Comparing the incomparables
CC Attribution 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Szappanos, Gábor
It is common belief that APT groups are masters of exploitation. If anyone, they should know everything about it, right? Our research into the real world uses of the CVE-2014-1761 vulnerability shows that it is far from being true. It is a common practice in the anti-malware world that the security products are compared to each other in comparative tests. Even the tests themselves can be evaluated by the criteria of the Anti-Malware Testing Standards Organization. The only players, who are not rated, are the malware authors. This is for a good reason: their activities cover a wide range of operations, that dont fully match and cant be exactly measured. The deep analysis of the samples using the CVE-2014-1761 vulnerability gave us a rare opportunity to compare the skills of a few different malware author groups. This is not a full and comprehensive test, but given the complexity of the exploit we could estimate the skills only in a very narrow slice of the full set: the understanding of the exploit. But the situation is the same as with any other test: if you know exactly what you are measuring, you can make valid conclusions. The presentation will detail the exploitation process, explaining the role and implementation of the RTF elements used in the process, the ROP chain and the shellcodes. We will investigate the different malware families that were using this vulnerability, and discuss the depth of modification into the exploit. This will give us a chance to rate the understanding and exploiting skill of the authors behind these malware families. The comparative analysis gave an opportunity to draw a relationship chart between the different malware families, showing strong correlation with previously known intelligence, and adding a couple of new relations. The final purpose of the comparative analysis is to understand the strengths and weaknesses of our enemies in the cyber warfare. The more we know about them, the greater our chances are for successful defense.
 Now I could ask you how was the part last night but I can see the casualties so I Could be gentle with you and make this presentation light and entertaining for you But I'm not a nice person so I will make it in an easier So let's just try jump right into this What am I going to do? Who are these incomparables in the landscape where we are moving? I'm meaning a Malware outlaws malware group writing groups Anti malware protection programs special a PT protection programs Every major constituent is thoroughly tested and their qualities are measured The end of virus protection Products are regularly tested by third party testers Even they this special a PT protection Devices which otherwise claimed themselves to be untestable are and Can be tested you could hear about it from yesterday presentation by Zoltan Balash or later today by Bouldie A little more detail about how to test these a PT defenses Even the test themselves are measured against the objective criteria by the anti malware testing standards organization There is one single player who is never tested and those are the malware outlaws and that's not fair We should be aware of their capabilities Not only for fun but but also because Actually, there is an actual war going on between them and us and the first Rule of war is that you have to know your enemy If you don't know your enemy your defenses will be inadequate if you underestimate them They are going to get you if you overestimate their capabilities then Your efforts in protection will be misplaced and you will waste your efforts in areas when you shouldn't waste and you should Concentrate your efforts elsewhere just as an example if you have a house which is full with valuable stuff and gadgets and You want to protect it and you're afraid of the burglars in the neighborhood There are a couple of options you can choose you can build a ball wall around your house a three meter high wall Electrical electric fence on the top that would effectively stop the ninjas who have as we all know only 2.5 meter vertical leap But that's a bit expensive It also blocks your view for the outside. It has also devastating effects on the vegetation around the wall so if you would happen to know that That the typical burglars in your neighborhood are Just cat burglars who Really good at lock picking because yesterday they attended the lock picking workshop here at activity Then you would know that the wall is useless. It's not necessary You should strengthen your locks and windows and doors that would be an adequate measure for you much cheaper And it would be still protected now it would still wouldn't defend you against Nation-state sponsored Attackers like NSA and the likes but chances are before NSA would attack you there will be about Five Russian cyber crime groups three Chinese APT groups. Maybe one israelian France APT group attacking you So you have to prepare for the vast majority of the attacks for that You have to know the capabilities of the attackers and that's the point of evaluating All these malware outdoors the APT groups and the common cyber crime groups and that's the point of my presentation now How do you evaluate these groups? How do you measure the skill set of them? There are a couple of Problems with testing them the first of all this subject These Malware outdoor groups work on different principles. They have different purposes. Some of them want your Banking access information so that they could steal your money from the bank others want some sensitive Documents from your hard drives while others want to just destroy your nuclear facilities physically So they have different purposes. They have different targets some are targeting home users others are large corporations Yet other APT groups are targeting non-governmental organizations. So the target range is also wide and Because of that they have to defeat different defenses for home users There is only probably a free anti-virus solution for for large corporate users all sorts of in depth deep and defenses in place even some advanced protection devices and for that the the attackers use Very different approaches and tools some are very happy just sending a Fishing email with the tax. Hey, here is some nice contact Click here and you'll be fine Others are using common exploits yet others are using zero day exploits So there is a wide range of tools that they are using so The task is how to measure and and qualify players who work on a very wide range of activities and The solution is something like Professors are doing in In university classes where they have a wide they have a lot of students With a wide range of capabilities They are going to give them a problem to solve and based on the level of their understanding of the problem and and the other skill they show in the solution They are going to rate these students. That's what I'm going to do. I'm impersonating a teacher APT groups are going to be the students now for that test to work The problem has to be solvable if it is not solvable. It's not there is no point in the test It also has to be difficult enough. So if anyone scores Perfect on the test then it is not a good comparative test Also, the test problem has to be granular enough to differentiate between wide range of skill sets and lastly Every student in the classroom has to be motivated to solve the problem if it is a problem that Only 10% of them is interested in solving than the test results will not be Usable for our purpose and measuring a large number of these Malware out of the loops. So what is going to be the test problem? The test problem is going to be a Word vulnerability it's a It was discovered last year. It's a rich text format five format vulnerability That leads to a Memory corruption now if you attended yesterday, so what I'm at presentation a Lot of the the terms and methods I'm going to talk about should be familiar for you. That was a Very extensive and good overview of the general principles and this is the this is going to be a practical implementation and this is What I refer to in the introduction that I'm going to be tough with you Because in order to understand the results of the test you have to understand the methodology of the test and The methodology of the test relies on you understanding how this exploitation works now this vulnerability is Is the has the unsexy name of CV? 2014 1761 I'm going to refer to this one of it. Yes 1761. I estimated it to save me 35 seconds of presentation time overall anyhow, this is a new world one ability and exploit and Every possible malware author group is just very happy to get their hands about a new world one Ability and exploit so they are very much what motivated in using it Because it is a powerful tool in infecting users So if you read the original Microsoft description of this exploit Of this vulnerability, it will say that it affects all possible Wordware Word versions that were out there at the time so All of them which are listed on this on this list are Vulnerable and possibly Exploitable by this vulnerability now, we all know that in theory there is no difference between theory and practice However in practice there is a huge difference. So If you would guess what would be your guess how many of these World versions were actually affected by this vulnerability? The silence I take it as zero it was a slightly more than that Actually one version was ever affected by this vulnerability and it was of his 2012 respect to 30-bit version and the reason is that Even though all the other versions were exploitable and could have been exploited successfully the practical Implementation