Arguably the most basic exfiltration technique
that there is is to dump the data into a file,
and send it outbound.
But guess what.
That's also the most common exfiltration technique.
And we kind of talked about this a little bit
when we talked about indicators of compromise.
Look at that outbound traffic as it's going outbound.
Do we normally send 1 gig of data
outbound, but last night we sent 100 gigs of data outbound?
That's what we've got to look out for.
So in this Nugget what we're going to be talking about
is how email and FTP services can
be used against us to exfiltrate our data outbound via that way. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
be used against us to exfiltrate our data outbound via that way.
File exfiltration seems like another kind of obvious one.
In many different ways, it is kind of an obvious one.
I mean, this is going to be the easiest path for a hacker
in order to exfiltrate your data.
There's no manipulating DNS, or creating an HTTP
server at this point.
It's literally just, oh, there's a file.
I'm going to take the file.
That's the end of it.
So let's talk about how file exfiltration
could really be used against you in a real world scenario.
What we're talking about in this case
is the end user, one more time, has taken over Bob's computer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the end user, one more time, has taken over Bob's computer.
Bob is getting in a whole lot of trouble
these days, because they just keep
on clicking on links that they shouldn't click on,
or maybe they installed some Chrome extension
they shouldn't have.
You get the idea.
So what Bob's malware is doing this time
is it is now looking for not only a database,
but also a file share.
And this could come in the form of a mapped drive that
was applied via GPO.
I mean, that's a really easy way for hackers WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I mean, that's a really easy way for hackers
to find their way throughout the network,
because they could look at what are the drives that are already
associated to it that they learn when they boot up.
They get through the GPO process.
Next thing they know they've got a file share attached to them.
So they find their way into the file share.
Maybe it's because of the shared folder or whatever.
And they just start trying.
They start trying to explore what
are all of the different folders, and files,
and structures that I can access from this point.
So if Bob were to have a file share map to them that
was the accounting file share, or the HR file share, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
was the accounting file share, or the HR file share,
or the IT file share, because-- let's be honest--
there are plenty of IT shops out there
that keep all their usernames and passwords
in an Excel file on a file share that multiple users have access
to.
It just happens, and it's sad, but it does.
Now the malware is scanning through this entire file share,
trying to access each one of these folders,
and each one of these files, trying to see what they can do.
Beyond that, the same thing still
applies about the SQL server database.
Maybe Bob has direct access to the SQL server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe Bob has direct access to the SQL server,
or maybe Bob has an app installed on his computer that
writes data to the SQL server.
One way or another, Bob's computer has access to it.
So in the file share scenario, there's files.
They're just sitting there, and they're
waiting to be exfiltrated.
In the database scenario, we may be running SELECT queries
to pull the data out of the database,
and then write them to a CSV file, or an Excel file.
At this point, all the hacker has
to do is have a place to send the file. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to do is have a place to send the file.
This could be an FTP server, or an FTPS server,
or an SFTP server-- yes, those are three different protocols--
an SCP server, a peer-to-peer file sharing site,
or it could even leverage good old-fashioned email.
You can absolutely script the sending of files via email
using Python, or PowerShell, or any other scripting language.
So the hacker could potentially create a temporary folder, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the hacker could potentially create a temporary folder,
copy all of the files into that folder,
then execute a Python script that iterates over
each file in that folder, and sends it to an FTP server,
or to an email address.
Again, this all goes back to indicators of compromise.
We need to be looking for things that seem abnormal
on our next gen firewall, or monitoring solution,
or AMP for Endpoints needs to be looking
for all of these executions, these weird signatures, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for all of these executions, these weird signatures,
or these anomalies that are happening directly
on the computers.
So that's been how files can be used to exfiltrate
our data and our information.
I hope this has been informative for you.
And I'd like to thank you for viewing.