Alchemy Security Consulting

Conti Group - Tooling, Leaks and Russian FSB Ties - Cyber Security Consultants - Alchemy

Will — Fri, 11 Mar 2022 05:00:00 GMT

The Conti group have been featured across many news outlets lately both inside and outside the cyber security community. It is well known that this specific threat actor is mainly operated from within Russia, and with the recent events within Russia and Ukraine we thought it would be a good idea to do a recap on this treat actor group. In this post we’ll aim to cover some of the tooling utilized by the threat actor as well as their involvement within the recent Russia and Ukraine conflict.

We encounter this group on a regular basis through our Managed Detection and Response service, and our incident response engagements. This threat actor behaves much like a business with a broad range of internal resources and departments to leverage as part of their ransomware service.

While there are a broad range of publicly available Indicators Of Compromise (IOCs) for this threat actor, we will cover some of the tooling we have seen them used recently which will typically fly under the radar of common security controls.

Conti Group and Critical Infrastructure

As a group Conti makes their money through their ransomware service, once they have gained access to an environment with elevated privileges, they will rapidly look to destroy backups before deploying their ransomware to as many machines as possible. Besides operating more as a business rather than a typical hacker group, they also attempt to ensure their attacks do not impact critical infrastructure. While critical infrastructure typically includes power grids and utilities, Conti are mainly referring to health care infrastructure such as hospitals.

However, with the recent conflict in Ukraine Conti have thrown their support behind Russia by publicly stating they will proactively target the critical infrastructure of countries that get involved with the conflict through cyber-attacks against Russia.

Conti's public announcement around critical infrastructure.

With this specific threat actor being so successful against targets around the world, especially in Australia, it is important to understand the TTPs associated with this threat actor to better defend against them. This is especially important if your business or environment is considered critical infrastructure.

Russian Federal Security Service (FSB) Ties

It has been long suspected that certain crime groups operating out of Russia have had various levels of support from their government. While there isn’t a lot of publicly available concrete evidence to suggest this is the case, documents have been leaked by a Ukrainian within the Conti group that suggests Conti have ties to the Russian Fedaral Security Service.

The below screenshot is from a Conti Jabber conversation where they discuss having gained access to some information detailing correspondence between the victim and the journalism organisation Bellingcat.

Translated conversation within the Conti group discussing FSB ties. Translated conversation within the Conti group discussing Navalny.

Of particular interest is the mention of Navalny and FSB within the same chat log, this does seem to suggest that to an extent Conti has a connection or contact at the FSB, how far this relationship goes is yet to be seen.

Tools, Techniques and Processes

The Conti group utilize a broadrange of Tools, Techniques and Processes. We are going to take this opportunity to briefly recap on some of the most common TTPs utilized by the group. As part of this we are also going to touch one some ‘greyware’, legitimate applications utilized by the crew to achieve persistence without raising the suspension of security controls.

Trickbot

Trickbot has been around since 2016, originally only observed being utilized by APT group Wizard Spider. This piece of malware is a feature rich application that provides the threat actor with a huge range of capabilities to facilitate persistence, lateral movement, and enumeration activities.

Emotet

Emotet has been operating since 2014 and was typically classified as a banking trojan and spread through broad phishing campaigns. This malware is typically used by groups as a deployment mechanism. Once the malware has successfully executed on an endpoint, the operator can distribute other malware such as Trickbot and Cobalt Strike.

Cobalt Strike

Cobalt Strike is an Adversary Simulation and Red Team Operations tool built for security teams and penetration testers to easily simulate an advanced threat. Think of this tool as a commercial command and control application. Unfortunately, even though Cobalt Strike perform diligent background checks on all of their customers, the application has been leaked multiple times and is now a staple tool for the Conti group.

Cobalt Strike console screenshot.

Greyware

In recent attacks we have noticed a significant shift in Conti’s tradecraft where they have adopted the use of legitimate tooling for both persistence and command and control. This includes utilizing applications that have legitimate real-world purposes such as applications commonly utilized by developers and Managed Service Providers (MSPs).

These applications will typically go unnoticed by most security controls purely because they are a legitimate application used by a huge number of legitimate businesses globally. While controls such as Endpoint Detection and Response (EDRs) will likely generate an alert that this is a potential risk, they typically do not prevent the application from executing.

Atera

Atera is a remote management tool developed for MSPs to allow them to easily support their customers through the remote management capabilities of the Atera application. While the technique of using remote access tools for persistence or command and control is not new, the licensing model of Atera resonates with Conti’s processes like no other. Typically, once the group has administrative access within an environment they will register for an Atera instance utilizing a public email address aligned to the internal domain name of the compromised environment. While it is not clear whether the group utilises a free trial for their entire engagement, Atera is licensed per consultant. This means they can essentially deploy the tool across an entire environment without running into any ‘per machine’ licensing issues.

Atera remote management tool screenshot.

NGROK

Ngrok is a tool that once installed on a machine can be configured to expose a service on the host to the internet. This is done by tunneling the network traffic over HTTPS to the Ngrok service, where Ngrok then provide a url and port that the user can hit to access the desired service.

Conti typically utilize this service to expose remote access protocols such as Remote Desktop Protocol (RDP). This allows them to gain a RDP session on a host that typically is not directly exposed to the internet and makes it easier for them to perform lateral movement.

The process that allows users to tunnel traffic utilising NGROK.

Crosstec Remote Control

CrossTec is a tool that is very similar to Atera in that it is typically utilized by an MSP to provide remote support to their customers. CrossTec is not as feature rich as Atera however it does provide the same level of remote access and persistence to the threat actor.

