Combating Spear-phishing: Convergence of Intel, Ops, Forensics, and Vulnerability Management Mr. Billy Rodriguez, GCIH Chief Intrusion Prevention Section Mr. Jacob Stauffer, GCFA, GREM Chief Intrusion Forensics Section
BLUF Air Force networks are constantly under attack Overview of the 33NWS mission Discuss AF vulnerability management Dissect a previous attacks I n t e g r i t y - S e r v i c e - E x c e l l e n c e 2
33 NWS (AFCERT) Vision Air Force network defenders providing Joint War Fighter freedom of action by employing pro-active network defense capabilities. Mission To produce effects for the Air Force and Combatant Commands in, through, and from cyberspace by employing synchronized network defense operations to detect, respond, and prevent network intrusions. I n t e g r i t y - S e r v i c e - E x c e l l e n c e 3
26 NOG Network Defense Team 26 NOS Always On, Always Ready 24x7 AF Network Operations, Support, & Defense 352 NWS Firebirds OPSEC & Force Protection Monitoring, Cyber Data Analysis 68 NWS Purple Dragons OPSEC Monitoring Web Risk Assessment Cyber Battle Damage Assessment Semper Excubia 426 NWS "Committed to Excellence" OPSEC Monitoring OPFOR Analysis Threat Presentation 33NWS (AFCERT) Mighty Griffins 24x7 AF Network Defense -Prevent -Detect -Respond I n t e g r i t y - S e r v i c e - E x c e l l e n c e 4
Partnerships Military USCYBERCOM Army, Navy, Marine CERTs NSA / NTOC Intelligence NSA / NTOC CIA NASIC Law Enforcement AFOSI DHS I n t e g r i t y - S e r v i c e - E x c e l l e n c e 5
Mission Ops Tempo 1400 1287 1272 1200 1000 800 812 906 600 400 200 0 127 204 204 156 59 429 2008 2009 2010 2011 2012 YTD Incidents CAT VIII Investigations I n t e g r i t y - S e r v i c e - E x c e l l e n c e 6
The Threat I n t e g r i t y - S e r v i c e - E x c e l l e n c e 7
Vulnerability Management Risk Management Monitoring Advisories Patch Management Vulnerability Scanning I n t e g r i t y - S e r v i c e - E x c e l l e n c e 8
Risk Management Know your environment and what matters Common questions to ask What systems do you have? What products do you have? Are you affected by each vulnerability? Does every vulnerability receive a critical designation? How do you prioritize? I n t e g r i t y - S e r v i c e - E x c e l l e n c e 9
Advisories What is your central monitoring capability? Threat Advisories Security Tips Tangible Stories I n t e g r i t y - S e r v i c e - E x c e l l e n c e 10
Patch Management How do you receive your patches? Adobe Microsoft Java Workstation A Workstation B Workstation C I n t e g r i t y - S e r v i c e - E x c e l l e n c e 11
Patch Management (cont d) Adobe Microsoft Java Test System Workstation A Workstation B Workstation C I n t e g r i t y - S e r v i c e - E x c e l l e n c e 12
Vulnerability Scanning How do you know your patches are working? Blue Team Red Team Green Team I n t e g r i t y - S e r v i c e - E x c e l l e n c e 13
The last line of defense! Host Based Security X X Protect your host by analyzing the norm and weeding out the unknown. I n t e g r i t y - S e r v i c e - E x c e l l e n c e 14
Why don t you just educate users? I n t e g r i t y - S e r v i c e - E x c e l l e n c e 15
Spear-phishing Supervisor to subordinate Conference Attendance invites Email from Commander to Squadron I n t e g r i t y - S e r v i c e - E x c e l l e n c e 18
Case Study: Vulnerability Acknowledged I n t e g r i t y - S e r v i c e - E x c e l l e n c e 19
Initial Attacks Observed Days later Federal Tax Law Changes for 2010-2017 AV detected and prevented I n t e g r i t y - S e r v i c e - E x c e l l e n c e 20
Additional Attacks Observed 4 Jan 10 Additional attempts observed on Federal Tax Law Changes for 2010-2017 (Version 2) Highly successful Malware had been modified to evade AV Targeted mainly JA/ADC officers Email was forwarded to friends/coworkers/home I n t e g r i t y - S e r v i c e - E x c e l l e n c e 21
Analysis Begins 5 Jan 10 Malware obtained/analyzed 5 Jan 10 Blackhole listed malicious URL s 7 Jan 10 Developed and pushed the Magic Signature 7 Jan 10 Observed alerts on other spear phishing attacks I n t e g r i t y - S e r v i c e - E x c e l l e n c e 22
Even More Attacks 11-15 Jan 10 Observed 5 additional email subjects/attachments OPM Form 71 Request for Leave/Approved Absence (Jan 2010) (11 Jan) MPUC 2010 (12 Jan) China s Evolving Strategic Strike Capability (13 Jan) News Highlights 13-01-2010 (13 Jan) USEUCOM Intelligence Summit (15 Jan) 12 Jan 10 Adobe released patch 13 Jan 10 AFCERT issued critical TCNO I n t e g r i t y - S e r v i c e - E x c e l l e n c e 23
The Magic Signature Step by Step I n t e g r i t y - S e r v i c e - E x c e l l e n c e 24
The malicious PDF was first opened in WinHex followed by a search for an embedded binary
a review for possible code following EOF tags was done nothing suspicious here
plus, a pattern emerged revealing a portion of a rolling XOR key this looked suspicious however
The full XOR key was uncovered. Using the embedded binary as a starting point, the key began with \x00 and continued in descending order with \xff \xfe \xfd \xfc \FB etc, thus revealing the executable A script was written to apply this XOR key to the PDF and the embedded binary was extracted for analysis More importantly, this led to an extremely valuable IDS signature
first, the offet of the malicious binary was noted (in this case 68CF) then the PDF was converted to Base64 since that s the encoding used when sent as a email attachment however, the size difference between the raw PDF and it s Base64 variant had to be factored in
Since the Base64 variant is 125% larger that the raw PDF (chunks of 4 vice chunks of 3), the raw PDF offset of the malicious binary (68CF) was divided by 3 then multiplied by 4 This procedure giving us was (8FBC) repeated twice by adding one and two offsets to the original PDF, in order to account for the three base64 possibilities This revealed the correct offset in the Base64 version of the PDF to create an IDS signature
Questions? Mighty Griffins - 24x7 AF Network Defense I n t e g r i t y - S e r v i c e - E x c e l l e n c e 31
Contact Information Ms Christi Ruiz, 33 NWS/DOU christi.ruiz@us.af.mil Mr Jacob Stauffer, 33NWS/DOUF jacob.stauffer@us.af.mil Mr Billy Rodriguez, 33NWS/DOUP billy.rodriguez@us.af.mil I n t e g r i t y - S e r v i c e - E x c e l l e n c e 32