incident reponse unravelled

Transcription

1 Tux's Angels: Incident Response Unravelled linux.conf.au MEL8OURNE2008

2 Tux's Angels: Incident Response Unravelled Something to lighten the mood...

3

4 Who we are Amelia, Kate, Vanessa IT Security Geeks Department of Defence Information Security Group Computer Network Vulnerability Team (CNVT)

5 What we do For Federal and State Government: 24/7 Incident response IT Security advice and assistance Vulnerability assessments Penetration testing / red teaming Research and Development Education and Training angels@lca:~/what_we_do

6 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/agenda

7 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/incident_response

8 Incident response Incident: Events that threaten IT Security Incident response: Process of handling this situation Things to keep in mind: Inform management Involve law enforcement for criminal activity Preserve forensic integrity

9 Incident response IR life cycle: Detection Collection Analysis Detection Analysis Collection

10 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/incident_response

11 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/linux_+_foss

12 Linux + FOSS: why? Why do we use Linux in Incident Response? Not invasive Multiple filesystem support More OS control Loopback device Why FOSS? Cutting edge technology Customisable, and more control Free! angels@lca:~/linux_+_foss

13 Linux + FOSS: tool selection How do we select tools for IR? Ease of installation Easy to understand, use and configure How accurate and updated it is Support and documentation available Reputation of the developers angels@lca:~/linux_+_foss

14 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/linux_+_foss

15 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/investigation

16 Investigation The incident IR life cycle Detection Collection Analysis

17 Investigation The incident IR life cycle Detection Collection Analysis

18 The incident Who? Administrator from Playground Inc. What? Suspected compromise of workstation ALPHA When? Reported at 4:30pm on 19th Dec 2007 playground.net1.myturf.net domain Requested on site assistance from Tux's Angels

19 The network

20 The network

21 Timeline: what we know

22 Timeline: what we know

23 Timeline: what we know Simile Timeline:

24 Investigation The incident IR life cycle Detection Collection Analysis

25 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

26 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

27 Detection Finding out if a security incident occurred May come from a variety of sources: IDS Logs Users Odd system behaviour Use all tools and resources available angels@lca:~/investigation/ir_life_cycle/detection

28 Detection Variety of tools can be used to detect a security incident These can be broken down into: Network Based Intrusion Detection Systems (NIDS) Host Based Intrusion Detection Systems (HIDS) Log watch and alerting tools angels@lca:~/investigation/ir_life_cycle/detection

29 Detection: NIDS Network based Intrusion Detection System NIDS tools they considered using Squil EasyIDS Their NIDS tool of choice Snort with BASE

30 Detection: HIDS Host based Intrusion Detection System HIDS tools they considered using AIDE Labrador Their HIDS tool of choice Afick

31 Detection: Log watch and alerting Log watch and alerting Logging and alerting tools they considered using LogCheck Devialog Their logging and alerting tool of choice Swatch

32 Detection: Custom IDS Solution Their custom IDS solution!

33 Detection: Custom IDS Solution

34 Detection: Custom IDS Solution ON AT BOOT MYSQL SNORT LOGS VIEWED BASE LOGS SYSLOG

35 Detection: Custom IDS Solution ON AT BOOT MYSQL SNORT LOGS VIEWED BASE LOGS SYSLOG DUMPCAP CREATES ROLLING PCAPS

36 Detection: Custom IDS Solution ON AT BOOT MYSQL SNORT LOGS VIEWED BASE LOGS SYSLOG SWATCH WATCHES ON ALERT BASH SCRIPT KICKS OFF DUMPCAP GETS 1 BEFORE, 3 AFTER ALERT CREATES ROLLING PCAPS angels@lca:~/investigation/ir_life_cycle/detection

37 Detection: Custom IDS Solution ON AT BOOT MYSQL SNORT LOGS VIEWED BASE LOGS SWATCH SYSLOG ANALYSED BASH SCRIPT TCPFLOW WATCHES ON ALERT KICKS OFF DUMPCAP GETS 1 BEFORE, 3 AFTER ALERT CREATES ROLLING PCAPS angels@lca:~/investigation/ir_life_cycle/detection MERGES EXTRACTS FLOWS MERGECAP

