The DMZ - 2018-10-20

« first day (2865 days earlier) ← previous day next day → last day (2029 days later) »

3:14 AM

@jdgregson The source mail server domain can be spoofed in an email.

3:37 AM

@forest yeah, I figured as much. The IP address in question was in the X-Originating-IP header, which any server could have just made up along the path.

The email's (possibly spoofed) path is interesting. It originated from the DoD IP, relayed through a server from an Indonesian university, relayed through several servers from the California State University Northridge (on-prem Exchange), transferred to CSUN's Office 365 tenant, bounced around Microsoft's infrastructure, and then found its way into our tenant.

Sounds like a spoofed path to throw off simple analysis.

Probably originated from some Ecatel server lol

The strange thing though is that the email completely failed SPF, DKIM, and DMARC authentication (our DMARC policy says to reject), which was logged in the "Authentication-Results-Original" header. Later on, after bouncing around Microsoft's infra, MS decided that SPF, DKIM, and DMARC all passed and that it should be delivered.

Authentication-Results-Original: spf=fail (sender IP is 130.166.5.125)
smtp.mailfrom=mycompanydomain.com; mycompanydomain.com; dkim=none (message not
signed) header.d=none;mycompanydomain.com; dmarc=fail action=oreject
header.from=mycompanydomain.com;

huh

Authentication-Results: spf=pass (sender IP is 52.100.131.27)
smtp.mailfrom=mycompanydomain.com; mycompanydomain.com; dkim=pass (signature was
verified) header.d=mycsunemail.onmicrosoft.com;mycompanydomain.com; dmarc=pass
action=none header.from=mycompanydomain.com;

MS is looking into it and will hopefully have an explanation on Monday. But, it get's even more interesting when I check the audit log for the target account.

For the last month, every 12 minutes and 20-40 seconds, a random IP address from around the world tries and fails to log into that account. Usually only once and then never again. Sometimes it tries twice in the same second, and then again, never uses that IP again.

What kind of authentication does it try to use?

3:45 AM

It's like somebody with a large botnet has a passing interest in that account in particular. I'm not sure if the slow brute force and the spear phishing are related, but nobody else in my company received the phishing email and I've never seen any login failures following a similar pattern on any other accounts.

Well slow brute force itself is not unusual.

What kind of company is it? Or what industry is it in?

Manufacturing. We make high-end railing systems. I can't see why we'd be the target of anything. But the CEO, the victim of the current attacks, takes frequent trips to China to meet with our suppliers. I can see the Chinese government taking an interest in reading his emails, just to confirm he isn't up to anything they don't like. U dunno.

*I dunno.

You'd definitely make a target lol

The thing with industrial espionage is that the businesses that seem the least interesting are actually the ones that are the most interesting. I mean something as boring as epoxy resin development is one of the top targets!

That makes sense. Plus with the current state of politics they have little reason NOT to hack anything they can.

I wouldn't be so sure to point my fingers at China.

It isn't even the worst offender.

3:57 AM

I'll try to do some more analysis this weekend. I said the brute force was happening for over a month, but that's just because I pulled a month and a half of logs and it was happening the entire time, every 12.5 minutes.

Who would you point your fingers at?

Whoever wants us to think it's the DoD, I guess.

No one in particular without knowing more about the attacker. I mean France is a huge part of industrial espionage, just like China.

It could also be Russia (though I think they care more about semi research than railing systems, but who knows). Or even the USA. Unless this attack matches a pattern from a particular adversary, it's too early to say who it was.

I'm curious if any of the attacking IPs have an open port used for remote access which could provide some insights. I'll scan one in the Russian Federation, since they won't care about a little port scan.

Careful, since your ISP might not like it. :P

But I doubt those IPs are controlled by the actual attacker, as opposed to simply being used legitimately or even spoofed downright.

Well you can't really spoof TCP, since whoever sent the SYN packet wouldn't get the ACK back.

I would suspect they they're IP cameras, home PCs, and routers which have been compromised.

I thought you were referring to the domains specified in email headers.

Which can be spoofed. Are you talking about a traceroute or something (that can be spoofed too)?

4:05 AM

Well, at the moment I'm talking about the IPs which are attempting to log into the account directly, not the ones involved in the phishing attack. I have no reason to believe the university servers are spoofed, since that all makes sense. They left some relays open, probably.

Ah, OK that makes sense.

