Slide 1

Slide 1 text

大學資安課程 第五週 準備武器階段 Keyboard007

Slide 2

Slide 2 text

經歷介紹 • 證照: – CEH CHFI – Palo Alto Network ACE – McAfee Vulnerability Manager • 經歷: – 協助調查局偵辦第一銀行盜領案 – 建置企業APT防護 – 協助企業資安事件處理 – 世新大學法律二十學分班結業 • 專長: – Incident Response – Penetration Testing & Exploit Research – Malware Analysis – Security Solution Implementation • APT Gateway (TM DDI) • APT Mail (TM DDEI) • APT SandBox (TM DDA) • APT Endpoint (CounterTack MDR)

Slide 3

Slide 3 text

準備武器階段 議程 • 企業防護一覽 • 企業入侵方法論

Slide 4

Slide 4 text

企業防護一覽 4

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Internet FW (External) FW (Internal) IPS Internal Server Farm File Sever AD PC 實體 BOTNET Command & Control1 Hacker Enterprise Hacker 供應鏈及廠商區 WEB Enterprise Cloud DB 一個企業怎麼打(從防護角度) Web WAF IPS Cellopoint Spam Email Server DMZ APT MAIL 行政會計 AV EDR

Slide 8

Slide 8 text

防火牆 Firewall • 第四層 • 第七層

Slide 9

Slide 9 text

入侵防禦系統 I D/P S • SNORT • https://securityonion.net/

Slide 10

Slide 10 text

網頁應用程式防火牆 WAF • 針對網路7層理論中最上層的應用層設計的防火牆,用來針 對在HTTP層的安全攻擊進行過濾與防護,補足僅針對網路 層過濾的傳統防火牆的缺憾。 • 白名單 • 黑名單 • 學習模式

Slide 11

Slide 11 text

垃圾郵件過濾 SPAM • 關鍵字 • 副檔名 • 寄件來源

Slide 12

Slide 12 text

APT Mail / Gateway • 沙箱 • 規則 • 靜態分析 – https://www.one- tab.com/page/QfDZJgsIRn 6mjQXf4MNdLw

Slide 13

Slide 13 text

沙箱繞過與反 分析 • https://github.com/a0rtega/pafish • https://github.com/AlicanAkyol/se ms/ • https://github.com/LordNoteworth y/al-khaser • https://github.com/marcusbotacin/ Anti.Analysis • https://github.com/ricardojrdez/ant i-analysis-tricks • https://github.com/google/sandbo x-attacksurface-analysis-tools

Slide 14

Slide 14 text

Data Sanitization (CDR) • Content Disarm and Reconstruction • 將檔案格式中的每個組成元件拆解,將其中可能執行程式碼 的元件清除,無法清除的部分,則以注入亂數方式使之無法 執行,之後再將各元件重組回既有檔案格式,且相關排版與 基本功能都能正常使用。

Slide 15

Slide 15 text

防毒軟體 Anti-Virus • 特徵碼掃描 • 檔案校驗和法 • 行為分析 • 主動防禦技術

Slide 16

Slide 16 text

1 6

Slide 17

Slide 17 text

NoDistribute Online Virus Scanner Without Result Distribution https://nodistribute.com/

Slide 18

Slide 18 text

EDR and EPP • 『端點』行為分析監控防護

Slide 19

Slide 19 text

企業入侵方法論 19

Slide 20

Slide 20 text

Initial Access • The initial access tactic represents the vectors adversaries use to gain an initial foothold within a network. • 駭客怎麼打進來的方法…

Slide 21

Slide 21 text

T1189 Drive-by Compromise • A drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is targeted for exploitation. This can happen in several ways, but there are a few main components:

Slide 22

Slide 22 text

T1190 Exploit Public-Facing Application • The use of software, data, or commands to take advantage of a weakness in an Internet-facing computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL) , standard services (like SMB or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services. Depending on the flaw being exploited this may include Exploitation for Defense Evasion. • 從企業對外的資產打進去

Slide 23

Slide 23 text

Equifax

Slide 24

Slide 24 text

165詐騙榜

Slide 25

Slide 25 text

T1200 Hardware Additions T1091 Replication Through Removable Media • Computer accessories, computers, or networking hardware may be introduced into a system as a vector to gain execution. While public references of usage by APT groups are scarce, many penetration testers leverage hardware additions for initial access. Commercial and open source products are leveraged with capabilities such as passive network tapping , man-in-the middle encryption breaking , keystroke injection , kernel memory reading via DMA , adding new wireless access to an existing network , and others. • Adversaries may move onto systems, possibly those on disconnected or air- gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.

