An exploration into the potential power of collaborative, mission-focused APT research groups

This post will be one of several that will reveal the origins of the investigation, research, and analysis group effort behind what has been .


The formation, vision, and strategy behind Starlight was a direct result of the and Intellectual Property data theft of vital technical information from RSA that forms the underpinnings of Authentication Frameworks used in thousands of companies and Government organizations worldwide.

(something you have , something you know PIN/PASSWORD) attempts to increase the attackers work effort when they want to in order to compromise protected data.  This data can be in the form of content portals, or even access to entire Internal sensitive networks.

When the was in the press, it shell-shocked the industry.  There was very little information in the public about the event.  Many industry experts simply fed off the news cycle, made predictions, or speculated.  The incredible thing however is the silence from the experts who should have had the most intelligence and data to share, research and discuss.  The lack of knowledge behind what malware was used, what IP/DNS infrastructure was leveraged, who else was attacked, who was doing the attacking, what where they targeting, and what tactics, techniques, and procedures were used to facilitate the attack were all lacking.  Many companies and individuals wanted the information to better protect their own networks, however where found to be lacking useful information to detect the same threat.

It was later revealed that the attack was a success, and the key intellectual property was obtained to engineer a technical circumvention / spoofing of a users authentication session when using a 2-factor method with the RSA Token.  A wave of attacks against in the Defense Industrial Base followed shortly after the RSA compromise confirming the mission of the Threat Groups.

Meet the other guy, across the pond, using his Shell, all up in your BASE, nomming on your data.

Antivirus and other security companies have incredible resources and sensor networks at their disposal providing a wealth of threat intelligence for those that seek to do the research, connect the dots and tell a story.   Sadly however many times that data goes undiscovered or unused, buried under a ton of other data, devoid of operational context which is so important these days when researching threats.

It is critical that you know what you are dealing with when handling a threat in your organization.  Is Nation-State espionage?  Is it CyberCrime?  Is it Hackivism, or simply a curious teenager.  If companies have not yet realized, the most potent threat to their long term survival is an estimated 15-30 voracious Chinese based Threat Groups that have been systematically and successfully pillaging America and its Allies systems and Intellectual Property since at least 2003.

Some of these groups are direct components of . Others are Chinese contractors or affiliates.  For those not familiar with the Chinese Government, it is tightly and intimately interwoven within the entire society.  In many cases it is hard to discern were Government influence ends and “Private” control begins.  However there is no doubt when it comes to the operational unit of a military branch where the orders come from.  The is to use its technical capabilities in Computer Network Exploitation, to , infiltrate, and steal any and all data that meets its intelligence tasking requirements for obtaining information related to is Military Modernization and Economic Growth objectives.

Over the past year, Government officials active and retired, congressmen, and security researchers have come out explicitly this to be the case.  They should know.  There is YEARS of  linking this activity to exact groups and individuals behind these activities.  The old tired adages of how ATTRIBUTION is too hard of a problem, and how its impossible to track the source of an attack are a RED HERRING in this industry.  Do not believe it for a second.  If your told that you are being lied to.  The abilities of Nation States to conduct Multi-INT intelligence analysis on threats is unparalleled.  This intelligence supports the missions of Counter-Intelligence, Law Enforcement, and provides data for Strategy and National Leadership Decision Making.

Future postings here will reveal many of the lessons learned through this experience.

It is my hope that it inspires the community of security experts, investigators, forensic professionals, incident responders, and malware analysts to recognize clearly that there is a dire need to come together as one to share their threat data, become educated on the specific technical threats and the groups behind them, and operate as a single unified entity in confronting the single most damaging threat to our future,  as “the greatest transfer of wealth through theft and piracy in the history of the world and we are on the losing end of it.”

I will conclude this post with the original email that I posted to a private research list, in which I issued a community call for action, a Paul Revere’s ride if you will.

