ANU hacked by phishing email through the preview pane



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    Assuming Outlook was the culprit for this attack, and Outlook uses IE and Word to display stuff - it's very conceivable that a zero-click exploit was used against these people.

    Assuming Outlook is the culprit, then the wording of the result is untrue. We assume this to be true, but to do so means you have already assumed them to be lying.

    And Outlook is simply automating clicks. Under normal circumstances, we don't call that zero interaction. It's a predetermined, automated interaction.

    The email layer itself is safe from this. It required an additional, unique application to be told to run code where code isn't supposed to exist. In no other situation do we call that a zero touch situation. If you automated an attack with a script anywhere else, you'd never accept that wording.



  • @DustinB3403 said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    @DustinB3403 said in ANU hacked by phishing email through the preview pane:

    I'd bet dollars to donuts that the attachment was opened, and contained some malicious software that allowed the attacker in.

    This claim of "they didn't even open the email" is absurd, someone absolutely opened an email, clicked a link or opened an attachment.

    why do you claim this? do you not believe there are zero-click exploits in anything?

    Chrome and IE both recently had zero click exploits - simply visiting a webpage would exploit them and give full control to a hacker.
    Assuming Outlook was the culprit for this attack, and Outlook uses IE and Word to display stuff - it's very conceivable that a zero-click exploit was used against these people.

    The claim that the email wasn't opened is a false claim - as almost everyone these days uses preview mode - which is the same as opening the email.

    I find it weird because the 20 page summary of the issues shows the spearfishing attempts! They clearly opened the emails to get those screenshots they provided.

    If their security team opened it, then certainly the end user did.

    I did not once say that zero-clicks don't exist, I just find it highly unlikely with the low quality of the spearfishing attempts made.

    I haven't looked at the 20 page paper yet - Thought I thought they only said (through quotes here) that yes, the email was opened - but no - no links/attachments were opened.

    are you saying that they did in fact claim the emails themselves were never opened?



  • Dash, the story and summation says this

    Spearfishing attempt to targeted users then an internal system was compromised.

    Not that there was some magical 0-day no-click that immediately allowed the hackers in. Is it possible, maybe, but the much more believable thing to have occurred is that from the first spearfishing attack, someone opened the attachment.



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    The claim that the email wasn't opened is a false claim - as almost everyone these days uses preview mode - which is the same as opening the email.

    Right, and this establishes that either they are just making things up because even "what email is" is something that they don't understand: in which case we must assume the entire event is false information.

    Or if they do know what email is, then they are malicious actors trying to cover something up.

    In either case, the result is "we can't trust their explanantion of events."



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Nic said in ANU hacked by phishing email through the preview pane:

    @nadnerB said in ANU hacked by phishing email through the preview pane:

    Here's a better article: https://www.itnews.com.au/news/anu-hackers-built-shadow-ecosystem-to-stay-hidden-for-six-weeks-531803

    Here's the link straight to the PDF of the report that has all the details in it:
    http://imagedepot.anu.edu.au/scapa/Website/SCAPA190209_Public_report_web_2.pdf

    Here is a bit that is odd from that...

    "The initial means of infection was a sophisticated spearphishing email which did not require user
    interaction, ie clicking on a link or downloading an attachment."

    Why would they bother making a "sophisticated spearphishing" attack, if the email didn't require any interaction? The spearphishing would be entirely pointless. So this is beyond fishy.

    They then define spearphishing as: " Spear-phishing emails are a form of malicious email targeting an individual or organisation. They mimic legitimate mail and contain malicious attachments or links designed to steal credentials or enable the install malware."

    So by claiming that it was spearphishing, and defining spearphishing, they now have conflicting claims. In one case they claimed that it contained malicious attachments or links, in the other they claim that it did not.

    yeah - it's bad writing for sure... but it could easily be both... If there was an unpatched vulnerability, that would be exploited.. but they could also include a link to an infected page in case there was no zero-click vulnerability.

    That's possible. But if so, feels like it makes the whole thing even worse.



