Instructor: Data exfiltration. 2 2
Now, in this lesson, 3 3
we are going to talk about data exfiltration, 4 4
because after all, 5 5
when an attacker tries to get into your system, 6 6
they're not just trying to get in there to gain access, 7 7
but, instead, they're trying to gain access for a purpose. 8 8
And a lot of times, that purpose is data exfiltration. 9 9
Data exfiltration is the process 10 10
by which an attacker takes data 11 11
that's stored inside of a private network 12 12
and they move it out to an external network. 13 13
Now, data exfiltration 14 14
is essentially stealing your information 15 15
and this is really important 16 16
because it can be done for lots of different reasons. 17 17
For example, 18 18
somebody might try to steal your information 19 19
to then blackmail you based on what they took, 20 20
or they may steal your information 21 21
like your customer's credit card numbers 22 22
to be able to use those credit card numbers 23 23
and buy things and make money for themselves. 24 24
There are lots of different reasons 25 25
that someone might want to exfil your data, 26 26
but either way, as a cyber defense analyst, 27 27
you need to understand what data exfiltration is 28 28
and all the different ways that someone might try to do it. 29 29
Data exfiltration can be performed 30 30
over many different types of channels. 31 31
This can be done over HTTP or HTTPS transfers. 32 32
It can be done over HTTP requests to databases. 33 33
It can be done using DNS. 34 34
It can be done using overt channels, 35 35
or it can be done using explicit tunnels. 36 36
Throughout the rest of this lesson, 37 37
we are going to cover each of these five areas. 38 38
First, we have HTTP or HTTPS transfers. 39 39
Now, these transfers occur 40 40
when an attacker uses commercial file sharing services 41 41
to upload the exfiltrated data from a victim. 42 42
For example, if someone breaks into your network 43 43
and they find a lot of files on your hard drive, 44 44
they need to get those things out. 45 45
Well, they might log into something 46 46
like their Dropbox account from your machine 47 47
and then upload all your files to that Dropbox account. 48 48
They can do this with Dropbox, OneDrive, Google Drive, 49 49
or many other cloud-sharing services. 50 50
All of these are a valid way for you to upload those files 51 51
to the centralized server and exfiltrate that data. 52 52
Another way that this might happen 53 53
is if they're using HTTP requests to database services. 54 54
Now, when this happens, 55 55
an adversary is going to use an SQL injection 56 56
or another type of similar technique 57 57
to copy records from a database 58 58
to which they shouldn't have access. 59 59
Now these are a little bit easier to detect. 60 60
The reason is there's a common IoC 61 61
that you're going to notice with them. 62 62
If you see a spike in request to a PHP 63 63
or other script files, 64 64
or unusually large HTTP response packets, 65 65
this could be an indicator 66 66
that someone is trying to use this HTTP request 67 67
to the database service 68 68
to get the data out of the database and over to an attacker. 69 69
The third type of data exfiltration channel 70 70
that we could use is DNS. 71 71
Now, DNS can be used with its queries 72 72
to transmit data out of a network enclave. 73 73
Now, there's lots of different types of records with DNS, 74 74
but one of the common indicators of compromise 75 75
is if you see an atypical query type being used. 76 76
For instance, someone starts asking 77 77
for TXT files or MX records, or CNAMEs, or NULL. 78 78
All of these are not nearly as common 79 79
as a standard A record. 80 80
And so if somebody has a client on a network 81 81
and they start sending out a request for TXT records 82 82
and in that is additional data, 83 83
that can actually be a way of exfiltrating data 84 84
out of your network using DNS as a covert channel. 85 85
Another thing you might be using is just an overt channel. 86 86
Now, basically, an overt channel 87 87
is a channel that is meant to send data. 88 88
For instance, FTP is file transfer protocol, 89 89
instant messaging, peer-to-peer information, emailing, 90 90
and other obvious file and data sharing tools 91 91
are all considered overt channels. 92 92
This is what those tools were designed to do, 93 93
to send information. 94 94
Now an attacker is using them to get your data 95 95
out of the network, making it an overt channel. 96 96
The final type we have is an explicit tunnel. 97 97
Now, when you're using an explicit tunnel, 98 98
this uses something like SSH, 99 99
which is Secure Shell, 100 100
or VPNs, virtual private networks, 101 101
to create a tunnel to transmit the data across a network. 102 102
So how do you identify 103 103
if one of these explicit tunnels 104 104
is actually being used as part of data exfiltration, 105 105
or it's just something that is useful 106 106
and needed by an administrator? 107 107
Well, one of the IoCs for this 108 108
is if you start seeing atypical endpoints 109 109
being involved in these tunnels. 110 110
Now, one of the most common ways 111 111
that it could be atypical is based on geographic location. 112 112
For instance, in my company, 113 113
we have employees in several areas. 114 114
We have employees in Maryland and Washington DC area. 115 115
We have employees down in Florida. 116 116
We have employees down in Puerto Rico. 117 117
We have employees out in the Philippines 118 118
and places like that. 119 119
Now, if I start seeing traffic 120 120
with an endpoint going from my servers to Russia 121 121
or my servers to Turkey, 122 122
those are locations that we don't have any employees in. 123 123
So that would be atypical 124 124
and something that would be suspicious 125 125
that we would look into. 126 126
But if I saw an SSH connection, 127 127
or a VPN going from Puerto Rico into my servers, 128 128
that wouldn't be atypical, 129 129
because my staff down there connects through VPNs 130 130
all the time. 131 131
So now that we've covered the basics of data exfiltration 132 132
and the five types of channels that could be used, 133 133
let me give you a warning about data exfiltration. 134 134
An adversary could use a different channel 135 135
for data exfiltration 136 136
than they used for command and control. 137 137
So just because you identified something like beaconing 138 138
or command and control and you block that, 139 139
it doesn't mean the data is going to stop being exfilled. 140 140
The reason for this is you might stop the beaconing 141 141
and the command and control, 142 142
but the command was already received 143 143
before you cut that off. 144 144
And so if I had a command and control channel over DNS, 145 145
but I'm sending that data out over SSH 146 146
and you block port 53, that stops the command and control. 147 147
But I may have already received the command signal 148 148
to send the data, 149 149
and so I'll continue sending it over port 22 using SSH. 150 150
This is just something you have to think about 151 151
because you've got to catch both areas, 152 152
whatever the command and control channel is 153 153
and the data exfiltration channel. 154 154
The final thing I want to talk about here 155 155
is what is the best mitigation against data exfiltration? 156 156
Well, the best mitigation 157 157
is to use strong encryption of data 158 158
when it's at rest or when it's in transit. 159 159
If you have a hard drive that is encrypted, 160 160
the data stored on that hard drive 161 161
can't be copied off and exfiltrated 162 162
without breaking that encryption first. 163 163
So even if they're able to download those files 164 164
and exfiltrate them, 165 165
they would have these encrypted files without the key 166 166
and they wouldn't be able to open them and read them. 167 167
This makes the data they exfilled 168 168
essentially useless to them. 169 169
So make sure you're using strong encryption 170 170
on all of your data at rest, 171 171
especially if you want to protect it from data exfiltration.