Linux compromises
- Linux systems are 'occasionally' targeted by actors, especially cryptomining and ransomware crews.
- This process can be similar to Windows machine compromises but some areas are specific to each flavour
- The below are a brief
overview of the exploitation, protection, detection and remediation
processes of Linux operating systems.
Exploitation:
- Same process as windows devices:
- Exploit external facing service
- Establish persistence
- Collect credentials
- Move laterally
- Similar to Windows:
- Patch
- Including applications
- Cron job with apt / yum update
- Limit number of admins with sudo powers
- Application whitelisting (fapolicyd)
- ACSC also have a Linux hardening worksheet which could be useful (Hardening Linux Workstations and Servers)
- Utilising Logs
- Weblogs
- Exploitation attempts
- Webshells
- Commandline logging
- SSH logs
- Memory images (which I don’t think is a viable way for continuous detection, for incident response more likely)
- Use Yara rules to search for malware; Volatility plugin
Process data:
- ps -eaf
- pstree
Get service (cron) data:
- ls -la /etc/cron*
- Cron jobs redirecting to "> /dev/null" are worth checking out
- Change passwords
- Regenerate keys (e.g. In ssh)
- Remove added users
- Clean off malware (webshells, scripts, implants)
- Remove cron jobs
- Monitor for reconnection attempts (from known malicious IPs)
Fantastic Access Tools
- Attackers are increasingly using remote access tools to gain and maintain access to the network, through the utilisation of either:
- Tools already deployed (and obtaining creds)
- Deploying own software
- Event 4688 - process names
- Event 4697 - service creation event (if tool was installed as a service)
- Sysmon - process names, DNS lookups / network traffic to known RMT domains
- Firewall logs - connections classified as app
- Can also manually check with a host using:
- Wmic /node:<target> process list
Tool brief overviews
- Recent report: Anomali, ‘ScreenConnect Remote Access Tool Utilizing Ministry of Foreign Affairs-Themed EXEs and URLs’
- DameWare
- Requires incoming connection from the internet on various ports
- Connects to IPv6 local host
- Shodan.io - product:dameware
- Dwrcs.exe
- GoToAssist
- Generates outgoing HTTP/S traffic - look for logmein or gotoassist
- Gotoassist.exe
- ConnectWiseControl / ScreenConnect
- Generates outgoing HTTP/S traffic
- Screenconnect.clientservice.exe
- Commonly used for phishing emails with a URL that deploys ScreenConnect directly
- Keep an eye out for any remote management/access tools
- Most of them will probably be "legit". If they are, ensure they:
- Use MFA
- Turn on logging
- Manage the users
- Turn off processes when not in use
------------------------------------------------------------------------------------------
SDBBot
- SDBBot is a remote access trojan identified by Proofpoint in 2019. The ACSC issued an alert in November last year about increased sightings in attacks targeting healthcare. It's often used to drop ransomware.
- Initial infection is usually via ISO or Excel email attachments. It sends C&C traffic over port 443 in a plaintext protocol.
Prevention:
- Microsoft's Attack Surface Reduction rules
- Block ISO attachments and downloads
- Block non-HTTPS traffic over port 443
'Lo-Tech OT hacking'
- A general primer on finding and securing 'human-machine interfaces', or HMIs - i.e. dashboards for SCADA/OT equipment.
- Common exposed HMIs include HVACs, fridges, etc.
- Cool Shodan search: https://www.shodan.io/search?query=screenshot.label%3Aics
- HMIs are easy to find and access. Targeted industrial sabotage is unlikely; most hackers are bored and poking at low-hanging fruit.
- This maps with OTORIO's report about the Israeli reservoir 'hack' in December. They concluded that the attackers likely 'did not possess any deep industrial capabilities or knowledge' and targeted the system solely because it was unprotected.
- Note: we calle attacks on these devices 'annoying' but 'unlikely to be dangerous'. An attendee pointed out that a hacked fridge could be catastrophic for a hospital or pharmacy storing temperature-controlled medications.
- Recommendation is network scanning and searching Shodan for modbus and dnp3, plus other common HMI ports and protocols.
Teamviewer
and remote access security
- In light of the Florida water incident, they added some points about securing remote access/support tools. Nothing too exciting, just 'figure out what tools are in use at your organization' and 'maybe try to secure them?'
- Apparently there will be a more detailed brief on this incident later.
0 comments:
Post a Comment