larsborn

Vor nunmehr 5 Jahren war die Zentralbank Bangladeshs Ziel eines Cyber-Angriffs. Die Akteure dahinter hatten vor eine Milliarde US-Dollar zu stehlen – einer der spektakulärsten Bankraube überhaupt.

Wir wissen alle, dass wir im Internet Spuren hinterlassen. Ähnlich verhält es sich mit bösartigen Akteuren, die einen Angriff durchführen. Wie beispielsweise den Angriff auf die Zentralbank von Bangladesh in 2016, einer der größten Bankraube in der Geschichte. Ich möchte anhand dieses Vorfalls beispielhaft einen kleinen Schritt im Vorgehen in der Cyber Threat Intelligence (CTI) skizieren. Dabei geht es nämlich nicht nur um Netzwerk-Indikatoren und Virus-Signaturen sondern darum, Angriff zu verstehen um sie besser abwehren zu können. CTI involviert die Bewertung von Informationen aus sehr vielen verschiedenen sowohl offen als auch verdeckten Quellen; sowohl mit technischen als auch mit nicht-technischen Mitteln. Die Ergebnisse solche Analysen sollen das Erreichen verschiedener Ziele ermöglichen: Eines davon ist, die Personen hinter einem Angriff zu identifizieren, die sogenannte Attribution. In diesem Vortrag werden wir uns nur auf den technischen Analyseschritt konzentrieren: ich werde das Open Source Tool Ghidra verwenden um live einige Komponenten des Angriffs durch Reverse Engineering zu analysieren. Dabei werden wir sogar schon einige Schlussfolgerungen über den Angriff und das Verhalten des Akteurs machen können. Ein wenig wie bei einer polizeilichen Ermittlung, nur das man Sie aus der Geborgenheit der eigenen vier Wände durchführen kann.

The NSA released a tool called Ghidra both for free usage as well as in source code format. It is a software reverse engineering framework with advance capabilities like a powerful decompiler. This lecture will give a short introduction into Ghidra and cover examples of both benign executables as well as malware with a focus on the Windows operating system.

Reverse engineering - more specifically software reverse engineering - is the process of deconstructing computer programs with the purpose of understanding their feature set. This especially includes software that is not available as source code but only as binary executables. These files can be analyzed by executing them, which is often referred to as "dynamic analysis" or by translating them into another language, like assembly, which the reverse engineer then tries to reason about. The second approach is often referred to as "static analysis". While it is - in principle - possible for a human to fully understand and statically analyze a binary by reading raw assembly, this approach does not scale well: The x86 assembly language for example - which is used in most desktop computers and servers - is made up of thousands of different instructions. Each of these instructions only performs a very small task, like adding two integers. One can imagine that a binary - even as mundane as a tool to list the current directory content - is made up of a large number of these instructions. In practice, the reverse engineering therefore heavily relies on tooling. The Vault 7 leak by WikiLeaks in 2017 suggested that the NSA owns or develops a reverse engineering tool called "Ghidra". Two years later, at the RSAConference in 2019, the NSA released the tool to the public, first as ready-to use software, then even all its source code. For the reverse engineering community, this is a huge thing: All tools available until that point in time where either very expensive or lack advanced capabilities. While this lecture will only cover executables for the Microsoft Windows operating system, Ghidra also supports a very wide variety of platforms reaching from ARM - used in many IoT devices - over DEX - for Android-based devices to more exotic architectures as PowerPC, MIPS or SPARC. This versatility is a huge pro for Ghidra when compared to its main competing software product like the Hex-Rays decompiler. A lot of people think, that reverse engineering is a dark art only a few selected individuals are chosen to be gifted in. I honestly think that it is just another skill and would even go as far as saying that maintaining a legacy software product without good documentation - which is a common scenario in the software development industry - is much harder than understanding how WannaCry worked.