Top Banner
HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]
50

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

May 28, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

HUNTING THREAT ACTORS WITH TLS CERTIFICATES

MARK PARSONS

DEVELOPER/THREAT ANALYST

KING AND UNION

[email protected]

Page 2: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHO AM I ?

• Formerly - incident responder / network defender

• Currently – developer / threat analyst

Page 3: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHO I AM NOT?

Animator - Archer

Page 4: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

ONE DIRECTION FAN FICTION?

Page 5: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUICK REVIEW

Traditional methods of infrastructure hunting/pivoting using network related resources

Page 6: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PASSIVE DNS (PDNS)

• Historical mappings of domains to IP addresses, and IP addresses to domains

• Some sources of PDNS

• Farsight

• Mnemonic

• RiskIQ/PassiveTotal

• OpenDNS

https://www.dnsdb.info/
http://passivedns.mnemonic.no/
https://www.passivetotal.org/
https://www.opendns.com/
Page 7: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHOIS TRACKING

• Using domain registrant information to look for other potentially related domains

• Sources of trackable WHOIS information

• DomainTools

• Whoisology

• RiskIQ/PassiveTotal

• DomainIQ

• Domain Big Data

https://whois.domaintools.com/
https://whoisology.com/
https://www.passivetotal.org/
https://www.domainiq.com/
http://domainbigdata.com/
Page 8: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHAT ELSE MIGHT PROVIDE TRACKABLE DATA THAT HELPS IN INFRASTRUCTURE HUNTING?

Page 9: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

THAT IS RIGHT TLS CERTIFICATES!!!

Page 10: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUICK CAVEAT

Code signing certificate != TLS certificate

Page 11: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CODE SIGNING CERTIFICATE

Page 12: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE

Page 13: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS HUNTING BASICS

Quick tips to help you get started

Page 14: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

WHERE TO START

• IP to certificate

• Certificate to IP

Page 15: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IP TO CERTIFICATE

What certificates have been seen on 185.12.44.51?

Page 16: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CERTIFICATE TO IP

What IP addresses has a1833c32d5f61d6ef9d1bb0133585112069d770e

been seen on?

Page 17: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

BASIC THINGS TO CONSIDER

Page 18: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

BEGINNING CONSIDERATIONS

• Do you have malware using this TLS certificate?

• How many other IP addresses are seen using that certificate?

Page 19: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TIME FRAME CONSIDERATIONS

• What time frame was a certificate seen on a suspect IP address

• Expiration dates of the certificate

• Not Before

• Not After

Page 20: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CERTIFICATE ISSUER CONSIDERATIONS

• Self Signed

• Free Certificate

• Paid Certificate

Page 21: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

NETWORK DEFENSE

Page 22: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IDS MONITORING – TLS FINGERPRINTS

• Suricata

• Bro

• Snort 3 – external package needed

https://github.com/CERT-Polska/snort3-x509-reputation-plugin
Page 23: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

AUTOMATE TRACKING OF TLS CERTIFICATES

• PassiveTotal Monitoring

• Censys.io API script

• Your own local sonar or censys.io datastore

• Combination of all of these

• Create script(s) to put new IP addresses or certificates found into monitoring or blocks as needed for your environment

https://passivetotal.org/
https://censys.io/
Page 24: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATES YOU SAY?WHERE DO YOU START?

Page 25: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

YOU NEED SOME DATA

Page 26: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

IF YOU DON’T WANT TO SCAN ALL THE THINGS

• You could do any of the following:

• Ingest scans.io sonar SSL scans

• Use censys.io

• Use PassiveTotal

https://scans.io/study/sonar.ssl
https://censys.io/
https://passivetotal.org/
Page 27: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

SCANS.IO SONAR SSL SCANS

• Only on TCP:443

• Raw data going back to 10/30/2013

• Easily consumable

• Updated weekly

• Incremental in nature

• certs.gz - Only new sha1s and base64 raw certificate seen that week

• hosts.gz - SHA1 and host for all hosts seen

• No public search interface

• Is weekly frequent enough ?

https://scans.io
Page 28: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CENSYS.IO

• TLS on TCP:25, 110, 143, 443, 993, 995

• Easy to use search interface

• API Access

• Frequent Updates

• All or nothing in nature

• If there is a delta between scans

• Old scan data is not in main search interface

• Old scan data is available in json format

• Old scan data is available via query interface

https://censys.io/
Page 29: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PASSIVETOTAL

• Merge traditional hunting with new methods

• Aggregates multiple passive DNS sources

• Provides WHOIS data

• Provides references to OpenSource reporting

• Also has TLS certificates

https://passivetotal.org/
Page 30: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

NOW THAT WE HAVE COVERED THE BASICS LETS GO HUNTING

Page 31: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new
Page 32: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