Slide 26

Slide 26 text

The USB Rubber Ducky The USB Rubber Ducky

Slide 27

Slide 27 text

The LAN Turtle • It is a stealth remote access, network intelligence gathering and man-in-the-middle • Housed within a generic “USB Ethernet Adapter Case”, the LAN turtles appearance allows it to blend into many environments • Drop it on a LAN and access it from anywhere via SSH, Meterpreter and Open VPN.

Slide 28

Slide 28 text

Weapons of a Pentester

Slide 29

Slide 29 text

T1193 Spearphishing Attachment • Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.

Slide 30

Slide 30 text

T1193 Spearphishing Attachment Email vector 接下來是世界APT附件武器大賞…

Slide 31

Slide 31 text

T1193 Spearphishing Attachment • Click to View Content

Slide 32

Slide 32 text

T1193 Spearphishing Attachment • Encrypted/Encoded/Blurred Documents

Slide 33

Slide 33 text

T1193 Spearphishing Attachment • Protected/Secureed Documents

Slide 34

Slide 34 text

T1193 Spearphishing Attachment • Protected by “Anti-Virus”

Slide 35

Slide 35 text

T1193 Spearphishing Attachment • Official Notice/Government Form

Slide 36

Slide 36 text

T1193 Spearphishing Attachment • Created in a newer/older version of Office

Slide 37

Slide 37 text

T1193 Spearphishing Attachment • View on Desktop/Laptop

Slide 38

Slide 38 text

T1193 Spearphishing Attachment • An Error Has Occurred

Slide 39

Slide 39 text

T1193 Spearphishing Attachment • Invoice/Banking

Slide 40

Slide 40 text

T1193 Spearphishing Attachment • Resumes with Ransomware

Slide 41

Slide 41 text

T1193 Spearphishing Attachment • Resumes with Fake Ransomware Dialogs

Slide 42

Slide 42 text

T1193 Spearphishing Attachment • Underarchieving

Slide 43

Slide 43 text

T1193 Spearphishing Attachment • Encrypted Documents

Slide 44

Slide 44 text

T1193 Spearphishing Attachment • Embedded Malware Payloads (Non-Macro Threats)

Slide 45

Slide 45 text

T1193 Spearphishing Attachment • Other Miscellaneous Fak e CredentialPrompt

Slide 46

Slide 46 text

T1193 Spearphishing Attachment Email vector 台灣地區的APT附件武器大賞…

Slide 47

Slide 47 text

台灣地區的… • Doc Exploit + Keylogger

Slide 48

Slide 48 text

台灣地區的… • 針對性MAIL題材 • 常見的反轉字元(RTLO) • 塞入大量NOP繞過檢測

Slide 49

Slide 49 text

台灣地區的… • 高科技題材 • 專打研究單位

Slide 50

Slide 50 text

台灣地區的… TXT轉成 EXE

Slide 51

Slide 51 text

台灣地區的… • 加密附件 • LNK Downloader

Slide 52

Slide 52 text

T1192 Spearphishing Link • Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.

Slide 53

Slide 53 text

T1194 Spearphishing via Service • Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Slide 54

Slide 54 text

T1195 Supply Chain Compromise T1199 Trusted Relationship • Supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: • Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Slide 55

Slide 55 text

Watering hole attack 水坑攻擊 • 在獵物聚集的地方等待目標,選擇目標下手 • 網頁掛馬 SWC (Strategic Web Compromise) – 掛在政府、智庫、論壇、社交、入口網站,目標族群常來訪 – Browser, JavaScript, VBScript, ActiveX, Java, Flash Player – 進階版: EK (Exploit Kit), 惡意廣告 (Malvertisements) • 軟體供應鏈 SCA (Supply Chain Attack) – 文書、影音、系統、企業軟體,有自動更新機制者尤佳 – 攻擊大眾常用軟體公司的 download / update server – 從受害者 IP 中選出真正目標,發動第二階段 targeted attack • https://www.slideshare.net/HacksInTaiwan/hitcon-freetalksupply- chain-attack

