Good morning.
Last year, in Santander, I also gave a speech.
That's why this year is called Art of Cyberwar 2, because last year was the first part of the presentation.
Last year we focused more on the agents of the threat, and this year we are going to focus more on the behavior of the threat.
Well, here we have the shield of the unit in which I am framed, the Cyber Defense Joint Command.
Today everything is interconnected, as the police officer said before.
It is difficult to think of something that is not connected to the Internet or to proprietary networks, in this case military ones.
Here we have the graph mounted, and we can observe... let's see if we can see the point...
Well, we have satellite communication, we have low-orbit communications, like drones, networks, digital soldiers for future soldiers...
Everything is interconnected in what is known militarily as the Global Information Grid, and all this data flows.
Evidently, all this data, as it flows, can be intercepted, interfered or modified.
From a protection point of view of the citizen, we have the smart cities.
We have smart meters, electronic counters, gasoline and electric counters, the water meter...
Everything is connected to the Internet so that the service providers can carry out a more efficient control and not have to send the man to look at the meter, or manage the service in a more efficient way, or manage the lighting in a part of the city.
Everything that is interconnected, like the video cameras, as the police officer mentioned before, traffic lights, everything that is in the network, as it can be accessed by the legitimate owner, it can also be accessed by third parties.
Even if they need to access the network, they will look for a way to access it.
As I was saying, last year I focused more on the part of the agents of the threat, and this year I focus on the motivation they can have to make an attack, but this year we are going to focus more on the exploitation of vulnerabilities.
So, the triangle of the threat, in this case, we are going to focus on the upper vertex.
We have different types of agents, as we mentioned last year, a small introduction, from criminals, as the police officer mentioned, which is what they can be most dedicated to.
We, personally, are a little less concerned, but we do focus more on the activities of hacktivists or foreign nations, or unhappy employees.
I still do not know happy employees, but they are always put as an example to unhappy employees as possible agents of the threat.
The competitors, which are there in the middle, obviously, when we are talking about the military industry, it is also very important, because the competition between companies makes it possible for an offensive movement to steal intellectual property,
and all that kind of things can also be a reason for investigation.
But our main adversaries will always be foreign nations and the activist groups, which are the main agents that are going to attack a state of law.
The criminal hackers, as was mentioned last year, will normally be able to act as mercenaries for foreign powers that want to count on them directly or buy their products.
As I was saying, this time we are going to focus more on characterization.
There are several models available today, these are open source, Dmitry has made it public, of how to characterize the phases of an attack.
The first step is the attacker.
He will make a recognition of the infrastructure that he wants to attack.
For example, a NMAP, so that you have a clear idea of what we are talking about.
Once he knows the contents of the infrastructure that his potential victim has, what he has to do is weaponize it.
He has to generate a weapon to be able to exploit those vulnerabilities that he may have detected.
The next step, once he has achieved his exploit, what he has to do is the transport campaign.
Normally, as companies and states do spend a lot of money on perimeter security, what they usually do is phishing campaigns, or spear phishing, very targeted emails, so that potential victims can fall for their deception and, in this way, go over the perimeter defenses,
because the email, in almost all companies, in all public bodies, is usually enabled.
So, once you receive that email and open the address, you click on a link, it is up to the attackers to establish a beachhead and start a multiphase attack to be able to control the devices and, according to their intentions, make side attacks inside the network or whatever.
Then, as I was telling you, the exploitation phase.
There would be, after having infected the team, and what is most important to them in most cases, the control, execution and maintenance of that threat.
There will be times when the attacker wants persistence in the victim, that is, to spend as much time as possible inside her.
As I was telling you, in the operations of industrial espionage, what the attacker is interested in is to be stealing information for years and years, because that way they can get information about a whole project in a much more stealthy way.
But on other occasions, if what you are trying to do is just steal some credentials, your goal is not to stay in that team.
You just get them, you get the administrator's credentials, for example, you take them and remove the persistence.
In this type of attacks, this is where we normally have malware without features, to avoid that a forensic analyst comes later and can recover the evidence that someone has been there, okay?
That is, there are two sides.
Normally, from a defensive point of view, once someone has seen how they can attack you, someone came up with the idea of ​​developing the Interaction Kill Chain, which is a model that allows you to generate intelligence and see how, if we saw before the different phases of an attack,
how to break in each of the phases of the attack the opponent's activities.
The more to the left we can attack the opponent's offensive actions, the better our defensive mechanism will be.
Unfortunately, the normal thing in almost all organizations is that you find out that they are doing something to you once they are doing what I was saying.
Someone has sneaked in and for some reason you already get an alarm, an event generated within your organization that detects that there is a malicious process in execution, so what you have to do is apply mitigation measures and learn from the sample you have captured to see what they are doing.