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    I haven't looked at the 20 page paper yet - Thought I thought they only said (through quotes here) that yes, the email was opened - but no - no links/attachments were opened.

    The official wording is that they "only previewed it", which is fine to say. And that they did not "open an attachment". Totally different than what the article said that they said.



  • If there was some 0-day no-click that was to be exploited, the attacker could've sent a blank email to any number of targets at the university and been on the network.

    There would be no reason to draft something up like with the multiple spearfishing examples that were prominently displayed.

    And their 2 big takeaways from this attack was User training for spearfishing and PII privacy protections.

    Not some factor of severely outdated software needing better maintenance.



  • "20−21 November 2018: the creation of attack station one.
    Over the course of two days the actor downloaded tools and scripts to build attack station one. To
    download these tools the actor also compromised a second Internet facing webserver using a webshell
    and used this server to download software tools to attack station one. These tools were used to run
    scripts and perform remote management tasks including scheduled deletion of logs to hide their
    activities. The actor started to map the ANU network on 21 November. "

    They built an attack station remotely? This sounds fine until you hear the second part...

    "22 November 2018: the creation of virtual machines on attack station one.
    The following day the actor set up two virtual machines on attack station one, one using Windows XP
    and the second Kali Linux.
    Both operating systems were download using BitTorrent. "


    So this was nested virtualization? Or somehow they managed to gain access to a physical box that they totally took over? They never mention the hypervisor at play here, but this is some crazy stuff that they are glossing over.



  • Other software used by the actor included network session capture and mapping tools, bespoke
    clean-up, JavaScript and PowerShell scripts as well as a proxy tool. The actor downloaded several
    types of virtualisation software before selecting one and downloaded disk images for Windows XP and
    Kali Linux. There is little evidence to suggest much use of Kali Linux.
    

    Ha. . . so the hacker setup VM's on your network and used WINDOWS XP to own this school's systems for 6 weeks. . .



  • " The actor also gained access (through remote desktop) to a machine in a school which had a publicly routable IP address. Age and permissiveness of the machine and its operating system are the likely reasons the actor compromised this machine"

    OMG... they exposed RDP on an outdated OS to the Internet and gave it a routable IP address!



  • @scottalanmiller Probably windows xp!



  • Okay, so @scottalanmiller this is from the analysis portion

        The first phishing email was designed to be interaction-less and likely used some form of scripting. It is assumed the actor anticipated a high degree of security awareness on the part of the intended recipient. Unfortunately, a copy of this email was not recoverable, so further analysis is not possible. 
         
        Subsequent phishing attachments were designed to harvest credentials and used similar scripts. The user opened the attached Word document and the credentials were sent to the remote server. All the attachments in the second, third and fourth spear-phishing cycles used the same technique with the credentials sent to the active attack station instead of the internet.
    

    Does that really count as no-click? I'd think this is more a scripted execution of their email client being allowed to execute scripts.



  • The article even got the year estimation wrong.

    19 years, not 20.

    Due to the operational security and clean-up operations of the actor, it has not been possible to retrieve copies of the files exfiltrated from the network. In some cases, there was enough forensic and log data to ascertain file sizes. However, because these files were compressed and likely to have been encrypted, it is difficult to infer what specific data sets was taken from the affected systems. However, based on log analysis and known data volumes it is highly likely that the actor took much less than the 19 years’ worth of data first noted at the time of the breach announcement.
    

    From the article

    The university confirmed the attack months after it occurred, and is now thought to have netted "considerably less" than 20 years worth of data as originally expected.


  • This bit is disconcerting.

    The purpose of this code remains unknown, and no forensic traces of it or the executable file which was compiled from the code have been found at the time of this report. 
    

    Meaning, you have the executable and can't tell what it's supposed to do?

    Because and this is key, the above is led with;

    There is also evidence of bespoke malware in the form of source code (compiled within the network) used to gain access to ESD.


  • Repeatedly throughout this summary, are "Outdated systems" targeted by the attacker. Meaning that this school routinely sets up systems for some purpose and runs it until it's dead, never updating them.