Slide 56

Slide 56 text

2011-07 壓縮工具 ALZip • ALZip是壓縮程序,是ALTools的組 件之一,在SK Communications內 部使用。攻擊者利用ALTools Common Module Update Application中的安全漏洞獲 得ALZip更新服務器的訪問權限, 植入指令將更新導向 下載木馬。 • 2010年9月24日註冊了惡意域名 「alyac.org」,該域名 與韓國軟件開發商ESTsoft旗下域名 alyac.com十分相近, 註冊者名叫 Guangming Wang • http://www.solidot.org/story?sid =26199

Slide 57

Slide 57 text

高度選擇性 • 2011-07-18 ALZip update server 被入侵 • 2011-07-25 SK Communication 自動更新僅 SK 用戶 IP 下載才被導向加料版 ALZip • 2011-07-26 入侵 CyWorld, Nate 資料庫 • 2011-07-28 後門放在城邦 – www.cph.com.tw/act/nateon.exe • 2011-08-04 ALZip 官方修補 • 簡體中文惡意程式 PlugX • https://www.commandfive.com/research.ht ml

Slide 58

Slide 58 text

韓國最大社交網站被黑 3500萬用戶資料泄露,台灣居然是駭 客幫兇!? • 韓國約有4900萬人,所以大概超 過一半的韓國人都 GG了 • 因為這次駭客的攻擊活動使用的 Malware 居然Host在某知名出版 集團的城邦網站下。 • http://blog.xecure- lab.com/2011/07/2500.html

Slide 59

Slide 59 text

2013-05 公文電子交換系統 eClient • 政府外包廠商被入侵換置惡意檔 案到檔案管理局 update server 有乖乖更新,都有中獎 • 七千多電腦受害 少數三級(嚴重) 事件 • 遍及所有大小政府單位包括中央 機關、地方機關、市政公 所、醫院、中小學校等。 • 簡體中文惡意程式 • FireFly • https://www.ithome.com.tw/n ode/80581

Slide 60

Slide 60 text

2013-08 播放軟體 KMPlayer • KMPlayer 執行後出現有新版本 • 3.7.0.87 更新訊息,連線至 update server下載偽冒更新程 式(KMP_3.7.0.87.exe) • 有合法數位簽章且當時狀態有效 (非 KMP 原廠) • 簡體中文惡意程式 • PlugX • https://www.ncert.nat.gov.tw/ NoticeAna/anaDetail.do?id=I CST-ANA-2013-0018

Slide 61

Slide 61 text

2013-12 瀏覽器 FireFox 論壇 MozTW • MozTW Forum PhpBB 弱點 • 台灣社群論壇上的下載連結被替換 • 惡意安裝檔 installer.cdn.mozil1a.org • 三天有近七萬下載數量 • 簡體中文惡意程式 • BotFrameWorkV2 • https://www.ptt.cc/bbs/Browsers/ M.1386431194.A.33A.html • https://bugzilla.mozilla.org/show_ bug.cgi?id=947564

Slide 62

Slide 62 text

2014-09 日本文書軟體 Emeditor • 官方網站被入侵,選擇受害者特定 IP 才拿到 惡意程式,共超過一萬次下載 • EmEditor 說,受害者包括日本政府企業 • LINE, 交通省,法務省,JAXA 太空總署等 • 有數位簽章,而且當時有效 (非原廠) • 簡體中文惡意程式 PlugX • http://researchcenter.paloaltonetworks.co m/2014/08/attacks-east-asia-using- google-code-command-control/ • https://www.emeditor.com/general/possi ble-malware-attack-emedidtor-update- checker/

Slide 63

Slide 63 text

2014-12 英雄聯盟 LoL, FIFA 遊戲 • 台灣代理商網站被入侵update server 也被換置,三款熱門遊 戲被加料 • 可能影響數百萬玩家 • 有合法數位簽章(代理商簽的) • 簡體中文惡意程式 PlugX • http://blog.trendmicro.com/trendlabs- security-intelligence/plugx-malware- found-in-official-releases-of-league-of- legends-path-of-exile

Slide 64

Slide 64 text

2015-09 開發工具 XCodeGhost • 翻牆抓蘋果 XCode 速度太慢牆內論壇上的 XCode 被加料 • 編譯出 4000+ 被加料 iOS App包括知名軟件 公司產品WeChat, DiDi 打車, 12306訂票 • 推估影響 1.5 億用戶, • 攻擊者發公告說這只是一個實驗 • Ken Thompson Hack 真實案例 • a C compiler that inserts back-door code when it compiles itself and that code appears nowhere in the source code • https://www.ithome.com.tw/news/99234