CrossTec Remote Control screenshot.

Defending Against Conti

Conti are opportunistic, with most of their successful attacks beginning with a phishing email, password-based attack or exploitation of a 0-Day vulnerability such as LOG4j. If an environment looks to be too mature, they will simply move on to next target to increase the likelihood of a successful attack.

Mitigating most threat actors, including Conti can be achieved using fairly common security controls.

Patch Management – Ensure that both applications and operating systems are patched on a regular basis. This should also include an out of band patching process for 0-Day vulnerabilities.
Multi-Factor Authentication – This single control will make it significantly harder for any threat actor to abuse password based attacks when deployed properly.
End-Point Detection and Response – An industry leading EDR product will detect many of the behaviors exhibited by threat actors. This includes the use of ‘greyware’ and living of the land tooling utilized by groups such as Conti. This also provides your business with a platform to react to incidents on a granular level across all endpoints.
Application Whitelisting – This control is extremely effective at reducing the range of tools available for a threat actor to utilize during an incident. Application Control is one of the best ways of ensuring software such as the remote access greyware tools we referred to earlier are not deployed without approval.When configured properly, this control can cripple an attack from even the most advanced threat actors.
Application Level Firewalls – The vast majority of application firewall vendors such as PaloAlto and checkpoint provide a categorization for domain and ip addresses. This can be utilized to block an entire application category, for example on a PaloAlto you could block ‘Proxy Avoidance and Anonymizers’ to prevent the use of tools such as NGROK.

References

https://www.cyber.gov.au/acsc/view-all-content/advisories/ransomware-profile-conti

https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/

https://attack.mitre.org/groups/G0102/

https://attack.mitre.org/software/S0575/

Yes, Local Administrators ARE a Risk

Phil — Mon, 01 Nov 2021 16:00:00 GMT

Modern environments are in a constant state of flux; new systems are being commissioned, and old systems decommissioned, to meet new requirements and increase efficiency in all sectors. Managing those changes takes strategy and labour, and every change has an overhead in both of those resources.

What do you do when your users want new software, or to be able to update their apps without waiting for the next patch window?

It’s the perfect solution, your users can now:

Install new and updated software
Change software configurations
Run repairs on software of there are issues
Run software that only runs as a local administrator

And all this without taking up IT resources for changes that may only affect a single endpoint. Sure, everyone needs email but how many users need software for CAD, tax reconciliation, or even software development?

Many businesses decide that the cost to the business, and frustration of users, is too high and provide admin access to users over their own machine. Some may even give functional groups admin to all the endpoints in their team via security groups.

Whatcha Running There, Bud?

A significant downside of this strategy is loss of both control and visibility over endpoints. You don’t have to patch applications now, but are your users doing it? Maybe they’ve installed chrome and they’re keeping it up to date, or maybe they’re using a portable Firefox on a USB they bring from home – the same one they use to clean up viruses on their parents’ home PC.

If you’re letting users install their own software, answering these questions is going to be hard:

What software do we monitor for updates?
What software do we have installed in our environment?
Are users using pirated software?
Are users installing software from reputable sources?
How do we get notified of vulnerabilities in a timely manner?

But how do I secure it?

Let’s have a look at ACSC’s Essential Eight Controls to mitigate exploitation. These are the Australian Government’s recommendation for the 8 most important controls to protect your business.

Let’s see how they align with allowing:

Application Control – Stringent Application Control is a great control is you have a single application that requires admin execution, but it is impossible for unmanaged endpoints. Application Control can only have an effective implementation if you can manage and restrict the use of the endpoint; local administrator privileges actively work against this control.
Patch Applications – If we are allowing users to install applications, there is no way to effectively implement a patching strategy. We don’t know what we need to patch.
Configure Microsoft Office Macro Settings – This is something we can do, but care should be taken to ensure that users aren’t able to undo group policy settings.
User Application Hardening – As with Patch Applications, we can’t implement this as we can’t control what applications are installed on an endpoint.
Restrict Administrative Privileges – Users have admin, the best we can do is restrict their scope to machines specifically assigned to them.
Patch Operating Systems – Not affected, though a policy should be enforced configuring the update schedule (disabling update checks is an administrative privilege)
Multi-factor authentication – Local Administrators can add local users to their machines which may bypass this policy
Regular backups – this is still possible, but backups must be configured centrally to prevent unrecoverable destruction on endpoints via deletion of filesystem checkpoints.

At this point, allowing Local Administrator access has weakened or invalidated the most effective controls we have.

OK, so we’ll get EDR to detect malicious activity. At least this way attackers can’t use tools to exploit other machines.

Oh, yeah that. We can’t stop the tools from running because we can’t get visibility and execution control within a virtual machine. Ok, we’ll get a vulnerability scanner to detect exploitable vulnerabilities – even if we can’t control the applications, we can scan for vulnerable installs to fix.

Oh, we made the scanner service a domain admin to have one account to scan all our machine. Now we need privileged account management anyway to detect and prevent the scanner account being used outside scanning schedules.

Conclusion

The basic answer here is – administrative privilege is a risk. One of the best ways to prevent exploitation is to limit its usage for administrators, any expansion pollutes your environment.

Giving users administrative access is giving away your control, and it’s hard to get that back.

OSINT for Penetration Testers - Cyber Security Consultants - Alchemy

Alex — Tue, 26 Oct 2021 04:00:00 GMT

Part of performing an effective and successful penetration test requires gathering as much information about the target as possible. The more information you have on your target, the more likely you are to discover an exploitable service or land a successful phish.