of the exploit have relied on absolute memory of set taken from a particular Windows components MS-com CTL-O CX a particular version of it and And that one was only by default installed by this office 2010 Service pack to it would have been a straightforward process to To pour this vulnerability to all of the other office versions. It didn't happen Why you will probably understand around the middle of this presentation So let's talk about a little bit about The exploitation process itself From a very rough overview there is a Rich tech format exploited documents vulnerability trigger a shell code gets Executed and at the end a payload is dropped into the system by some sort of trojan now There is one thing a slight problem in this chain and that slight problem is called data execution prevention Which means that it is relatively easy to to full world into into writing shell code into a memory area On the heap It is quite easy also to convince to jump into that memory area However, what is difficult as is now and not possible with depth in present is to actually execute that code because These data areas either on stack on heap are declared at the end of the year On heap are declared at least on the contemporary windows operating system as non executable You can inject your code there. You cannot execute that So before you can execute your shell code that would drop and execute the the final trojan on the system You will have to make sure that the shell code is executable. It's it's another executable page So the whole exploitation start with a bootloader Component that bootloader component allocates a new memory block Make that an executable memory block just copies the shell code there and executes from there. That's pretty easy There is one slight problem in order to Make this allocation you have to execute the bootloader code but how do you execute a code if you cannot execute a code because of data execution prevention and Here comes the concept of the rob exploitation return oriented programming Which means that you cannot execute the code that you placed in memory But you can execute codes that are already placed in the memory by the system libraries at the time the exploitation occurs There are about a dozen soft window system libraries already loaded into the memory for your convenience this means there is there are Tense of megabytes of code Laying in memory that you can use now all you all that the attacker has to do is to pick small snippets of these codes Think about them as puzzles get these puzzles from Windows system libraries and just Chain them together so that they would accomplish the functionality that you will need so during the exploitation When the memory corruption occurs you just divert the normal execution of work to jump to the first puzzle of your code and it will Get the word gets so disoriented that it will jump from puzzle to puzzle if they are they are chained together very carefully then They will accomplish the task you want these Puzzles are a very limited Capability sets so you will need a lot of puzzles to accomplish even the Smallest task that you need There is another one The problem which is a SLR the address space layout randomization Which means that if you want to use these puzzles you have to know where they are in memory 99% of the windows Libraries are placed randomly in the memory. There are only a few of them which have fixed load offset and These libraries are of extreme value for the the exploiters and attackers and MS com city Allowsing that is used by the moon albity is one of those libraries so the exploitation starts with Confusing word taking making him a detour in execution divert him and then starts the drop chain Which would allocate a memory for an executable memory for the shell code and execute it There is another slight problem in this particular case which means the which in which which means that Then first word first gets dire and diverted it gets diverted to a small memory region And the small memory region region cannot host an entire rope chain There is another memory region that the attackers can control which can host a large group of data But it is not where word first gets The diverted to so the bootloader of this exploitation process is Further divided into two parts. There is a bootloader of the bootloader The initial rope chain which will make sure that the execution gets diverted to that larger Buffer which already hosting the entire rope chain that the rope chain then allocates an executable memory range Copies the shell code the shell code executes in one or two stages Locates the payload decrypts it drops it executes it and Detector is there with a video with the install Trojan now It is a good test problem for the malware authors because it is granular Modifying the final payload It is a everyday task for these malware authors What if I in the shell code? It's not every day, but it is they do it on a regular basis touching the rope chains now that That's a highly skilled operation and not many of them. That's do you to do that? So here we have we have a granular problem for the malware authors to solve if we are looking a bit in detail into the exploit itself it is a memory corruption a vulnerability V table a pointer to a function table gets over with them during the exploitation The way it happens The article documents can contain list override tables which have several different parameters for lists embedded in a text of the document now the the data in this list of a right tables is stored in buffers in memory and the Instructures in memory and the the addresses of these structures are stored in a preallocated memory region now if there would happen to be a somewhat more of these Overwrite structures than word expects then it will Stretch is over the boundary of the preallocated memory area and it will overwrite whatever comes after that And that's the memory corruption at least today the execution in particular at a certain Memory address there is a pointer to a VTB in MSO DLR It's a pretty meaningless that is for me a function table not to fancy functions and in the process of parsing the Malfold rtf document The addresses of the list override tables stretch over the Allocated region and overwrite this this function table address So at some unrelated point later in the code execution of word A call would be made to into this function table But instead of taking the appropriate function from MSO DLR This call would take the the address from from one of the list override tables and And this address would be an absolute memory location in inside the MS com CTL or CX Yes, and The initial rope chain as I said Does nothing but transfers the execution to a larger buffer which is controlled by the attacker. I mean there is a Inside the list override structure. There is this level text buffer which can hold a large chunk of binary data This large chunk is going to be the main rope chain and the share code first stage share code now The list of the right table Contains the address of this buffer. So really the initial rope chain has nothing to do but execute this single call into the The list override into the level text buffer like I said the rope Drop gadgets or the puzzles that you can use from From the preloaded system libraries are of very limited capabilities. So this single Single call single assembly instruction you need six different puzzles to to execute this code and Just as an illustration of the complexity of the task the first address the address of the first rope gadget is stored in a list override table, but within the RTF RTF file it's actually actually stored in four different places. It combined from four different places For example, the first byte E8 is the value of the the level of NFNC and tag in the RTF 232 decimal equals to E8 in hexadecimal. So the the first byte 48 It's actually a bit filled and several of the Texts within the RTF combining to it for example this level GCN 0 and Level Norris start and level world and this level Norris start is Setting 40 the other setting eight in this bit field. That's how it is combining together Finally the last two bytes are in the level numbers tag within the RTF file this Slash up or stroke 5a Note the the hexadecimal value of 5a the following apostrophe is the the eski character of 27 which is follows that so in order to control one single address In in the the rope chain you would have to modify at least at four different places for different distinct places at the RTF file To use this exploitation you can imagine it requires an intimate knowledge of the RTF structure and representation so they in all effect and This address in MSCom city row six you will find a small call Court fragment this will be is going to be the first puzzle in solving the the code transfer After that execution goes on to the larger level text buffer the Rear rope chain that is stored there which was the memory allocation now that one is a bit longer and As the expo that I mean The the attackers have no absolute control over the code within the rope gadgets So they do what they want and they do a bit more than that in some cases Apart from doing whatever the attackers want to do they Perform like some pop from the set stack which is not needed for the actual execution But because there is a pop and it's not avoidable There has to be something on the stack that is popped into register which is that only they're never used So during the rope chain there are a few unused bytes Which has no Significance for the exploitation they have to be there so that something could be meaninglessly popped into a register So these bytes are not used it could be anything right there the their main