1 1 00:00:00,510 --> 00:00:02,580 Data exfiltration. 2 2 00:00:02,580 --> 00:00:03,720 Now, in this lesson, 3 3 00:00:03,720 --> 00:00:06,210 we are going to talk about data exfiltration, 4 4 00:00:06,210 --> 00:00:07,320 because after all, 5 5 00:00:07,320 --> 00:00:09,570 when an attacker tries to get into your system, 6 6 00:00:09,570 --> 00:00:12,210 they're not just trying to get in there to gain access, 7 7 00:00:12,210 --> 00:00:15,360 but, instead, they're trying to gain access for a purpose. 8 8 00:00:15,360 --> 00:00:19,020 And a lot of times, that purpose is data exfiltration. 9 9 00:00:19,020 --> 00:00:20,820 Data exfiltration is the process 10 10 00:00:20,820 --> 00:00:22,440 by which an attacker takes data 11 11 00:00:22,440 --> 00:00:24,570 that's stored inside of a private network 12 12 00:00:24,570 --> 00:00:27,210 and they move it out to an external network. 13 13 00:00:27,210 --> 00:00:28,410 Now, data exfiltration 14 14 00:00:28,410 --> 00:00:30,630 is essentially stealing your information 15 15 00:00:30,630 --> 00:00:31,800 and this is really important 16 16 00:00:31,800 --> 00:00:34,650 because it can be done for lots of different reasons. 17 17 00:00:34,650 --> 00:00:35,580 For example, 18 18 00:00:35,580 --> 00:00:37,320 somebody might try to steal your information 19 19 00:00:37,320 --> 00:00:39,960 to then blackmail you based on what they took, 20 20 00:00:39,960 --> 00:00:41,460 or they may steal your information 21 21 00:00:41,460 --> 00:00:42,583 like your customer's credit card numbers 22 22 00:00:42,583 --> 00:00:44,730 to be able to use those credit card numbers 23 23 00:00:44,730 --> 00:00:47,310 and buy things and make money for themselves. 24 24 00:00:47,310 --> 00:00:48,720 There are lots of different reasons 25 25 00:00:48,720 --> 00:00:50,940 that someone might want to exfil your data, 26 26 00:00:50,940 --> 00:00:53,340 but either way, as a cyber defense analyst, 27 27 00:00:53,340 --> 00:00:56,460 you need to understand what data exfiltration is 28 28 00:00:56,460 --> 00:01:00,150 and all the different ways that someone might try to do it. 29 29 00:01:00,150 --> 00:01:01,980 Data exfiltration can be performed 30 30 00:01:01,980 --> 00:01:04,320 over many different types of channels. 31 31 00:01:04,320 --> 00:01:08,250 This can be done over HTTP or HTTPS transfers. 32 32 00:01:08,250 --> 00:01:11,610 It can be done over HTTP requests to databases. 33 33 00:01:11,610 --> 00:01:13,560 It can be done using DNS. 34 34 00:01:13,560 --> 00:01:15,390 It can be done using overt channels, 35 35 00:01:15,390 --> 00:01:18,240 or it can be done using explicit tunnels. 36 36 00:01:18,240 --> 00:01:19,500 Throughout the rest of this lesson, 37 37 00:01:19,500 --> 00:01:21,990 we are going to cover each of these five areas. 38 38 00:01:21,990 --> 00:01:26,010 First, we have HTTP or HTTPS transfers. 39 39 00:01:26,010 --> 00:01:27,450 Now, these transfers occur 40 40 00:01:27,450 --> 00:01:30,330 when an attacker uses commercial file sharing services 41 41 00:01:30,330 --> 00:01:33,450 to upload the exfiltrated data from a victim. 42 42 00:01:33,450 --> 00:01:35,820 For example, if someone breaks into your network 43 43 00:01:35,820 --> 00:01:37,980 and they find a lot of files on your hard drive, 44 44 00:01:37,980 --> 00:01:39,540 they need to get those things out. 45 45 00:01:39,540 --> 00:01:41,040 Well, they might log into something 46 46 00:01:41,040 --> 00:01:43,620 like their Dropbox account from your machine 47 47 00:01:43,620 --> 00:01:46,710 and then upload all your files to that Dropbox account. 48 48 00:01:46,710 --> 00:01:49,830 They can do this with Dropbox, OneDrive, Google Drive, 49 49 00:01:49,830 --> 00:01:52,560 or many other cloud-sharing services. 50 50 00:01:52,560 --> 00:01:55,170 All of these are a valid way for you to upload those files 51 51 00:01:55,170 --> 00:01:58,680 to the centralized server and exfiltrate that data. 52 52 00:01:58,680 --> 00:02:00,120 Another way that this might happen 53 53 00:02:00,120 --> 00:02:03,750 is if they're using HTTP requests to database services. 54 54 00:02:03,750 --> 00:02:04,920 Now, when this happens, 55 55 00:02:04,920 --> 00:02:07,290 an adversary is going to use an SQL injection 56 56 00:02:07,290 --> 00:02:09,060 or another type of similar technique 57 57 00:02:09,060 --> 00:02:11,070 to copy records from a database 58 58 00:02:11,070 --> 00:02:13,380 to which they shouldn't have access. 