For example, through OSINT you may discover that the target is openly advertising a job position, and invites applicants to send a resume through to HR. You craft a document using template injection to pull a C2 beacon from one of your C2 domains and can achieve a foothold on the internal domain by mimicking a job applicant.

Without effective recon, it is likely that this opportunity may be missed resulting in an extended period attempting to gain an internal foothold.

So how do you go about effective OSINT/recon?

Breach Data

While breach data may not always contain information on your target, or even recent or up-to-date passwords, it can provide valuable information.

For example, it can give an idea of if users practice sensible account hygiene and register for non-work websites using work email addresses. It can also provide an indication of how users structure their passwords. While “Mary1987” may not be the most recent password, it indicates password format in the form of “NameYear” may be suitable for password spraying.

Figure 1 - Checking breach data for potential credentials

Social Media

Social media is a good place to identify employees at your target. LinkedIn generally provides a solid list of employee names, along with job titles that can help you land a juicy phish.

Creating a list can be done using JavaScript to print employee names to console, or you can use the BurpSuite plug-in GatherContacts.

Figure 2 - Creating a list of employees for phishing and password spraying

Social media can also be useful for determining what relationships a business might have with other companies in the same industry that could be exploited, or what technology might be in use that may need to be avoided when you gain an internal foothold.

DNS Records

DNS records can also reveal a large amount of information regarding potential targets and remote entry points such as VPN or RDP gateways. In addition, with a lot of organisations moving to cloud platforms it can also help identify issues such as subdomain takeovers (they still very much exist in 2021!)

Figure 3 - DNS record lookup using the dnsrecon tool (not stealthy)

One thing you should be wary of with DNS is that it can be noisy if you start querying the organisations DNS servers directly, so depending on how stealthy you need to be, this may need to be done via historical DNS records and/or certificate transparency lookups.

Tools

A number of tools exist that can automate some of this reconnaissance. During a time-limited penetration test these can be quite valuable, as they allow you to work on other tasks while the information is gathered.

theHarvester - Almost a one-stop shop for reconnaissance and OSINT gathering. The tool can perform lookups using a number of different services, generating employee lists, lists of hosts, interesting files etc. Be aware that a majority of actions performed by theHarvester will touch the target, so may not be suitable for all tests.

dnsrecon - This tool will do all the DNS reconnaissance required to enumerate subdomains. By default, it will use the target’s own nameservers, but you can specify which to use, and it does have the ability to lookup via certificate transparency logs, check for zone transfers etc.

Fierce - DNS brute force tool, capable of performing reverse DNS queries. Noisy, so only useful on penetration tests where stealth doesn’t matter.

Figure 4 - fierce in action

Hunter.io - Hunter.io is a useful tool for gathering target email addresses from around the Internet. The free tier limits the number of results returned but does give you an idea of how email addresses are formatted to create your own list from people enumerated through other sources. Paid tier does allow full results and the ability to download a CSV file.

Shodan.io - Shodan can be useful for enumerating open services on target IP addresses without the need for active port scanning. Free tier allows you some use of the API such as domain, CIDR etc. but does have a limited number of daily queries.

Figure 5 - shodan interface

CONTI Group - The not so advanced APT

Alex — Mon, 30 Aug 2021 04:00:00 GMT

Recently in the news it was revealed that a member of an “APT” group that utilises the “Conti” ransomware became disgruntled at the state of their relationship with the group and leaked a large majority of the groups “Tools, Techniques and Procedures” documents.

Conti was first discovered in 2020 and is used primarily by the Russian crime group aliased as “Wizard Spider” (we will assume the leak came from a former member of this group). In addition to the encryption of files seen from historical families of ransomware, Conti also copies files to the attacker’s server before encryption, allowing the group to threaten data leaks if the ransom isn’t paid.

As we regularly hear of organisations succumbing to Conti infections or targeted by “Advanced Persistent Threats” such as Wizard Spider, I was curious as to how the group operates so successfully in compromising these organisations and delivering their payloads. In the name of science*, I obtained a copy of the leaked files and to my dismay discovered they really aren’t so “advanced” in the way they operate.

Figure 1 - Downloading the leak "for science"

Figure 2 - Archive Contents

From what I can gather based on a Google translate of the leaked documents, activities tend to follow that of a standard penetration test, and they don’t seem to employ any advanced methods such as EDR evasion or attempt to hide their tracks long term which is kind of what you’d expect from a group labelled “advanced”. Organisations can take comfort that they don’t generally seem to utilise 0-day exploits but may jump on easily exploitable vulnerabilities that have recently been disclosed (install those patches!).

Initial Compromise

The group seems to have the most success in gaining an initial foothold through phishing, although have been seen brute forcing RDP end points exposed to the Internet. Often, they will attempt to directly just drop an executable file on a user’s machine via a malicious, disguised email attachment, which will beacon back to a command-and-control server (currently the IcedID malware).

This initial beacon then appears to be used to pull down a Cobalt Strike implant that is then used for the rest of the engagement.

Lateral Movement

Once the initial foothold has been gained, and the switch to Cobalt Strike has occurred, internal enumeration activities begin. Activities include enumeration of compromised user privileges on the local machine, identification of domain administrators, and open SMB shares.

During this phase, a lot of their activity is detectable if appropriate systems and alerts are in place. The group utilises several additional binaries such as “Adfind”, “Anydesk”, and “putty” which write artifacts to disk. In addition, widely available free scripts are used from projects such as Powerview or Bloodhound.

