12 ms·
China state-sponsored cyber actor living off the land to evade detection [pdf]
- cookieperson 3y agoNot a single mention of Linux. Hope the windows community comes together and finds ways to harden these exploits
- supriyo-biswas 3y agoRun a SSH honeypot. You can capture plenty of Linux malware.
- cookieperson 3y agoOh for sure. Just saying in this specific bulletin there's no mention of Linux or macos targets.
- some_random 3y agoYeah lots of really, really low quality malware
- waihtis 3y agothe cynic in me thinks the bad linux activity is there, but the targets do not have any kind of linux monitoring in place to spot activity
- SoftTalker 3y agoIf you're just running a random linux server that isn't an otherwise "interesting" target the only times I've seen those get compromised is by some ludicrously dumb configuration mistakes, such as running databases with a default admin password and no firewall, etc.
- cookieperson 3y agoIt's a less interesting target for a lot of widespread attacks. Consider the surface area of Linux machines vs Windows? Most big corporations run on windows, even if devs rock Linux, that's not usually what these types of attacks are after. That said you are right. Most Linux users ride on insecure machines. I remember talking to someone who had no idea they had to set up a firewall. They had switched from Linux 2 years prior under the guise that it was more secure than windows out of the box. I wish Linux security was talked about more. The people who know how to do it assume everyone does, and the people who don't... don't know what they don't know.
- belltaco 3y agoThere are mentions of Linux right at the beginning: >The actor has leveraged compromised small office/home office (SOHO) network devices as intermediate infrastructure to obscure their activity by having much of the command and control (C2) traffic emanate from local ISPs in the geographic area of the victim. None of those devices are running Windows.
- cookieperson 3y agoAll of the recommendations I saw were based on windows
- supriyo-biswas 3y agoAre LOLBINs still an issue for most companies? I was under the impression that most endpoint detection products simply trace all syscalls, and therefore can somewhat accurately extract information about exploitation events without relying on a "foreign" file artifact.
- waihtis 3y agoit's a needle in the haystack issue. plus most EDR products do not actually alert on benign looking syscalls as it'll quickly cause an false positive overload
- supriyo-biswas 3y agoI would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.) I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either. [1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/ https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...
- some_random 3y agoThey do, it just doesn't work very well.
- waihtis 3y agoThey might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult. A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.
- alephnerd 3y agoSome are working on it (SentinelOne is a notable player with the capacity), but ML domain experience in the Cybersecurity space is severely lacking as a lot of Cybersecurity PMs and Founders are ex-Networking types who view ML/AI as marketing hype. Source: am a PM in the space who has been banging heads with these types of people
- aigoochamna 3y ago"Living off the land" in the context of this document means using readily available command line tools and utilities on infected devices?
- supriyo-biswas 3y agoYes, see for example [1]. [1] https://github.com/LOLBAS-Project/LOLBAS https://github.com/LOLBAS-Project/LOLBAS
- aigoochamna 3y agoThanks, that makes more sense. Reading the document as an outsider was confusing :p For a minute, I was worried there were some crazy nationalistic Chinese dudes living in the woods behind my house.
- rolph 3y agosummary pgh 3 [One of the actor’s primary tactics, techniques, and procedures (TTPs) is living off the land, which uses built-in network administration tools to perform their objectives. This TTP allows the actor to evade detection by blending in with normal Windows system and network activities, avoid endpoint detection and response (EDR) products that would alert on the introduction of third-party applications to the host, and limit the amount of activity that is captured in default logging configurations. Some of the built-in tools this actor uses are: wmic , ntdsutil , netsh , and PowerShell .]
- fredgrott 3y agoNo mention of Unix, MacOSX, or Linux. Is there an un-equal hardening of such tools or is it more of the popularity of MS Windows in the marketplace?
- waihtis 3y agoFor the Linux variant of LOLBINs, see GTFOBINS https://gtfobins.github.io/ https://gtfobins.github.io/
- _8j50 3y agoOh wow, so living off the land is the same as "hands-on-keyboard" activity now? They used impacket ffs! This is a very typical post-compromise playbook many actors use. A lot of this might even be considered bad opsec. This is why it is said that APTs are usually not very sophisticated, they just have a lot of resources.
- pphysch 3y agoYeah, this seems like a classic case of "random mundane thing" + "namedrop China" = "srs bsns" + someone getting promoted
- yellow_lead 3y agoI believe even an expert security researcher would have a hard time using windows as a personal machine without getting hacked. There are so many attack vectors and the security updates+guidance from Microsoft is completely lacking.
- mmastrac 3y agoMost serious security researchers use an airgapped laptop with a wireless card pulled or otherwise disabled. There's far fewer ways to compromise a laptop where the only comms are on a USB stick physically transported between two computers, though it's not necessarily impossible.
- hnthrowaway0315 3y agoI heard that IoT devices can be (and were) exploited in the same way and used in DDoS attacks. Fascinating work on both sides for $laymen.
- WhereIsTheTruth 3y ago[flagged]
- alexeldeib 3y agoHere I thought this was about human spies on US soil avoiding leaving a digital trace of their real identities…
- ssss11 3y agoMaybe it should be called living on the sand (silicon) instead
- WhereIsTheTruth 3y ago> Is China doing the same kind of spying on CIA agents? > If so, then it's nothing new Is this really warrants getting flagged? care to explain?
- phendrenad2 3y agoThis is not about CCP spies setting up a tent in the wilderness and using public wifi to launch hacks, this is about "living off the land" meaning using existing system admin tools to hack systems. Although the other explanation would be more cyberpunk.
- ransackdev 3y agoIrony; NSA, CISA, and DOJ release cybersecurity bulletin as a pdf attachment
- red-iron-pine 3y agoIf you're concerned about LOLBINs then you're the kind of person they want to get to open a random pdf...