Solarwinds供應鏈攻擊武器SUNBURST和TEARDROP分析
1. 事件描述
2020年12月，F(xiàn)ireEye發(fā)現(xiàn)一起針對許多組織(主要是針對美國科技公司)的大規(guī)模網(wǎng)絡攻擊已經(jīng)持續(xù)了幾個月。這次網(wǎng)絡攻擊具有一定程度的復雜性，導致外國政府迅速介入，這次攻擊中的戰(zhàn)術(shù)和技術(shù)細節(jié)非常出色。攻擊者沒有進行常規(guī)的網(wǎng)絡釣魚或者漏洞利用攻擊，而是進行了精心設計的供應鏈攻擊。在本文中，我們重點分析了Solarwinds供應鏈中使用的后門(SUNBURST)及其攻擊載荷之一(TEARDROP)的一些功能，包括對SUNBURST的哈希編碼字符串進行徹底的模糊處理以及對TEARDROP的控制流和解密方法的分析。
2. 技術(shù)細節(jié)分析
SUNBURST后門的技術(shù)細節(jié)已經(jīng)被很多公司和組織分析透徹，這使我們可以專注于我們感興趣的一個功能上進行深度分析，我們將分析后門精心設計的免殺方法。
SUNBURST所采用的規(guī)避技術(shù)在概念上類似于沙箱規(guī)避。沙盒規(guī)避的目的是確保惡意軟件不會在檢測惡意軟件的虛擬機上運行。
后門文件的黑名單不是以可讀字符串數(shù)組的形式給出的。而是將可讀字符串替換為FNV-1a哈希值。通常的惡意軟件都會采用此功能，，除了最近的一些惡意軟件會使用FNV-1a，而不是SHA256和CRC32校驗和，但這個后門厲害的地方在于它保持了代碼合法性。
后門作者對僅將進程和服務列入黑名單并不滿意，他們還將某些設備驅(qū)動程序和IP地址的整個范圍列入了黑名單，通過將受感染機器的IP轉(zhuǎn)換為域名，該功能用于將所有內(nèi)部Solarwinds域都列入了黑名單。這告訴我們，不僅攻擊者決定使用Solarwinds攻擊Uber到達目標，而且還詳細了解了Solarwinds內(nèi)部網(wǎng)絡的拓撲結(jié)構(gòu)?？傮w而言，嵌入在SUNBURST中的哈希編碼字符串列表是SUNBURST加入黑名單的200多個域。結(jié)果表明，即使是最先進，最頑強的攻擊者也不認為自己是無敵的，他們相信自己足夠立于不敗之地。
可在Addeneum I中找到SUNBURST中包含的FNV-1a混淆字符串的完整列表。
毫無疑問，這種攻擊是一項令人難以置信的大規(guī)模黑客技術(shù)成就。250多個組織被SolarWinds后門感染，其中一半在美國，在推送惡意代碼時，他們確保遵循Solarwinds的編碼約定;他們在其初始有效載荷中包含了“邏輯漏洞”，以將惡意活動從初始感染推遲整整兩周，并進行動態(tài)分析。他們將橫向移動限制為使用被盜但有效的用戶憑據(jù)進行的合法操作。出于所有這些原因，值得注意的是，這種Übermensch層的攻擊被用來部署TEARDROP，這僅僅是人為的惡意軟件刪除程序。
在發(fā)現(xiàn)之時，TEARDROP是一種新的攻擊載荷，從未見過，甚至可能是針對這種攻擊量身定制的。它僅針對少數(shù)幾個目標部署，TEARDROP在內(nèi)存中運行，但是它確實注冊了Windows服務，還會編輯注冊表。
TEARDROP的控制流程非常簡單，在服務執(zhí)行期間調(diào)用DLL導出函數(shù)Tk_CreateImageType，該函數(shù)將JPEG圖像寫入當前目錄，其名稱各不相同;賽門鐵克披露過upbeat_anxiety.jpg和festive_computer.jpg，F(xiàn)ireEye披露過gracious_truth.jpg。在未經(jīng)訓練的人看來，這些似乎是人為命名的。但是更有可能是通過將兩個硬編碼單詞連接在一起而在任意計算機上隨機生成的，而該機器是用來編譯該惡意軟件的。
然后TEARDROP使用自制密碼和硬編碼密0x96鑰執(zhí)行解密。使用以下方法來實現(xiàn)該過程：
從較高的角度看，這就像某種自制PRNG，它決定每次使用哪個密鑰字節(jié)。當動態(tài)運行時，生成的鍵索引可以簡單地映射到0, 1, 2, ..., 149, 0, 1, ...等等。事實證明，這不是PRNG，而是對模運算的編譯器優(yōu)化實現(xiàn)。
一旦了解了優(yōu)化，解密代碼就等同于以下內(nèi)容：
- CTXT_START_OFFSET = 0x30
- KEY_LENGTH = 0x96
- PREV_CTXT_BYTE_INITIAL_DEFAULT = 0xcc
- prev_ctxt_byte = PREV_CTXT_BYTE_INITIAL_DEFAULT
- for i, ctxt_byte in enumerate(ciphertext[CTXT_START_OFFSET:]):
- ptxt_byte = ctxt_byte ^ (prev_ctxt_byte ^ key[i % KEY_LENGTH])
- plaintext[i] = ptxt_byte
- prev_ctxt_byte = ctxt_byte
因此，原始加密是一個簡單的XOR，然后還將每個密文字節(jié)與前一個密文字節(jié)進行XOR，沒有人會隨機針對內(nèi)存中二進制Blob的Kasiski攻擊，以期遇到XOR密文。
解密后的有效負載具有以下自定義header格式，其讀取方式類似于正確的PE header：
第一幅圖顯示了在TEARDROP上找到的解密BEACON有效載荷的代碼，第二幅圖顯示了一個已知BEACON樣本的代碼，PE的基本地址一樣。
TEARDROP的BEACON有效載荷
TEARDROP的構(gòu)建方式擯棄了BEACON，它是Cobalt Strike 附帶的有效載荷。根據(jù)Cobalt Strike網(wǎng)站的說法，BEACON的目的是為高級攻擊者建模。它支持跨各種協(xié)議的網(wǎng)絡橫向移動，用于C2簽入的“被動”和“主動”模式，以及可用于模仿其他惡意軟件或與目標網(wǎng)絡的合法流量融合的可配置C2通信方案。
3. 分析總結(jié)
如果我們在這次攻擊事件發(fā)生后不得不做個總結(jié)，那就是“縱深防御”。似乎我們一直以來都是這樣的陳詞濫調(diào)，但它源于美國國家安全局(NSA)在2012年發(fā)表的一篇論文，其背后的原理是合理且相關(guān)的：不要將所有精力都花在建一堵墻上。沒有完美的圍墻，總有一天，有人會穿過這面墻。
通過分析SUNBURST和TEARDROP的二進制文件，我們了解到，即使這個非常成功的攻擊也存在問題。為了確保這一點，必須創(chuàng)建大量的域和進程黑名單。