Figure 3 - Anydesk remote desktop configuration

Privilege Escalation

Attackers won’t necessarily perform lateral movement and privilege escalation once gaining an initial foothold, but once they start, they move quickly. Entire environment compromises have been reported in as quickly as 2 hours.

Privilege escalation doesn’t follow anything special, simply determining the best route to obtain administrator or higher privileges on the local machine, identifying domain administrator groups and then using well known tools to find where these users are logged in and compromising these systems to obtain their passwords/password hashes.

Figure 4 - Helpful instruction on hunting down admins

Once they have domain administrator privileges, they will exfiltrate company data (Office files etc.) offsite for use in blackmail at a later stage. After this they will drop Conti ransomware on the network, encrypting all files on the file share(s) and as many workstations as are reachable.

Detection and Prevention

The primary thread running through the leak is of a few people with a bit more experience writing basic guides for those not so experienced, and in performing IR for organisations compromised by Wizard Spider we have discovered that this seems to be the case.

Very little is information is provided for advanced exploitation techniques, stealth and remaining out of site or compromising even a semi-mature environment (ie. MFA and EDR or application whitelisting).

Organisations can greatly reduce the likelihood of compromise through investment in a couple of key areas. By implementing multi-factor authentication to prevent compromised credentials being re-used. Implementing application whitelisting configured to only allow approved binaries such as Microsoft-signed will prevent the malware from running all together in the event a user clicks on a link or opens an attachment.

In addition, implementing an Endpoint Detection and Response (EDR) will prevent “living off the land” style attacks that are consistent with exploitation behaviour.

For a long-term approach, organisations can follow the ACSC’s Essential 8 list of recommended security protections.

Disclaimer

I make no promises regarding organisation security when defending against an actual “advanced” threat such as a state-sponsored attacker tasked with infiltrating your organisation with specific goals in mind.

References

https://www.nbcnews.com/tech/security/step-1-google-search-ransomware-hacker-goes-rogue-leaks-gangs-plan-rcna1611
https://thedfirreport.com/2021/05/12/conti-ransomware/
https://www.cyber.gov.au/acsc/view-all-content/essential-eight

Hidden Cobra - Uncovering the North Korean APT

Will — Tue, 03 Aug 2021 04:00:00 GMT

Advanced persistent threats come in many forms ranging from your crime groups, activists all the way through to your state sponsored groups. While some of these threat actors such as crime groups are seen on a regular (if not daily..) basis, state sponsored attacks are less common and more sophisticated. While most state sponsored groups are engaged in similar activity, there is one group specifically that bridges the gap between your typical state sponsored and crime group.

Introducing, Hidden Cobra AKA Lazarus Group, the North Korean state sponsored threat actor.

Generally, state sponsored APT groups have a similar focus on espionage activities, typically targeting government, critical infrastructure and defence industries. Hidden Cobra however are known for engaging in a broad range of crime-based activity from ransomware all the way through to bank and cryptocurrency exchange heists since roughly 2009. We have listed a few of the better-known attacks Hidden Cobra have conducted below.

2014 - Sony Breach
2016 - Bangladesh Bank Cyber Heist
2017 - WannaCry
2017 - AppleJeus Cryptocurrency

We are going to explore the more recent activity of the AppleJeus campaigns to highlight some of the interesting Tools, Techniques and Processes utilised by Hidden Cobra.

AppleJeus

This specific malware is solely attributed to Hidden Cobra and to date, no other threat actors have been documented using this malware. It has been used in various campaigns to specifically target users of Cryptocurrency trading applications as well as Cryptocurrency exchanges themselves. This malware has been actively deployed and matured since its inception in 2018 across multiple campaigns as documented below from US-CERT.

2018 Celas Trade Pro
2019 JMT Trading
2019 Union Crypto
2020 Kupay Wallet
2020 ConGoTrade
2020 Dorusio

AppleJeus is distributed via websites that impersonate a legitimate application or service. Typically these services or applications are related to cryptocurrency, however Hidden Cobra have also been seen impersonating IT administrative tools.

The attacker would take the legitimate application and repackage it to include their own malicious code. In some instances the application itself was injected with the malicious code, however in some instances the attacker would simply package a malicious binary along with the application using tools such as Advanced Installer and AutoIT.

The threat actor would then host the repackaged/modified application on their impersonated website, before referring users to the malicious website via posts on numerous cryptocurrency forums.

Included below are just a few examples of websites and applications that have been impersonated and used by Hidden Cobra as part of their ongoing AppleJeus campaigns to date.

Celas Trade Pro – celasllc[.]com

This AppleJeus campaign was identified in August 2018 and was distributed via a modified and backdoored version of 'Q.T. Bitcoin Trader'. The malware itself was hosted on celasllc[.]com with both Windows and MacOS versions available for download.

The celasllc[.]com website that was used to distribute AppleJeus in 2018.

JMT Trading – jmttrading[.]org

The JMTTrading AppleJeus campaign was identified in 2019, distributed again with a modified version of 'Q.T. Bitcoin Trader'. The malware itself was hosted on GitHub, with both prepackage and 'open-source' versions available for Windows and MacOS.

The jmttrading[.]org website that was used to distribute AppleJeus in 2019.

Union Crypto Trader - uninioncrypto[.]vip

Union Crypto was another fake cryptocurrency trading application that was created solely to distribute the AppleJeus malware in 2019.

The unioncrypto[.]vip website that as used to distribute the malware in 2019.

Bitcoin Find and Recover - btcfindrecover[.]pw

Bitcoin Find and Recover is a legitimate opensource bitcoin password and seed recovery tool. This legitimate tool was utilised to spread AppleJeus via a fake web page. The application itself was hosted prepackaged on the btcfindrecover[.]pw web server with a link back to the actual GitHub repository.