59 59 00:02:13,380 --> 00:02:15,630 Now these are a little bit easier to detect. 60 60 00:02:15,630 --> 00:02:17,820 The reason is there's a common IoC 61 61 00:02:17,820 --> 00:02:19,530 that you're going to notice with them. 62 62 00:02:19,530 --> 00:02:22,050 If you see a spike in request to a PHP 63 63 00:02:22,050 --> 00:02:23,670 or other script files, 64 64 00:02:23,670 --> 00:02:27,030 or unusually large HTTP response packets, 65 65 00:02:27,030 --> 00:02:28,260 this could be an indicator 66 66 00:02:28,260 --> 00:02:31,440 that someone is trying to use this HTTP request 67 67 00:02:31,440 --> 00:02:32,730 to the database service 68 68 00:02:32,730 --> 00:02:36,090 to get the data out of the database and over to an attacker. 69 69 00:02:36,090 --> 00:02:38,040 The third type of data exfiltration channel 70 70 00:02:38,040 --> 00:02:40,110 that we could use is DNS. 71 71 00:02:40,110 --> 00:02:42,390 Now, DNS can be used with its queries 72 72 00:02:42,390 --> 00:02:45,510 to transmit data out of a network enclave. 73 73 00:02:45,510 --> 00:02:48,420 Now, there's lots of different types of records with DNS, 74 74 00:02:48,420 --> 00:02:50,580 but one of the common indicators of compromise 75 75 00:02:50,580 --> 00:02:53,460 is if you see an atypical query type being used. 76 76 00:02:53,460 --> 00:02:55,170 For instance, someone starts asking 77 77 00:02:55,170 --> 00:02:59,700 for TXT files or MX records, or CNAMEs, or NULL. 78 78 00:02:59,700 --> 00:03:01,590 All of these are not nearly as common 79 79 00:03:01,590 --> 00:03:03,150 as a standard A record. 80 80 00:03:03,150 --> 00:03:05,460 And so if somebody has a client on a network 81 81 00:03:05,460 --> 00:03:08,700 and they start sending out a request for TXT records 82 82 00:03:08,700 --> 00:03:10,410 and in that is additional data, 83 83 00:03:10,410 --> 00:03:12,720 that can actually be a way of exfiltrating data 84 84 00:03:12,720 --> 00:03:16,290 out of your network using DNS as a covert channel. 85 85 00:03:16,290 --> 00:03:19,500 Another thing you might be using is just an overt channel. 86 86 00:03:19,500 --> 00:03:20,880 Now, basically, an overt channel 87 87 00:03:20,880 --> 00:03:22,920 is a channel that is meant to send data. 88 88 00:03:22,920 --> 00:03:25,980 For instance, FTP is file transfer protocol, 89 89 00:03:25,980 --> 00:03:29,040 instant messaging, peer-to-peer information, emailing, 90 90 00:03:29,040 --> 00:03:31,650 and other obvious file and data sharing tools 91 91 00:03:31,650 --> 00:03:33,840 are all considered overt channels. 92 92 00:03:33,840 --> 00:03:35,640 This is what those tools were designed to do, 93 93 00:03:35,640 --> 00:03:37,140 to send information. 94 94 00:03:37,140 --> 00:03:39,660 Now an attacker is using them to get your data 95 95 00:03:39,660 --> 00:03:42,840 out of the network, making it an overt channel. 96 96 00:03:42,840 --> 00:03:45,480 The final type we have is an explicit tunnel. 97 97 00:03:45,480 --> 00:03:47,250 Now, when you're using an explicit tunnel, 98 98 00:03:47,250 --> 00:03:49,080 this uses something like SSH, 99 99 00:03:49,080 --> 00:03:50,370 which is Secure Shell, 100 100 00:03:50,370 --> 00:03:52,560 or VPNs, virtual private networks, 101 101 00:03:52,560 --> 00:03:55,830 to create a tunnel to transmit the data across a network. 102 102 00:03:55,830 --> 00:03:57,000 So how do you identify 103 103 00:03:57,000 --> 00:03:58,560 if one of these explicit tunnels 104 104 00:03:58,560 --> 00:04:01,290 is actually being used as part of data exfiltration, 105 105 00:04:01,290 --> 00:04:03,060 or it's just something that is useful 106 106 00:04:03,060 --> 00:04:04,800 and needed by an administrator? 107 107 00:04:04,800 --> 00:04:06,420 Well, one of the IoCs for this 108 108 00:04:06,420 --> 00:04:08,490 is if you start seeing atypical endpoints 109 109 00:04:08,490 --> 00:04:10,290 being involved in these tunnels. 110 110 00:04:10,290 --> 00:04:11,520 Now, one of the most common ways 111 111 00:04:11,520 --> 00:04:14,790 that it could be atypical is based on geographic location. 112 112 00:04:14,790 --> 00:04:16,590 For instance, in my company, 113 113 00:04:16,590 --> 00:04:18,840 we have employees in several areas. 114 114 00:04:18,840 --> 00:04:22,080 We have employees in Maryland and Washington DC area. 115 115 00:04:22,080 --> 00:04:23,910 We have employees down in Florida. 