this hard drive contains 25 million
pieces of malware and this computer is about to become very very sick what do
you mean threat service has stopped Windows Defender is completely
disabled but I guess that's what happens when you send $500 to a faceless person
named smelly who runs a shady Network that collects develops studies and
reverse Engineers nefarious code so why
did I do that because if you're trying to learn about
computer security this is probably the most valuable textbook you could find it
contains their entire repository of malware samples research papers blog
posts from security researchers and source code now of course it's all
freely available on the VX underground website but the $500 isn't really for
the content it's a donation to ensure they can keep building this repository
which wait is that actually a good thing well let's talk about that the single
biggest hole in most Security Systems computer or otherwise is trust new
malware pops up every day and defending against it is a never-ending game
of whack-a-mole that is such a constant
churn of zero day exploits and unpatched vulnerabilities that it's better to just
assume the worst that is why today's episode sponsor threat Locker uses a
zero trust approach to security their endpoint protection platform works by
assuming that applic a are guilty until they're proven innocent meaning that
users within your organization can't just accidentally open the wrong email
attachment or program installer and take down the entire company from the inside
lead to a whole bunch of really bad like oh I don't know
maybe the very first thing I asked when this video got pitched to me was isn't
this thing kind of dangerous to have lying around and the answer is yes yes
but also no these mostly aren't ready to
go viruses mostly and while they
absolutely can wreak havoc on your system if you're not careful you don't
really need to worry about doing a lock bit on yourself and encrypting your
whole Drive part of the reason for that is how things are stored most
executables are missing the exe file extension so the system is far less
likely to automatically run them and everything else is in a password
protected 7zip archive to prevent it from being automatically unpacked
furthermore many of these malwares are older and the only real damage they can
do to a fully updated system is by overloading Windows Defender threat
detection engine that's what caused the weird behavior that you saw before of
course many of them are still dangerous and once you've got them decompressed
and armed all safety is completely out the Windows and also macOS and Linux
Borat rat popped up in 2022 and was referred to as a triple threat because
on on top of granting remote access it also includes dods and ransomware tools
this seems like exactly the kind of thing I would want to just run launch
Borat 7z archive in any run Windows 10
or 11 this is Linux yes would you like
me to show you any run they do sandboxing there's so much resetting and
reimaging and everything in this project
a fun one right oh it's just the best well interesting at least right it's
interesting it's abs absolutely interesting it's also uh extremely scary
I mean it's not like you could single-handedly take down the whole company if you do anything irresponsible
or careless Windows 10 or 11 so we'll do
Windows 11 here we'll run a public analysis it's going to start uploading
the file we have 660 seconds to do this
before it implodes implodes oh this instance just goes away in 10 11 minutes
no matter what that's correct we're going to launch Bor at. exe so if
someone managed to execute this on your
system this is what would happen this right here is actually the control panel
for it so this is what the hacker Sees God it and what I want to do right now
is I'm going to go build a client for this so I'm going to go just quickly
here build alls yep yeah we'll choose an icon here let's give it the Borat rat
icon okay so we are going to go build exe here client.exe is going to save
into the Borat folder and then what we should be able to do and this works 50%
of the time for me is when we open up client.exe so this will infect this
instance this is what we would try to remotely execute on the target system
yeah so we would try and remotely execute that and you can see that we've done that we've successfully infected
ourselves it's going to run a couple it's going to run system info. exe
conhost host name. exe just spit out
absolutely everything that we want to know about this system here is
everything about it all in just this uh this text file here and this will get
sent to the attacker probably as fun as it gets as in the utilities so we can
hide and show our taskbar hide and show our desktop just to mess with people
yeah oh Mouse is the best swap will swap around the left and right click dude we
can turn off the webcam light yep most
webcams do work with the webcam light
just kind of hardwired into the camera circuitry but some of them don't and
that's where this is going to really exploit it the other thing this is going to do is allow you to turn on their
webcam light basically activating their camera but not actually have to do any
it's just a quick way of freaking them out if they're trying to make threats at
you over the phone while you uh try and extort them for money fod helper watch
how easy it is to get admin you can see permission right here it says permission