As for the IPs trying to log in, 5.202.46.77 is in Iran, so I doubt he'll care if I port scan him. I'll do it from AWS just to keep Comcast happy with me :P

Fair enough!

One second, my SSH key up and disappeared, which is... unsettling. I have to pull it back out of storage and re-encrypt it.

Disappeared? O_o

Do you have auditd or something to tell you what happened to it?

4:14 AM

Unfortunately no. I suspect my anti-virus ate it. I use Bitdefender, which has "advanced threat protection", meaning it looks for suspicious activity like scripts. So from time to time, it will kill my Powershell sessions and eat everythig it was touching.

Ick

That's one reason I prefer Linux. My system doesn't betray me randomly.

Although twice the vDSO did seem to vanish after a long-ish period of uptime (only noticed it when seccomp filters that did not whitelist calls normally made via vDSO started failing)... That was kind of unexpected. And scary.

I've always preferred Linux too. I grew up using that stuff. Starting with Ubuntu 9.04. These days though I have to write a lot of code for SharePoint and Excel Macros, so I have to stick with Windows. Plus having PowerShell is really convenient for MS environments.

Screw it, I'll just scan it from home and tell Comcast to suck it.

When I need Windows things (and Wine doesn't work), I run it in a VM and forward the relevant window to my X11 environment. Lets it integrated seamlessly with X11 applications, with just a little extra delay during VM initialization.

Not a bad idea. I do the opposite, I run Windows 10 and then spin up a local or remove Linux VM when I need to do Linux things. Plus I use Scoop in PowerShell, which is a better implementation of cygwin-like tools.

*remote Linux VM

The problem with picking an IP on the other side of the world is waiting for nmap to scan all 65535 ports on the other side of the world

5:59:15 remaining... fml :/

4:43 AM

Too long for me. I spun up a new AWS instance in Mumbai, which is much closer to Iran than the AWS US-West availability zone.

Still taking 5 hours from Mumbai. I think the problem here is that Iran's internet speed is < 1Mbps (at least in 2012). I need a more suitable target.

5:41 AM

@jdgregson You don't have to scan every port.

Just scan the ones that run the most common services.

Or you can rent a Gbit server from Maxided or Ecatel or something and run masscan on it, specifying the list of IP addresses you want to scan.

Well if I was trying to hide a service on a device I'd pick a port that nobody would bother scanning, so the only way to be sure is to scan them all :P

For someone abusing a bunch of insecure routers, it's unlikely that they've put much effort into securing the systems. Hell, most botnets built from vulnerabilities leave the vulnerabilities unpatched!

I'm currently scanning one in Vietnam and the scan is at 95.41%. That said, it was at 89.65%. I'll do a quick scan in another terminal, one second...

What kind of device is it? Assuming you did OS fingerprinting, of course.

You can often narrow down the services. For a router in a DC, you might want to check for IPMI or telnet. For a SOHO router, you might want to check for SOAP or SSH.

@ scripts > nmap 45.70.204.254
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-19 22:48 Pacific Daylight Time
Nmap scan report for 45.70.204.254
Host is up (0.18s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
25/tcp filtered smtp
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1723/tcp open pptp
2000/tcp open cisco-sccp
8291/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 11.94 seconds

5:48 AM

Like there's no reason to check for the Tor ORPort service on a IP cam.

PPTP? This thing is running everything

Seems like a firewall or router.

Try service fingerprinting those ports.

isn't msrpc and samba NEVER supposed to be internet accessible? No wonder this thing was hacked.

It says msrpc is filtered, not necessarily open.

Oh yeah, good point.

5:51 AM

nmap.org/book/man-port-scanning-basics.html

Because closed means the OS is responding "nothing lives here". Filtered means it can't even determine that (e.g. packets may be dropped).

I gotchya.

@ scripts > nmap --version-all -O 45.70.204.254
Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-19 22:51 Pacific Daylight Time
Nmap scan report for 45.70.204.254
Host is up (0.18s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
25/tcp filtered smtp
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1723/tcp open pptp
2000/tcp open cisco-sccp
8291/tcp open unknown
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3

Try fingerprinting the open ports. Also if this is a firewall or some NAT device, then whatever vulnerable system was compromised might be behind it.

By fingerprint do you mean identify service and version? I thought --version-all was going to do that for me.

Fingerprint as in attempt to connect and see how it responds.

Oh, I gotchya. Netcat to the rescue.

