BlackHat USA 2016

When Governments Attack!
Eva Galperin / Global Policy Analyst / eva@eff.org
Cooper Quintin / Staff Technologist / cooperq@eff.org

BlackHat USA 2016

Whois?

Eva Galperin

Cooper Quintin

Morgan Marquis-Boire Claudio Guarnieri

BlackHat USA 2016

What is EFF?

BlackHat USA 2016

“What Binge On does, it includes a
proprietary technology and what thetechnology does is not only detect thevideo stream but select theappropriate bit rate to optimize to thevideo, the mobile device. That’s part Aof my answer. Part B of my answer is,
who the fuck are you, anyway, EFF?
Why are you stirring up so muchtrouble, and who pays you?” - John
LegereBlackHat USA 2016

Q: Who the Fuck are you, anyway, EFF?

BlackHat USA 2016

Legal WorkBlackHat USA 2016

BlackHat USA 2016

Q: Why are you stirring up so muchtrouble?

BlackHat USA 2016

ActivismBlackHat USA 2016

International WorkBlackHat USA 2016

Technology

BlackHat USA 2016

Q: Who pays you?

BlackHat USA 2016

Targeted Attacks

BlackHat USA 2016

BlackHat USA 2016

EthiopiaBlackHat USA 2016

Iran

BlackHat USA 2016

Pawn Storm / FancyBear / APT28

BlackHat USA 2016

Nobody Cares About Kazakhstan

Operation ManulBlackHat USA 2016

Kazakhstan is here!

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

KZ!

BlackHat USA 2016

KZ!

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

NO DOGS WERE HARMED IN THE MAKING OF THIS TALK.
WE LOVE DOGS.
PLEASE ENJOY THIS UNICORN PICTURE.

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

I got a letter from the government the other day...

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

Mukhtar Ablyazov

BlackHat USA 2016

Unveiling Operation ManulBlackHat USA 2016

BlackHat USA 2016

JRat / Jacksbot

BlackHat USA 2016

JRat / Jacksbot• Java Based• Multi Platform– Win, Mac, Linux, Solaris, *BSD

• Plugin Architecture and API• Cheap!

BlackHat USA 2016

JRat / Jacksbot

Server UI

BlackHat USA 2016

JRat / Jacksbot

View Remote ScreenBlackHat USA 2016

JRat / Jacksbot

Control PanelBlackHat USA 2016

JRat / Jacksbot - Other Features• Process List
• Remote Shell• Chat• Edit Registry• Manage Remote Filesystem

BlackHat USA 2016

JRat / Jacksbot - Plugins• Turn on remote webcam• Disable webcam indicator light• Password Recovery• Keylogger• Reverse SOCKS Proxy• Roll Your Own...

BlackHat USA 2016

JRat / Jacksbot - Anti Analysis• Bytecode obfuscated with Zendix KlassMaster• Encrypted config file
• Decryption key hidden in zip file metadata• Detect VirtualizationBlackHat USA 2016

Bandook••••

Another off the shelf, commodity RAT
Continuously developed over a number of years
Only targets Windows
Modular:– Start shell, record sound, record video,
keylogger, take screenshots, etc. etc.

BlackHat USA 2016

C&C Servers
Axroot.com, Adobeair.net, kaliex.net…
• Windows servers, running XAMPP• Do not appear to be shared hosts– Not many domains / shared document root

• But they are not sitting idle!
– Many open ports and many open directories

BlackHat USA 2016

C&C Servers
Axroot.com, Adobeair.net, kaliex.net…
• Windows servers, running XAMPP• Do not appear to be shared hosts– Not many domains / shared document root

• But they are not sitting idle!
– Many open ports and many open directories

BlackHat USA 2016

Other Targets

BlackHat USA 2016

Other Targets

BlackHat USA 2016

Attribution Is HardBlackHat USA 2016

Links to Kazakhstan• Common thread between targets– Legal disputes against KZ government• Phishing at private email address– Subpoenaed by Kazakhstan• Arcanum Global Intelligence– Cyber Intelligence Operations– Hired by KZ to gather intel on Ablyazov family

BlackHat USA 2016

BlackHat USA 2016

Links Between Operation Manuland Appin• Overlapping domains with hangover,including appinsecurity.com• Alleged use of Hackback trojan / similar totrojan used in Oslo
– Unable to verify thisBlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

Other Considerations

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

BlackHat USA 2016

It doesn’t need to be sophisticated to work.

BlackHat USA 2016

We could(n’t) be heroes

BlackHat USA 2016

What do we do?
• Outreach community relations/trust building• Incident response malware analysis/forensics/threat intel• Education training/IT support/help desk
• Policy research legal/law enforcement• Advocacy awareness/policy change• Follow up with other affected parties

BlackHat USA 2016

What do we do?
• Outreach community relations/trust building• Incident response malware analysis/forensics/threat intel• Education training/IT support/help desk
• Policy research legal/law enforcement• Advocacy awareness/policy change• Follow up with other affected parties

BlackHat USA 2016

What is to be done?

BlackHat USA 2016

What industry can do• Anti-virus state sponsored warnings• Better state-sponsored warnings

BlackHat USA 2016

What you can doBlackHat USA 2016

BlackHat USA 2016

Pick a cause you care about

and get involved.

BlackHat USA 2016

What Else Can You Do?
• If you have research related to the actors
behind Operation Manul publish it, or send
it to us!
• Donate to EFF!

BlackHat USA 2016

Takeaways• None of this research is “sexy”. The tools andthe actors aren’t sophisticated.
• Attacks don’t need to be sophisticated towork.
• But it’s not every day that malware research
can prevent people from getting kidnapped orkilled, and expose state crimes.

BlackHat USA 2016

Acknowledgements• Huge thanks to our fellow researchers: Morgan MarquisBoire and Claudio Guarnieri.
• Operation Hangover: Snorre Fagerland, Morten Kråkvik,
Jonathan Camp, Ned Moran.
• Hex-Rays, Joe Sandbox, Virus Total, Passive Total fordonation of their services and software.
• Additionally we’d like to thank David Greene, Jamie Lee
Williams, Meghan Fenzel, Nate Cardozo, Kurt Opsahl,
Soraya Okuda, and Marion Marschalek, for their patience,
help, support, and advice.

BlackHat USA 2016

Further Reading
Operation Hangover: http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_India…
Oslo Freedom Forum: https://www.f-secure.com/weblog/archives/00002554.html
Iran 2FA Spearphishing: https://citizenlab.org/2015/08/iran_two_factor_phishing/
Pawn Storm EFF Report: https://www.eff.org/deeplinks/2015/08/new-spear-phishing….
Wassenaar: https://www.eff.org/deeplinks/2015/05/we-must-fight-proposed-us-wassenaar-impl….
Kidane V. Ethiopia: https://www.eff.org/cases/kidane-v-ethiopia
Ethiopia and FinFisher: https://citizenlab.org/2013/03/you-only-click-twice-finfishers-global...
Human Rights Watch Report on Kazakhstan: https://www.hrw.org/world-report/2015/countrychapters/kazakhstan