rope chain The main logic is very simple it allocates a new memory copies the shark code there and jumps there But because the drug gadgets are of limited capability it requires about 10 12 building blocks to accomplish this task if we look from the the rtf perspective into this The exploit the rtf file starts with some sort of header followed by some sort of irrelevant information The exploit trigger the initial rope chain is scattered throughout the the texture of the rtf file The first stage drop chain is stored in the in the level text buffer Along with the first stage shall code second stage shall code and the payload is usually Appended as some binary chunk at the end of the rtf file now from the Attacker point I mean from the test point of view it all have it adds an additional granularity to the test like Every decent malware out or could modify the appended binary shell code and the payload. That's not a problem the first stage shall code is easily recognizable in Relatively easily recognizable in the level text buffer. I mean it looks like a buffer of bytes that a decent malware writer can Comprehend and and modify the initial rope chain For that you have to really really deeply understand the rtf structure so apart from the the the granularity in the exploitation itself there is a granularity in understanding the rtf structure itself, so it is a Well-defined and granular test task for the for the attackers and we are going to leave it so We are going to Rank the attackers on the lab on the skills that they are showing to us so starting from from Zero knowledge data knowledge means that they are buying on in the underground market base is a generator and they are going to generate a sample with it Basic skillset involve replacing the payload in an existing sample intermediate knowledge attackers can modify already the shell code Skilled ones try to make some trivial modification in the rope chain itself advanced and protesters can make significant modifications in the rope chain or the exploit trigger and And the real good ones can control every single aspect of the exploitation that is going to be the scale that I will place the APT authors so the the first version of this research was published in February At our blog I'm not going to touch all of the families and the groups mentioned in that Because that would be an even longer presentation You can go there and check that but I'm going to mention a few additional ones because we which were not known at the time of Writing that paper. So let's start with suspect zero the first ever sample that we could identify using this as well. This is going to be the base point of Of comparison as it turned out All of the further samples were derived from this one There was no independent development going on in this exploit. This was a destructive trojan appeared last April and it displayed a decoy with some Mayor partners seeking advertisement Clearly Because of this kind of decoy and a destructive payload It was not used in the targeted attack as you would expect from from an APT player who Would deploy zero day. I think it was deliberately released A little before Microsoft Patched this vulnerability The reason is unknown perhaps the Perhaps to cover tracks because if there is only one single entity who knows and uses this vulnerability every every Evidence points into the bad direction. It's other starts to using it. It will get scattered. Anyway in this case the document starts with a large chunk several kilobytes of Really junk contents context not used not displayed But it is very convenient for identifying everyone else who was copying this content Clearly this guy whether developed it was a highly skilled one There was some early birds One week after this the initial sample was released a couple of targeted attacks were Performed using this vulnerability Mainly by the Duke group That was recently blocked by by f secure a great overview by them It was Targeted against diplomatic targets and they they made Very significant modifications to the exploited document. For example, they cut all of the junk that was at the beginning of the file They stripped down nearly to the minimum to the the RTF contact and Also changed memory location within the rope chain. So they made Very significant changes in the the exploited documents. I'm not saying it is not possible to do all that in a week I'm sorry, but it's very unlikely that happened So my guess would be that they had prior or prior knowledge of this exploit Before they started working it if I had to guess I would say that This is the group that is most closely connected to the source of the exploit Now the the Dukes have a reputation of being supported by the Russian government They have huge financial resources and they have a history of using zero-day exploit So it is not an unreasonable assumption that they were the first one to use this exploit, but there is no Strict evidence pointing into that direction. Anyhow because of the changes they made to the rope chain clearly dangerous and probe criminals There was some direct descendants That were using the original sample and they didn't do anything else But swept the exploit step the payload the binary Trojan at the end that's clearly a very basic Modification this samples appeared about one week One month after the the original really really is and they are they were used by the petit tiger a PT group When I said they didn't change anything that's not entirely true They changed the the author name from is my is my to is my which is something you could do in two seconds in a text editor so that doesn't constitute as a Major skill anyway, but this is this group showed the very basic skills of exploit ability And then comes an interesting strain which is metasploit and and the direct descendants from it Metasploit is a great tool for researchers for for penetration testing understanding the The exploit and so it is also a great tool for Malware authors and they are Using it extensively to generate new samples for it like In the cases I'm going to show you the the metasploit module appeared about a week after the original release of the first document and The clearly the web were created that module understood some of the the Europe exploitation at least to the level that as I mentioned in the Main rope chain. There are some unused filler bytes which are there only for that to be popped into a meaningful meaningless Register now these were filled in the original sample with the 41 hex bytes now in the metasploit module They were filled with random values. These are these these whites that could make us Possible to identify whoever was ripping metasploit for samples. Anyway, whoever developed metasploit module was a skilled exploiter one of the direct Descendants from Metasploit was the The havex malware which was mentioned also mentioned yesterday in presentation as targeting energetic sector Looking for industrial control systems, but when I created these slides, I didn't know that it was going to happen So I picked another one and another example and that was the inception Group it was reported by blue coat and later on by Kaspersky under the name cloud us Atlas And they directly connected that with the famous red October campaign anyhow, but they did it they generated a Sampled by metasploit then swept the shellcode and the payload and they just replaced it Plus additionally in case of inception they prepended another exploit block at the beginning exploiting an older vulnerability However doing that They messed up with our TF cell structure. This is a very delicate Vulnerability if you mess up with the rtf structure, it will break the exploit and that happened in the case of the inception group they Generated about 13 documents With this exploit and sit in 11 of them the exploit was actually broken. So they generated the Asample with Metasploit just to use this vulnerability and they broke it in about 90% of the cases that's really on one hand They are skilled because they touched the shellcode and the payload on other hand It is shadowed a little by the fact that whatever they created was not working anyhow, there is a huge Group of samples using this exploit that we're using some sort of generator sample generator One could argue that Metasploit is also a generator, but now here I'm talking about commercial tools released in the underground Circles one of them I don't know what the generator is. I don't know the name for it. It has not been Reported yet. We just see that hundreds of samples are generated by it a lot of Common banking trojan families are being distributed it and it is right now dominating the the Exploitation scene so the largest chunk of exploited documents that we are see right now on a databases are generated by this tool It has Apart from the the the main block main level text block that was the rope chain and the shellcode an additional two additional blocks that Have the same filler value all over them it is not used it is pointless But it can use it can be used as a watermark to point out the all these samples that were created by this toolkit anyhow Because they did touch a little bit of the The level text structures and the exploitation stuff is sort of an intermediate skillset was whoever was Writing this this generator another one Microsoft 13 through there It was blocked by Fire I and later this year just a few weeks ago We have released a white paper about this one. That's the other large chunk of Exploited samples that using this vulnerability also hundreds of documents created with it I Suggest to read our wallpaper because that's very interesting and I don't have The time to go into details into it anyway, it has a