WEBVTT 1 00:00:00.360 --> 00:00:03.200 Hey Carl here, we're on a mission to find new 2 00:00:03.240 --> 00:00:05.960 fans of the show. I mean, where else can you 3 00:00:05.960 --> 00:00:10.279 get real life comedy and horror in one podcast. You 4 00:00:10.320 --> 00:00:13.000 can do your part by leaving us a review on iTunes, 5 00:00:13.039 --> 00:00:16.719 Spotify or wherever you get Security this week. Also, you 6 00:00:16.760 --> 00:00:19.079 can get an ad free feed by becoming a five 7 00:00:19.160 --> 00:00:22.079 dollars a month patron. Go to Patreon dot Security this 8 00:00:22.120 --> 00:00:25.399 week dot com and sign up, and don't forget Discord 9 00:00:25.640 --> 00:00:28.559 Discord dot Security this week dot com. Lots of good 10 00:00:28.559 --> 00:00:32.320 stuff happening there. Yeah, I think that's it. So on 11 00:00:32.399 --> 00:00:36.719 with the podcast. Hey Patrick, Yeah, you you and your 12 00:00:36.759 --> 00:00:39.600 wife are come from German heritage. 13 00:00:39.240 --> 00:00:40.799 Right, I'm Irish, but she's German. 14 00:00:40.920 --> 00:00:43.000 Yeah, all right, So here's a German joke for her. 15 00:00:43.200 --> 00:00:44.159 Oh, I'm sure she'll love it. 16 00:00:44.240 --> 00:00:47.119 You know about the German baby that didn't talk no 17 00:00:47.679 --> 00:00:50.799 until he was five or so. He didn't say a 18 00:00:50.840 --> 00:00:54.439 word all his life. Five years old, he's at the 19 00:00:54.479 --> 00:00:57.560 dinner table and finally the first words he says is 20 00:00:58.640 --> 00:01:01.920 this thrillllle is tap and everybody they all freak out. 21 00:01:01.920 --> 00:01:05.799 Oh my god, Henry, you speak, You can speak? How 22 00:01:05.799 --> 00:01:21.840 come you haven't spoken up till now? Everything has been satisfactory. Hey, 23 00:01:21.879 --> 00:01:24.599 welcome back to Security this week. I'm Carl Franklin's Patrick 24 00:01:24.640 --> 00:01:28.000 Hines and Duaye Laflotte. We're here to discuss some of 25 00:01:28.040 --> 00:01:31.280 the things that happened last week. Anyway, I think we 26 00:01:31.319 --> 00:01:35.359 should start with this US Army sites hacked to display 27 00:01:35.439 --> 00:01:42.959 anti Trump pro Kurdistan messages. Wa, So what happened here? 28 00:01:44.400 --> 00:01:46.599 This is this is a Yeah, there were a couple 29 00:01:46.599 --> 00:01:51.680 different site basic hygiene. Yeah, agreed. So there's the Army 30 00:01:51.760 --> 00:01:55.519 AI Integration Center site. So we're not talking like, uh, 31 00:01:55.799 --> 00:01:58.959 you know, I don't know, Department of Wars website. Yeah, 32 00:01:59.040 --> 00:02:02.760 exactly right. Wait was that was that war games? Was 33 00:02:02.760 --> 00:02:05.280 that normat? I think it was. Yeah, that's a good 34 00:02:05.359 --> 00:02:07.439 callback batter, I know. 35 00:02:07.640 --> 00:02:08.000 Damn. 36 00:02:08.879 --> 00:02:12.599 So the Army AI Integration Center and the Open Innovation 37 00:02:12.840 --> 00:02:17.400 Lab run by the military, these are not systems. For 38 00:02:17.439 --> 00:02:20.960 those of you who have worked in you know, uh 39 00:02:21.159 --> 00:02:27.400 tss CI A tile environments, top secret clearance, compartmentalized information 40 00:02:27.719 --> 00:02:31.039 type stuff if you know the terms SIPPER and nipper 41 00:02:31.080 --> 00:02:33.680 if you know what those mean. These systems are not 42 00:02:33.719 --> 00:02:38.800 connected to those, right. These were like third party you 43 00:02:38.840 --> 00:02:43.039 know kind of websites almost toasted by go daddy style 44 00:02:43.319 --> 00:02:48.360 WordPress websites explaining you know what those departments do, but 45 00:02:48.639 --> 00:02:51.199 not you know, not officially run by them. 46 00:02:51.520 --> 00:02:54.800 I thought the hack was pretty innovative that the pages 47 00:02:54.879 --> 00:02:58.120 usually show a four oh four right, yes, not found, 48 00:02:58.520 --> 00:03:04.439 but known attacker modified the default error page and replaced 49 00:03:04.479 --> 00:03:06.919 it with their political notice. 