WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.850 align:middle line:90%
Arguably the most basic
exfiltration technique

3
00:02.850 --> 00:05.430 align:middle line:90%
that there is is to dump
the data into a file,

4
00:05.430 --> 00:06.455 align:middle line:84%
and send it outbound.

5
00:06.455 --> 00:07.080 align:middle line:84%
But guess what.

6
00:07.080 --> 00:10.170 align:middle line:90%
That's also the most common
exfiltration technique.

7
00:10.170 --> 00:12.060 align:middle line:90%
And we kind of talked
about this a little bit

8
00:12.060 --> 00:14.550 align:middle line:90%
when we talked about
indicators of compromise.

9
00:14.550 --> 00:17.430 align:middle line:90%
Look at that outbound traffic
as it's going outbound.

10
00:17.430 --> 00:19.620 align:middle line:90%
Do we normally
send 1 gig of data

11
00:19.620 --> 00:22.597 align:middle line:90%
outbound, but last night we
sent 100 gigs of data outbound?

12
00:22.597 --> 00:24.180 align:middle line:90%
That's what we've
got to look out for.

13
00:24.180 --> 00:26.430 align:middle line:90%
So in this Nugget what we're
going to be talking about

14
00:26.430 --> 00:28.560 align:middle line:90%
is how email and
FTP services can

15
00:28.560 --> 00:32.790 align:middle line:90%
be used against us to exfiltrate
our data outbound via that way.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.560 --> 00:32.790 align:middle line:90%
be used against us to exfiltrate
our data outbound via that way.

16
00:32.790 --> 00:36.510 align:middle line:90%
File exfiltration seems like
another kind of obvious one.

17
00:36.510 --> 00:39.120 align:middle line:90%
In many different ways, it
is kind of an obvious one.

18
00:39.120 --> 00:42.690 align:middle line:90%
I mean, this is going to be
the easiest path for a hacker

19
00:42.690 --> 00:44.460 align:middle line:90%
in order to
exfiltrate your data.

20
00:44.460 --> 00:47.730 align:middle line:90%
There's no manipulating
DNS, or creating an HTTP

21
00:47.730 --> 00:48.750 align:middle line:84%
server at this point.

22
00:48.750 --> 00:50.490 align:middle line:90%
It's literally just,
oh, there's a file.

23
00:50.490 --> 00:51.370 align:middle line:84%
I'm going to take the file.

24
00:51.370 --> 00:52.245 align:middle line:84%
That's the end of it.

25
00:52.245 --> 00:54.780 align:middle line:90%
So let's talk about
how file exfiltration

26
00:54.780 --> 00:58.128 align:middle line:90%
could really be used against
you in a real world scenario.

27
00:58.128 --> 00:59.670 align:middle line:90%
What we're talking
about in this case

28
00:59.670 --> 01:03.100 align:middle line:90%
is the end user, one more time,
has taken over Bob's computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.670 --> 01:03.100 align:middle line:90%
is the end user, one more time,
has taken over Bob's computer.

29
01:03.100 --> 01:05.670 align:middle line:90%
Bob is getting in a
whole lot of trouble

30
01:05.670 --> 01:07.560 align:middle line:90%
these days, because
they just keep

31
01:07.560 --> 01:09.930 align:middle line:90%
on clicking on links that
they shouldn't click on,

32
01:09.930 --> 01:12.247 align:middle line:90%
or maybe they installed
some Chrome extension

33
01:12.247 --> 01:13.080 align:middle line:84%
they shouldn't have.

34
01:13.080 --> 01:14.170 align:middle line:84%
You get the idea.

35
01:14.170 --> 01:16.740 align:middle line:90%
So what Bob's malware
is doing this time

36
01:16.740 --> 01:19.950 align:middle line:90%
is it is now looking
for not only a database,

37
01:19.950 --> 01:22.200 align:middle line:84%
but also a file share.

38
01:22.200 --> 01:25.980 align:middle line:90%
And this could come in the
form of a mapped drive that

39
01:25.980 --> 01:27.870 align:middle line:84%
was applied via GPO.

40
01:27.870 --> 01:31.080 align:middle line:90%
I mean, that's a really
easy way for hackers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:27.870 --> 01:31.080 align:middle line:90%
I mean, that's a really
easy way for hackers

41
01:31.080 --> 01:32.850 align:middle line:90%
to find their way
throughout the network,

42
01:32.850 --> 01:35.475 align:middle line:90%
because they could look at what
are the drives that are already

43
01:35.475 --> 01:37.950 align:middle line:90%
associated to it that they
learn when they boot up.

44
01:37.950 --> 01:39.775 align:middle line:90%
They get through
the GPO process.

45
01:39.775 --> 01:42.400 align:middle line:90%
Next thing they know they've got
a file share attached to them.

46
01:42.400 --> 01:44.783 align:middle line:90%
So they find their way
into the file share.

47
01:44.783 --> 01:46.950 align:middle line:90%
Maybe it's because of the
shared folder or whatever.

48
01:46.950 --> 01:48.900 align:middle line:84%
And they just start trying.

49
01:48.900 --> 01:51.180 align:middle line:90%
They start trying
to explore what

50
01:51.180 --> 01:53.580 align:middle line:90%
are all of the different
folders, and files,

51
01:53.580 --> 01:56.170 align:middle line:90%
and structures that I can
access from this point.