very distinctive characteristics and it is One of the very very few cases when the the Malware authors actually touched the rope chain and They built an alternative rope chain instead of the original one so it is performing the same task It it requires two more Building blocks it is a bit alternative route But documents generated by this toolkit Exploit three different vulnerable it is within the same RTF file and also dozens of mostly banking trojans were distributed by Document generated by this toolkit anyhow the level Of skills that's that the author of this kit showed because he actually they have to touch the rope chain It's really a someone who understands exploitation at a high level a very interesting case Was the Rotten tomato case now? I I'm a physicist by education. I'm a lousy programmer. I When I have to do programming I do as a physicist. I take an example program modify to my needs and beat it with a stick until it works It was surprising to see that an APT group Chinese APT group followed just about the same Path of development except for the until it work parts So what they did They wanted to use this exploit in their campaigns So they took a sample generated by word intruder which was mentioned just one slide before and the There was a third exploit block at the end. They just got rid of it perhaps it was too complicated to modify that in place for them They replaced the first exploit ball block Appended their own payload and started to use it in a campaign now the problem with this picture it exploit to vulnerable it is If the first one is activated then the Trojan the APT Trojan by this group Some other plug-ins backdoor is get a gets executed if the first one is triggered Then the the original Z bot sample from the original sample that they ripped from word intruder gets executed So depending on the condition. It's either an APT or a common cybercrime It is really an unwanted situation for this group mostly because they Grab the sample so that they could use actually the exploit so What they took they grabbed another sample where this 761 exploit worked and They cut out the original one for the from word intruder copied into it from that other example And there it goes one problem like I mentioned until it works part Word intruder has a slight problem at least In half of the samples the exploit doesn't work So this Chinese APT group didn't get lucky they picked the sample where it the exploit didn't work actually But when they copied the block from this another example They overwrite they did overwrite the non-working exploit with a working one and They broke it immediately because In this case this shellcode looks for the payload at the fixed file offset Because and when they copied it into their own document There was this unused encrypted Zbot executable at the beginning another exploit block so this fixed file offset was shifted back into the that file But this Chinese authors never corrected the shellcode for this offset so And they created samples and they used it in target error text where this exploit never ever actually worked and they were Using it for months in different target error text. They started it using in Russia distributing plug-ins and Then they moved their operation against India and Pakistani targets Anyhow they show a really basic set of exploitation understanding and I'm Being very generous to them with this classification. Anyhow, there was one case of successful integration I don't think it was used by the same group it was deployed in in Arabic countries When they actually fixed the shellcode offset and it actually dropped a Zbot anyhow Let's switch to the the evolution part so In this table I just blindly copied all the the malware families that I have seen created I have seen using this exploit and just by looking at the samples. I was placing them Into that skillset matrix. However, here comes the fun part. It's a university professor. You can do nasty things One of the nasty things is to see if they actually work Like I said In many cases in fact in the case of this exploit more over Over half of the cases the exploit actually didn't work. I mentioned it with the inception I mentioned it with birding through there the Generated or used samples they just contained broken versions of this exploit and the supposedly highly skilled Cyber criminals they just fail to realize this fact. So that just takes back a little value from their evaluation and The other thing is the relations really One of my university professors had this really bad habit after test. He started to create Disindancy graphs who was copying from whom and And modified the marks accordingly. So I'm doing the same with these malibu routers For example a large chunk of samples or sloucher of cyber crime groups Although the samples they are using show Large are great understanding of the exploit. That's not they merit It's because they are using the birding through there or some other generation generator. So they The The merit goes to whoever created those tools. They are the actual users of the exploited documents The skill set extends only to the point of executing a Generator and using whatever is the spit out of it so In this picture you can identify a couple of high profile APT groups For example the pity tiger or a genetic energetic beer group, which I mentioned Number panda or nightshade panda they were responsible for the rotten tomato cases Hangover team also showed their mark in this in this table karma panda and the dukes which I mentioned earlier So really this is the evaluation part of the test and this places all the Approval all the groups in their appropriate places. So the here is this dividing line anyone left on the in the table understands Whatever happens after the exploit happened so they can Deploy their malware they can modify the payloads, but they really don't understand the exploitation itself They don't have in-house expertise in exploitation Whoever are on the right side in this table. Those are the really dangerous players. Those are the ones who understand exploit exploitations Five formats and they apparently have in-house expertise. Now what this table doesn't show are the numbers the vast majority of the incidents that we can see 99.9 point whatever percent belong in this region where Used by players who show little to non understanding of the exploitation and only a few Incidents belong to the real dangerous guys and even these are shadowed by the fact that Even though in solving the problem they show high High skills Whatever they created was not working. So they may be good programmers They may seem to be good at exploitation by but they clearly leak the key like the capabilities of Determining that whatever they created was actually working or not so the the conclusion is that Malware outlaws in general even the the highest profile APT or cybercrime groups are clearly lacking in in QA They don't they are not checking Whatever they are using in in actual attacks if They are working or if these are multi exploit samples that every individual exploit is working in the samples The common cybercrime group groups who are deploying banking trojans have a better supply chain Because someone is doing the generators for them and they are buying it But even though however skilled these groups are they don't show enough Knowledge and skills to port this vulnerability to other office versions. So There is a certain limit in their in their capabilities But they are very eager to use any new vulnerability that is available and Immediately as they can get their hands on it And they are going to use it in a text or try to use it in a text But a final warning for you even though they are not Really the ninjas you you should be afraid of just cat burglar's Once they get into your house, they show very high capabilities and skills in Emptying out your house and cleaning out or your assets So they may not be good at exploiting but once they get hand and they get their food into your organization They are very talented and resourceful. So be aware but You should know that if you keep up with the exploit information They are not really much ahead of you And that oh I have some final slide. I I said it was going to be a test So let's see if it is really a test and here are the the objective criteria by a MTS or not in my testing standard Organization, so I'm just going through some of the criteria. I don't think I'd end danger the public by this test I'm certainly not biased towards any of these groups. In fact, I'm equally biased against all of them I think the test was reasonably transparent the testing methodology I mean I spent the first 25 minutes explaining you the testing methodology. So I was pretty clear about that And Finally the test should have an active contact point which in that case should be me I guess So that concludes my presentation I Think As I look around I don't see too many people sleeping. So I guess I Reached my goal and kept you awake that take it as an accomplishment. Thank you. You
