WEBVTT

1
00:00.000 --> 00:00.030 align:middle line:84%


2
00:00.030 --> 00:02.130 align:middle line:90%
Now, there are other
protocols out there

3
00:02.130 --> 00:04.560 align:middle line:90%
that leverage payloads
of data whenever

4
00:04.560 --> 00:07.590 align:middle line:90%
they're trying to do whatever
it is these protocols do.

5
00:07.590 --> 00:10.180 align:middle line:90%
And we can manipulate
those payloads of data.

6
00:10.180 --> 00:10.680 align:middle line:84%
Guess what.

7
00:10.680 --> 00:12.330 align:middle line:84%
Attackers can, too.

8
00:12.330 --> 00:14.550 align:middle line:90%
So when the attackers
receive or find

9
00:14.550 --> 00:17.320 align:middle line:90%
the data that they're looking
for in your environment,

10
00:17.320 --> 00:20.340 align:middle line:90%
they can use these text-based
protocols to just fire off

11
00:20.340 --> 00:23.070 align:middle line:90%
the data, even one
character at a time.

12
00:23.070 --> 00:25.290 align:middle line:90%
These are protocols
like ICMP, what

13
00:25.290 --> 00:29.795 align:middle line:90%
we use to send ping messages,
or NTP, Network Time Protocol.

14
00:29.795 --> 00:31.170 align:middle line:90%
So in this Nugget,
we're actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.795 --> 00:31.170 align:middle line:90%
So in this Nugget,
we're actually

15
00:31.170 --> 00:33.030 align:middle line:90%
going to explore a
script that I found

16
00:33.030 --> 00:37.770 align:middle line:90%
on GitHub that leverages the
ICMP protocol to exfiltrate

17
00:37.770 --> 00:39.255 align:middle line:84%
data one character at a time.

18
00:39.255 --> 00:43.530 align:middle line:90%
A really cool way that they can
attack us and exfiltrate data.

19
00:43.530 --> 00:46.020 align:middle line:90%
But be careful, you want
to monitor these things.

20
00:46.020 --> 00:48.900 align:middle line:90%
They're an indicator of
compromise at the same time.

21
00:48.900 --> 00:49.567 align:middle line:84%
Let's get going.

22
00:49.567 --> 00:50.983 align:middle line:90%
Now, look, I'm
going to be honest.

23
00:50.983 --> 00:53.490 align:middle line:90%
This is another one that kind
of blew my mind the first time

24
00:53.490 --> 00:55.380 align:middle line:90%
that I saw it, because
I didn't realize

25
00:55.380 --> 00:57.720 align:middle line:90%
that we could manipulate
the protocols these ways.

26
00:57.720 --> 01:00.000 align:middle line:84%
But hackers absolutely can.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:00.000 --> 01:02.430 align:middle line:90%
There are protocols
that are sending data

28
01:02.430 --> 01:06.100 align:middle line:90%
across the wire just
using ASCII level text.

29
01:06.100 --> 01:08.730 align:middle line:90%
And these are protocols that
we can change on the fly

30
01:08.730 --> 01:10.680 align:middle line:84%
and use it to exfiltrate data.

31
01:10.680 --> 01:13.770 align:middle line:90%
Just the same way that we
could exfiltrate DNS data

32
01:13.770 --> 01:17.070 align:middle line:90%
by using a base64 encoding,
and then just sending

33
01:17.070 --> 01:20.610 align:middle line:90%
a query for that message, we
can leverage similar protocols,

34
01:20.610 --> 01:24.720 align:middle line:90%
like NTP, to send messages using
the exact same exfiltration

35
01:24.720 --> 01:25.590 align:middle line:84%
technique there.

36
01:25.590 --> 01:30.180 align:middle line:90%
Or we could even use the most
classic protocol of all, ICMP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:25.590 --> 01:30.180 align:middle line:90%
Or we could even use the most
classic protocol of all, ICMP,

37
01:30.180 --> 01:31.440 align:middle line:84%
to send ping requests.

38
01:31.440 --> 01:32.430 align:middle line:84%
Check this out.

39
01:32.430 --> 01:34.140 align:middle line:90%
If I bring up my
Wireshark capture here,

40
01:34.140 --> 01:36.900 align:middle line:90%
you can see I've initiated
four basic ping requests.

