Author: DarkOwl Content Team

May 31, 2024

RSA Conference in San Francisco, this year held May 6-9, is one of biggest and most anticipated cybersecurity events of the year. The DarkOwl team plans and looks forward to RSA each year; to see friendly and new faces alike, hear the latest trends, news and innovations in cybersecurity, share our latest product updates and offerings, and of course have some fun around San Francisco. This year, the team had a booth on the show floor, a private meeting space around the corner from Moscone Center to hold one-to-one meetings with prospects, partners, press, and clients, and for the first year ever, host a party with several of our customers and partners on Tuesday night!

“The Art of Possible”

The RSA Conference slogan, “Where the World Talks Security” is the perfect quick elevator pitch for what happens each year at RSA – thousands of security professionals from around the globe gather together to hear and discuss new and leading perspectives, innovation and best practices. The most memorable RSA moments can be found on their website here.

The theme of RSA this year was “The Art of Possible.” According to Dr. Hugh Thompson, Executive Chairman of RSAC and Program Committee Chair in his keynote speech describes the theme as “a phrase that, on the one hand, is meant to inspire hope, but it also serves as a warning. We should never underestimate what is possible by our adversaries.” It is a great point as over 40,000 cyber security professionals across 130 countries around the globe all gather at RSA.

DarkOwl Highlights

Representing the DarkOwl team, we had several executive team members, sales reps, customer success managers, and analysts present manning the booth and holding private one-to-one meetings. Of note, DarkOwl Chief Business Officer, Alison Halland, shared, “Great week of seeing new and friendly faces alike – tons of great conversations, especially at the booth which a welcomed change of pace – not just attendees looking for some freebies, but genuinely interested in what DarkOwl has to offer.” Magnus Svärd, Director of Strategic Partnerships, echoed that sentiment, “RSA this year was the busiest yet with a higher number of meetings compared to previous years. The names of the companies were top tier visiting the booth.”

Big shoutout to all our customers and partners that stopped by the booth to say hi, see the latest updates and provide feedback. These face-to-face conversations are invaluable to us as we work towards making darknet data relevant, actionable, and digestible for all our clients!

Showcasing Customers and Partners

This year, we were happy to host several sessions at our booth, highlighting the work that we do with different customers. We hosted OSINT Combine, Silobreaker, Authentic8 and Datastreamer. This was a great way to showcase how we work together. Below, we briefly summarize how DarkOwl works with each of these companies.

OSINT Combine

This collaboration empowers OSINT Combine’s clients with access to DarkOwl’s extensive darknet database, bolstering their open-source intelligence capabilities and enabling them to address complex operational requirements more effectively through training, software solutions, and consulting services. Read more.

Silobreaker

DarkOwl’s robust darknet data enables our customer, Silobreaker, to provide their customers enriched monitoring of deep, dark web and dark web adjacent sites to help identify risk at scale and drive better decision-making. Use Case here.

Authentic8

This partnership brings together the advanced technologies and expertise of both Authentic8 and DarkOwl to address the escalating challenges posed by cyber threats. By combining DarkOwl’s comprehensive darknet database and monitoring capabilities with Authentic8’s Silo cloud browser, which is known for its secure browsing environment, organizations will gain unprecedented visibility and protection against cyber threats surfacing on the darknet. Read more.

Datastreamer

With Datastreamer and DarkOwl’s combined solution, organizations can integrate dark web data without in-house engineering teams needing to maintain complex data pipelines. Furthermore, analysts can broaden coverage by merging additional web data including TikTok, Threads, news, forums and more. Previously raw unstructured data is federated for analysts to perform queries and real-time surveillance as easily as they would with structured data. Learn more.

Product Highlights

Ahead of RSA, the team put together several product highlights and updates to be able to share on the showfloor. Below, we outline a few of them, but a full blog of Q1 product highlights can be found here and a summary 1-Pager here. Curious about how any of these can help your use case? Contact us!

Access the Darknet Safely and Securely Directly from DarkOwl Vision

Last quarter the team released “Direct to Darknet” within Vision UI in partnership with Authentic8, a leading provider of cloud-based secure browsing solutions. This feature allows users to further investigate Vision UI search results on forums, marketplaces, and other Onion sites. This can be helpful for an investigation to view the original website, view images or advertisements that may be on the sites, take a screenshot for reporting, and more. By combining DarkOwl’s comprehensive darknet database and monitoring capabilities with Authentic8’s Silo cloud browser, which is known for its secure browsing environment, organizations will gain unprecedented visibility and protection against cyber threats surfacing on the darknet.

