Tony Lauro – Preview of Obfuscation Techniques and How to Tame Them

you Hey everybody. My name is Tony lauro. I'm with Akamai.

I'm director of security strategy and technology today. I'm going to talk a little bit about common obfuscation techniques that we see from attackers. Now when you're building your environments, you may not necessarily think of these in the Forefront, but what we see in terms of why these attackers are trying to hide their techniques is because they're trying to evade detection.

So if you're part of a blue team and if the systems You're Building are going to be internet facing they're probably going to see some of this activity. So let's get started. So just a little bit about myself been at Akamai for about nine years.

I used to manage our Enterprise security architecture team. Now, I'm on the strategy team and basically I I'm speaking with csos helping them understand what we do and then getting feedback from them as we develop new technology to make sure that as we bring that to the Forefront of the marketplace that it's actually going to do what we needed to do. So today we're going to talk about Four Deadly common obfuscation techniques, I took deadly out of the picture there because obviously these aren't going to kill me buddy, but you will definitely see them around The first one is impersonation technique, we're gonna have some fun with this.

You know, I think one thing that's kind of interesting is when you think about traffic you see from the internet a large portion of that is automated traffic right Bots and Bots have a job to do they need to make a request. Into your page for SEO purposes and site ranking you want to really provide them the ability to be validated. So you're giving them the best possible.

You know relationship to your page. Now, you know, this obviously is is one of the biggest things that can be abused by attackers. So for instance how to attackers take advantage of this.

Well first thing that we've seen is, you know, if you're familiar with Google Sheets, which is basically the Excel of Google I'm gonna script up, you know hundreds of thousands of requests to come from Google Sheets and I'm gonna send them using the header the same header as googlebot. Right. So now you have a request that's coming from Google address space and it looks like it's coming from googlebot.

You may whitelist this but if you if you're not sure exactly what these are doing, you may run into some problems. So we're gonna ask for ourselves a question. Is this Google but and how do we validate this?

Right? So really to to understand what the bad Bots are you first have to identify and validate? Very succinctly what the good Bots are and who they are.

So we look at the user agent for googlebot. Says googlebot. It's also going to send a full user agent string.

I mean, these are things that are going to be sent in the specific order the header structure the header orders going to be exactly the same every time and then the autonomous system number listed for Google on the domain listed for Google. This checks out. This is googlebot.

But when we look at the request sent from Google Sheets will notice something kind of interesting even though the as numbers the same that domain is actually listed differently. It says Google user content as well. Even though the as numbers the same the IP range is different.

If you're to look up this IP range it says this is a sign to Google user content domain and not googlebot, right? So this is not googlebot. So part of this.

Is is first that really understand what we're looking for to identify the actual information around a good bot that's making a request. So obviously here when you look that up it says this is assigned to Google Cloud customers. Obviously people are taking advantage of this.

There's a lot of information online for how to run these scripts you'd be surprised. How often and how common requests from Google Sheets comes out and their white listed by Blue Team Defenders, right? So this is something we do not want to do one instance of why this could be a problem is this is something we saw from a particular customer.

They were getting hit with a scripted but distributed get flood from Google user content domain using this technique and it drove their CDN costs up over a thousand percent. Right? So if you have a CDN on the front end, it's gonna do its job and it's gonna say, hey you're making a request.

I'm gonna feel that request so having This I have traffic up over a thousand percent is not good. So obviously you have to have some mechanisms to that. The next example is so a site technique and it's something we see through raw streaming through GitHub user content.

The idea here is what we're looking at is a remote file inclusion to Shell Mass exploitation T. So ultimately the attackers are using this a flaw in some of your code. To trick your website into downloading a webshell right in this particular case.

php. But what's interesting highlighted in yellow is it's coming from GitHub user content. So when you look at the the rules and the parameters for remote file inclusion detection one thing that might make this look legit is it's going to a valid domain, right?

So, of course if you're looking at this specific URI path, you'll see it's just tools and shells BP scan that PHP you would probably not allow that but from a large scale perspective, if you're you know, allowing domains. This may be in a loud list the other interesting thing here, obviously, if you look at the beginning of the URI, this is what makes this hormone inclusion available to be attacker. So this piece here is where the actual flaw exists and that's where the attacker is going to append instead of going to Source equals and looking for maybe a local file or a local image or even another domain that you do have access to that.

You should be referencing this is referencing malicious code. So obviously you down download BP scan. This is reverse shell and what's interesting.

About this technique as well is when I'm an attacker and I'm doing a mass exploitation campaign. I'm gonna do this on a very broad scale. I don't want to have your you know, if I'm sending out a hundred thousand requests.

I don't want any of your requests coming back to my compromised web server in digital ocean. Just say I want those payloads to be massively available. So I might use this example here so that my payloads can be delivered with the speed of a CDN.

And a lot more readily than if I were to host it off of, you know, one of my own compromise boxes. The other example here we're gonna look at is called shot in the dark technique. Not sure if you guys remember this this poor cat jumping to its I'm sure it it has not nine lives, but as it jumped off of this balcony here, it just slipped and fell down in the Gap.

