all right hey folks
ryan here with the cactus con crew once
again and with
the veyox and we have bear of berlin
hello fellows thank you for joining
appreciate it
thank you for having us classic
overlapping with multiple speakers
gotta love it all right uh we're about
to get into a q a
further session uh but first let's throw
a giveaway
your way we have the amazon
50 amazon gift card sponsored by
digital shadows so we're gonna go ahead
and just give that sucker away right now
let's do it and survey says
boom all right null crisis is the way
i'm gonna go ahead and pronounce that
congratulations and thank you again very
much to the digital shadows crew
destined at all unless you didn't want
me to say your name in which case
too late so thanks very much that's
awesome
um i don't know about the rest of folks
but i like i like money
so good stuff we have a whole bunch of
discussion going on
in the channel and there's a lot of
really good things to dig into
also as we were discussing off air there
are a number of lead-ins essentially
from the previous talk
so it's just kind of like hey malware
analysis and triage stuff and then oh
hey look at this
so i think that worked out really well
um if
uh our team did it on by design awesome
if not well let's pretend we did
so before we go any further and do the
actual questions
uh anything that idu fellows want to
throw out there bring up now
oh sure thank you just thank you thank
you everyone
um thanks for uh everyone uh there's
been a lot of good conversation in the
chat so that that's great to see
um jonas yeah absolutely no i mean i'm
just really happy that there's a
discussion going on
uh there's some great stuff going on
right now around
uh you know when do indicators uh
when do we share them i think um for the
vaox and i
we kind of looked at this uh from a
perspective of okay
if you if you get an incident at your
company or something and it's relatively
you know new that's when you're really
going to be looking from the ups back
up sec perspective of let's not divulge
that we're looking at this
publicly to the attacker necessarily
let's wait a while
for that information to be published so
i thought that was interesting to
to give our take on that i saw another
comment about stage versus stages that i
just went to go into so a staged
payload would be something where the
initial show code is just going to be
reaching out and grabbing the rest of
uh the payload code and then executing
that
on the system so it's a much smaller
shell code that actually needs to be
executed it's going to fit into memory
buffers a lot easier
right this staged less stage less is
going to have kind of like your your
whole pack it's going to bring all the
tools with you
but again going to take a lot more
memory space so
you know in certain cases um it's it's
not going to fit into
a vulnerability that you want to exploit
that's where the staged obviously comes
into play
awesome cool thank you for addressing
those bad boys
uh let's see do we want to tap on public
versus private sandboxing in general or
was that already kind of
the general let me let me actually let
me flip that around a little bit
so the whole conversation for folks who
weren't following along
uh in the talk discussion i believe
primarily was about indicator management
essentially is what kind of dovetailed
into
like well okay when you age out an
indicator all right there's
there's really is no quote-unquote right
answer on that i'm sure the three of us
now
all malware folks would have different
responses that different you know
whatever
um and there's some folks who you know
some of us know very well in the chat
you know who are like
do it this way and we you know it's just
been a common thing
so let's let's look at it this way are
there any
private sandboxes that you believe would
work
better as a public sandbox any kind of
just you know a thought process of like
well this is something we normally
use privately but if this were something
that could be public slash maybe
crowdsource or what have you would that
potentially change things just trying to
think of a question you wouldn't
normally think of
i'll take that because it's something
that i've that i've thought about
recently
uh a lot especially around phishing um i
think it'd be really interesting if if
there was more crowdsourced responses to
fishing sandboxing
right because there are you know
multiple different actors that are going
to be attacking different orgs some of
it's
cross organizational be great to kind of
get more of a community focus i mean
there's some
you know there's another thing that i'd
like to see is um crowdsourcing
fake login pages i think url scan has a
little bit of this that i've seen that i
like
where it'll it'll over time it'll it'll
identify you know like a fake law a
microsoft login page on a
on a non microsoft domain or it'll flag
it as like hey potentially
you know a fake login page it'd be cool
you know maybe
you know using using those kind of of
sources
and and getting that more crowdsourced
and instead of you know only for your
orgs i think a lot of people can benefit
a lot of
organizations can benefit from from that
information
absolutely and just to piggyback on that
a little bit
and as someone pointed points out in the
chat here checking hashes is one thing
um but i think more of what i had in
mind was like submitting the actual
binaries themselves to a public um
sandbox because you never know that
might be the first time
that that binary is submitted to that
sandbox and
you never know threat actors you know
what they might be monitoring
so that's where the that opsec piece
is is important the fir very first edr
uh enterprise detection response for
folks who don't
uh are familiar with the term general
that i ever used and that we used at a
particular location that i will not
disclose
let alone the name of the edr its
default setting
was any binary that it was analyzing was
to upload it to virustotal
what yeah that was my next point was the
automated
piece right i mean i think that's the
other portion of like
where where are where is the uploading
of of of
evidence coming if it's a manual thing
well then you have the analyst
discretion right you can kind of tune it
around
the situation have situational awareness
if if you're if you're automating for
instance
sending all of your artifacts you run
