Darktrace Blog

Perspectives on cyber defense

How a cloud server nearly released IP at a major manufacturing company

Andrew Tsonchev, Director of Cyber Analysis | Monday September 18, 2017

4 million customers had their information exposed in the Time Warner compromise. In the Verizon breach, that number rose to 14 million. Third-party cloud vulnerabilities were responsible for both.

Signature-based security tools consistently fail to detect cloud-based threats like these, which are often subtle and unique from threats found on the physical network.

At a leading manufacturing company in Europe, Darktrace detected a similar cloud vulnerability, only instead of customer data at risk, it was sensitive intellectual property.

The company was using a third-party cloud server to store files containing product details and sales projections. The files on the server and the root IP were gated with a username and password.

After entering their credentials, however, the files contained on the server were left unencrypted. Darktrace detected this vulnerability when a device downloaded a ZIP file from a rare external IP address that Darktrace deemed highly anomalous compared to the device’s normal behavior.

94:65:9c:a6:XX:XX made an HTTP connection to XX[.]23.0.23 on TCP port 80

Source: 10.84.16.50
Destination: 10.3.0.1
Destination Port: 8080
Path: hxxp://XX.23.0[.]23/dl/ntt_download.php?key=DLNT57fe6b54[PARTLY REDACTED]

Ordinarily, this activity would indicate unauthorized content entering the network, but in this case, the anomaly revealed a critical security flaw. Darktrace’s AI algorithms and mathematical models immediately recognized this activity as a deviation from the device’s normal ‘pattern of life’.

Upon investigation of the anomaly, it was discovered that the ZIP file wasn’t access restricted. In other words, anybody could have downloaded the ZIP file if they knew the URL, which could have been obtained by simply intercepting network traffic, either internally or externally. More dedicated attackers could have even brute-forced the file ‘key’ parameter of the URL.

The files in question included product specs, market research, and other sensitive data. The loss or leakage of such information could have placed the entire product line at risk.

A sample of the file names in the ZIP file included:

2016-09-30 - [REDACTED] - Spectral Reconstruction and Measurement.docx
2016-09-30 - [REDACTED] - Brightness analysis.docx
2016-09-30 - Coverage on validation cards - Statistical analysis.xlsx

By reporting this incident as soon as it was detected, the company prevented the loss of valuable intellectual property and internal documents. Darktrace assisted the security team in revising their data storage practices in order to better protect their product information moving forward.

Too often, subtle anomalies like these are obscured by the cloud or lost in the noise of the network. Traditional security tools tend to have limited visibility of cloud activity, and even then, they only look for known threats. This vulnerability was unique and would have gone undetected by signature-based controls.

To learn more about the threats Darktrace finds, download our 2017 Global Threat Report which details the nine most interesting threats we’ve found in 2017, including an incident where IoT drawing pads were co-opted into a large-scale DDoS attack.

How Darktrace’s AI detects metamorphic malware

Justin Fier, Director of Cyber Intelligence & Analytics | Monday July 31, 2017

Some of the most insidious threats that Darktrace finds use self-modifying technology to hide their presence on the network. These attacks can dynamically change their threat signatures, automatically extract data, and spread without a human controller.

Recently, we discovered anomalous activity on the network of a major US university. After investigation, we found that the anomaly was the ‘Smoke Malware Loader’ which employs numerous techniques to evade internal security. Most notably, the malware generates fake traffic to hide its presence.

Darktrace observed the initial infection when three anomalous executables were transferred over plain text. The malware did not match any known threat signatures, allowing it to bypass the network’s perimeter controls.

C1ulyq1wLrMBs6LG00 on Thu Sep 8, 13:19:01
Co2eAJ2GifEkWut700 on Thu Sep 8, 12:09:52
CdcZeu200UOsuf5u00 on Wed Sep 14, 16:38:44

The connections originated from a suspicious external domain that the company had never communicated with before:

lago666[.]com (91.243.193.149)

Both the anomalous download and the beaconing activity represented major deviations from the unique ‘pattern of life’ learned by the Enterprise Immune System.

Although the payload circumvented the network’s perimeter security, the company also had an alternate security system monitoring network flow. This tool raised an alert when the download occurred, but it was deemed a ‘false positive’ because the malware proceeded to install new, previously unknown versions of the executable to the Windows registry.

After the self-modifying modules were uploaded to the company device, a large number of HTTP POST requests were sent against /smk/log.php to the following domains:

lago666[.]com
lago666[.]xyz
lago666[.]pw
lago666[.]top
lago666[.]site
lago666[.]bid
www.lago666[.]website
lago666[.]online
www.lago666[.]space
lago666[.]website
lago666[.]space
www.lago666[.]online
lago666[.]trade
lago666[.]webcam
lago666[.]tech
lago666[.]host
lago666[.]press

The malware attempted to transfer data to these external destinations, but to hide its tracks, the remote machine replied with a fake 404 error code. These connections were deemed highly anomalous by Darktrace’s AI algorithms.

Since the payload was designed to be compatible with the password grabber module2 – which is often deployed side-by-side with Smoke Malware Loader – the data attempting to leave the network likely contained user credentials and passwords.

In conjunction with the initial transfer, another anomalous file was then delivered to a different device. This activity indicated that the threat actor was likely attempting to move laterally across the network:

hxxp://cdn.che[.]moe/izgmcx.exe (connection UID: CGH6uV3G5tdKSNY800) to 10.1.105.117 on Mon Sep 12 at 08:02:03.

Darktrace detected each anomaly in real time as the situation developed. By using AI algorithms to continuously learn normal behavior, Darktrace was able to monitor the malware’s changing threat signature.

