thank you so much everyone for coming
along
I should get this this talks about the
the rat industry or the remote access
trojan industry and the kind of Manoa in
the markets which has been developed to
support it but before we actually talk
about something interesting just to get
rid of the way so many know me some of
you probably uh hopefully don't I'm done
I work as a security engineer while
studying at Edinburgh Napier the
software engineering and as of up until
November I was part of the any second
Eddy so not this one
but either just full disclosure I don't
do malware as a job my job is in threat
intelligence so take that with you well
it is a hobby for me for now my max
resolves in infrastructure so very much
detached from all this but um as we call
and as we can try go back to site on
this topic which is very very vast and I
can't get into everything as much as I'd
like well we're gonna start with a quick
introduction on the essentially ancient
history what I find to be the first
things which could be considered rats or
you know remote admin tools as the as
the developers told them and we'll talk
a quick introduction on what malware is
on more specifically what a Trojan is
and this will all be important later
trust me and then hopefully well if the
talk makes it that long we'll move into
what I consider modern-day rotting
samples and again the the markets which
is sprung up to support them which is
quite important there will be time for
questions at the end hopefully so if
again the topic is quite vast well my
answers I don't know please don't be mad
at me so first of all do we all know
what malware is I guess we do but if
you're not sure malware is a portmanteau
of malicious software software which has
been specifically designed to disrupt
damage or gain unauthorized access but
something I noticed in researching this
is that people seem to take specifically
designed like to quite an extreme and
only think like a healer like if I make
a bit of malware but then instead of
software agreement in there that says
please don't use this as malware it
protects you we'll find out just how
true that is by the game
malware includes lots of different types
of programs like viruses which are
self-replicating
and worms which can spread by themselves
intrusions which we'll be talking about
but essentially the very simple versions
are religious programs which rely on
deception to be spread so like whether
it's a three fortnight VBox tool or
whether it's pictures from the runescape
girlfriend exe or whether it's whatever
someone's sending you the premise is
that you don't know that thinking it's
something else
so I thought in mind that what the hell
is the difference between a trojan and a
rat right so there's two so rather than
acronym and depending on who you ask
it either stands for remote access
trojan and this is what you know AV
companies column and/or it stands for
remote administration tools which is
what you know the producers of these
tools call them because obviously you
don't really put yourself in anyone's
good books by saying that you produce a
Georgian you know so whenever I first
started researching this I thought
remote access trojan was a bit of a
misnomer because surely all Trojans
require some form of remote access right
like if it's physical access and
certainly a Trojan you're just at the
computer so I like it it helps to think
about it that like a remote access
Trojan is a Trojan which specifically
goes after as much remote access as
possible so we're talking about almost
administrative level of control remotely
over a system so knowing all the
definitions that start with some very
very old tools a long time ago any
galaxy far far away Sweden started with
NAT buffs in 1998 which carl fredrik
nick der I hope no one's Swedish because
but butchered that essentially said in
an interview in 2002 that he created it
so you have fun with his or her friends
and for the Creator to have fun with his
or her friends and it's also for network
administrators that would like to remove
the administrator and that's quite like
we'll call back on this it's important
to remember that's why he says he
created it and also he claims that it is
the first tool of its type which if
that's correct and I couldn't find any
reliable examples earlier this would
make it the first
remote administration tool which is I
mean it's a good achievement I guess but
moving on the feature list essentially
it they take it uses a client-server
architecture so you'd install a copy of
the server binary onto a handi computer
and when installed it would run
automatically and stay and we are in the
memory and it would support for Windows
an idea it would support key keystroke
logging and would allow you to inject
your own keystrokes which every happen
does I don't know about you guys and it
would allow full display capture and
we're an entire file system access so
that's rewrite any file anyplace
modify anything and you know just cuz is
a great administrator you can open
includes a CD driver will which is a
very useful thing and it also has its
own tunneling protocol which enables you
to use any any server of this which you
have access to you as a proxy to connect
to other computers to which again
totally isn't malicious or anything um
so this is a sensor what it looks like
you can see on the very left ok can you
go to the backseat because this will be
useful for the rest okay cool so on the
left you can see a like open cd-rom you
essentially just pointed as a single
hostname or IP and click connect a
couple of things we can gain from this
is that there's no option and at least
not bus 1.2 to configure the exact port
that connects on so you know quite
primitive very much have fun to whether
it's meant for I'm an access I really
don't know you can also play a saw and
change the volume on the computer so
that kinda sums it up and it kind of
stockholder this one because only a year
later in 1989 he released nap bus Pro
that bus pro version 2.0 which was
essentially just in that bus but only if
you're trying to sell it to a business
under like things like the ability to
cache and store multiple servers and a
greater file system access and like
scripts so you can like run retains on
look whatever machines haven't installed
but of course it got quickly hacked and
although it was intended to be more
visible and it was intended to leave