The ideal thing would be, in the recognition phase, in which they have not yet entered your organization, to have that ability to know in which forums you can move information about what they want to do to you or what they are going to do to you, to have people involved reading that information available on the web to be able to take and prevent future actions.
But the normal thing, as I say, is that most of the time it is reactive instead of preventive.
But you have to try to be preventive.
The attackers, in the end, are a business.
As much as I was telling you about cybercriminals, what they are looking for is to monitor the attack to the maximum, that is, a person who does not want to attack a government, but wants to attack citizens and develops a ransomware, what he wants is to charge 20,
40, 60, 200 dollars for the citizen to recover his information.
He is going to charge it in cryptocurrencies and that is his only goal.
What interests him?
To do something that is very, very effective.
Then he says, if I want to steal his systems from small people, I have to try to find out what is the operating system that has more diffusion to maximize the chances of success in my attack.
If it determines that the operating system that has more diffusion, for example, is Windows 7, then what it will do is to develop something that works against Windows 7.
It distributes a campaign, as we talked about in the library.
It knows that emails that coincide with campaigns, for example, with the income campaign, or you have an Amazon package or whatever, people click on that email and say, if I send 10,000 emails and I get 100 clicks, well, I may have been profitable.
On the other hand, the nations and companies that seek to steal intellectual property have as their main drawback that the potential victims are people who do invest in defense.
So what they have to do is prepare much better for the attack and, obviously, in many cases, resort to the black market to buy steel exploits to be able to take and apply them in their attacks.
Because to have their potential victims, the operating system with all the patches, the patched applications have people who are monitoring.
So it greatly increases the level of what you have to do.
But for them, the return on investment, in this case, is not a monetization of the attack, but simply being able to interrupt at any given moment a network of command and control.
So the goal is different.
For the state, the money does not matter, but for a criminal it does.
And as we said, the criminals who are dedicated to develop exploits can be playing two sides, see who can pay them a little more and sell it to the common people or sell it to the states and shut up that this is out there.
Go to the beach to sell, to say that you have managed to make a steel exploit, it does not make sense if what you can get is 200,000 dollars for getting an exploit in the black market.
From a defensive point of view, it is interesting to generate resilience metrics that allow you to see how your system resists possible attacks.
From an operational point of view, you have to have a complete vision of the entire chain of instruction, of everything that is happening, and do not focus only on merely technical aspects.
If you have a complete vision, you have to give context to the possible threats you have.
Why do you have to have context for the threat?
Because if, for example, it coincides that at a given moment there are elections in a country, it is a moment in which foreign agents can probably take and decide to take action.
What you have seen in the fake news, this type of thing happens.
Sometimes the information without context lacks meaning.
Later we will see a model in which geopolitical context is inserted within technical information.
From the forensic point of view, which is the part in which I have framed my unit, we are dedicated to gathering data from the attacks, both from the operating system and from the sample itself.
If at a given moment we detect that, for example, it comes through an email, we have the bug directly, we directly analyze the bug, but when it is time to analyze an infected organ, you also have to determine whether it exists or not, because you are dedicated to collecting the complete chain of the intrusion.
Unfortunately, each time the attacker's command and control system lasts less time, then most of the intrusions have a survival time of 24 to 48 hours before the command and control server stops working.
So, if we get the sample to analyze, maybe at 72 hours, we cannot complete the complete investigation of the intrusion because we only have the initiator of the intrusion, which is the one that goes in the mail, but if someone has infected the computer,
we can collect the rest of the evidence and do a complete study of the entire chain of intrusion and try from there to see what goes in the rest of the explanation to try to characterize who is the attacker.
Normally, in the first phase of the intrusion, people do not usually put all their potential.
One of the main offensive actions that can be taken is to go unnoticed.
That is, if you take and spend a zero-day exploit in phase 1 of the attack, you are trying to understand that you are a person who has economic resources and you can afford to spend between 100,000 and 200,000 dollars to make an attack, which, obviously,
a 15-year-old hacker cannot do.
So, this kind of thing gives an idea that the person behind this attack or group of people, an entity, has enough motivation to try to attack you and has more economic resources to do so.
It is clear that an attack like the Stuxnet is not done by a group of university students in their free time.
That requires a very strong economic investment behind to be able to carry out this type of research, to find some skills, to be able to make an exploit and develop it and then, on top of that, to place it.
Because, in this case, isolated networks, we are talking about the need, in the end, of a classical intelligence program to be able to go from the networks that are connected to the Internet to the isolated network, passing through a USB, and there, maybe,
you can require or coerce a person or bribe them.
So, this type of mix of attacks, as I was saying, can only be carried out by states or, in any case, companies that want to carry out industrial espionage.
I mean, people who really have a high economic motivation.
Not like in the movies where a normal person, from home, launches a meta-exploit and manages to destroy a nuclear power plant.