The btcfindrecover[.]pw website that was used to distribute the malware from 2019.

Electrum Wallet - electrum-wallet[.]com

Electrum Wallet is a legitimate opensource bitcoin wallet application. The threat actor bundled their malicious code with the application using packaging software such as 'Advanced Installer'. Users were directed to download the backdoored application through forum posts.

Forum posts utilised by the threat actor to lure users to their webpage hosting the malware.

AppleJeus malware has a particular focus on cryptocurrency, and it is distributed it in such a way to infect targets through both direct and indirect methods. By simply hosting their malware on their legitimate looking websites and referring target users or organisations to download and utilise the tool, they can compromise both corporate environments and individuals.

The malware itself will proactively and re-actively search for crypto currency wallets, usernames and passwords on the target machine before exfiltrating this data to command-and-control infrastructure via https post requests.

Not your typical state sponsored threat actor

While specifically targeting cryptocurrency and banking sectors is not a characteristic unique to Hidden Cobra, it is a unique characteristic for a state sponsored threat actor. While state sponsored attacks are rarer in comparison to crime groups, Hidden Cobra are an example of how even the simplest looking attacks should be taken seriously. The AppleJeus malware itself is not advanced by any means, however as the target audience is broad, these campaigns manage to compromise both individuals and businesses across a vast range of verticals.

The graphs below show the geographical spread of infection based on command-and-control traffic to domains that were hijacked during a recent incident response engagement.

Geographical spread of infections. Time chart of infections by country.

Defending against these forms of attacks

The TTPs employed by Hidden Cobra are not advanced; technology such as end-point detection response and application whitelisting are extremely effective at detecting and mitigating the TTPs associated with this threat actor. As an individual, secure practices such as hash-based validation are also highly effective practices to ensure that the file you are downloading is legitimate. Most developers will provide a list of hashes (Such as MD5, SHA256 etc..) that can be used to verify that the hash of the file you downloaded matches the hash supplied by the developer.

And finally, ensure that you always download applications from a trusted source.

References

https://us-cert.cisa.gov/ncas/alerts/aa21-048a

https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory-hidden-cobra-applejeus-cryptocurrency-threats/

Please Sign Here - Why NTLM Relaying Is Still a Risk in 2021 - Cyber Security Consultants - Alchemy

Phil — Mon, 14 Jun 2021 04:00:00 GMT

The Windows Name Resolution Flow

You may be under the impression that turning host names into IP addresses is simple.

You check:

The Hosts file; then
Your system’s DNS (Domain Name System) resolver

That’s it right? If you don’t get a response from your local file or DNS, then the system doesn’t exist. Well, no; the name resolution flow in Windows looks something like this:

Figure 1 - Windows host name resolution flow

Well, that’s a bit more complicated, isn’t it? And a bit hard to read – feel free to take a minute to look at it zoomed in.

Now I can hear you thinking “WINS? LM Hosts? LLMNR? I don’t remember turning those on. What even are they?”. The more technical people may even be saying “What? We have a domain; we won’t use anything like WINS or NetBIOS. They’re for workgroups.”

Why Windows Finds Services Via Broadcast

Unfortunately, these are all legacy settings that are enabled by default to meet Microsoft’s ever-present backwards-compatible philosophy. You don’t get big in enterprise if your new OS breaks all your old apps and services.

Have you been in the “Network” tab in explorer and wondered how all those laptops and meeting room TVs got there? Has your internet gone out at home and your router redirects you to a webpage to let you know what’s happening? These are all work via broadcast name resolution methods.

This is especially important for small to medium-sized businesses which might not have an internal domain. How does a new laptop find “WD Cloud Drive” or “BOB-PC” with no Active Directory DNS service to find the file shares?

The same applies to other services as well: WPAD requests are sent out to decide how to proxy web requests in environments that don’t set proxies via DHCP or Group Policy.

Net-NTLMv2 Authentication

Even back in the Windows NT days, Microsoft knew that that NTLMv1 (DES encryption based on your password hash) was not secure, so they needed a new network authentication mechanism. As such Net-NTLMv2 was introduced in Windows NT4 as part of the Security Support Provider framework.

It goes a little something like this:

Figure 2 - NTLM authentication flow

Overall, this is a solid attempt as the user’s password or NT password hash is never sent over the network, but the domain controller can verify the authentication attempt from the NTLMv2 response, server nonce, and the user’s stored NT password hash.

Unfortunately, there is a little idiosyncrasy when using Net-NTLMv2 over SMB (network shares) or LDAP (directory services) - neither the client station nor the server is authenticated in this process, only the connection. This allows a MitM (Man in the Middle) attack to intercept authentication attempts to achieve an authenticated connection.

Relaying Credentials (aka. Pass the Hash)

So, let's say we’re a threat actor on the network and we want to be in the middle of one of these connections. We know that Windows clients will sometimes broadcast name requests onto the network, so we just listen; mDNS, WINS, NetBIOS, LLMNR, all of them. Once we get a hit, we impersonate the service, and the connection now looks like this:

Figure 3 - Intercepted NTLM authentication

This is possible because, in the default configuration, this process does not authenticate either the server or client device - it will only authenticate the credentials sent during negotiation. Unless both the server and client specifically request/require message authentication and encryption (“Sign” and “Seal” in SMB parlance) then it will not occur. This leaves the attacker with a fully authenticated session that the server does not know has been intercepted.

How to Get More Requests with IPv6

OK, so we turn of broadcast name resolution. With that, we’re safe from rogue nameservers on our local network!

