Mandiant’s APT1 Domain/MD5 Intel and Security Onion with ELSA

Last night’s post on using domain and md5 lists from Mandiant’s Intel Report APT1: Exposing One of China’s Cyber Espionage Units focused on Security Onion for Splunk. If you’re using ELSA with your Security Onion deployment you can use the tool to run ELSA queries against a text file.

Download the Digital Appendix and Indicators zip file (md5 hashes are provided by Mandiant) and extract the files. Copy “Appendix D (Digital) – FQDNs.txt” and “Appendix E (Digital) – MD5s.txt” to your Security Onion Server (ELSA web node) and rename them to apt1_fqdn.txt and apt1_md5.txt.

sudo perl /opt/elsa/contrib/ -f /path/to/apt1_fqdn.txt -t > fqdn_hits.log

sudo perl /opt/elsa/contrib/ -f /path/to/apt1_md5.txt -t > md5_hits.log

The commands above will generate a log file containing each query term searched and any matching results that were returned.

Mandiant’s APT1 Domain/MD5 Intel and Security Onion for Splunk

Mandiant’s Intel Report APT1: Exposing One of China’s Cyber Espionage Units is loaded with indicators that organizations can use to identify whether they are or have been a victim of APT1. If you’re running the newest version of Security Onion, then you’ll definitely have data available to comb through for network, domain and md5 hash indicators. ELSA can help you with this process as can Security Onion for Splunk.

If you want a quick way to leverage the domain and md5 data in Security Onion for Splunk download the Digital Appendix and Indicators zip file (md5 hashes are provided by Mandiant) and extract the files. Make a copy of the files “Appendix D (Digital) – FQDNs.txt” and “Appendix E (Digital) – MD5s.txt” and rename them to apt1_fqdn.csv and apt1_md5.csv. Then you’ll need to edit the files so the first row contains the field header. For apt1_fqdn.csv add “domain” to the first row; for apt1_md5.csv add “md5” so they should look like this:

apt1_fqdn.csv example apt1_md5.csv example

Next, we need to upload the .csv files we edited so head to Security Onion for Splunk and click Manager > Lookups > Lookup Table files > New. The Destination app will be securityonion, then choose the files and specify the Destination filename to be the same as what we named the files (apt1_fqdn.csv and apt1_md5.csv).

Add lookup table

When you’ve uploaded both files you’ll need to change the permissions if you want other users to be able to run the queries by setting the permissions to Read for “This app only (securityonion).” Now head back to the Security Onion app, click the Search menu and run the following searches over all the Bro historical data you’ve got (dns.log and http.log specifically).

sourcetype=bro_dns [|inputlookup apt1_fqdn.csv | fields + domain] | fields dest_ip src_ip domain

sourcetype=bro_http [|inputlookup apt1_md5.csv | fields + md5] | fields dest_ip src_ip md5

If you get no matching events back, breathe a sigh of relief. If you do get results, start digging deeper!


Reflections on MIRcon

If you missed MIRcon 2011, you should tune in to Mandiant’s State of the Hack: What really happened at MIRcon webcast on October 28th. (Archived version should be available here.) There were some great talks from the likes of Richard Clarke, Michael Chertoff, and Tony Sager, and a lot of the greatest minds in incident response and cybersecurity either presented or were present. Kevin Mandia has assembled an insanely gifted and giving crew.

What did we learn? Organized crime, hacktivism and nation-states are the attackers and no target is invulnerable. Your only defense is to quickly identify and carefully disrupt attacks. Don’t be a soft target. The harder the attacker has to work, the more likely you’ll either stop them the next time or they’ll move on to a softer target. They understand and have seen firsthand the effects of cyber espionage: the skill, speed and agility of the attackers; the ineffectiveness of standard security infrastructure; the economic impact of personal, corporate and national data loss and compromise.

We cannot put a price on the ultimate impact of cybercrime. Sure, we all know someone who has had to deal with credit card fraud or has received one of those letters stating that your personal information “may” have been lost. That’s a huge hit on our economy. But it’s the tip of the iceberg. It’s what you see in the media and has the most potential to effect you personally. Now think corporate. Stealing PII is valuable. Attacking corporate bank accounts is profitable too. I believe it was Michael Chertoff who referred to “outsider trading” in his talk: stealing confidential corporate communications to leverage that information against the victim company in business negotiations. If you’re a bidder and you know the lowest bid in advance you can pretty much guarantee a win.

It doesn’t stop there. Richard Clarke told a great story about driving down a highway in Dubai where he saw an eighteen wheeler carrying a predator drone. He later asked Dubai officials when they had starting buying predators. “We haven’t.” they said.  “The US won’t sell them to us. That was a Flying Dragon.” Guess who they bought that from?

The ultimate impact seems immeasurable and there are no indications that it’s going to let up. In that sense, MIRcon was as depressing as I had expected. Actually, a little more so. Kevin Mandia’s opening remarks left my co-worker turning to me saying, “Wow. Depressing. Wow.” and me nodding affirmatively. Had it ended there I probably would be looking to buy some farmland and chickens far away from the Interwebs. Instead the next two days were filled with quality presentations, amazing technology and it’s uses, and real-world stories of victories and defeats. By the time Kevin gave his closing remarks I was still depressed, don’t get me wrong. It’s bleak. But some people get it. Some battles are being won. And at least some of the people fighting those battles are interested in helping you wage those battles yourself and providing tools and guidance to do so. There’s a rich, military background in the core of Mandiant. It’s quite apparent they’ve never abandoned service to their country.

/salute Mandiant

A beginning…a prediction

SANS was all over this right after Christmas. I’m glad to see it getting a bit more press and must admit that Deborah Gage’s write-up lacks the confusion we typically see in the media reporting of incidents. (Although I guess the media confusion applies to all subject matter.) If an infection subverts your anti-virus, you’re pretty much guaranteed to be screwed. In this case, you’ve been infected by some attackers that were willing to take more risks than normal in launching the attack; physical access is my greatest fear.

In short, several brands of digital picture frames were purchased in big name stores bearing an unexpected gift (read trojan horse). Simply connecting one of these fine products to your Windows computer would pretty much guarantee you a rootkit. We’ve heard this song before with hard drives and USB drives. This time, according to the article, we’re relatively lucky that the infection is only a keylogger that attempts to steal user names and passwords for select online games…for now.

Between downloaders, self-patching and self-healing malware, I won’t be surprised to see additional functionality from these infections in the coming months. And even if we don’t, we’re still looking at a source of attack that further damages the trust relationship we as consumers have with manufacturers. Lead in children’s toys? Poison in dog food? As much as they think they can, governments can’t effectively regulate everything and attack vectors like this are vulnerable. We have further proof of the need for awareness and caution.

I’m inclined to think this is a well-organized group behind this attack. The attack method is shrewd. You avoid the unreliability of social engineering and spam and eliminate the variables and risk of alluring someone to the infection. The attack is limited in that it will only initially infect consumers who purchase the tainted wares. The supply chain is fraught with opportunity to induce such an infection, from manufacturing to shipping/distribution to the reseller. But let’s imagine for a minute that the picture frame is wireless and displaying pictures of lattes and muffins at a Starbucks full of users enjoying the free wireless access. It starts to get a little scarier, doesn’t it?

So what better way to cap a new beginning than a prediction? In the not too distant future there is going to be another spate of attacks where the source of infection is a product tainted before it reaches the end-user and it will be a more malicious and effective attack than this one. Government will look to enforce some kind of regulation on any type of electronic device that interacts with another device and all the while we’ll be poisoning our animals and watching our kids chew on that shiny and colorful piece of lead.