5:55 AM

nmap.org/book/vscan.html

Netcat also works, though it might not be able to detect the service if it doesn't respond immediately (like OpenSSH does) and simply waits with an open connection for the client to send something relevant.

nmap.org/book/man-version-detection.html

PORT STATE SERVICE VERSION
25/tcp filtered smtp
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1723/tcp open pptp MikroTik (Firmware: 1)
2000/tcp open bandwidth-test MikroTik bandwidth-test server
8291/tcp open unknown
Service Info: Host: CORE TUNINS

@ scripts > nc 45.70.204.254 2000

Looks like you got your answer. So that shows that port 2000 was not necessarily "cisco-sccp", but some sort of bandwidth test thing.

So that system is a MikroTik router. Either it is the device that was exploited, or the exploited device lives behind it with NAT. Did you manage to capture the TCP fingerprint of the attacker, to see if it matches that of the router?

Because it could just as likely be that the victim system is a Windows machine behind that router as it is that the router itself is the culprit.

I'd suspect something behind the router. And hold on, let me pull the audit log for that connection.

The audit log isn't very helpful, just a bunch of MS infra-specific IDs. The only thing I can glean about the source IP is the IP itself.

Not even the source port.

Seems you don't log enough detail.

Can you tell if it's a business or home router?

I'm not sure I'm able to turn logging up any higher on the O365 tenant.

6:07 AM

Sounds like a Windows problem. ;)

I personally keep a rolling log of raw packet capture data. Whenever an alert is triggered, the past few pcap logs are saved to storage.

It's hard to tell from what I'm seeing. It doesn't resolve to a domain name, and a geo-location lookup shows the ISP as TUNINS TELECOM.

Do you have a custom device as your edge firewall?

An ALIX board running OpenBSD.

Nice. I should do something like that eventually just so I have some control. I currently just have my ISP's router set up, and the a bunch of firewalls on my endpoints. Honestly I don't want ANY ports open to the internet, but ISPs don't seem to see the issue.

An ISP's router is almost always garbage.

You might like OpnSense. It's like pfSense, but actually secure.

And requires much less configuration than OpenBSD.

You know, I should really look into how Satellite internet works... I imagine it'd be quite possible to get free and anonymous internet with it.

6:28 AM

I may set that up some day. Though I'd have to send the ISPs router back one way or the other. It's a router-modem combo, so I can't insert a custom device after the modem.

It doesn't support bridge mode?

Actually it may. That would make things a bit easier.

I can't wait until Tesla gets some affordable satellite internet up and running. Not free, but still cooler than coax.

That all-port scan finally finished.

Nmap scan report for 45.70.204.254
Host is up (0.29s latency).
Not shown: 65405 closed ports, 126 filtered ports
PORT STATE SERVICE
1723/tcp open pptp
2000/tcp open cisco-sccp
4145/tcp open vvr-control
8291/tcp open unknown

vvr-control?

Seems it has something to do with volume replication.

@jdgregson veritas.com/content/support/en_US/doc/ka8j0000000PxqHAAS

Aha!

securitynews.sonicwall.com/xmlpost/…

@jdgregson The router may be vulnerable to CVE-2018-14847.

Yeah, good catch.

shodan.io/host/45.70.204.254

So it's not actually Veritas Volume whatever, but a port opened to get around firewalls and put a socks proxy on 4145.

Check if the other IPs that attacked you have that open port.

6:38 AM

Hmm, good idea. This is where I'd rather use Bash than powershell, haha.

I'll pull together a list and throw together a bash script.

It's also possible that this isn't a botnet owned by the attacker, merely a proxy list the attacker got (which would contain botnets, free proxy servers, misconfigured proxy servers, etc). E.g. you can get proxies like that from Vip72.

grsecurity.net/respectre_announce.php

Huh, interesting.

I just read a news story that says Windows 10 will soon use Google's retpoline for Spectre defense, giving users back virtually all of their processor's power.

Retpoline is pretty limited in what it can do.

You still need to manually (or with static analysis) instrument kernel code to protect from other versions of Spectre in order to get full defenses.

I was dealing with a legacy desktop we have set up at work for a special purpose and wondering why is it so slow. It has a 10 year old Xeon, but it still shouldn't be dragging its feet that much. And then I remembered that it's patched against Spectre and it all makes sense. But it's running Windows 7, so it's doomed forever.

Is Respectre kernel-mode, or userland?