That is not the case, because the networks are tampered with, as I was saying.
The important thing, and from an operational point of view, as I was saying, is to find the centers of gravity that prioritize the development and employment of action courses.
Normally, we use the term APT for organized groups.
In banks, they use the term FIN.
We are talking about the same thing.
That is, there is money behind, an organized group, people with a salary, with a schedule, who have economic resources and who seek to do an important damage, whether it is economic, or against a control network, or against the activity, or against the corporate image.
From the point of view of the analysis of the campaigns, finding the tactics, techniques and procedures of the attackers helps us to find how they operate and what they do.
That is the important thing from our point of view.
As I was saying, this is the diamond model of the intrusion.
We have four vertices, opponent and victim, the upper vertices, infrastructure and capacity.
But with this model, we add what is called the technical metacharacteristics, but we also add a sociopolitical context and a technological context that link them.
As I was saying, it is important to know when an attack can come to you, at a given moment, key dates, which can be significant for a group, either in a sociocultural context, which can be key dates, such as the 11-S, etc.
You can take that moment when you know that maybe there are organized groups that may want to attack.
Then, in those days, you have to have a higher alert level because they will probably come to attack you.
In campaigns, especially in denial-of-service campaigns, the most common ones, orchestrated by the people of the activist groups.
We can also represent the action courses in this way, a very clear graph.
If there are different actions, different campaigns that are being orchestrated, at some point, if a human person analyzes how the operations are being carried out , you can see that in many cases patterns are repeated.
And when patterns are repeated, normally people who work in criminal justice tell you that if patterns are repeated because they are carried out by the same person or groups of people or that they can have connections between them.
So, if we have a connection between campaigns, there is probably a link between the agents who are behind them.
In the financial point of view, as I was saying, it is easier for a cybercriminal group to be executing it.
From the point of view of the defense of the States, the one behind that campaign is probably the same adversary.
The processing of the activity groups allows us to find the definition of the analytical problem, selection of the characteristics, creation, growth, analysis and redefinition.
MITRE has this model.
It centers to the left, as we said, proactive detection and to the right what would be the response to incidents, forensics and mitigation.
Ensuring the mission is to get the system to work from a reactive point of view, as we said, while the proactive part avoids you from getting in.
It is less visible, but it is more effective from a defensive point of view because you avoid getting in.
MITRE has developed this table that allows to characterize...
You probably can't see it well, but as I say, it is free, it is available.
You can enter its web portal and check it.
It allows a threat that you are characterizing and you are filling all those squares in the matrix.
In such a way that when you are analyzing what is happening, you are marking the squares according to each of the points that we have.
Here we have an example of carbon black and it has the ports defined.
I can see it well from here, but maybe you can't.
If there has been a type of attack, a type of exploitation, imagine that you are exploiting port 443, then you are putting all those data in the matrix that is available.
What advantage does it have?
Once you have managed to characterize the threat that you are receiving, you have a complete panel defined of what that type of threat does and you can present it to your bosses.
That is always an advantage.
Bosses generally don't usually have a technical vision of what is happening, but this type of thing helps to summarize it and expose it at an operational or strategic level.
And for them it is easier to understand concepts or words that they know more or less what it can be, but it is not necessary that they know the port in which it is being executed, nor how they have done it, nor if they use a type of function or another of the API.
They don't care about that, but they do know that it is working like this.
It helps you, as an analyst, to serialize what you are presenting.
That is to say, many times you have to make a report and make reports tedious and heavy.
In this way, you can take and have a pattern, a guide, of how to elaborate the reports.
And this method because it is becoming very useful to present threats in this way.
As we will see later, it is not only about scaling it within your organization, but also about sharing with other organizations.
If we all talk with a common system of sharing how a threat is characterized , then at another point, for example, imagine with Belgium, with France, with whoever, if we send them this pattern characterized in this way, as they also work it, they will be able to take advantage of it in a very easy way.
FireEye, another of the big ones in the sector, has its own vision of the cycle.
If you have seen the one of Mitre, it is flat.
They have put the loop and what they want is simply insist on persistence.
It is their way of representing.
There are not unique models.
Each one takes the one he likes the most.
There are people who prefer the one of FireEye.
I personally like the one of Mitre more, but it is not a bad model, especially because they insist on lateral movements that the other part is not so clear how to represent it.
When we want to characterize the threat, we have several sources.
As I was saying, there is a first phase, which is obtaining information from open sources.
That part requires work that can be automated with tools, that go directly to certain web portals, that get information.
But there is another part that requires a little more work because it will have to enter the dark web to interact with the people who work there.
And there is a moment when not everything can be a crawler that takes Beba and somehow by natural language gets information and puts it on a pretty web page.
There are moments when you need people who write.
