Hello and welcome to another
application of the Mannatech
framework discussion today,
we're going to be looking at audio
capture.
So the objectives of today's
discussion are pretty
straightforward.
We're going to describe what audio
capture is in its very short
description.
We're going to look at some mitigation
techniques, detection techniques,
and then we've got a piece of
malware or a tool that we're going
to fill in between these two areas.
Now, audio capture
is essentially when a threat
actor uses computer devices
such as microphones, webcams
or applications such as voice
or video calls to
capture audio recordings.
And this is in the hopes that
sensitive information can be
collected. And so those nifty little
webcam covers.
And for those of us that are
paranoid enough to unplug our
microphones and things of that
nature when they're not in use, this
is for you.
Now, there is
a one of many pieces
of malware out there called
Vanderhook. And so this is a
commercially available rap.
It's written in Delfi and it's got
some different capabilities.
And so it has the ability to capture
audio.
It can spawn Windows Command.
Shell has the ability to conduct key
logging and it can replace
IEEE Explorer
with a bandha payload
and it can capture information from
the victim's webcam.
I've seen a number of other
tool sets and things of that nature
that you can use in a similar
fashion.
Typically, you're not one for one
where you have a piece of malware
that is just for
audio capture or video capture.
They're typically multifaceted
pieces of malware
now, something
that you're going to see often
as we get into the later portions
of the framework.
And what we're going to be looking
at is that there aren't
a lot of mitigating
factors. Now, there are things like
network intrusion prevention that
you can use to help kind of identify
threat actor activities
and do things of that nature.
But in some cases, due to the way
that these vectors work,
it's not easy to detect the
threat actor in the act of actually
doing some of those things.
And so for those areas, we're
just going to indicate that end user
awareness training to reduce
the risk of infection is going to be
one of our primary mitigating
factors. If you don't get an
infection, if you don't fall
for the phishing email, if you don't
try to download the
free version of software.
Chances are you can avoid a lot of
risk that would eventually lead
to these types of infections.
Now, detection
techniques in this case are going to
be looking for unusual processes
accessing APIs associated
with devices or software that
interact with peripheral devices,
being like window API and
things of that nature.
They're calling for microphones
or webcams, and we're not actually
actively using those devices.
And so there are some things that we
can do to potentially detect
activity associated with listening
in on these devices.
But again, that would likely have
to be correlated with a broader set
of data in order to
validate whether or not we actually
have a threat. Actor on the network.
Now, let's do a quick
chat on learning.
True or false audio capture is
when the microphone on a system
captures sound.
All right, well, if you need some
additional time, please pause the
video. So in the instance of this
statement, audio captured is
when sound or system sound is
captured with the microphone.
And so this
is a true statement.
You may have thought, OK, well, it
is also when a webcam
captures video and things of that
nature. Yes, that is true as well.
But in the context of this
statement, audio capture is when the
microphone on the system captures
audio. That is a true statement
as well.
So let's go ahead and pop over to
the summary for today's discussion.
So we looked at audio capture
again at a high level, just within
moderate's when we capture audio,
webcam information, other
application types of information
in the hopes of finding the
secret secret source that will help
us to either make money or get a leg
up. We also looked at Mandu Care
in the middle again, remote access,
Trojan, multifaceted, got
a few things that it can do with
audio capture video being one
of those things.
Again, mitigation techniques in
this case are really going to be
limited to end
user awareness training.
And so really being able to spot
and identify the threat and raise
the flag is going to be important
here. And really, that's
going to be what helps you to
mitigate the risk of these
threat actors being able to get to
this point.
And then we looked at detection
techniques, really looking for
unusual calls, unusual
activity that would be associated
with webcams and microphones.
So with that in mind, I want
to thank you for your time today,
and I look forward to seeing you
again soon.