6:53 AM

It's a compiler plugin, which usually means kernel, but I'm sure it could be modified easily to support userland code (like RAP and, if you had the "secret sauce" static analysis plugin, the integer overflow protection plugin too).

Maybe it will find its way into Windows, since Microsoft is at least pretending to like open source now.

Nope, it's only available to grsecurity customers.

And Brad Spengler has such a... abrasive personality that it's unlikely that he'll ever release it back to the public (technically you can make GPLed code customer-only).

There's a reason I'm so pessimistic about Linux security now that grsec is non-public.

I've never heard of them. Did they used to be public? Their current model seems to be counter open-source.

It used to be public. Grsecurity and PaX basically invented a large subset of the security techniques we use today (NX and ASLR, SMEP and SMAP, etc. are all based on their designs). They also created the first fully-functional forward and backwards CFI for the Linux kernel called RAP, as well as complete refcount overflow mitigations and complete integer overflow protection.

They went closed because of drama between the founders and the Linux Foundation, Intel (specifically its subsidiary Wind River Systems), and Google.

4

A: What is KSPP (Kernel self-protection project)?

KSPP is not a competitor. It is a project to get improved security features into the Linux kernel, funded by the Core Infrastructure Initiative. Grsecurity, on the other hand, is a security patch for Linux produced by Open Source Security, Inc. Grsecurity is implemented as a series of modificatio...

The sad thing is that, right now, the default configuration for Linux (either from kernel.org or from most distro-specific kernel configs) is a good bit less secure than the Windows kernel, even though Windows is closed source. Linux has better potential when configured properly, but by default, it kinda sucks. Grsecurity reverses that, making even the default Linux kernel the most secure large monolithic kernel available.

7:13 AM

That's rather unfortunate. I'm surprised I've never heard of them. Though I'm only recently getting into security. What kind of entities are able to be subscribers of them? I'd imagine their mitigation would be included in Redhat's distributions if you have a subscription with them.

Companies only, it seems. However it shouldn't be hard to form an LLC and buy.

It's kinda expensive (like 6k USD per year, minimum).

Although I'm willing to pay in full for anyone who wants to purchase it in the name of their own company, since I want a copy myself. :)

That is kind of pricey, but not nearly as pricey as being hacked. Some friends and I are thinking of starting an LLC, mostly just as a holding company for us to explore our ideas. Though something like that wouldn't be on our roadmap for many years.

Is that a per-host cost, or per company?

That's their "budget" price which allows up to 10 installations.

Of course, there is nothing forcing you to install on 10 systems or less. They just ask you before you buy how many systems you plan to run on it, and adjust the price based on your answer.

Well if you ever want to purchase grsecurity, get in contact with me via email (it's on my profile). I have plenty of bitcoins and can pay for it in full. :)

Ah, that's not bad. If you're willing to put down that kind of capital why not just start your own LLC? :P Well I suppose you'd have the endless tax headache.

Anonymity reasons.

Same reason I can't just pay them via bank transfer (since I only have bitcoins at my disposal). I make money but do not like to disclose to anyone who I am.

7:23 AM

I gotchya. Sounds like they're missing out by not accepting Bitcoin.

They don't like selling to "individuals" because they're afraid their open source code will be "leaked", which would let Google and Intel read them, which grsec does not want.

That does make sense. A bit selfish of them though.

Scan is done.

They are selfish people, even if they are brilliant.

Well, what's the scan tell you? :P

Of the 414 address sample, 314 of them have port 4145 open -- 75.8%

So it's a router botnet composed primarily of victims of CVE-2018-14847.

7:27 AM

Yeah, I think it's safe to say.

How badly do you want to find out who was trying to log in to your systems? :P

Versus how badly do I want to stay out of jail? Haha

Hey, if the feds are allowed to hack back...

Just pwn a few of these routers and see who tries to connect to them.

Plus that is a global network, so as soon as one government realizes that have to work with another they'll just drop the case.

My guess is that it's used by a lot of people, not just one guy. Most likely not even developed by the guy who attacked the routers. He's likely just using the socks proxies that were put on the routers to attack you (among others).

7:33 AM

Haha, yes, they are socks proxies for sure. I am using that Brazil one right now.

Hello everyones.

ehehe

Collect a list of them. Might come in handy.

I'm sure they will. And if they all get patched, just scan the internet for more addresses with port 4145 open. I'll create a paste of this, one second.

Make sure it's a private paste.

Otherwise spiders will find it and burn the proxies.