So many times when people are interacting in a forum, they can be interacting with people from FBI, CIA, NSA or the Russian part that are really involved there to get an idea of what is there and they can get information that is valid for the first phase that they are detecting me,
they are doing a scan and I can get information from the campaigns.
if you get into forums like Anonymous, you can get how they interact between you in the group and you can get an idea of whether they are going to attack or not against the Ministry of Justice, for example.
So that kind of information you are getting you can give it in a previous alert.
Then, the next thing is Dartnet.
In this case, Dartnet refers to dark areas of a network inside your organization where services are used but the attackers usually use it to hide and then from there to make lateral attacks to pivot.
It is a very useful way to work.
From the defensive point of view, which is the part we work on, what you have to do is to place probes in those sub-networks or in those endpoints to get information and see if at some point there is a process running in memory, a commitment indicator,
a registration key , persistence.
This kind of things allow you to have a telemetry which is the next section to see the state of your networks.
Then, scan and index.
There are people who don't like running in memory, internal audits which include part of the pen testing.
I consider that the pen testing part to strengthen your own defenses .
What happens is that, from the white box to the black box, to the gray box, from the outside, from the inside, people are usually quite reluctant.
And more in industrial environments.
You tell someone in a nuclear plant that you want to do a pen testing of their plant and they will never say yes.
And that would help to find all the vulnerabilities there are and block them.
But the feeling that sometimes have of the pen testing going wrong and causing damage, that kind of information cannot be obtained.
Malware processing is another thing I have to do in my job.
I work as a malware analyst as well as a forensic analyst .
And that is what more information the enemies are giving you.
Not because I work on this, but because it is true.
I mean, you can look it up on the internet and it will come out.
If you can capture a sample that is being executed in your network, you are analyzing what is hitting you .
Not what is hitting you on the other side .
Right now, to any site you subscribe , you will receive threats bulletins , cyber threats .
I mean , I don't care if it is a bank, I don't care because it is not my business.
But I am interested, for example, if they are hitting other NATO countries.
Because the same bug that is coming to Belgium, to Mons, the NATO headquarters in Europe, it will probably come to me in a few hours.
Something that will be completely similar.
What they have, I don't care .
If they have been able to analyze it and send me the report, I don't have to analyze it.
Or the other way around.
If I receive it, I can scale it to the allied
countries .
I receive it , scale it to the allied countries.
the way around.
around .
As I was saying before, there are people who can sell you exploits, or there are people who can come and shake your hand because they can tell you that they know that they are doing something to you, that they have been in your network for two months,
and that kind of thing.
The human treatment should never be disdained as a source of information.
Well, the famous drawing of Elisabeth.
The dark web, in the case of governments, is usually the main source of information of what is happening.
But it should not be disdained that looking at the surface, sometimes a lot of things appear, because in places like this CoverFlow, a lot of source code appears, which can be reused, or github, which can be reused for malicious actions.
Maybe the person who hangs it there, hangs it with all the good intentions in the world, but it is clear that if you find an exploit on a website like github, which has no control of the people who enter and who leave, and the source code is there, you can take it,
analyze what is there, and you can mount a Frankenstein malware, which are all these malware samples that are made in pieces from one place to another, you compile it and you get it to work miraculously, you take it, distribute it and it works.
Obviously, this type of thing is easier to do if these portals are available, which in no case were done with bad intentions.
If, on the other hand, you want to resort to an exploit kit, it is clear that you will have to resort to the dark web.
You go to dark and remote places, which are not so remote, and for 35 or 40 dollars you can buy an exploit kit, which with a control panel allows you to configure a malware that you take and you can put a campaign and distribute it easily.
As I mentioned, this type of threat, which is simple for a large corporation, probably to mitigate in a given moment, is the one that hits mainly against small users.
You configure a few options of anti-debugging, anti-virtual machine, and with that kind of thing, luckily you can even jump defensive measures of non-classified networks of corporations.
That does not require much effort and can be used to mask a campaign in some cases.
As I was saying, there is not enough people or talent within large corporations dedicated to malware analysis, and in many cases you can resort to externalization and cybersecurity companies.
Normally, PIMEs cannot have specialized personnel in any case, and only large corporations can allow internal personnel.
And even so, as I was saying, there are many companies like Deloitte, S2, S21, that offer services at a fairly high price.
They allow you to have a SOC monitoring your networks and services of forensics, services of malware analysis, and for many companies it is worth having it within their own organization.
And as I was saying, they also get rid of the problem of looking for talent.
That is, the talent is concentrated in a few companies and the rest is subcontracted or tries to steal it from others.
As I was saying, malware analysis is of vital importance.
If the organization intends to take a step ahead of the threat,
we get a lot of bugs at work.
Many of what arrives can be generic.
Typical ransomware that anyone gets at home because it arrives in the same campaigns, either by email, and in those we do not even waste time.
Directly we see that it is like what is coming and it is removed.