Collection Stats

Last quarter showed tremendous growth in data collection. The team had 5% growth quarter over quarter in added Tor documents, 27% growth in I2P documents, 31% growth in ZeroNet documents, 15% growth in records from Telegram, to highlight a few.

A Watchful Eye Evening

On Tuesday night, for the first time, DarkOwl hosted a happy hour after the show floor closed… and what a fun night! We’d like to extend a huge thank you to our co-sponsors, Doppel, OSINT Combine, and Socialgist. From networking with net new prospects, current customers, partners and everything in between, it was a great event and we hope that everyone that attended enjoyed their evening. If you didn’t get an invite this year, make sure to ask for invite next year! We would love to see you and look forward to hosting again!

Didn’t get a chance to meet with our executive team at RSA? Contact us to set up some time to chat!

May 28, 2024

In December of 2023, DarkOwl analysts released a blog answering the burning question of “What are Stealer Logs”. In another piece, DarkOwl analysts presented an overview of the different types of Information Stealers (Info Stealers) that are sold on the Darknet.

Now, DarkOwl would like to shed some insight into info stealers from an engineering perspective, to further explore the functionality, specific behaviors, and technical characteristics of this sophisticated form of credential theft.

Info Stealers infiltrate systems and compromise data primarily through social engineering attacks. Common tactics include but are not limited to:

• Phishing Emails
• Malicious Websites
• Exploiting Software Vulnerabilities
• Remote Access Trojans (RATs)
• Removable Media Attacks
• Drive-by-Downloads

Info stealers are very sophisticated forms of malware, and the complexity of the modular architecture allows them to often go undetected even by anti-virus software. While each type of info stealer does vary in its level of refinement, as they are still relatively new but rapidly evolving, this review will be focused on generalizing key elements commonly found in info stealers. Info stealers are known for their evasion techniques and for targeting what people want to protect, their private information, credentials, and financial data.

Info Stealers

Part of what makes info stealers so sophisticated are their complex modular architecture. A simplified overview of that architecture includes the following key elements:

1. Core Engine Module
2. Communication Module
3. Data Collection Module
4. Encryption Module
5. Exfiltration Module
6. Evasion Module

To understand what each of these modules are and their functionality within a stealer log we will review each term and look at a very basic version of the complex code that is used to design an Information Stealer.

Core Engine Module

This serves as the central intelligence hub of the info stealer and manages its functionality. The core engine drives tasks such as initialization and configuration of all the other modules coordinating their actions. It also initializes the malware, establishes communication with the command control (C2) server and houses the execution codes for the other five modules.

Below is a basic sample of what part of the code for a Core Engine could look like:

• Keylogger – provides a basic framework for logging keystrokes
• log_keystroke – this captures and logs keystrokes
• save_logs – method used to save and send the logged keystrokes to a remote server
• start_logging – acts as a place holder for when to start the keylogging process

Communication Module

This establishes and maintains communication with the C2 server, handles sending/receiving commands, transmission of stolen data, and maintains a covert channel of communications. Generally, this module will have some form of encryption in place to prevent the interception of the data that is being stolen as well as protecting the location of where the stolen data is being sent.

Below is a basic Communication Module code to demonstrate part of the module’s functionality:

• request – this library is used to send a HTTP request to the C2 server
• send_request – sends what is called a POST request to the C2 servers URL which generates a JSON response
• handshake – initiates communication with the C2 server and contains information about malware versions, system architecture and contains the installation ID
• execute_command – simulates the execution commands from the C2 server
• exfiltrate_data – simulates the exfiltration of the stolen data

Data Collections Module

The responsibility of this module is to identify and harvest the data the threat actor is after once the system has been infected. The Data Collections Module can house a large array of submodules for specific forms of data the threat actor wants to collect. Common forms of data such as PII, financial data, device information, Geo locations, and personal photos would all require their own submodule to identify. In addition to the targeted data, the Data Collections Module also collects from numerus other sources such as browsers, system files, and apps installed on the device.