50 00:03:07.280 --> 00:03:10.280 Yeah, and that's interesting too, because it's like, there's two 51 00:03:10.319 --> 00:03:12.960 reasons why you might might do that as an attacker. One, 52 00:03:14.159 --> 00:03:16.479 you know, maybe you get access to an endpoint that 53 00:03:16.560 --> 00:03:18.319 only has the ability to edit the WORL four. Like 54 00:03:18.360 --> 00:03:20.599 let's say this was a word Press site and there 55 00:03:20.639 --> 00:03:22.479 was a plugin that allows you to edit the foural 56 00:03:22.560 --> 00:03:25.639 four pages, and maybe that's the insecure plug in, so 57 00:03:25.680 --> 00:03:27.599 that's why they edited that Page's possible it was the 58 00:03:27.639 --> 00:03:31.280 only path, but the other path might be you know 59 00:03:31.439 --> 00:03:34.680 how blatantly obvious it is if your main web page 60 00:03:34.719 --> 00:03:37.080 has changed. But if somebody changes a four or four. 61 00:03:36.960 --> 00:03:38.400 Page, it might be a while. 62 00:03:38.439 --> 00:03:41.759 It might be a while before somebody finds it, sees it, whatever, right, 63 00:03:41.800 --> 00:03:43.520 and it gives you a little bit more time for 64 00:03:43.599 --> 00:03:47.719 the forensics on those servers to get wiped away. So 65 00:03:48.000 --> 00:03:51.560 that's that's my hacker advice. Yeah, Okay, don't always go 66 00:03:51.599 --> 00:03:53.719 for the front door. Sometimes the four or four is 67 00:03:53.759 --> 00:04:01.400 the way to go the four oh four. 68 00:04:01.560 --> 00:04:05.520 So Patrick, this next one you added as a kind 69 00:04:05.599 --> 00:04:07.280 of a last week thing, right. 70 00:04:07.199 --> 00:04:11.240 Yeah, I stumbled on it shortly after we recorded. There's 71 00:04:11.439 --> 00:04:14.240 two new fishing kits. And the thing that makes them 72 00:04:14.479 --> 00:04:18.600 interesting is that they get around multi factor authentication, especially 73 00:04:18.600 --> 00:04:21.959 in Office three sixty five, Microsoft three sixty five and 74 00:04:22.759 --> 00:04:25.000 up until now a lot of people have just thought that, well, 75 00:04:25.040 --> 00:04:27.800 I've got multi factor, so I'm fine, and you're never fine, 76 00:04:28.240 --> 00:04:34.519 just like little Henrick. It's not satisfactory. Nice callback. So 77 00:04:35.040 --> 00:04:38.000 you know this, Dwayne loves these, which means they're really bad, 78 00:04:38.240 --> 00:04:41.279 so good, really bad, Dwayne, why don't you talk about 79 00:04:41.319 --> 00:04:42.680 like why you love these so much? 80 00:04:42.720 --> 00:04:45.160 So these are these are awesome. People don't think about 81 00:04:45.240 --> 00:04:47.800 like everybody does this, but nobody thinks about what it's 82 00:04:47.839 --> 00:04:52.480 actually doing. So when we talk about tokens and this, 83 00:04:52.480 --> 00:04:55.800 this particular is a manipulation of tokens. And on this 84 00:04:55.839 --> 00:04:58.079 show we've talked about token tactics, we've talked about all 85 00:04:58.120 --> 00:05:00.879 sorts of things had to manipulate Office. That's and we've 86 00:05:00.879 --> 00:05:03.439 given this analogy. Before you know, you go buy a 87 00:05:03.480 --> 00:05:06.720 brand new smart TV and you fired up. You turn 88 00:05:06.759 --> 00:05:08.319 it on and hope you don't connect it to your 89 00:05:08.319 --> 00:05:10.279 real network. You connect it to some sort of IoT 90 00:05:10.399 --> 00:05:14.240 guess network, and you go to connect Netflix, and there's 91 00:05:14.279 --> 00:05:16.600 two options. There's you know, log in with your username 92 00:05:16.600 --> 00:05:18.519 and password, which is just a pain in the ass 93 00:05:18.519 --> 00:05:22.600 on that little remote control they give you. Or they 94 00:05:22.680 --> 00:05:25.079 give you a code on the screen and you can 95 00:05:25.120 --> 00:05:27.519 go to any browser and you can log into your 96 00:05:27.519 --> 00:05:30.759 Netflix account and you can type that code in. And 97 00:05:30.800 --> 00:05:33.360 when you do that, now that TV gets access to 98 00:05:33.399 --> 00:05:36.199 your account, and you're like, oh, this is nice and easy, 99 00:05:37.120 --> 00:05:40.600 right exactly, this is the same type of thing. You 100 00:05:40.639 --> 00:05:43.279 can do the same thing with your Microsoft account. So 101 00:05:43.439 --> 00:05:49.560 there's the ability to give IoT style access to your 102 00:05:49.560 --> 00:05:51.959 Microsoft account through a token. 