-: Another part 2 2
of threat classification is to describe the different types 3 3
of adversary tools collectively described as malware. 4 4
Now, we're not going to cover the basic malware like viruses 5 5
and worms and Trojans and root kits and ransomware 6 6
because you should already be familiar with all 7 7
of those from your a plus and your security plus studies 8 8
and we are way beyond that inside this course. 9 9
Instead, we're going to focus 10 10
on three types, commodity, malware, zero day malware 11 11
and command and control. 12 12
When I talk about commodity malware, we're talking 13 13
about malicious software applications that are 14 14
widely available for sale and are easily obtained and used. 15 15
Now, you can usually find these 16 16
on the dark web or the dark net, and there are 17 17
online marketplaces where you can buy remote access Trojans 18 18
things like Poison ivy, dark Comet, and Extreme Rat 19 19
and many other types of malware out there. 20 20
These things are all available online 21 21
for a fee where you can download them 22 22
and then start using them as part 23 23
of your attacks if you're a bad guy. 24 24
Now, these are commodity malware because they are generic 25 25
off the shelf pieces of malware, but there are also targeted 26 26
or custom malware that can be developed 27 27
and deployed with a target in mind. 28 28
When you're dealing with commodity malware, it's generic 29 29
it's going against everybody 30 30
but when you're dealing with targeted or custom malware 31 31
there is a specific target in mind 32 32
and so knowing this can help you identify that malware 33 33
and if you determine it's commodity or targeted 34 34
this can help you determine the severity 35 35
of an incident because if somebody is using targeted malware 36 36
against your organization, there is a higher severity 37 37
to that incident for you because you are being targeted. 38 38
You're not just randomly hit 39 39
by some drive-by piece of malware, 40 40
and so this is something that's 41 41
important for you to consider. 42 42
Now, the next thing we have to think 43 43
about here is a zero day vulnerability and a zero 44 44
day vulnerability is any vulnerability that is discovered 45 45
or exploited before the vendor can issue a patch for it. 46 46
Now, this is where we get our zero day malware 47 47
from is malware that attacks. 48 48
This is zero day vulnerability. 49 49
When we talk about zero day, this is usually applied 50 50
to the vulnerability itself, but in recent years 51 51
people talk about zero day malware as well 52 52
as they start referring to the attack 53 53
or the malware that is exploiting that zero day. 54 54
You may see either term being used 55 55
on the exam when they talk about zero day 56 56
they may be talking about the vulnerability or the malware 57 57
so read the question to understand the context. 58 58
Now, the next thing we have to think about when we talk 59 59
about this zero day malware is how serious is it? 60 60
Well, zero day exploits are big business. 61 61
These things cost a lot 62 62
of money and a lot of time to develop. 63 63
For example, if you're a bug bounty person 64 64
and you start finding zero day vulnerabilities 65 65
you can actually get lots of money 66 66
for turning those over to the company 67 67
because they don't want those out on the open market. 68 68
But you can also sell those to different governments 69 69
and law enforcement agencies, and even on the dark web 70 70
and some of these zero day exploits have gone 71 71
for millions of dollars. 72 72
There is one that sold 73 73
for over $1 million that targeted Apple iPhones. 74 74
These things are big business now 75 75
because they cost so much money 76 76
most adversaries will only use a zero day vulnerability 77 77
for a very high value attack. 78 78
They're not going to waste these 79 79
and so generally what you're going to see is 80 80
that people tend to try to attack something 81 81
with a generic or off the shelf piece 82 82
of malware first and get into the network. 83 83
And if that target is valuable enough 84 84
and they can't get in through other means 85 85
then they would go and use their zero day. 86 86
Often countries 87 87
and nation states are stockpiling these zero days 88 88
so that they can use them 89 89
as they're doing their spying and their espionage 90 90
and other things that are a very high value for them. 91 91
Now, the third thing we want to talk 92 92
about is command and control, but before we do that 93 93
we need to talk once more about APTs. 94 94
APTs originally referred to the person 95 95
but now it refers more to the ability. 96 96
An APT is an attacker's ability to obtain, maintain 97 97
and diversify access 98 98
to network systems using different exploits and malware. 99 99
This can be done through commodity malware 100 100
or through targeted or custom malware. 101 101
Either way, when that attacker gets into your system 102 102