like like like something in the taskbar
stuff it's very easy to remove those
features and then just have a better
version of the first remote access
Trojan if that makes sense
oh yeah and this one had webcam image
culture because that's what enterprises
are looking for I guess but although
we're talking a lot with the fun
features and high like it's such an epic
prank and that's sort of stuff
not the case like these are really
really kind of offensive tools which can
be used for a lot of bad so in the same
year that necklace 2.0 key might the
original program was used to frame
Magnus Ericsson a la researcher at Lund
University in Sweden for a possession of
three and a half thousand child
pornographic images and he wasn't
cleared until five years later when a
computer expert from the es offered to
investigate the case for him and this is
taken from the the newspaper in 2004 the
expression the district court did
someone to go for a control of his
computer so the advanced program that
bus expert expertise I guess is required
to use it and it is conceivable for
example that someone else used
Erickson's computer as a storage place
although it hasn't confirmed whether it
was just used as a proxy server or
whether someone had liked deliberately
planted there and alerted detect the
technicians out University so I guess
we'll never know moving on around the
same time this one's a lot more
well-known than that bus black orifice
was released the DEF CON sex by a member
of the prolific hacking group called to
the dead Cory called sir a stick so I
mean obviously a ministration till right
release the DEF CON I call to the dead
Cory sure but essentially a self
contained self installing utility which
allows the user to control and monitor
computers running running Windows
operating system over a network
Sony excuse me so essentially the
release here is very much sorry like
they advertised it sarcastically as a as
a remote administration tool and the
their motivations for it so they
released like a full memo detailing like
like what the wall black orifice could
do and why they were
lease it and essentially they had made
complaints to Microsoft about the
security of previous operating systems
like Windows ME and they released
Windows 98 which it was described here
as having a Swiss cheese approach to
security so things didn't really get
better and things kind of haven't really
got much better so I must have been on
there something shame about inspiring a
generation of extortion but whatever so
this is what it looks like kind of
standard Windows an idea program you can
see that this one does have a bit more
complexity than that bus whether that
was because it was made by someone but
like you knew more about computers or
look he was more serious by making it
like a proper bit of malware could be
used I'm not sure but essentially like
the same list of features with some
extra ones added on like for instance
you've got an HTTP server which you can
put onto the put onto the server for the
arbitrary uploading download of files
let's go to you can turn the interface
in the promiscuous mode and sniff all
the packets going through it I guess and
most importantly this is one to remember
is this does show up a lot quite
recently and this is the first program I
can find which doesn't this is a plug-in
interface so if let's say I use a back
office at home for administration and
I'd like to upload a custom script which
runs in a biophysicist hidden process I
can I could do so and I can dissolute it
too to my to my client and just run it
on any computer so this does instead of
waiting for suggest stick to add the
feature for me I can just make it myself
so that's cool and it's also it
advertises itself is fully invisible not
appearing in any tasks less or any file
list or any process list at all which I
couldn't imagine three very hard and the
year later just like an app bus came up
with a better version back office 2000
Kim I the next year at Def Con but the
story is essentially the same so like
it's like overly ganar similar
interesting the next year after that sub
7 was developed by mod man who's still
on he's still active in the community is
art Greg components whether if you'd
like
to find out more about subs Abin or more
about like the people and their
motivations for why they made this stuff
a lot of it today we're like software
freedom unlike digital advocacy which
doesn't make sense to me but this is
notable because it came with a whole
bunch of features this really came over
loaded with features compared to other
malware at the time and it's strived to
be the most usable remote access trojan
that that was on the market essentially
but one thing I'd like to note here is
that it was one of the most there was
one of the first widely used rats with
um command and control functionality
which happened three IRC and this is
significant because throughout the 2000s
this is what was used by botnets and I
can't find I can find one like an
example of a worm which is an IRC to
report in but in terms of like actively
like dishing out commands like through
an IRC chatroom because it's ideal for
it's ideal for malware authors right
because like IRC I mean like the
server's already there it's a nice
Vecchio's traffic and you've immediately
got the option to message a whole chat
room full of people or just a specific
box so that's like very easy targeting
for like if you want your botnets
additional things and this is the first
kind of example with it but um to
properly understand would like what we
mean about bots and like botnets and
rats are they also and together we need
to understand what a what a zombie means
so when we talk about botnets we
generally refer to Victor compromised
computers which make up the botnet as
zombies which I accept remote commands
all those authorization from the vault
herder as well or whoever's controlling
the botnet or rat but essentially this
term has kind of been forgotten install
victim and slave or yeast as well but of
course like it's just means compromised
computer really which brings me to my
next point there is although a group of
rock controlled zombies is a botnet
technically there is like technical
differences in these two terms for
instance as botnets scale and they're
designed to scale and they benefit from
scale for instance are used in DDoS
attacks and they're used for spam and
they're generally used for thing where