Below is a basic example to demonstrate the structure and functionality of Data Collections Module often found in info stealers:

• keystroklogger – mentioned above in the core engine module
• NetworkMonitor – captures network traffic (a placeholder) and sends it to a remote server.
• DataExfiltration – mentioned above in the core engine module
• If _ _name_ _ == “_ _main_ _”: – this creates a block instance of the three submodules are created, and separate threads are started to run their respective functions concurrently

Encryption Module

This provides cryptographic functionality and encryption keys used to communicate with the C2 server. As ironic as it seems the use of strong encryption algorithms (AES) is used to prevent interception of “unauthorized” access to the data that is currently being stolen. Only instead of protecting the device owner from the threat actor it is protecting the threat actor from the device owner, authorities, and aids in keeping the info stealer from malware detection.

Below is an example of one type of AES often used in info stealers:

• EncryptionModule – methods for encrypting/decrypting data with the use of the AES algorithm
• encrypt_data – imports plaintext data, encrypts it using AES, and outputs encrypted data as a “base64” encoding string
• decrypt_data – does the reverse action of “encrypt_data”
• if _ _name_ _== “_ _main_ _”: – generates a random encryption key

Exfiltration Module

This module handles the transmission of the stolen data once it has been encrypted. Exfiltration module formats the encrypted data into messages and sends them through the communications channel established by the communications module. This module often includes contingencies for when there are network interruptions, failed transmissions, and bandwidth issues.

Below is an example of the type of code that could be used in the Exfiltration Module:

• ExfiltrationModule – this is a class that will provide a method to send the stolen data to the remote server
• send_data – takes the stolen data as an input and sends it to the designated server URL
• if _ _name_ _== “_ _main_ _”: – creates and instance of the exfiltration module with the URL of the remote server
• data_to_exfiltrate – stolen data is sent to the remote server

Evasion Module

Just as it sounds this final module is responsible for the evasion tactics to evade malware detection by software and humans. Some common evasion techniques include polymorphism, obfuscation, and anti-debugging to hide the malware. This module acts as a chameleon as it continually adapts and evolves to remain under the radar. This is a highly scalable and adaptable to the various environments and target systems but below is a simple example of what the code could look like.

• EvasionModule – defines the methods for simulating normal user activity while detecting virtualization/sandboxing and analysis tools
• simulate_normal_activity – mimics typical user behavior, by opening files, browsing websites, or launching apps to hide amongst legitimate activity
• detect_virtualization AND detect_analysis_tools – check for signs of virtualization/sandboxing and the presence of analysis tools
• evade_detection – continuously runs evasion checks
• if _ _name_ _== “_ _main_ _”: – the EvasionModule class is created, and the evade_detection method is called to start the evasion process.

There is no doubt about it, information stealers are a formidable threat to cybersecurity on multiple levels. Info Stealers are sophisticatedly engineered to stealthily execute malicious intent. By studying the architecture, functionality, and technical characteristics through an engineering perspective, cybersecurity analysts can gain a deeper understanding of how to create effective countermeasures and create robust detection strategies.

Questions? Contact us!

May 23, 2024

Internet censorship is arguably a critical threat facing freedom of expression and access to information today. This is especially true for countries where access to information is restricted by governments or other controlling entities. For many countries around the world, controlling entities use various tools, techniques, and technology in order to control and restrict access to certain websites and publicly available content. The Tor Project’s response to such targeted censorship is WebTunnel.

In this blog, DarkOwl analysts summarize WebTunnel, not to be confused with TORTunnel, what it is, how it is implemented, and the impacts it has.

Image 1: Source: Tor Blog

WebTunnel 

Released March 12^th, 2024, WebTunnel is a bridge developed by the Tor Project that allows users to bypass censorship by disguising traffic to mimic encrypted web traffic. Essentially, WebTunnel helps users evade censorship by hiding traffic in plain sight. The bridge tunnels TOR traffic by wrapping the TOR connection in a websocket-like HTTPS connection, making traffic more difficult for tools, techniques, and technology to detect and block. The Tor Project designed WebTunnel to be easy to use and simple to deploy. 