Figure 4 - Narrator: it was not

From Windows Vista and Windows Server 2008, the default configuration will configure IPV6 with DHCPv6 enabled. In keeping with IPv6’s living-network ethos, Windows will periodically send nameserver solicitations to IPv6 multicast addresses to discover new resolvers.

Figure 5 - Windows client DHCPv6 solicitation

It’s important to note here that with malicious DHCP servers in IPv4 networks, you have to race the real DHCP server to respond to the client as the first answer will be used and any further responses will be ignored. But since IPv6 is designed for clients and routers to communicate and dynamically update network configurations – if we respond to these requests, our IPv6 address will be set as an additional DNS server or router. Windows also prefers IPv6 DNS servers before IPv4 DNS servers, allowing interception traffic from local devices.

Figure 6 - Windows client with malicious IPv6 default route

Preventing Credential Relaying

As we see in Figure 3 above, a malicious user is able to forge an authenticated session by intercepting and redirecting the handshake to a controlled target. We were able to do this because there is no authenticity enforcement on the final connection.

The number one way to prevent credential relaying in an enterprise network is to enforce signing of SMB and LDAP traffic (we’ll ignore NTLM authentication over HTTP, transport security provides authenticity for HTTPS connections). When message signing is enforced, the client and server use an agreed session key to include cryptographic signatures for messages in the authenticated session. The session key is derived using the algorithm below:

sessionKey = HMAC-MD5(v2-Hash, HMAC-MD5(v2-Hash, NTLMv2 Response + Server Challenge))

This relies on the user’s password hash which the server doesn’t know, but since the server needs to validate the authentication, the Domain controller can calculate and return the session key in the authentication response.

By enforcing this signature, MitM attacks are no longer possible as an attacker cannot calculate the authentication code for messages.

Why Server-Side Signing Enforcement Is Not Enough

A common policy in modern networks is to enforce signing on servers only, and this seems reasonable; since enforcement at either side is effectively enforcement at both sides, it should be fine to just set it on servers. Problems arise, however, when we have to deal with non-standard configurations – maybe you require support for an old building management system that doesn’t support authentication with signing… or an HVAC system… or access control.

If you have systems like this, supporting them means supporting insecure configurations in your environment. Part of remediating these issues can be segmentation and segregation of your environment, but systems are inherently meant to be accessed.

In these cases, the best way to prevent these attacks is to ensure that client systems are also enforcing secure configurations. Only systems that are explicitly required to having signing disabled should be allowed, to minimize the risk of exploitation.

Conclusion

In modern environments, it’s common to see that signing for SMB and LDAP have been enforced on Domain Controllers but with modern tooling that understands those limitations, attackers are still able to exploit this weakness to gain privileges in your environment. Through name resolution poisoning they can collect user password hashes. Through credential relaying, attackers can gain authenticated connections to network shares, extracting or deleting business data and even system backups.

Due to these risks, we recommend the following GPOs to minimize the risk and impact of credential relaying:

Network security: LDAP client signing requirements – Require Signing (Require signing for LDAP clients)

Network security: LDAP server signing requirements – Require Signing (Require signing for LDAP servers)

Domain controller: LDAP server channel binding token requirements – Always (Prevent cross-protocol NTLMv2 relaying)

Microsoft network client: Digitally sign communications (always) – Enabled (Require signing for SMB clients)

Microsoft network server: Digitally sign communications (always) – Enabled (Require signing for SMB servers)

Turn off smart multi-homed name resolution – Enabled (Disable LLMNR)

Turn off multicast name resolution – Enabled (Disable mDNS)

In addition, the following PowerShell command can be used to disable NetBIOS on Windows Endpoints:

Get-ChildItem "HKLM:SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces" | foreach { Set-ItemProperty -Path "$regkey\$($_.pschildname)" -Name NetbiosOptions -Value 2}

Postscript

In this post, we discussed the risks of not enforcing SMB/LDAP signing and described the process of Net-NTLMv2 authentication. We did not discuss NTLMv1, but the advice you will receive from all sources is clear: NTLMv1 is not safe, and it should be turned off. The network hash itself is salted, but the encryption algorithm is weak. The session key also leaks information as it is calculated without a hash as below:

sessionKey = MD4(NT password hash)

To prevent NTLMv1 use in your environment, the following GPO should be set:

Network security: LAN Manager authentication level - Send NTLMv2 responses only\refuse LM & NTLM

The benefits of Red Teaming

Will — Wed, 07 Apr 2021 04:00:00 GMT

Red teaming is not a new concept within the cyber security community. However in Australia, Red Teaming is a relatively new term for most organisations. In this blog post we'll take a dive into:

What differentiates a Red Team engagement from a Penetration Test.
Why you shouldn't consider a red team engagement (You totally should.)
The overall benefits of a red team engagement.

The Differences

There are key differences between a Red Team engagement and a typical penetration test. The first difference to consider is that a Red Team engagement is almost always a 'black box' engagement where very little information outside of clearly defined objectives are supplied by the client. This is also typically the case internally, with very few internal staff members being briefed on both the engagement scope, objectives and timelines.