Many highly intelligent and dedicated people across many industries and sectors heeded the call, and signed up for the effort.  They all did not seek glory or recognition for their efforts.  They recognized the vital need for a deeply collaborative effort that was mission focused with the goal of centralizing the collective APT knowledge each group member could muster for the aggregate benefit of all.  The process by which members where invited into the organization was based on a that many other groups use as a basis for membership.

The group formed a pact of anonymity with regards to their identities and affiliations.   They produced excellent work, in-depth technical research, and collaborated continuously and richly to the effort and mission.  This privacy will be honored in this and future postings.  Their contributions and dedication to the group made Operation Starlight a successful model for future collaborative efforts challenged with APT research.

Future postings will cover:

  • The dynamics of group formation
  • The challenges of cyber intelligence sharing
  • Targeting the right expertise for inclusion
  • Contribution of resources to the effort
  • Communication and content sharing mechanisms
  • The data that kicked the RSA investigation into high gear
  • The 3 Groups that attacked RSA and their malware / methods
  • Dealing with Press Inquiries
  • The challenges of dealing with Attribution Research
  • APT Malware Analysis and forensic artifacts
  • Timelining Zero Day Exploit Research in Embedded Attacks tied to China
  • Spearfish attack research and Shellcode Analysis
  • Network intelligence, DNS monitoring
  • Scaling and analysis issues with regard to information overload
  • Information organization
  • Threat Group enumeration and categorization
  • CyberWeapon attribution and naming challenges
  • Historical Threat Group campaigns
  • Victim Identification and Intelligence
  • Decoder development
  • Operational Monitoring
  • Disruption Operations
  • Novel and GroundBreaking Game Changing Strategies
  • Lessons in Crisis Management
  • Victim Notification and LE interactions
  • CyberThreat Overclassification
  • The Profit/Patriotism Conundrum and Ambulance Chasing
  • Big Data Mining
  • Smear Campaigns and Information Operations
  • and many other interesting topics

I hope you will enjoy my sharing of experiences and wish that it may inspire you to think differently about things with regard to APT research and how you can make a difference.  There is now a ton of open intelligence that any enterprising researcher can leverage to peel back the onion, connect the dots, and the come the definitive conclusion that our networks our undefendable, there is a desperate need for gamechanging strategies, and our Government is to constrained by policy and political will to do anything about the issue with regards to China until it is too late.

The communication and application of punitive severe consequences in the form of Economic, Trade, Financial pain combined with a massive tactical offensive cyber counter-attack on all CN APT CNE infrastructure, actors, and resources is partially what is needed to show that we mean business. Developing cadres of patrotic operation under letters of combined with the of a also .  This should be preferably done in close collaboration with our Allied friends that recognize that they too are under the same threats and have the will to do something about it.  If not, we might as well concede, and step back from our positions as the leaders of the free world.  I hope the Communist Party of China treats you kindly.

in the sand and denying it will not make the data leaving your networks slow down anytime soon.  We are a , however the and of  speaks volumes about our efforts to roll back the threat or even demonstrate an effective deterrence.

The email that started it all. (Click image to view entire email)

We had better collectively get in gear on this.  Someday lives will be  and we will be looking down the barrel of our own innovation and weapons…


March 27, 2011

No more echo chambers.

March 25, 2011

Well it seems like I have acquired something of a following, however it still seems like not many are interested in adding significant discussion or views to lend to the debate.  I invite any and all to post their thoughts and ideas, or make recommendations for research.

Twitter: diocyde


Malware has reached the point of overwhelming the collective average intelligence of the normal operator.  With a plethora of threats, and an infinate amount of possibilities and variations the complexity of such threats will eventually overwhelm the singular human cognition capacity.  This is why we have seen over the past few years the “dumbing down” of ability for AV protections which struggle to deal with tens of millions of samples a year and hundreds of thousands of signatures.  Lost in all the automated analysis is the digital nuggets of intelligence that are missed, or only noted in some obscure report with no operational context. 

