Cатсн²² (in)sесuяitу / ChrisJohnRiley

Can societies manage the SIGINT monster?
Duncan Campbell (IPTV Ltd)

Behind closed doors, ubiquitous surveillance systems have evolved in parallel to and hidden within the global communications infrastructure. Developments in signals intelligence (Sigint) technology and tradecraft have shadowed all new telecommunications developments. Sigint agencies have covertly sought to lead, change, and subvert arrangements that IT practitioners make for security and privacy.

Everybody with an open data connection is being monitored and recorded at all time.

We can do privacy and security. The fallacy that we can’t have both needs to be disproven.

Even though there’s no wall of sheep here, there is an embassy only meters from the hotel were this conference takes place. On the rooftop of the British embassy there is massive surveillance and recording equipment. Phased arrays trying to scan and record anything within range.

This kind of system was exposed in the Snowden document leaks, and boasts a range of collection types (WiFi, CDMA, GSM, Satellite, WiMAX, Microwave, …).

To the other side of the Danube, sitting atop the United Nations tower is an almost identical tower (part of a project called STATEROOM). These are covert special collection sites.

Other collection points exist at the US embassy in Vienna… and are listed in the Snowden leaks.

Outside of Vienna, there are obviously other monitoring stations, including the famous event in Athens were GSM networks were monitored resulting in the death of a telecom employee.

Austria has a history of being central to monitoring within europe dating back many years. These capabilities have only expanded under the RAMPART program, accessing international communications from around the world. These 3rd party relationships are key to the US monitoring plans.

Access to communications data and monitoring is traded for access to advanced techniques and technologies.

Austria is only one part of the process… with data flowing through Germany and back to Washington for further analysis.

Without knowing the language used to describe things, the Snowden documents (and others) are hard to decipher. The word hacking isn’t used, instead being replaced with words such as “touch” and “implant” to describe malware.

A brief history of sessionizers

• 1998 First optical fibre rate sessionizers
• 2000 Grandmaster
• 2002 WEALTHCLUSTER (known publicly as DPI)
• 2006 TURMOIL (also known as TULLURIAN)
• 2010 Increased to 10 Gbps
• 2013 100 Gbps (post Snowden information)

This data is all then fed into projects like XKeystore… however this is a broken system as the recent attacks in Paris show.

Extraordinary mis-purposing of systems designed for one use, but resulting in the large-scale collection of data from civilians.

Massive amounts of information, incompetent tools, coupled with wide reaching monitoring.

XKeystore runs on MySQL, relies on Crontab, and uses CADENCE, an ancient and inefficiently designed system (scaled up from the days of telegraphy).

Little intelligence value…

You give them big data, and they screw up badly”

Anything that they can’t get is their biggest target. Access to mobile communications, leading to attacks on Belgacom to get insight into their network and communications.

Even with all that access however, they still don’t do their job. Stealing data, but not stopping the attacks that they are meant to detect by invading this privacy.

Recent Wikeleaks data shows that US monitoring stations in the EU are targeting politicians and business talks… and not attempting to try and find the bad guys.

Going for data at scale, exposes their overreach and inability to gain meaningful insight from the data.

Privacy and Security do not trade-off against each other… it’s not a zero sum game!

Links:

• Presentation Abstract
• Presentation Blogpost
• Duncan Campbell Bio

Advanced Powershell Threat: Lethal Client Side Attacks using Powershell – Nikhil Mittal

APT – A buzzword which refuses to die. Lets have some fun with it, lets move it to powershell. This talk would focus on using powershell for Client Side Attacks.

Powershell is an ideal platform for client side attacks as it is available on all the Windows machines. We would see how easy and effective it is to use powershell for various client side attacks like drive-by-downloads, malicious attachments, Java applets, Human Interface Devices etc.

The payloads which would be used with these attacks include in-memory code execeution, dump passwords and system secretsin plain text, backdoors, keyloggers, moving to other systems, reverse shells etc.

The code used in the above talk will be released as open source. The talk would be full of live demonsrations.

Client-side Attacks

Why Client-side attacks

• Server-side is being locked down, so attacks are moving more to the client-side
• Often client-side is less secured and not prioritized for patching compared to the server-side systems
• The perimeter-ized network is still the norm
• Less chance of being discovered when the attack begins from the inside of the network
• Users are too familiar with their systems, and tend to feel over-confident about their security

To avoid detection it’s best to not use exploitation or memory corruption attacks to avoid being detected by possible host-based IDS/IPS or Anti-virus.

What is Powershell / Why Powershell

Tasked-based command line shell and scripting language designed for system administrators

Powershell is already present on the majority of your target systems and is a powerful method to reside in the system. It also provides easy access to things such as the .Net classes, WMI, Windows API, WinRM, Registry, etc…

Anything we can do to reduce our dependance on Metasploit and possibly detectable tools is a good thing.

Tools to create malicious client-side files

Out-Word.ps1

Used to create “armed” or “infected” MS Word documents

Out-Excel.ps1

Same as Out-Word, but for Excel files.

Out-HTA.ps1

Creates an executable HTML application to send to the user that triggers Powershell

Out-Java.ps1

Creates an executable JAR file to launch Powershell

Out-Shortcut.ps1

Creates a malicious .lnk file that points to the Powershell on the users machine to trigger specific actions. Can also set a hotkey on the shortcut so the link is triggered whenever the user clicks a specific key combination.

Out-CHM.ps1

Creates compiled HTML Help Files to execute Powershell commands. Can be customized to include real help information to fool a user.

Defense

• Don’t click stuff! Teach your users to not trust content from external sources
• Removal of VBA from MS Office would help specific attacks
• Active monitoring of users machines may help detect such attacks
• Remove powershell access to users who don’t need it (block/limit the user)

Links:

• Presentation Abstract
• Presentation blogpost
• Nikhil Mittal Twitter
• Nikhil Mittal Homepage
• Nishang tool (github)