user over on the right side we're going to hit fod
helper it's going to restart the
client and oh look admin that's it and
they haven't patched that yet okay what are we running on yeah 2021 second half
so this is pretty old window that's good that's that's really good
that that's still unpatched on this version but it's probably patched
somewhere else I I've not run this for real I'm very afraid of it obviously
this dashboard here right there's a lot of lines yep I mean you could have a lot
of clients and you could just poke around in one anytime you want what's
surveillance do oh surveillance just uh just lets you watch a little bit you can
remote shell remote screen remote camera go into their file manager you can
record you can get their uh their Network information see what's what
processes are running else we got here uh control so you can send files to them
you can run yep key logger is built into
every malware these days malware is where it gets real interesting oh I just
pick what malware I want yeah you want to Dos somebody you can do that
especially if you've got a lot of bots there uh you can ransomware them so if
you wanted to just do a lock bit on someone you can just ransomware them
like that there is a way in here to steal credentials for
Discord it steals the the session token
for Discord so that you can gain access to somebody's Discord and then start
messaging all their friends start messaging their friends with your client.exe which you've just made look
like whatever program you want because that's part of the whole uh Builder and
this is this is old but it's it's not that old it's still active in some
regards maybe not this exact version but clearly there's still people using it
and this kind of thing is only going to get scarier and scarier when Windows 10
reaches into of Life dude M cuz so many people are going to stay on Windows 10
and it's not going to be getting security patches guys patch your
software the stuff that gets patched isn't what really worries me it's the
zero days there's so many zero days and there's so much money in this now
especially with all of those hospitals getting Ransom
weed anyway good
luck practically speaking there is no limit to what a creative attacker could
do with something like Borat rat we haven't even touched on some of the
basic functionality like exfiltrating data popping up text messages so the
attacker can communicate with the victim but how does it do so much well a big
part of it is thanks to the dll files that are included these DLS are mostly
feature plugins that are taken from a fork of DC rat called Santa rat when you
really think about it Borat does look a bit like a dirty Wizard or a homeless
Santa but that's besides the point the point is if we run the rat in a malware
sandbox like any run which using here we can get some idea of how it's executing
individual exploits take the fod helper
exploit for example how is it giving the
rat administrator privileges with almost no effort whatsoever well we can see
that it makes some registry changes before launching fod Helper but what
registry changes is it making exactly searching through the VX drive we can
find the source code for it and see that it uses UAC bypass method 3 from
options. dll the source code for options. DL might be missing but as we
know it came from Santa rat so we can check the source code for that and see
that it's modifying this key in the registry even if we don't have any
programming knowledge just searching our virus drive for Borat reveals several
articles that summarize the threat in slightly more legible terms how can we
use this though well if we're a bad actor now we know a way to get to a
command prompt window with admin privileges and we can explain that but
if we're a good actor we know to set up something to watch that section of the
registry in order to avoid this issue
that is where today's episode sponsor threat Locker comes in if we try to run
this on a protected machine threat Locker will block the executable not
because it's a known virus but because it's trying to execute at all our threat
Locker administrator account can now see it within Response Center open it up in
a virtualized testing environment to ensure that it's safe and either keep it
on the block list add it to the allow list outright or allow it with ring
fencing just in case you're not sure about the application ring fencing is
the act of limiting what a program can do like blocking it from connecting to
the internet blocking it from writing to the registry accessing protected files
or interacting with high-risk applications like Powershell and command
prompt after all malware can't get access to an Administrator Command
Prompt if it can't open a command prompt at all coming back to our VX underground
drive though being able to pone Windows not exactly a big accomplishment Windows
machines get hacked every day what about Linux here's the thing web servers
usually run Linux and there's a lot of things that are trying to Target that a
WordPress server is especially susceptible to attacks like the c99
backdoor ooh is it demo time WordPress is often used by wouldbe web Masters
because it is relatively user friendly at least on the surface and free to use
but not all of the plugins are free technically because of wordpress's GPL
license all der Works including plugins are required to use GPL as well that
means that they can charge money but they also can't stop people from sharing