103 00:05:51.759 --> 00:05:55.360 Which ranks right up there with home dentistry, those good ideas. 104 00:05:55.480 --> 00:05:59.279 Yep, literally, the same thing, the same thing you're going through. 105 00:05:59.639 --> 00:06:02.399 You get token in an email, you literally go to 106 00:06:02.519 --> 00:06:07.720 Microsoft's real site. Right, So if you're using a password manager, 107 00:06:07.759 --> 00:06:10.920 if you're using pass keys, there will be no warnings 108 00:06:10.920 --> 00:06:14.079 here because they're bringing you right to the real Microsoft 109 00:06:14.160 --> 00:06:18.160 site and when you get there, they're giving you the 110 00:06:18.199 --> 00:06:20.319 instructions on what to type in there? Oh, log in 111 00:06:20.360 --> 00:06:22.680 like you normally would. We need you to verify your 112 00:06:22.680 --> 00:06:25.199 account by typing in this code, you know, two six 113 00:06:25.279 --> 00:06:27.079 three four two eight writ whatever. 114 00:06:27.079 --> 00:06:30.560 It is both interesting is that code not only authenticates 115 00:06:30.600 --> 00:06:33.480 you but authorizes you too. Yeah, one little code. 116 00:06:33.720 --> 00:06:37.079 And what was awesome with the older token tactics is 117 00:06:37.120 --> 00:06:39.959 that what you got access to was this graph API, 118 00:06:40.040 --> 00:06:41.680 which gave you the ability to do all sorts of things 119 00:06:41.800 --> 00:06:45.639 like read emails and whatnot. But then every ninety days 120 00:06:45.639 --> 00:06:48.040 you could request a new token if you wanted to, 121 00:06:48.160 --> 00:06:49.839 so you could be in their end definitely, and if 122 00:06:49.879 --> 00:06:53.240 the user changed their password, it didn't matter. 123 00:06:53.319 --> 00:06:54.399 Sounds very convenient. 124 00:06:54.720 --> 00:06:57.839 Unless the user went in and like killed all tokens 125 00:06:57.879 --> 00:07:01.079 and said log out all my devices. The attackers were 126 00:07:01.079 --> 00:07:03.800 still in there. So it's it's a brilliant tactic. Honestly, 127 00:07:04.079 --> 00:07:06.680 I really I really like that they're reviving it. I 128 00:07:06.680 --> 00:07:09.759 mean I missed token tactics and now evil Tactics is out, 129 00:07:09.759 --> 00:07:10.600 so you know, it's it's good. 130 00:07:10.639 --> 00:07:11.160 It's all good. 131 00:07:11.759 --> 00:07:15.680 Yes, okay, okay. 132 00:07:16.120 --> 00:07:20.040 Along with that, and speaking of keys, the next story 133 00:07:20.120 --> 00:07:25.720 critical SharePoint remote code execution flaw exploited to steal machine keys. 134 00:07:25.800 --> 00:07:29.680 What's the machine key? Oh no, not that the machine key, 135 00:07:29.759 --> 00:07:31.800 the machine the key machine. Yes. 136 00:07:35.560 --> 00:07:38.720 Dot net has a whole bunch of keys. And for 137 00:07:38.759 --> 00:07:40.160 those of you who have heard of like the dp 138 00:07:40.279 --> 00:07:46.680 A p I, which is the Data protection API and Windows. Wow, 139 00:07:46.759 --> 00:07:48.600 how do we get into this without getting into too 140 00:07:48.680 --> 00:07:49.319 much crypto? 141 00:07:50.120 --> 00:07:50.800 Uh? 142 00:07:51.000 --> 00:07:51.439 There are more? 143 00:07:51.839 --> 00:07:52.800 Thing is too much crypto? 