But other samples arrive that are much more directed and we have had to analyze them.
After a job that can take you between two days to a week at least, you manage to strip all the bug between static behavior and dynamic behavior, you raise a report up and take the relevant measures, especially mitigation, to see which computers may have been infected,
which information may have been compromised.
A few days later, maybe a report from Palo Alto or similar companies appears in open sources that analyze a sample that is practically nailed to yours.
Maybe it does not have the same hash, but the functionality is the same and it is clear that it has been developed by the same group that has attacked you, but because it is very easy for an attacker to modify small details in the sample so that it is not exactly the same and thus avoid antiviruses,
because antiviruses work quite weakly.
That is, you take an antivirus and what you normally do is analyze only the file signature, analyze the hash and say, well, if I know it well and if not, I do nothing.
It is not known.
There are more parameters that can be analyzed, apart from the hash of a complete file, to determine if that file is bad or not.
And then, as in a series of these appearances, we will see how to find out if they are of the same family and if they are of the same family as the Daltons.
From the first to the fifth they are all bad.
In this case, you can see that there are reports very similar on the Internet to yours and that you have managed to have a few days before.
The companies that generally sell cyber intelligence, all this type of information, also when they publish it, they also limit what they offer.
Because I meet them at events and they tell you that maybe there are details that they omit because they are interested in selling a premium product to third parties or because for whatever reason they do not want to give the attacker the idea of how they have been able to get that type of information so that they do not take measures to cover it the next time.
So, well, because we had deeper reports than what they had put in public and in this case I was surprised that they had not reached some conclusions that we had reached.
When you had reached point C, reaching D and E, it was only to dedicate a little more time.
It must also be said that many times the bosses do not let you dedicate all the time in the world to the samples and at some point you have to stop.
But in this case I think it was because they did not decide to share it.
For those who are not very involved in malware analysis, there is something called compromise indicators, what you see there as the IOC, which is the characterization of a sample.
That is, if it has a command and control server, the IP to which it connects, if it uses certain functions of the Windows API, in this case it is a bug for Windows, the hashes, as we mentioned, the hash of the import table, that kind of things are all characteristics that make up an IOC.
You can develop tools that check if the IOCs that you are developing, check if there are more computers in your corporate network that are infected.
It is the grace of wasting time in developing an IOC.
That is, if I know that there is a bug that is generating a persistence key in the registry in a certain key, I do something that measures the key of the registry, to see if it is the new computer that I am analyzing, if it has that registry key, which for me is a clear and unique indicator that this computer is compromised.
If we put a lot of ANDs and ORs, or how we configure it, in a given moment what it gives us is a lower probability of false positive, then we would make an IOC that is effective for the organization.
Again, these IOCs gain their value when you share them with others, because you are obviously saving them time, in this case, from the technical part of implementing it, and they can directly look in their networks for the presence of that sample or a very similar one.
If you are not good at making compromise indicators, as I mentioned, we are going to have either false positives or false negatives, and it is almost worse remedy than the disease.
The disadvantages, as I said before, with the diamond.
Lack of context is not good.
You have to know why that sample, that IOC that they are giving you from a sample, is valid for you.
That is, for me, a bank one, as I said before, generally is not valid for me at all, it has no context.
If they tell me, take an IOC, what are they hitting with this?
If they do not tell me that they are hitting something that interests me, I probably do not have it.
Pass an IOC on a computer, just to give you an idea, a single IOC can take me maybe 15 or 20 minutes.
The basic idea of the IOCs, as I was saying, is sharing.
I will go to the final part of the presentation, so we are gaining time.
There are platforms like MISP, which is free, where people can set up collaborative portals, where people can share IOCs and descriptions of the threat, in such a way that if you set up a community of information sharing, with this type of platforms, you have an early warning system,
in which all the members of the community can take action based on what is happening to others.
In the specific case of the platform MISP, which is developed by the CEER of Luxembourg, it has the advantage that when you share, it allows you to choose what you share of that descriptor that you have generated.
So, if you generate a descriptor and you are not interested in sharing certain details with everyone, those details will not appear in what is shared, and you have kept it for yourself because maybe you are not interested in saying the number of devices that have been infected or whatever.
What is sometimes wrong with sharing?
Well, it is that small children do not share and the older ones less.
That is, many times people do not share everything they should, because they are not interested in exposing that their networks have been infected.
Why?
Because it is like saying that I do not have a good defensive system, they have deceived me, they have taken me by surprise, and people sometimes do not share everything they should, sometimes more at the theoretical level of sharing than at the practical level,
which is then being carried out 100%.
Maybe it is being done at 70% or 60%, it is shared, but probably it is not being shared everything that happens, because cyber exercises happen, people do not share everything they detect, in the real scenario it is even worse.
The idea of ​​integrating sources, as we mentioned before, allows us to have the best intelligence of the possible threat.