116 116 00:04:23,910 --> 00:04:25,740 We have employees down in Puerto Rico. 117 117 00:04:25,740 --> 00:04:27,390 We have employees out in the Philippines 118 118 00:04:27,390 --> 00:04:28,770 and places like that. 119 119 00:04:28,770 --> 00:04:30,300 Now, if I start seeing traffic 120 120 00:04:30,300 --> 00:04:33,060 with an endpoint going from my servers to Russia 121 121 00:04:33,060 --> 00:04:34,830 or my servers to Turkey, 122 122 00:04:34,830 --> 00:04:37,200 those are locations that we don't have any employees in. 123 123 00:04:37,200 --> 00:04:38,580 So that would be atypical 124 124 00:04:38,580 --> 00:04:40,020 and something that would be suspicious 125 125 00:04:40,020 --> 00:04:41,610 that we would look into. 126 126 00:04:41,610 --> 00:04:43,350 But if I saw an SSH connection, 127 127 00:04:43,350 --> 00:04:46,410 or a VPN going from Puerto Rico into my servers, 128 128 00:04:46,410 --> 00:04:47,730 that wouldn't be atypical, 129 129 00:04:47,730 --> 00:04:50,040 because my staff down there connects through VPNs 130 130 00:04:50,040 --> 00:04:51,630 all the time. 131 131 00:04:51,630 --> 00:04:54,660 So now that we've covered the basics of data exfiltration 132 132 00:04:54,660 --> 00:04:56,730 and the five types of channels that could be used, 133 133 00:04:56,730 --> 00:04:59,700 let me give you a warning about data exfiltration. 134 134 00:04:59,700 --> 00:05:01,800 An adversary could use a different channel 135 135 00:05:01,800 --> 00:05:03,030 for data exfiltration 136 136 00:05:03,030 --> 00:05:04,980 than they used for command and control. 137 137 00:05:04,980 --> 00:05:07,650 So just because you identified something like beaconing 138 138 00:05:07,650 --> 00:05:09,780 or command and control and you block that, 139 139 00:05:09,780 --> 00:05:12,870 it doesn't mean the data is going to stop being exfilled. 140 140 00:05:12,870 --> 00:05:15,330 The reason for this is you might stop the beaconing 141 141 00:05:15,330 --> 00:05:16,560 and the command and control, 142 142 00:05:16,560 --> 00:05:18,240 but the command was already received 143 143 00:05:18,240 --> 00:05:19,860 before you cut that off. 144 144 00:05:19,860 --> 00:05:22,980 And so if I had a command and control channel over DNS, 145 145 00:05:22,980 --> 00:05:26,250 but I'm sending that data out over SSH 146 146 00:05:26,250 --> 00:05:29,280 and you block port 53, that stops the command and control. 147 147 00:05:29,280 --> 00:05:30,990 But I may have already received the command signal 148 148 00:05:30,990 --> 00:05:32,010 to send the data, 149 149 00:05:32,010 --> 00:05:35,850 and so I'll continue sending it over port 22 using SSH. 150 150 00:05:35,850 --> 00:05:37,140 This is just something you have to think about 151 151 00:05:37,140 --> 00:05:39,120 because you've got to catch both areas, 152 152 00:05:39,120 --> 00:05:40,830 whatever the command and control channel is 153 153 00:05:40,830 --> 00:05:43,020 and the data exfiltration channel. 154 154 00:05:43,020 --> 00:05:44,370 The final thing I want to talk about here 155 155 00:05:44,370 --> 00:05:48,150 is what is the best mitigation against data exfiltration? 156 156 00:05:48,150 --> 00:05:49,470 Well, the best mitigation 157 157 00:05:49,470 --> 00:05:51,570 is to use strong encryption of data 158 158 00:05:51,570 --> 00:05:54,270 when it's at rest or when it's in transit. 159 159 00:05:54,270 --> 00:05:56,610 If you have a hard drive that is encrypted, 160 160 00:05:56,610 --> 00:05:58,140 the data stored on that hard drive 161 161 00:05:58,140 --> 00:06:00,330 can't be copied off and exfiltrated 162 162 00:06:00,330 --> 00:06:02,220 without breaking that encryption first. 163 163 00:06:02,220 --> 00:06:04,140 So even if they're able to download those files 164 164 00:06:04,140 --> 00:06:05,280 and exfiltrate them, 165 165 00:06:05,280 --> 00:06:07,620 they would have these encrypted files without the key 166 166 00:06:07,620 --> 00:06:09,570 and they wouldn't be able to open them and read them. 167 167 00:06:09,570 --> 00:06:11,340 This makes the data they exfilled 168 168 00:06:11,340 --> 00:06:12,990 essentially useless to them. 169 169 00:06:12,990 --> 00:06:15,000 So make sure you're using strong encryption 170 170 00:06:15,000 --> 00:06:16,470 on all of your data at rest, 171 171 00:06:16,470 --> 00:06:19,370 especially if you want to protect it from data exfiltration.