[HN Gopher] China state-sponsored cyber actor living off the lan...
___________________________________________________________________
China state-sponsored cyber actor living off the land to evade
detection [pdf]
Author : mmwelt
Score : 88 points
Date : 2023-05-28 15:17 UTC (7 hours ago)
(HTM) web link (media.defense.gov)
(TXT) w3m dump (media.defense.gov)
| badrabbit wrote:
| Oh wow, so living off the land is the same as "hands-on-keyboard"
| activity now? They used impacket ffs! This is a very typical
| post-compromise playbook many actors use. A lot of this might
| even be considered bad opsec.
|
| This is why it is said that APTs are usually not very
| sophisticated, they just have a lot of resources.
| pphysch wrote:
| Yeah, this seems like a classic case of "random mundane thing"
| + "namedrop China" = "srs bsns" + someone getting promoted
| alexeldeib wrote:
| Here I thought this was about human spies on US soil avoiding
| leaving a digital trace of their real identities...
| ssss11 wrote:
| Maybe it should be called living on the sand (silicon) instead
| yellow_lead wrote:
| I believe even an expert security researcher would have a hard
| time using windows as a personal machine without getting hacked.
| There are so many attack vectors and the security
| updates+guidance from Microsoft is completely lacking.
| mmastrac wrote:
| Most serious security researchers use an airgapped laptop with
| a wireless card pulled or otherwise disabled. There's far fewer
| ways to compromise a laptop where the only comms are on a USB
| stick physically transported between two computers, though it's
| not necessarily impossible.
| cookieperson wrote:
| Not a single mention of Linux. Hope the windows community comes
| together and finds ways to harden these exploits
| supriyo-biswas wrote:
| Run a SSH honeypot. You can capture plenty of Linux malware.
| cookieperson wrote:
| Oh for sure. Just saying in this specific bulletin there's no
| mention of Linux or macos targets.
| some_random wrote:
| Yeah lots of really, really low quality malware
| belltaco wrote:
| There are mentions of Linux right at the beginning:
|
| >The actor has leveraged compromised small office/home office
| (SOHO) network devices as intermediate infrastructure to
| obscure their activity by having much of the command and
| control (C2) traffic emanate from local ISPs in the geographic
| area of the victim.
|
| None of those devices are running Windows.
| waihtis wrote:
| the cynic in me thinks the bad linux activity is there, but the
| targets do not have any kind of linux monitoring in place to
| spot activity
| SoftTalker wrote:
| If you're just running a random linux server that isn't an
| otherwise "interesting" target the only times I've seen those
| get compromised is by some ludicrously dumb configuration
| mistakes, such as running databases with a default admin
| password and no firewall, etc.
| cookieperson wrote:
| It's a less interesting target for a lot of widespread
| attacks. Consider the surface area of Linux machines vs
| Windows? Most big corporations run on windows, even if devs
| rock Linux, that's not usually what these types of attacks
| are after.
|
| That said you are right. Most Linux users ride on insecure
| machines. I remember talking to someone who had no idea they
| had to set up a firewall. They had switched from Linux 2
| years prior under the guise that it was more secure than
| windows out of the box. I wish Linux security was talked
| about more. The people who know how to do it assume everyone
| does, and the people who don't... don't know what they don't
| know.
| supriyo-biswas wrote:
| Are LOLBINs still an issue for most companies? I was under the
| impression that most endpoint detection products simply trace all
| syscalls, and therefore can somewhat accurately extract
| information about exploitation events without relying on a
| "foreign" file artifact.
| some_random wrote:
| LOLBINs are very much an issue at pretty much every company
| there is, just because there's a way to detect them doesn't
| mean they're actually detected, or that an alert is made, or
| that the alert is triaged correctly, or that EDR is even turned
| on, etc
| kryogen1c wrote:
| > Are LOLBINs still an issue for most companies?
|
| Depends. The TS/SCI enclave at Raytheon R&D is probably locked
| down. However, most of the (sub)contracting work is done by
| small-medium business America and they've never even heard of
| lolbins.
| IIAOPSW wrote:
| lolbin is the trash can for all these meaningless technoblab
| alerts that you laugh at right?
