Instructor: Beaconing. 2 2
Now when your computer gets infected 3 3
with some kind of malware, it can have that malware run 4 4
commands on it, but it's only going to be a one-way street. 5 5
For an attacker to be able to have two-way control, 6 6
it needs to reach back to a command and control server. 7 7
One of the ways it does this is by using beaconing. 8 8
Now beaconing is a means for a network node to advertise 9 9
its presence and establish a link with other nodes. 10 10
So if we have somebody who's been infected, 11 11
once it's been infected, it's going to reach back 12 12
to the central C2 server and say, "Hey, I've been infected. 13 13
I'm here now as part of your resource pool." 14 14
Now beaconing is not just a malicious thing, though. 15 15
Beaconing can be used legitimately. 16 16
For example, inside of your wireless access points, 17 17
there's something called a beacon management frame 18 18
and this is sent from a wireless access point 19 19
to other wireless access points in the area to say, 20 20
"Hey, I'm here, I'm awake, and I'm ready to accept traffic." 21 21
Now malicious beaconing, on the other hand, will 22 22
usually take the form of a simple ping 23 23
or a heartbeat to verify the bot is still alive 24 24
inside of this botnet. 25 25
Now this beaconing can happen at regular intervals 26 26
or it can happen at different times depending 27 27
on how it's configured. 28 28
But the whole goal of beaconing is to send out a message 29 29
from a victimized machine back to a C2 server to say, 30 30
"Hey, I'm here and I'm part of your botnet now." 31 31
We'll talk about the different communication channels used 32 32
by this beaconing in just a little bit. 33 33
So at this point, we have a host, it's been victimized, 34 34
and it's beaconing out. 35 35
Now the easiest thing for us to do would be to figure out 36 36
where it's beaconing to 37 37
and simply block that address, right? 38 38
Well, because of that, 39 39
attackers have started evolving their process. 40 40
In the old days, they would beacon to a common IP address 41 41
or to a common domain name, but to make it more difficult 42 42
for us to identify or block them as defenders, 43 43
these type of malware are now changing their DNS names 44 44
and their IP addresses all the time using things like DGA, 45 45
domain generation algorithms, and fast flux DNS. 46 46
So with all these changes happening, 47 47
how can we detect this beaconing activity? 48 48
Well, one of the most common ways is by capturing metadata 49 49
about all those sessions that are being established 50 50
or trying to make connections. 51 51
And then using analysis, we can correlate that 52 52
into beaconing activity. 53 53
Now here's a quick exam tip. 54 54
For the exam, you are likely going to see 55 55
an example of beaconing. 56 56
If they give you a log example and you see 57 57
something happening as a beacon, they're usually going to make 58 58
it happen on a regular interval every three seconds, 59 59
every five seconds, every 15 seconds, every day at midnight, 60 60
something like that because that is traditional beaconing. 61 61
But in the real world, most attackers aren't going to use 62 62
the same time every single day. 63 63
Instead, they will jump around using 64 64
some sort of an algorithm or they'll switch up 65 65
the IP or DNS names using DGA and fast flux DNS. 66 66
Now as I said earlier, there are 67 67
some legitimate applications 68 68
that will also perform beaconing and this also makes 69 69
it harder for us as defenders to identify 70 70
what is malicious beaconing versus what is real beaconing. 71 71
For example, a lot of legitimate applications 72 72
like NTP servers, auto update and patching systems, 73 73
and cluster services all use beaconing and heartbeats 74 74
as a way for them to send out information and let 75 75
other services know they are there and ready to support. 76 76
So when you see something, you have to figure out is 77 77
this malicious or is this something that's authorized? 78 78
And as a defender, learning what normal, 79 79
authorized behavior looks like within your network is 80 80
key to start understanding what is malicious beaconing. 81 81
Because if it's not something you've seen normally, 82 82
it then becomes suspicious or malicious. 83 83
Now as I said earlier, the adversaries are 84 84
constantly trying to redevelop their techniques 85 85
so they don't get caught. 86 86
In the earlier days, they would use beaconing 87 87
at consistent intervals. 88 88
But to start avoiding detection, they started using DGAs 89 89
and fast flux DNS and they started adding jitter. 90 90
Now jitter is an adversary's use 91 91
of a random delay to frustrate indicators based 92 92
on regular connection attempt intervals. 93 93
So if I used to see that this malware always connected 94 94
at 3:15 AM, but now it may connect at 3:00, 3:15, 3:45, 95 95
and it jumps around at different times using 96 96
different delays, that's the idea of jitter. 97 97
Now this jitter doesn't have to be a long period of time; 98 98
it could just be a couple of milliseconds 99 99
or a couple of seconds in either direction, 100 100
but even that is going to be enough to confuse some sensors. 101 101
Another way adversaries try to hide their activity 102 102
of beaconing is they will start using sparse delivery. 103 103
This allows them to reduce their packet sizes 104 104
and, therefore, they can hide within the noise 105 105
of other network traffic. 106 106
If you're running a large network that's sending out 107 107
gigabytes of data every single day, will you notice 108 108
just a handful of packets being sent out as a beacon? 109 109
Maybe or maybe not. 110 110
It makes it a lot harder to find 111 111
because it's that noise inside that larger signal. 112 112
