so I'm going to talk about the very strange topic right at least it has a
strange word called steganography I know how how much you guys are acquainted to
the word does anybody know what steganography means Johanns some not all
so when I was putting together this presentation I was thinking maybe I'll
talk about the history of what's that is so I'm going to talk about the Romans in
Julius Caesar you know that started super boring now nobody's going to want
to talk about that or listen to do that kind of stuff so instead of that I i
look for different examples of steganography more and more on a little
bit more current and more fun so I don't know if you know this story is about
arnold schwarzenegger the governor to her and a few years ago he showed up
being named some Democratic Party announced that the very well so they
heckle him they told him
lots and lots of stuff they insulted him now what did the guy that the next door
actually the next law that they were trying to pass he vetoed it not only did
he veto the law he also sent this text as the official reason I read it to you
cuz I realize it's very small steps to the members of the California State
Assembly and returning Assembly Bill 1176 without my signature or something
now have lamented the fact that major reasons issues overlooked while many
unnecessary bills come to me for consideration for everything is
major Asian measure brought to the table but the legislature just kick the can
down the alley it looks like I'm projecting it now everybody was very
outraged because there's a hidden message and I know you guys see the
hidden message there if you see the first letter of every line can you see
what it makes out with you see you CK why oh you how was the guy who actually
heckle him back there in the
and in the in the democrat
dinner so this is a hidden message or an example of a hidden message nowadays
have been relatively few years ago so not that many not too long ago so this
is a moral example of steganography is trying to hide data within data to try
and do good
a kind of data that is unexpected in this context into another data you know
that you would expect all this letter actually a secret message and are going
to put this into the virtual world right into the computer world and this is what
are no worse actually telling Tom Ammiano which was so in the virtual
world with this translates to is normally putting hidden Mestas into
pictures for instance right so in a picture if you notice the left hand side
there's the complete white complete widest and 255 complete white saturation
no you that bit a little bit down to the left so it's a 254 254 250 forces than
white humanized on Saturday so you can use that difference in order for you to
encode a bit so instead of putting complete white you put slightly great
and instead of 10 so you can encode one bit of information if you go further
down and that's a 252 just for comparison you cannot seem to the human
eye that's complete white that way you can encode a lot of information this is
the picture it's a classic picture of a model it's been hows 1970
too many to November 27 to play made not been houseman playboy so this for some
reason I have no idea what the stable steganography geeks have used this
picture always to show differences in encoding data and pictures so when get
started to do that mean sorry they designed this starting to do that this
the encoded information into this particular image if you notice at the
left hand side is the real image from the real jpg at the right hand side its
encoded information there is a hidden message there it's completely impossible
the human eye to discern whether there's encoded information and if you look at
the histogram the history tells you what how many colors of its type right you
can see the color this division it's spiky if you notice there's a little bit
more spikes which means that there's extraneous information but you won't be
able to discern from the naked eye
there's nothing strange there so this is the way to encode information this is
the way that stable weeks have been doing it now at the end of the criminals
are going for the money so this is really pretty this is very good you know
Jay bags das good but the guys just want the money so I'm going to be telling you
by way of example how different malware writers persons behind this model where
r encoding information I using steganography in order to make money in
order to encode information to be to fly under the radar so they're less likely
to be detected but they're not the only ones right
criminals are are very common and very frequent but they're not the only ones
who create model who else create small were any idea
nobody these guys write those guys yeah those guys and what do they want it or
no money is going to be for spying for trying to get information from their
targets so these guys are going to find steganography incredibly useful for the
purposes
there's been a few examples leader state sponsored more were there is using
steganography nowadays who else is using malware nowadays to attack these guys
actually know these guys were dunno terrorist activists you name it right
guys who want to smear create smear campaigns to to defame to destroy the
reputation of their targets so again these guys also find it useful to create
my own to be more difficult to detect now I'm going to go for the examples
remember that I'm going to be putting by way of example showing steganography