 Now I could ask you how was the part last night but I can see the casualties so I  Could be gentle with you and make this presentation light and entertaining for you  But I'm not a nice person so I will make it in an easier  So let's just try jump right into this  What am I going to do? Who are these incomparables in the landscape where we are moving? I'm meaning  a  Malware outlaws malware group writing groups  Anti malware protection programs special a PT protection programs  Every major constituent is thoroughly tested and their qualities are measured  The end of virus protection  Products are regularly tested by third party testers  Even they this special a PT protection  Devices which otherwise claimed themselves to be  untestable are and  Can be tested you could hear about it from yesterday presentation by  Zoltan Balash or later today by Bouldie  A little more detail about how to test these a PT defenses  Even the test themselves are measured against the objective criteria by the anti malware testing standards organization  There is one single player who is never tested and those are the malware outlaws and that's not fair  We should be aware of their capabilities  Not only for fun but but also because  Actually, there is an actual war going on between them and us and the first  Rule of war is that you have to know your enemy  If you don't know your enemy your defenses will be inadequate if you underestimate them  They are going to get you  if you overestimate their capabilities then  Your efforts in protection will be misplaced and you will waste your efforts in areas when you shouldn't waste and you should  Concentrate your efforts elsewhere just as an example  if you have a house which is full with valuable  stuff and gadgets and  You want to protect it and you're afraid of the burglars in the neighborhood  There are a couple of options you can choose you can build a ball wall around your house a three meter high wall  Electrical electric fence on the top that would effectively stop the ninjas who have as we all know only  2.5 meter vertical leap  But that's a bit expensive  It also blocks your view for the outside. It has also devastating effects on the vegetation  around the wall  so if you would happen to know that  That the typical burglars in your neighborhood are  Just cat burglars who  Really good at lock picking because yesterday they attended the lock picking workshop here at activity  Then you would know that the wall is useless. It's not necessary  You should strengthen your locks and windows and doors that would be an adequate measure for you much cheaper  And it would be still protected  now it would still  wouldn't  defend you against  Nation-state sponsored  Attackers like NSA and the likes but chances are before NSA would attack you there will be about  Five Russian cyber crime groups three Chinese APT groups. Maybe one israelian France APT group attacking you  So you have to prepare for the vast majority of the attacks for that  You have to know the capabilities of the attackers and that's  the point of evaluating  All these malware outdoors the APT groups and the common cyber crime groups and that's the point of my presentation  now  How do you evaluate these groups? How do you measure the skill set of them? There are a couple of  Problems with testing them the first of all  this subject  These Malware outdoor groups work on different principles. They have different purposes. Some of them want your  Banking access information so that they could steal your money from the bank others want some sensitive  Documents from your hard drives while others want to just destroy your nuclear facilities physically  So they have different purposes. They have different targets some are targeting home users others are large corporations  Yet other APT groups are targeting non-governmental organizations. So the target range is also wide  and  Because of that they have to defeat different defenses for home users  There is only probably a free anti-virus solution for for large corporate users all sorts of  in depth deep and defenses in place even some advanced protection devices and  for that the the attackers use  Very different approaches and tools some are very happy just sending a  Fishing email with the tax. Hey, here is some nice contact  Click here and you'll be fine  Others are using common exploits yet others are using zero day exploits  So there is a wide range of tools that they are using  so  The task is how to measure  and  and qualify players who work on a very wide range of activities and  The solution is something like  Professors are doing in  In university classes where they have a wide they have a lot of students  With a wide range of capabilities  They are going to give them a problem to solve and based on the level of their understanding of the problem and and the  other skill they show in the solution  They are going to rate these students. That's what I'm going to do. I'm  impersonating a teacher APT groups are going to be the students now for that test to work  The problem has to be solvable if it is not solvable. It's not there is no point in the test  It also has to be difficult enough. So if anyone scores  Perfect on the test then it is not a good comparative test  Also, the test problem has to be granular enough to differentiate between wide range of skill sets and  lastly  Every student in the classroom has to be motivated to solve the problem if it is a problem that  Only 10% of them is interested in solving than the test results will not be  Usable for our purpose and measuring a large number of these  Malware out of the loops. So what is going to be the test problem? The test problem is going to be a  Word vulnerability it's a  It was discovered last year. It's a rich text format five format vulnerability  That leads to a  Memory corruption now if you attended yesterday, so what I'm at presentation a  Lot of the the terms and methods I'm going to talk about should be familiar for you. That was a  Very extensive and good overview of the general principles and this is the this is going to be a practical  implementation and  this is  What I refer to in the introduction that I'm going to be tough with you  Because in order to understand the results of the test you have to understand the methodology of the test and  The methodology of the test relies on you understanding how this exploitation works  now this vulnerability is  Is the has the unsexy name of CV?  2014 1761  I'm going to refer to this one of it. Yes 1761. I estimated it to save me 35 seconds of presentation time overall  anyhow, this is a  new world one ability  and exploit and  Every possible malware author group is just very happy to get their hands about a new world one  Ability and exploit so they are very much what motivated in using it  Because it is a powerful tool in infecting users  So if you read the original Microsoft description of this exploit  Of this vulnerability, it will say that it affects all possible  Wordware  Word versions that were out there at the time so  All of them which are listed on this on this list are  Vulnerable and possibly  Exploitable by this vulnerability now, we all know that in theory there is no difference between theory and practice  However in practice there is a huge difference. So  If you would guess what would be your guess how many of these  World versions were actually affected by this vulnerability?  The silence I take it as zero it was a slightly more than that  Actually one version was ever affected by this vulnerability and it was of his 2012  respect to 30-bit version and the reason is that  Even though all the other versions were exploitable and could have been exploited successfully the practical  Implementation of the exploit have relied on absolute memory of set taken from a particular  Windows components MS-com CTL-O CX a particular version of it and  And that one was only by default installed by this office 2010  Service pack to  it would have been a straightforward process to  To pour this vulnerability to all of the other office versions. It didn't happen  Why you will probably understand around the middle of this presentation  So let's talk about a little bit about  The exploitation process itself  From a very rough overview there is a  Rich tech format exploited documents vulnerability trigger a shell code gets  Executed and at the end a payload is dropped into the system by some sort of trojan  now  There is one thing a slight problem in this chain and that slight problem is called data execution  prevention  Which means  that it is  relatively easy to  to full world into into writing shell code  into a memory area  On the heap  It is quite easy also to convince to jump into that memory area  However, what is difficult as is now and not possible with depth in present is to actually execute that code  because  These data areas  either on stack on heap are declared at the end of the year  On heap are declared at least on the contemporary windows operating system as non executable  You can inject your code there. You cannot execute that  So before you can execute your shell code that would drop and execute the the final trojan on the system  You will have to make sure that the shell code is executable. It's it's another executable page  So the whole exploitation start with a bootloader  Component that bootloader component allocates a new memory block  Make that an executable memory block just copies the shell code there and executes from there. That's pretty easy  There is one slight problem in order to  Make this allocation you have to execute the bootloader code  but how do you execute a code if you cannot execute a code because of data execution prevention and  Here comes the concept of the rob exploitation return oriented programming  Which means that you cannot execute the code that you placed in memory  But you can execute codes that are already placed in the memory by the system libraries at the time the exploitation occurs  There are about a dozen soft window system libraries already loaded into the memory for your convenience  this means there is there are  Tense of megabytes of code  Laying in memory that you can use now all you all that the attacker has to do is to pick small  snippets of these codes  Think about them as puzzles  get these puzzles from Windows system libraries and just  Chain them