144 00:07:53.120 --> 00:07:54.680 Well, I don't. 145 00:07:54.839 --> 00:07:56.759 Let's talk about the math. The key is just a 146 00:07:57.600 --> 00:08:02.199 thank you Carl, a string of cars that identifies something 147 00:08:03.839 --> 00:08:05.680 to you know, think of it as a password, but 148 00:08:05.720 --> 00:08:06.360 it's more than that. 149 00:08:06.439 --> 00:08:09.920 It's used to encrypt, right, yeah, yeah, absolutely, And and 150 00:08:09.959 --> 00:08:12.720 what's neat about it? Used to be you would use 151 00:08:12.759 --> 00:08:15.279 the same key for every system, like, oh, we have 152 00:08:15.360 --> 00:08:16.759 this really long key and we use it for every 153 00:08:16.759 --> 00:08:18.639 system and blah blah blah, and you're encrypted and it's 154 00:08:18.639 --> 00:08:21.600 a symmetric key, and huzzak. Everything's great. The problem is 155 00:08:21.600 --> 00:08:23.480 if one of those systems got compromised, you could read 156 00:08:23.519 --> 00:08:25.800 the date on all the systems, So then they said, okay, well, 157 00:08:25.839 --> 00:08:27.959 you know'd be great is if each system had their 158 00:08:28.000 --> 00:08:32.559 own unique key, a machine key that could then do 159 00:08:32.639 --> 00:08:36.799 those levels of encryption and authorization or authentication of tokens 160 00:08:36.799 --> 00:08:37.639 and all sorts of stuff. 161 00:08:37.639 --> 00:08:40.279 Well, but the interesting thing is every network connection has 162 00:08:40.320 --> 00:08:42.840 its own unique identifier that can be used as a key. 163 00:08:42.960 --> 00:08:47.159 Yeah, absolutely, yeah, And there's there's all sorts of HMAC, 164 00:08:47.200 --> 00:08:49.759 there's all sorts of things you can use. Just the 165 00:08:49.799 --> 00:08:53.320 machine key is typically tied to, you know, a dot 166 00:08:53.440 --> 00:08:56.799 ED installation of well really anything. Every Windows computer has 167 00:08:56.840 --> 00:08:59.679 a dot N installation on it. So if you can 168 00:08:59.679 --> 00:09:02.399 get out access to those keys, you can do things 169 00:09:02.440 --> 00:09:06.159 like maybe manipulate the encryption on the box. You can 170 00:09:06.200 --> 00:09:08.559 do things like say that you're authorized to a site 171 00:09:08.559 --> 00:09:11.200 by encrypting a token that might be passed around whatever 172 00:09:11.240 --> 00:09:15.519 it may be. So getting access to those is reasonably important. 173 00:09:16.759 --> 00:09:19.279 In this particular one, the POC attempts to trigger a 174 00:09:19.360 --> 00:09:24.600 remote code execution by delivering a dot net binary format 175 00:09:24.720 --> 00:09:30.360 or payload as a cookie of a forged security context token. Right, 176 00:09:30.440 --> 00:09:32.559 So in this particular case, they're doing exactly what we're 177 00:09:32.600 --> 00:09:36.840 just saying. They're they're using those to then forge a 178 00:09:36.960 --> 00:09:40.240 token and using inside that token they're they're calling a 179 00:09:40.279 --> 00:09:43.480 binary format or that allows them to get remote code execution. 180 00:09:43.679 --> 00:09:47.759 So is this a legal thing for for anybody to 181 00:09:47.799 --> 00:09:50.200 be able to do like, is this an expected thing 182 00:09:50.200 --> 00:09:53.559 that was just exploited or is this like a bug 183 00:09:54.039 --> 00:09:55.320 if you will, No, this is. 184 00:09:55.399 --> 00:09:57.960 This is just a bug. Okay, this is a de 185 00:09:58.120 --> 00:10:02.320 serialization bug if er recorrectly, yeah, going through it. Yeah, 186 00:10:02.320 --> 00:10:06.759 it's a decerialization bug in here, so m I actually 187 00:10:06.960 --> 00:10:08.799 de serialization bugs are awesome. 188 00:10:08.519 --> 00:10:12.840 Too, but unless they happen to you. 189 00:10:13.080 --> 00:10:17.080 Yeah, yeah, even then. Honestly, sometimes we'll just put systems 190 00:10:17.120 --> 00:10:19.600 on the Internet, no firewall, just to watch the magic. 191 00:10:20.200 --> 00:10:23.720 Grab some pointers. Yeah see I'll stick. 192 00:10:23.600 --> 00:10:25.639 Man, get a copy of Shrek in French. 193 00:10:25.879 --> 00:10:29.080 Yeah, whatever, and just see how quickly they they actually happened, 194 00:10:29.120 --> 00:10:30.200 get ripped offline. 195 00:10:30.960 --> 00:10:33.120 Some frenchman was putting all of his movies on one 196 00:10:33.120 --> 00:10:34.840 of ours. We got copies. 197 00:10:35.240 --> 00:10:37.840 Wow. See that's the French. The French would do that. 198 00:10:37.879 --> 00:10:43.759 The Germans would put strudele recipes, kept it strude. 