So a few hours ago I whipped up a super basic Office #malware whose goal was to extract as much info from sandboxes as possible and send it in the clear so you can gather all the configurations of the sandbox.
I named it Thumper
Thumper does 4 things:
- Built In Office/VBA Info Gathering
- Registry Reading (USER & LM)
- RecentFiles Methods
- Shoots results via HTTP (so you can see)
It does this (by design) with the elegance of a herd of drunken water buffaloes dancing to Russian hard bass in a tea shop.
As the reference to the name, it's meant to call the sandworms hidding in the dunes.
And if you want to detect and avoid almost all of the sandboxes - easiest way is to check the DateTime stamps of RecentFile methods of Word.
Like This:
This method isnt new by any means and in many sandboxes I found the last time a recent file was accessed to be > 600 days.
Meaning your image is nearly 2 years old without any environment updates.
While I applaud your uptime, its a easy way to see that no real human uses it
In addition to that, most online sandboxes dont hide any unique data nor do they attempt to mimic any hardware values in registry =(
Another common one was NMAP installed on an Office machine.
Because Sam in Accounting def needs to deep inspect them packetz
Anyways you can inspect the reports of a few yourselves and see what configurations Online Sandboxes have so you can just bypass them on your next upload.
Since I'm 6 drinks in for 20 bucks, let me tell you all about the story of how the first Microsoft Office 2007 vulnerability was discovered, or how it wasn't.
This was a story I was gonna save for a book but fuck it, I ain't gonna write it anyways.
So my first month at working at eEye in late 2006 good ol Microsoft announced Office 2007.
They said they added a shit ton of security including safe int, sandboxing, code analysis, and malformed doc detection.
I told my boss I was gonna break it.
So I started fuzzing by hand
I'm the kind of sicko who can open a Microsoft office document in a hex editor and start telling you what it is all about just by scrolling down.
I have spent an embarrassing amount of time looking at BIFF format in a hex editor, trust me it's nothing special
A 🧵I wanted to share one of my more recent successful red team campaigns so others can test & tabletop
The client, like many others recently, implemented an approved internal AI interface for code questions and searches
This was essentially a wrapped chatGPT UI + file search
The site was 3rd party developed and has several implementations before rolling out in stages to all departments
For this scenario the goal was to compromise a separate dev and finance team with limited access in order to gain access to the production environment and financials
The attack first created a spoofed Google cloud and email to appear similar to the 3rd party company who used this service.
At this point a spoofed email was sent to several junior developers and low level HR people on the target teams posing as the AI portal dev team.
It's 11pm and the VC bros next to me are starting a company and are gonna roll out WordPress as their CRM, and they think they can manage it themselves with a Microsoft Azure cloud and MongoDB. None of them have admin experience
💀💀💀💀
This is at a hotel bar
They are in the carbon footprint reduction industry, I have no clue wtaf that involves but it sounds like a lot of cold calling and selling people materials from what I heard
Guys they are discussing WordPress security and how one is their previous companies had to wipe everything "because a baddie broke their WordPress and shit"
Are these your sandboxes leaking out information that allows attackers to visibly fingerprint your environment and evade analysis?
This 🧵is a deep dive into this method and why I find it relatively primitive yet, elegant & efficient as a sandbox system bypass.
For those watchful eyes, they might have noticed the leaked information in the above screenshot is XML format of the entire system settings.
How much settings? 118,000 bytes worth detailing everything from Hardware, Firmware, BIOS, manufacturers, PNP devices, printers etc.
This information comes from Microsoft Windows System Assessment Tool aka WinSAT. It has been implemented since Windows Vista and can be read all about here:
PSA In the last week I have seen 3 examples of a relatively new strategy targeting telcos & iPhones of victims
With the increased measures against SIM Swapping, it seems attackers are switching over to 2 other methods to compromise phones
- Call Forwarding
- Parental Tools
Both attacks are similar in which attackers (likely related to Lazarus) are either social engineering telcos or using an insider at these companies to conduct these attacks.
In all of these cases it was leading up to ATO of iCloud and/or password managers
The call forwarding attack is relatively straight forward:
Attacker calls in telco and social engineers the operator to convince the agent to switch a line to call forwarding because of vacation.
The attacker then forwards the number to a VOIP number they control
So for all my followers who are wondering why TikTok is being investigated and potentially banned is because of several reasons heres a 🧵
A. they used data from their app to geolocate whistleblower journalists and physically go to their location
B. They violated policy on data
Harvesting by using their inapp browser instead of the supplied mobile browser, this obtains much more data than what is normally collected and it's shady practices
C. They have repeatedly been caught using methods that get information using your phones gyroscope and other
Sensors on the phone in order to locate you and track your location even without geodata and tracking enabled
D. they have questionable ties to the Chinese government even when they deny it. This is the same group of people that hacked many sensitive data repositories and