Slide 65

Slide 65 text

2017-08 系統工具 CCleaner • 知名系統清理工具官網下載被加料 • 一個多月期間被兩百萬次下載沒有任何防毒軟體偵測到 • 鎖定科技廠商,植入二階段後門,從 github, wordpress 下載後門指令 • 卡巴說後門與 APT17 片段 base64 相似 • http://blog.talosintelligence.com/2017/09/avast- distributes-malware • http://blog.talosintelligence.com/2017/09/ccleaner -c2-concern.html • https://blog.avast.com/avast-threat-labs-analysis- of-ccleaner-incident

Slide 66

Slide 66 text

老闆 你的印章掉了 X海 DXink X華 瑞X

Slide 67

Slide 67 text

資安廠商也可能是目標?!

Slide 68

Slide 68 text

資安軟體本身也可能是資安 漏洞? • 透過防毒主機 update server 派送後門 • 2013 南韓 DarkSeoul 事件 AhnLab PMS • NYTimes, Washington Post 頭條 • 以色列政府入侵 Kaspersky 後發現俄羅斯政府入 侵 Kaspersky 並利用防毒軟體功能偷取美利堅政 府入侵別國用的 NSA TAO 後門工具 • 防毒公司長期用「不會跳警告的病毒碼」,配合 雲端回報機制,了解可疑檔案的in-the-wild 狀況, 調整偵測率以避免誤判。 • 自動上傳可疑樣本功能,原本是為了方便病毒實 驗室採樣分析,例如果偷偷寫一個含有情蒐關鍵 字的 silent signature,用來幹壞事偷私密檔案。 • 美國政府全面禁用 Kaspersky, BestBuy 下架退費 • https://www.washingtonpost.com/world/natio nal-security/israel-hacked-kaspersky-then- tipped-the-nsa-that-its-tools-had-been- breached/2017/10/10/d48ce774-aa95-11e7- 850e-2bdd1236be5d_story.html

Slide 69

Slide 69 text

T1078 Valid Accounts • Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access.

Slide 70

Slide 70 text

撞庫攻擊: 一場需要用戶參與的持久戰 • 『脫褲』 『洗庫』『撞庫』三個環節所進行的活動

Slide 71

Slide 71 text

Credential Reuse Attacks • https://github.com/D4Vinci/Cr 3dOv3r • https://drive.google.com/drive /folders/1gVLL5CRm1ZJa- 6f2vZoEQ1gPYJfOpmOV?usp =sharing

Slide 72

Slide 72 text

Q & A

Slide 73

Slide 73 text

大學資安課程 第十七週 清除軌跡 中芯數據 資深資安顧問 周哲賢

Slide 74

Slide 74 text

清除軌跡 議程 • 資安事件調查 • 清除軌跡方法論

Slide 75

Slide 75 text

資安事件調查 75

Slide 76

Slide 76 text

系統入侵 • 系統異常 • RDP爆破 • SSH爆破 • 主機漏洞

Slide 77

Slide 77 text

Web入侵與資料外洩 Webshell

Slide 78

Slide 78 text

電商勒索 • DDOS • 撈庫

Slide 79

Slide 79 text

DDOS 民意導向DDOS

Slide 80

Slide 80 text

BPC & BEC • 商業流程入侵 (Business Process Compromise) • 商務電子郵件入侵 (Business Email Compromise)

Slide 81

Slide 81 text

資安事件調查方法

Slide 82

Slide 82 text

資安事件調查的流程 • 資安事故(incident)是指對組織資訊作業具有負面影響的事件(event),例如系統 當機、分散式阻斷攻擊(Distributed Denial of Services,簡稱DDoS)、非授權 使用系統、非授權存取資料、執行帶有惡意程式檔案等類型。 – 一、準備(Preparation)階段 – 二、偵測與分析(Detection & Analysis)階段 – 三、控制移除與復原(Containment, Eradication & Recover )階段 – 四、後續活動(Post-Incident Activity)階段 發現 問題 緊急 處理 災難 復原 環境 改造 預防 攻擊