199 00:10:44.519 --> 00:10:46.639 I thought that was I know it's it's more than 200 00:10:46.679 --> 00:10:48.080 a week old, but I thought it was important for 201 00:10:48.200 --> 00:10:48.559 us to cover. 202 00:10:48.679 --> 00:10:51.919 Okay, should we take a break, Yeah, all right, we'll 203 00:10:51.960 --> 00:10:59.279 be right back after these very important messages, and we're back. 204 00:10:59.480 --> 00:11:03.480 It's Secury this week. I'm Carl, that's Patrick, Dwayne and Heinrich, 205 00:11:04.080 --> 00:11:07.320 who is now speaking, and we got a few more 206 00:11:08.039 --> 00:11:12.039 a few more stories here. I hadn't heard of trick 207 00:11:12.120 --> 00:11:16.600 butt before, but this headline is Trickbot variant uses DNS 208 00:11:16.720 --> 00:11:21.759 tunneling for command and control. So tunneling kind of like 209 00:11:21.799 --> 00:11:25.399 a VPN. Is that like wrapping the packet in a 210 00:11:25.480 --> 00:11:28.000 header and footer to make it look like something else 211 00:11:28.120 --> 00:11:32.120 or inside the DNS packet? I'm not sure. 212 00:11:32.320 --> 00:11:35.559 Yeah, absolutely, it's the same type of thing. Think of 213 00:11:35.600 --> 00:11:39.039 it even like a VPN. Right, So you're using a VPN, 214 00:11:39.120 --> 00:11:43.840 you're tunneling all of your TCPIP traffic in these packets 215 00:11:43.879 --> 00:11:47.039 that really the firewalls can't understand, but they send them along. 216 00:11:47.080 --> 00:11:48.879 They have the proper headers to route out and that 217 00:11:48.919 --> 00:11:49.759 sort of stuff. 218 00:11:49.480 --> 00:11:51.679 But the actual packet just looks like data. 219 00:11:51.799 --> 00:11:54.879 Exactly in the middle part of that packet is encrypted, right, 220 00:11:54.919 --> 00:11:57.480 so they can't read it, and they all route it 221 00:11:57.519 --> 00:11:59.240 along and when he gets to the proper place, it 222 00:11:59.279 --> 00:12:02.879 gets decrypted. And then in a VPN situation, your Internet 223 00:12:02.879 --> 00:12:05.200 traffic just routes wherever it landed. 224 00:12:05.039 --> 00:12:09.120 Unless the place that you're trying to use while on 225 00:12:09.240 --> 00:12:12.919 a VPN detects that you are using a VPN and say, hey, 226 00:12:12.919 --> 00:12:15.120 you can't use a VPN, yeah, exactly, which a lot 227 00:12:15.120 --> 00:12:17.840 of the streaming services do that. Yeah, And here's what 228 00:12:17.879 --> 00:12:19.519 I'll tell you. I mean a lot of that comes 229 00:12:19.519 --> 00:12:22.240 from a lot of the streaming services understanding what the 230 00:12:22.320 --> 00:12:26.120 VPN end points are that you would come out of. Yeah. 231 00:12:26.159 --> 00:12:30.320 So, for example, let's say you could get one installed 232 00:12:30.840 --> 00:12:33.399 at home and then route through your house is a VPN, 233 00:12:34.159 --> 00:12:35.919 chances are you're fine there, So you go anywhere in 234 00:12:35.919 --> 00:12:40.559 the world and still get your streaming services or yeah, right. 235 00:12:40.639 --> 00:12:45.799 Or yeah, I should stop talking, should stop talking right now. 236 00:12:45.639 --> 00:12:49.480 Let's just say there's a lot of clouds, it's just aws. 237 00:12:51.320 --> 00:12:54.200 Maybe you spin up a VPC somewhere. 238 00:12:55.200 --> 00:12:57.120 The legal way to do this is use a service 239 00:12:57.200 --> 00:13:01.759 like Nord VPN and purchase an IP address that nobody 240 00:13:01.799 --> 00:13:02.600 else has. 241 00:13:02.720 --> 00:13:06.000 So you can you can absolutely do that works, yeah, 242 00:13:06.120 --> 00:13:09.519 or rally through Amazon. Yeah, okay, and then it's a 243 00:13:09.559 --> 00:13:13.240 little sketchier, but who knows. So in this particular case, 244 00:13:15.159 --> 00:13:18.919 they're disguising, right, like you would disguise your web browsing 245 00:13:19.000 --> 00:13:23.000 traffic by using a VPN, they're disguising their C two traffic, 246 00:13:23.000 --> 00:13:26.039 their command and control traffic because They don't want you 247 00:13:26.080 --> 00:13:27.960 to discovered of course, right right, They don't want you 248 00:13:28.039 --> 00:13:31.600 to know what they're actually x fultrading or infiltrating into 249 00:13:31.600 --> 00:13:32.840 your in your network. 