That's true. I can email it to you if you'd like a copy.

Definitely, thanks.

7:38 AM

See? Scanning all 65535 ports paid off after all :P haha

Heh, true, true.

Your email address... it copies and pastes backwards?

That's a rather effective anti-harvesting technique.

&#x202e;<code>&#99;c&#46;li&#97;<strong></strong><!-- fuck tha po-lice -->m&#114;іa&commat;egr&#8204;<!-- -->e&#0007;m&#x200b;tѕ<b></b><i></i>er&#8203;o&#102;</code>&#x202c;

I'm using RTL. So yeah you can't just copy-paste. :P

Alright, sent. Let me know if you got it, I might have typed it wrong.

Yep, got it.

Thanks.

7:47 AM

Alright, cool. I wonder if the DoD address from the phishing attack has a proxy...

Damn, no port 4145. I'm not about to mass-scan a DoD router though :P

Everyone does it. On IRC, I used to have a ping command as my QUIT message. Anyone who put it in would suddenly flood a DoD server with ICMP messages containing a payload that, in ASCII, was something like "I will kill Obama".

Never saw anything on the news about arrests.

Hahahaha. I lol'd.

I guess they just don't monitor that stuff. And I can't really blame them, I don't want my tax dollars going to pay some fool to examine port scans and ICMP payloads all day, every day.

Port scans happen all the time. It wouldn't trigger anything more than an alert that may block those addresses. And it's not like those servers have anything really sensitive on them anyway.

Yeah, they wouldn't exactly tall IANA to apply a label like that to something important. If only it said "NSA Tailored Access Operations", that would be the fun stuff.

The Vault7 leaks and such contain some interesting info on that.

On how to recognize some specific CIA hosts (which are, obviously, not linked at all with the CIA. Actually they're infected foreign mail servers and such).

7:58 AM

And they we're not allowed to hack anything. That's just not fair.

mhm

That's why I have a complete and utter disregard for the law.

I disregard some laws. Like the speed limit. The law doesn't follow that law either.

So do these socks proxies provide any extra features, like access to the router's firmware, or the network behind the firewall? I might have to re-exploit to get that deep.

Yeah you'll have to exploit the system again to get into it.

Chances are, the attacker did not patch the vuln when they got in.

If they cared about that they would have tried to secure the proxy too I'd expect.

Well it's not like a few routers are a massively valuable resource.

8:05 AM

Yeah, that's true. Let's get into one of these things.

Obviously after routing through one of them.

I'd do it through Tor tbh.

Who knows, maybe each router logs unauthorized access and reports it to the botmaster. Better safe than sorry.

God forbid he gets pissed and fucks with my netflix experience.

Or gets arrested and gives up the access to LEO who collect a list of users.

Good point. I can set up Linux to use Tor system-wide, right? I need to send metasploit through it.

Well you can but it's better to use torsocks and just set Linux to block non-Tor connections, since transparent proxying ("system-wide Tor") has some ugly leaks.

So torsocks <command>.

8:23 AM

So I got torsocks working. Now to bloc the other connections

Set Tor to run in a specific group or as a specific user (if it isn't already), then ban outgoing connections from anything but that user.

Looks like it runs as debian-tor by default, and then I ran this to block all others:

iptables -F OUTPUT
iptables -A OUTPUT -j ACCEPT -m owner --uid-owner debian-tor
iptables -A OUTPUT -j ACCEPT -o lo #used to allow traffic over the loopback device and is completely safe.
iptables -A OUTPUT -j ACCEPT -p udp --dport 123 #allow outbound NTP connections that are not routed over tor
iptables -P OUTPUT DROP
iptables -L -v

Well remember that a malicious application could use UDP/123.

I'd drop it for now.

9:13 AM

Ugh, this is too much work for tonight. This exploit seems promising: exploit-db.com/exploits/45170, but for whatever reason, 'metasploit' isn't a python module on my Kali VM.

So after all this digging, some things are clear:

1) somebody who acquired a list of open Socks proxies has an interest in my CEOs email account

2) we need to set up 2FA on his account

10:09 AM

You know what I hate more than anything else? Websites that use custom mouse cursor icons. I found a blog talking about the Homolka and Bernardo murders with a retarded machine gun as the cursor: krispykreeps.tumblr.com

« first day (2865 days earlier) ← previous day next day → last day (2029 days later) »

Transcript for

Oct '1820

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile