Microsoft SolarWinds analysis: Attackers hid inside Windows systems by wearing the skins of legit processes
- Reference: 1611248337
- News link: https://www.theregister.co.uk/2021/01/21/microsoft_solarwinds_deep_dive/
- Source link:
Microsoft's deep dive, published yesterday following SolarWinds' own take on the malware, [1]repeated earlier findings that the hackers went to unusual lengths to disguise their intrusion and avoid detection.
[2]
Specifically, the compromised DLL file was quietly deployed onto targeted systems by mimicking legitimate file names – and the attackers worked between 8am and 5pm to increase the odds of not being spotted.
Micros~1 summarised its findings in a [3]blog post by saying:
[4]
Each Cobalt Strike DLL implant was prepared to be unique per machine and avoided at any cost overlap and reuse of folder name, file name, export function names, C2 domain/IP, HTTP requests, timestamp, file metadata, config, and child process launched. This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files.
It continued: "Applying this level of permutations for each individual compromised machine is an incredible effort normally not seen with other adversaries and done to prevent full identification of all compromised assets inside a network or effective sharing of threat intel between victims."
Much of the infosec commentary around the SolarWinds supply chain attack has reused the tired old clichés of stating the attackers were sophisticated, advanced, cunning, soft, strong, thoroughly absorbent, and so on. In this case the clichés appear to be true because the attackers "first enumerated remote processes and services running on the target host" and only moved through the target network "after disabling certain security services."
Those techniques included editing the Windows registries of target machines to disable autostarting of security processes – and then waiting until the target machine was rebooted before moving in for the kill.
"The combination of a complex attack chain and a protracted operation means that defensive solutions need to have comprehensive cross-domain visibility into attacker activity and provide months of historical data with powerful hunting tools to investigate as far back as necessary," Microsoft sighed.
The analysis includes indicators of compromise and techniques used by the attackers to skate around SolarWinds's networks but, unusually for infosec research, expresses them in plain English that any averagely skilled IT pro can follow. It's well worth a read.
The attackers also used the mildly unusual reflective DLL loading attack technique. A full explanation can be [5]read here , also from Microsoft. Briefly, the technique allows malicious DLL files to be loaded into a process without first having been registered with it – and does so from memory, via a custom loader deployed by the attacker, rather than pulling it from a potentially detectable disk location.
Relatedly, custom Cobalt Strike loaders developed by the hackers strongly resembled "legitimate Windows file and directory names, once again demonstrating how the attackers attempted to blend in the environment and hide in plain sight," said MS.
[6]
The autopsies of the biggest supply chain attack for years will doubtless continue, but one thing's for sure: whichever nation state was behind it, they really knew what they were doing and really didn't want to be caught in the act. ®
Get our [7]Tech Resources
[1] https://www.theregister.com/2021/01/12/solarwinds_tech_analysis_crowdstrike/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YAoHhp6J9TxuXW66eJ47rAAAANg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YAoHhp6J9TxuXW66eJ47rAAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.microsoft.com/security/blog/2017/11/13/detecting-reflective-dll-loading-with-windows-defender-atp/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YAoHhp6J9TxuXW66eJ47rAAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://whitepapers.theregister.com/
Re: What?
Indeed.
Since the last Windows Update of my machine, I can no longer disable Windows Update.
I'd really like to know what to jiggle in that abomination of an excuse that is the Registry to be able to lock that shit down and have my PC behave as I wish.
Re: What?
If you want your machine to do as you wish why run anything more recent than, say W2K?
Re: What?
My guess is because Microsoft has to allow for security processes to be stopped by something on the system, otherwise you couldn't replace Windows Defender pieces with 3rd party tools.
"and does so from memory"
Fascinating. And how does the malware get stuff into memory ?
Does it download it directly there ? If so, how does it download it past the security barriers ?
Will this be the final end
of DLLs?
I've not dug hard into the issue of DLLs, but are all the hassles even worth it any more? Especially if you're deploying to a (proper) single-app container, what's the win anymore?
Re: Will this be the final end
Ask the folk at Linux who also have shared libraries. Hell, to be honest just start writing efficient code and then we can get away with a hello world program that fits in a few hundred bytes instead of a few megabytes. I was looking at some code today, C++, the guy who wrote it clearly had no idea that he could add extra functions, use defines instead of magic numbers, indeed the program contains a nice memory leak of an object as to boot because he instantiated one then reassigned that to another instantiation instead of using a pointer. The pointer would also have meant he didnt need the flag variable. A little refactor and in fact neither was needed and all the duplicate code between the 10 cases that were identical bar one word and the then the (yet another flag) controlled aftermath from the 10 cases that happened 40 more lines down the file (yes more than 40 more lines of processing in a switch) ... oh well.
At this point I hold my hand up to having written a 120+line switch statement in the past but I defend that I did get round to cleaning it up before dumping it on a customer
Probably was a state sponsered attack
The time frame and the extreme hiding measures make it unlikely that it was an ordinary criminal gang - waiting many months from initial penetration of SolarWinds until the first attack activated is not the sort of patience expected from a criminal organization - but is perfectly plausible for a state spying organization. Changing the names of all the attacker files etc on each individual machine to avoid detection is also indicates a well trained group.
Re: Probably was a state sponsered attack
Hackers are much better coders than the average app writer.
No shit sherlock
I mean, the easiest way surely and at some point it must be said that if you dont know whats supposed to be running, you dont have a chance of checking what runs and you cant check the checksum of the object running is what you expect it is then you dont have a secure system.
If you go look at the tasks running in a windows machine today it numbers hundreds... what the hell most of them doing I doubt even Microsoft engineers have a clue. Why they are all consuming my CPU when I dont actually want to do more than browse some porn heaven only knows... but it probably goes a long way to explain the 10 minutes staring at a revoloving set of dots because I was stupid enough to lock the machine when I left it, or the 20 minutes it takes to shut down (what the hell is it doing... sending all my passwords to the NSA, Russia and GCHQ just in case?
Re: No shit sherlock
This is one of the reasons I switched most of my workloads to Linux Mint.
I still use Windows for work stuff (I need to make a living too) but whenever I can I switch to Linux.
"cunning VBScript"
If Visual BASIC is your threat, then dump BASIC! As for hiding something within another process, that's sort of old hat. Also, for naming their files to "blend in" with Windows, what did they expect? A file name of "EvilL33tCodzHere.dll"? That's another trick that's very old hat.
Really, the only part here that required effort was the attackers writing their own in-memory loader. The rest of it was just going through the motions.
What?
"...Those techniques included editing the Windows registries of target machines to disable autostarting of security processes – and then waiting until the target machine was rebooted before moving in for the kill..."
Why the fuck is that possible, Microsoft? Other AV vendors etc don't allow the stopping of services or changing their registry startup state even by DA or EA so...