250 00:13:32.679 --> 00:13:34.679 Or that they're infiltrating or exful trading. 251 00:13:34.879 --> 00:13:37.159 Yeah, well that's true. That's that's a good point. 252 00:13:37.240 --> 00:13:40.600 So what did they set up a DNS service and 253 00:13:40.759 --> 00:13:45.879 then whoever pings that service, they can un tunnel it, 254 00:13:46.200 --> 00:13:48.519 unwrap it and see what the actual message is. Is 255 00:13:48.559 --> 00:13:49.440 that how they were doing it? 256 00:13:49.559 --> 00:13:52.399 Yeah, exactly, Yeah. I mean think of it this way 257 00:13:52.799 --> 00:13:55.559 for those of you who've really kind of thought deeply 258 00:13:55.600 --> 00:13:58.960 about how the Internet works. I guess when you go 259 00:13:59.000 --> 00:14:02.600 to www dot mysoft, dot com, right, there's a whole 260 00:14:02.639 --> 00:14:05.279 bunch of dot com So it flips it and it 261 00:14:05.320 --> 00:14:08.039 looks it looks at the address backwards. So there's a 262 00:14:08.039 --> 00:14:10.519 whole bunch of dot com servers right, and dot gov 263 00:14:10.559 --> 00:14:12.879 and dot dot d U and whatever. Right, there's a 264 00:14:12.879 --> 00:14:17.039 whole bunch of root level domain controllers that that handle those. 265 00:14:17.639 --> 00:14:20.240 Then the dot com server goes, Okay, I know where 266 00:14:20.320 --> 00:14:23.600 Microsoft is. I don't know where this dubww you know 267 00:14:23.720 --> 00:14:25.480 www is. I don't know where that is, but I 268 00:14:25.480 --> 00:14:28.360 know where Microsoft is, so let me point you at Microsoft. 269 00:14:28.720 --> 00:14:31.759 So then your traffic goes from there to Microsoft and 270 00:14:31.799 --> 00:14:36.039 the Microsoft server goes. Okay, I know where Www is, 271 00:14:36.159 --> 00:14:38.840 I know where staging dot Microsoft is, I know where 272 00:14:39.240 --> 00:14:42.720 you know Xbox dot Microsoft is exactly, and it has 273 00:14:42.759 --> 00:14:45.320 an IP address, probably have a load balance or whatever 274 00:14:46.240 --> 00:14:49.320 of each of those different what they call canonical names 275 00:14:50.120 --> 00:14:52.279 or a records is depending on what you're you know, 276 00:14:52.320 --> 00:14:55.360 what you're putting in there that point to those services. 277 00:14:56.039 --> 00:15:01.320 Now imagine this, Imagine that Microsoft DNS controlled by us, 278 00:15:01.559 --> 00:15:04.320 the hackers, right, so somebody comes to us looking for Www. 279 00:15:04.440 --> 00:15:05.879 We just throw it out when we go that's garbage. 280 00:15:05.879 --> 00:15:06.240 I don't give. 281 00:15:06.279 --> 00:15:07.039 I don't care about that. 282 00:15:07.159 --> 00:15:10.080 You mean we we resolve it to the actual Www. Yeah, 283 00:15:10.120 --> 00:15:13.120 maybe we do, right, but let's he probably would, so 284 00:15:13.120 --> 00:15:15.240 you wouldn't be detected. I'm trying to think like an 285 00:15:15.240 --> 00:15:16.080 evil person here. 286 00:15:16.200 --> 00:15:19.759 Sure, well, and and maybe where you know, I don't know, 287 00:15:21.480 --> 00:15:24.240 shark laser, shark cages dot com. 288 00:15:23.960 --> 00:15:25.559 Right, Bob's discount shark cages. 289 00:15:25.720 --> 00:15:28.159 There you go, Bob's Discount shark cages. So we're not 290 00:15:28.320 --> 00:15:30.960 like hackers RS dot com right, but we're you know, 291 00:15:31.000 --> 00:15:34.159 we have we control this DNS server. Now, let's say 292 00:15:34.200 --> 00:15:37.840 somebody comes to me looking for an address that is 293 00:15:38.159 --> 00:15:43.559 you know A E three, four six nine, B C two, 294 00:15:44.720 --> 00:15:49.960 you know D five dot Bob's Discount, you know Shark 295 00:15:50.000 --> 00:15:54.440 lasercages dot com, and that that big front name is 296 00:15:54.480 --> 00:15:57.600 actually just a base sixty four encoded response. 