    Only having been caught with their pants down did they take these out of date systems offline.



  • @DustinB3403 said in ANU hacked by phishing email through the preview pane:

    If there was some 0-day no-click that was to be exploited, the attacker could've sent a blank email to any number of targets at the university and been on the network.

    There would be no reason to draft something up like with the multiple spearfishing examples that were prominently displayed.

    And their 2 big takeaways from this attack was User training for spearfishing and PII privacy protections.

    Not some factor of severely outdated software needing better maintenance.

    you missed the whole point where I said perhaps the zero-day was patched, or otherwise prevented from being exploited.. so making the email with multiple attack vectors would be good.

    Also, a blank email might trip their spam filter and get killed, etc.



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    " The actor also gained access (through remote desktop) to a machine in a school which had a publicly routable IP address. Age and permissiveness of the machine and its operating system are the likely reasons the actor compromised this machine"

    OMG... they exposed RDP on an outdated OS to the Internet and gave it a routable IP address!

    nothing unsurprising here, really.



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    "20−21 November 2018: the creation of attack station one.
    Over the course of two days the actor downloaded tools and scripts to build attack station one. To
    download these tools the actor also compromised a second Internet facing webserver using a webshell
    and used this server to download software tools to attack station one. These tools were used to run
    scripts and perform remote management tasks including scheduled deletion of logs to hide their
    activities. The actor started to map the ANU network on 21 November. "

    They built an attack station remotely? This sounds fine until you hear the second part...

    I don't understand the need to compromise a second machine, was the first compromised machine unable to get the desired tools because of a web filter?

    "22 November 2018: the creation of virtual machines on attack station one.
    The following day the actor set up two virtual machines on attack station one, one using Windows XP
    and the second Kali Linux.
    Both operating systems were download using BitTorrent. "


    So this was nested virtualization? Or somehow they managed to gain access to a physical box that they totally took over? They never mention the hypervisor at play here, but this is some crazy stuff that they are glossing over.

    Why do you assume nested virtualization? Isn't station one a user's laptop/desktop? Assuming Windows 10, the attacker could have enabled Hyper-V then ran two VMs there. Or they could have installed virtualbox and built VMs there... I see no reason to consider nested virtualization.



  • @Dashrender one interesting tidbit from the Brian Krebs talk at SpiceWorld 2019 was him talking about how hackers typically take a couple weeks to surveil the landscape before executing their payload. Them getting in and then taking time to reinforce their toehold into the environment sounds like it's the norm now.



  • @DustinB3403 said in ANU hacked by phishing email through the preview pane:

    Does that really count as no-click? I'd think this is more a scripted execution of their email client being allowed to execute scripts.

    Has to be scripted execution for some environment. Email itself is plain text and cannot be a threat until a scripted execution decides to treat it as an executable.



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    Why do you assume nested virtualization? Isn't station one a user's laptop/desktop? Assuming Windows 10, the attacker could have enabled Hyper-V then ran two VMs there. Or they could have installed virtualbox and built VMs there... I see no reason to consider nested virtualization.

    Because they got a platform first. Then they created VMs on it. Where was this machine hiding if it was a physical machine? Anything like Hyper-V, VirtualBox, etc. would be incredibly noticeable. Especially given that we know how old the equipment that they were running there is. How you could hide building an attack platform on someone's desktop is beyond me. How the hell would no one notice?



  • @Nic said in ANU hacked by phishing email through the preview pane:

    @Dashrender one interesting tidbit from the Brian Krebs talk at SpiceWorld 2019 was him talking about how hackers typically take a couple weeks to surveil the landscape before executing their payload. Them getting in and then taking time to reinforce their toehold into the environment sounds like it's the norm now.

    They've had time to figure out that even big shops like a huge university have nothing looking for breaches, and nothing being secured. So why try to be fast?



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    Why do you assume nested virtualization? Isn't station one a user's laptop/desktop? Assuming Windows 10, the attacker could have enabled Hyper-V then ran two VMs there. Or they could have installed virtualbox and built VMs there... I see no reason to consider nested virtualization.

