That DNS Nugget actually set up a lot of information,
a lot of understanding the concepts of exfiltration
techniques.
In fact, pretty much the rest of this content
throughout the skill is going to be following
a similar type of method or thought process
when it comes to exfiltrating data.
But it uses different protocols to do it at this point.
So what we're going to be doing in this Nugget
is talking about how we can leverage the HTTP protocol.
Now, if you've followed along throughout this playlist
and you've learned about how REST APIs work,
it's kind of the same thing.
We're talking about those HTTP methods WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're talking about those HTTP methods
and how we can provide payloads of data within the HTTP request
themselves.
Let's get going, talking about how the HTTP protocol works,
and how it can be used against us.
So that DNS exfiltration stuff, that was pretty cool
and a pretty creative way to exfiltrate data, right?
Well, here's the thing.
The DNS protocol was really only built
to do one thing-- send a query, get a response back.
But when it comes to the HTTP protocol,
that's the protocol that makes the internet work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's the protocol that makes the internet work.
It's not just about sending off a little bit of information
and getting a response back.
Now we can actually get and download files.
We can upload files.
We can create new data.
I mean, think about how you do all of your shopping online.
When you place an order for things,
you're sending your credit card information.
You're sending your order information out to the internet
using the HTTP protocol.
Using the HTTP protocol is actually
a really easy way for attackers to exfiltrate your data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a really easy way for attackers to exfiltrate your data.
And it's one of the most common ways
to see that that's happening.
It's a great way to see when you've
got indicators of compromise.
Again, this is where you would see things
like a cross-site scripting attack,
or where you would see things like a SQL injection attack.
So let's jump on the whiteboard and talk again a little
bit about how the HTTP protocol works,
and how it can be used against us.
So the idea, again, is that Bob's computer right here
has been attacked.
It's now been taken over by this malicious malware, or virus, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's now been taken over by this malicious malware, or virus,
or Trojan, or the bad stuff that's going on here.
And maybe it just so happens that Bob is a SQL developer.
And he has access to the SQL databases
where all of our corporate data live.
So the malware begins discovering what all resources
it has access to.
It may be trying to elevate privileges one more
time by trying to run everything as admin.
And at some point it realizes that it
can access this SQL database. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can access this SQL database.
The attacker here is now just salivating.
They're chomping at the bit, because they have access
to the corporate data.
They have access to maybe medical records.
They have access to maybe government secrets.
They have access to your corporate info,
like sales information, or upcoming products,
or intellectual property, like copyrights, and trademarks,
and things like that.
It's time for them--
before they hold it encrypted for ransomware,
they want to exfiltrate and steal that data for themselves. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they want to exfiltrate and steal that data for themselves.
We talked about one of the ways they could do it
by sending DNS queries with the data being encoded by base64.
But the HTTP protocol is way more robust and easier
to work with, because, again, it all comes back to APIs.
Did you watch the Nuggets on the APIs?
That's pretty important stuff when
it comes to using the HTTP protocol to exfiltrate data.
So now the attacker has a malicious server sitting out
here on the internet.
And what it really is is an API endpoint WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what it really is is an API endpoint
that is set up to receive data payload.
The malware begins running queries against the database.
It's running these gigantic SELECT statements.
And it's just retrieving as much data as it possibly can
from each one of the tables that exists in the database.
Then from there the malware can convert the table data
that comes back from the SQL database into JSON or XML.
Basically, what this is saying is
this is kind of like converting an Excel file into a text WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is kind of like converting an Excel file into a text
document.
That's basically the gist of what it's doing.
And then using the HTTP protocol,
specifically with the POST method-- remember,
we did talk about these in those API Nuggets--
it's going to post these JSON and XML documents
containing that SQL data straight
in to the malicious web server.
That's really the gist of it.
That's how the HTTP protocol works.
And that's the idea.
That's the theory behind this.
And this is why we call this a major indicator of compromise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is why we call this a major indicator of compromise.
When we start seeing read and write volume
skyrocketing on our database, or we see just the intensive CPU
load, or the disk IO load is starting
to skyrocket on the virtual machine that
runs our database in general, we know something is abnormally
happening on our database.
What we should then look is either on our web security
appliance or our firewall logs.
We should start looking at the volume of outbound data WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We should start looking at the volume of outbound data
and to what endpoints is it going.
We can even do PCAPs or packet inspections
to see what data is going outbound.
We should check those payloads to see
if we are exfiltrating data in the form of JSON or XML.
Again, because the HTTP protocol comes
with methods, like GET methods, POST methods, PUT methods,
and the DELETE methods, it is perfectly set up
to send and receive data using the HTTP protocol. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to send and receive data using the HTTP protocol.
And it can handle all of these payloads as part of it.
The web server knows if the incoming traffic
is going to be XML, or if the incoming traffic
is going to be JSON data, because that's
what's going to be listed in the header of the HTTP protocol.
And here's the real kicker.
When we look at a Wireshark capture of HTTP traffic,
what you see here, this is actually pretty much always
going to use HTTPS traffic.
Especially if the hacker is smart,
they're going to want to try and encrypt this data as it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they're going to want to try and encrypt this data as it's
flowing across the wire.
So even if you do a packet capture,
you can't see exactly what data is being captured unless you
have a next gen firewall that can do SSL handshake capturing,
and then decoding of the SSL traffic as it's going on.
There are firewall appliances that can do that.
It can capture the SSL and TLS handshake,
and perform decryption of the traffic
as it traverses the firewall.
So know that that is an option out there for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So know that that is an option out there for you.
But the big thing that you should keep in mind--
an eye out for is the amount of traffic for a specific protocol
and the destination.
If I see some very large packets that are constantly going from
one IP to the same destination and it's really adding up over
time-- it may even be choking out my bandwidth that I have
at the corporate uplink--
that may indicate to me that we have
some sort of HTTP exfiltration attack
that's going on right now.
So that's been understanding how HTTP can be used WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's been understanding how HTTP can be used
as an exfiltration technique.
I hope this has been informative for you.
And I'd like to thank you for viewing.