Downloaded 106 times
![whoweare
Based in Taiwan
Interests in Computer Forensics
Access to some raw network traffic data (fun!)
Get to fish interesting things (PROFFFIIITT!)
@bensonwu [secret] @fygrave
[censored]
3](https://image.slidesharecdn.com/bh2013-final-release-130821085435-phpapp02/75/Hunting-The-Shadows-In-Depth-Analysis-of-Escalated-APT-Attacks-3-2048.jpg)
Uploaded byF _
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
This document analyzes advanced persistent threat (APT) attacks targeting Taiwan, focusing on the "Lstudio" group. It describes the group's infrastructure including command and control servers, use of botnets to control thousands of compromised machines internationally, and development of custom tools. The summary highlights key points about the group's operations since 2007, use of multiple software versions and back-ends, and targeting of both government and private sector victims primarily in Taiwan but also worldwide.
More Related Content
![Layakk - Atacando 3G Vol. 2 [rootedvlc2]](https://cdn.slidesharecdn.com/ss_thumbnails/rootedvlc-layakk-150917145421-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
Hunting The Shadows: In Depth Analysis of Escalated APT Attacks
- 1. Hunting the Shadows: InDepth Analysis of Escalated APT Attacks Fyodor Yarochkin, Academia Sinica Pei Kan PK Tsung, Academia Sinica Ming-Chang Jeremy Chiu, Xecure Lab Ming-Wei Benson Wu, Xecure Lab 1
- 2. Agenda • Why Taiwan? •The “Lstudio” player… fun • Taking a peek at Weaponry • APT in a Cloud • Victimology or … chicken-logy? 2
- 3. whoweare Based in Taiwan Interestsin Computer Forensics Access to some raw network traffic data (fun!) Get to fish interesting things (PROFFFIIITT!) @bensonwu [secret] @fygrave [censored] 3
- 4. Disclaimer A few wordsbefore we move on. - With this research we are primarily interested in understanding the Ops and victims of discussed targeted attacks. We DO NOT attempt to perform any attribution of potential attackers. 4
- 5. Taiwan has beena frontline of APT battlefield for some time 5
- 6. Many interesting thingscould be observed (though this is not “Lstudio” group) 6
- 7. Elirks: earlier campaign Reported by Dell/Secureworks as Elirks http://www.secureworks.com/cyber-threat- intelligence/threats/chasing_apt/ 7
- 8.
- 9. Elirks 2.0 –silly to reuse the address-space Managed by the same IP addresses (easy to cross-correlate) 9
- 10. Another on-going Campaign On-going: 10
- 11. On average, 48APT emails a week! 11
- 12. The “Lstudio” group: Exploringfun things in a greater detail :) 12
- 13. They start witha boring spearphhiiissh 13
- 14.
- 15. The APT Landscapein Taiwan 15
- 16. We’ll examine the“LStudio” group today • Unique indicators of the “LStudio” group: • Debug symbols (.pdb) • “horse” label and generator tag • Some curious discoveries from the “Lstudio” backend data center … ;-) 16
- 17. LStudio binaries havecute things CSJ-Elise f:toolscodeCSJEliseReleaseEliseDLL.pdb http://scan.xecure-lab.com 17
- 18.
- 19.
- 20.
- 21.
- 22. “Lstudio” payload Generator Generator Owner HorseLabel Generator-Tag APT Exploit delivery via email 22
- 23. We don’t sayvictim 肉雞 = G 23
- 24. The typical botnetmodel 24
- 25.
- 26. APT advanced farming:) Operated by roughly 25 “farmers” Has controlled over 5,884 machines International coverage over 30 countries Utilizes 4 different Botnet software families Active since 2007 26
- 27. The “Lstudio” ChickenCloud APT Cloud Backend Data Center Farmer Boss? Farmer Group B Farmer Group ACommand Channel (Second phase backdoor) Data Channel (First phase backdoor) Configurable Bounce APT Botnet A 27 APT Botnet B
- 28. .. And whoare the Chicken ?! 28
- 29. International Chicken FarmCorp. 29
- 30. chicken farms wentinternational TW 84% US 6% 5,884 chickens 2% 30 KR 1% CN 1%
- 31. Share some Chicken 31 http://www.appledaily.com.tw/ http://www.cna.com.tw KMT ? KMT ?
- 32. When you travel,your chicken travel too… 32
- 33. Lets look atsome travelers 33 US Canada France England Taiwan
- 34.
- 35. .. do have9 to 5 job ;)… 35
- 36. Just like somesecurity researchers do 36
- 37. AND THE LAST.. SOME HANDY TOOLS TO SHARE 37
- 38.
- 39. Yara: a swiss-knifeof static sigs ;) 39
- 40. Yara use Easy tointegrate with your scripts Integration with a proxy server is possible via icap yara plugin: https://github.com/fygrave/c_icap_yara Raw network traffic monitoring project (and http/DNS indexing): https://github.com/fygrave/eyepkflow 40
- 41. More cool tools Molochhttps://github.com/aol/moloch Yara mail https://github.com/kevthehermit/yaraMail Yara pcap https://github.com/kevthehermit/YaraPcap 41
- 42. Conclusions Complex infrastructure Operates since2007 Multiple software versions Multiple back-ends Victims – government and private sector Mainly Taiwan but also seen world-wide 42
- 43.
Editor's Notes
- #20 整體設計上Elise，將摒棄現行概念底盤以鋁合金打造、車身鈑件也大量採用碳纖維材質的Elise全車重僅1095公斤，而在Lotus的規劃下，未來Elise將搭載擁有約320匹馬力輸出之2.0升四缸引擎。從近來幾部全新發表的Lotus之上，我們能夠看見新一代Lotus係採用源自"鯊魚"的設計概念，並隨著各車型與定位著不同，而各自發展屬於單一車型的獨特風格，而在Elise之上我們也能看見更多銳利的線條與充滿殺氣的勾勒樂手法，以營造出Elise特別的霸氣！ http://cool3c.incar.tw/article/34399