Upload
others
View
4
Download
0
Embed Size (px)
Citation preview
1© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ETERNAL BLUES WITH ETERNALBLUEAdrian Hada, Senior Security Research Engineer
2© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
WHOAMI
• Senior Security Research Engineer
• Spend my time researching attacks, malware, botnets and the like
3© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
QUICK OUTLINE
• EternalBlue
• Online Scanning
• Active Threats
• Stats
4© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
WHAT IS ETERNALBLUE?
Photo by Ales Krivec from Pexels https://www.pexels.com/photo/camping-environment-feet-grass-558454/
5© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
WHAT IS ETERNALBLUE
E=mc2
6© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ONLINE SCANNING
7© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATS
• DoublePulsar - Shellcode+DLL
• Advanced analysis methods
• Find malware download URLs
• Download & profit
8© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATS
• Nice and shady RAT
• AV products have good detection
Gh0st RAT
9© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATS
• Fingerprints system
• Receives target
• Sends large buffers of data (port 80)
Nitol DDoS Bot
10© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATSCoin Miners
11© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATS
• Very territorial, kill other miners and harden the host
Coin Miners
12© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
ACTIVE THREATS
• No-killswitch WannaCry
• The dropped binaries do not run correctly
• No Bitcoin wallet, URLs for paymentnew.ok.ru
WannaCry & Clones
13© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
0
100000
200000
300000
400000
500000
600000
700000
May June July August September October (partial)
Attack Count
Attack Count
Number of Attacks
14© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
0
10000
20000
30000
40000
50000
60000
70000
80000
May June July August September October (partial)
IP Count
IP Count
Number of IP Addresses
15© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATSGeographical Distribution of Targets
0
50000
100000
150000
200000
250000
300000
350000
400000
Asia Europe North America South America Oceania
Attack Count
Attack Count
16© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
United States20%
Russia11%
Japan8%
Indonesia5%Vietnam
5%India5%
China4%
Ukraine4%
Brazil4%
Taiwan4%
Venezuela3%
Turkey2%
South Africa2%
Netherlands2%
United Kingdom2%
Republic of Lithuania1%
Thailand1%
Hong Kong1%
Other16%
Attackers
Geographical Distribution of Attackers
17© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
• Conficker - Very few of the total
Types of Hosts
18© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
• Residential & IoT – proxies?
Types of Hosts
19© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |
STATS
• Enterprise
Types of Hosts
20© 2017 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |