Weaponizing Intelligence: Interdiction in Today’s Threat Landscape

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Matthew Olney
Weaponizing Intelligence:
Interdiction in Today’s Threat Landscape
SP01-W11
Man...

Matthew Olney
Talos Threat Intelligence & Interdiction Group
WEAPONIZING INTELLIGENCE
INTERDICTION IN TODAY’S THREAT LANDS...

Matthew Olney
Manager of Threat Intelligence and Interdiction
11 Years with Sourcefire VRT and Cisco Talos
Prior to that 1...

250+
Full Time Threat
Intel Researchers
MILLIONS
Of Telemetry
Agents
4
Global Data
Centers
1100+
Threat Traps
100+
Threat ...

“Interdiction is a military term for the act of delaying, disrupting,
or destroying enemy forces or supplies en route to t...

Easy
• ISAC (Information Sharing
and Analysis Center)
• Industry, National and
Multinational CERTs
• Internet Service Prov...

“It seems like they
gave up after about 4
days of 2-3 orders a
day. We have not
seen any order
attempts since 5/15.
Thanks...

INTERDICTION CASE STUDY #1:
SAMSAM & JBOSS

CVE-2007-1036
• “…JBoss does not restrict access to the console
and web management interfaces…”
CVE-2010-0738
• “The JMX-C...

“João Filho Matos Figueiredo, what did you do?”
– João’s mother, probably
JEXBOSS

• Telemetry indicates
December, 2015 start date
• Network-wide ransomware
attack
• Ransom paid via Bitcoin
SAMSAM
• Seen i...

Preliminary blog post:
• Samsam: The Doctor Will See You, After He Pays The Ransom
Research: How bad is this JBoss problem...

Day X
• JexBoss Invocation &
JBossAss backdoor installation
X+47 Days
• File Upload Installed on web
server
X+49 Days
• Fu...

• There is a window between shell installation and file encryption
• I dramatically fail at math and also manage to undere...

2104
Shells
1575
Unique IPs
88
Countries

http://<Jboss IP address>/status

http://<Jboss IP address>/status&full=true

2,176
Uniquely-named shells

Almost 2000 notifications
• Intel partners
• Sales staff
• 20 Talos researchers
• 2 Weeks
Samples gathered
• IR specialist...

• IR received a SAMSAM engagement from an unmarked IP address
• Could be SSL on 443
• Or, fairly often, on port 8080
• Run...

2,104
New targets
625
New backdoor IPs

• Notified servers not 100% remediated
• Actors continue to attack JBOSS servers
• Working with LEO
JBOSS – THE SAGA CONTI...

Floki Bot Strikes
Talos, Flashpoint and FIRST

WHAT IS FLOKI BOT?

IDA Pro
FIRST – FIRST-PLUGIN.US
Function Identification
and Recovery Signature Tool
Streamline code research
• Prevent dup...

IDA Pro
FIRST SYSTEM OVERVIEW
Check for Metadata
56 6A 0C 6A 01 E8 64 AB 00 00
Add Function Metadata
Name / Prototype / Co...

sub_401000
--------------------------------------------------
56 6a 0c 6a 01 e8 64 ab 00 00 8b f0 8b 44 24 10 89
46 04 8b ...

BEFORE AND AFTER FIRST

USING FIRST TO ANALYZE FLOKI BOT

TOR SUPPORT

COLLABORATION WITH FLASHPOINT

CUSTOMER SERVICE IS IMPORTANT

TAKEAWAYS

WHAT SHOULD YOU DO?
• There is more to defense than just what happens on your network
• Demand that your information secur...

Q&A

talosintelligence.com
@talossecurity
@kpyke

INTELLIGENCE COMMUNITIES
Project Aspis – collaboration between Talos and host providers
• Talos provides expertise and res...

#RSAC

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 38 Ad

View on Slideshare

1 of 38 Ad