different governmental uses for malware - black hat | home · 2015-05-28 · •different...

38

Upload: others

Post on 08-Jul-2020

1 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 2: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

• Different governmental uses for malware

• Law Enforcement

• Espionage

• Surveillance

• Sabotage

• Warfare

Page 3: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 4: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 5: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Protecting the irreplaceable | f-secure.com

Page 6: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

CosmicDuke

Page 7: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Masking "file.scr"

Page 8: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

• rcs.Заказ.doc

• rcs.18.jpg

• rcs.DSC_1365527283.jpg

CVE-2011-0611

Page 9: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

CosmicDuke remnants• c:\botgenstudio\generations\8f1777b0\bin\Bot.pdb

• d:\production\nitro\sva\generations\809113dd\bin\Bot.pdb

• d:\sva\nitro\botgenstudio\interface\generations\80ddfcc1\bin\Bot.pdb

• D:\PRODUCTION\NITRO\KSK\Generations\70BCDEA1\bin\Bot.pdb

• C:\Projects\NEMESIS\nemesis-gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb

Page 10: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 11: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Havex

Page 12: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 13: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 14: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 15: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Agent.BTZ / Turla / Snake / Uroburos

Page 16: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Turla

Agent.BTZ

Page 17: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Developer Signatures

$Id: event.c 14097 2010-11-01 14:46:27Z gilg $

$Id: mime64.c 12892 2010-06-24 14:31:59Z vlad $

$Id: named_mutex.c 15594 2011-03-18 08:04:09Z gilg $

$Id: nt.c 20719 2012-12-05 12:31:20Z gilg $

$Id: ntsystem.c 19662 2012-07-09 13:17:17Z gilg $

$Id: snake_config.c 5204 2007-01-04 10:28:19Z vlad $

Page 18: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

6es7-315-2 / 6es7-417

Page 19: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Protecting the irreplaceable | f-secure.com

Page 20: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 21: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 22: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 23: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

"There was also some music playing randomly on several of the workstations during the middle of the night with the volume maxed out. I believe it was the american band acdcthunderstruck. It was all very strange and happened very quickly. the attackers also managed to gain root access to the machine they entered from and removed all the logs."

Page 24: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Gauss encryptionmov ecx, (LENGTHOF tToCrypt)-1

mov edx, OFFSET tToCrypt

mov ebx, OFFSET tEncrypt

L1:

mov eax, [edx]

XOR eax, ACDCnot eax

mov [ebx], eax

inc edx

inc EBX

LOOP L1

mov edx, OFFSET tOutEncr

call WriteString

mov edx, OFFSET tEncrypt

call WriteString

call Crlf

ret

Page 25: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 26: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 27: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 28: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 29: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

FinFly

Page 30: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 31: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

UAE, Bahrain, Saudi Arabia, Syria…

• Finfisher (Gamma)

• RCS (Hacking Team)

• DarkComet

• BlackShades

• Xtreme RAT

• Spynet

Page 32: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Image Source: When Governments Hack Opponents: A Look at Actors and Technology, Citizen Lab + ICSI

Page 33: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Page 34: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Hacker Units indside UKUSA intelligence agencies

JTRIG

Page 35: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

THE EYES

• FIVE EYES: USA, UK, Canada, Australia, New Zealand

• NINE EYES: Five Eyes + Denmark, Norway, The Netherlands and France

• FOURTEEN EYES: Nine Eyes + Sweden, Germany, Belgium, Italy and Spain

Page 36: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

• free brokep

FREE Peter Sunde

Page 37: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Geneva Convention

"Legitimate military targets are limited to those objects which by their nature make an effective contribution to military action and whose total or partial destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage"

Page 38: Different governmental uses for malware - Black Hat | Home · 2015-05-28 · •Different governmental uses for malware •Law Enforcement •Espionage •Surveillance •Sabotage

Please fill your feedback form if you havenice things to say. Otherwise, never mind.

Thank You

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Malware & Anti-Malware

1 EnsembleHMD: Accurate Hardware Malware Detectors with ... › ~kkhas001 › pubs › tdsc18.pdf · malware detector. The online detection problem uses a time-series window based

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Windows Malware Firewall: Remove Windows Malware Firewall

Lightweight Behavioral Malware Detection for Windows Platformsspiros/papers/malcon2017a.pdf · Our malware detector uses a simple randomization fea-ture selection technique to increase

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Ch 1: Introducing Windows XP - samsclass.info · Web viewMalware uses the registry for Malware uses the registry for . persistence. Making malware re-start when the system reboots

Technical security at 1&1 - Ruhr University Bochum · Poly- and metamorphic malware and the obfuscation curse 16 18.01.2018 Most modern malware is polymorphic and uses anti-analysis

New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Graph-based Malware Detection Using Dynamic Analysis · Malware frequently uses self-protection measures to thwart debugging and analysis. Ether uses a tactic of zero modification

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Reversing malware analysis trainingpart9 advanced malware analysis

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

procurement.cofc.eduprocurement.cofc.edu/solicitations/docs/CATO CENTER … · Web viewThe withholding requirement applies to every governmental entity that uses a contract ("Using

Healthy foetus- A Global commitment. Role of Governmental and Role of Governmental and Non Governmental Non Governmental Organization in Organization

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

IronNet: Threat Intelligence Brief...project Ĕ Malware and infrastructure associated with the North Korea-linked Kimusky group targeting various think tanks, NGOs (non-governmental

Android Malware Exposed-Evolution of Android Malware

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Metamorphic Malware 1 Metamorphic Malware Research

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Evaluating Open Source Malware Sandboxes with Linux malware

Advanced malware analysis training session6 malware sandbox analysis

Reverse Engineering & Malware Analysis...Malware uses a year old privilege escalation vulnerability (CVE-2016-5195) known as Dirty COW, to gain root access on the mobile . It serves

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

COVID-19 · The malware uses a few layers of packing as well as a multi-sub-process technique to make research more difficult. The malware also uses an information stealing technique,

1 Automated malware audit service Automatischer Malware Audit

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program