Traditional security tools – no matter how advanced – are incapable of detecting such sophisticated threats. Legacy controls rely on rules and signatures, and these threats are specifically designed to bypass rules and signatures.

Darktrace’s real-time threat detection allowed the university’s security team to quarantine the infected devices before the malware could burrow deeper into the network, and before the attacker could use the passwords to further compromise the network. Darktrace then assisted the security team as they remediated the situation and changed their security protocols and passwords.

Darktrace’s perspective on the NotPetya attack

Dave Palmer, Director of Technology | Thursday June 29, 2017

The ‘ransomware’ attack sweeping the globe is yet another demonstration of the decreasing usefulness of the traditional cyber defense approaches. Businesses cannot rely on patching vulnerabilities fast enough, and a NotPetya patch would only protect you against yesterday’s attack but will not be able to stop tomorrow’s.

An interesting difference to last month’s WannaCry attack is that it could spread from victim to new victim directly over the internet. Whilst this one can also spread quickly within organizations, Petya (or NotPetya) has not spread across the internet. The good news is that if you haven’t been affected yet, it is unlikely you will be.

At first glance, this might look like conventional ransomware, but it has emerged that the system for paying the criminals and decrypting data doesn’t work. This means that regardless of whether monetization was the original motive or not, it will feel like sabotage from the victims’ perspective.

Questions regarding whether the attack was a targeted one or not are in this case legitimate, as the initial deployment was via poisoning legitimate accountancy software heavily used in Ukraine and Ukrainian city websites. A majority of businesses affected would have been operating in the Ukraine area, or connected to them via their supply chain.

How many more warnings do we need that relying on stopping attacks seen in the past just isn’t enough? The latest advances in AI mean that autonomous technology can now detect and fight back against any in-progress threats within a company network, buying the security teams time to investigate.

In our tests, Darktrace has confirmed the ability to autonomously respond to NotPetya, neutralizing the threat in seconds. Enterprise Immune System technology works because it doesn’t rely on rules or signatures. It takes defensive action before humans have time to react, and is the only realistic way that security teams will scale to the increased speed and diversity of future attacks.

Every rule has an exception: How to detect insider threat without rules

Andrew Tsonchev, Director of Cyber Analysis | Wednesday June 21, 2017

Typically, security controls have to predefine ‘good’ and ‘bad’ behavior, but this approach inevitably leaves room for people to circumvent those rules, intentionally or otherwise. This is especially problematic when it comes to establishing rules for insiders. Too restrictive, and their workflow is impeded. Too laissez-fair, and they open themselves up to easily preventable threats.

For instance, to prevent anomalous RDP connections – either inbound or outbound – traditional security tools like firewalls often predefine which destination ports to allow and which ports to restrict. However, if an employee were to use a destination port not explicitly restricted by the firewall, they could theoretically exfiltrate data out of the network without raising any alerts.

After installing on the corporate network of a large manufacturing company, our AI technology recently spotted a rogue device making RDP connections to a rare external host that should have been blocked by the firewall.

10.230.102.143 · 00:23:18:28:3d:8c made 2 RDP connections to 100% rare external host mail.klaxcar[.]com

The company’s firewall was configured to prevent outbound RDP connections, but the rule was overly simplistic and was defined by destination port. By changing the port in use, the connections were allowed to continue.

Time: 2017-03-23 14:44:57 [UTC]
Protocol: RDP
Source: 10.230.102.143
Destination: 217.109.48.125
Destination Port: 30005

No other devices in the network had been observed connecting to that host. The activity represented a major deviation from the pattern of normality built by Darktrace’s AI algorithms. The connections lasted over ten minutes and involved the download of nearly 4MB of data.

10.230.102.143 was first seen on the network on 2017-03-23.
Total duration: 10 mins 34 secs
Total upload: 0.19 MB
Total download: 3.77 MB

Darktrace Antigena determined this activity was threatening enough to require an immediate response. It triggered an autonomous response that blocked all outgoing traffic from the device for 10 minutes, giving the security team time to identify the rogue device and stop the RDP activities.

Upon investigation, it became clear that an employee had connected their personal device to the corporate network and was attempting to send valuable intellectual property to a foreign party. The external host happened to be associated with a competing manufacturing company.

It may be tempting to conclude that the company simply needed a better firewall, but that misses the point. Legacy tools – no matter how expensive – still rely on rules, and every rule has an exception. Of course, firewalls are still an essential part of modern cyber security, but organizations need to accept that cyber-threats will always find a way around these tools.

At Darktrace, our technology doesn’t make any assumptions about maliciousness. It uses advanced machine learning and AI algorithms to learn ‘normal’ for every user and device on a network. When a threatening deviation arises, Darktrace neutralizes the threat in real time. While some of these anomalies get stopped by firewalls and other rules-based tools, subtle insider threats like these frequently go undetected.

To learn more about the threats Darktrace finds, check out our Darktrace Global Threat Case Studies Report 2016 which tells the story of how a hacker compromised the video conferencing unit in the executive boardroom.

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. With over 10 years of experience in cyber defense, Fier has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Fier is a highly-skilled technical officer, and a specialist in cyber operations across both offensive and defensive arenas.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew Tsonchev is a technical specialist in cyber security and threat analysis, advising Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning, and automated response. Before joining Darktrace, Andrew worked as a Security Researcher at Cisco Systems, analyzing vast data sets to uncover new trends and developments in the threat landscape. His findings have been widely reported in leading media outlets, including PC World, CRN, SecurityWeek, TripWire, and the New York Times. He holds a first-class degree in physics from Oxford University, and a first-class degree in philosophy from King’s College London.

English Français 日本語