they don't want to get out 103 103
and generally you're going to find nation states 104 104
and organized crime actors have this APT capability. 105 105
Now, in terms of classification 106 106
we talked about our knowns and our unknowns. 107 107
When we talk about APTs, these are considered unknown. 108 108
Unknown meaning we know that they're out there 109 109
we know they're trying to attack us 110 110
but we don't know exactly how they're going to do it 111 111
because they're always modifying their techniques 112 112
and they're always getting better all the time. 113 113
And so this makes them a known unknown threat. 114 114
Now, when we deal with APTs, a lot 115 115
of times they will go out and use commodity malware 116 116
or other off-the-shelf technologies to try to infect 117 117
as many machines as possible. 118 118
Then they'll have those report back 119 119
to what's called a C2 node or a command and control node. 120 120
Now, a C2 node is any infrastructure 121 121
of hosts and services with which attackers direct distribute 122 122
or control malware over botnets. 123 123
And so often they will build up these large botnets 124 124
especially if you're dealing with a crime organization. 125 125
Now, as they do this 126 126
you're going to have all these different machines all 127 127
around the world that connect back 128 128
to the bot master who is in charge of the C2 network 129 129
and they can then issue a command to use those machines 130 130
in any way they see fit. 131 131
They may use them as a pivot point into somebody 132 132
else's network to attack the network from there. 133 133
So as law enforcement tries to track it back 134 134
they find this innocent bot as opposed to the bot master. 135 135
Also, we can take all these machines 136 136
and then use them to attack a single target 137 137
if we're doing a distributed denial 138 138
of service attack, for instance 139 139
and this is the whole idea of using a C2 node. 140 140
It's this single point 141 141
of contact that we can then use to talk to everybody else 142 142
across our networks to do the bidding that we want to do 143 143
and APTs use this a lot. 144 144
Now, what is usually the target of an APT? 145 145
Well, generally they're going to target financial institutions 146 146
healthcare companies, and even governments 147 147
because they all have large PII data sets 148 148
and that can be turned into money. 149 149
Additionally, they may go 150 150
after governments to carry out political objectives 151 151
like interfering in elections or spying 152 152
in another country to figure out what they're going to do 153 153
in the larger geopolitical spectrum. 154 154
Now, one other key thing 155 155
about an APT is generally an APT is not a single person 156 156
but it is a group of people. 157 157
Generally, you're going to have a staff that has 158 158
different realms of expertise. 159 159
For instance, I may have one person whose job it is to break 160 160
down the front door and get into the system. 161 161
I may have another person whose job it is to make sure 162 162
that when they're in that system they have persistence 163 163
and they don't get kicked out. 164 164
I may have another person who's a linguist who 165 165
can help me translate the information I'm getting. 166 166
For instance, we talked earlier about the fact 167 167
that Russia and China and North Korea all have teams 168 168
of APTs that go out and attack other companies 169 169
and countries and things like that. 170 170
Well, if I'm in China and I break into an American company 171 171
their information is probably written in English 172 172
and if my hacker only speaks Chinese or Mandarin 173 173
that would be an issue. 174 174
So we may have a linguist there to 175 175
help translate that information for them. 176 176
This is all the type of thing we have to think 177 177
about when we think about APTs because they are well funded. 178 178
They have a team of people 179 179
and they are all working together against you. 180 180
Now, I had just mentioned the idea of persistence. 181 181
What is persistence? 182 182
Persistence is the ability of a threat actor to 183 183
maintain covert access to a target host or network. 184 184
This means that once I break in 185 185
I can stay in your network for long periods of time. 186 186
Studies have shown that the average APT is on your network 187 187
for six to seven months before they are detected. 188 188
That is a long time, and they can do a lot of stuff 189 189
on that network without you ever knowing they're there. 190 190
And so that is going to be one 191 191
of the things we have to start figuring 192 192
out is how do we detect these APTs? 193 193
How can we find if they're in our network? 194 194
And as we go through this course 195 195
we'll talk more about indicators of compromise 196 196
and how we can start detecting them earlier 197 197
in the cycle so we can get them out of our network quicker.