297 00:15:58.039 --> 00:15:58.360 Wow. 298 00:15:58.440 --> 00:16:00.399 So when I see that name, instead of revolving it 299 00:16:00.399 --> 00:16:03.360 to an IP address, I take that crazy name on 300 00:16:03.360 --> 00:16:06.039 the front and I dBase sixty four it back in 301 00:16:06.080 --> 00:16:09.879 the text and now I'm getting commands back. Right. So 302 00:16:10.000 --> 00:16:15.279 that's one way to do DNS tunneling as a C two. 303 00:16:15.759 --> 00:16:20.440 And when I respond, instead of responding with an IP address, 304 00:16:20.679 --> 00:16:23.600 it's my agent calling me. I know that I'm going 305 00:16:23.639 --> 00:16:26.360 to respond with what's called a text record, which is 306 00:16:26.399 --> 00:16:29.120 here's the command I want you to run now, and 307 00:16:29.159 --> 00:16:31.240 then it's going to come back with what the answer 308 00:16:31.360 --> 00:16:33.679 on that command was, whether it's show me all the users? 309 00:16:33.720 --> 00:16:34.480 And that's sort of stuff. 310 00:16:34.600 --> 00:16:37.039 And you can just take an open source implementation of 311 00:16:37.120 --> 00:16:39.600 DNS and bastardize the protocol. 312 00:16:40.159 --> 00:16:42.279 You can. You don't even have to you don't have 313 00:16:42.360 --> 00:16:46.240 to write it from scratch. There are tons of evil DNS. 314 00:16:46.360 --> 00:16:49.600 Well, there's open source DNS servers too. Like Patrick, there's tons. 315 00:16:49.480 --> 00:16:51.759 Of evil DNS servers that you can do that with. 316 00:16:52.120 --> 00:16:54.120 Like you don't you just set up an evil DNS server. 317 00:16:54.240 --> 00:16:54.519 It's not. 318 00:16:54.639 --> 00:16:57.159 That's how it probably started as somebody took a DNS 319 00:16:57.200 --> 00:16:58.159 and customized. 320 00:16:58.279 --> 00:16:58.919 Yeah, exactly. 321 00:16:59.000 --> 00:17:02.279 I remember when they weren't a ton of DNS evil 322 00:17:02.360 --> 00:17:05.000 DNS is to deal there. I remember when bind was 323 00:17:05.799 --> 00:17:08.279 we had to make our own ships. They weren't delivered. 324 00:17:09.319 --> 00:17:11.440 I remember when token ring was a thing. 325 00:17:11.839 --> 00:17:14.000 I remember when we had to grind out our keys 326 00:17:14.079 --> 00:17:18.000 by hand. It's right, with a rotary key maker. 327 00:17:18.359 --> 00:17:20.160 We had to make the key out of aloney and 328 00:17:20.480 --> 00:17:21.640 carget it with our teeth. 329 00:17:23.640 --> 00:17:26.960 Anyways, So in this particular case, because they didn't want 330 00:17:27.039 --> 00:17:30.319 their I mean, Base sixty four ring, a command is 331 00:17:30.400 --> 00:17:33.480 super easy to detect generally, Okay, So what they actually 332 00:17:33.480 --> 00:17:37.119 did is they say commands are encrypted with a single 333 00:17:37.200 --> 00:17:39.440 byte x or hex encoding. 334 00:17:39.880 --> 00:17:42.359 First off, that's why I always use base sixty three. 335 00:17:42.599 --> 00:17:47.359 First off, whoever wrote this article, it says, whoever wrote 336 00:17:47.359 --> 00:17:50.680 this article a little bit of information on the fact 337 00:17:50.680 --> 00:17:56.000 that x or and hex encoding isn't encryption. Encryption is 338 00:17:56.039 --> 00:17:58.880 either asymmetric or symmetric, and it uses a key, and 339 00:17:58.920 --> 00:18:00.559 it falls an algorithm, and it would be either a 340 00:18:00.599 --> 00:18:03.160 bit chain block or something along those lines. This is 341 00:18:03.240 --> 00:18:06.240 in encoding, which means it's not actually encryptob whatever. All right, 342 00:18:06.480 --> 00:18:08.440 I'm not going to go into that. Holy I think 343 00:18:08.480 --> 00:18:13.519 you just did no but heedless to say there's a 344 00:18:13.559 --> 00:18:18.440 stupid Yeah, their commands were obfuscated. I'll put it that way, 345 00:18:18.839 --> 00:18:19.880 in a way that would make it. 346 00:18:20.079 --> 00:18:22.319 Like this story has been obfiscated. 347 00:18:23.440 --> 00:18:25.680 And for the one listener that's still awake, thank you 348 00:18:25.799 --> 00:18:29.400 very much. I know who you are. You're on discord. 349 00:18:29.480 --> 00:18:34.200 It's great to talk to you. Yeah, So that's that's it. 350 00:18:34.240 --> 00:18:37.160 This is just an interesting method for command and control. 