Key Features:

• HTTPS Tunneling:
  • Uses HTTPS tunneling to mimic ‘normal’ HTTPS traffic 
• Obfuscation: 
  • Uses obfuscation techniques to disguise Tor traffic 
• User-Friendly Interface: 
  • Designed to be user-friendly and easy to use 

Configuring a TOR browser to use the new WebTunnel feature is easy. Users simply navigate to the TOR Project bridges resource from any browser, select “webtunnel”, and copy the provided line. The user then simply opens the TOR browser, selects “add a bridge manually”, pastes the copied line, and restarts the browser. No further modifications or configurations are required. 

Tor provides individuals with a means to protect and obfuscate online privacy and anonymity, enabling users to browse internet connected resources without potentially revealing personal or location data. WebTunnel has the potential to significantly impact censorship evasion by providing users with an easier, more effective and reliable means to access restricted content. 

Impact

The availability of features like WebTunnel impacts corporate security and further extends the corporate risk surface. Corporate security policies and technology often lock down networks and devices to protect the organization. Anonymity driven tools and features often allows users to bypass corporate defenses to browse the totality of the internet both good and bad. While it’s fair to assess most users using privacy-driven tools to bypass corporate security policies, technology, and controls are likely not doing it out of spite or hostility towards the organization, these users often lack the guidance and information on why these tools and features should not be used to bypass corporate defenses.

Educate users on the risks bypass tools expose the organization to and why such tools are not allowed inside the corporate environment or on corporate devices. Allow staff to understand the potential impact and outcome. TOR is a tool neither good nor bad until assigned an action by the user. Encourage staff to include the security of the organization in their decisions.  

Don’t miss any updates or research from DarkOwl. Register for email.

May 14, 2024

Cybersecurity might has well have its own language. There are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security field or have a keen interest, one may not know. Understanding what these acronyms and terms mean is the first step to developing a thorough understanding of cybersecurity and in turn better protecting yourself, clients, and employees.

In this blog series, we aim to explain and simplify some of the most commonly used terms. In this edition, let’s dive into CVEs.

CVEs 101

CVE is an acronym thrown around frequently in the cybersecurity space. CVE stands for Common Vulnerabilities and Exposures. A CVE is a list of publicly disclosed cybersecurity vulnerabilities that are assigned a unique identifier called a CVE ID. According to the National Institute of Standards and Technology, CVE defines a vulnerability as “a weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this context typically involves coding changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety).” When a security vulnerability is identified, it receives a CVE ID number. This identifier is used to monitor and reference the vulnerability in security advisories released by vendors and researchers, and have a uniform way in searching the same vulnerability across databases.

The concept of the CVE database originated in a whitepaper by co-creators Steven M. Christey and David E. Mann of the MITRE Corporation. The initial CVE list was publicly available in 1999, and continues to grow. There are currently over 247,000 CVEs and in the first week of 2024 alone, over 600 were cataloged. The system is maintained by the United States’ National Cybersecurity FFRDC, which is run by the MITRE Corporation and receives finding from the US Department of Homeland Security’s National Cyber Division.

Keeping a record of all CVEs allows security and IT researchers to coordinate efforts in prioritizing and resolving these vulnerabilities. To keep CVE records organized, there is a CVE Program dedicated to identifying, defining, and cataloging publicly disclosed cybersecurity vulnerabilities.

Not only are CVEs important for keeping track of vulnerabilities in a way that is repeatable, searchable and trackable, but they raise security awareness. Because CVEs are publicly documented, there is better awareness of potential threats and security concerns. Individuals and organizations have the ability to search vulnerabilities and take the necessary actions to secure their computer systems and networks. CVEs allow security professionals to stay up to date on the latest security flaws and vulnerabilities.

CVEs in the Wild

CVE-2023-34362: MOVEit Transfer

In 2019, the Cl0p ransomware gang shifted their focus to exploiting the MOVEit vulnerability to target victims starting in May 2023, and they carried on with this campaign throughout the summer. They exploited the SQL injection vulnerability known as CVE-2023-34362 in the MOVEit transfer system, which is extensively utilized for managing file transfer operations across numerous organizations. Cl0p’s exploitation of this vulnerability had significant repercussions for several prominent brands and companies, garnering substantial media coverage. It’s estimated that roughly 2,000 instances of the MOVEit vulnerability were exploited, affecting approximately 60 million individuals worldwide. These figures may be conservative due to under-reported incidents and efforts by affected entities to conceal the extent of network intrusions. Nevertheless, experts projected that the group stood to gain around $100 million from exploiting this vulnerability. If this vulnerability were to be left unaddressed, it could lead to significant data breaches, loss of sensitive information, and severe disruption of services.