APT 28 / XTUNNEL

• Netzpolotik - Digital Attack on German Parliament

• CrowdStrike – Bears in the Midst

• ESET – Lifting the lid on Sednit

https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
http://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-software-uses/
Page 33: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

STARTING WITH NETZPOLOTIK REPORT

https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
Page 34: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRADITIONAL PASSIVE DNS PIVOTS

Page 35: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE PIVOT ON INITIAL

IP

Page 36: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

LET’S TAKE A CLOSER LOOK AT THE CERTIFICATES

Page 37: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

PIVOT ON 454-CROOKSERVER

CERTIFICATE

Page 38: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new
Page 39: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TIMELINE

Page 40: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

APT 28 XTUNNEL SUMMARY

• Initial report 2 domains, 2 IPs, 1 TLS cert

• Traditional pivots reveal 5 interesting domains

• Now have 38 IPs, 7 domains, 3 TLS certs

Page 41: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRICKBOT

• ThreatGeek – Blog post

http://www.threatgeek.com/2016/10/trickbot-the-dyre-connection.html
Page 42: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

POST HAS SEVERAL ADDRESSES WITH CONNECTIONS TO 443

Page 43: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

INITIAL INDICATORS

Page 44: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TLS CERTIFICATE PIVOT

Page 45: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

MALICIOUS SAMPLES

Page 46: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

TRICKBOT SUMMARY

• Initial indicators 13 IP addresses

• All have common TLS certificate

• 22 new IP addresses

• Malware samples show linkages between IP addresses

Page 47: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CONCLUSION

• Continue to look for new ways to monitor and track infrastructure

• Tracking TLS certificates should be added as part of normal infrastructure hunting

• Processing the data can be an initial steep hill but afterwards it is a green pasture

Page 48: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

THANKS TO THE FOLLOWING PEOPLE

• Ben Koehl

• James Elliott

• David Westcott

Page 49: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

CONTACT INFO

@markpars0nsgithub.com/mpars0ns

[email protected]

Page 50: Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION MARK@KINGANDUNION.COM. ... to put new

QUESTIONS?


Related Documents
SMS PVA: An Underground Service Enabling Threat Actors to ...

SMS PVA: An Underground Service Enabling Threat Actors to...

Category: Documents
CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT...

Category: Documents
MAY 2019 – ISSUE 2 Newsletter - Threat-Arrest … · MAY 2019 – ISSUE 2 Newsletter Cyber-Security Threats and Threat Actors Training Assurance Driven Multi-Layer, end-to-end Simulation

MAY 2019 – ISSUE 2 Newsletter - Threat-Arrest … · MAY....

Category: Documents
CYBER THREATSCAPE REPORT 2018 - Accenture...6 > CYBER THREATSCAPE REPORT 2018 IRANIAN THREAT IS A GROWING FORCE TO BE RECKONED WITH Iran-based threat actors and threat groups are likely

CYBER THREATSCAPE REPORT 2018 - Accenture...6 > CYBER...

Category: Documents
Threat Landscape Snapshot Landscape Snapshot Re… · access trojans and password stealers, nationstate threat actors have been linked to attacks against - government, health and

Threat Landscape Snapshot Landscape Snapshot Re… ·...

Category: Documents
2019-06-26 -Final Risk assessment guidelines and template ... · the capabilities and intent of the threat actors: 3.2.1. Main threat actors • non adversary/accidental threat actor,

2019-06-26 -Final Risk assessment guidelines and template...

Category: Documents
SonicWall 2017 Annual Threat Report FINAL2 · 2 2017 SonicWall Annual Threat Report Introduction 3 Threat Findings from 2016 4 POS Malware Decline 6 SSL/TLS Encryption 7 Exploit Kit

SonicWall 2017 Annual Threat Report FINAL2 · 2 2017...

Category: Documents
THREAT COMPASS - Blueliv...Threat Compass Threat Context provides security teams with continuously updated and intuitive information around threat actors, campaigns, IOCs, malware,

THREAT COMPASS - Blueliv...Threat Compass Threat Context...

Category: Documents
DEPARTMENT OF D S€¦ · aspects of the cyber threat; these include external threat actors, insider threats, supply chain vulnerabilities, and threats to DoD‘s operational ability.

DEPARTMENT OF D S€¦ · aspects of the cyber threat;...

Category: Documents
TLS-450/TLS-450PLUS Consoles

TLS-450/TLS-450PLUS Consoles

Category: Documents
Threat Hunting y simulación de ataques · 2020. 4. 21. · Energy . Possible actors . APT32, APT33, APT34, Dragonfly, Magic Hound, Threat Group- 3390 APT32 is a threat group that

Threat Hunting y simulación de ataques · 2020. 4. 21. ·...

Category: Documents
Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Identifying Mobile Malware and Key Threat Actors …...

Category: Documents