Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le novembre 05, 2020, 00:08:03

Titre: [FireEye]Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945
Posté par: igor51 le novembre 05, 2020, 00:08:03

Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945

[html]

Through Mandiant investigation of intrusions, the FLARE Advanced
  Practices team observed a group we track as UNC1945 compromise managed
  service providers and operate against a tailored set of targets within
  the financial and professional consulting industries by leveraging
  access to third-party networks (see this     href="/content/fireeye-www/en_US/blog/threat-research/2019/03/clustering-and-associating-attacker-activity-at-scale.html">blog
  post for an in-depth description of “UNC” groups).

 

UNC1945 targeted Oracle Solaris operating systems, utilized several
  tools and utilities against Windows and Linux operating systems,
  loaded and operated custom virtual machines, and employed techniques
  to evade detection. UNC1945 demonstrated access to exploits, tools and
  malware for multiple operating systems, a disciplined interest in
  covering or manipulating their activity, and displayed advanced
  technical abilities during interactive operations.

 

Mandiant discovered and reported to Oracle   href="https://nvd.nist.gov/vuln/detail/CVE-2020-14871">CVE-2020-14871,
  which was addressed in Oracle's     href="https://www.oracle.com/security-alerts/cpuoct2020.html">October
    2020 Critical Patch Update. Mandiant recommends staying current
  on all current patch updates to ensure a high security posture. We
  will discuss this vulnerability in greater detail in a follow up blog post.

 

UNC1945 Attack Lifecycle

 

The threat actor demonstrated experience and comfort by utilizing
  unique tactics, techniques and procedures (TTPs) within Unix
  environments, demonstrating a high level of acumen in conjunction with
  ease of operability in Microsoft Windows operating systems. They were
  successful navigating multiple segmented networks and leveraging
  third-party access to extend operations well beyond the initial
  victim. Furthermore, UNC1945 operated from several virtual machines
  pre-configured with post-exploitation tools in addition to their
  custom toolset to evade detection and forensics.

 

Initial Compromise

 

In late 2018, UNC1945 gained access to a Solaris server and
  installed a backdoor we track as SLAPSTICK in order to capture
  connection details and credentials to facilitate further compromise.
  The SSH service of this server was exposed to the internet at the
  time, the same time we observed first evidence of threat activity.
  Unfortunately, due to insufficient available evidence, the next
  indication of activity was in mid-2020 at which time a different
  Solaris server was observed connecting to the threat actor
  infrastructure. This indicates a dwell time of approximately 519 days
  based on recovered artifacts.

 

• Although we were unable to determine how the late-2018 initial
      access was accomplished, we did observe successful UNC1945 SSH
      connections directly to the victim Solaris 10 server, since the SSH
      service was exposed directly to the internet at the time.

   
• In mid-2020, we observed UNC1945 deploy EVILSUN—a remote
      exploitation tool containing a zero-day exploit for
      CVE-2020-14871—on a Solaris 9 server. At the time, connections from
      the server to the threat actor IP address were observed over port
        8080.
  • Mandiant discovered and reported CVE-2020-14871, a
            recently patched vulnerability in the Oracle Solaris Pluggable
            Authentication Module (PAM) that allows an unauthenticated
            attacker with network access via multiple protocols to exploit
            and compromise the operating system.
  • According to an
            April 2020 post on a black-market website, an “Oracle Solaris
            SSHD Remote Root Exploit” was available for approximately $3,000
            USD, which may be identifiable with EVILSUN.
  
         
  • Additionally, we confirmed a Solaris server exposed to the
            internet had critical vulnerabilities, which included the
            possibility of remote exploitation without authentication.
  
     

 

Establish Foothold and Maintain Persistence

 

The threat actor used a Solaris Pluggable Authentication Module
  backdoor we refer to as SLAPSTICK to establish a foothold on a Solaris
  9 server. This facilitated user access to the system with a secret
  hard-coded password and allowed the threat actors to escalate
  privileges and maintain persistence (see Figure 1).

 
   
     

Log –font –unix | /usr/lib/ssh/sshd sshd               kbdint - can <Encoded Password> <IP REDACTED>               Magical Password             auth.info | sshd[11800]: [ID 800047               auth.info] Accepted keyboard-interactive for root from               <IP REDACTED> port 39680 ssh2             auth.notice | su: [ID 366847 auth.notice]               ‘su root’ - succeeded for netcool on           /dev/pts/31

 

  Figure 1: SLAPSTICK logs

 

At the initial victim, UNC1945 placed a copy of a legitimate
  pam_unix.so file and SLAPSTICK in the /lib64/security folder. A day
  later, the threat actor positioned a custom Linux backdoor, which
  Mandiant named LEMONSTICK, on the same workstation. LEMONSTICK
  capabilities include command execution, file transfer and execution,
  and the ability to establish tunnel connections. (see Figure 2).

 
   
     

FileItem:changed |               /usr/lib64/security/pam_unix,so [57720]             Audit log | [audit_type: USER_END] user               pid=10080 uid=0 auid=0 msg='PAM: session close               acct=root" : exe="/usr/sbin/sshd"               (hostname=1.239.171.32, addr=1.239.171.32, terminal=ssh           res=success)'"             FileItem:Accessed |           /var/tmp/.cache/ocb_static

 

  Figure 2: UNC1945 emplacement of SLAPSTICK