| waihtis wrote:
| it's a needle in the haystack issue. plus most EDR products do
| not actually alert on benign looking syscalls as it'll quickly
| cause an false positive overload
| supriyo-biswas wrote:
| I would be very surprised if EDR products didn't use some
| form of anomaly detection (e.g. autoencoders[1], ANN
| embeddings etc.)
|
| I've gotten into trouble with employers over editing system
| configuration files and trying to start reverse shells, and I
| can't imagine execve() or connect()+dup2() are malicious
| either.
|
| [1] https://www.evilsocket.net/2022/08/15/Process-behaviour-
| anom...
| some_random wrote:
| They do, it just doesn't work very well.
| alephnerd wrote:
| Some are working on it (SentinelOne is a notable player
| with the capacity), but ML domain experience in the
| Cybersecurity space is severely lacking as a lot of
| Cybersecurity PMs and Founders are ex-Networking types who
| view ML/AI as marketing hype.
|
| Source: am a PM in the space who has been banging heads
| with these types of people
| waihtis wrote:
| They might and some definitely do, but at large enough
| scale maintaining a good anomaly detection signal to noise
| ratio becomes very difficult.
|
| A single ubuntu terminal spawn will generate something like
| 20 system calls. Now multiply that with however many
| actions you take during 8 hours of using a computer with
| your generic corp of over 10k hosts.
| fredgrott wrote:
| No mention of Unix, MacOSX, or Linux.
|
| Is there an un-equal hardening of such tools or is it more of the
| popularity of MS Windows in the marketplace?
| aigoochamna wrote:
| "Living off the land" in the context of this document means using
| readily available command line tools and utilities on infected
| devices?
| supriyo-biswas wrote:
| Yes, see for example [1].
|
| [1] https://github.com/LOLBAS-Project/LOLBAS
| aigoochamna wrote:
| Thanks, that makes more sense. Reading the document as an
| outsider was confusing :p
|
| For a minute, I was worried there were some crazy
| nationalistic Chinese dudes living in the woods behind my
| house.
| IIAOPSW wrote:
| There might be.
| tiahura wrote:
| No, they're at your local research university.
| malikNF wrote:
| This exactly what I thought as well. Glad I am not the only
| one.
| rolph wrote:
| summary pgh 3 [One of the actor's primary tactics, techniques,
| and procedures (TTPs) is living off the land, which uses built-
| in network administration tools to perform their objectives.
| This TTP allows the actor to evade detection by blending in
| with normal Windows system and network activities, avoid
| endpoint detection and response (EDR) products that would alert
| on the introduction of third-party applications to the host,
| and limit the amount of activity that is captured in default
| logging configurations. Some of the built-in tools this actor
| uses are: wmic , ntdsutil , netsh , and PowerShell .]
| badrabbit wrote:
| ntdsutil does not ship with windows by default
| ars wrote:
| On Linux servers I always uninstall the compiler and dev tools.
| I actually wrote a little script to dry-run uninstall every
| single package on the server one by one, and if uninstalling it
| doesn't remove anything important I'll go ahead an uninstall
| it.
|
| I'm left with only a bare minimum of stuff, even things like
| man pages or simple utils I'll uninstall.
| SoftTalker wrote:
| If the intruder as gotten far enough to be in a position to
| run a compiler, he'll just upload it if it isn't there.
| ars wrote:
| Maybe, maybe not. Compilers are quite large, especially
| once you include dev versions of system libraries.
| ginko wrote:
| Kind of disappointing. I was hoping for a story about Chinese
| cells homesteading in Middle America to avoid detection between
| their cyber exploits.
| tiahura wrote:
| Given the recent news about Chinese hacks of Guam, I was
| thinking sailboat live aboard spies.
| CrzyLngPwd wrote:
| Same. I felt clickbaited.
| hnthrowaway0315 wrote:
| I heard that IoT devices can be (and were) exploited in the same
| way and used in DDoS attacks. Fascinating work on both sides for
| $laymen.
| WhereIsTheTruth wrote:
| [flagged]
| waihtis wrote:
| For the Linux variant of LOLBINs, see GTFOBINS
| https://gtfobins.github.io/
___________________________________________________________________
(page generated 2023-05-28 23:02 UTC)