assets been currently used in my way if you were here in the previous session
for track it's one of the mothers that uses that I did not go for some reason
sorry role and I told you that are not going to help me are not going to help
me he's hiding something there so the first one they have here it's looks
looks is a downloader in the same way as well track it just download stuff now
what does it download actually it has now gone its own icon and if you look at
it closely these are from two samples you look at it closely at the picture at
the edge of the victor
you can see that there's like garbage go try this is something some pixels there
don't belong on the right hand side again same thing it's the side of the
picture frame there's some extraneous information what is that it's actually
code treats that as code is not they know it's real code is just ended there
any runs it and he continues his routines does the first one being able
to
hide malicious code with another call now you might think that's not super
useful in the same way that you can encrypt in layers like road was telling
us you can also to split their what was the difference between encrypted code
and this kind of God not much really
the broadly stable geeks that really like to you still not a lot more than
that as by way of example
lurks also is very interested in that it has this this can of peas he goes to the
CNC any downloads what the weather's download download his picture that's a
very ugly picture right he looks like quite yet but we know that why'd you can
encode starving wait because I doesn't discern between very close
hues of Wight now if you look at this picture that the upper part is the
header but the lower part it's the white it's actually not why do you look at the
end and the FBS
255 255 situation but it's a 255 255 254 agree with the actually in cold here
it's a URL including the euro which is the next step of downloads downloads
here and it continues the process do you see how it works both codes code within
code and code sorry URL within a picture so that's one example
well another one stakeholder much more complex than this actually download the
picture and within the picture you can find real bits and bytes often are
seeing coded piece of code so inside there's another DLL which it puts into
memory unbranched this is this is the stuff I really it when I was putting
together this presentation I thought this it's really not worth showing lots
of bits and bytes so I'm just show you the picture now the thing about this one
is that when you are as a virus analyst when you're seeing all this exchange
without looking at the virus you only see somebody trying to download this Jay
back from the internet and that's it that's why you see so any device trying
to see the exchange of information will only see a JPEG being downloaded we have
no idea what's inside
actually there's called and say there's a DLL theses a DLL download inside
their image which is scary and itself now the second part this was encoding
code are you getting gored also data right configuration they don't normally
the next stage this is Arnold trying to go to tell you is going to help me so
who's who's p.m. this is part of the code and promises can promise that so
you have a download of a dbag and you can see where you downloaded from so
it's just a JPEG download pure and simple nothing else nothing fancy about
this message a big it down as a deep which is this beautiful sunset again any
device in the way would only see the JPEG download that's it so he will know
what it is it's actually the codes are see encoded in the codes to something
that it's a paradox that delighted the original images to view of image at the
right hand side is a modified image at the very end it has stuff appended its
encoded with RCA for when you dial the code with this is the contents in ASCII
know where you the code that its regular sues configuration file so it has actual
configuration they die within the image download an image it looks like an image
it is an image but appended to it there's something in coded that is most
of its configuration they don't see this is news
another example on this is in the mobile domain that's very interesting because
this was a malware that got installed promising that it was a poor and
application for Android now I know you're interested in that but I wasn't
allowed to show you saw that was pixelated but in the end the icon it's
it's a poor and I can write in the icon inside there's hidden information so if
you look at the icon durst just pure B&B they reduce pixels and there's a marker
called text software and some stuff that looks like it might be pixels no it's
not it's not because if you look at the code that's the beautiful thing of
underrated gives you the code right so you look at the cold and you see what
he's doing is looking for a marker and it's doing some stuff does anybody know
what this piece of code is doing to recognize the XOR is exploring with with
a very ugly key get that key is just sex or nothing nothing fancy just a very
long now view X or that piece of gold within the icon is what you get this
configuration data it's it's SMS it was texting SMS to Premium Members nothing
fancy about this one but it was encoding within the same icon within the porn
icon other Android application he was including all the configuration data so
if you look for it if you're trying to look for the
configuration data from an analyst point of view you won't see anything it's into