it's valuable to
a lot of different hosts doing the
connecting it's with the more features
as doesn't mention the sub 713 features
as a version 3.1 which is the one with
the IRC stuff that's not terribly useful
for about that because of a connective
return diem in fact lots and lots of
machines we don't want to make it we
want to make it as hard to detect and
it's hard to stop as possible and if
you've crammed it for the features
that's a lot of indicators compromised
like there's a lot of ways for that to
trip up where there's a lot of ways for
antiviruses to pick it up or identify
processes which connects to which like
in G your screen and that sort of thing
so there is a difference in the way that
rats and trojans the witching are
involved in botnets are used but that's
just semantics essentially moving on to
the modern day I decided to start this
section with like laughing you want but
essentially the the finding of hoc forms
is essentially when I would start the
modern day of the-- remote
administration tool market because like
available with like any kind of like any
kind of special connection or available
just to the clear now for anyone to sign
up to open the new members it really did
help develop a public interest and rats
in cemented there's one of the most
popular ways to kind of induct new black
lab members right because the set up or
more like sisters you don't really need
any like skills the tools are already
there I mean we'll get to some
technicalities with actually running a
campaign which which causes some
difficulty but essentially high
performance did really help to make this
reality because like if you give all
skaters the same kind of way to identify
themselves this creates kind of a
rapport between different industries so
for instance if I'm selling for like
crack to extend like selling a
legitimate for whatever reason hosting
and you're a malware developer and we
both are active in the same forum
there's an implied legitimacy there and
when you're trading on what is
essentially the Wild West and the
internet like anyone can scan me people
can promise stuff you can pay them and
another slave with money right because
like these these are essentially scam
artists we're talking about like it
really does help to have like one kind
of identity and then it obviously I'm
released like different like paid
membership tiers which indeed help to
drive business to the likes likes really
like you buy
level of membership and then the other
kind of like an implicit trust because
you've been vetted and you've paid for
membership so you you're not sitting to
take the money and run right but I think
the most important thing about this was
hi it made zombie monetization like a
reality and it made it instead of
something being abstract like oh I'll
come up with an awful way to make money
out of these like you can go in the
forum and watch people do it you can go
in the forum and see what people are
selling and you know these selling them
out where and you know what they what
they're selling from the like from the
zombies right so essentially when we
talk about matters of monetization that
can be summed up is they summed up in
what the hell would anyone do with my PC
if I get a virus why why do they want
the virus there except for you know fun
fun with your friends as a karl-frederik
put it why on earth would anyone want
the the malware to be there and excuse
me in 2009 Brian Krebs asked the same
question and rode around the article
called the scrap value of a hiked PC
addressing the question of like oh well
I only use my PC for solitaire like why
would you hack me and if we want users
to start taking security seriously and
if you want them to be aware of the
threats right there this is a really
important question to answer like fully
so forgetting targeted attacks like me
in fact in a specific person here's
here's some things which would make like
a a computer controlled by rap pretty
valuable so sort of a web hosting so the
value here is the anonymity it delivers
to the attacker so for instance I can
sell you a posting and you can host
whatever you want on it and it doesn't
matter if it goes doreen because there's
no way to tie you back to the original
hosting right except for me and this is
the CDs for lots of stuff so like
fashion campaigns will use this malware
hosting so if you're um if part of your
fetching campaign is to download malware
from a site the site can be hosted here
in that way you know you're not getting
blacklisted from hosting domains or
getting arrested because she signed up
with it in a real name which does happen
um you can host wares on it and again
illegal pornography
people will pay a lot of money to like
host this kind of stuff if you can do
reliably so like why not focus in on the
right campaign essentially next up is
something guys some of us might be
familiar with virtual goods
so online games now I have like trading
features and lighting in order to get
people to play nice and in order to and
devise people playing the game you'll
get items which are sometimes worth
real-life money and this didn't rinse
from like developer sanctioned
activities like like the state market
and condor strike in team fortress t2
economies which aren't supposed to be a
really like have real life value but do
anyway
like for instance you've got a rinse
cape and so on and so forth um and a
nice benefit of this is that they're
owned predominantly by children like
these are people who don't really have
not much or young adults are best sorry
they like this they don't really have
that much knowledge about computers like
generally do have that much money so
they're the type of person to search in
the youtube free free cabo credits or so
on and so forth and you'll see a lot of
a lot of hosting or a lot of spreading
of the bar word on there and essentially
those are then taken from the accounts
which have per authentication and like
like if like if you think about it your
statement kind is less protected than
your bank accounts and i can sell my i
can sell the same items to anyone right
so instead of there being like an actual
paper trail of me funding money out of
your account like valve has a good luck
support
[Music]
next up reputation hijacking so way back
in the day this was essentially when
spammers find a way to amass sign up for
yahoo accounts or hotmail accounts and
then use the inherent validity of a
