to do it differently might be nice in theory, but is lacking a smooth way to change over from the old paper-invoice ways. PDF will be the thing for some decades and we will have to deal with it.
- vbrandl 6y agoHaving implemented rudimentary ZUGFeRD support at $dayjob a few years ago (our main product is sending, receiving and validating invoices for energy companies in Germany), I don't see ZUGFeRD becoming relevant anytime soon. At least for b2b invoices, nothing has changed since the release of ZUGFeRD. They prefer sticking to EDI formats (many with some custom edge cases for their SAP monstrosities, e.g. putting the `-` sign for negative numbers _after_ the number like `10-` for `-10`...)
- corty 6y ago
- FreshFries 6y agoWe (as in the IT Sec industry including me) prefer to blame Matthew. Or my 80 year old mother for not installing the latest Adobe patches in real time. With 30 years of daily experience in this field, I am ashamed about how we fail Matthew & my mother in the sense that they can still not just enjoy the internet and open random emails without one of us blaming them for how stupid they are.
- therealx 6y agoDo we somehow fail the dumb accountant or 80 year gma with cars because they can't just get in and drive without learning how to drive?
- djeiasbsbo 6y agoThat analogy doesn't work in my opinion, because to even be allowed to drive, an extensive amount of training is required. I think we need to start very early. There should be more mandatory comouter science and information security classes at schools because we are all confronted with these topics everyday. Most people can work systems such as washing machines, vacuum cleaners and so on, the problems arise when the internet (or other forms of connectability) comes into the picture. But the reality is that most such systems will probably soon be connected in some way, so the challenge grows. So I think it is very important that we push for more information/education instead of going into the direction of more locked down, closed off and proprietary systems because these can easily "not respect" the end user.
- therealx 6y agoI disagree. Anyone with minor observation can get behind a wheel and drive. Will they do it well? No (same with a computer) Is it legal? No, but thats because we all decided that as a group. The danger is different, but I think it's still an interesting analogy. I think we need to all realize that most people aren't cut out for computer science, per se, but most people are cut out to learn to responsibly use a computer.
- wil421 6y agoIf Matthew in accounting received a malicious attachment then IT has already failed.
- arafsheikh 6y agoIf I understand your comment correctly - even though the fingerprints are published, the attacker can still reverse eng the implementation from the tools and bypass antivirus systems at least in the near future?
- mlyle 6y agoSure, but they could already reverse mimikatz; having another implementation from FireEye doesn't really help.
- martinko 6y agoYou don't need to reverse minikatz, it's open source.
- est31 6y agoAlso fingerprints will only stop the lowest level of attackers. You can easily change binaries in a way the fingerprint is changed but the functionality remains the same. Reorder functions, add some garbage data, etc.
- arafsheikh 6y agoThat makes sense. So given that the attacker is technically sophisticated in this case, what are the tangible benefits of publishing the fingerprints? I guess one benefit might be to push the development of new detection techniques to detect the underlying implementation of these tools.
- judge2020 6y agoThe biggest advantage is that it would allow orgs to audit all applications that have been fingerprinted within their org and see if they might have been attacked as well.
- Kalium 6y agoSome of the fingerprints are easily gotten around by fudging the binaries a bit. Others, like snort rules, look at things like network traffic that might not always be so easily disguised.
- pabs3 6y agoWhats your opinion of open source tools and distributions of them (like Kali) in this space and the tradeoff between open sourcing your red team tools vs reimplementing tools that are already out there.
- mike_d 6y agoA vulnerability that is secret is the biggest threat to security. Publishing tools makes them public knowledge that can be defended against. If you are doing penetration testing and basic security work, there is no value in having private tools. It becomes important in red team work because you are trying to emulate a real attacker that has access to non-public tools.
- gen3 6y agoThe point in them re-implementing some of the public tools is so sites like totalvirius or a hash based antivirus does not pick up on what the program is. If they didn’t have a binary that looked reasonably different to those that already exist, then it would instantly get triggered. It is worth noting that there are tools to obfuscate sourcecode/bins.
- lupire 6y ago> Matthew in accounting that will open that invoice attachment so he can pay it. Matthew in accounting shouldn't have permission to run an untrusted binary.