the into the icon which is interesting and the third part now we know with a
high coat we know they hide data and they also highlight CNC communication
and yeah you were waiting for it so I know this time to stop communication
here so more very interesting you know what this one does in order to see what
the CNC is instead of having it hard coded it makes a DNS connection it asks
a certain server for a certain domain and only text so if you make a request
it doesn't work so doesn't exist I don't know what it is but if you look at if
you ask for a text so what to text associated to this domain
this when you get there is change what would you get that now the virus after
doing this DNS requests gets that they don't because he devoted to this so then
the next stage is that one makes the second now he got the C&C
text description from a domain and remember that that domain does not
resolve normally within the eight just is not resolved only with a text the
text has been doing is being used for something so this is a way of
steganography right you would never expect that in this channel to have this
kind of information if you're looking at the fire's point of view looking at this
communication you have noise the other data channel is being abused to encode
information that does not belong there completely does not belong that tax
there is one way of getting information within a C&C but there's more where
banker
how there's this one get what the next stages where this season sees this is a
very creative one is relatively modern March 2014 now it goes to Pinterest it
goes to Suffolk pins and if you look down our lives down and looks who r for
that right we look for them and somebody commented that that stuff comment is
that if you look there that's a very strange comment it's four numbers
provided by ABC indeed it is an IP address it is actually the CNC it goes
to Pinterest it looks pretty specific comments it known that it's an IP
address and he puts together the whole URL for the next stage of the C&C so
he's using public public sources just public URLs in order to look for the
next stage of the C&C download now in the same vein bro similar to this is
Jenica
January 2015 very similar to this but it does it doesn't with your YouTube it
goes to YouTube specific YouTube videos and you see down there there's a very
strange comment right are our anniversary with a number it looks looks
like what is this
there's more examples here a little bit bigger generally 2004 modern now this is
the piece of code if you look at the piece of code that creates it divides by
31 33 37 elite which is cool and needs some special algorithm it creates an IP
and just communicates with baby that's it that's all it's actually the same way
that number it included an IP address that is the next stage of downloads it
has a configuration they died inside
to continue the infection so just including information in an unexpected
tunnel the scary thing is that if you don't know that this is happening was
was you know to expect this then you can contact you to you can take it down if
you have no idea what is that this is happening you only see some computer
downloading a YouTube page that's all you see that's it nothing else nothing
suspicious
it's actually asking for configuration examples this one is hammered as it's
the one that its state sponsored using steganography also in this vein July
2015 so this is very very recent so what this one does it it goes to Twitter and
on Twitter it looks for the latest tweet of a specific user another user doesn't
exist
usually it doesn't exist now the day that the bad guy actually said that a
state sponsor eight so the country that once to issue commands to this hammered
as it creates that username every day is a different username so they want to
communicate with the user name and the tweet they do things like that now it
looks like a new user just created today is doing something that it's doesn't
make any sense now the malware knows that that user today's user hosts a CNC
C&C server so that is the C&C server for a two-day
for the for the next day but the download of the inspection now if the
bad guy if if the particular country affecting doesn't want to issue commands
the just don't create the user don't get to these user the day they want to
create that they want to issue the command is created using it as easy as
that
to it's one that's what is used for now what what country is responsible for
homicides any idea did you guys us' snow is not russia is Russia according to
some antivirus vendor which I won't name and another use for steganography is to
highlight stolen now I've always been thinking that it is like trying to use
unexpected channels to put them inside it's perfect for this and I haven't been
able to get to see a lot of this so I forecast that in the future this is
going to be the most useful way to steal information because if I see that
an infected computer it's sending away credit card data can I know well that
that computers infected now that guy can be sending 10,000 credit card numbers
all of a sudden through HTTP that's very obvious right now if they use some HTTP
sneaky like putting it into a 64 and encoding it into an HTTP request now
that's different and I were talking about how I had no idea what it is
anything that's happening any anybody sitting between the infected PC and the
server will be able to to see nothing nothing of interest now that this is so