52
01:56.170 --> 01:59.250 align:middle line:90%
So if Bob were to have a
file share map to them that

53
01:59.250 --> 02:02.730 align:middle line:90%
was the accounting file
share, or the HR file share,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.250 --> 02:02.730 align:middle line:90%
was the accounting file
share, or the HR file share,

54
02:02.730 --> 02:05.190 align:middle line:90%
or the IT file share,
because-- let's be honest--

55
02:05.190 --> 02:07.410 align:middle line:90%
there are plenty of
IT shops out there

56
02:07.410 --> 02:09.570 align:middle line:90%
that keep all their
usernames and passwords

57
02:09.570 --> 02:13.000 align:middle line:90%
in an Excel file on a file share
that multiple users have access

58
02:13.000 --> 02:13.500 align:middle line:84%
to.

59
02:13.500 --> 02:15.510 align:middle line:90%
It just happens, and
it's sad, but it does.

60
02:15.510 --> 02:18.570 align:middle line:90%
Now the malware is scanning
through this entire file share,

61
02:18.570 --> 02:20.760 align:middle line:90%
trying to access each
one of these folders,

62
02:20.760 --> 02:24.060 align:middle line:90%
and each one of these files,
trying to see what they can do.

63
02:24.060 --> 02:25.530 align:middle line:90%
Beyond that, the
same thing still

64
02:25.530 --> 02:27.960 align:middle line:90%
applies about the
SQL server database.

65
02:27.960 --> 02:30.930 align:middle line:90%
Maybe Bob has direct
access to the SQL server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:27.960 --> 02:30.930 align:middle line:90%
Maybe Bob has direct
access to the SQL server,

66
02:30.930 --> 02:35.040 align:middle line:90%
or maybe Bob has an app
installed on his computer that

67
02:35.040 --> 02:37.170 align:middle line:84%
writes data to the SQL server.

68
02:37.170 --> 02:40.960 align:middle line:90%
One way or another, Bob's
computer has access to it.

69
02:40.960 --> 02:43.165 align:middle line:90%
So in the file share
scenario, there's files.

70
02:43.165 --> 02:44.790 align:middle line:90%
They're just sitting
there, and they're

71
02:44.790 --> 02:46.320 align:middle line:84%
waiting to be exfiltrated.

72
02:46.320 --> 02:50.250 align:middle line:90%
In the database scenario, we
may be running SELECT queries

73
02:50.250 --> 02:52.410 align:middle line:90%
to pull the data
out of the database,

74
02:52.410 --> 02:56.820 align:middle line:90%
and then write them to a
CSV file, or an Excel file.

75
02:56.820 --> 02:58.920 align:middle line:90%
At this point,
all the hacker has

76
02:58.920 --> 03:02.170 align:middle line:90%
to do is have a place
to send the file.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:58.920 --> 03:02.170 align:middle line:90%
to do is have a place
to send the file.

77
03:02.170 --> 03:07.320 align:middle line:90%
This could be an FTP
server, or an FTPS server,

78
03:07.320 --> 03:11.130 align:middle line:90%
or an SFTP server-- yes, those
are three different protocols--

79
03:11.130 --> 03:15.930 align:middle line:90%
an SCP server, a peer-to-peer
file sharing site,

80
03:15.930 --> 03:19.950 align:middle line:90%
or it could even leverage
good old-fashioned email.

81
03:19.950 --> 03:24.600 align:middle line:90%
You can absolutely script the
sending of files via email

82
03:24.600 --> 03:29.020 align:middle line:90%
using Python, or PowerShell, or
any other scripting language.

83
03:29.020 --> 03:32.460 align:middle line:90%
So the hacker could potentially
create a temporary folder,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:29.020 --> 03:32.460 align:middle line:90%
So the hacker could potentially
create a temporary folder,

84
03:32.460 --> 03:35.130 align:middle line:90%
copy all of the files
into that folder,

85
03:35.130 --> 03:38.730 align:middle line:90%
then execute a Python
script that iterates over

86
03:38.730 --> 03:43.020 align:middle line:90%
each file in that folder, and
sends it to an FTP server,

87
03:43.020 --> 03:45.280 align:middle line:84%
or to an email address.

88
03:45.280 --> 03:48.640 align:middle line:90%
Again, this all goes back
to indicators of compromise.

89
03:48.640 --> 03:51.840 align:middle line:90%
We need to be looking for
things that seem abnormal

90
03:51.840 --> 03:55.020 align:middle line:90%
on our next gen firewall,
or monitoring solution,

91
03:55.020 --> 03:58.080 align:middle line:90%
or AMP for Endpoints
needs to be looking

92
03:58.080 --> 04:00.870 align:middle line:90%
for all of these executions,
these weird signatures,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:58.080 --> 04:00.870 align:middle line:90%
for all of these executions,
these weird signatures,

93
04:00.870 --> 04:03.660 align:middle line:90%
or these anomalies that
are happening directly

94
04:03.660 --> 04:04.650 align:middle line:84%
on the computers.

95
04:04.650 --> 04:07.500 align:middle line:90%
So that's been how files
can be used to exfiltrate

96
04:07.500 --> 04:09.032 align:middle line:84%
our data and our information.

97
04:09.032 --> 04:10.740 align:middle line:90%
I hope this has been
informative for you.

98
04:10.740 --> 04:13.280 align:middle line:90%
And I'd like to thank
you for viewing.