38 DEMO: Detecting an incident using snort, swatch, tcpflow and BASE

39 Detection: results Suspect compromise: YES Snort unsuccessful TELNET login from ALPHA to Internet box Afick 3 new unexplained exe's: inst.exe inst2.exe MS Indexer.exe Information passed to Tux's Angels angels@lca:~/investigation/ir_life_cycle/detection

40 Timeline + Detection: what we know angels@lca:~/investigation/ir_life_cycle/detection

41 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

42 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

43 Collection Acquiring data to determine occurrences related to a specific event Collect data Verify data angels@lca:~/investigation/ir_life_cycle/collection

44 Collection Data can come from a variety of sources: network memory disk angels@lca:~/investigation/ir_life_cycle/collection

45 Collection: network Collecting network data Tools we considered using: dumpcap Wireshark Tool of choice: tcpdump

46 Collection: memory Collecting memory data Techniques we considered using: Crash dumps Hibernation file Tool of choice: FAU dd

47 Collection: disk Collecting disk data Tools we considered using: dd sdd Tool of choice: dcfldd

48 Collection What happened onsite?

49

50 Collection What happened onsite? Physical memory: FAU dd and dcfldd Disk image: dcfldd Startup pcaps: tcpdump Gateway pcaps: dumpcap

51 DEMO: Memory acquisition using FAU dd and dcfldd

52 Timeline + Collection: what we know angels@lca:~/investigation/ir_life_cycle/collection

53 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

54 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

55 Analysis Analysing the data acquired in collection phase Confirmatory analysis and event reconstruction Data is Surveyed, Extracted and Examined (SEE data analytic approach)

56 Analysis Our priorities: 1) Cause of compromise 2) Extent of compromise 3) Malware functionality & identity

57 Analysis Data from collection phase: network disk memory Tools to analyse each dataset

58 Analysis: network

59 Analysis: network Network tools we considered: tcpxtract ngrep netdude Our network tool of choice: wireshark

60 Analysis: network

61 The network

62 Analysis: network Network capture ( pcap): From :28 to :00 Taken on external gateway interface ( ) First observation: At 14:05 ALPHA starts using a proxy rather than a DIRECT connection to the Internet Proxy is an untrusted IP address: angels@lca:~/investigation/ir_life_cycle/analysis/network

63 Timeline: wpad DNS request

64 Timeline: wpad DNS request

65 Analysis: wpad.dat function FindProxyForURL(url, host) { if (shexpmatch(url, "*.playground.net1.myturf.net/*")) { return "DIRECT"; } return "PROXY proxy.myturf.net:3128"; } angels@lca:~/investigation/ir_life_cycle/analysis/network

66 Analysis: wpad.dat function FindProxyForURL(url, host) { if (shexpmatch(url, "*.playground.net1.myturf.net/*")) { return "DIRECT"; } return "PROXY proxy.myturf.net:3128"; } angels@lca:~/investigation/ir_life_cycle/analysis/network

67 Analysis: wpad refresher Web Proxy Autodiscovery protocol Used by web browsers set to auto detect proxy settings DHCP and DNS wpad.<domain> Moves up hierarchy until it gets a hit angels@lca:~/investigation/ir_life_cycle/analysis/network

68 Analysis: wpad resolving

69 Timeline: Firefox setup.exe downloaded

70

71

72

73

74 Analysis: network Is this the real firefox setup.exe?

75 Analysis: network Is this the real firefox setup.exe? NO WAY!

76 Analysis: network Is this the real firefox setup.exe? NO WAY! Content type: application/octet stream

77 Analysis: network Is this the real firefox setup.exe? NO WAY! Content type: application/octet stream Like this: Two executables Legitimate executable the user requested. e.g. the real firefox setup.exe

78 84d p0rxy

79 Timeline: encrypted comms to malware controller

80 The attack network

81 The attack network

82 Analysis Our priorities: 1) Cause of compromise 2) Extent of compromise 3) Malware functionality & identity

83 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise 3) Malware functionality & identity angels@lca:~/investigation/ir_life_cycle/analysis/network

84 Analysis: disk

85 Analysis: disk Disk tools we considered: Suite: sleuthkit + autopsy Utilities: many Tasks: Antivirus scan, MAC time analysis, browser history, event logs, registry, file carving angels@lca:~/investigation/ir_life_cycle/analysis/disk

86 Analysis: disk Our disk tools of choice: Suite: pyflag Utilities: clamav, mork.pl, sleuthkit (fls, mactime, dls), scalpel, md5sum, strings, file

87 Analysis: disk Antivirus scan using clamav Scheduled to update & scan using cron Log file can be easily grep'd Results can be scripted to extract infected files AV can be hit or miss due to variants Infected file: 36 (Trojan.Small 2497) VirusTOTAL: Backdoor.Poison variant?

88 Analysis: disk md5sum identified unique viruses inst.exe inst2.exe == MS Indexer.exe == live.exe Afick hash database identified these same files strings of each executable matched executables in firefox setup.exe

89 Analysis: disk Firefox setup.exe inst.exe inst2.exe/ms Indexer.exe/live.exe Legitimate executable the user requested. e.g. the real firefox setup.exe

90 MAC times (files and registry hives) Event log IE browser cache

91

92 Analysis: disk pyflag enabled us to: Confirm initial compromise Determine how the malware unpacks

93 Analysis: how the malware unpacks Firefox setup.exe inst.exe inst2.exe/ms Indexer.exe/live.exe Legitimate executable the user requested. e.g. the real firefox setup.exe

94 Analysis: how the malware unpacks Firefox setup.exe Unpacker inst2.exe/ms Indexer.exe/live.exe Legitimate executable the user requested. e.g. the real firefox setup.exe

95 Analysis: how the malware unpacks Firefox setup.exe Unpacker Trojan/malware Legitimate executable the user requested. e.g. the real firefox setup.exe

96 Analysis: how the malware unpacks Firefox setup.exe Unpacker THIS IS MY BAD FOOD. BAAAAD FOOD Trojan/malware THIS IS MY BAD FOOD. BAAAAD FOOD Legitimate executable the user requested. e.g. the real firefox setup.exe

97 Timeline: persistence

98 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise 3) Malware functionality & identity angels@lca:~/investigation/ir_life_cycle/analysis/disk

99 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise Malware: inst2.exe Methods of persistence: reg keys, start up 3) Malware functionality & identity angels@lca:~/investigation/ir_life_cycle/analysis/disk

100 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise Malware: inst2.exe Methods of persistence: reg keys, start up 3) Malware functionality & identity angels@lca:~/investigation/ir_life_cycle/analysis/disk

101 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise Malware: inst2.exe Methods of persistence: reg keys, start up 3) Malware functionality & identity Functionality: keylogging, password hashes, file upload, encrypted comms angels@lca:~/investigation/ir_life_cycle/analysis/disk

102 Analysis: memory

103 Analysis: memory Memory tools we considered: PTFinder PoolTools Windows IR/CF tools Our memory tool of choice: volatility

104 DEMO: Memory analysis using volatility

105 Analysis: memory pslist: firefox.exe (1812) firefox.exe not running when memory acquired! connections: firefox.exe (1812) to :3460 dlllist: parameters to firefox.exe, non standard?

106 Analysis: memory

107 Analysis: memory

108 Analysis Our priorities: 1) Cause of compromise wpad + malicious firefox 2) Extent of compromise Malware: inst2.exe Methods of persistence: reg keys, start up 3) Malware functionality & identity Functionality: keylogging, password hashes, file upload, encrypted comms Identity: PoisonIvy angels@lca:~/investigation/ir_life_cycle/analysis/memory

109 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

110 Investigation The incident IR life cycle Detection Collection Analysis Detection Analysis Collection

111 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/investigation

112 Agenda Incident response Linux + FOSS Investigation Conclusion angels@lca:~/conclusion

113 Final Timeline: Investigation SOLVED!

114 Ok, so what now? Block outbound comms Prevent further compromise Reimage infected machines Ensure no mechanism for persistence Assess damage

115 Linux + FOSS Tool wrap up Detection: swatch/snort/dumpcap/base Collection: dcfldd/faudd/tcpdump Analysis: wireshark/pyflag (and others)/volatility How you can use these tools, even if you're not in an IR team? angels@lca:~/conclusion

116 Thanks... Our bad guy: Eddie Cornejo LCA

117 Thank you. Any questions? References (images): Alpha DC home server from hp.png Gateway %20Server.jpg Internet Badguy Dragons