this is what happened with vivica typically it's it's a little information
stealer from poland we know that it's important because its target
specifically polish credit card bank accounts which are made up by 20 digits
said 20 digits altogether that's what is looking for its looking for the memory
and it picks it up so he knows this user is providing some website the bank
account to pay and what did you do with it it has no idea what to do with it
there's no configuration they did not upload side there's nothing now what it
does it sends an HTTP request to a dummy website since you see that they get
requests / some garbage it doesn't exist it comes back with a moral core but it's
a fake corridor and you can deliver it because it's not a 404 not found its own
site now installs solar creating a new HTTP
we still deeply response here for four side now installed and within a dream
that response there is something in court it and that's something included
is a new Polish bank account so then the mall were what it does its it replaces
all instances of the users by this one so that they have to receive payments
instead of receiving payments to the user's account he receives it to the bad
guys
account but it got it again it guided through HTTP encode it so you would
expect to have a 404 response you expected to have any real information
any configuration configuration the power to do some stuff with right and
you would expect it to either on a tour of the response from a website so so
that's another way I hope that in the future this is going to be more
going to go more right because I could for instance asked to take website
something and put something in the post down completely nonsensical trying to
put information and nobody would be able to really expect anything out of the
ordinary you can use any protocol not only if there's a lot of echo here you
can use any product of their 2008 information is at the end of the days
it's putting unexpected
expected to handle so using a channel that doesn't belong there to put
information that you would expect now what's care about this that these
examples I'm telling you because i've seen it right but I can't tell you
things that I haven't seen because by definition these are using unexpected
channels I'm not able to ascertain whether there's information being
exchanged or not and that's a scary thing there must be lots of them using
all other channels that have not seen because I have no idea what to look for
and that is happening that is happening now the conclusion is this one at some
point he was really cool like something that makes a
you can put secret messages in today you can use any channel to encode
information and if you don't know that is there anything you would look for it
because you don't know that is there now the moment that bad guys start using
this to make money out of it or to actual trade information or a truck
information or perhaps to do terrorist
behavior there then it stops being cool because you cannot you cannot by
definition look look in a place that you don't expect something that you don't
know it's there you just don't know what's the what's the only thing you can
do start looking for unexpected things like if you see that the NHS is supposed
to be a very short conversation and you start seeing very huge chunks of the
exchange that strange but you don't really know what's in there right so the
end of the day it is cool but it can be evil right it can be bad it can be
misused and abused very easily and would not be wise we have no idea that that's
happening
we have time for two questions please use the easy ones yeah so everything was
clear I have seen in the question I'm going to ask have you seen any still
gonna for every light on the color channels of them out there that are
communicating to the client and server so that's what I'm saying that correct
channels are by definition until I see them when I see them then I know is
there then I can create a rule looking through them but I expect that there's a
lot of them that I'm not seeing because I'm not looking for them until the
moment when I see the mower then I open it I see the Cold War I start reversing
the coat and then I see what's happening all it actually works this way or so
then I know what to expect and the next time I see a call to Pinterest looking
for this specific string they know that they're looking for a serious interest
image absolutely there's there's a lot of covert channels I I know that
I suspect that there there has to be but I don't know what to look for
otherwise they will be covered does make sense once you find an image ladies how
hard it is to trace back it because it's posted by user created for from
something from some part of the world so you want to trace it back to a user who
created the secret message it is very difficult because it depends on what the
secret messages but normally it's either going to be coat nation so the data is
not gonna give you anything that relates to the user and if you look at where
it's hosted be hosted on github in my be hosted on Pinterest and YouTube with
your YouTube I would but the police can go to YouTube who uploaded this they
give you an IB that I've been may or may not tell you anything more often than
not if the guys will not tell you anything if the guys in the area but
normally bad guys a little more than that you really about why are you
looking for any other questions thank you so much for a presentation