0x04 附錄I：SUNBURST中包含的FNV-1a混淆字符串列表
- Processes:
- 2597124982561782591 = apimonitor-x64
- 2600364143812063535 = apimonitor-x86
- 13464308873961738403 = autopsy64
- 4821863173800309721 = autopsy
- 12969190449276002545 = autoruns64
- 3320026265773918739 = autoruns
- 12094027092655598256 = autorunsc64
- 10657751674541025650 = autorunsc
- 11913842725949116895 = binaryninja
- 5449730069165757263 = blacklight
- 292198192373389586 = cff explorer
- 12790084614253405985 = cutter
- 5219431737322569038 = de4dot
- 15535773470978271326 = debugview
- 7810436520414958497 = diskmon
- 13316211011159594063 = dnsd
- 13825071784440082496 = dnspy
- 14480775929210717493 = dotpeek32
- 14482658293117931546 = dotpeek64
- 8473756179280619170 = dumpcap
- 3778500091710709090 = evidence center
- 8799118153397725683 = exeinfope
- 12027963942392743532 = fakedns
- 576626207276463000 = fakenet
- 7412338704062093516 = ffdec
- 682250828679635420 = fiddler
- 13014156621614176974 = fileinsight
- 18150909006539876521 = floss
- 10336842116636872171 = gdb
- 12785322942775634499 = hiew32demo
- 13260224381505715848 = hiew32
- 17956969551821596225 = hollows_hunter
- 8709004393777297355 = idaq64
- 14256853800858727521 = idaq
- 8129411991672431889 = idr
- 15997665423159927228 = ildasm
- 10829648878147112121 = ilspy
- 9149947745824492274 = jd-gui
- 3656637464651387014 = lordpe
- 3575761800716667678 = officemalscanner
- 4501656691368064027 = ollydbg
- 10296494671777307979 = pdfstreamdumper
- 14630721578341374856 = pe-bear
- 4088976323439621041 = pebrowse64
- 9531326785919727076 = peid
- 6461429591783621719 = pe-sieve32
- 6508141243778577344 = pe-sieve64
- 10235971842993272939 = pestudio
- 2478231962306073784 = peview
- 9903758755917170407 = peview
- 14710585101020280896 = ppee
- 13611814135072561278 = procdump64
- 2810460305047003196 = procdump
- 2032008861530788751 = processhacker
- 27407921587843457 = procexp64
- 6491986958834001955 = procexp
- 2128122064571842954 = procmon
- 10484659978517092504 = prodiscoverbasic
- 8478833628889826985 = py2exedecompiler
- 10463926208560207521 = r2agent
- 7080175711202577138 = rabin2
- 8697424601205169055 = radare2
- 7775177810774851294 = ramcapture64
- 16130138450758310172 = ramcapture
- 506634811745884560 = reflector
- 18294908219222222902 = regmon
- 3588624367609827560 = resourcehacker
- 9555688264681862794 = retdec-ar-extractor
- 5415426428750045503 = retdec-bin2llvmir
- 3642525650883269872 = retdec-bin2pat
- 13135068273077306806 = retdec-config
- 3769837838875367802 = retdec-fileinfo
- 191060519014405309 = retdec-getsig
- 1682585410644922036 = retdec-idr2pat
- 7878537243757499832 = retdec-llvmir2hll
- 13799353263187722717 = retdec-macho-extractor
- 1367627386496056834 = retdec-pat2yara
- 12574535824074203265 = retdec-stacofin
- 16990567851129491937 = retdec-unpacker
- 8994091295115840290 = retdec-yarac
- 13876356431472225791 = rundotnetdll
