Hello and welcome to another
application of the modern attack
framework discussion today
we're going to be looking at
external remote services.
This is a particular attack vector
in the initial access phase
of the attack framework.
So today's objectives
are as follows.
We're going to define what external
remote services are so that
we're all on the same page there.
We're going to review Lennix Rabbit
and we're going to review the threat
group, oilrig mitigation
techniques and detection best
practices with respect
to external remote services.
So let's go ahead and jump right
in.
So external
remote services are
manor's in which an organization
can remotely manage or access
otherwise protected systems.
And so in this case, it could
be something like VPN access,
it can be a remote desktop
connection. S.H.
Telnet any service
that would allow a user
to access a system and
perform either business functions
or administrative functions could
be considered a remote service
with respect to this discussion.
And so we've seen time and time
again where things like remote
desktop have been taken advantage of
or an administrator
may accidentally leave something
like S.H.
Open with some weak credentials.
These would all be particular
vectors that an attacker would look
for and would utilize
in order to get that
initial access and then start to
work on compromising a system.
Now, one such tool
that we're going to
review would be Linux, Rabbitt and
Rabut. So in this
particular case, this
malware is installed for the
purpose of mining
cryptocurrency and
it's got the ability to
not carry out an attack in
restricted locations, which
is kind of smart.
So essentially what happens
is, is it's broken into four
main functions.
It establishes command and control
servers using TOR and it
starts to work to set up
persistance.
Now, these phases are pretty
quick in that we're saying it does.
Some command and control activity
sets up persistance using the RC
Local and Basche RC files
does some forseen
and then installs a cryptocurrency
miner. Now, at the
initial points of this, though, if
the geolocation puts it in a
restricted IP range
or a blacklist, that IP range, it
will not do
any of the steps involved.
It'll simply move on to the next
system. So there's some intelligence
built into this thing
and definitely
targeted attacks taking place.
And so I'm going to move
the screen over here for a
moment and show you
the actual entry for the software
on the Monitor website.
Now, as you can see here,
Linux Rabbitt is malware.
As we've already indicated, it was
a campaign that lasted from August
to October of twenty eighteen, which
is when it was primarily active
shares code with another malware
strain known as Rabut.
So again, working
to install cryptocurrency Meiners
into the software and then it breaks
down the techniques used.
So as we said,
the bash and bash are C,
so it maintains persistence on the
fact that machines do that are not
local and bash files.
It will do brute force
S.H. attempts in order to gain
access to the systems.
And so if you've got bought twenty
two listening and
available and it's got weak
credentials, then the primary thing
that this particular
malware was doing was it
would scan IP ranges
and identify that they were not
blacklisted and that they weren't in
a restricted geolocation
on a restricted list.
And then it would work from that
point to
find the list and import twenty
to brute force that
and then send payloads from the
CI to server
to the system to work to then
install the miners
or the crypto miners.
And so this was a very sophisticated
piece of malware in the way that it
was set up and that it didn't
attack certain systems.
And it also
worked pretty much automatically
across the Internet.
So we'll go
ahead and move into
a particular threat group, oil
rig. And so oil rig is
an advanced threat group or an app
that's been noted as having ties to
Iran. They're also known as Apte
thirty four and Helix
Kitten.
Now they primarily target
financial, energy,
chemical and telecommunications
agencies and businesses and
they're primarily known for DNS
tunneling, using tools such as
glimpsing poison, frog and
hypocenter.
So it's important to know
how these
threat actors attack
individuals, what their common
signatures are and what their common
tools are, because then you
as an organization can research
glimpsing poison frog
or hyper shell and then
kind of know what controls
you can implement if DNA tunneling
is being used. Wooderson, some
controls we can implement for DNS
tunneling and understanding how
that looks and how we can detect
that and protect against it.
And so it
makes sense when we're looking at
each of these vectors to understand
how these threat actors have gone
through and commonly attacked
entities and attack systems.
And so that's not to say that
they'll continue to use tools
like poison frog or hyper shell,
but if that is kind of their
signature.
And you could associate that with a
checksum or some type of hash
or some type of signature for that
particular software that
could slow them down and make it a
little bit easier for you to
work to remove them from the system
or at least identify that they're on
a system.