together so that they would accomplish the functionality that you will need  so during the exploitation  When the memory corruption occurs you just divert the normal execution of work to jump to the first puzzle of your code and it will  Get the word gets so disoriented that it will jump from puzzle to puzzle if they are they are chained together very carefully  then  They will accomplish the task you want these  Puzzles are a very limited  Capability sets so you will need a lot of puzzles to accomplish even the  Smallest task that you need  There is another one  The problem which is a SLR the  address space layout randomization  Which means that if you want to use these puzzles you have to know where they are in memory  99% of the windows  Libraries are placed randomly in the memory. There are only a few of them which have fixed load offset and  These libraries are of extreme value for the the exploiters and attackers and MS com city  Allowsing that is used by the moon albity is one of those libraries  so the exploitation starts with  Confusing word taking making him a detour in execution divert him and then starts the drop chain  Which would allocate a memory for an executable memory for the shell code and execute it  There is another slight problem in this particular case  which means the  which in which which means that  Then first word first gets dire and diverted it gets diverted to a small memory region  And the small memory region region cannot host an entire rope chain  There is another memory region that the attackers can control which can host a large group of data  But it is not where word first gets  The diverted to so the bootloader of this exploitation process is  Further divided into two parts. There is a bootloader of the bootloader  The initial rope chain which will make sure that the execution gets diverted to that larger  Buffer which already hosting the entire rope chain that the rope chain then allocates an executable memory range  Copies the shell code the shell code executes in one or two stages  Locates the payload decrypts it drops it executes it and  Detector is there with a  video with the install Trojan now  It is a good test problem for the malware authors because it is granular  Modifying the final payload  It is a everyday task for these malware authors  What if I in the shell code?  It's not every day, but it is they do it on a regular basis  touching the rope chains now that  That's a highly skilled operation and not many of them. That's do you to do that?  So here we have we have a granular  problem for the malware authors to solve if  we are looking a bit in detail into the exploit itself it is a  memory corruption a vulnerability  V table a pointer to a function table gets over with them during the exploitation  The way it happens  The article documents can contain  list override tables which have  several different parameters for lists embedded in a text of the document now the  the data in this list of a right tables is stored in  buffers in memory and the  Instructures in memory and the the addresses of these structures are stored in a preallocated  memory region  now if there would happen to be a somewhat more of these  Overwrite structures than word expects then it will  Stretch is over the boundary of the preallocated memory area and it will overwrite whatever comes after that  And that's the memory corruption at least today the  execution  in particular  at a certain  Memory address there is a pointer to a VTB in  MSO DLR  It's a pretty meaningless that is for me a function table  not to fancy functions and  in the process of  parsing the  Malfold rtf document  The addresses of the list override tables stretch over  the  Allocated region and overwrite this this function table address  So at some unrelated point later in the code execution of word  A call would be made to into this function table  But instead of taking the appropriate function from MSO DLR  This call would take the  the address from from one of the list override tables and  And this address would be an absolute memory location  in inside the MS com CTL or CX  Yes, and  The initial rope chain as I said  Does nothing but transfers the execution to a larger buffer which is controlled by the attacker. I mean  there is a  Inside the list override structure. There is this level text buffer which can hold a large  chunk of binary data  This large chunk is going to be the main  rope chain and the share code first stage share code now  The list of the right table  Contains the address of this buffer. So really the initial rope chain has nothing to do but execute this single  call into the  The list override into the level text buffer like I said the rope  Drop gadgets or the puzzles that you can use from  From the preloaded system libraries are of very limited capabilities. So this single  Single call single assembly instruction  you need six different puzzles to to execute this code and  Just as an illustration of the complexity of the task the first address the address of the first rope gadget  is stored in a list override table, but within the RTF  RTF file it's actually actually stored in four different places. It combined from four different places  For example, the first byte E8 is the value of the the level of NFNC and  tag in the RTF  232 decimal equals to E8 in hexadecimal. So the the first byte 48  It's actually a bit filled and  several of the  Texts within the RTF combining to it for example this level GCN 0 and  Level Norris start and level world and this level Norris start is  Setting 40 the other setting eight in this bit field. That's how it is combining together  Finally the last two bytes are in the level numbers tag within the RTF file  this  Slash up or stroke 5a  Note the the hexadecimal value of 5a the following apostrophe is the the eski character of  27 which is follows that so in order to control one single address  In in the the rope chain you would have to modify at least at four different places for different  distinct places at the RTF file  To use this exploitation you can imagine it requires an intimate knowledge of the RTF structure  and  representation so they  in all effect and  This address in MSCom city row six you will find a small call  Court fragment this will be is going to be the first puzzle in solving the the  code transfer  After that execution goes on to the larger level text buffer the  Rear rope chain that is stored there which was the memory allocation now that one is a bit longer and  As the expo that I mean  The the attackers have no absolute control over the code within the rope gadgets  So they do what they want and they do a bit more than that  in some cases  Apart from doing whatever the attackers want to do they  Perform like some pop from the set stack which is not needed for the actual execution  But because there is a pop and it's not avoidable  There has to be something on the stack that is popped into register which is that only they're never used  So during the rope chain there are a few unused bytes  Which has no  Significance for the exploitation they have to be there so that something could be meaninglessly popped into a register  So these bytes are not used it could be anything right there the  their main rope chain  The main logic is very simple it allocates a new memory copies the shark code there and jumps there  But because the drug gadgets are of limited capability it requires about 10 12 building blocks  to accomplish this task  if we look from the the rtf perspective into this  The exploit the rtf file starts with some sort of header followed by some sort of irrelevant information  The exploit trigger the initial rope chain is scattered throughout the the texture of the rtf file  The first stage drop chain is stored in the in the level text buffer  Along with the first stage shall code second stage shall code and the payload is usually  Appended as some binary chunk at the end of the rtf file now from the  Attacker point I mean from the test point of view it all have it adds an additional granularity to the test like  Every decent malware out or could modify the appended binary shell code and the payload. That's not a problem  the first stage shall code is easily recognizable in  Relatively easily recognizable in the level text buffer. I mean it looks like a buffer of bytes that  a  decent  malware writer can  Comprehend and and modify the initial rope chain  For that you have to really really deeply understand the rtf structure  so apart from the the the granularity in the exploitation itself there is a granularity in  understanding the rtf structure itself, so it is a  Well-defined and granular test task for the for the attackers and we are going to leave it so  We are going to  Rank the attackers on the lab on the skills that they are showing to us so starting from from  Zero knowledge data knowledge means that they are buying on in the underground market base is a generator and they are going to generate a  sample with it  Basic skillset  involve replacing the payload in an existing sample intermediate knowledge  attackers can modify already the shell code  Skilled ones try to make some trivial modification in the rope chain itself  advanced and protesters  can make significant modifications in the rope chain or the exploit trigger and  And the real good ones can control every single aspect of the exploitation that is going to be the scale that I will place the  APT authors so the the first version of this  research was published in February  At our blog  I'm not going to touch all of the families and the groups mentioned in that  Because that would be an even longer presentation  You can go there and check that but I'm going to