Advanced Data Exfiltration The Way Q Would Have Done It

I f tach Ian Amit | November 2011

www.security-art.comAll rights reserved to Security Art ltd. 2002-2011

Advanced Data ExfiltrationThe way Q would have done it

Iftach Ian AmitVP Consulting

DC9723CSA-IL Board memberIL-CERT Visionary

http://www.security-art.com


http://2011.brucon.org/index.php/Content#Pushing_in.2C_leaving_a_present.2C_and_pulling_out_without_anybody_noticing_.28Ian_Amit.29




All rights reserved to Security Art ltd. 2002-2011


whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



whoami

2



Agenda

3



Agenda

3



Agenda

3



Agenda

3



4



5



5



5



5



5



6



6



6



6



6



6



6



7



7



7



7



7



7


All rights reserved to Security Art ltd. 2002-2011 8









9



9

• eMails, web links, phishing...



9


• Works like a charm!



9



• And can be mostly automated



9




• SET to the rescue



9




• SET to the rescue



10

And... being nice/nasty/obnoxious/needy always helps!



10




10




10




10




11



11



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



Internet

11

3rd partyYou!

Target



12



12



12



What is the target “willing” to tell about itself?

13




13




13



Who’s your daddy?And buddy, and friends, relatives, colleagues...

14




14




14




14







Select your target wisely

And then craft your payload :-)

16



17



17



17



17



17



• ZeuS: $3000-$5000

• SpyEye: $2500-$4000

• Limbo: $500-$1500

17



• ZeuS: $3000-$5000

• SpyEye: $2500-$4000

• Limbo: $500-$1500

17

FREE!



18



18



18

Experienced travelers know the importance of packing properly



18

Experienced travelers know the importance of packing properly



• File servers

• Databases

• File types

• Gateways (routes)

• Printers

19



20

Mass infection:5-6 days before

detection

APT:5-6 months before

detection



20


detection


detection



20


detection


detection

Frequent updates No* updates* Almost



21

PATIENCEMass infection:5-6 days before

detection


detection

Frequent updates No* updates* Almost



22



22



22



22



22



22



22



23



23



24



24



24



So...

25

-----BEGIN PGP MESSAGE-----Version: GnuPG/MacGPG2 v2.0.14 (Darwin)

hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZpFGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8BfBHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt/gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuSGilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakpTm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfOhdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLeiSyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIGvu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX/vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbTYcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5KgmMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Isqvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI==jN3t-----END PGP MESSAGE-----



Still “too detectable”

26



Still “too detectable”

26

hQMOA1jQIm6UkL4eEAv/W3r/eYLUmqRNi/Jegt72lK6qdBiBfkg9PZ5YKql9CUZpFGnVk029K3gEVcrA4k7w2aOtP7tYKRF8v4yrZQ9GZ7eXzR7+Tbf1g+7dveH6U8BfBHo8LRovj5OlGghrvpyKYRPIf/NAgzL2G8dyi/FVB0YB4J7/4x0YFEalQHaLiKyt/gkikyV92njPJ6tPm2sdKUqUHSb20r9AdowZ0VVRrWwdRgUhdNXajjwcbH1BjVuSGilw8MnmQkmJAT+TAFkTqC9fjiwtnNMNANJbo2Z36RqsAcKbhVh1eMA7ev0pUakpTm4xN64syk/1DEc0VHFbanAreTV3tCbUUIoPQDFGFpiu3oS6/089oUvRtBBbC5p6leYKEnDllcGWAomRSiYBFWjTca/DIw43QIW/lmdBnwcWLuQmDCmwr3HuhEaOmqfOhdgaxM4GuVdJCDdwXzwpuaPElCd18weH2XNzudLdeRKN+wjl/4D6bIo+038BcLeiSyhWrMFB7mKSmEzQufQUDACFamtMCn9YOo3mgo+YYk505qhIDLNwZXqyVUqOHvIGvu7gzuNwUdY5idLqsGEs0K0xVwYntTKUh61tNS/HDfNTVm4Y3p8M88JHhcg7npY5gJuhWuHkgp2CTsQT+gRjthm3l3AlnIvAfuC5uWLMsjA4sCw2FRDOARxrN9El8maX/vCxN9aB3dK4S9MSGJ5HhaYpTfpc9CdFkFryzb2sFWfW85nSzNo7dVFCy0jmSr19o4Jsfj0J0izS3MeGYYz5NSsfBz+6o/IYURL3OXrm4DuJNHY0DvVbYqSQRRx3o2S+uZekwXwYsqpei/f/sYo875p5NeX3g62zgjy2Vly+n58WaZWoHb5Y0QCxNfpjdcAQ3tuZQaUvlqrkQeSRxKXD7pxlHdwHDgfvw01RU8NsMkfsBoTZY27BjFvIg5S/pv9O6IznXaJu9jRWDj6tvSypx8X2iiVgtSHYahlqEUH1RusAMCILkx0DydCvUud/qRbTYcnkVVgA8ojeDoVpp3AabRrSmgEAOwW6M0KvnSuMKniLIKe7kolqGjEuLAx7s5KgmMHfNki5dYWvQzHv03ID9UG+uW6o54BnsajEVe2EcYTPT+8pg2bCxnMElK0ds9Isqvf2Kx4kqO0qMeJG1II2zfAFqmMiTMtgA2CZ0Y42hA/bQK/CCM8QVo9JcGn3Jf6N0X1TVob7xDo/fkRROHv74dIh2Kxa0SH8iGdb4kI==jN3t



Much better• Throws in some additional encodings

• And an XOR for old time’s sake

• And we are good to go...

• 0% detection rate

27



Resistance is futile



29



29

80

44353



29

80

44353



Kill some trees

30



31



31



Good ol’e DD...

32



33



33



33

1 0 1 0

1/2 byte=

16 values



33

1 0 1 0

1/2 byte=

16 values



33

1 0 1 0

1/2 byte=

16 values



34



34



34



34



34



34



34



34







1 0 1 0



DEMO

36



DEMO

36



DEMO

36



DEMO

36



DEMO

36



DEMO

36



37



Killing paper isn’t nice• Fax it!

• Most corporations have email-to-fax services

• heard of the address [email protected] ?

• Just send any document (text, doc, pdf) to it and off you go with the data...

38

mailto:[email protected]




Conclusions

39



Conclusions

39



Conclusions

39



Conclusions

39



• Start with the human factor

• Then add technology

40



• Start with the human factor

• Then add technology

40



• Where people leave data

• Hint - spend time with developers.

• “Hack” the business process

• Test, test again, and then test. Follow with a surprise test!

41



• Where people leave data

• Hint - spend time with developers.

• “Hack” the business process

• Test, test again, and then test. Follow with a surprise test!

41



“be true to yourself, not to what you believe things should look like”

Old chinese proverb



“be true to yourself, not to what you believe things should look like”

Old chinese proverb



They are YOUR assetsafter all

No reason to beshy about it...

And remember to add honey...



44



44



44



TEST SOME MORE

For hints/guides see: www.pentest-standard.org

http://www.pentest-standard.org

http://www.pentest-standard.org



Questions?

46

Thank you! Whitepapers:www.security-art.com

Too shy to ask [email protected]

Need your daily chatter?twitter.com/iiamit

Data modulation Exfil POC:http://code.google.com/p/

data-sound-poc/





http://code.google.com/p/data-sound-poc/




Advanced Data Exfiltration The Way Q Would Have Done It

Technology

iftach ian

rescueall

1500all rights

targetall

business process

rights reserved

automated

nicenasty