    Because they got a platform first. Then they created VMs on it. Where was this machine hiding if it was a physical machine? Anything like Hyper-V, VirtualBox, etc. would be incredibly noticeable. Especially given that we know how old the equipment that they were running there is. How you could hide building an attack platform on someone's desktop is beyond me. How the hell would no one notice?

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.
    I could easily see this being an executive machine that's more power than he ever needs, so having those VMs running there could be barely noticeable, and if the attacker was using the machine mainly while the user wasn't, then it would be even less noticeable to the end user.



  • @Dashrender we know that station one was out of date, presumably running a much older OS as these systems were fully decommissioned once this was all discovered.

    I would be highly suspect if hyperv was able to be setup on these systems, more likely some version of virtual box was installed, and used to run the operation from.



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.

    That's reasonable, but how the heck did they commandeer a desktop, install a hypervisor, run multiple VMs, and no one notice!!



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.

    That's reasonable, but how the heck did they commandeer a desktop, install a hypervisor, run multiple VMs, and no one notice!!

    That I would guess is the million dollar question. Like did they have workstations setup randomly throughout the school, like tucked in a closet and people just forgot to remove them?



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.

    That's reasonable, but how the heck did they commandeer a desktop, install a hypervisor, run multiple VMs, and no one notice!!

    I really don't understand your lack of understanding? Do you expect that something would show up to the user, something other than the performance hit? As I said, if the hacker only used the computer when the normal user was off, then it's very easy to see that that normal user would not see the performance drop.



  • @Dashrender said in ANU hacked by phishing email through the preview pane:

    @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.

    That's reasonable, but how the heck did they commandeer a desktop, install a hypervisor, run multiple VMs, and no one notice!!

    I really don't understand your lack of understanding? Do you expect that something would show up to the user, something other than the performance hit? As I said, if the hacker only used the computer when the normal user was off, then it's very easy to see that that normal user would not see the performance drop.

    I suppose. But do you have a machine in your environment that could handle even the storage requirements of multiple VMs without causing issues? We are talking about a school running old machines here. Taking old equipment and "hiding" a ton of resources is harder than it sounds.



  • @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    @scottalanmiller said in ANU hacked by phishing email through the preview pane:

    @Dashrender said in ANU hacked by phishing email through the preview pane:

    I still haven't read the 20 page doc... but I'm completely assuming the the attack station is a person's desktop, something that was commandeered via the phishing attack. It seemed likely that that machine is where they installed a hyper-visor.

    That's reasonable, but how the heck did they commandeer a desktop, install a hypervisor, run multiple VMs, and no one notice!!

    I really don't understand your lack of understanding? Do you expect that something would show up to the user, something other than the performance hit? As I said, if the hacker only used the computer when the normal user was off, then it's very easy to see that that normal user would not see the performance drop.

    I suppose. But do you have a machine in your environment that could handle even the storage requirements of multiple VMs without causing issues? We are talking about a school running old machines here. Taking old equipment and "hiding" a ton of resources is harder than it sounds.

    They said XP and something else - XP, depending on the tools used by the attacker is 20 GB base, call it another 20 GB for tools - yes, every machine in my environment could give up 40 GB of storage.
    And if the machines are really that old - then I would fully expect them to have 500 GB HDD, making this even less of an issue than my machines that only have 128 GB SSDs.

    Most corporate machines barely require any local storage at all. My normal install uses around 30 GB today with windows 10. The desktop is really the only place anyone stores anything, the rest is in folder redirected documents folder, which really lives on the network (may or may not have local copy).



  • @Dashrender Except that we know that this environment isn't run like a corporation, since they have machines that were completely unaccounted for; for some duration of time that people forgot about them and those machines were targeted and used.

    The summation of this is that; this university is absolutely a joke, run by people who don't take their responsibilities seriously and were hoping to never have any issue occur ever.

    Edit: Typo corrected in bold.


Log in to reply