hotmail account because like different
like web mail hosts would trust these
addresses more given that they caesar
given they had like like security behind
signing up and they had spam detection
that sort of thing so if you find a way
to actually sign up to these addresses
that was really good for getting your
spam seen by as many people as possible
but nowadays with social media
reputation hijacking essentially means
when you take over someones a current
which usually identifies them like for
instance if you go on any social media
or any forum site and you see a post
from someone who's not in current
there's a lot inherent value of what
they post based on who they are so if
like if i had to try the generation
current and i posted someone like people
are going to trust that length more than
if i push it on my own
twitter because like there's like she's
got much more to lose than i so um rats
have been spread in order to get access
to high value socially
- which can be used in further malware
spreading or indeed advertising services
other advertising services is much less
profitable than horse or sorry selling
advertising services on still many kinds
as much less profitable just spreading
more malware so it's become much more
common excuse me
and up next probably the biggest thing
with widespread one would be credential
stealing so essentially get around
you're on your computer take all the
passwords on them and anything which can
be used to process money or deliver
value to the person running the botnet
they'll just tick so this isn't limited
although they obviously would prefer for
them to like fund sale of access to your
to your savings that love access to your
mind the kind they love all that it's
not just limited to coins actually store
money occurrence which you use the
process money in general do you have an
inherent value because of the capacity
for money laundering and because the the
value of an account used for legitimate
reasons is so much more is so much
higher than just and I find it's just
been made right because if I make an
offender then immediately use it to sell
something worth a thousand times off
someone else he just made an account
like but there's like there are fraud
prevention and then these types of
programs so this does help to evade
those and that's like an think for
examples those to be eBay and Skrill
much both for problems so that kind of
behavior and leaving the worst for last
we've got extortion so I'm sure
everyone's familiar will run somewhere
ransomware is much more common than
relaxed estrogens because like there's
no management involved you just kind of
sell of a key experience ended I someone
downloads and all of a sudden they have
to pay you or it's you know they're not
getting their stuff back but we like
with our devices and we trust them with
a lot of very sensitive stuff so it
doesn't have to just be like we'll get
access to your system like you can use I
can I get into ten extent blackmail you
can find something that they do not want
all right and use the secrecy of this to
their demand money of them so I don't
know if anyone remembers but early
examples around somewhere I would say
that oh the FBI is detected child
pornography on your computer and then
actually give me five hundred dollars of
iTunes vouchers you're going to go to
jail like that sort of stuff and like
the data is very much coming from these
practices like other ransomware has
existed for a while something unpopular
recently and this practice definitely
predates it to a large extent
and so if if you can't hold the system
ransom the my name LeConte like again
going back to social media some social
medias are the basis of people's
businesses some like social media
accounts or clients on external services
like the person needs otherwise they
will not be able to make their living
and so there's there's value to that so
if they can lock you out of your email
and lock you out of your Twitter then
like it's gonna be hard to get your
account pack and rather than wait 30
days for Twitter support pay $200 get a
box I guess
and finally webcam extortion which is
quite a big one because obviously like
anyone can set up one of these campaigns
it's not because you can just download
it for free on the internet there's not
really not everyone tried to make money
there like there are an awful lot of
just very very sick people for instance
like webcam extortion so I'm attempting
to I get lewd photos off someone's
webcam without them knowing it's on and
then using those images to extort and
further it's very very common and indeed
you can see that mirrored and in the
forms of today so if if you can't read
that it essentially it's advertising
ebooks and services for getting teenage
girls and young women to install your
remote access trojan because these
instances of the sprouting are worth
more and can be sold to more people and
if you're not going to use them yourself
someone else certainly will so rather
that obviously sucks but that's
a should inspire but that's a I like
this part and parcel of this kind of
what this kind of access attracts that
people aren't just here to make money or
just throw people are here to make money
in any way they can and generally if
they're willing to take access to your
entire computer without you knowing
they're not really that bothered about
extortion either so let's say we've got
Indiana coin we've made all this money
were like okay what's the point like it
doesn't really scale like yeah I just
keep making this I went to money forever
well as Homer right you put said money
can be exchanged for goods and services
and we can actually make our malware
better not only by like like buying a
premium version but we can also employ
services by like tangentially related
but different industry or different
markets of blackhat to make our malware
more successful to make it spread faster
so
Yashin actually been earlier but if if
you've ever even following there might
be a couple of things too from your head
like oh well if they're just using all
these free tools well then the anti
viruses can block the free tools and
I'll be safe right well yes but also new
so the idea here is that while the
viruses can block them and then it takes
longer to make it to make a remote
access Trojan than it does to like block
one so eventually will keep up with the
tide not quite so crypting is
essentially the encryption i've also