That is, if you only pull from a source, for example, as we mentioned, only open sources, only forums and such, you are going to have problems.
If you take and say, look, my organization has enough purchasing power to pay a company that sells me the feeds, which are information about threats that are happening.
There are companies, I will not say names because they do not pay me to advertise, which, as they are the big ones in the market, as they have 20,000, 30,000 clients distributed around the world, what they do is put their probes in these clients.
So, as I was saying, instead of having a free sharing platform only of malware events, they, for example, have corporate bank clients.
Then they sell you that part only.
Then you buy the corporate client part, for example, of a bank, and then you see, from Singapore to California, what is happening in all the banks.
If any of them receives an impact, you will be notified.
What I was telling you about the context.
That is, there are times when campaigns are focused only on Southeast Asia.
While it is true that most of the organizations can have headquarters distributed around the world, there are times when the attacks are focused, for example, on South Korea.
What happens in South Korea, everyone thinks it can be North Korea, the aggressor.
Well, North Korea, if it has no interest in Europe, it will not make that campaign spread.
Why?
To mitigate the possibility of detection.
That is, the more people you are hitting, more people will say that you are the kicker in the yard.
So, if you only focus on one, the action will be more focused.
I tell you that it depends a little bit on the scenarios, but for a big bank, for example, one of the big banks, which does have assets all over the world, knowing that they are hitting their branches in a certain part of the world, it can be worth it to be on the alert,
to take action, if it happens in Southeast Asia, in Latin America, which also has the advantage of time change, and with which it applies, with 6, 8, 10 hours of advantage, it can be applying mitigation measures.
Think about the stock market, which has a schedule that goes with the time of use.
Obviously, if they are hitting the stock market and there is an organized campaign, then I can take and move the action to the time of use and gain that advantage.
What intelligence has to provide is anticipation.
If it is not forensic analysis.
That is, when it has passed, it is forensic analysis.
It does not make sense.
What happens?
You can have a lot of money, but you can have a lot of cars.
You buy a garage like Cristiano Ronaldo's.
You have 12 cars in the garage.
But Cristiano Ronaldo, like any of us, can only drive one car at a time.
So he can have 12 cars, but he can only get one out.
The other 11 stay in the garage.
If we buy from 5, 6, 7 suppliers, what happens?
Half of the suppliers sell, I'm not going to say a lot, but almost.
That is, almost all have the same probes on.
And then what they sell practically to the end customer is the same product.
So if you have that clear, normally you only have one or two cyber threat suppliers.
That way you avoid overlapping the information.
Because if you have too many suppliers, you run the risk of infoxication.
You have too much information, you can't process it, you don't have enough people.
And in a given moment you verify that they overlap each other.
That is, they are selling you the same commitment indicator several times.
The normal thing in most organizations, as I said, is to have one or two source providers.
And you mix them with your internal ones, if you have the capacity.
The internal ones, as I said, are the ones that give more value to the organization.
But the external ones, as I said, in the case of a bank, you don't have to disdain them.
Because they are contextualized with your business environment.
We can move on to a more technical part.
When you start to receive, as I said, many malware samples.
And it is the one that has to analyze them.
We are not talking about buying them.
What you want in the end is to serialize a little.
Who can be behind this?
And how, in the end, you are going to have to include it in a campaign.
And that campaign is going to be orchestrated by an agent.
What interests you is, once you are analyzing a bug, that you don't know what it is, obviously, you don't know where it comes from.
But the moment you start to see a little bit the modus operandi of what it is doing.
And where it comes from, if it comes by mail, if it comes by USB.
It can give you an idea of ​​what is going on.
So what you have to do is try to serialize this type of information.
To try, in the end, to give a context to the threat.
If we can find the connections between those samples.
Like what happens in the movies.
Have you found a signature?
How about?
Really, more than a signature.
I was here.
Normally what you are going to find, as I said, methods of criminal investigation.
What you are going to find are patterns that allow you to know.
Because they use certain programming techniques.
Because they use certain types of techniques of attack.
That make you think that it is the same person, the same group of people who work in a team.
If you can find those links.
In the end, what it will allow you is to say.
Hey, look, it comes from the same person or group of people.
What they are doing, obviously, as I said before.
Is every 24, 48 hours they generate a new sample with a small difference.
In such a way that the perimeter defenses are not able to detect it.
Because what they do is generally look for the signature and little behavior.
As much as it is said that behavior is sought.
Normally behavior is not so easy to detect.
Once you have characterized the sample and everything it does.
You say, look, they can be from the same group of people.
Or, as I said, they have reused code that was available on the dark web.
And that your colleagues who work have detected.
Analyzing the networks.
That function that you are saying is specific.
You can buy those by modules.
You can be buying them.
And you really take away the possibility of attribution.
