Advanced Data Exfiltration - the way Q would have done it

I f tach Ian Amit | November 2011

www.security-art.comAll rights reserved to Security Art ltd. 2002-2011

Advanced Data ExfiltrationThe way Q would have done it

Iftach Ian AmitVP Consulting

DC9723CSA-IL Board memberIL-CERT Visionary

Wednesday, December 7, 11

http://www.security-art.com


http://2011.brucon.org/index.php/Content#Pushing_in.2C_leaving_a_present.2C_and_pulling_out_without_anybody_noticing_.28Ian_Amit.29




All rights reserved to Security Art ltd. 2002-2011


whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




whoami

2




Agenda

3




Agenda

3




Agenda

3




Agenda

3




4




5




5




5




5




5




6




6




6




6




6




6




6




7




7




7




7




7




7



All rights reserved to Security Art ltd. 2002-2011 8













9




9

• eMails, web links, phishing...




9


• Works like a charm!




9



• And can be mostly automated




9




• SET to the rescue




9




• SET to the rescue




10

And... being nice/nasty/obnoxious/needy always helps!




10





10





10





10





11




11




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




Internet

11

3rd partyYou!

Target




12




12




12




What is the target “willing” to tell about itself?

13





13





13




Who’s your daddy?And buddy, and friends, relatives, colleagues...

14





14





14





14










Select your target wisely

And then craft your payload :-)

16




17




17




17




17




17




• ZeuS: $3000-$5000

• SpyEye: $2500-$4000

• Limbo: $500-$1500

17




• ZeuS: $3000-$5000

• SpyEye: $2500-$4000

• Limbo: $500-$1500

17

FREE!




18




18




18

Experienced travelers know the importance of packing properly




18

Experienced travelers know the importance of packing properly




• File servers

• Databases

• File types

• Gateways (routes)

• Printers

19




20

Mass infection:5-6 days before

detection

APT:5-6 months before

detection




20


detection


detection




20


detection


detection

Frequent updates No* updates* Almost




21

PATIENCEMass infection:5-6 days before

detection


detection

Frequent updates No* updates* Almost




22




22




22




22




22




22




22




23




23




24




24




24




So...

25

-----BEGIN PGP MESSAGE-----Version: GnuPG/MacGPG2 v2.0.14 (Darwin)

hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZpFGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8BfBHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt/gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuSGilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakpTm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfOhdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLeiSyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIGvu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX/vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbTYcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5KgmMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Isqvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI==jN3t-----END PGP MESSAGE-----




Still “too detectable”

26




Still “too detectable”

26

hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZpFGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8BfBHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt/gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuSGilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakpTm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfOhdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLeiSyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIGvu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX/vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbTYcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5KgmMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Isqvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI==jN3t




Much better• Throws in some additional encodings

• And an XOR for old time’s sake

• And we are good to go...

• 0% detection rate

27




Resistance is futile




29




29

80

44353




29

80

44353




Kill some trees

30




31




31




Good ol’e DD...

32




33




33




33

1 0 1 0

1/2 byte=

16 values




33

1 0 1 0

1/2 byte=

16 values




33

1 0 1 0

1/2 byte=

16 values




34




34




34




34




34




34




34




34










1 0 1 0




DEMO

36




DEMO

36




DEMO

36




DEMO

36




DEMO

36




DEMO

36




37




Killing paper isn’t nice• Fax it!

• Most corporations have email-to-fax services

• heard of the address [email protected] ?

• Just send any document (text, doc, pdf) to it and off you go with the data...

38


mailto:[email protected]




Conclusions

39




Conclusions

39




Conclusions

39




Conclusions

39




• Start with the human factor

• Then add technology

40




• Start with the human factor

• Then add technology

40




• Where people leave data

• Hint - spend time with developers.

• “Hack” the business process

• Test, test again, and then test. Follow with a surprise test!

41




• Where people leave data

• Hint - spend time with developers.

• “Hack” the business process

• Test, test again, and then test. Follow with a surprise test!

41




“be true to yourself, not to what you believe things should look like”

Old chinese proverb




“be true to yourself, not to what you believe things should look like”

Old chinese proverb




They are YOUR assetsafter all

No reason to beshy about it...

And remember to add honey...




44




44




44




TEST SOME MORE

For hints/guides see: www.pentest-standard.org


http://www.pentest-standard.org

http://www.pentest-standard.org



Questions?

46

Thank you! Whitepapers:www.security-art.com

Too shy to ask [email protected]

Need your daily chatter?twitter.com/iiamit

Data modulation Exfil POC:http://code.google.com/p/

data-sound-poc/






http://code.google.com/p/data-sound-poc/




Technology

Advanced Data Exfiltration - the way Q would have done it