So now that we've talked a lot about beaconing 113 113
in this lesson, you should understand what it is 114 114
and why we use it. 115 115
Because after all, a command and control server needs to be 116 116
able to issue commands to its zombies 117 117
as part of the botnet using some kind 118 118
of a communication channel. 119 119
Usually this is going to start out using a beacon 120 120
and then it'll be able to send out 121 121
additional control signals in response to those beacons 122 122
if they need to send out an attack. 123 123
Essentially, the beacon is just saying, 124 124
"I'm here and I'm ready to receive orders." 125 125
Then the command and control server needs to send 126 126
information back to them. 127 127
And how they do that is 128 128
through various communication channels. 129 129
These channels include things like internet relay chat, 130 130
or IRC, HTTP and HTTPS connections, 131 131
domain name system or DNS connections, 132 132
social media websites, cloud services, 133 133
and media and document files. 134 134
Let's talk about each of these as we go 135 135
through the rest of this lesson. 136 136
First, let's talk about IRC, which is internet relay chat. 137 137
This is a group communication protocol with networks divided 138 138
into discreet channels that are then used 139 139
as individual forums by the clients to chat with each other. 140 140
Now IRC is basically the early version of chat. 141 141
Think about it like Facebook Messenger 142 142
or Discord or something like that. 143 143
IRC was really popular back in the 90s and early 2000s. 144 144
Essentially, you could log onto a different server 145 145
and in that server, there'd be lots of different chat rooms 146 146
and you could go in and start talking on those. 147 147
Well over time, people developed bots that could run 148 148
these chat rooms and they could also be used 149 149
as a command and control mechanism. 150 150
Now these days, most organizations don't have 151 151
a legitimate use for IRC and because of that, 152 152
most organizations will simply block IRC. 153 153
This way, the use of IRC 154 154
as a command and control channel is eliminated. 155 155
And because of this, the use of IRC 156 156
as a command and control channel has been 157 157
on the decline for many years. 158 158
So adversaries had to find another way 159 159
and that brings us to our second method, HTTP and HTTPS. 160 160
Now unlike IRC, every business has a need 161 161
for web connections. 162 162
You need to go to a website to pay your bills. 163 163
You need to go to a website to sell things 164 164
for your customers. 165 165
You need to go to a website to set up 166 166
your advertising campaigns. 167 167
All of that runs on HTTP or HTTPS, 168 168
which runs on either port 80 or port 443. 169 169
Now these communications over these web protocols are 170 170
a necessity in almost every organizational network 171 171
so you can't just blanket and say we're not going to allow 172 172
port 80 or port 443 traffic because you would shut down 173 173
everything your business needs to run. 174 174
So what can you do to prevent these from being used 175 175
as a communications channel for the C2 servers? 176 176
Well, the best mitigation is to use a intercepting proxy 177 177
at your network's edge. 178 178
Now this is also known as break and inspect. 179 179
Essentially, you have a device at the edge of your network 180 180
and when somebody internal to your network wants to connect 181 181
to something like Gmail over a secure connection, 182 182
they would go, instead of doing a connection between them 183 183
and Gmail with an HTTPS tunnel, they instead would connect 184 184
from them to this intercepting proxy 185 185
and then the intercepting proxy makes a secure connection 186 186
out to the Gmail server. 187 187
This way, you end up having a secure tunnel 188 188
all the way across, but you're essentially an authorized 189 189
on-path attacker with you sitting at that network edge. 190 190
This allows your network defenders to analyze 191 191
the traffic going in and out of your network 192 192
within those HTTPS connections. 193 193
Our third type of communication channel that's used heavily 194 194
by C2 networks is DNS or the domain name system. 195 195
Now most DNS traffic is not inspected or filtered 196 196
in private organizational networks so attackers have found 197 197
DNS to be an effective command and control channel. 198 198
Now another reason this is 199 199
an effective command and control channel is 200 200
that you don't actually have to have a direct connection 201 201
to the outside network to be able to send out a signal. 202 202
Instead, you could send it to your local DNS resolver. 203 203
That local DNS resolver will then execute the lookup 204 204
on the authorative servers outside the organization, 205 205
like on the internet, and then they'll receive the response 206 206
with a control message. 207 207
Now this allows attackers to send their commands 208 208
in either a request or response query. 209 209
So if I'm trying to do something as a beacon out, 210 210
I can send it out as a malicious host sending 211 211
out the request, and then if I want to send a command back, 212 212
I can send that back as part of the response query. 213 213
This way information can pass back and forth to that host, 214 214
and again, it usually will bypass 215 215
any inspection and any filtering. 216 216
So how do you know if it's legitimate DNS traffic 217 217
or if it's an indicator of compromise? 218 218
Well, the first thing that might show that it's an indicator 219 219
or compromise is if you start seeing 220 220
the same query being repeated several times 221 221
when a bot is checking 222 222
