And before we get into our examples, I do want to hit on the major differences between Deep Packet Inspection and Antivirus Evasion to kind of wrap up our last skill and start getting into the examples for the one that we're in right now.
And as we fix the screen here, what we're taking a look at is Deep Packet Inspection. And what are we really focusing on here in terms of Deep Packet Inspection?
Well, first of all, command and control, that C2 communication going from the pentester into the actual network and back to the pentester or malicious person.
So beaconing patterns or data being transmitted to and from an actual pentesting system.
Now, we also see other things, too, like SQL injection strings inside of HTTP packets. And this is just a way for me to be able to put a bullet point here of malicious strings inside of requests is another way to put this.
But if I figured if I put that there, I'd remember it better.
So we're looking for data that goes back and forth that isn't really formed to be proper for the request that it's actually supposed to be making. Things that were like long string requests that we know that aren't supposed to exist.
And then malicious headers or malformed packets. Now, I have an example here like the ping of death. And this is really for those older folks out of my generation.
Because as much bandwidth as we have on the internet today and on the different internal networks, you really shouldn't get a ping of death.
That's the old school denial of service by sending crafted ping packets that were so big that it would knock dial up off the internet. And some of you may be asking what is dial up.
But we can focus on malicious headers and malformed packets in terms of being able to go into previous skills in this course and make modifications or look for modifications inside of the few couple of headers of our actual packets going in and out of the network.
We've already seen how we can do SSH tunneling in previous skills. And that's just one measure to be able to craft silly packets to go back and forth to evade different detection devices out there.
And deep packet inspection allows us to be able to go through and find them.
So, then we have tunneling signatures. Now, the reason I included this in the actual list as well, too, because deep packet inspection allows us, looking through the eyes and glasses of a security administrator, allows us to be able to see if anybody is trying to circumvent the actual network security within our organization.
Whether it be by accident or on purpose, what we're looking for here is connections to VPNs, IPSec tunnels, anything that leaves outside of our network and connects to another network virtually in a different location on a different piece of network.
Now, I have here detected SSH traffic over port 80, and that's kind of me hitting on previous skills where we were doing tunneling.
And the reason that you do tunneling is because through encapsulation and through encryption, you can avoid deep packet inspection.
So, this is a method for us to be able to evade some of those detection methods to be able to get our data in and out of the organization.
Well, where does this differ from antivirus or endpoint protection like antivirus or anti-malware? I'm glad you asked.
The reason that we use antivirus and anti-malware for endpoint solutions on the systems itself is because once that data has traversed the network and on the individual system, we're looking for known hash values and malware binaries, kind of like we did in the previous deep packet inspection skill.
And this allows us to be able to see if there's anything already known to the rest of the world out there that we should really be on the lookout for.
Like, is it in virus total? Is it in our definitions? And I'm going to be touching more on definitions here in just a moment.
But we can also take a deeper look at the packet once it's been opened up in case it has been encapsulated or encrypted.
We're looking for things that are suspicious, like API calls. And inside of the parentheses there, I have a Word document trying to launch PowerShell.
Now, this isn't exactly what we've done in previous skills, but what we have done are macros and sign-up office applications.
And yes, we can invoke PowerShell from Word. And if we were to do that, to try to run a PowerShell script, it would run at the permission of the user that's invoking that Word document and then PowerShell.
So if it's a local administrator, game on. If it's a standard user at home on a standard operating system, pretty much administrative rights most of the time, so still game on.
And even if it's just a regular user, we could use that pivot point to be able to go through and find a potential way to enumerate user information if they're on a domain. Game on.
And lastly, we talk about memory injection techniques. And I'm going to have a skill dedicated to memory exploits here in a couple of skills after this one.
But what we're really kind of hitting on here is the infamous Knot Sled and very similar activities.
Because that packet, once it makes it all the way through and forms up with all of its buddies in the playground, then they can get together and gang up on the actual memory or application of a system and start putting in commands and injecting them into places they shouldn't be.
And we've already covered Knot Sleds and how that can allow a malicious actor or a pen tester to go in and inject commands whenever the memory doesn't necessarily have the proper addressing.
And it's when the data and file is on the actual endpoint system when stuff like this takes place.
So that's really the big difference between deep packet inspection and antivirus on the actual endpoint or anti-malware.
Again, just kind of wanted to close that chapter. But you may be wondering, what about the signatures that are developed to be able to figure these things out?