While a Red Team engagement and a penetration test can have very similar objectives, the target scope and approach will differ dramatically. For example, a typical perimeter penetration test will be restricted to targeting an organisation via the internet utilising agreed attack methods. A Red Team engagement however will identify multiple attack surfaces to properly test an organisations overall resilience to an attack from an advanced threat actor. A Red Team engagement will engage in activities such as:

Social Engineering
- Phishing
- Vishing
Physical Intrusion
- Lock Picking
- Tail Gating
- Physical Implant/Device Placement
- Physical Badge Cloning
Wireless Testing
Perimeter Testing
Vulnerability Exploitation

Another key difference between a typical penetration test and a Red Team engagement is the approach, team size and duration of the assessment. A typical penetration test engagement will generally consist of:

Clearly defined testing process/plan
Duration of five to ten business days
One resource assigned for the duration of the assessment.

A Red Team engagement differs slightly:

A Dynamic testing process with a constantly evolving plan.
Duration of ten business days or more.
A minimum of two resources assigned for the duration of the assessment.

Due to the nature of a Red Team engagement, the team will need to create a multi-tiered plan to successfully achieve their target objectives. This involves granular enumeration processes prior to attempting any form of planning or exploitation against a target.

Considerations

Before considering a Red Team engagement over a traditional penetration test, we recommend that customers consider their Cyber Security defensive capabilities. For example if your organisation does not have a cyber security team, strategy or critical security controls in place such as the majority of the ACSC Essential Eight then a Red Team engagement is likely not going to provide more value for you than a traditional penetration test.

The Benefits

A Red team assessment will target multiple layers of your organization to test their defensive capability against an attack from an Advanced Persistent Threat (APT). While a typical penetration test is limited to a specific service or environment, a Red Team assessment will target your technology, people and physical security to identify the risk posed by an APT (Advanced Persistent Threat) against agreed objectives or scenarios.

As part of a red team assessment, you will be able to exercise your defensive technology, incident response and user awareness training to identify and contain an active breach. By working closely with relevant teams, a red team is able to identify advanced vulnerabilities across multiple layers of an organisation and assist them in defending against successful attacks to mature their defensive capabilities.

Overall a Red Team engagement is an excellent way for an organisation to test their resilience against an advanced threat actor and to identify vulnerabilities in layers of the organisation they were otherwise not aware of.

Stealing Password Reset Tokens for Fun and Profit - Cyber Security Consultants - Alchemy

Alex — Mon, 28 Dec 2020 05:00:00 GMT

When adding a “Password Reset” function to your application it is especially important to ensure this has the same security considerations as any other critical function within the application. Due to the nature of resetting a user’s password, along with many security considerations being overlooked, it is not uncommon for attackers to spend extra time trying to bend these types of functions to their will to try and gain unauthorised access.

There are some key considerations that must take place when implementing this functionality to ensure it cannot be abused by attackers:

it should essentially be impossible for an attacker to obtain in any manner a password reset token for another user,
tokens must have a limited time span and be invalidated upon use,
tokens must be authorised to only perform a password reset.

Let’s take a look in the case of an application Alchemy Security tested recently.

Problem one – static password reset tokens

For each user a password reset token was created at time of account creation and stored in the database as part of the credentials. This meant the account had a single reset token valid for the lifetime of the account, independent of how many times the user forgot their password.

As the token was not invalidated after a period of time or once used, this meant that even if the legitimate user reset their password, an attacker still had access to the token and in turn the account, another weakness detailed in problem two. It also appeared likely that the token could not be invalidated without deleting and re-creating the account.

The token was returned in a ‘HTTP 200 OK’ response from the API endpoint, so while not visible within the web page itself, was still easily obtainable by an attacker simply using an interception proxy such as Burp Suite. This meant that an attacker could easily write a script to test a list of usernames and obtain the token for each by parsing the resulting response.

To make matters worse, all of the above actions do not require any user authentication. Allowing an un-authenticated attacker to easily enumerate both usernames and their associated reset tokens without restriction or valid credentials.

Leaked password reset token.

Problem two – excessive token permissions & incorrect authorisation checks

The biggest problem was the token itself had excessive permissions and was able to perform almost any action for which the user already had permissions. For example, the token could be used to update the user’s profile (which then leaked the user’s password hash, another big issue!) or perform search functions to access data for which the user had access to.

These two issues meant that the application was prone to two critical security issues:

Account takeovers: An attacker able to obtain a reset token now had the ability to change a user’s email address associated with the account and perform an actual password reset (among other changes).
Application takeover: If an attacker targeted an admin account, they could essentially take full control of the application, locking out other administrator accounts and accessing all data within the application. Alternately, they could make changes to any other account of their choice, including escalating privileges of a low privileged account they already had access to.

Stealing an admin password reset token. Escalating privileges using stolen token.

These issues can be easily be avoided in the following manner:

ensure reset tokens are only created once a user runs the “password reset” function,
tokens must only be provided to the user requesting the reset via an email address previously validated and connected to the account and not returned via the web application front end,
tokens must only be authorised to perform a reset and not have permissions for any other purpose,
tokens must not be easily guessed, predictable or able to be brute forced.

MITRE ATT&CK Framework Primer

Will — Mon, 16 Nov 2020 05:00:00 GMT

The MITRE ATT&CK framework is a fairly familiar term within the Cyber Security industry. It has quickly evolved from a niche framework, to the core of many security operation centers. While the vast majority of security operating centers are familiar with the framework, less mature businesses have trouble understanding where to start and, how to apply the framework effectively.

ATT&CK 1-0-1

ATT&CK is broken up into various categories called ‘Tactics’ starting from ‘Initial Access’ all the way down to ‘Impact’. We liken the order of ATT&CK Tactics from left to right with the Lockheed Martin Cyber Killchain. The Lockheed Martin Cyber Kill Chain visualises the phases a threat actor will have to transition through to meet their objective. As such, detecting or mitigating a technique in an earlier Tactic allows you to limit the impact the breach will have on your environment by preventing the threat actor from actioning a technique in a later Tactic.