- think814 6y agopresumably he opened a pdf with a zero-day from an untrusted source
- GreenWatermelon 6y agoand that untrusted source could look a lot like his superior's email (boss@c0mpany.com vs boss@company.com) And depending on the resources of the hacker, the email could be stylised just for him, talking about something important that's (perhaps something bad) happening now and the notBoss is telling him to check this months info, and kindly providing him with a pdf that Mathew hastily opens with his latest version of Adobe Acrobat with a zero day vulnerability that hasn't been discovered yet. It could also be literally anything.
- markus_zhang 6y agoYeah agreed, combining social engineering with technical exploits and you can get really good results. I almost fell into one trap myself one day: Basically I was having an argument with a service provider, and somehow I received an email talking about the same type of issue (just high level, without the minute details) with a link attached. I had to check it many times to make sure that it was a fraud email...
- mr_mitm 6y agoPresumably he opened an Office document containing macros. Macros are able to execute system commands and load malicious PowerShell code. Executable files are blocked by pretty much all corporate e-mails systems. Zero-days for PDF viewers are rare. After all, most hacking attacks are things like ransomware campaigns, where everyone is a potential victim and phishing mails are sprayed all over the internet. A zero-day would be burnt pretty quickly. However, many users legitimately need office macros and also need to open office documents to collaborate with contractors or customers. Many times, the phishing mail comes from a legitimate address because the other company has been compromised already. The solution would be to only allow signed macros, but depending on the size of the organization, that can be costly.
- Wowfunhappy 6y agoDoes Matthew in accounting need access to the same network as the engineering staff?
- hangonhn 6y agoAir gap is not the final word in security. Stuxnet got into the Iranian centrifuges despite an air gap.
- Wowfunhappy 6y agoBut only because someone plugged a USB drive into the centrifuge computers. If the networks were air gapped, it wouldn't be Matthew's fault. Someone who had access to the engineering network would need to screw up. Which is of course perfectly possible—engineers make mistakes too. (Furthermore, if they were hacked by a nation state... for all we know it really could have been done without any user action at all.)
- est31 6y agoLikely you want to transfer data from an airgapped computer and back. So you need some way of transferring it.
- Wowfunhappy 6y agoIt’s not obvious to me why engineering and accounting should need to transfer any data and back forth beyond basic email communications.
- hangonhn 6y agoI mean email is a vector too. And remember that 0 day no touch iOS exploit that was discovered by project zero? Surely that could have been vector too. After that use a compromised iOS device to do something similar by exploiting some bluetooth vulnerability.
- 6y ago
- deleted 6y ago[deleted]
- markus_zhang 6y agoAs a layman Mimikatz looks like magic. How did the author figure out where in memory the prints are? This is fascinating stuff.
- hh3k0 6y ago> How did the author figure out where in memory the prints are? Microsoft provided him a nifty protocol for that. > Mimikatz first became a key hacker asset thanks to its ability to exploit an obscure Windows function called WDigest. That feature is designed to make it more convenient for corporate and government Windows users to prove their identity to different applications on their network or on the web; it holds their authentication credentials in memory and automatically reuses them, so they only have to enter their username and password once. While Windows keeps that copy of the user's password encrypted, it also keeps a copy of the secret key to decrypt it handy in memory, too. "It’s like storing a password-protected secret in an email with the password in the same email," Delpy says. https://www.wired.com/story/how-mimikatz-became-go-to-hacker-tool/ https://www.wired.com/story/how-mimikatz-became-go-to-hacker...
- markus_zhang 6y agoAh, thank you very much. I wonder if authentification software of my company uses it, too.
- ChuckMcM 6y agoThat totally makes sense. It also suggests that it could kickstart someone's effort to make their own tools which avoid the signature detector which is sad. A technique we used at Blekko (and hopefully you guys do as well) was logging/tracing statistical traffic flows for normal cluster operations such that we could alert on atypical traffic (which in our case meant something was likely kinda broken but limping along and needed to be fixed/replaced.). We also didn't have to deal with APTs before we were acquired so the stakes were way lower. Agreed that getting hacked is inevitable if the prize is worth it, always interested in adding new ways to instrument the world to detect sniffing or attacks.
- dzhiurgis 6y agoWonder how many of those signatures are suddenly going to light up as existing tools used besides FireEye.
- bluGill 6y agoThe Mathew in accounting is why you have to fill out expense reports. Accounting used to not require them until they started getting fake invoices in the mail. This attack predates the internet.
- cafard 6y agoOr on John Podesta?
- jessmay 6y agoIn your first sentence you say why fingerprinting is bad but then say they did a good job by releasing fingerprints? Am I missing something?