Pwn All The Things
If you're interested in the technical aspects of #DNCHack, implant and attribution, here's @Crowdstrike's analysis: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ …
-
COSYBEAR is an interesting implant. Python and Powershell; comms via .NET using AES with a fixed sym-key
#DncHackpic.twitter.com/CpCXNEQTux
That puts COSYBEAR here on the @daveaitel implant-sophistication scale :) #DncHackpic.twitter.com/DXNIhVplhx
-
-
Fixed IV/key in COSYBEAR means can traffic-decrypt from pcap. Clearly not written by folks who know crypto
#DNCHackpic.twitter.com/BrPLBNjli9
-
-
lolwtf? COSYBEAR operators apparently are lame script kiddies. Clearing event logs is like the worst opsec
#DncHackpic.twitter.com/KW2AA1iW7a
-
Serious Q: What AV does DNC run? How did it possibly miss an implant clearing win-event logs w/ WMI persistance?pic.twitter.com/bls5QPOn8R
-
For some reason
@CrowdStrike listing IOCs as SHA256, when industry standard is SHA1. Makes it harder to search for.pic.twitter.com/p2BQY92hXz
-
.
@CrowdStrike Also for some reason clearly have, but aren't sharing the binaries. Seems optimized to stop people checking their results. -
Btw, if you want to piggyback onto COSYBEAR, its startup module downloaded w/ fixed AES/IV dl-ed over HTTP (port80)pic.twitter.com/HejStU8MWi
-
-
-
@pwnallthethings This is a pretty common place for implants to be. It has advantages because doing client-side key generation is noisy. -
@daveaitel Yes, but doing a full-blown HTTPS connection isn't especially. AES over HTTP is noisy and obv to firewalls + network perimeter -
@pwnallthethings Tradeoffs everywhere. :) Sometimes just because of legacy code! -
@daveaitel Usually! Here I think it's just a bug. COSYBEAR uses HTTPS for its actual comms. HTTP+FixedKey is only for startup/bootstrap.
-
-
-
@pwnallthethings@daveaitel Can you please send me a link to this sophistication research? very much interested
-
-
@pwnallthethings awkward.. I discussed this extensively with@daveaitel in 2002 when we demoed CORE IMPACT to Atstake New York
daveaitel
Paul Jaramillo
iarce
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.