1. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Gluten Free Malware (Neutrino EK Analysis) LS Pulsifer Surveillance Analyst 13 December 2013

2. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Outline What is Neutrino? Detection Methods Post-infection Symptoms Mitigation Struggles Conclusion

3. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS What is Neutrino? Marketed as “Neutrino - a bunch of exploits” in March 2013, has evolved rapidly since Uses open source javascript Plugin Detect As seen on http://ip.pulsifer.ca/plugindetect/ Targets CVE-2013-2463, 2012-1723, 2013-0431 Oracle Java SE < 6u45, < 7u21 ORDER NOW! Day$40 Week$150 Month$450

4. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Detection Methods SF VRT rules for Snort vs Emerging Threats ET = NOISY VRT = SLOW[er] TO RELEASE As of 10 December ET = 16 active snort rules VRT = 27 active snort rules Results for neutrino_vs_6u45.pcap ET = 4 alerts VRT = 0 alerts VRT HAS GOTTEN BETTER

5. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Detection Methods cont. CLI Wizardry Cpl Cowan stumbled upon Neutrino w/o the aide of an IDS Determined reliable detection method w/ SANCP metadata and AWK dstport = 8000, dst bytes greater than 100,000, less than 200,000 The above does not indicate the active exploitation of a host, it merely detects the use of the javascript Plugin Detect.js Similarly detect Neutrino w/ HTTPRY metadata and AWK NOT AS RELIABLE AS SANCP

6. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Post-Infection Symptoms JRE icon in the system tray popped Computer acts sluggish dllhost.exe had been executed > 30 times explorer.exe jumped up to 158,000kb 186 MB of network traffic in < 10 minutes In contact with over 500 IP addresses 1560 packets contain the word “click” NOTHING VISIBLE TO THE USER

7. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Mitigation Windows XP SP3 w/ Java SE 7u45 navigated to hxxp://forexscene.eu/index.php MALICIOUS URL Only interactions were the POST for PluginDetect results NO JAR FILE DOWNLOADED UPDATE JAVA

8. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Struggles Lab Environment Firewall, GDNS, Sinkhole OPSEC Attrib IP space Misconfiguration Patch levels DHCP lease times Visibility Gateways LAYERS 8 & 9

9. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS Conclusion Most EK target various services (PluginDetect)  Test was done from HOME Neutrino fell off, what next? NUCLEAR DOTCACHE BLACKHOLE v2 WHITEHOLE MAGNITUDE ZEROACCESS REDKIT SWEET ORANGE COOL CRITX CRIME BOSS

10. CANADIAN FORCES NETWORK OPERATIONS CENTRE( CFNOC) CENTRE D’OPERATIONS DES RESEAUX DES FORCE CANADIANNE (CORFC) UNCLAS 9 QUESTIONS?