Now, what are some mitigation
techniques when it comes to
remote services?
Well, disable or
remove features is kind of the
number one recommendation.
And it's not disable or remove
features that you
need for business purposes, but
disable or remove features on
systems that don't serve
a function. That way.
It makes the target harder to
infiltrate.
And it may take a little more work
from the threat actor and then it
slows them down and makes it harder
to to kind of move throughout
the network without being noticed,
limit access to resources over
connections such as VPN.
And so
this particular area I've seen time
and time again we get access
to a network via a VPN
connection. But that VPN connection
is not limited to
like a VPN network where it's
just the critical resources
that are necessary to accomplish
one's tasks. It's essentially you
get VPN access into the network
and then you have access to the
entire network. It's relatively
flat.
So if you can limit the access
that remote resources have to
the network and what they can
ping, what they can get into and
what they can use, that can
help to mitigate the ability of a
threat actor to get in and just move
through out the network.
Multifactor authentication is huge
for any administrative account,
any service type account, like an
SSA account, if you can put
multifactor function into place
or at least require multifactor
authentication before you can move
any further in the systems or
software applications, that is great
to have.
Now, we've noted previously and
recently that multifactor
authentication does have its
shortcomings, but.
More times than not, organizations
aren't utilizing multifactor when
they could.
And again, this could help to reduce
the ability of a threat actor to
compromise an account or limit
their capability of moving further
into a network with the account.
So definitely these functions are
available. It would be great to do.
And then, as we said, with VPN
access, network segmentation is
great.
We practice or should practice least
privilege when it comes to
administrative accounts.
We should try to practice at
privilege and what those accounts
could do. Local user accounts,
domain user accounts, same
thing should go for network access.
If a system only needs access
to certain certain areas
or certain servers,
certain software
components, we want to try to
to limit that network access to
what is necessary for that system to
achieve its desired functions
and more that way.
Again, if a threat actor does get
into an organization systems,
it makes it harder to move through
those systems undetected, harder
to move through those systems with
malware and things of that nature.
Typically, as you all know, malware
is typically
tied to the permissions and
capabilities of the systems and
accounts that it takes.
So if that system and its accounts
have full access to everything,
then that malware can usually move
throughout the organization.
Now, some detection, best
practices within this area,
log collection, and
especially those for authentication
logs are very important.
So if you've got a component
in your risk management process or
in your security procedures
and policies that involves log
collection, authentication
logs are important because we can
focus on brute
force attempts, unusual
logging activity, unusual
login attempts like, you know,
generic account login attempts and
things of that nature that malware
or threat actors would normally use
some type of dictionary or some type
of common list, and they'll hit
a system and then roll through that
list. So if we've got a way to
collect those logs and store them
securely, it can help
us to detect when a threat
actor is attempting to access
systems and then potentially allow
us to take action to block that.
And then, of course, as we
mentioned, unusual access attempts
can be like focusing on business
hours. So if the administrator
for a system is
active from 6:00 a.m.
to 6:00 pm
in the afternoon or 6:00 in the
morning, 6:00 in the afternoon,
and then suddenly at 2:00
in the morning at night, you
know, there's some activity from
that account that's unusual or
that's not within the standard
business hour range for that user.
That can be something that would be
abnormal, non-business related
activity that we can then focus on
and try to address.
So let's go ahead and jump in to
a quick check on learning.
True or false, oilrig
is a piece of malware that finds and
installs crypto monitors on
vulnerable systems.
All right. Well, if you need some
additional time to look through
this, please pause the video and go
from there.
So Oilrig is
a HTP
or a threat group or an advanced
persistent threats.
Sorry, and they
might have used something like
Rabbitt or Lennix Rabbitt,
but that was not
a piece of malware that we discussed
here. They are a threat group.
The malware that we discussed and
installs crypto monitors on
vulnerable systems is Linux, Rabbitt
or Raybert.
So in this case, this is a
false statement.
So let's go ahead and jump in to our
summary.
So in summary, today, we defined
what external remote services
are we reviewed?
Linux, Rabbitt and Rabut.
We talked about the threat group
Oilrig.
We reviewed mitigation techniques
and we reviewed some detection
best practices.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.