their code so websites that host cracked
plugins aren't usually able to be taken down by lawyers they do however often
serve plugins with a little something extra that might make you want to pay
for plugins from the official Source they can be used to host sketchy files
they can be used to ransomware your network and once a back door is
installed other malware can be uploaded and potentially
executed want to show us how it works what I've done is gone ahead and just
added uh our back door into one of the
most generic websites of all time yeah this is a default theme the way that
this could be kind of replicated in real world other than just through infected
uh themes or plugins is also through
mismanaged upload uh credentials so okay
if you've got user uploads they can potentially make this happen and uh this
is what the back door actually looks like so you can see that here we're
going to Local Host into the themes folder and we're just running this
simple PHP file and now we have access to everything wait what okay so hold on
a second so my server is serving that website that's correct and you took
advantage of a misconfigured upload
permission setting yes I just uploaded this file
and I have this
yes so this could be used to do any number of things let's say that your
website was hosting um you know a cool mod for something or or a cool useful
little application I could go in and I could replace the file with something
completely different and if they don't bother to actually check the check sum
that I publish on my site although I could of course overwrite the check sum
as well then they could download a completely different file execute that
on their computer and boom they're infected and since everything is usually
done with not the greatest encryption
for PHP websites usually especially
WordPress the encryption on passwords Is Not Great you could just go in grab the
database and then use I don't know your RTX 490 at home to right crack the
passwords kind of like in the uh Wi-Fi cracking video right you should check
out that video If you haven't seen it already equally scary honestly that's a
little bit less scary than uh than some of these things because people can steal
your Wi-Fi credentials but this will allow them to do stuff to you from
anywhere sure but if they're on your network then it's it's just so
convenient at least you know they're nearby though that's nice that's true
means I'm not alone now PHP is a just
intime programming language so malware spreaders need to be a bit more creative
than simply hiding it within a binary file that's where things like base 64
encoding and GP come into play by converting everything into unreadable
text that also fits into a single line in a code editor they can turn 5,000
lines of backd door code into only nine pretty lines of totally not suspicious
at all gibberish if that gibberish code gets into a publicly accessible part of
a web server either through misconfigured file upload permissions or
nefarious WordPress plugins it can be executed by anyone who knows it's there
with php's eval function nefarious code can break out of the PHP container and
start executing commands directly on the operating system now whoa whoa hold on a
second here lonus all this seems pretty irresponsible are you guys really really
just trusting VX underground and plugging this drive into a live system
here the answer is no and of course not
even though we're not using any run here like we were with Windows our sponsor
threat Locker would never forgive us if we just blindly gave out trust I mean
that's the antithesis of the zero trust model trusting a stranger is the number
one way to get pwned no worm or back door can ever match the effectiveness of
a social engineering attack so if a guy named name smelly tells you that the
drive he gave you contains lots and lots of malware you should probably believe
him and take the necessary precautions but what are they well to start with we
set up our Linux machine to be air gapped okay to clarify no system is
completely immune and it was only a few months ago that the popular compression
Library XZ was found to contain a back door but desktop Linux is less likely to
be attacked with simple automated malware as for air gapping this refers
to the practice of isolating a computer from the rest of your networked machines
and it can be simulated with vlans but if you want to be sure I'd recommend
just unplugging it VLAN hopping isn't a
huge risk these days but it isn't impossible of course if you want to step
up your safety level further you need a malware sandbox a virtual machine on a
virtual Network that is completely isolated from any other machine and that
will be destroyed the moment that you no longer need it threat Locker has their
testing environment feature that allows you to pass executables that are
quarantined from your protected computers into their sandbox without any
runs overly restrictive time limit or the requirement to make your sample
public now we're using any run for deeper Dives right now simply because it
allows us to upload our samples directly but threat Locker's Response Center is
more than adequate for 99% of use cases
the two products the sponsored one and the other one actually complement each
other really nicely to fill different sand boxing needs threat Locker is great
for production environment work while any run is better suited for noodling
around shall we noodle some more Hey look it's the chief noodler himself what