mention a few additional ones because we which were not known at the time of  Writing that paper. So let's start with suspect zero the first ever sample that we could identify  using this as well. This is going to be the base point of  Of comparison as it turned out  All of the further samples were derived from this one  There was no independent development going on in this exploit. This was a destructive trojan  appeared last April and it displayed a decoy with some  Mayor partners seeking advertisement  Clearly  Because of this kind of decoy and a destructive payload  It was not used in the targeted attack as you would expect from from an APT player who  Would deploy zero day. I think it was deliberately released  A little before Microsoft  Patched this vulnerability  The reason is unknown perhaps the  Perhaps to cover tracks because if there is only one single entity who knows and uses this vulnerability  every every  Evidence points into the bad direction. It's other starts to using it. It will get scattered. Anyway  in this case the document starts with a large  chunk several kilobytes of  Really junk contents context not used not displayed  But it is very convenient for identifying everyone else who was copying this content  Clearly this guy whether developed it was a highly skilled one  There was some early birds  One week after this the initial sample was released a couple of targeted attacks were  Performed using this vulnerability  Mainly by the Duke group  That was recently blocked by by f secure a great overview by them  It was  Targeted against diplomatic targets and they they made  Very significant modifications to the exploited document. For example, they cut all of the junk that was at the beginning of the file  They stripped down  nearly to the minimum to the the RTF contact and  Also changed memory location within the rope chain. So they made  Very significant changes in the the exploited documents. I'm not saying it is not possible to do all that in a week  I'm sorry, but it's very unlikely that happened  So my guess would be that they had prior or prior knowledge of this exploit  Before they started working it if I had to guess I would say that  This is the group that is most closely connected to the source of the exploit  Now the the Dukes have a reputation of being supported by the Russian government  They have huge financial resources and they have a history of using zero-day exploit  So it is not an unreasonable assumption that they were the first one to use this exploit, but there is no  Strict evidence pointing into that direction. Anyhow because of the changes they made to the rope chain  clearly dangerous and probe criminals  There was some direct descendants  That were using the original sample and they didn't do anything else  But swept the exploit step the payload the binary  Trojan at the end that's clearly a very basic  Modification this samples appeared about one week  One month after the the original really really is and they are they were used by the petit tiger a PT group  When I said they didn't change anything that's not entirely true  They changed the the author name from is my is my to is my which is  something you could do in two seconds in a text editor so that doesn't constitute as a  Major skill anyway, but this is this group showed the very basic skills of exploit ability  And then comes an interesting strain which is metasploit and and the direct descendants from it  Metasploit is a great tool for researchers for  for penetration testing  understanding the  The exploit and so it is also a great tool for Malware authors  and they are  Using it extensively to generate new samples for it like  In the cases I'm going to show you the  the metasploit module appeared about a week after the original release of the first document and  The clearly the web were created that module understood some of the  the Europe exploitation at least to the level that as I mentioned in the  Main rope chain. There are some unused  filler bytes which are there only for that to be popped into a meaningful meaningless  Register now these were filled in the original sample with the  41 hex bytes now in the metasploit module  They were filled with random values. These are these these whites that could make us  Possible to identify whoever was ripping metasploit for samples. Anyway, whoever developed metasploit module was a skilled  exploiter  one of the  direct  Descendants from Metasploit was the  The havex malware which was mentioned also mentioned yesterday in presentation as targeting energetic sector  Looking for industrial control systems, but when I created these slides, I didn't know that it was going to happen  So I picked another one and another example and that was the inception  Group it was reported by blue coat and later on by Kaspersky under the name cloud us Atlas  And they directly connected that with the famous red October campaign  anyhow, but they did it they generated a  Sampled by metasploit then swept the shellcode and the payload and they just replaced it  Plus additionally in case of inception they prepended another exploit block at the beginning exploiting an older vulnerability  However doing that  They messed up with our TF cell structure. This is a very delicate  Vulnerability if you mess up with the rtf structure, it will break the exploit and that happened in the case of the  inception group they  Generated about 13 documents  With this exploit and sit in 11 of them the exploit was actually broken. So they generated the  Asample with Metasploit just to use this vulnerability and they broke it in about 90% of the cases that's really  on one hand  They are skilled because they touched the shellcode and the payload on other hand  It is shadowed a little by the fact that whatever they created was not working  anyhow, there is a huge  Group of samples using this exploit that we're using some sort of generator sample generator  One could argue that Metasploit is also a generator, but now here I'm talking about  commercial tools  released in the underground  Circles one of them  I don't know what the generator is. I don't know the name for it. It has not been  Reported yet. We just see that hundreds of samples are generated by it a lot of  Common banking trojan families are being distributed it and it is right now dominating the the  Exploitation scene so the largest chunk of exploited documents that we are see right now on a databases are generated by this tool  It has  Apart from the the the main block main level text block that was the rope chain and the shellcode an additional  two additional blocks that  Have the same filler value all over them it is not used it is pointless  But it can use it can be used as a watermark to point out the all these samples that were created by this toolkit  anyhow  Because they did touch a little bit of the  The level text structures and the exploitation stuff is sort of an intermediate skillset was whoever was  Writing this this generator another one  Microsoft 13 through there  It was blocked by  Fire I and later this year just a few weeks ago  We have released a white paper about this one. That's the other large chunk of  Exploited samples that using this vulnerability also hundreds of documents created with it  I  Suggest to read our wallpaper because that's very interesting and I don't have  The time to go into details into it  anyway, it has a very distinctive characteristics and it is  One of the very very few cases when the the  Malware authors actually touched the rope chain and  They built an alternative rope chain instead of the original one so it is performing the same task  It it requires two more  Building blocks it is a bit alternative route  But  documents generated by this toolkit  Exploit three different vulnerable it is within the same  RTF file  and also dozens of mostly banking trojans were distributed by  Document generated by this toolkit anyhow the level  Of skills that's that the author of this kit showed because he actually they have to touch the rope chain  It's really a someone who understands exploitation at a high level  a very interesting case  Was the Rotten tomato case now?  I  I'm a physicist by education. I'm a lousy programmer. I  When I have to do programming I do as a physicist. I take an example program modify to my needs and beat it with a stick until it works  It was surprising to see that an APT group  Chinese APT group followed just about the same  Path of development except for the until it work parts  So what they did  They wanted to use this exploit in their campaigns  So they took a sample generated by word intruder which was mentioned just  one slide before and the  There was a third  exploit block at the end. They just got rid of it  perhaps it was  too complicated to modify that in place for them  They replaced the first exploit ball block  Appended their own payload and started to use it in a campaign now the problem with this picture it exploit to vulnerable it is  If the first one is activated then the Trojan the APT Trojan by this group  Some other plug-ins backdoor is get a gets executed if the first one is triggered  Then the the original Z bot sample from the original sample that they ripped from word intruder gets executed  So depending on the condition. It's either an APT or a common cybercrime  It is really an unwanted situation for this group  mostly because they  Grab the sample so that they could use actually the exploit so  What they took they grabbed another sample where this  761 exploit worked  and  They cut out the original one for the from word intruder copied into it from that  other example  And there it goes one problem like I mentioned until it works part  