This is what attackers were hoping what happened when they tried to get access to one of our threat researchers accounts. So a threat researcher receives an email again, I mentioned before, you know, when we look at attacks what blue teams have to think about and what you have to think about as well is it's not just compromising the code or the system that you build it's getting access to what you have access to in order to build those systems. So this is something that attackers are always on the lookout to do so Larry cash dollar one of our security researchers receive this email first thing he said was yeah this the email says Facebook secure at Hotmail, but it's Telling him it's an alert for Google obviously not legit, right?

So as he kind of looked into this, he was like man, this is you know, this is pretexting right pretexting is what kind of previous relationship would you have with who I'm pretending to send an email as so if I'm sending an email as Facebook or Gmail that's or Google. That's a pretext which is probably gonna make it more likely that you would actually click on the message right? I did a talk in Chicago one time and I said, hey raise your hand if you if I sent you an email that said your Amazon delivery is delayed click here to find that status how many people have an Amazon delivery in flight and like 60% of people raise their hand, you know in terms of social engineering that's a great Ploy.

The other thing is baiting right? This is this is me saying there's a problem. You need to fix it, right?

There's always some kind of urgent request. Or you know take care of this right away because it's gonna cause you you know cost you money or cause you harm that's baby and that's trying to get someone to click on that. So After he looked into this a little bit more.

He said when he clicked through the link, he noticed something interesting. The page was being translated through Google Translate. in.

So from the front end perspective if you were to look at this in a mobile browser just say and you were to pull up this Google login form. It might look legit. com, right?

So this was an interesting technique the attacker was using in order to obviously if he would have just clicked on the email without looking at the email address and all that other stuff. He probably would have been a little bit more susceptible but If my mom got this message that said you have to reset your Google account. She would have clicked on that and then she would have come to this page and seen.

What looks like a Google login page after you log into Google it brings up another window that says hey connect your Facebook account because there's another problem. So it's trying to harvest credentials for Facebook as well. Now what it looks like on the the backside of this is the attacker gets it's information sent to him, but what's interesting is in this form that he used the scammers email address is in there his name, you know, he wrote the script Etc.

Yes. He was proud of this but at the very bottom it shows the credentials that the part of the code that takes the credentials and everything that you typed in and sends it to to this scammer in the email. So this is what this Famer would have seen the email address password phone number alternate email even the IP address of the victim and the user agent if they were to try to go further on and do further attacks.

So again, Google Google was used to establish, you know trust in this case and if you kind of look back at that at the domains here Google user content, you know to my point earlier is his white listed across most detection engines and there's a lot of interesting files that come up if you go to virus total or to alien involved, so I just try to pull one up real quick and it's like, oh, hey, here's a translation tool that's being sent out and it's referencing back through Google user content. Now, I don't think this translator was built on Google user content. It might use Google translator in the back as an engine.

but the idea of you know posing as a valid piece of software potentially and possibly containing malicious code is is obviously a real risk here as well. And when you look at the analysis of this particular piece of software all the different things that it's allowed to do, you know icmp net bios calls. It's allowed to communicate with VMS and inside of the VMS scuzzy adapters Etc.

If there was something bad and this piece of code was able to install it probably would have access to do whatever it wants. When you look at the things it is able to do this piece the software you see that the the severity level for each of these activities is listed rather High not for that particular piece of code, but anything that's able to do this needs to be really looked at and expected properly. The last technique is a final battle technique.

This is something that's interesting is when you look at the idea of obstacading code this is not This is not rocket science, right? There's free online obfuscaters. You know from anything from base64 to gz inflate Etc.

But we saw something quite interesting come across so we saw remote file inclusion being obscured. Via PHP obfuscation and what's kind of interesting about this is the attacker was leveraging remote filing inclusion based on a vulnerability on the customer's website. And then as we kind of look into it, we're looking at something interesting a custom function that's actually writing to the web server itself so that if anyone comes to the web server and if it's a search engine, it's going to redirect all requests from that search engine over to an adult's.

an adult website Right. So now it's it's taking the power of the eyeballs which are directed at your site based on. Search Telemetry and it's redirecting that for their own game to a an adult site.

Like this could really be played in in as a bunch of different the outcome of this could be played out very differently. No matter what the attacker was trying to do. php it executes Joomla code against the page.

It hasn't is Bob user function, which I showed you on the previous page which checks the user agent string value and if that's a again. A bot it's going to send it to an adult page. This is interesting mostly because you kind of think of like, hey, I'm gonna exploit your your service.

Or whatever codes running on in your container depending on what you know what the actual function is of your application, but what's interesting here is that this is purely just an SEO attack. It's just to take eyeballs away from where they were going to go and then send them to where the attacker wants them to go. I'm sure we'll see more things like that for for defacements, right?

So instead of defacing your page. I just compromise your page and any requests from a bot that goes to you will be sent over to my copy of your page that is for the compromise. So here's some resources, you know, we have a great security research team great blogs.

We're also hiring that's about all I have time for today. I know it was quick. But if you guys have any question, you can reach out to me the email or on Twitter.

Thank you very much and have a good day.