Everything that is available in the black market no longer has the facility of attribution.
Because it is only within the reach of the one who has money.
And according to the cost you have.
It will allow you to know if it is within the reach of a type of threat agent or another.
Methods are emerging that allow us to make big data representation.
When we have tens of thousands of samples in our personal collection.
And they allow us to make drawings as cool as these.
What does this mean?
This is from a real campaign.
This is from an APT1 campaign.
So, if we have three samples to analyze.
And their domains, as I mentioned, are jumping.
24, 48 hours.
This has been changed to the sample that has arrived.
It is different.
We have three samples.
We observe that they use common domain controllers.
We can conclude, probably without the possibility of being too wrong.
That the three samples are developed by the same group of people.
This, instead of doing it with three samples, we do it with 30,000.
We no longer do this by hand.
I do this by hand.
But not this.
This has to be done with a computer application that allows you to generate these graphs.
You take this.
You put all your sample set.
And in the end, what you conclude, and because you have to know how to interpret the graph, is that they are from the same group of people who have done it.
But they are two different campaigns.
The one that has a square shape is one campaign.
And the one that has a circle shape is another different campaign.
But the agents are the same.
That is, the interconnection that these nodes have, that we are seeing, is the basis of this.
That is, for you to know how the graph has been generated, it is from, for example, domain controllers that they have in common, we have been able to generate these graphs.
The ones above were connected with some, and the ones below were connected with others.
Shared code analysis.
What was being said about the Frankensteins.
You have a complete code, you have managed to have the sample, for example, the initial, and you see that there are functions, you are analyzing it with IDA, and you see that there are pieces that sound like other days.
And you say, you look at it and say, look, this here is that it has really been bought or not.
You see that there are things that are new.
Normally, if you want to go unnoticed, one of the techniques that is usually used as a malware developer programmer is to use, for example, the bugs for Windows, use the own PID of Windows.
Because, obviously, if I use something that is personal and done by me, if they hunt me and catch me the code in the computer of my house, those of the judicial police, obviously they are going to catch me.
While if I throw the PID of Windows, first, it is stealthy, it is authorized, I am using the system's properties, they do not attract attention.
So, what can you do?
If you do not find, only from fragments of the code that are different, you can look for ways to try to find that are similar, for example, in the call order of the functions, etc.
That is, there are different tricks to try to configure the percentage of code that is similar.
As I said, if you are an attacker, what you try is to maximize the gain that you are trying to do against small victims, what you are going to do is change four lines of code, in such a way that in an hour at most, or 20 minutes, you have a completely different sample and you start a new distribution campaign.
If you have to reprogram everything again, as you have seen all the time it takes to do one of these things, it no longer makes sense because you get more of your man-hour of work than what you are going to get with the campaign.
So, there will be samples that have a very high similarity and others that have a much lower similarity.
As I was saying, you start to see certain models.
The one that is getting the most out right now, the one with the most hits, is based on n-grams.
And in a very simple way, and with this we are going to finish the presentation, it allows us to see the coincidences between samples.
If we say that we have analyzed a sample and we characterize it with all those dots, which would be the commitment indicators that we would have configured.
And the sample B has all that set of dots.
We make a diagram of B and there is a small coincidence, or a big coincidence, as you want to see, that those samples have common elements.
If we make a mathematical calculation that we consider to be reliable, we make a function that allows us to analyze this, we can determine the degree of equality that these functions have.
So, as I said, there are models that allow to make this kind of comparisons and that give you an estimate of the degree of similarity it has.
Here we have a representation of the same thing.
I'm going to try with more samples, the pieces they share.
The similarity is represented in percentage from 0 to 100.
Normally the application will put it from 0 to 1, to make it a little less clear to the boss.
And with the Jakar index, which is the model I used for the presentation, the three characteristics of the similarity functions are fulfilled.
That is, they have a normalized value, understand perfectly how it works, because if he asks you how the model works, you can explain it, and empirically verify that it works.
That is, you have had to take before and validate your method.
In the end, you get a paper and you take it and present it, and your own method, Jakar's, works quite well.
Here we have another graph, which is the implementation of an example of the Jakar index method.
If we have two samples that have nothing in common, it would be the upper left quadrant, we have that they have nothing to do with each other, the commitment indicators, and we could say that they are not made by the same person, or that they are not from the same campaign,
or that they have changed the modus operandi.
The second, obviously, coincides in all the commitment indicators.
If you have not established the hash as a commitment indicator, it would still be the same sample.
That is, there are more ways than the hash to determine the commitment indicators, because that way we would have a very reliable commitment indicator that it is made by the same person, if you are lucky enough to catch two practically the same.
If we have one like the one below the left, the lower left corner, and they only have one common indicator, it is probably not made by the same person, because it has very little in common, and obviously, if someone implements a memory injection technique,
it probably uses the same function.