into a control server for more orders. 223 223
Essentially, a normal DNS query will happen once 224 224
and you may not make that query again for several days. 225 225
But if you see the same query being repeated 226 226
every couple hours or every day or two, 227 227
that could be an indicator that it is a bot checking in. 228 228
Another indicator could be if you start seeing commands sent 229 229
within a request or response query. 230 230
And when you see this, it's usually because those requests 231 231
and response queries will be longer 232 232
and more complicated than normal. 233 233
Now one of the ways that attackers actually send 234 234
out information as part of these request to response is 235 235
they're actually going to send out more data inside that packet 236 236
so they can send the commands they want to send. 237 237
So instead of just saying, "What is the address 238 238
for diontraining.com?", they may say "What is the address 239 239
for diontraining.com and here's all this other command 240 240
and control information." 241 241
So you'll see a larger packet size 242 242
or longer and more complicated requests. 243 243
Now with this second IOC, though, one of the ways 244 244
that they can evade detection is actually breaking up 245 245
their control messages into several query chunks to help 246 246
not trip the sensors. 247 247
So instead of having this one really big DNS request, 248 248
they can have that DNS request chopped into smaller packets 249 249
and by doing that, they will be able to evade detection. 250 250
Again, though, if you can take that traffic 251 251
and put it back together, you can then see 252 252
what the larger request was 253 253
and see what malicious intent they had. 254 254
Our next category is social media websites. 255 255
Sites like Facebook and Twitter and LinkedIn have all been 256 256
vectors for command and control operations in the past. 257 257
This is because as people have started blocking things 258 258
like internet relay chat, more people have moved to things 259 259
like Facebook and Twitter and LinkedIn for messaging. 260 260
Another reason the attackers use this is 261 261
because by using these social media platforms 262 262
messaging functions, this allows 263 263
the attacker to live off the land. 264 264
They don't have to create their own tools. 265 265
They can just send messages through their APIs 266 266
and that way they don't have to install anything 267 267
and it makes it harder for you to detect them. 268 268
For example, there was one case where a botnet was using 269 269
LinkedIn as its command and control platform. 270 270
Essentially, what would happen is these bots would check 271 271
LinkedIn every day and if they saw that the job position 272 272
for a particular contact was changed, for instance, 273 273
it went from the accounting department 274 274
to the human resources department, 275 275
that would be the signal to now do their attack payloads. 276 276
And so that was the way they used 277 277
this way to send out a command. 278 278
It was very sneaky and it worked really well 279 279
because a lot of companies trusted LinkedIn. 280 280
And so when they saw something like a field 281 281
like employment status or employment history 282 282
or a status update, 283 283
that could trigger some sort of action by this malware. 284 284
Another example is Twitter. 285 285
There was another botnet out there that used hashtags 286 286
as part of the command strings 287 287
that they were sending to the bots. 288 288
Essentially, the way this worked is the bots 289 289
on the victim machine would look at Twitter 290 290
and whenever they saw messages with a certain hashtag, 291 291
they would then use that, parse that message, 292 292
and use that as the way to receive their orders. 293 293
Our fourth type of communication channel is cloud services. 294 294
Cloud services are great for an attacker 295 295
because they don't have to own their own services 296 296
and own their own servers. 297 297
Instead, they can spin up virtual machines 298 298
or use app-based engines to be able to send out C2 messages. 299 299
For example, attackers in the past have used 300 300
Google's app engine platform to send 301 301
command and control messages 302 302
through a hosted custom application within that platform. 303 303
Others have used things like AWS Lambda to use 304 304
those type of functions, as well, and this way, 305 305
they don't have to incur the cost of setting up 306 306
their own servers and they can use the cloud company's 307 307
reliable and scalable infrastructure to send out 308 308
those messages to a very large audience 309 309
of bots in their control. 310 310
The final communication channel we need to talk about is 311 311
metadata, which exists within media and document files. 312 312
Now metadata is a set of data that describes information 313 313
about other data. 314 314
Now for instance, if you're looking at an MP3 file 315 315
or a PNG file or a JPEG or an MP4 or anything; 316 316
it can be audio or video or images, all of these have 317 317
metadata embedded within those files. 318 318
Now the metadata within these files can hold 319 319
attackers' command and control messages, too. 320 320
And so when you actually send a message to that network 321 321
like, "Here is a PNG file," which is a graphic file 322 322
as part of an email, the bot could read that message, 323 323
read the metadata off that PNG file, off that graphic file, 324 324
and that would then tell them, execute X-Y-Z attack method. 325 325
This way, that metadata holds the C2 messages 326 326
and it can get through your detection systems 327 327
because your detection systems probably aren't looking 328 328
inside the metadata of these different files.