- 14968320160131875803 = sbiesvc
- 14868920869169964081 = scdbg
- 106672141413120087 = scylla_x64
- 79089792725215063 = scylla_x86
- 5614586596107908838 = shellcode_launcher
- 3869935012404164040 = solarwindsdiagnostics
- 3538022140597504361 = sysmon64
- 14111374107076822891 = sysmon64
- 7982848972385914508 = task explorer
- 8760312338504300643 = task explorer-x64
- 17351543633914244545 = tcpdump
- 7516148236133302073 = tcpvcon
- 15114163911481793350 = tcpview
- 15457732070353984570 = vboxservice
- 16292685861617888592 = win32_remote
- 10374841591685794123 = win64_remotex64
- 3045986759481489935 = windbg
- 17109238199226571972 = windump
- 6827032273910657891 = winhex64
- 5945487981219695001 = winhex
- 8052533790968282297 = winobj
- 17574002783607647274 = wireshark
- 3341747963119755850 = x32dbg
- 14193859431895170587 = x64dbg
- 17439059603042731363 = xwforensics64
- 17683972236092287897 = xwforensics
- 700598796416086955 = redcloak
- 3660705254426876796 = avgsvc
- 12709986806548166638 = avgui
- 3890794756780010537 = avgsvca
- 2797129108883749491 = avgidsagent
- 3890769468012566366 = avgsvcx
- 14095938998438966337 = avgwdsvcx
- 11109294216876344399 = avgadminclientservice
- 1368907909245890092 = afwserv
- 11818825521849580123 = avastui
- 8146185202538899243 = avastsvc
- 2934149816356927366 = aswidsagent
- 13029357933491444455 = aswidsagenta
- 6195833633417633900 = aswengsrv
- 2760663353550280147 = avastavwrapper
- 16423314183614230717 = bccavsvc
- 2532538262737333146 = psanhost
- 4454255944391929578 = psuaservice
- 6088115528707848728 = psuamain
- 13611051401579634621 = avp
- 18147627057830191163 = avpui
- 17633734304611248415 = ksde
- 13581776705111912829 = ksdeui
- 7175363135479931834 = tanium
- 3178468437029279937 = taniumclient
- 13599785766252827703 = taniumdetectengine
- 6180361713414290679 = taniumendpointindex
- 8612208440357175863 = taniumtracecli
- 8408095252303317471 = taniumtracewebsocketclient64
- Services:
- windows Defender:
- 5183687599225757871 = msmpeng
- 917638920165491138 = windefend
- Windows Sense:
- 10063651499895178962 = mssense
- 16335643316870329598 = sense
- Windows Sensor:
- 10501212300031893463 = microsoft.tri.sensor
- 155978580751494388 = microsoft.tri.sensor.updater
- NIST:
- 17204844226884380288 = cavp
- Carbon Black:
- 5984963105389676759 = cb
- 11385275378891906608 = carbonblack
- 13693525876560827283 = carbonblackk
- 17849680105131524334 = cbcomms
- 18246404330670877335 = cbstream
- CrowdStrike:
- 8698326794961817906 = csfalconservice
- 9061219083560670602 = csfalconcontainer
- 11771945869106552231 = csagent
- 9234894663364701749 = csdevicecontrol
- 8698326794961817906 = csfalconservice
- FireEye:
- 15695338751700748390 = xagt
- 640589622539783622 = xagtnotif
- 9384605490088500348 = fe_avk
- 6274014997237900919 = fekern
- 15092207615430402812 = feelam
- 3320767229281015341 = fewscservice