But that does not indicate that it is the same person, but simply that it is using the same method.
And then, as the sector below the right, you have four coincidences of a total of 10, a 40%, it may be and it may not.
Normally, the recommendation of the IACAR index is that it is taken when there is an 80% similarity.
It can be represented with tables.
As you can see, only the lower part of the table would be the values, or the lower part of the diagonal, or the upper part, that we could elaborate.
This would be similar to what we have talked about in Mitre, of how to present the threat.
And here, when we have it instead of 2 or 3, when we have it, it is like a beast.
Again, campaigns separated from the same agent on APT-1 received samples and it is showing us its different campaigns in a very easy way to observe for the human eye.
And well, with this, as I have already explained the final part in the period of the presentation, I will simply show you the screenshots of what is MIS.
MIS allows to identify with the threat through the agent, through the indicators and the campaigns.
Following this graph, you can define who is doing what.
You can follow the analysis of the campaign.
It uses sticks and taxi as protocols to define and exchange information.
And this is the last panel they have developed so you can see how complex it is to define a thing, because one thinks it is simple, but to fill in all this takes a while.
Sometimes it takes more than the time the campaign lasts.
But, as you have a history of campaigns, you can do what we have just seen in two transparencies before, that is, take and make an analysis of the similitude between them.
It is not the only option available.
Cortex is having a lot of trouble right now to characterize the threats.
It has a color code, everything is very visual, a graphic panel.
And, well, that's it.
We have a small round of questions.
I hope you enjoyed the presentation.
Good morning.
With all the capacity that the State theoretically has to prevent or reduce this type of attack, why is it not done like some people, people like White Hat,
a noise vector for attacks, are the domestic routers.
And there are known failures that could be mitigated directly by the State, as some White Hats have had them directly, created a patch, and regardless of the user's will, the owner of that router, patch that router.
Instead of waiting for someone to go to a Black Hat, or whatever they want to call it, take this router into account and use it to attack and make noise in the network, making other tasks difficult.
Why doesn't the State take on the role of White Hat, and some very simple and basic things, and execute them itself?
Lack of budget.
I think that answers perfectly, doesn't it?
In the end, human resources and economic resources are limited.
INCIBE, that organizes this event, I suppose that soon they will have this responsibility, or almost responsibility, but the ones in charge in Spain would not be the military, but it would be INCIBE's responsibility to give security to the citizen.
A second question?
May I?
Yes.
The attacker and the attacked are two sides of the same coin.
For example, Spain right now is selling weapons to Arabia to attack Yemen.
It is, in some way, looking for someone to go back against itself.
How does the State, or the army, deal with this kind of issue, where the attacker and the attacked are at the same time?
May I repeat the question?
I didn't understand it well.
For example, Spain...
Lower the microphone a little bit.
Spain right now is selling weapons to Arabia to attack Yemen.
Yes.
Yemen will feel attacked by Spain.
And it can come and re-attack Spain.
We will call it a terrorist attack, and they will call Spain a terrorist attack.
How does the army deal with this moral double?
They don't allow me to answer that question, but...
Another question, please, technical.
Yes, please.
Here, in the first row.
Hello, good morning.
Thank you for the presentation.
I was going to ask you, when...
I mean, how do you see where the criminals tend to go when they are closing, for example, with the last two markets that have been closed in the dark web?
What other methods do they use to communicate with each other?
I don't know.
I can't hear the questions.
I don't know if...
Tell me and I'll answer you.
With the markets that are on the web?
Yes.
And where do you see them going?
Okay, they ask me about the cybercriminals' trends on the dark web.
What happens is that they also change their methods.
Normally, the threat evolves, okay?
And you have to follow the evolution of the threat, okay?
So, the information in the statics is dynamic and they change their parameters.
So, if they have some trends and they see that you are stopping them, they evolve their tactics and change them, okay?
So, it is always easier to attack than to defend, because the one who attacks leads the initiative and you have to be reactive, no matter how much you try to have prior information, okay?
But they say that Windows is in fashion, so we attack Windows.
That Android is in fashion, so we go for Android.
That they have implemented a patch for this, so we go for something else, okay?
So, they always go ahead and work with information, that of unknown vulnerabilities, someone who implements exploits, that kind of thing, so you have to be aware of it.
They are not static.
If we had a static attack today, it would make little sense, because they are patched right away, okay?
So, obviously, they evolve, and those who are more avid do not put things out there on the AdWord.
It is true that, as I said, the lack of talent that states can have makes them leave traces on the AdWord, and you can be taking those crumbs and get an idea of what can come to you, okay?
But normally, when you want to find out, as we have explained with the graph, is that they are already inside, and what you have to do is analyze, and that is why I have a job as a forensic, what has happened, okay?
Any more questions?
Well, thank you very much for your attention.
A pleasure.