referred to as packing but for um for
doing it for malicious purposes it's
generally referred to in the market as
crypting it's essentially the process of
obscuring an executable in order to
prevent detection of the malicious code
in so corrupters of various functions
but like the core of it is popping under
film familiar popping is shorthand for
executable compression which is on
compressing the file and then
decompressing it in memory once it's a
once it's wrong so generally in Windows
the encrypted code exists as a PE
resource within within the binary which
is then so the the sort of the program
is essentially the instructions on how
to unpack the the program and then the
rest is just on the run the rest is this
nonsense until it's uncompressed right
so while parking has legitimate uses
like blackman memory wasn't really that
it was much more scarce than it was
everything will be packed because you're
trying to cram as much on your floppy
disk as you're on right like if you've
only got like 64 K of memory you don't
want something taking up space just
because it's more legitimate right like
even Sophos distributed its own
antivirus fully packed so we've said on
a floppy disk because things used to run
faster on floppy disks have been told
but essentially why it works is the the
the program will start at a launch and
unpacking routine which will be pointed
at a pace of a malicious code and then
it'll just hand over control to that
malicious code wants to compact and no
one will be any other wiser so
sorry excuse me of course it doesn't
it's not just a simple there are various
levels of sophistication and because we
have various levels of sophisticated
actors a lot of them are commonly used
so we'll start with the very very basic
ones which are easy for antiviruses to
catch on to and then we'll go up to
relate ridiculous lots and lots of
effort I want to stay undetected for the
rest of my life edge stuff so you can
use open source placards but and on the
plus side they're available for free
right so you're not paying any one more
that profit to yourself good job
on the downside they're available for
free so like everyone else can download
them as well and when you're in an arms
race with an antivirus company you
probably shouldn't give your secret key
to not being detected to them so anti
viruses of had access to the source code
for ages which makes detecting them
pretty trivial it's just you know
finding out other pipes and then like
applying that to to the files you're
scanning excuse me
next up the wrong you can pay for a
crippling service so on a public forum
someone elaborate eyes hi guys have been
equipped there and if you want to
encrypt your files you can either pay
for access per month or you can pay for
access as you go so you can pay per
crept usually a couple of couple of
pennies like 50 P or 20 P or whatever so
the source code will be generally
attempt to be made unavailable so you
won't have access to a list of access to
the cryptid files so the AV has to
reverse-engineer samples and that takes
time that more time than it would to
find out exactly how to block or buy
over rats which are entirely unpacked so
it'll also contain on the analysis
features that'll obfuscate the stub and
by stub I mean that bit of code at the
start which is uncompressed which is
essentially instructions on how to
decompress the rest and it'll behave
differently if it notices it's in a
sandbox or VM so that's not about
specific that's very common so semi
aware and encrypted obviously can be
Kryptos obviously can be used anywhere
not just with relaxed estrogens so next
a lot either private corrupting services
so instead of um instead of selling like
individual licenses or individual crypts
you sell spots on a program so there's a
there's limited access and this is
entirely intentional because the idea is
if not many people are using it there's
not gonna be that many samples so if
I've got a really important thing I want
to put a virus on or a piece of malware
I'm sorry then I can
that won't be detected right but the
downside is you actually think this has
actually cost money price goes
significantly up to to the suitor how
the business works was limited in winter
spots but the idea here is it'll be
updated regularly
so hopefully evade detection for longer
and it'll how you generally have more
advanced the analysis features like
it'll obfuscate the control flow when
that's being reversed in the API and so
on and so forth and right at the top the
ground of the crime not universally
available and used for the general
applications as well as a virtualized
exe obfuscator which essentially instead
of decrypting the code it just runs it
in a virtual machine which has an
architecture which is not like any of
the architectures we use so if you're
reversing it you need to learn an
entirely new control set or command set
and so on and so forth so like if you're
trying to reverse this for answers that
can be quite a pain it can take much
much much longer so this is kind of what
you're aiming for but obviously it costs
significantly more than the other
options and generally if you're just
you're just doing it to scam a few
prints kippur coins
you wouldn't year like you wouldn't need
users so let's pretend they've done all
that ok so I've got my rat I've got my
I've got it encrypted ID I even know if
it works right because I'd like I don't
want to just burn all my crepes by
testing if my rat works you know like I
don't want to see I like I do want to
drop it on the alive system it gets
detected and then suddenly I'm not like
I've I've lost that spreading mechanism
or something so if you're thinking a
service like virus toodle we are half
right it would be great if we had
services where we could just show them
our out and it would give us the the
detection rate back and virus to do that
however it also provides callbacks to
the antivirus companies so not ideal if
I'm a malware author and I'm testing new
types of corrupting and I'm just sending
my sample but cryptid in various
different ways directly to the antivirus
company that's generally what we want to
avoid so what if we made our room
service what and it did the same thing
as virustotal but only it didn't send
them back
well we're 12 years late as the clangor
antivirus services which essentially are
kills which can be best described as
mimicking the services virus to the
