Lessons from Operation RussianDollAs defensive security controls raise the bar to attack, attackers
will employ increasingly sophisticated techniques to complete their
mission. Understanding the mechanics and impact of these threats is
essential to systematically discover and deflect the coming wave of
advanced attacks.
Mandiant has developed a comprehensive whitepaper that provides a
multi-faceted analysis of the exploit payload "Operation
RussianDoll." This payload is an exploit for CVE-2015-1701
embedded within the un-obfuscated 64-bit RussianDoll payload (MD5:
54656d7ae9f6b89413d5b20704b43b10). The whitepaper references a freely
available open-source proof of concept and provides malware triage
analysts, reverse engineers, and exploit analysts with tools and
background information to recognize and analyze future exploits. It
also covers how red team analysts can apply these principles to carve
out exploit functionality or augment exploits to produce tools that
will enhance effectiveness of security operations.
The whitepaper walks the reader through the payload's actions to
understand how to loosely identify what it does once it has gained
kernel privilege. It then discusses how to obtain higher-resolution
answers from reverse engineering by using WinDbg to confirm
assumptions, manipulate control flow, and observe exploit behavior.
Building on this and other published sources, a technically detailed
exploit analysis is assembled by examining the relevant portions of
win32k.sys. Finally, the paper discusses how to extract and augment
this exploit to load encrypted, unsigned drivers into the Windows 7
x64 kernel address space.
We hope this analysis will support security professionals'
understanding of the malware used by Advanced Persistent Threat (APT)
actors and of tools and techniques that may be used to conduct
enhanced analysis.
href="https://www2.fireeye.com/Lessons-from-Operation-RussianDoll-Matryoshka-Mining.html"
target="_blank">Download the "Lessons from Operation
RussianDoll" whitepaper here.
Source:
Lessons from Operation RussianDoll