Figure 1: Initial vendor alert on the newly discovered MOVEit vulnerability; Source: Community Progress

CVE-2023-22515: Confluence Data Center and Server by Atlassian

Last fall, the Ukrainian Cyber Alliance (UCA) used CVE-2023-22515, which involves Confluence, to escalate privileges and access Trigona’s confluence server. They gained insight into the infrastructure and published Trigona’s support documents, exfilled the developer environment and information pertaining to Trigona’s crypto payments, as well as the back-end of Trigona’s chat service and blog/leak site details. After collecting all the information, UCA defaced and deleted Trigona’s site. Open CVE’s provide danger to all, including the cybercriminals who use the impacted tools.

CVE-2022-42475: FortiOS SSL-VPN Vulnerability

Continuing their world-wide efforts to infiltrate government, military, and key sources of intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) in early February of this year. This was done to deploy a backdoor named COATHANGER and gain access to a network used by the Dutch military. This was the first time the Dutch have publicly attributed a cyber incident to Chinese actors. This vulnerability, along with CVE-2023-22515, emphasize the importance of maintaining good security hygiene and always updating computer systems to the latest version.

CVEs in DarkOwl Vision

Cyber Actors Discuss CVEs on the Darknet

Cyber criminals and hackers frequently discuss vulnerabilities on the darknet for various platforms. Discussions of relevant software and exploitability of specific CVEs can assist an organization in determining potential unpatched vulnerabilities. Figure 2 shows a forum discussion about an exploit for CVE-2022-30190, which is a Microsoft office vulnerability that hackers can leverage for remote code execution.

Figure 2: DarkOwl Vision search reveals an exploit based on CVE-2022-30190; Source: DarkOwl Vision

Figure 3 shows a post to a hacker forum on the darknet by the user known by the moniker, PresidentXS, that discusses an Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability.” An attacker successfully exploiting this vulnerability allows for malicious code execution on an ADO service account.

Figure 3: Source: DarkOwl Vision

Posts and discussion threads like these examples in DarkOwl Vision are useful for reviewing comments, exploring applications, and use cases for the vulnerability specifically.

Tokenization

Based on feedback from our customers, CVEs are identified and tokenized within our indexed documentation collection. DarkOwl Vision UI users can search for results containing a specific CVE number, as well as for results containing any number of CVEs. CVE tokenization makes it easier to search for CVEs along side keywords or other entities such as onion domains or threat actor aliases.

Figure 4: CVE search in Vision UI; Source: DarkOwl Vision

Actor Explore

DarkOwl’s Actor Explore feature provides invaluable insights into cyber threat actors, empowering security professionals, researchers, and organizations with analyst curated information about threat actors, enhancing their ability to understand and combat cybersecurity threats effectively. Each actor profile in Actor Explore includes a detailed dossier, offering an in-depth overview of the threat actor and includes extensive information such as darknet fingerprints, targets, tools, CVEs, contact information, and more. Actor Explore connects this information to our other data sets, including leak sites, ransomware sites, alias, cryptocurrency, etcetera that actors are associated with. This wealth of data enables users to gain a profound understanding of the threat actors, their tactics, and the potential risks they pose.

A DarkOwl Vision user can also search in Actor Explore by CVE. This filtering option makes it easier to find and compare actors of interest.

Figure 5: DarkOwl Actor Explore result for Cl0p and the CVEs they exploit; Source: DarkOwl Vision

Figure 6: Example of CVE filtering in Actor Explore; Source: DarkOwl Vision

Resources

Keeping up to date on CVEs is essential to maintaining a secure IT environment. Below are a couple free resources available for tracking and researching CVEs.

• CVE Program Mission: Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. View the 228,713 CVE records available.
• CVE Tracker: A New Motional Open-Source Tool for Tracking Common Vulnerabilities and Exposures. View tool here.

To take investigations the next step, root cause mapping of vulnerabilities is best done by correlating CVE Records. Check out guidance from Mitre here.

To see DarkOwl Vision and our collection of CVEs in action, contact us.