provides but only running the device
tools in the sandbox when they are
little more into it which stops it
calling back to the original service are
used to determine how good
my crypt is and essentially this has
happened quite a few times the most one
of the most recently most notable cases
was referred about me started in 2011
ended in 2015 because it's still illegal
even if you're not the person holding
the malware itself if you enable and
make money off hackers you're at best an
accomplice and worst a bit of a scumbag
so two charges of the computer misuse
Act and interestingly enough one charge
of money laundering because I guess like
that's what they care about right like
don't care if you're making money so uh
the NCA reported 1.2 million scans using
the service in the time it was a made
available so I mean with a better room
for error
it's like 1.2 million scans or with our
1.2 million bits of malware which had
been analyzed or different definitely
corrupted malware which is quite a scale
and interestingly enough was noticed by
train right group because the service
also offered a URL sorry domain and IP
reputation checking so of course in the
same service because you paid for one
you also get reputation checking thrown
in and of course they noticed that there
was reputation checks coming from this
IP I'm not I'm not like the actual virus
callbacks since who logins the fact that
their products were being used
maliciously so so let's say I've cryptid
my software I've I know it works
I know it's undetected so how do I know
if anyone will fall for right because
like the way I've spread like how we
spread malware changes as fast as human
interests change right like people might
want to download free fortnight V Buck
generator today but they might not want
the done with it tomorrow and I don't
want to spend all my time searching on
what the kids are doing these days so of
course I can this go on high form the
game and find no that's tiny and they do
apologize but essentially it's various
different guides and services for for
how to spread your malware promising
arranged from hundreds plus to thirty to
fifty five downloads per day so I mean
they like it instead of you figuring
right okay how do I spread this and how
do I make the pantsing you just pay
someone to do that for you stick your
execute upon it and send it off away you
go so like upload upload sites good are
in contents like its content
sites get moderated and of course like
the metrics for actual monetization
change so for instance with the steam
trading it used to be very much that I'm
if I scan the knife of someone on hunger
strike I'd be able to sell it no problem
on multiple sites but now to trade
statement forces two-factor
authentication and its moves like these
which really stop remote access Trojan
authors and like people who are trying
to make money to this it's essentially
as our security gets better the like
opportunity gets lower in the word for
opportunistic scams like this so that's
kind of the that's a lesson to take away
from this certainly and finally
something that people struggle with
because you've got like OPSEC is like
essentially a universal problem for for
all black hats it's and he like no
matter what you do it's not worth very
much so you get caught right like you're
like you're not a millionaire in prison
well depending on where you live but
whether it's running Skype Skype support
accounts for their malware signed up to
their own email address or running a new
IP service off their home reader they're
not very good at it so how do we
actually know how do we how do they get
better other I'm the I I hope they feel
forever that I don't know how to get
better other I don't I don't want them
to know really as the people who make
these not like just to be clear the
people who make these malware and the
people who support them three businesses
which enable like which enable catch
exfiltration or businesses which enable
log less hosting or businesses which
enable essentially like free like free
EULA software which totally is in the
malware like I mean they're all they're
all cut from the same cloth
they're all just enabling vulnerable
people on online getting scammed and
like a mess we do something about it
nothing's really going to win is this
being recorded it is right well I mean
if you're if you're a block caught
watching get a job seriously so moving
roughly on.com it was developed in 2008
until 2012 by dark cooler SC
active still not arrested I I guess and
had seventy thousand users added to peak
but essentially he's quoted as saying
that the whole development process of
dark comment was just a challenge for
myself and he had no issues developing
and providing support for skids and what
we going to go too much into the tech of
the technical details which are common
because we're really seen it was sub
seven essentially programs are do get
very Sammy
so instead of going through each one
individually although I'll provide run
at the end so for four years do thousand
Ania to actually you know for six years
he be he provided support for this well
for no problem the fact that it was
being abused I guess I mean in writing
had a problem but he also earn two
thousand euros providing support for for
for combat through the years so not
enough of a problem did not take money
off my desk and then suddenly and then
2014 this happened so it is with deep
regret that I'm here to announce the end
of project dark comic rat after over
four years in development hard work day
and night to offer you free at will with
the well to make communities
expectations of a program of type remote
administration till I have devoted years
with a nonprofit philosophy for you to
enjoy without asking anything in return
other than respect of the rules
unfortunately some of you couldn't
respect the terms so because of you
generally speaking mid dar common route
and so sad story involved just trying to
help people whether this remote
administration tool and a lot bunch of
bad people use the features built into
the program to in fact people's
computers let them knowing happens to
the best of us I guess so something
that's right at the end there and I've
highlighted at the talks and gets
important without mentioning what
happened in Syria and I guess that must
be French for oops a hostile dictator
government used my tool to target
journalists within the country and