One case in point is the clear chaos and confusion of the antiquated CARO naming convention for categorization and naming of malware.  EVERY single AV company does it differently.  No one can agree on a naming convention.  Names of bots/trojans are OBFUSCATED for pointless worthless reasons, adding to the confusion and noise level.  For example, our latest Adobe Flash O-day threat combined with targeted attacks.  F-Secure, after  launched in a highly targeted fashion by actors that are causing a tremendous amount of digital carnage, does its analysis of the exploit, and then decides to name the actual (digital weapon) payload some ridiculous name (Trojan.Agent.ARKJ).   Granted this name (dumbing down) has been going on for years, however when the context of important attacks increasing public awareness to such a high degree, the Tools and arsenal of threat actors should be made known to the general public.  One of the reason security response teams just sort of reimage and move about their business is that they have no ability to triage a really damaging threat unless they do a full static and dynamic analysis of it.

The APT threat group based in Shanghai Military Region Tactical reconnaissance Bureau that has been discussed in earlier posts has malware and malware analysis (for example threat expert) and Virus Total reports that link that specific malware and its evolution back to 2005!  Coincidently this is one of the threats that gets automatically analyzed and classified as blah blah Trojan/backdoor-DSG or whatever the stupid CARO implementation spits out.  additionally some malware is named but the name is a scrambled variant of the Author, the callback domain, the Victim, or some attribution string or mutex in the malware but for some reason AV companies feel its “important” to protect the privacy of malicious cyber actors.  This helps absolutely no one and serves to dissipate the tactical/operational/and strategic importance of a particular attack, as well as misdirect attention of the public away from the victim and the damage being done.  

The espionage attacks of Aurora/Ghostnet/Shadownet and others have not only popularized the naming of malcode but given it a tremendous amount of publicity and attention from researchers WITH the time to rip apart the code and possibly .  additionally its this kind of publicity that engenders the non-geek world to stand up and take notice that their lunch is getting eaten on a daily basis.  AV companies in the past decade and in the early days sought to take away the EGO tripping of virus writers by refusing to grant them infamy by naming a virus after then.  I say the times have changed.  I say that true attribution intelligence should be disgorged from the holder of it and attached like a stinking rotting corpse to the samples. 

Props to  for actually doing this by naming this latest Payload Trojan.Linxder after the Chinese CNE operators hacker handle.   Of course Fireeye is not a AV company per say but the days of just having AV companies is long gone as now everyone is in the cyber space vendor community and managed service sector.

Here is a challenge to Any Reverse Engineer / Malware Analyst / Cyber Intelligence Threat Analyst / or Security Researcher.

  • Go to Mila’s excellent  site
  • Download the excellent archives of 99.99% APT attack payloads
  • Discover the hidden nuggets of Attribution Intelligence
  •    that are used and write a small analysis of these findings. 
  • I will post them as a comment to this blog and I will approve them for review by the entire community.

There are tons of techniques that are being used, abused, and engineered that are enabling the horrible detection rates we are seeing today.

If the new rules of the road are that governments, militaries, and critical infrastructure, and commercial and non-profit organizations are going to be targets for the long term, we might as well serve ourselves by quit calling it APT and start calling it by its real name.  The actual units and operators that are responsible . 

If threat actors use highly customized code this is a Weakness.  This means that if a victim gets attacked with a specialized piece of espionage malware, its analyzed, dissected, and publicized, then other organizations can digitally investigate their own infrastructures looking for the same threat.  If they find it, they know they just got screwed as well.  This is called HERD Defense.  An attack on one member of the herd might take out an individual, but the rest of the herd is now alerted and on the defense whenever they see the same thing or similar.

RSA can start by giving us samples to analyze, and full disclosure briefing.

One of the things AV companies can do is start writing in depth public analysis reports/blogs about the bunch of malware threats that they see used in attacks on say 10 victims or less.  Thats where you find the gooodness. 