Word intruder has a slight problem at least  In half of the samples the exploit doesn't work  So this Chinese APT group didn't get lucky they picked the sample where it the exploit didn't work actually  But when they copied the block from this another example  They overwrite they did overwrite the non-working exploit with a working one and  They broke it immediately  because  In this case this shellcode looks for the payload at the fixed file offset  Because and when they copied it into their own document  There was this unused encrypted  Zbot executable at the beginning another exploit block so this fixed file offset was shifted back into the that file  But this Chinese authors never  corrected the shellcode for this offset so  And they created samples and they used it in target error text where this exploit never ever actually worked  and they were  Using it for months in different target error text. They started it using in Russia  distributing  plug-ins and  Then they moved their operation against India and Pakistani targets  Anyhow they show a really basic set of exploitation understanding and I'm  Being very generous to them with this classification. Anyhow, there was one case of successful integration  I don't think it was used by the same group  it was deployed in in  Arabic countries  When they actually fixed the shellcode offset and it actually dropped a Zbot  anyhow  Let's switch to the the evolution part  so  In this table  I just blindly copied all the the malware families that I have seen created  I have seen using this exploit and just by looking at the samples. I was  placing them  Into that skillset matrix. However, here comes the fun part. It's a university professor. You can do nasty things  One of the nasty things is to see if they actually work  Like I said  In many cases in fact in the case of this exploit more over  Over half of the cases the exploit actually didn't work. I mentioned it with the inception  I mentioned it with birding through there  the  Generated or used samples  they just contained broken versions of this exploit and the supposedly  highly skilled  Cyber criminals they just fail to realize this fact. So that just takes back a little value  from their evaluation and  The other thing is the relations  really  One of my university professors had this really bad habit after test. He started to create  Disindancy  graphs who was copying from whom and  And modified the marks accordingly. So I'm doing the same with these malibu routers  For example a large chunk of samples or sloucher of cyber crime groups  Although the samples they are using show  Large are great understanding of the exploit. That's not they merit  It's because they are using the birding through there or some other generation generator. So they  The  The merit goes to whoever created those tools. They are the actual users of the exploited documents  The skill set extends only to the point of executing a  Generator and using whatever is the spit out of it  so  In this picture you can identify a couple of high profile APT groups  For example the pity tiger or a genetic energetic beer group, which I mentioned  Number panda or nightshade panda they were responsible for the rotten tomato cases  Hangover team also showed their mark in this in this table karma panda and the dukes which I mentioned earlier  So really this is the evaluation part  of the test and this places all the  Approval all the groups in their appropriate places. So the here is this dividing line anyone left  on the in the table  understands  Whatever happens after the exploit happened so they can  Deploy their malware they can modify the payloads, but they really don't understand the exploitation itself  They don't have in-house expertise in exploitation  Whoever are on the right side in this table. Those are the really dangerous players. Those are the ones  who  understand exploit  exploitations  Five formats and they apparently have in-house expertise. Now what this table doesn't show are the numbers the vast majority of  the incidents that we can see 99.9 point  whatever percent belong in this region where  Used by players who show little to non understanding of the exploitation and only a few  Incidents belong to the real dangerous guys and even these are shadowed by the fact  that  Even though in solving the problem they show high  High skills  Whatever they created was not working. So they may be good programmers  They may seem to be good at exploitation by but they clearly leak the key like the capabilities of  Determining that whatever they created was actually working or not  so the the conclusion is that  Malware outlaws in general even the the highest profile APT or cybercrime groups are clearly lacking in  in QA  They don't they are not checking  Whatever they are using in in actual attacks if  They are working or if these are multi exploit samples that every individual exploit is working in the samples  The common cybercrime group groups who are deploying banking trojans have a better supply chain  Because someone is doing the generators for them and they are buying it  But even though however skilled these groups are they don't show enough  Knowledge and skills to port this vulnerability to other office versions. So  There is a certain limit  in their in their capabilities  But they are very eager to use any new vulnerability that is available and  Immediately as they can get their hands on it  And they are going to use it in a text or try to use it in a text  But a final warning for you even though they are not  Really the ninjas you you should be afraid of just cat burglar's  Once they get into your house, they show very high capabilities and skills in  Emptying out your house and cleaning out or your assets  So they may not be good at exploiting but once they get hand and they get their food into your organization  They are very talented and resourceful. So be aware but  You should know that if you keep up with  the exploit information  They are not really much ahead of you  And  that oh  I have some final slide. I I said it was going to be a test  So let's see if it is really a test and here are the the objective criteria by a MTS or not in my testing standard  Organization, so I'm just going through some of the criteria. I don't think I'd end danger the public by this test  I'm certainly not biased towards any of these groups. In fact, I'm equally biased against all of them  I think the test was reasonably transparent the testing methodology  I mean I spent the first 25 minutes explaining you the testing methodology. So I was pretty clear about that  And  Finally the test should have an active contact point which in that case should be me I guess  So that concludes my presentation I  Think  As I look around  I don't see too many people sleeping. So I guess I  Reached my goal and kept you awake that take it as an accomplishment. Thank you. You
G__borSzappanosComparingtheincomparables_0_47.png G__borSzappanosComparingtheincomparables_48_407.png G__borSzappanosComparingtheincomparables_408_6503.png G__borSzappanosComparingtheincomparables_6504_11795.png G__borSzappanosComparingtheincomparables_11796_15023.png G__borSzappanosComparingtheincomparables_15024_15707.png G__borSzappanosComparingtheincomparables_15708_15971.png G__borSzappanosComparingtheincomparables_15972_17147.png G__borSzappanosComparingtheincomparables_17148_17219.png G__borSzappanosComparingtheincomparables_17220_17279.png G__borSzappanosComparingtheincomparables_17280_20519.png G__borSzappanosComparingtheincomparables_20520_20579.png G__borSzappanosComparingtheincomparables_20580_22571.png G__borSzappanosComparingtheincomparables_22572_22967.png G__borSzappanosComparingtheincomparables_22968_23867.png G__borSzappanosComparingtheincomparables_23868_25415.png G__borSzappanosComparingtheincomparables_25416_26063.png G__borSzappanosComparingtheincomparables_26064_27059.png G__borSzappanosComparingtheincomparables_27060_30659.png G__borSzappanosComparingtheincomparables_30660_30719.png G__borSzappanosComparingtheincomparables_30720_31643.png G__borSzappanosComparingtheincomparables_31644_33155.png G__borSzappanosComparingtheincomparables_33156_33563.png G__borSzappanosComparingtheincomparables_33564_35951.png G__borSzappanosComparingtheincomparables_35952_36683.png G__borSzappanosComparingtheincomparables_36684_41795.png G__borSzappanosComparingtheincomparables_41796_41843.png G__borSzappanosComparingtheincomparables_41844_42107.png G__borSzappanosComparingtheincomparables_42108_42695.png G__borSzappanosComparingtheincomparables_42696_43235.png G__borSzappanosComparingtheincomparables_43236_44891.png G__borSzappanosComparingtheincomparables_44892_46019.png G__borSzappanosComparingtheincomparables_46020_48395.png G__borSzappanosComparingtheincomparables_48396_54563.png G__borSzappanosComparingtheincomparables_54564_57059.png G__borSzappanosComparingtheincomparables_57060_57575.png G__borSzappanosComparingtheincomparables_57576_58523.png G__borSzappanosComparingtheincomparables_58524_58595.png G__borSzappanosComparingtheincomparables_58596_59735.png G__borSzappanosComparingtheincomparables_59736_59795.png G__borSzappanosComparingtheincomparables_59796_59999.png G__borSzappanosComparingtheincomparables_60000_60335.png G__borSzappanosComparingtheincomparables_60336_66659.png G__borSzappanosComparingtheincomparables_66660_67739.png G__borSzappanosComparingtheincomparables_67740_68255.png G__borSzappanosComparingtheincomparables_68256_73007.png G__borSzappanosComparingtheincomparables_73008_76019.png G__borSzappanosComparingtheincomparables_76020_77099.png G__borSzappanosComparingtheincomparables_77100_77759.png G__borSzappanosComparingtheincomparables_77760_77797.png