disabled their computers and stop them
from telling people about what was
happening so I mean I thought I don't
know why closed either if anyone if
anyone knows do something I'm a rough at
the same time created in 2010 was black
shirts and black sheets it's quite
famous here's how did that if anyone
okay cool and bloodless new info so
available for forty
I sighed I signed out forms and pay
someone $40 and I get a month of support
and this that's rap for and any future
updates it gets so essentially what
we're saying with advertising support
they are kind of going after the lowest
common denominator here they are selling
it there active these targets people
they don't know how to set up a remote
administration tool so I mean short of
them being you know the Red Hat of the
rap industry like this is it's very
clear who they want to use this program
and I'll give you a hint it's not
seasoned you know network administrators
but essentially came in three versions
blotches net which is made in VB and
lots and lots of features loathsome just
as only a sub seven if not more and
hardware ID locked so once you bought it
is like you couldn't use not licensed
anywhere else in an attempt to make more
money arson and black she'd stealth
which is made in Java a much smaller bug
featured and way way way less features
but essentially like basic remote access
features and all the communication was
encrypted so I guess if that was more
suited to your needs then go for that it
was also slightly cheaper I think but
let's have a look black kids and that
seemed save architecture the same
architecture as an app bus I mean and
this is like 12 years later so cold I
guess it was a you could either use a
web or application based or come on the
control framework for yourself and one
thing is interesting about I'd like to
note was a lot of routes at this time
calm included offered a customizable
payload creation so excuse me when
you're when you're making a server to
tip it on to one of your machines I hope
it gives you a whole bunch of options
like you could specify the IP connection
port the transport profiles you could
name the server you could tell you can
tell what found in and mutex so if
you're this important so if you're
sending a version of your route to your
big list of machines you're ready I'm
accessory you can put a new taxing and
then if a binary if the same mutex is
already running then it won't run twice
and give you two versions of access to
the same machine so like that it's it's
clear that this was intended at some
stage for like bats usage like for the
control lots and lots of machines not
just like a few
on your estate so know the language
language used at the bottom there in
fact that's one GSB helps with spreading
as we know as we know what spreading is
that's kind of word like what we the
term we use and we describe like trying
to get your malware under someone else's
computers or a method so I'll strike two
and makes your server appear to be a
normal file strike three malware so one
- I like what Satori mentioned at the
end there they are clone file tool which
makes sure to look like a similar file
so here we have on the Left people the
back you have to take my word for it but
on the Left we have we have essentially
a normal notepad.exe and on the right we
have the fake no pot Exe and you can
replace the icon separately so it would
look exactly like the normal notepad but
only it would just be 300 kilobytes
larger so like I don't know about you
but I wouldn't say that if it somewhere
managed to go on my computer you know so
I'm just like every other piece of
malware uses the registry it's
extensively to identify the payload to
ensure like persistence through reboot
to open up for open a new firewall rule
so it wouldn't pop up with something's
trying to connect but sort of stuff very
silent worked very well at the time or
so Akamai says so once let's say I in
fact someone successfully it makes the
firewall really connects right this is
what I'd see essentially what we're
looking at there's a big potential list
box full from full of server details and
we've got the options to ping quick
search map view resolve host name and
then the categories of surveillance
network system on miscellaneous so on
server as well and you can also there's
also chatroom I'm not sure if I allows
you to chat with the person on the other
side but that would be pretty creepy to
me it enables persistence or it enables
you to access all of the events which
happen all of the click and keyboard
events which are using system-wide hooks
so anything that's typed on any
application you immediately get access
to and I assume I can botch it off and
send it to wherever you wanted and
looking a bit know I once identify yeah
so looking a bit and
the features so system essentially like
if we think back to necklaces features
exactly the same features so like I
think we're correct in saying the
necklace was the first but a full access
to the files for access the project
processes registry everything basically
and then these are these features at the
bottom were used to if you ever would
like let's say if I infected someone in
January and then by March the krypter I
used to close darling and I wasn't sure
if it was going to be valid for very
longer I could just crept a new file and
then send them to all of my existing
people had infected and then all of a
sudden my with limited downtime I mean
obviously the effectiveness of the stuff
varies but um what a limited time time
I'm essentially got a new got any
connection so that's cool and then
finally like every other legitimate
access tool we've got Steve Micawber a
fund manager spreading file hijacker
cookie manager and odd clicker so again
the more methods of more methods of
monetization therefore before obviously
people looking to make money out of
these machines is infected so everything
kind of pointing that being nada oh yeah
in his back so not really not really
gentleman at all and what could happen
such a great feel very very future risk
very feature-rich very unlike it were
very well people pay for that great
support
what could possibly possibly go wrong
next only the biggest malware take turn
off the time so far with I think there
was 50 raids in the u.s. 90 in Europe or
Europol kid an idea I'm not sure what
their jurisdiction is but essentially
everyone who was anyone involved in the
