Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/20/2015
11:44 AM
John Strand
John Strand
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

Introducing ‘RITA’ for Real Intelligence Threat Analysis

SANS' free, new framework can help teams hunt for attackers by extending traditional signature analysis to blacklisted IP addresses and accounts that have multiple concurrent logons to multiple systems.

There is often a huge disconnect between what attackers do and what we as defenders do to detect them. There is currently a huge push to develop better and better indicators of compromise (IOC) or better threat intelligence. But if we sit back and think about these advancements in security, it becomes clear that we are still stuck in the process of trying to build better and bigger blacklists, still stuck believing we can somehow define evil away by building systems to find and neutralize it.

This will not work. 

We continue to look for the easy button. We continue to seek out automation of our security infrastructure. 

This will not work.

The reason these things will not work is because our defenses are static and accessible to all. All it takes is for an adversary to acquire these technologies and figure out how to bypass them before they sling a single packet at your network. This is one of the key reasons we work so hard to develop active defense approaches. But active defense will only go so far.

There is a new development in security called "hunt teaming." This is when an organization puts together a team of individuals to actively look for evil on a network. It takes some big assumptions on the part of the defenders. The first is that security automation has failed somewhere. The second is that existing technologies will not be sufficient to find the bad guys. Even more critical, "hunt teaming" requires a fundamental shift in how we approach detecting attacks.

Traditionally, our approach has involved a set of simple signatures. For example, one of Black Hills Information Security's (BHIS) tools, called VSagent, hides its command-and-control (C2) traffic into __VIEWSTATE parameter, which is base64 encoded.  Further, it beacons every 30 seconds. Unfortunately, attackers can easily modify the backdoor to bypass any simple signature you throw at it. It also represents many of the nasty C2 techniques we have seen over the past few years.

A new framework for hunt teaming
How then, should we approach malware like this? The question asks us to not just look at individual TCP streams but rather look at the communication as it relates to much larger timeframes. To help with this, SANS has released a free new tool, Real Intelligence Threat Analysis or (RITA). (Note: The password for the ht user account is !templinpw! Because it is in OVA format it is portable to other VM environments.) 

Currently, there are a number of different frameworks for pen testing, like Metasploit, SET, and Recon-ng. The idea behind RITA is to create a framework that it is extensible; it allows people to continuously add additional modules to it.  

Let’s take a few moments and walk through the current modules in RITA.

  • First, to start RITA we just need to fire up the run.py script in the /home/ht/Documents/RITA directory.
  • Then, open a browser and surf to http://127.0.0.1:5000.
  • Next, we are going to enter an example customer where the example data is stored on this VM:

The beaconing module will use Discrete Fast Fourier Transform (DFFT) to move the connections leaving your network from the time domain to a frequency domain.

Why? When we think about events, we tend to think of events as a series in time. When we look at things, it’s in terms of first, second, and third. However, we can also look at time in terms of frequency. For example, if we have connections connect at regular intervals, it will show up very clearly as a DFFT. So, when we run this module it will create graphs showing likely beaconing behavior.

Detecting a two-second beacon
The graph below shows a two-second beacon. This means there is a detectible frequency of two-second intervals between two hosts. This type of signature analysis is very difficult on standard security devices like IDS and IPS.

But we can go further. We can also look for systems connecting to blacklisted IP addresses, potential scanning behavior, long duration connections (good for data exfiltration), and accounts that have multiple concurrent logons to multiple systems. 

The beautiful thing about RITA is that the data can be exported to the desktop, but can also be visualized via Kibana. For example, if you run the concurrent module, this module will show all accounts which are logged in concurrently to multiple systems. This is great for detecting lateral movement. By running this module, it will run the module and load the data into Kibana for visualization. (To see the results, you’ll need to select the results tab at the top.)

To load some results, you start by editing the time it reviews in the upper right hand corner.  It should say “Last 15 minutes.”

  • Then, select “Last 5 years”
  • In the middle box, type “result_type=”
  • It will show you some autocomplete some options 
  • Select result_type=concurrent
  • This will show the systems with multiple concurrent connections

As you will see, the targetUserName of Fire_Phreak is logged on to multiple systems at the same time. That should give you a first start with the RITA VM.  Good luck!

John Strand is a senior instructor with the SANS Institute. He teaches SEC504: Hacker Techniques, Exploits, and Incident Handling; SEC560: Network Penetration Testing and Ethical Hacking; SEC580: Metasploit Kung Fu for Enterprise Pen Testing; and SEC464: Hacker Guard: ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industry’s conventional wisdom. Here’s a look at what they’re thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16246
PUBLISHED: 2019-12-12
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
CVE-2019-17358
PUBLISHED: 2019-12-12
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP ...
CVE-2019-17428
PUBLISHED: 2019-12-12
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
CVE-2019-18345
PUBLISHED: 2019-12-12
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrat...
CVE-2019-19198
PUBLISHED: 2019-12-12
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.