- ESET:
- 3200333496547938354 = ekrn
- 14513577387099045298 = eguiproxy
- 607197993339007484 = egui
- 15587050164583443069 = eamonm
- 9559632696372799208 = eelam
- 4931721628717906635 = ehdrv
- 2589926981877829912 = ekrnepfw
- 17997967489723066537 = epfwwfp
- 14079676299181301772 = ekbdflt
- 17939405613729073960 = epfw
- F-SECURE:
- 521157249538507889 = fsgk32st
- 14971809093655817917 = fswebuid
- 10545868833523019926 = fsgk32
- 15039834196857999838 = fsma32
- 14055243717250701608 = fssm32
- 5587557070429522647 = fnrb32
- 12445177985737237804 = fsaua
- 17978774977754553159 = fsorsp
- 17017923349298346219 = fsav32
- 17624147599670377042 = f-secure gatekeeper handler starter
- 16066651430762394116 = f-secure network request broker
- 13655261125244647696 = f-secure webui daemon
- 3421213182954201407 = fsma
- 14243671177281069512 = fsorspclient
- 16112751343173365533 = f-secure gatekeeper
- 3425260965299690882 = f-secure hips
- 9333057603143916814 = fsbts
- 3413886037471417852 = fsni
- 7315838824213522000 = fsvista
- 13783346438774742614 = f-secure filter
- 2380224015317016190 = f-secure recognizer
- 3413052607651207697 = fses
- 3407972863931386250 = fsfw
- 10393903804869831898 = fsdfw
- 3421197789791424393 = fsms
- 541172992193764396 = fsdevcon
- Drivers:
- 17097380490166623672 = cybkerneltracker.sys
- 15194901817027173566 = atrsdfw.sys
- 12718416789200275332 = eaw.sys
- 18392881921099771407 = rvsavd.sys
- 3626142665768487764 = dgdmk.sys
- 12343334044036541897 = sentinelmonitor.sys
- 397780960855462669 = hexisfsmonitor.sys
- 6943102301517884811 = groundling32.sys
- 13544031715334011032 = groundling64.sys
- 11801746708619571308 = safe-agent.sys
- 18159703063075866524 = crexecprev.sys
- 835151375515278827 = psepfilter.sys
- 16570804352575357627 = cve.sys
- 1614465773938842903 = brfilter.sys
- 12679195163651834776 = brcow_x_x_x_x.sys
- 2717025511528702475 = lragentmf.sys
- 17984632978012874803 = libwamf.sys
- domain names:
- 1109067043404435916 = swdev.local
- 15267980678929160412 = swdev.dmz
- 8381292265993977266 = lab.local
- 3796405623695665524 = lab.na
- 8727477769544302060 = emea.sales
- 10734127004244879770 = cork.lab
- 11073283311104541690 = dev.local
- 4030236413975199654 = dmz.local
- 7701683279824397773 = pci.local
- 5132256620104998637 = saas.swi
- 5942282052525294911 = lab.rio
- 4578480846255629462 = lab.brno
- 16858955978146406642 = apac.lab
- HTTP:
- 8873858923435176895 = expect
- 6116246686670134098 = content-type
- 2734787258623754862 = accept
- 6116246686670134098 = content-type
- 7574774749059321801 = user-agent
- 1475579823244607677 = 100-continue
- 11266044540366291518 = connection
- 9007106680104765185 = referer
- 13852439084267373191 = keep-alive
- 14226582801651130532 = close
- 15514036435533858158 = if-modified-since
- 16066522799090129502 = date
本文翻譯自：https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/