into issues what if what if there is
pii what if there's any sort of company
information in those artifacts that they
that the attacker
put in right there's there's reasons why
you would want to kind of stop gap and
not say
let's just upload everything regardless
you know
um there's some discretion i think
that's that's definitely useful
so thought about this this is something
that's bothered me for a while now i
have not yet personally heard of it
occurring
even a single time but i'm just waiting
someone's
private tip threat intelligence platform
is breached is stolen is accessed
whatever imagine whether it's a local
crits
instance or you know a lot of folks are
moving over to miss
um government these are still in crits
what if all of a sudden someone's like
ah hey
i grabbed it you know i have their misp
and people were like yo why now
yo what up right how many of those
indicators that you consider
solely private are all of a sudden not
private and how do you handle that
i don't think we have time for that
discussion but yeah
that's how i see you know yeah
imagine that they're like oh no our
threat connect account is private
not anymore it's like actually it's
public now yeah
whoops um
that's ever gonna stay private forever
like that's you know probably that idea
is probably we should get away from
thinking of that
you know there's a time and place for
private but i think
it should have kind of like when it runs
out which have some sort of a date we're
like okay let's let's
divulge this let's let's open this up to
the community for sure or and again
there are private intel sharing
communities already with different you
know there's there's tlp there's all
these protocols for
sharing intel specifically you know and
with regards to kind of these concerns
around
around confidentiality and stuff like
that
trust groups yep i i find the problem
with trust groups is that
the trust group itself grows to uh
and then too many people are allowed to
bring folks in and then your trust group
of you know 80 highly skilled all like
you're on the same page you know when
there's 500 people all of a sudden
no one wants to share information you
know there are a couple big names still
still not big enough to mention you know
and i supposed to mention the trust
group name
that some folks are aware like oh yeah
that died no one was gonna do that
anymore
then you got that problem oh let's see
here
oh i love the fact that you brought up
the uh fishing indicators
many times fishing threats these days
are based on credential harvesting
versus actual binaries and then the
credential harvesting stuff oftentimes
will just get lost so like you mentioned
url scan is great
sites like virustotal where you can just
put the domain in you know um
you have to be very careful with all the
opsec you take a phishing url and you
put it into the search
not the url but the search and virus
total and what is the default
thing that it does if it's not currently
in the database right now
it auto analyzes it for you it didn't
used to do that it used to say oh we
don't have that one but now it searches
it and you're like
that's cute thank you so a lot of uh
potential hurdles in our way to deal
with all these indicators
so i'll go ahead and bring it up we only
have three or four minutes for
continued discussion so keep that in
mind but
the overall concept of indicator
management or
aging out indicators um any general
thoughts on that that you wanna
you wanna make in such a limited amount
of time
i'll start off and just say it's a
challenge
and i don't know if there's a right
answer i would argue that there
isn't a right answer um how many times
have you seen something from a year
ago creep up again now it might be
slightly different i mean the the hash
might not be
exactly the same but maybe some of the
infrastructure behind it
is partly the same like it's a it's a
great discussion
and i would love to see maybe like a
panel discussion on that or something
that that would be a great topic to talk
about
we have a couple folks in the chat who
are discussing who uh the very concept
who would make a great
panel on that in fact one of the fellows
brought up uh
i won't throw his name on him sure he
wants his name out there but in the
discussion at the very least
was talking about the fact that your
threat intelligence platforms
may not be built to support a gratuitous
number of indicators
so if you are like me i i'm the old
school style personally i want to hoard
them all and i want them always and i
just want to know like i want the dates
to be associated but i want them
and he's like okay that's cute right you
try to generate x number of gra
or a graph or whatever over you know
ryan's 17
billion indicators you're like cool
story so that also has to you know come
into play like okay what do you not just
maintain and keep but also analyze over
when you're trying to correlate can your
systems even do that when it becomes
to a certain scale so that's that was a
really good conversation in the chat
thank you fellas very very much for your
presentation um
i'm such a malware guy myself so i was
like yeah i loved it
uh hopefully folks who have never seen
that type of analysis
and especially folks who just aren't
familiar very much so with
reverse engineering or malware analysis
seeing the previous and this talk
together
are like okay maybe that's something i
want to start playing around with you
know so
i think that that would make a good
impact both of those especially going
one after the other uh all right
thank you thank you thanks everyone and
we'll be around for questions and stuff
so
don't hesitate to reach out
thanks so much everyone yeah absolutely
all right we're going to throw
a new giveaway this is going to be the
last giveaway of the day as we move into
the
uh final talk hour of the day and this
is going to be another
set of ted thermopolis signed
infosec rockstar books so we're going to
give out two of these bad
boys so i'm going to go ahead and go
into the room now
and we're going to make that guy right
there and there we go so you should see
that there we go
everyone head on over to the giveaway
section and throw your thumbs up we'll
be giving two of those out at the final
q a
after the upcoming talk and for now
we're going to sign off so again thank
you fellas very much
thank you cheers thank you see everyone