are we looking at now ooh lock bit yeah we're going to take a quick look at lock
bit so I'm told it's shocking how simple
it actually is that's in the script this is super cool is this a paid
version of any run yes okay did they send that over to us they did hey shout
out any run thanks so we're doing the same thing we did with B rat we're going
to drag it out of here and I did not passord protect this one
Tanner hey if we get infected I don't own the
company so here we've got just some configuration things uh local discs true
Network shares
true yeah so I think it makes my skin crawl just thinking about something like
this getting on our Network oh have I clarified that it's a ransomware well
it's a ransomware if I didn't say that already so now we've got our decrypter
mhm we've got password. dll so that's
the decryption password here if uh if it
is executed through dll the exe version is a slightly different password but
yeah it's it's essentially here's the
here's the encrypter and then here's the key that you can provide to the victim
in whatever form you like yeah what a lot of people have been doing lately is
accepting the payment from their victims and then not decrypting so that is an
option too that is a that is a whole other level of yeah so if you uh were to
run lb3 exe and yeah you've now lost everything
that was quick it actually looks you can set what kinds of files it looks for off
the bat so you can aim for uh databases
first if you want which is what a lot of places have going after more of a
commercial entity yep see this is the kind of thing we cover on Wow and we
talk about in the news and and we discuss but there's a big difference
between you know sort of talking about what's out there and and these
high-profile attacks and just seeing how simple the tools are you
want to know I could do this you want to know how simple some of these are you
know the W to cry virus that was the one that was that was the ransomware that
was just all over the place for several years there it got defeated when
somebody went into to the source code for it did a whole decompilation found uh found
a line of code in there that kept calling one particular website address
yeah so they decided to buy the domain because it hadn't been registered
apparently that domain was just being used by wan to cry as a kill switch so
they accidentally stopped W to cry the guy ended up uh getting caught by the
FBI for credit card fraud that he did earlier in his life and then the judge
at judgment was like n the you know what the public good that you've done kind of
outweighs whatever credit card fraud so if you're going to commit credit card
fraud also stop the worst ransomware attacks in
history of course the groups that are executing ransomware attacks be they
monoc cry or lock bit or something else aren't just using ransomware they need
to find a way to infiltrate their targets organization spread it around
and remain undetected and many of these tasks require some level of social
engineering so what might start as a fishing attack could then transition
into a rat being planted which can then be used to plant the ransomware Borat
rat isn't its own ransomware necessarily but rather it's a vessel for carrying
many payloads one of which happens to be lock bit style ransomwares and all of
this is being accomplished by several competing groups um some are simply
trying to cash in but some clearly have other goals in mind as there's strong
evidence that many malware groups operate as part of government entities
North Korea's Lazarus group uh Russia's berserk bear and Amer America's NSA
equation group are just a few suspected examples so is this hard drive only for
researchers or could somebody conceivably use this repository to
create and spread malware possibly in an act of state sponsored
terrorism don't kid yourself this is on
the blacker side of gray and the only moral justification for its existence is
that realistically the bad guys have access to this information anyway and by
shedding light on it we're at least giving the good gu a hoping chance to
counter any upcoming threats security through obscurity is a pipe dream and
just like we probably upset some gas station owners when we made our video on
The Flipper zero we're probably ruffling some feathers with this one but we feel
it's a valuable conversation to start and one that we should keep on having
the last question you guys might be asking is what are we planning to do
with the VX underground hard drive well the first thing is to put a warning
label on it maybe even a bigger one than this and then after that I don't know
we've actually had some really cool ideas for videos in the past that have
required us to intentionally infect a system but providing real malware to us
is against the policy of every white hat organization and person that we have
ever interacted with so we have struggled at times to create for example
an infected system to bring to a shop for servicing if you have any other
ideas we're open to them but for now we're going to Fester on it for a little
bit and seeing the kinds of threats that are not only out there but more numerous
than I previously imagined I guess we'll look into hardening our security maybe
with some help from our sponsor threat Locker if you guys liked this video why
don't you check out the time we bought antivirus USB sticks from
Facebook they were they were USB sticks all right