351 00:18:37.359 --> 00:18:39.599 The problem is, like I could even ask you, Carl 352 00:18:39.680 --> 00:18:42.279 at home, how many DNS quarters do you make in 353 00:18:42.279 --> 00:18:42.599 a day? 354 00:18:42.680 --> 00:18:44.599 Oh? Geez, I mean I don't personally make them. The 355 00:18:44.599 --> 00:18:46.680 browser makes them. But yeah, every time I go to 356 00:18:46.720 --> 00:18:50.319 a website, so in a day, maybe one hundred two hundred. 357 00:18:50.400 --> 00:18:53.480 Well, actually it's probably more than that because there's resources. 358 00:18:53.880 --> 00:18:56.680 Yeah, and every picture might be on marketing site, and 359 00:18:56.720 --> 00:19:00.680 every JavaScript might be pulled from a general like so there. 360 00:19:00.519 --> 00:19:02.400 May be right, it's not just what you type into 361 00:19:02.440 --> 00:19:04.599 the browser, it's all the images and everything else. 362 00:19:04.680 --> 00:19:08.000 Yeah, yeah, there may be hundreds of thousands of DNS 363 00:19:08.119 --> 00:19:09.559 quarries and this ads. 364 00:19:09.839 --> 00:19:11.200 Yeah, with your different domains. 365 00:19:11.279 --> 00:19:11.880 Yeah, you're right. 366 00:19:11.960 --> 00:19:14.839 So now let's say tomorrow you make a million DNS quarries. 367 00:19:14.839 --> 00:19:17.319 Would you notice what I noticed? What as opposed to 368 00:19:17.400 --> 00:19:20.839 your normal one hundred thousand. You probably wouldn't know, right, 369 00:19:20.880 --> 00:19:23.039 because you're not logging how many DNS quorts. You don't 370 00:19:23.079 --> 00:19:25.960 know what's normal. And I'll read the logs right exactly, 371 00:19:26.039 --> 00:19:30.319 And even I have a really pretty lockdown network, I 372 00:19:30.359 --> 00:19:32.279 don't know that I would notice a difference of ten 373 00:19:32.319 --> 00:19:37.200 percent more DNS quarries out. Okay, So this is where like, okay, 374 00:19:37.640 --> 00:19:41.680 really good monitoring, really good understanding of what's normal and 375 00:19:41.720 --> 00:19:43.799 what's out of the norm. You would have picked this 376 00:19:44.000 --> 00:19:47.359 up right. You would have seen an increase in DNS traffic. 377 00:19:47.680 --> 00:19:49.519 And I hate to say it, but AI is going 378 00:19:49.599 --> 00:19:50.799 to be the thing that helps us with this. 379 00:19:50.920 --> 00:19:53.039 Oh yeah, and hurts us. 380 00:19:53.079 --> 00:19:54.559 But we'll talk about that later. 381 00:19:54.400 --> 00:19:56.920 In other ways foreshadowing. 382 00:19:57.000 --> 00:19:59.839 Before we jump to that story, I want to tell 383 00:19:59.880 --> 00:20:01.480 you guys a little hack that I did that I 384 00:20:01.799 --> 00:20:04.799 was very proud of. Myself for figuring out. So I 385 00:20:04.920 --> 00:20:09.279 use Bitwarden, right, and I use it. It's sort of you know, 386 00:20:09.519 --> 00:20:13.319 I use the extension in Chrome, right, yep. So that's 387 00:20:13.359 --> 00:20:16.599 that's a good thing. And I have a MacBook, and 388 00:20:16.880 --> 00:20:19.240 I needed to use my MacBook because I'm doing some 389 00:20:19.559 --> 00:20:22.960 MAUI development and testing it with iOS and all that stuff, 390 00:20:23.319 --> 00:20:26.559 and I had to set up some stuff on my Mac. 391 00:20:27.279 --> 00:20:31.960 But I was using an AI that understands my system, 392 00:20:32.920 --> 00:20:35.720 visual studio and all that on my Windows machine. And 393 00:20:35.759 --> 00:20:39.480 I haven't taken the time to make a tunnel between 394 00:20:39.880 --> 00:20:42.920 these machines, right, so they there really isn't any way 395 00:20:42.920 --> 00:20:45.119 I can like copy and paste from one machine to 396 00:20:45.160 --> 00:20:47.519 another yet, and I could do that easily, but I 397 00:20:47.559 --> 00:20:55.160 haven't sure. So Bitwarden in any login record has a 398 00:20:55.240 --> 00:20:59.160 notes field, and I have Chrome running on the other 399 00:20:59.240 --> 00:21:01.960 side the Mac, and I just open up one of 400 00:21:02.000 --> 00:21:05.119 these things and type my command that I need to 401 00:21:05.240 --> 00:21:08.680