Slide 83

Slide 83 text

資安事件調查思路 • 有什麼異常?(What) • 受害對象是誰?(WHO) • 受害對象在哪?(Where) – XX網段? – 誰能管理? – 如何管理? • 如何受害?(How) • 設想所有可能 • Timeline Analysis • 羅卡定理與時間的交互作用

Slide 84

Slide 84 text

網站駭侵調查思路 • 有LOG: – 網頁平台記錄檔 – 網頁主機其餘服務存取記錄檔 – 檔案時間軸分析 • 沒LOG: – 用入侵網站的思維作研判 – 請參考右圖黑站思路

Slide 85

Slide 85 text

IR Toolkit • https://github.com/diogo-fernan/ir-rescue • activity: – user activity data • disk: – disk data • events: – Windows event logs • filesystem: – data related with NTFS and files • malware: – system data that can be used to spot malware • memory: – the memory • network: – network data • registry: – system and user registry • system: – system-related information • web: – browsing history and caches.

Slide 86

Slide 86 text

LINUX IR • LINUX IR 好文匯整: – https://www.one-tab.com/page/3tLqOfx8T8qkCDp4dDm6_Q

Slide 87

Slide 87 text

macOS IR • TOOL: – KnockKnock – TaskExplorer – Dylib Hijack Scanner – https://objective-see.com/products.html

Slide 88

Slide 88 text

資安事件 調查公司 • 資料來源 ITHOME –https://www.ithom e.com.tw/news/12 3912

Slide 89

Slide 89 text

電腦網路犯罪調查單位 • 法務部調查局 • 刑事警察局

Slide 90

Slide 90 text

主機數位鑑識 硬碟DD • 目的 – 將硬碟以BIT Stream Copy • 工具 – FTK Imager Lite • 功能 – 實體硬碟 (整顆實體硬碟) – 邏輯磁區 (C: / D:)

Slide 91

Slide 91 text

CSI Cyber 網路威脅情資 惡意程式分析平台

Slide 92

Slide 92 text

CSI Cyber 手機鑑識軟體套件

Slide 93

Slide 93 text

CSI Cyber 網路封包分析工具

Slide 94

Slide 94 text

CSI Cyber 手機鑑識設備

Slide 95

Slide 95 text

CSI Cyber APT攻擊與惡意程式偵測軟體

Slide 96

Slide 96 text

CSI Cyber 鑑識工具攜行箱

Slide 97

Slide 97 text

CSI Cyber 電腦主機採證系統

Slide 98

Slide 98 text

專業鑑識軟體 有沒有覺得很像功能很強大的檔案瀏覽器…

Slide 99

Slide 99 text

刑法36章 Example • 第 360 條 無故以電腦程式或其他電磁方式 干擾他人電腦或其相關設備,致生損害於公 眾或他人者,處三年以下有期徒刑、拘役或 科或併科十萬元以下罰金。 • 學術網路印表機暴露在外,大量印廢文 = DOS?!

Slide 100

Slide 100 text

數位證據法律攻防 • 木馬抗辯 • 溢波抗辯 • 思考點 • Chain of custody

Slide 101

Slide 101 text

保留 • 保留

Slide 102

Slide 102 text

清除軌跡方法論 102

Slide 103

Slide 103 text

滅證 • Sdelete • ClearEventLog • https://github.com/Rizer0/Log- killer • https://github.com/hlldz/Invoke- Phant0m

Slide 104

Slide 104 text

Sdelete • https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete • 程式係微軟公司所推出的工具,用途為安全刪除,可透過輸 入參數(-c,-p,-r,-s,-z,-nobanner),針對指定要刪除的檔案進行 磁區抹除。所謂「安全刪除」,係指經該程式刪除後,難以 透過專業軟體復原相數位軌跡。 •-p > 6

Slide 105

Slide 105 text

ClearEventLog https://docs.microsoft.com/en- us/windows/desktop/api/winbase/nf-winbase- cleareventloga

Slide 106

Slide 106 text

Log-killer https://github.com/Rizer0/Log-killer

Slide 107

Slide 107 text

Invoke-Phant0m • https://github.com/hlldz/Invoke- Phant0m

Slide 108

Slide 108 text

No content

Slide 109

Slide 109 text

職業級滅證 • 某一天早上九點半,對外網站完全開不起來… • IR 項目 • History 全清除 • /var/log/* 全清除 • /home/wwroot/* 全清除 (只殘留資料夾) • /etc/ 相關config 全清除

Slide 110

Slide 110 text

Q & A