Blackhat - Do you trust your Threat Intelligence

1. © 2019 AT&T IntellectualProperty. AT&T, Globe logo, andDIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliated companies. Allother marksare the property oftheir respectve owners.
Do you trust your
threat intelligence?
Black Hat 2019
Christopher Doman, Principle Informaton Security Engineer, AT&T Alien Labs - @chrisdoman

2. 2 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Atackers are watching
• A blog post was published September 2017 on how to track APT28
• Immediately, the group was harder to follow
“ . . . a [blog] post
burning the few tracking
methods we have, likely
for PR over substance”
@safronsec, 2018

3. 3 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Some groups
disappear quickly

4. 4 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Some disappear more slowly
APT1 report released
February 18, 2013
Old infrastructure New infrastructure
See “M-Trends 2014”, FireEye for more informaton
66.79.165.154
208.44.242.107

5. 5 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Did group members contnue in other groups?
See “APT1 & putter panda: collaboration or a shared contractor?”, PwC / @tlansec for more information
Barkiofork / APT1 Matchaldru / Puter Panda
hgcurtain.com

6. 6 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Or digital quartermasters?
See "A Detailed Examinaton of the Siesta Campaign", FireEye March 2014 for more informaton
Poison Ivy / APT1 Poison Ivy / APT10
Shared Icon
fb080cef60846...
PDF

7. 7 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
“The mysterious return of years-old malware” in 2018?
Malware author known as "feng_911" (2006-09-22), Babyface Backdoor
htp://read.pudn.com/downloads62/sourcecode/hack/trojan/215589/SRC/Client/ClientDlg.cpp__.htm

8. 8 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Some like atenton

9. 9 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Some don’t
like atenton

10. 10 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Atackers watch platorms too

11. 11 © 2019 AT&T Intellectual Property. AT&T, Globe logo, andDIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliated companies. Allother marksare the property oftheir respectve owners.
So, can you trust sharing partners?

12. 12 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Example sharing platorm: VirusTotal
User uploads sample
of new malware
to VirusTotal
If Vendor B
doesn’t detect
the malware
They get a hint to
write a new
signature
Vendor A writes
signature for new
malware
> > >

13. 13 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Theoretcal atack demonstrated
Create benign
binaries and write
own signatures
See “On the way to beter testng” by Kaspersky
Submit to
VirusTotal
The binaries are
initally detected by
just your engine
Over 20 vendors
then start detectng
as malicious too
> > >

14. 14 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Sophistcated atack seen in the wild
Take multple
versions of benign
binaries
Insert “known bad
fragments” to
benign binaries
Submit to
VirusTotal
Watch false
positves cascade
> > >

15. 15 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Non-sharing vendors kicked out of VirusTotal
“There are a number of endpoint products that use
VirusTotal to determine if a fle is malicious.
Without any contributon to the community.
Without giving anything in return.”
Alex Eckelberry, 2016
A. Eckelberry (2017-05-04), "A BOMB JUST DROPPED IN ENDPOINT SECURITY… AND I’M NOT SURE ANYONE NOTICED"
Retreived from htp://blog.eckelberry.com/a-bomb-just-dropped-in-endpoint-security-and-im-not-sure-anyone-notced/

16. 16 © 2019 AT&T Intellectual Property. AT&T, Globe logo, andDIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliated companies. Allother marksare the property oftheir respectve owners.
Should you share atack code?

17. 17 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Hidden Tear, should it have been shared?
Open source ransomware shared for "educatonal use"
v1

18. 18 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Hidden Tear, should it have been shared?
Author retrieves victms
fles using a backdoor
13-year-old removes
the backdoor
3
Blackmailed into taking down code
“I’m sorry. I failed this tme.”
Now . . .
v2 v3

19. 19 © 2019 AT&T Intellectual Property. AT&T, Globe logo, andDIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliated companies. Allother marksare the property oftheir respectve owners.
Can your SOC trust open source informaton?

20. 20 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Don’t trust everything you read online
“First Law of Thermodynamics”, Wikipedia
Retrieved from htps://en.wikipedia.org/wiki/First_law_of_thermodynamics
Creatve Commons Atributon-ShareAlike

21. 21 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Whitelists

22. 22 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Whitelists / warning lists
Cisco Umbrella misp-warninglistsTM

23. 23 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
DIY IPv4 whitelists
Domain Whitelist IPv4 /24

24. 24 © 2019 AT&T Intellectual Property. AT&T, Globe logo, andDIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliated companies. Allother marksare the property oftheir respectve owners.
Future threat intelligence sharing

25. 25 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Building a domain oracle using
AI machine learning xgboost

26. 26 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Automated indicator generaton
Malware
sample
Domains
from
sandbox
Domain
Oracle> >

27. 27 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
Automated
indicator
pivots?

28. 28 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
New types of sharing — JA3
See “JA3 Fingerprints”, https://sslbl.abuse.ch/ja3-fingerprints/ for more informaton

29. 29 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
New types of sharing — Sigma
See “Sigma”, https://github.com/Neo23x0/sigma/ for more informaton

30. 30 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
New types of sharing - OsQuery

31. 31 © 2019 AT&T IntellectualProperty. AT&T, Globe logo, and DIRECTV are registeredtrademarksandservice marks of
AT&T IntellectualPropertyand/or AT&T afliatedcompanies. Allother marksare the propertyof their respectve owners.
In summary . . .
Share how to detect,
but be careful sharing how to track
Trust your sharing partners,
but verify their data
Lots of room for automaton,
but manual verifcaton is stll needed