core Blackshades industry got taken down
and why then that's my question why not
all of them are all the routes before
them well how to think about it and
write its life so starting in 2010
remember it was again used in Syria and
a great source to check out about the
use of like commercial malware tools and
then places like Syria citizen lab he
did great great work in that area by
keeping keeping us up-to-date with what
preference we're using so
like their tactics and seizures in Seoul
so forth and then in I think it was 20
only 12 may miss teen USA candidate was
um was infected with one of these rats
and it was actually a victim of
sextortion so essentially they took
compromising photos of her using the
webcam and demanded more otherwise
they'd release the photos she said no
one went to the media about it and the
he got arrested so he choked her but I
think the main thing that made back to
it's different was that it was run not
only in conjunction with other black cup
businesses and that should be businesses
not business but you know that was also
a business and its own right like
between 2010 and April 2014 according to
justice sakarov they made over three
hundred and fifty thousand dollars with
the seals and like I know it's not much
over four years like I mean especially
when you know you go to jail at Leon fit
and fun it's like it's it's certainly a
significant amount and if we're talking
about like a industry which is
essentially kept afloat by children like
that's a significant amount of money
stolen you know so the list goes on
there's far too many more examples to
talk about so NJ rot is another another
notable example made in 2012 in Asia
loves it it's it's all over the place in
China and India and this neutral partly
because Microsoft took down four million
IP addresses related to the service in
new IP much essentially if I want to run
malware from my home computer because I
don't think much what I can do is I can
get I can use a service like no IP which
will then attach my rigor to your demand
and then I can just access my my IP
through that domain rather than like
having to change the IP I'm using every
15 minutes so of course Microsoft once
there was there was a big spike in usage
and Microsoft reacted by taking four
million accounts or four million
addresses offline which is I mean all of
the software advocates immediately got
very up in arms about it and said well
it's it's awful the one company can do
that
I can use my malware anymore so that was
sad and then luminosity like made a lot
of money as well Colton grubs
his name was so he launched his malware
and then offered support by the name
under the name of KFC watermelon on hack
forms so you can tell it literal I think
it was literally 17 and he signed up for
his official platform Skype account at
Colton grubs gmail.com and got caught
Wow so that's essentially we're all
caught up so what do we learn from this
like a what now I know how a broad
industry propagated and how it started
and he supports it know why they did how
do we fight this right like hide away as
in preset professionals and students and
people who want to be part of the
industry how do we make the world safer
right so I mean what can go after the
profit motive but the journalist I don't
think that tells much because people
have things of value that's kind of
inherent otherwise we wouldn't have it
let's go I don't think that's
incentivizing I'd like I don't think
it's like no way this is a technical
problem first and foremost I feel like
any norms risks of Bagdad companies
versus tiny crypto authors I don't think
we're gonna win so I feel like if we
could try and disincentivizes it once as
possible so collaboration with law
enforcement from the likes of Trend
Micro and companies to bring these
people to justice and for making making
it very clear that if you're going to
have any success at all you will be
caught because I think the p.m. point
here is transferring that wealth from
prospective wealth online from control
of accounts into like real-world money
and you know food my god if we can make
that as difficult as possible I feel
like we can really strike at the heart
of this and stopping the hustle and NCAA
has started to prevent program recently
which is essentially in line with what
with the last point there we need to
stop people's first like because like
kids are broke like like you know the
valta computer they've got an internet
access can I have some money no final
ghost comes in for tonight's games you
know like it's I mean it's it's entirely
human nature because it's the path of
least resistance to making money and
feeling powerful a lot through the stuff
so we need to stop kids from having
their first exposure and information
security some very very talented kids
mind gee some of them a few of them and
like we need to stop them stop their
first
like interaction with solar first
interaction with this with this industry
being you know involving the law so yeah
so as this desk talked to a lot of
effort and the few I need to fight for
it Lloyd is here Rosie wave who cares
about the bike
Lloyd help me with a lot of the
technical details of it because as I
said I'm not more aware author I'm not a
malware user I don't know anything about
well I didn't know anything written any
of this and if you're like him some good
feeds to follow their malware hunter
team no I thought that got some help
from them as well they know a lot about
they've been here for a while they
didn't all about historical stuff and of
course the gold mine that is Brian Krebs
on crabs on security calm he covers a
lot of the sane and the people here
involved in it so I'll leave you with a
question why do we encourage more kids
with an interest in this kind of stuff
into InfoSec rather than blackhat stuff
which you know ruins our career prospect
and times their life and our losses all
so tweeted me and thank you very much
for taking the time to listen
are there any questions before just for
a high like it makes up for the involved
in Syria no not particularly
but again like because of its
versatility and the kind of like the
kill chain of in faction like it's such
a versatile to old I'm very I'm certain
the yeah I guess you're talking about
Isis right yeah so I mean like I'm sure
they do but unfortunately like this is
so vast that yeah yes the answer is yes
hi any other questions
okay go well thank very much Chris
[Applause]