We use this as a general rule, it is possible for some attacks to completely skip various Tactics. However, it is much easier to defend or recover from an attack when you have implemented appropriate mitigation, detection and recovery strategies to better respond to a technique earlier, rather than responding to them in a later Tactic such as ‘Impact’. For example, if you have strategies in place that allow you to detect or prevent potentially malicious remote access events such as a user logging into a VPN service from outside of Australia. You can proactively respond by disabling the account, resetting the users password and preventing the threat actor from actioning techniques from later Tactics. This makes it significantly more difficult for a threat actor to reach their end goal while allowing you to more easily defend your environment.

Reconnaissance > Resource Development > Initial Access > Execution > Persistence > Privilege Escalation > Defence Evasion > Credential Access > Discovery > Lateral Movement > Collection > Command and Control > Exfiltration > Impact

The MITRE ATT&CK framework is built from the perspective of a threat actor, detailing how a threat actor may break into an environment and move laterally. Each of these tactics contain multiple techniques, with each technique containing detailed information.

The techniques within the framework contain detailed information including:

Methodologies used by threat actors to leverage and exploit the technique.
The systems or services the technique applies to, such as operating systems.
Which threat actors utilise the technique.
How to mitigate or detect the technique in your environment.
Published references to the technique being utilised in the wild.

This image shows a sample of the numerous Tactics and Techniques that make up the MITRE ATT&CK framework.

Using The Framework

So now we understand the basics of ATT&CK, there are various ways of utilising the framework to better defend an environment against a malicious threat actor. Luckily, MITRE have released a tool called ‘ATT&CK Navigator’ that makes this process significantly easier.

The ATT&CK Navigator tool allows cyber security teams to easily navigate and annotate ATT&CK matrices in multiple layers. This allows the team to easily plan, measure and visualise both offensive and defensive capabilities through colour coding, numerical values and comments.

One of the more common use cases for the framework is to regularly measure and mature the defensive capabilities of an organisation. This is done by measuring the effectiveness of various controls and mitigations (Anti-Virus, Email Gateways, Firewalls etc..) against the ATT&CK framework. This can then be used to combine each service matrix into a combined layer, making it simple to identify improvement opportunities. The below image shows how an organisation can easily visualise gaps in their mitigation and detection strategies.

The above image shows multiple product matrices combined to give an overall idea of the detection capabilities. The default navigator legend goes from red through to bright green with red being a combined score of 0.

Another excellent use case for the framework, is measuring the effectiveness of a product in mitigating various Techniques and, any potential overlap the product will have with existing products or services in your Cyber Security stack. It is also quite common for vendors of cyber security products and services to align or measure themselves against the framework. MITRE make this even easier by providing pre-evaluation reports of various products against ATT&CK using the Navigator tool. This means an organisiation can simply overlay the MITRE or vendor provided matrices over an overall matrix to identify how effective a product will be alongside existing controls.

The screenshot below (https://attackevals.mitre-engenuity.org/APT29/results/crowdstrike/matrix.html) shows the effectiveness of CrowdStrike Falcon while detecting Tactics, Techniques and Procedures (TTPs) from the threat actor group Advanced Persistent Threat 29 (APT 29), with a total detection rate of 100%!

The above image shows a MITRE ATT&CK Evaluation of Crowdstrike Falcon against the Advanced Persistent Threat 29.

Here at Alchemy Sec, we also utilise the framework when performing incident response for customers. MITRE keep up to date matrices of a vast range of threat actors that allow cyber security teams to easily identify the known TTPs to look for when dealing with known adversaries. Having this information at hand allows cyber security teams to more efficiently detect, mitigate and eradicate the threat actor from the environment.

The Differentiator

Unlike other frameworks, ATT&CK is built around technical tactics, techniques and procedures from the perspective of threat actors. As such, many security teams proactively choose to align their detection, mitigation and incident response processes with the framework to better understand their own strengths and weaknesses. Integrating MITRE ATT&CK into an organisation’s existing processes does require a degree of technical knowledge.

In saying that, AlchemySec have guided numerous customers in enhancing their existing processes and leveraging relationships with vendors to have them align their own tools or services against the framework. This allows organisations to utilise the framework without the same degree of technical knowledge and putting all of the heavy lifting back on the vendor to align their product with the framework.

While the framework is effective from a technical perspective, it can also be used at a management level to easily visualise strengths, weaknesses and opportunities to improve in maturity. This process can be pivotal in acquiring buy in from key stakeholders when looking to augment or rationalise existing capabilities with new services.

In Conclusion

The MITRE ATT&CK framework can used as the foundation of a broad range of use cases to allow an organisation to better detect, mitigate and eradicate threats within their environment. To get the most value out of the framework an organisation will require a certain level of maturity from both cyber security processes and technically capable resources. However, the framework contains a wealth of cyber security information that can be utilised for product selection, incident response and threat actor profiling with very little technical knowledge.

While some of Alchemy Sec’s example use cases can be niche, we hope the concepts shared resonate and inspire you to generate interesting ones of your own to be used in concert with the framework to the benefit of your own environment.

References

MITRE ATT&CK Framework: https://attack.mitre.org

MITRE ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/

MITRE ATT&CK Evaluations: https://attackevals.mitre-engenuity.org

CrowdStrike MITRE ATT&CK Framework Evaluation: https://www.crowdstrike.com/blog/crowdstrike-falcon-mitre-attack-evaluation-results-second-iteration/

Lockheed Martin Cyber Kill Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html