Botconf 2019

With the quantity and sophistication of bots and botnets ever increasing, automation is key in gathering threat intelligence, and disseminating it to defence systems. With botnets’ rapid flux in nodes and update sources, this information needs to be captured and distributed as quickly as possible. In this talk we will look at an approach to this problem, whereby threat intelligence is automatically gathered from bot samples and the botnets they belong to, allowing prompt distribution to security software on endpoints to allow their monitoring to detect the latest threats.

In March 2018, thousands of home routers were potentially compromised by a criminal campaign called “Roaming Mantis” in Japan to overwrite DNS settings to use a rogue DNS. This criminal has strong financial motivation. Devices under the compromised router, such as Android, iOS, PC were targeted. They have been rapidly improving their malicious contents for each platform. In addition, the attacker implemented their malicious contents which support 27 languages for targeting around the world. Based on our research, we would like to disclose the details of this campaign such as the mind of the criminals, the details of malicious contents and how they compromised routers to share with researchers and CERTs…

A new under-the-radar botnet targeting Network Access Storage (NAS) and Network Video Recorder (NVR) devices, has been discovered. The botnet originates back to 2013, uses a known vulnerability for infection, and is still active as of today. Our research shows that it is infecting a range of devices from a well-known vendor in the consumer software space, however these devices are so popular that compromised examples can be found in both small businesses and governments alike. What makes this botnet unique is the way that it was built from stock components with only very few custom-built binaries; the separation of its subnets; and the way host nodes communicate with the C2. Years later the vendor fixed the targeted vulnerability, however, a large chunk of infected nodes’ firmware has either never been updated or the devices have not been restarted in years.

Composing YARA rules based on these feats requires a lot of experience and is typically done manually or at best tool-assisted, which still is a tedious and time-consuming process. In this presentation, we introduce YARA-Signator, an approach for the fully automated isolation of these characteristic code regions and the construction of YARA rules targeting them.

Encrypted C&C data can make the life of malware analysts and incident handlers a lot harder, as it can make C&C traffic a lot harder to recognise, when done right. Fortunately, not every malware author is able to implement encryption in a secure way. A well-known vulnerability in the use of cryptography (that also led to attacks on older standards for Wi-Fi protection) is still present in a number of wide-spread malware families. In this presentation we show how this cryptographic weakness can be used for several analysis purposes. We show how the presence of the weakness can be detected using traffic gathered in sandboxes. We also show how clustering can be applied to encrypted data to group different variants (with potentially different and unknown encryption keys) of the same malware together while at the same time gathering structural information about the plaintext. And finally, we show how information on the plaintext structure of a malware family can in some cases be used to automatically generate IDS signatures for new variants using only a single ciphertext and without extracting the key itself from the binary.

The Emotet banking trojan has been studied by many researchers since it was first discovered in 2014. In particular, the infection scheme and the Command & Control architecture are both pretty well documented. However, few researchers investigated the way the payloads were dropped on the compromised websites and how the polymorphism has been implemented. This presentation aims to focus on the latter aspect, describing how the payloads are dropped on the compromised websites and how the polymorphism has been implemented by the Emotet’s herders. New layers of the botnet architecture would be unveiled during the presentation.

Android malware authors go to great lengths to come up with increasingly clever ways to monetise their apps. The author (or a group) presented during my talk shows quite the range, from simply repacking apps with a bespoke advertising SDK to writing a sophisticated rooting trojan with new techniques never seen in other harmful apps. Their most complex creation is called “Zen”. Zen bundles exploits to gain privileged root access. It then uses this access to create fake Google accounts on devices. These accounts are created by abusing accessibility service with additional help from code injection.

Malspam’ (an umbrella term for spam campaigns that deliver malware or send users to phishing sites) has long been the prominent way for individuals and organisations to get themselves infected. These campaigns are opportunistic (i.e. non targeted), which distinguishes them from very targeted spear-phishing campaigns. Yet these malspam campaigns also differ in a number of fundamental ways from ordinary spam, which positively affects their effectiveness and negatively affects our ability to analyse them. In this talk, I will explain how most malspam campaigns differ from ordinary spam, based on years of studying the email part of such campaigns in our lab. I will discuss how this makes them a lot better at bypassing email filters and how this affects their visibility.

At the end of 2018, it has been reported that Latin America suffers approximately 3.7 million cyber-attacks per day. Even the most well-known pieces of malware, such as TrickBot or Emotet, have their eyes set on this region. When it comes to malware that originates in those countries, the first thing that comes to mind are those infamous, huge, mostly Delphi-written banking trojans. These banking trojans have been our focus for over a year now. They are completely different from what is generally called a banking trojan and because their authors tend to copy from one another or from the same sources, all of them are very similar to each other. That is the main reason we see only generic detections. Our research started with identifying strong characteristics that allowed us to identify more than 10 new malware families among them…