41
01:36.900 --> 01:39.118 align:middle line:84%
Look at the payload right there.

42
01:39.118 --> 01:39.660 align:middle line:84%
Look at that.

43
01:39.660 --> 01:40.350 align:middle line:84%
What is this?

44
01:40.350 --> 01:43.170 align:middle line:90%
This is nothing more than just
the alphabet, a string of text.

45
01:43.170 --> 01:46.600 align:middle line:90%
And you can absolutely
change this protocol.

46
01:46.600 --> 01:49.890 align:middle line:90%
You could actually absolutely
change this payload of data

47
01:49.890 --> 01:54.450 align:middle line:90%
to send something like that
base64 encoded username

48
01:54.450 --> 01:57.930 align:middle line:90%
and password so long as it
doesn't violate any links

49
01:57.930 --> 01:59.190 align:middle line:84%
or MTUs along the path.

50
01:59.190 --> 02:01.210 align:middle line:90%
Of course, you could
fragment it along the way,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:59.190 --> 02:01.210 align:middle line:90%
Of course, you could
fragment it along the way,

51
02:01.210 --> 02:03.250 align:middle line:90%
but if there is a don't
fragment bit sent, well,

52
02:03.250 --> 02:05.583 align:middle line:90%
then you're not going to be
able to exfiltrate the data.

53
02:05.583 --> 02:08.639 align:middle line:90%
But the point is that we can
change this payload right here

54
02:08.639 --> 02:09.505 align:middle line:84%
on the fly.

55
02:09.505 --> 02:11.130 align:middle line:90%
And one of the cool
things that I found

56
02:11.130 --> 02:12.690 align:middle line:90%
is there's actually
scripts out there

57
02:12.690 --> 02:14.860 align:middle line:90%
publicly available
on GitHub that

58
02:14.860 --> 02:16.110 align:middle line:84%
walk you through how to do it.

59
02:16.110 --> 02:16.780 align:middle line:84%
Check this out.

60
02:16.780 --> 02:18.300 align:middle line:84%
I'll bring it up right now.

61
02:18.300 --> 02:21.150 align:middle line:90%
This I found, this
little sample code.

62
02:21.150 --> 02:23.430 align:middle line:90%
You can see it right
here on this URL.

63
02:23.430 --> 02:26.820 align:middle line:90%
This is the GitHub
repository of martinoj2009.

64
02:26.820 --> 02:30.330 align:middle line:90%
And he's got a little script
here called ICMPExfil.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:26.820 --> 02:30.330 align:middle line:90%
And he's got a little script
here called ICMPExfil.

65
02:30.330 --> 02:33.180 align:middle line:90%
Now, the script that I'm focused
on right here is the ping.

66
02:33.180 --> 02:35.790 align:middle line:90%
He's also got another script
in this repository, which

67
02:35.790 --> 02:38.730 align:middle line:90%
is how the server actually
handles the response as it's

68
02:38.730 --> 02:39.490 align:middle line:84%
coming in.

69
02:39.490 --> 02:40.750 align:middle line:84%
This is a Python script.

70
02:40.750 --> 02:42.360 align:middle line:90%
And again, hackers
can absolutely

71
02:42.360 --> 02:44.760 align:middle line:90%
run malicious scripts
whenever they want.

72
02:44.760 --> 02:48.600 align:middle line:90%
The idea is that it
runs the ping.py script,

73
02:48.600 --> 02:52.590 align:middle line:90%
but it passes in variables, or
arguments, as they're called.

74
02:52.590 --> 02:54.090 align:middle line:90%
And these arguments
are going to be

75
02:54.090 --> 02:57.030 align:middle line:90%
things like the username
or the password.

76
02:57.030 --> 02:59.800 align:middle line:90%
And they might be
base64 encoded.

77
02:59.800 --> 03:02.370 align:middle line:90%
Whatever the case is,
they simply run the script
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.800 --> 03:02.370 align:middle line:90%
Whatever the case is,
they simply run the script

78
03:02.370 --> 03:04.360 align:middle line:90%
and provide the
additional information.

79
03:04.360 --> 03:06.720 align:middle line:90%
And all of this can be
done in the background

80
03:06.720 --> 03:10.030 align:middle line:90%
unbeknownst to you, or the
end users who are watching.

