The document discusses how hackers exfiltrate sensitive data from networks. It describes common exfiltration scenarios used by advanced persistent threats, point of sale malware like BlackPOS, and financial malware like Zeus. These scenarios involve infecting systems, moving laterally through the network, using novel command and control techniques, and extracting data using various transport protocols, encodings, and encryption. The document recommends detecting exfiltration by understanding the targeted data, common data formats, encoding methods, and traffic patterns used by different malware varieties.

1. HOW THEY’RE GETTING THE
DATA OUT OF YOUR NETWORK
Eric Koeppen
IBM X-Force Advanced Research
erkoeppe[at]us[dot]ibm[dot]com
@PorkChop
(v1)
IBM Security Systems | © 2014 IBM Corporation

2. IBM Security Systems | © 2014 IBM Corporation
AGENDA
 Introduction
 Exfiltration Scenarios
– Advanced Persistent Threat (APT)
– Point of Sale (POS) Malware
– Financial Malware
 Conclusion

3. HOW THEY’RE GETTING THE DATA OUT OF YOUR NETWORK:
A SURVEY OF METHODS USED FOR EXFILTRATION OF SENSITIVE DATA,
RECOMMENDATIONS FOR DETECTION AND PROTECTION
IBM Security Systems | © 2014 IBM Corporation
INTRODUCTION

4. IBM Security Systems | © 2014 IBM Corporation
INTRODUCTION
 Initial malware infection often just the first step.
 Data sent to external servers.
 Can have disastrous effects:
– Initial loss of revenue
– Company brand image
– Customer loyalty
– Competitive advantage (trade secrets)
– Subsequent lawsuits

5. HOW THEY’RE GETTING THE DATA OUT OF YOUR NETWORK:
A SURVEY OF METHODS USED FOR EXFILTRATION OF SENSITIVE DATA,
RECOMMENDATIONS FOR DETECTION AND PROTECTION
IBM Security Systems | © 2014 IBM Corporation
EXFILTRATION SCENARIOS

6.  Operation ShadyRAT
– Began 2006 and ran for 5 years
– Targeted over 70 organizations
– Government organizations & private companies
– Multiple infection mechanisms
– Moves laterally through network
– Novel C2 (often used steganography)
– Petabytes of data
IBM Security Systems | © 2014 IBM Corporation
ADVANCED PERSISTENT THREAT

7. IBM Security Systems | © 2014 IBM Corporation
ADVANCED PERSISTENT THREAT

8. IBM Security Systems | © 2014 IBM Corporation
ADVANCED PERSISTENT THREAT
 Detection APT Exfiltration tactics
– Data different for each site
• Data types different
• Data formats different
– Various forms of C2
– Initial connection uses predefined handshake

9. IBM Security Systems | © 2014 IBM Corporation
POINT OF SALE MALWARE
 BlackPOS – the Target attack
– Customer data compromised
• 40 million accounts
• PII data for 70 million
– Initial infection by Trojan
– Periodic memory scraping to collect info

10. IBM Security Systems | © 2014 IBM Corporation
POINT OF SALE MALWARE (SCENARIO 1)

11. IBM Security Systems | © 2014 IBM Corporation
POINT OF SALE MALWARE (SCENARIO 2)

12.  Detection POS Malware Exfiltration
– Leverages different transport protocols/methods
• HTTP Posts, HTTP Gets, HTTPS, FTP,
SMB/NetBIOS, NFS, etc
– Data usually known format:
• Track 1 & 2 credit card information
– Various data encoding techniques:
• Some samples use Ascii or UUencoding
• Some samples use minor obfuscation
• Some samples use encryption
IBM Security Systems | © 2014 IBM Corporation
POINT OF SALE MALWARE

13.  Zeus Banking Trojan
– Many variants
– Has been around for years
– Gameover Zeus variant has accounted for over
$100 million in theft since 2011
– Various techniques:
• Mock up web pages for stealing bank info
• Parsing cookie files for local data-containing files
• Steal digital certificates, local private keys
• Stealing FTP client info and mail client settings
• Parses registry keys for valuable information
IBM Security Systems | © 2014 IBM Corporation
FINANCIALMALWARE

14. IBM Security Systems | © 2014 IBM Corporation
FINANCIALMALWARE (SCENARIO 1)

15. IBM Security Systems | © 2014 IBM Corporation
FINANCIALMALWARE (SCENARIO 2)

16.  Detection Zeus Banking Trojan Exfiltration
– Constantly updating their techniques
– Payload messages hashed, signed, and encrypted
with RC4 encryption
– Can detect the presence of P2P botnet on the
network (Game Over P2P variant)
• Detect P2P keep-alive messages
IBM Security Systems | © 2014 IBM Corporation
FINANCIALMALWARE

17. HOW THEY’RE GETTING THE DATA OUT OF YOUR NETWORK:
A SURVEY OF METHODS USED FOR EXFILTRATION OF SENSITIVE DATA,
RECOMMENDATIONS FOR DETECTION AND PROTECTION
IBM Security Systems | © 2014 IBM Corporation
CONCLUSION

18. IBM Security Systems | © 2014 IBM Corporation
CONCLUSION
– Changing landscape
– Detection based on knowing:
• Which data is being targeted
• What are typical formats for that data
• How that data is being encoded
– When data is encrypted, monitor traffic patterns
– Common practices can go a long way:
• Monitor logs
• Keep patches up to date
• Lock down acceptable communication
• Educate users

19. HOW THEY’RE GETTING THE DATA OUT OF YOUR NETWORK
IBM Security Systems | © 2014 IBM Corporation
Thank You!
Eric Koeppen
IBM X-Force Advanced Research
erkoeppe[at]us[dot]ibm[dot]com
@PorkChop