Take any random from Contagio.  See what kind of nuggets of intelligence you can glean from it, do your due diligence open source research and social network analysis, put your detective/investigator hat on.  And then ask your self why people continue saying they got pwned by the APT, instead of when instead they should just point to the bastards Baidu profile and Send him a little present as a token of thanks.

Thanks for getting added to the Pwned list.  Join the club.

One of the things that drives my research in relation to other technical research on malware that only tends to focus on the bits and the bytes is the fact that you can tell entire stories and interrelate seemingly disparate hostile acts of cyber aggression if you know enough and look long enough at the data right in front of you.

The concept of malware intelligence and connecting the dots after view many many samples seems to be under appreciated in the industry to a large extent.  Especially with AV vendors whose mission is to mainly focus on large prevalent threats and most of the Excellent stuff is never reported or just rubbed out of existence with ridiculous CARO naming convention names that mean nothing to the end user and speak nothing to the level of Weaponization of the malware nor its myriad of intelligence nuggets that can be found in its inner core.  Additionally where this information may be discovered, it is not correlated, shared, or discussed in the open.  The actors and organizations are given free reign to act in the shadows due to the fact that no one is actually pointing a finger in their direction and putting heat on them.  This is additionally true in the cybercrime area of malware development where many may know the actors responsible or behind networks however keep it private.    This only enables the sorry state of our situation where the game has completely changed and a tipping point (actually we are way past that) has occurred.  The ground has shifted under our feet and we are still not gauging how serious things are occurring.

GAMECHANGER: I am proposing that industry luminaries come together to create a highly technical Malware Intelligence Fusion Center with the express goal of bringing the special weaponization techniques to light and out in the open.  Identify and correlate the myriad of slipups that hostile actors use that can enable attribution whether it be embedded payload metadata, unique encryption, shellcode specifics, payload pedigrees, TTPs of hostile actors, and then tie these back to multi-INT sources of open source intelligence thus creating threat dossiers that can be leveraged for real world actions.

These cyber actions are done precisely because there is NO risk of consequence, They can operate in the dark because the industry allows them to.  They fail to focus on the fine technical details that might actually connect the dots and draw a bigger picture, then use that knowledge to force a change of behavior.   The numerous denials from various Foreign Ministers about how they would Never ever do these things is on its face wholly ridiculous, however when challenged after each attack, the victims simply let it go, they do not aggressively push for results, demand a change in behavior, or impose consequences collectively or individually.  Most will simply write up a small malware analysis report, not the C2 IP address for (blocking purposes) which is completely worthless and holds NO worth whatsoever in cyberdefense now as we speak.  Then they will post it somewhere and occasionally it will get referenced when next attack occurs.

The collective talent in the security and AV space is staggering, however with all that brain power not a single group or entity (save for possibly Mandiant) has truly tackled and provided a real Cyber Espionage Malware Intelligence capability that is worth much of anything.  If countries want to do the malware espionage game, then they will have to up their game and not get caught, or else all their information is identified and captured and made available to the community for the purposes of collective defense.  (think water buffaloes rallying around and protecting themselves when a pride of lions enters the area)

One of the problems is that much of this is done sort-of effectively in the military/intelligence space, however its pretty much akin to a group of lords and ladies all protected behind big stone walls while the barbarians ravage the countryside and pillage the peasants and merchant class.  This is Exactly what is occurring today, however the fallacy is thinking that the lords and ladies behind the walls are actually safe.  They are not.  They are under concerted siege, and only discovering the rotting diseased corpses that have been placed in the wells, and catapulted over the walls at night, and the assassin insiders that manipulate and kill from within.   Cyber espionage is at a risk of being over popularized to the point where now people hear of a major breach, roll their eyes and say O man not again.  O well.  It happens a lot and then proceed to blah blah about how they should have been secure.