81
03:10.030 --> 03:12.220 align:middle line:90%
So if I make it all the
way down to the bottom,

82
03:12.220 --> 03:13.800 align:middle line:90%
you can see right
here it's running

83
03:13.800 --> 03:19.140 align:middle line:90%
the subprocess call, a count of
one ping, to this destination.

84
03:19.140 --> 03:23.160 align:middle line:90%
And it sends that payload
for every line in the data.

85
03:23.160 --> 03:25.020 align:middle line:90%
And for every
character in the line,

86
03:25.020 --> 03:29.340 align:middle line:90%
it sends that ping one line at
a time, one character at a time.

87
03:29.340 --> 03:31.660 align:middle line:90%
Now, above this, all the
stuff that's going on here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.340 --> 03:31.660 align:middle line:90%
Now, above this, all the
stuff that's going on here

88
03:31.660 --> 03:33.960 align:middle line:90%
is this is just how it's
handling the data that it's

89
03:33.960 --> 03:35.430 align:middle line:84%
trying to exfiltrate.

90
03:35.430 --> 03:37.950 align:middle line:90%
It does have to be
encoded in ASCII text.

91
03:37.950 --> 03:39.420 align:middle line:84%
It does have to be plaintext.

92
03:39.420 --> 03:41.680 align:middle line:90%
And it has to be written
in a specific way.

93
03:41.680 --> 03:43.202 align:middle line:90%
So all of this
handling code here

94
03:43.202 --> 03:44.910 align:middle line:90%
is just making sure
that the payload will

95
03:44.910 --> 03:49.350 align:middle line:90%
be accessible and usable both
by the ICMP protocol, as well as

96
03:49.350 --> 03:51.032 align:middle line:84%
the server that's receiving it.

97
03:51.032 --> 03:52.740 align:middle line:90%
But the idea is I just
wanted to show you

98
03:52.740 --> 03:55.200 align:middle line:90%
the script, that the script
actually exists out there

99
03:55.200 --> 03:59.370 align:middle line:90%
on GitHub right now showing
you how people can use the ICMP

100
03:59.370 --> 04:02.340 align:middle line:90%
protocol to send one
character at a time
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.370 --> 04:02.340 align:middle line:90%
protocol to send one
character at a time

101
04:02.340 --> 04:05.940 align:middle line:90%
to exfiltrate data that they
care about using the ICMP

102
04:05.940 --> 04:07.030 align:middle line:84%
protocol.

103
04:07.030 --> 04:09.870 align:middle line:90%
So the big takeaway here
is that just keep in mind

104
04:09.870 --> 04:13.470 align:middle line:90%
that any protocol that has
any sort of text-based payload

105
04:13.470 --> 04:16.589 align:middle line:90%
might be able to be
manipulated by a hacker

106
04:16.589 --> 04:18.579 align:middle line:90%
that they can use to
exfiltrate the data.

107
04:18.579 --> 04:21.000 align:middle line:90%
Maybe that data is
ASCII encoded, or base64

108
04:21.000 --> 04:22.089 align:middle line:84%
encoded, or whatever.

109
04:22.089 --> 04:23.850 align:middle line:90%
But even the most
basic protocols,

110
04:23.850 --> 04:27.630 align:middle line:90%
like ICMP, or Network
Time Protocol, NTP,

111
04:27.630 --> 04:31.450 align:middle line:90%
can be manipulated and used
to exfiltrate sensitive data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:27.630 --> 04:31.450 align:middle line:90%
can be manipulated and used
to exfiltrate sensitive data.

112
04:31.450 --> 04:33.540 align:middle line:90%
Whether it's coming from
your database, files,

113
04:33.540 --> 04:35.370 align:middle line:90%
or key loggers,
whatever the case,

114
04:35.370 --> 04:39.460 align:middle line:90%
hackers can find a way in, and
then they can find a way out.

115
04:39.460 --> 04:42.032 align:middle line:90%
So that's been understanding
how data can be exfiltrated.

116
04:42.032 --> 04:43.740 align:middle line:90%
I hope this has been
informative for you.

117
04:43.740 --> 04:46.160 align:middle line:90%
And I'd like to thank
you for viewing.