Why has the public discussion not turned openly hostile, demanded action, demanded answers and started act in a more active defense posture towards this?  Currently there is very little open academic or public debate on the benefits of aggressive self defense.  I will say that the latest video where this poor fat kid is just getting the crap punched out of him by a sadistic yet smaller little bastard of a kid.  The fat kid finally say @#$@# and grabs the little pissant, heaves him up in the air and .    The bully then proceeds to do a ridiculous “I just got knocked the F&(k out!” wobble and the bullied kid walks away.

This should serve as a nice inspiration for an example in active defense but I doubt many think its time to work on these things.

My main purpose for this blog was to infect the blogosphere with memes’ and concepts to modify the way things are being done today in the realms of cyberwar/conflict and the sorry situation we are in.  I have proposed game changing concepts that seem to be so actively sought after by organizations like DARPA and NIST as well as others.   Based on the types of organizations that have actively followed this blog, I would say that some of the content has influenced actions or ideas and maybe just maybe planted seeds, where we can pivot from the old and emerge stronger and more active into the new paradigm we find ourselves in.

Many have inquired about the various sources of some of my previous posts.  You can piece together much of the cyber espionage program by researching a variety of sources such as ThreatExpert / Security research on zero-day exploits where they cover not only the embedded attacks, but analysis of the payloads, deep technical analysis on contagio’s web site samples.  Combine that with reports to congress on China, James M’s excellent reporting on behalf of NGC, Topical reports from InfoWar Monitor on GHOSTNET/Aurora/Nightdragon and others, as well as the Excellent malware analysis reports that where exposed due to HBGary’s colossal fuckup revealing new victims as well as in depth malware analysis reports from the targeted and thoroughly compromised Qinetiq organization that works in cyber defense,  Tieing that to the revelations of Wikileaks which exposed methods and code names and past attacks and timelines, along with the excellent reports that Mandiant puts out, and you can easily combine it with the full bevy of open source social networking research to make and tell a wonderful fact based story and connect the dots.  The fact that attackers suck so much at their job (or don’t care about operational security) or that we are just so good and putting the pieces together makes for interesting days.

We shall see how the RSA thing pans out, however there are more “invasions” BTW that’s what China calls computer intrusions…. than you can shake a stick at and we and our allies will be doing post mortem until the cows come home.  In the mean time those little bastards will continue to steal our data on the hosts You Are not looking at.

Typically from a cyberdefense standpoint 2 – factor authentication is the way to go.  Well  in its that our adversaries have effectively developed, operationalized and used successful attacks against our Governments Smart Cards, commonly known as the for DOD and PIV for Federal agencies.    I would have to imagine this is highly damaging, embarrassing considering millions and millions of dollars and years of development has been put into the effort for over the last decade.

The irony is that the Federal Government hasnt even rolled completely out these capabilities for agencies, leaving these safeguards as optional for implementation until recently.  Really??

Either way, their are pwned now.  Users are attacked at home while they use their cards, and attackers are alerted and ride the session in to steal the data from Smartcard protected portals.   A Significant effort must have been initiated to circumvent these controls.    This is known as a Smart-Card Proxy attack.  In order to work with the card reader the attacker would have required reversing knowledge or and then wrote code to hook and issue call functions to the vendor software.  They would have also had to to undermine the chain of trust.

BTW soft certificate stealing is par for the course in APT malware so if you think about using them or extracting them to disk with the private key installed then your doubly screwed.  Either that or they will hook all the certificate processes in Windows and dump the private keys/passphrases from there, or get the PINs from normal keystroke logging.

The only vendor that truly makes this software is   So much for their Tagline “Establishing Trust in Online Identities”,,,,

I will reprint the article here since its just so dam scandalous.

The US government has been stepping up its use of smart cards to help lock down its computer networks, but hackers have found ways around them.

Over the past 18 months, security consultancy has come across several cases where determined attackers were able to get onto computers or networks that required both smart cards and passwords. In a report set to be released Thursday, Mandiant calls this technique a “smart card proxy.”

The attack works in several steps. First, the criminals hack their way onto a PC. Often they’ll do this by sending a specially crafted email message to someone at the network they’re trying to break into. The message will include an malicious attachment that, when opened, gives the hacker a foothold in the network.

After identifying the computers that have card readers, the bad guys install keystroke logging software on those computers to steal the password that is typically used in concert with the smart card.

Then they wait.

When the victim inserts the smart card into the hacked PC, the criminals then try to log into the server or network that requires the smart card for authentication. When the server asks for a digital token from the smart card, the bad guys simply redirect that request to the hacked system, and return it with the token and the previously stolen password.

This is similar to the techniques criminals have been using for several years now to get around the extra authentication technologies used in online banking.

Mandiant is the kind of company that businesses and government agencies call to clean up the mess after they’ve been hacked. It has done investigations at about 120 organisations overt the past year and a half. Most of them get hacked via a targeted email. But in many cases, they were actually hacked years earlier, but never managed to remove the malicious software from their network, according to the report.

Companies or government agencies that assume that they are secure just because they use smart cards to authenticate, could be in for a nasty surprise some day, said Rob Lee, a director with Mandiant. “Everything is circumventable in the end,” he said.

As if that were not enough, they are also using Social Networking for C2 including MSN and Google Chat and MSN. 

Funny how AV companies are really quiet about all this novel capabilities.  My dime is that they are sitting untouched in those massive Malware repositories they have.  Maybe if the drop all their Allapple/Virut/Sality samples they could see the forest for the trees.

Any knowledgebase is only as good as the collaborative work that is entered into it by the hardworking and pioneering analysts that currently research new malware tactics, techniques, and procedures.  I will be issuing this invitation to reversers and analysts that I have respected and read about while doing my research.  It is my hope that a small portion of these researchers will accept this role and help guide the open source generation of the worlds largest malware DNA knowledge base.

Here is the list in no particular order: 

  • Phil Wallisch – HBGary
  • Lorenzo Kucaric – Crucial Security
  • Michael Troutman – Crucial Security
  • Nick Harbor – Mandiant
  • Jorge Mieres
  • Tom Liston
  • Giuseppe Bonfa (Evil Cry)
  • Frank Boldewin
  • Alex Lanstein – Fireeye
  • Atif Mushtaq – Fireeye
  • Julia Wolf – Fireeye
  • Dider Stevens
  • Paul Royal
  • Danny Quist – Offensive Computing
  • Marco Cova
  • Ero Carrera
  • Joe Stewart – SecureWorks
  • Anushree Reddy
  • Dancho Danchev
  • Peter Kleissner
  • Ivan Kirillov – MITRE MAEC
  • Dr. Michael VanPutte – DARPA Cyber Genome

This list is not complete, and will be enhanced based on recommendation from other analysts and researchers.  There is also standing invite to all AntiVirus community researchers that do this for a living and have seen these techniques and tricks for years, yet have never had an effective way to communicate these traits in a standardized fashion.  Now here is your chance! 

Post a reply here if your interested in being on the board.

This is a test of a development prototype for the identification and submission of Malware DNA Traits into a centralized Knowledgebase.  This will be a collaborative industry effort.  The industry has recognized and validated the need for this.  There are several excellent groups that are adopting the concepts of malware DNA.  Here is a sampling.  The fact that pools of research money have been and are still being put into solving this problem, especially under DARPA, demonstrates how challenging a realization of this will be.

  • HBGary – feature in their Responder Pro – Live memory analysis toolset
  • Harris Corp. – - Digital Genome Sequencing Methodology
  • MITRE –
  • IEEE Standards Association – (blog post and )
  • Defense Advanced Research Projects Agency (DARPA) Strategic Projects Office – –

Excellent Antipacker site

December 16, 2008

F0und a cool little site from a crew called Team Furry that has excellent resources on Packer reverse engineering called .



Get every new post delivered to your Inbox.